Governance, Telemetry & Neutrality

Layer 6 is the control plane and the nervous system of the stack.

Everything below it—hardware, comms, distribution, identity, proofs, settlement—can drift, centralize, or quietly break without anyone noticing until it is too late. Layer 6 refuses to let that drift remain invisible. It insists that:

• Neutrality (no favored flows, no hidden house edge),

• Repression-resilience (still works under capital controls and censorship), and

• Verification economics (VerifyPrice, VerifyReach, VerifySettle)

are service-level objectives (SLOs), not marketing copy.

“No Dashboards, No Trust”: Public SLOs as Constitution

Most protocols ship documents called “constitutions.” In practice, the real constitution is whatever you cannot silently violate without getting caught.

For this stack, the constitution is:

• a set of SLOs on triad capacity and neutrality, plus

• a set of dashboards and receipts that make violations obvious.

Examples:

• “p95 VerifyPrice for canonical workloads stays below $T$ seconds on commodity hardware.”

• “Top-N prover/LP/router share remains below $X\%$ by hashpower/FLOPs/liquidity.”

• “BTC$\leftrightarrow$XMR corridors achieve $\geq 95\%$ success with no protocol-attributable loss.”

• “At least $K$ distinct jurisdictions and hardware profiles are actively verifying.”

These are not just operational goals; they are the monetary invariants. Layer 6’s first job is to publish and maintain these SLOs as public contracts.

Control Surfaces: Parameters, Upgrades, Emergency Powers

Every protocol has knobs. The question that decides whether it is a constitution or a clique is not which knobs exist but who can turn them, with what evidence, and how visible the turning is. The second job of Layer 6 is to inventory the control surfaces — to name the knobs, then bind each one to a proposer, a ratifier, a data requirement, a delay, and a rollback path. A knob that is not on this list is not governed; it is somebody’s private steering wheel.

The knobs come in three families. Economic parameters are the ones that touch money directly: block reward curves and Work Credit issuance schedules, fee policies (floor, burn, and the split between security and dividends), and PoUW weighting across workloads. Technical parameters shape what the network will accept: circuit versions and proof-system parameters, additions and deprecations to the accepted hardware profiles, and corridor policies such as timelocks, refund windows, and anonymity thresholds. Operational parameters govern the watching itself: telemetry granularity and reporting requirements, incident severity levels and response playbooks, and key ceremonies with their quorum sizes. The families differ in blast radius, which is exactly why they are enumerated separately rather than dumped into one list — issuance is not incident management, and pretending they are the same class of decision is how emergency powers leak into monetary policy.

For each surface, Layer 6 specifies: (1) who can propose a change, (2) who can ratify it, (3) what data must be presented, (4) what delays and rollback mechanisms exist, and (5) which changes are “emergency powers.”

Bell-Labs-Style R&D vs. On-Chain Governance vs. Off-Chain Norms

There are three governance “forces” that need to be reconciled:

1. Bell-Labs-style R&D. A research org with autonomy to explore new circuits, proof systems, hardware profiles, and corridor designs.

2. On-chain governance. Voting weighted by governance weight (defined in Chapter 25: Layer 6: Governance & Telemetry: time-locked base asset, never Work Credits), with parameter changes baked into protocol logic. Work Credits are excluded from the franchise deliberately: they retire on redemption, so a Work-Credit electorate would be a rolling census of whoever has not yet consumed their service, and a prover could vote with credits it sold against its own capacity that morning.

3. Off-chain norms and institutions. Foundations, labs, dev collectives, and community norms.

Layer 6’s thesis is not “pick one.” It is:

Use Bell-Labs-style R&D to discover, on-chain governance to ratify and constrain, and off-chain norms to fill the gaps—but keep all three under telemetry.

Concretely:

The R&D lab:

• Maintains public roadmaps and risk registers.

• Publishes upgrade proposals with quantified impacts on VerifyPrice, VerifyReach, VerifySettle, decentralization, and hardware profiles.

• Runs testnets and shadow deployments.

On-chain governance:

• Controls scarce resources: issuance, reward splits, canonical workloads, acceptance/deprecation of proof systems and hardware profiles.

• Is bounded by constitutional SLOs: certain changes are simply not allowed if they push metrics beyond thresholds unless higher-order safety processes trigger.

Off-chain institutions:

• Operate under public charters that explicitly state their mandate and constraints.

• Are expected to publish minutes, risk assessments, and incident reports.

This three-body system is inherently unstable; Layer 6 keeps it from drifting into pure plutocracy or pure priesthood by insisting that all three bodies are visible in telemetry:

• Changes in code and parameters appear on-chain.

• Lab work appears in open repos and benchmarks.

• Institutional decisions appear in charters, public calls, and reports.

No dark corners; no “just trust us, we’re the stewards.”

Governance Capture Risk

Token-weighted governance creates capture risk: large holders can centralize control over issuance, fee routing, and telemetry rules. The stack mitigates this through hard constitutional constraints that governance cannot override (see Chapter 25: Layer 6: Governance & Telemetry), timelocks on parameter changes, independent measurement infrastructure, and non-governable red lines (Chapter 30: Risk Analysis & Failure Modes). If governance can alter issuance, fee routing, or telemetry rules without hard constraints, this is itself a red line.

Governance as SLOs: The Five Invariants

Governance and operations exist to keep one invariant true under stress:

Pay the machine only for work anyone can verify cheaply—and give humans lawful privacy by default.

Everything below—roles, metrics, runbooks, and legal posture—turns that sentence into procedures, with receipts. Where policy pressure rises, the system defaults to measurement and non-custodial design rather than new gatekeepers. “No dashboards, no trust” is not a slogan; it is the rule for deciding when the system is still safe to treat as money.

Governance and operations are about what happens when the world pushes back. They are the difference between a beautiful mechanism that works in a friendly lab and an actual monetary substrate that survives YCC (yield-curve control), capital controls, app-store bans, and “secure enclave” mandates.

The protocol’s “constitution” reduces to five invariants:

1. Verification asymmetry, by modality. The invariant is stated in the modality terms of Chapter 22: Layer 4: Truth & Work, because the aggregate ratio does not protect the property the monetary claim needs. Three clauses. (a) The M1+M2 share of verified units — the fraction of the network’s verified output whose correctness anyone can check cheaply — stays above a published floor, and that share is reported as its own series on the Value Capture Board (Chapter 26: Extended Telemetry). (b) Each canonical workload’s $r(W) = v(W)/p(W)$ stays within its modality band: $\leq 10^{-3}$ for M1 SKUs, $\leq 10^{-2}$ for M2 SKUs with the soundness parameter published beside the ratio; M3 SKUs carry no $r(W)$ target because the ratio is not their operative quantity. (c) The aggregate $r(W) \leq 0.3$ is retained only as a portfolio-level engineering floor for workloads not yet assigned a band, and no monetary claim reads on it. The Sev-1 condition reads on clauses (a) and (b): the M1+M2 share falls below its floor, or a banded workload’s $p_{95,t}$ breaches its constitutional VerifyPrice SLO (Chapter 22: Layer 4: Truth & Work) for the published window. A workload drifting above $0.3$ is an engineering incident, not a monetary one; a single threshold such as $r \leq 0.3$ is the tempting place to put the economic hinge, and Chapter 22: Layer 4: Truth & Work shows why it is the wrong one.

2. Open admission. Anyone who brings correct work clears. Admission is not gated by identity, licensing, or proprietary hardware. Routers are neutral and open-source; house share and time-to-first-fill for new provers/LPs are visible on the Neutrality & Admission Board. If honest new entrants cannot join and get paid within a bounded window, decentralization is already drifting.

3. Useful-work security budget. Block rewards and fees underwrite useful work—MatMul-PoUW, verified inference, provenance and settlement proofs—under explicit SLAs. The security budget is tied to canonical workloads with published VerifyPrice rather than to a puzzle with no external buyer. That is a deliberate trade and not a free improvement: a work function with a buyer has a demand curve somebody can move, which is the objectivity a buyerless hash puzzle gets for nothing (Chapter 34: Objections & Responses).

   Inference Verification Tiers and WC Eligibility: Under the “AI Money” analytical lens, inference Work Credits remain service claims. To prevent weak spot checks from being marketed as high-assurance verification, workloads are tiered by verification strength:

   Tier	Verification Type	WC Eligibility
   Tier A	Cryptographic (full ZK)	Full eligibility (1.0$\times$)
   Tier B	Probabilistic (bounded error, audited)	Discounted (0.6$\times$)
   Tier C	Attestation-only (TEE + sampling)	Service-grade only ($0.3\times$); collateral-ineligible

   Inference verification tiers and WC eligibility.

   Rule: Tier A and Tier B verified inference are eligible for full and discounted Work Credit issuance respectively; Tier C mints service-grade credits at $0.3\times$ that are ineligible as collateral (Chapter 22: Layer 4: Truth & Work). Tier B issuance is discounted by a published issuance weight (the $0.6\times$ of the tier table in Chapter 22: Layer 4: Truth & Work) reflecting error bounds and audit rate — a weight on what is minted, not a haircut on what is pledged. Tier C can exist as a service market but is not collateral-grade—it represents trust in TEE vendors, which is exactly what the thesis aims to minimize.

4. Lawful privacy by design. Settlement is neutral and non-custodial by default—adaptor-sig atomic swaps, shielded pools, privacy rails—but comes with viewing keys and auditable PIDL receipts so law-abiding users can evidence obligations without re-introducing chokepoints. The Settlement & Privacy Board reports swap success, refund safety, and anonymity-set health; flows that never touch custodians should still leave enough receipts that auditors can do their jobs.

5. Verifiable machines at Layer 0. Canonical proving and attestation paths run on open designs with sampled supply chains; hardware attestation becomes one input to proofs, not a vendor priesthood. Hardware profiles, lot-sampling coverage, and profile incidents show up on the Hardware/Layer-0 panes of the boards.

These invariants are hard to change and easy to measure. Everything else—fee curves, circuit versions, work-function parameters, corridor lists—is configuration.

To keep configuration from degenerating into a governance circus, changes are tied to observable triggers instead of vibes:

• If VerifyPrice p95 for a workload $W$ drifts above its target band for a sustained window, that workload’s circuit and parameters are queued for revision. Blocking the change requires an explicit override that cites alternative SLOs and appears in the governance log.

• If entry latency for new provers/miners/LPs rises beyond a threshold, or the top-N share and house share breach caps, neutral routers automatically ratchet down house share and prioritize small bidders until the metric recovers.

• If a swap corridor records a protocol-attributable loss — a party with no no-loss exit within $\tau_C$ (Chapter 23: Layer 5: Value & Settlement) — in VerifySettle, that corridor is marked advisory-delisted in the published route table: default clients stop routing to it, and any client may override the advisory with a visible flag. A hard removal that clients cannot override requires the breach to be reproduced in the public regression suite. Re-listing requires the suite to pass (including stress tests) plus a public post-mortem. User-liveness failures do not trigger this path; they are published under their root-cause class.

In this frame, “governance” does not micromanage every adjustment; it writes the SLOs and the triggers. Operations enforces them and publishes the receipts. Most changes are data-driven roll-forward: parameters evolve in response to Verify* drift, with clear before/after numbers.

To keep rule-making separate from rent-collection, two broad roles are distinguished:

• A spec & telemetry steward that publishes ABIs, PIDL schemas, canonical workloads, hardware profiles, and the VerifyPrice/Reach/Settle dashboards. It does not run routers or take custody. Its mandate is to keep the bill of materials and metrics honest and up to date.

• Market participants—miners, provers, routers, corridor LPs—who compete on price and reliability under those public SLOs, with SLA escrow and slashing keyed to PIDL receipts. Their incentives are economic; their constraints are the invariants and metrics.

This “two-chamber” structure keeps the job of defining rules and SLOs distinct from the job of selling capacity under those rules. It avoids the familiar pattern in which the entity that can edit parameters also happens to own the biggest fleet of nodes.

Governance as SLOs, not personality, is what lets the system answer policy pressure with dashboards and runbooks instead of press releases. When asked “how do you survive X?”, the right answer is not “trust the foundation,” but “look at this board, this trigger, and this incident playbook.”

Constitutional Enforcement

“SLO-bounded governance” is only credible if the enforcement mechanism is specified.

Machine-Enforced Constraints (Hard)

Certain invariants are enforced on-chain or in protocol code:

Machine-enforced constitutional constraints.

The house-share cap is not machine-enforceable without an identity assumption.

A router contract that “rejects bids exceeding share” sounds enforceable. A router can only reject a bid it can attribute, and attribution to a house requires knowing which provers are the same party — a Sybil-resistant identity that Layer 3 deliberately does not provide for market participants. Without it, a cap on house share is a cap on the share of any single key, which an operator satisfies by running more keys. The cap therefore belongs to telemetry-and-slashing rather than to the hard table: house share is estimated from receipt correlation (co-location, timing, shared FCR references, shared stake sources), published on the Neutrality & Admission Board with its estimation method, and a router whose estimated house share exceeds the cap is slashed and de-prioritized by the trigger of Chapter 25: Layer 6: Governance & Telemetry. If a future Layer-3 design supplies Sybil-resistant operator identity, the cap can return to the hard table with that assumption stated in the row. Common control among operators is the same problem one level up: receipt correlation sees shared infrastructure but not a shared owner, so legally separate operators that answer to one controller can read as several houses, and the control overlay of Chapter 26: Extended Telemetry supplies the ownership, contract, and creditor evidence that correlation cannot.

Override Path (Slow, Expensive)

Some constraints need flexibility. The override path is deliberately expensive:

• Supermajority: $\geq 67\%$ of governance weight, defined as base-asset units voluntarily time-locked for the vote’s duration plus the override’s timelock, weighted linearly by quantity and capped per address family at the Red Line 8 concentration threshold. Work Credits carry no governance weight (Chapter 25: Layer 6: Governance & Telemetry); base asset that is not locked carries none either, so a holder who wants to sell into the decision cannot also make it.

• Long timelock: $\geq 30$ days (90 days for issuance-related).

• Risk memo: Mandatory written analysis, hash anchored on-chain.

• Sunset clause: Override auto-expires after 12 months.

The asymmetry is deliberate. Following the constitution costs nothing, and departing from it costs a supermajority, a month, and a memo on the permanent record, because a protocol that bends easily is a protocol someone else will bend. The price of that design is that a wrong threshold persists, and a threshold is never wrong on its own: someone chose it. Every threshold the protocol enforces is therefore published beside the reasoning that set it, and those who set a threshold own its errors as fully as the signers of an override own theirs. The override record exists to judge the rule across many decisions—whether departures under stated conditions did better or worse than the rule would have—and not to convict a signer of a bad draw. A governance process that treats every override followed by a loss as a failed decision will get obedience, and obedience to a wrong threshold is the failure the telemetry was built to see.

Emergency Path (Narrow)

True emergencies (proof system break, active exploit) require faster action. The emergency path is narrow and auditable:

Emergency path scope limitations. “Advisory” means the action changes the published default route or workload table and every client may override it with a visible flag; “hard” means protocol code refuses the object.

Requirements: $\geq 3$ of 5 security signers; auto-expire in 7 days; postmortem within 14 days.

Subtractive is not harmless: the compelled-signer problem.

It is tempting to treat every subtractive power as safe because it cannot redirect value. That is true of theft and false of censorship. A body that can delist a corridor or freeze a workload class on three signatures is, to a state that can compel three signers, a kill switch for exactly the routes the stack exists to keep open — and Invariant 2 (open admission) and the “no kill switch for any single jurisdiction” commitment of Chapter 27: Legal, Policy, and Jurisdictional Posture are both violated the first time it is used that way, with every individual action constitutional. Two of the four powers are therefore advisory by default: an emergency delisting or freeze changes the default table that clients ship with, is logged with its evidence, and can be overridden by any client operator who is prepared to carry the flag. The hard form — protocol code refusing the corridor or workload — is available only when the triggering breach has been reproduced in the public regression suite (a refund-safety loss on the corridor; an acceptance-bound break for the workload class), so that the thing being removed is demonstrably broken rather than merely disfavoured. Proof-system deprecation and hardware-profile quarantine remain hard, because their triggers (a cryptographic break, a compromised attestation root) are themselves publicly verifiable artifacts and there is no honest client that wants to keep verifying against a broken proof system.

Reconciling the emergency path with Red Line 8.

Chapter 30: Risk Analysis & Failure Modes retires the thesis if governance can alter issuance, fee routing, or telemetry rules without hard constraints. Read carelessly, this path appears to grant exactly that: five signers on a seven-day fuse. The reconciliation is structural and worth stating as a constitutional rule rather than leaving to inference:

• Emergency powers are subtractive only, and the censoring subset is advisory. Every allowed action removes or restricts a protocol claim (deprecate, delist, quarantine, freeze). No allowed action redirects value: no fee re-routing, no issuance change, no collateral-rule change, no telemetry amendment. A body that can only shrink the protocol cannot steal from it; the worst case is a smaller protocol, which is a survivable failure and the correct bias for a seven-day fuse — provided that the two powers which shrink the protocol selectively (delist, freeze) cannot be made to bind on clients that disagree, which is what the advisory default secures.

• Subtractive is not free. Quarantining a hardware profile concentrates verification (Red Line 3’s condition); freezing a workload class cuts its fee flows. Emergency use therefore carries its own falsification weight: emergency actions must be logged against the red-line conditions they aggravate, and repeated or routine use of subtractive powers — the “emergency governance becoming routine” failure named under Red Line 12 — trips Red Line 8’s spirit even though each individual action was constitutional. The test is not whether any single action was permitted but whether the emergency path has become a de facto governance channel.

• Signers are named, accountable, and rotating. The five seats are filled by published charter, occupied by independent security researchers and operators (not the foundation, not the largest holders), subject to rotation, and removable by the standard override path. Anonymity of the signer set is itself a Red Line 4 telemetry failure.

Monetary Constitution

It is natural to write that “Work Credit issuance is governed by a halving schedule.” That sentence conflates the two instruments the whole document works to keep apart. A halving schedule is a property of a base asset: a fixed, front-loaded supply path that no demand can move. A Work Credit is a typed claim on reserved future service; it is issued when committed capacity is sold and reserved and extinguished when the service is delivered, and there is no sense in which the number of such claims can “halve” on a calendar without either refusing to sell committed capacity or selling claims on capacity nobody committed. The two have separate subsections with separate rules.

Base-Asset Issuance Envelope

Gross base-asset issuance follows the consensus schedule fixed ex ante — halving every $N$ blocks (e.g., 4-year halvings). This is the supply path of the monetary candidate and nothing else. Audited Delivered Verified Capacity neither expands nor contracts it. Net supply additionally reflects the retirement rules of the fee split (Chapter 25: Layer 6: Governance & Telemetry), so net supply is not predetermined while burns depend on usage. Capacity evidence constrains service claims (Chapter 25: Layer 6: Governance & Telemetry), not the monetary issuance envelope.

Why there is no capacity modulator.

A rule that moved issuance with audited capacity growth would remove one kind of discretion and import a dependence in its place: issuance would rest on measurement choices, audit judgments, workload aggregation, scenario definitions, and a target growth rate — the measurement problem of Chapter 17: Layer 0: Verifiable Machines & Energy, carried into the monetary object. It would also not answer the question that matters for the base asset, which is whether a held balance outperforms Bitcoin-funded procurement (Chapter 13: Why Hold the Base Asset?). The reference design is simpler because the mechanism has not earned its place, not because a fixed schedule proves monetary value. Removing it settles neither the adequacy of the security budget, nor the incentives of useful-work consensus, nor governance over the other parameters.

Work Credit Issuance Rules

Work Credits have no schedule. They are issued under four rules and no others:

1. One claim per standardized unit of committed capacity. A Work Credit is issued only against a registry SKU (Chapter 22: Layer 4: Truth & Work) committed by a named provider or constituted pool for a stated window, and the sale and the reservation are one atomic step: no sold claim exists without its capacity reserved. Verified delivery against the SKU’s acceptance criterion extinguishes the claim and issues the Work Receipt. There is no issuance “to” anyone; there is only sale against reserved capacity.

2. Weights are at most one. The issuance weights of Chapter 25: Layer 6: Governance & Telemetry (verification tier, hardware grade, concentration, FCR confidence, sovereign optionality) multiply the issued quantity and are all $\leq 1.0$. No grade, tier, or bonus issues more credit than capacity committed; premia for open hardware or high assurance are paid through collateral grade and routing priority, never through issuance above committed capacity.

3. Reservation-bounded. The weighted Work Credits outstanding against an SKU class cannot exceed the reservation limit set by audited stress-adjusted Delivered Verified Capacity, computed jointly across workloads that share capacity; a sale that would breach the bound is rejected by protocol code (Chapter 25: Layer 6: Governance & Telemetry). DVC supports this limit; it does not guarantee performance.

4. Failure resolves by terms. Cancellation, expiry, default, and refund follow the terms written in the claim. A failed delivery becomes neither an open-ended promise nor a claim on the base asset, and advance proceeds that finance capacity not yet built are project finance, labelled as such (Chapter 3: The World Forces New Monetary Primitives).

Nothing in these rules references the base asset’s schedule, and nothing in the base asset’s envelope references Work Credit volume or capacity measurement.

Fee Routing

Fee routing split — the reference-design partition. Every worked example in Parts II–V uses this point; the 30–50% burn band of Chapter 8: The Triad and the Monetary Candidate is the design space it was chosen from, and Design A’s 40/30/30 is an alternative inside it, not a second reference.

Why burn, and what a burn is. A burn returns fee value to holders pro rata: it is a buyback, and Chapter 13: Why Hold the Base Asset? and Chapter 27: Legal, Policy, and Jurisdictional Posture both say so. The familiar chain “high demand $\to$ high fees $\to$ high burn $\to$ supply reduction $\to$ value appreciation; this closes the loop” is the inference Chapter 13: Why Hold the Base Asset? shows to be false, and Layer 6 does not make it. What a burn does, exactly: it reduces net issuance — and reduces supply outright only in an epoch where burned units exceed issued units, which at the Year-1 fee-coverage target of Chapter 25: Layer 6: Governance & Telemetry they will not (if retained fees cover 30% of the security budget, gross fees are 37.5% of it and the 20% burn share is 7.5% of the budget, against issuance funding the other 70%). It is published as its own series — gross burns, gross issuance, net issuance — on the Native Monetary Buyer Map, and it is read as supply arithmetic, not as buyer evidence (Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture). It does not by itself create monetary premium: a buyback accrues value to a claim, and accrual is the cash-flow leg of Chapter 8: The Triad and the Monetary Candidate, not the moneyness leg.

This routing is what makes the Value Capture Lemma from Chapter 8: The Triad and the Monetary Candidate more than a slogan: it is the fee plumbing that delivers the lemma’s cash-flow claim, and only that claim. Its 20% burn is the same conservative variant used in the Layer 4 worked example (Chapter 22: Layer 4: Truth & Work) rather than the 30–50% reference band of Chapter 8: The Triad and the Monetary Candidate, because here the remaining 10% funds assurance. The assurance budget funds the Layer 0 sampling that keeps hardware claims credible. Changes to the fee split are governance parameters — and every such parameter is discretion over the return to holders that the classification analysis examines (Chapter 27: Legal, Policy, and Jurisdictional Posture); the constitutional version of this design fixes the split ex ante and removes the knob rather than defending a floor for it.

Retirement Rule

In addition to fee burn, base-asset units are retired in specific circumstances:

Base-asset and service-claim retirement triggers.

Issuance Weights

Work Credits minted under weaker assurance levels receive discounted issuance. The multipliers below are issuance weights — factors on what is minted — and are named as such; the word haircut is reserved in this document for discounts on what is pledged (collateral grade, bridge class), which are a different instrument applied at a different moment. Calling this table “Risk Haircuts” would not be a cosmetic error: a haircut leaves the claim whole and discounts its pledge value, while a weight mints fewer claims.

Issuance weights for Work Credit minting. Every weight is $\leq 1.0$ (Chapter 25: Layer 6: Governance & Telemetry).

These weights are protocol parameters (not discretionary); they appear in dashboards and apply automatically. The concentration row applies to the share the protocol can attribute, and the share under common control is published beside it (Chapter 26: Extended Telemetry).

Two distinct physical factors.

The last two rows look similar and do different work. The distinction matters enough to state explicitly, because collapsing them leaves a gap that a well-run fragile operator can walk through.

• FCR confidence grade is epistemic. It asks whether the physical substrate can be seen at all. It penalizes opacity.

• Sovereign optionality is strategic. It asks whether what can be seen is survivable. It penalizes fragility (Chapter 17: Layer 0: Verifiable Machines & Energy).

Without the second row, a facility that reports complete, signed, independently verified FCR data documenting a single interconnect, one fuel source, no backup duration, and a jurisdiction with an active rationing regime would receive no issuance discount whatsoever. It would in fact score well, because its disclosures are impeccable. Transparency about fragility is not the same as resilience, and an issuance schedule that rewards only the former is measuring candour rather than durability.

This is the operational form of the distinction drawn in Chapter 17: Layer 0: Verifiable Machines & Energy: verifiability and availability are separate properties, and Work Credit issuance should price both.

Interaction with the affordability hinge.

These weights must not become a back door for degrading verification cost. Per Chapter 17: Layer 0: Verifiable Machines & Energy, a resilience premium is acceptable only while benign-state Real-Resource VerifyPrice stays inside its constitutional SLO band. If pursuing a higher $\mathcal{O}_s$ band pushes a network’s verification cost outside that band, the SLO wins and the optionality target is deferred. Weights adjust issuance; they do not license breaching a constitutional target.

Coverage Target

The fee-coverage ratio measures what share of the security budget comes from fees vs. issuance:

$$\text{FeeCoverage} = \frac{\text{RetainedFees}}{\text{TotalSecurityBudget}}$$

where $\text{RetainedFees}$ is fee revenue net of the burned share — the portion that actually funds validators, provers, and operations. Burns do not fund security: a burn is supply arithmetic, not security revenue (Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture), so adding it to the numerator would double-count the burned slice of fees (it is already inside gross fee revenue) or, if read as destruction of issuance, would count destruction as funding. The burned quantity is published as its own series and read as reduced net issuance. Gross fee revenue is likewise published, so the burn share is visible; the convention is pinned here and applies wherever a fee-plus-burn quantity appears (the take-rate $\tau$ of Chapter 30: Risk Analysis & Failure Modes uses gross fees, because it measures what buyers pay, not what the budget retains).

Fee coverage trajectory. The staged targets apply conditional on scale: they bind from the first quarter in which native-loop volume exceeds the published minimum — 1,000 daily active settlement identities and USD 5M quarterly native-settlement volume, the same viability gate the boards use — so the Year-1 row means “within four quarters of viability,” not “four quarters from genesis,” when bootstrapping runs longer. If the gate has not been met, FeeCoverage is published with the staging flag “pre-viability” and no target is credited or missed.

Why this matters: A system funded entirely by issuance is inflating its way to security — the warehouse paying guards in shares printed that morning (Chapter 30: Risk Analysis & Failure Modes gives the analogy its full form). A system where fees cover the budget has structural demand: someone is paying for the service, not merely holding the token. The trajectory from issuance-funded to fee-funded is the path from “speculative token” to “productive asset,” and it is a trajectory, not a switch, precisely because trust in the funding model has to be earned quarter by quarter.

The targets are a hypothesis, and the comparators say an aggressive one.

No precedent supports 30% in year one. Bitcoin, after seventeen years, funds its security budget from fees in the low single digits per cent in a typical epoch, with brief spikes into double digits during fee events. The utility-token cohort the thesis engages in Chapter 34: Objections & Responses — Filecoin, Render, Akash [Messari 2024–26] [Token Terminal 2024–26] — reached low-single-digit fee coverage against issuance at maturity, not 30%, and none has approached 50%. The staged table is therefore labelled for what it is: a falsifiable hypothesis that a work function with a buyer can reach fee coverage an order of magnitude above every buyerless and every utility-token precedent, within four quarters of viability. If the Year-1 row is missed, the miss is published against those comparators and the phase does not advance; the table is not revised downward to meet the data.

Value Capture Loop

+---------------------------------------------------------------+
|                    VALUE CAPTURE LOOP                         |
+---------------------------------------------------------------+
|  DEMAND (users need Privacy, Proofs, Compute)                 |
|    |                                                          |
|    v                                                          |
|  Users pay fees in the base asset for triad services         |
|    |                                                          |
|    +-- 70% -> Capacity providers (stakers hold base asset)    |
|    +-- 20% -> Burned (supply reduction)                       |
|    +-- 10% -> Assurance budget (sampling, audits)             |
|    |                                                          |
|    v                                                          |
|  Provers/routers must stake base asset as collateral          |
|    |                                                          |
|    v                                                          |
|  Base-asset gross issuance follows the ex-ante schedule       |
|  (Work Credits issued separately, one per reserved unit)      |
|    |                                                          |
|    v                                                          |
|  NET EFFECT: Demand -> Fees -> Burns + Staking -> Accrual     |
|  Monetary premium still requires holder and agency conditions |
+---------------------------------------------------------------+

Why demand does not simply expand base-asset supply proportionally:

1. Issuance cap is hard: Protocol enforces the epoch-level envelope of Chapter 25: Layer 6: Governance & Telemetry regardless of demand; Work Credit volume does expand with demand, by design, and is the other instrument.

2. Burn is automatic: Higher demand $\to$ higher fees $\to$ higher burn $\to$ lower net issuance. Not lower supply until burn exceeds issuance, which the coverage trajectory does not reach before Year 5 at the earliest; and a buyback, not a moneyness mechanism.

3. Staking locks supply: More provers/routers $\to$ more collateral locked $\to$ less circulating supply.

4. Issuance weights constrain minting: Weak verification or concentrated provers sell fewer Work Credits per unit committed, so service-claim volume grows more slowly than raw capacity; this constrains the claim instrument, not the base asset.

This is the “bond indenture” that makes the accrual claim auditable, not asserted. It is not, by itself, the SoV claim; that requires the holder-side and agency conditions the diagram’s last line names.

A constitution nobody can check is a press release. Layer 6 claims that measurement is the constitution — that SLOs, not assurances, decide whether the asset is still money — and that claim is only as strong as the measurement regime beneath it. Dashboards can be gamed, and the gaming is usually boring: a favorable region here, a fast machine there, a bad month quietly absent. So the observatory must be built the way it audits others. Anyone can re-run the audit, on hardware they own, and catch the observatory lying. That is the standard this chapter engineers for, and everything in it — reference machines, cost vectors, sampling seeds, anchored archives — exists to make that re-run possible.

Reference Verifier Classes

“Anyone can verify” is a promise about hardware, so it has to be priced on hardware a person can actually own. All Verify* metrics are therefore measured on standardized reference hardware:

Reference verifier classes.

Rule: All constitutional SLOs (e.g., “VerifyPrice $t_{95} \leq 5$s” — the p95 time field of the canonical tuple, Appendix A: Formal Model of Verification Asymmetry & VerifyPrice) are defined against Laptop-Class unless a workload’s registry entry binds it to another class, in which case the entry names the class. This ensures the “anyone can verify” promise is falsifiable. Where a registry entry binds an SKU to Server-Class (e.g. INFER_LM_7B_512TOK, whose M3 re-execution does not fit a Laptop-Class SLO; Chapter 22: Layer 4: Truth & Work), the entry governs that SKU and the Laptop-Class figure is still published beside it; the blanket rule governs everything the registry does not rebind.

Reference Verifier Implementations

Reference verifier implementation requirements.

Why two implementations rather than one trusted one? Because a single verifier codebase is a single point of failure for the truth itself. One bug can inflate or deflate every measurement the constitution depends on, and nobody outside would ever know. Two independent implementations, built by different people from the same specification, turn that silent failure into a visible disagreement — and a disagreement, unlike a bug, shows up on a dashboard.

Cost Vector Definition

A single number is easy to quote and easier to flatter. VerifyPrice is deliberately not one, and it is also deliberately not several: it has one definition, the canonical five-field tuple $(p_{50,t},$ $p_{95,t},$ $p_{50,c},$ $p_{95,c},$ $\text{fail})$ of Appendix A: Formal Model of Verification Asymmetry & VerifyPrice. What this section defines is the cost-vector view — the per-run physical quantities the harness records for workload $W$ on verifier class $V$, from which the canonical tuple is priced by the rule of Chapter 22: Layer 4: Truth & Work:

$$\text{CostVector}(W, V)_{\text{run}} = (t_{\text{run}},\ e_{\text{run}},\ m_{\text{run}},\ b_{\text{run}},\ \text{outcome}_{\text{run}})$$

Where:

• $t_{\text{run}}$: verification time (seconds); percentiled into $p_{50,t}$, $p_{95,t}$

• $e_{\text{run}}$: energy (Joules); enters the per-run USD cost $c_{\text{run}}$, which is percentiled into $p_{50,c}$, $p_{95,c}$

• $m_{\text{run}}$: peak memory (MB) — published, not priced; exceeding the registry ceiling is a failure outcome

• $b_{\text{run}}$: bandwidth (bytes) — published, not priced, same rule

• $\text{outcome}_{\text{run}}$: pass or failure code; aggregated into $\text{fail}$

This vector is not written as “$\text{VerifyPrice}(W,V) =$”, because it is not VerifyPrice. Only the canonical five-field tuple of Chapter 22: Layer 4: Truth & Work carries the name; this vector and the per-run price model of Chapter 22: Layer 4: Truth & Work are views of its inputs, and they are labelled as such wherever they appear.

Sampling and Anti-Cherry-Pick

The most common attack on telemetry is not fabrication; it is curation. Nobody has to invent numbers when selective reporting will do: show receipts from good regions, fast hardware, favorable conditions, and the dashboard flatters itself without a single lie in it. The sampling regime exists to make curation detectable:

Sampling mechanisms for Verify* telemetry.

Rule: Any dashboard point published without a verifiable sampling seed and stratification breakdown is not part of the official Verify* record.

Data Availability and Anti-Memory-Hole

Dashboards are views. The source of truth is the receipt corpus. Receipts must be:

Data availability requirements.

A dashboard can be edited; a Merkle root committed to a neutral ledger cannot be un-committed. That asymmetry is the whole defense. If a government or a CDN can quietly delete the bad months, the telemetry regime has been captured without a single headline. Content-addressing plus neutral anchoring does not prevent deletion — it makes deletion visible, and visible deletion is itself a datum.

Reproducibility Contract

A valid dashboard datapoint is defined as:

$$\textit{Datapoint} = (d_{\text{root}}, v_{\text{harness}}, v_{\text{verifier}}, r)$$

Validity check: Anyone can:

1. Fetch receipts by $d_{\text{root}}$ (dataset root)

2. Run $v_{\text{harness}}$ (harness version) with $v_{\text{verifier}}$ (verifier version)

3. Verify $r$ (result) matches

If the results do not match, the datapoint is invalid and the discrepancy is a Sev-1 incident.

Published artifacts:

• Harness code (open source, tagged)

• Verifier binaries (reproducible builds, hashed)

• Dataset roots (timestamped, anchored)

• Aggregation scripts (deterministic)

This transforms “no dashboards, no trust” from philosophy into a reproducible measurement contract.

How to Measure: Receipts, Not Vibes

VerifyPrice was introduced at Layer 4; VerifyReach at Layer 1; VerifySettle at Layer 5. Layer 6 treats them as a coherent observability regime rather than three unrelated graphs.

The observability story only works if it is itself verifiable. That is why every claim, proof, settlement, and SLA outcome is turned into a receipt with enough structure that anyone can replay the metrics on a reference verifier.

In practice, this means:

• Every proof receipt carries not only the proof artifact but also start/end timestamps, resource usage, and a hardware profile tag.

• Settlement receipts encode corridor, timing, refund status, and failure codes.

• Routers emit anonymized samples of order books, matched and unmatched bids, and house vs. third-party flags.

• Hardware vendors publish lot-attestation artifacts that receipts can reference as part of their profile.

A public “VerifyPrice Observatory” then ingests these receipts and emits the aggregate vectors referred to in the text. Anyone can pull the raw receipts corresponding to a dashboard point, feed them into the same open-source verifier suite, and see whether they obtain the same numbers. If they do not, the mismatch is itself an incident.

This architecture enforces a simple discipline: if it matters, there is a receipt for it. If a claim about performance, neutrality, or safety cannot be tied back to receipts that anyone can re-check, it is out of scope for the monetary thesis.

They are the three primary dials for answering:

• Is verification still cheap? (VerifyPrice)

• Can users still reach the network under pressure? (VerifyReach)

• Can users still move value privately and safely? (VerifySettle)

This observability regime watches the stack across five planes:

Proof & compute plane
Are receipts reliable, and does verification asymmetry actually hold under load?

Settlement & privacy plane
Do non-custodial payouts actually clear, with privacy and refund-safety matching the promise?

Neutrality & admission plane
Can new provers, miners, routers, and mirrors join on equal footing, or has the system ossified into a club?

Economic coverage plane
Are real fee flows, not issuance, paying a growing share of the security and operations budget?

Layer-0 hardware plane
Do “verifiable machines” remain falsifiable in practice, or has the system slid quietly back into “trust the vendor”?

Each plane maps directly to the nine SoV requirements of Part I (Chapter 4: First Principles: What a SoV Must Survive): credible scarcity, cheap public verification, censorship-resistance and portability, neutrality and permissionlessness, native demand, lawful privacy by design, duration-neutrality, asset-level value capture (non-bypassability), and agency preservation. The economic coverage plane reads on the fifth and eighth; the settlement and privacy plane on the sixth and ninth; the proof and compute plane on the second; the neutrality plane on the third and fourth; the Layer-0 plane on the second and, through sovereign optionality, the third. If any plane drifts too far from its targets, the monetary thesis weakens, no matter how elegant VerifyPrice looks in isolation.

VerifyFlow: Instrumenting the Market Realization Plane

VerifyPrice, VerifyReach, and VerifySettle answer whether the stack is real. None of them answers a question that will dominate every public conversation about the asset: why is the price doing that? Chapter 13: Why Hold the Base Asset? says monetary adoption cannot be inferred from price, and Chapter 13: Why Hold the Base Asset? says the answer lives in external market structure. VerifyFlow is the fourth named verification family, and it measures the external financial representation and price-transmission state of the native monetary object.

The governing principle extends the existing one:

No protocol dashboards, no monetary trust. No flow ledger, no price inference.

Wrapper-Level Vector

For each external financial wrapper $i$, publish

$$\mathrm{VerifyFlow}_i = \bigl(L_i,\; A_i,\; \Delta A_i,\; r_i,\; w_{Xi},\; \varepsilon_i,\; \kappa_i,\; C_i,\; H_i,\; D_i\bigr)$$

where $L_i$ is the leverage multiple and reset rule; $A_i$ is assets or delta-adjusted exposure; $\Delta A_i$ is creations and redemptions, published raw and flagged: $\Delta A_i$ is the input to the decomposition of Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture, not an aggregate in its own right, and no downstream sum may consume it unless the wrapper’s series has been decomposed into its $\varepsilon$-, $\alpha$-, and residual components — otherwise aggregating across wrappers silently rebuilds the double-count the asset-level vector exists to prevent. $r_i$ is the wrapper’s underlying return over the daily-reset horizon, and $w_{Xi}$ its delta-equivalent exposure weight to the native asset $X$ (unity for a single-asset physical wrapper, less for baskets and partially hedged structures); both are consumed by the $Q^{RC}$ and $Q^{RD}$ terms below. $\varepsilon_i$ is holder flow elasticity; $\kappa_i$ is net mechanical gain; $C_i$ is constituent concentration; $H_i$ is hedge implementation (physical, swaps, futures, options); and $D_i$ is dealer or counterparty concentration. Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture derives $\varepsilon$ and $\kappa$ and states their measurement contract.

Asset-Level Vector

For the native asset $X$, publish

$$\mathrm{VerifyFlow}(X) = \bigl(Q^{RC},\; Q^{RD},\; \mathrm{MPR}^{\text{gross/net}},\; \mathrm{CCR},\; \mathrm{SER},\; \mathrm{WNG},\; \mathrm{RCR},\; \mathrm{NUS}\bigr)$$

The MPR slot is a published pair (gross and net), so the vector names the pair rather than one form; every other slot is a single series.

Return-coupled demand $Q^{RC}$.
Exposure that moves as a function of the return itself, $Q^{RC} = \sum_i w_{Xi}\,\kappa_i A_i r_i$, where $w_{Xi}$ is the wrapper’s delta-equivalent exposure weight to $X$ — the same weight $Q^{RD}$ carries, and without it a basket wrapper’s rebalancing demand for its other constituents would be booked against $X$. This term shapes volatility, momentum, persistence, and reversal severity.

Return-decoupled demand $Q^{RD}$.
Allocation flow largely independent of the day’s return, $Q^{RD} = \sum_k w_{Xk} \alpha_k A_{k}$, where $\alpha_k$ is the return-independent intercept of net creation into wrapper $k$ and $w_{Xk}$ its delta-equivalent exposure weight to $X$. $Q^{RD}$ consumes $\alpha$ only. Per the decomposition rule of Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture, creations split into an $\varepsilon$-driven component (return-coupled, already inside $\kappa$), the intercept $\alpha_k$ (structural bid — distribution growth, mandate adoption, scheduled contributions), and a residual $u_k$ (unexplained, published as its own series and consumed by no aggregate). Feeding raw $F_k$ into this sum would double-count the $\varepsilon$-component, which $\kappa$ already carries through $Q^{RC}$, and would inflate MPR and every downstream reading built on it. This term shapes destination, concentration, and level — which prices get accepted without valuation-sensitive selling.

Mechanical Pressure Ratio (MPR).
Gross measures pressure; net measures direction. That distinction is the whole metric, and it is worth the two definitions it costs. $Q^{RC}$ and $Q^{RD}$ partition product-level demand by return-dependence: the $\varepsilon$-component of creations belongs to $Q^{RC}$ (inside $\kappa$) and only $\alpha_k$ belongs to $Q^{RD}$. Total product-level exposure demand is then $Q^{\text{exp}} = Q^{RC} + Q^{RD}$ with no term counted twice. Dealers translate that exposure into market orders, so realized market demand is its intermediated image,

$$Q^{\text{mkt}} = \mathcal{H}\bigl(Q^{\text{exp}},\ \text{dealer inventory},\ \text{internalization},\ \text{swap/future/option mix}\bigr).$$

Left as a symbol, $\mathcal{H}$ would make MPR a ratio with an undefined numerator. It is defined here as the published pass-through decomposition: for each reporting segment $j$ (venue $\times$ wrapper class),

$$Q^{\text{mkt}}_j = \bigl(1 - \iota_j\bigr)\,\pi_j\,Q^{\text{exp}}_j \;-\; \Delta I_j,$$

where $\iota_j$ is the dealer internalization share (exposure netted against other client flow and never sent to market), $\pi_j$ the spot pass-through of the segment’s hedge mix (unity for physical holdings; the delta of the futures, swap, or option book otherwise), and $\Delta I_j$ the change in dealer inventory over the window. Each of $\iota_j$, $\pi_j$, and $\Delta I_j$ is a disclosed series under Chapter 26: Extended Telemetry; where a segment’s dealers do not disclose them, $Q^{\text{mkt}}_j$ is not computable, MPR is published with that segment marked missing and its exposure share stated, and no headline MPR is quoted for a window in which the missing share exceeds 20% of $Q^{\text{exp}}$. MPR is thus computable exactly to the extent dealers disclose, and the metric says so rather than filling the gap with an assumption.

The gross form, $\mathrm{MPR}^{\text{gross}} = \sum |Q^{\text{mkt}}_j| / V_X$, counts every dollar of liquidity consumed on both sides: it asks how hard the machinery is leaning on the market, whichever way it leans. The net form, $\mathrm{MPR}^{\text{net}} = |Q^{\text{mkt}}| / V_X$, nets the offsetting flows first and asks only where the weight ends up. Here $V_X$ is the asset’s executable liquidity — average daily traded USD volume on the reference venue set over the same window the numerator aggregates, published with the ratio — and the segments $j$ are the pre-declared reporting partition (venue $\times$ wrapper class), also published with the ratio.

The two forms must never be averaged, ranked, or otherwise combined, because each guards against a different deception. Netting offsetting flows before the modulus erases the liquidity both sides consumed, which is why the gross form leads and the net form contextualizes. And customer exposure and dealer hedging are the same demand observed at two stages, not two independent demands; summing them would double-count. Report $Q^{\text{exp}}$ and $Q^{\text{mkt}}$ separately and never add them — a pressure gauge and a compass are two instruments, and gluing them into one dial breaks both.

Custodial Control Ratio (CCR).
Base asset controlled by custodians and wrappers, divided by circulating supply.

Synthetic Exposure Ratio (SER).
Delta-adjusted derivative exposure divided by liquid free float.

Wrapper–Native Growth Gap (WNG).
$\mathrm{WNG} = \Delta \ln E^{\text{wrapper}} - \Delta \ln U^{\text{native}}$, where $U^{\text{native}}$ counts native service flows only — fee payments, private settlement volume, proof purchases, and verified-compute consumption, each a turnover measured over the window. Collateral lockup is a stock and is published as its own companion series, never summed into $U^{\text{native}}$; burns are supply arithmetic, not buyer evidence (Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture), and are likewise excluded. A persistently positive WNG means financial exposure is growing faster than monetary use — the single most compact measure of financialization outrunning adoption. Because it feeds the triple-divergence composite and Red Line 9, its aggregation is specified rather than left to the operator: a trailing four-quarter window; quantities in unit terms on both sides (wrapper exposure in units of $X$ equivalent, native use in units of service transacted), so that asset-price revaluation is stripped from the comparison by construction; and the USD-denominated series published alongside for readers who want the market view. The reason for unit-denominating is a revaluation artifact, and it runs the other way from what intuition suggests: $E^{\text{wrapper}}$ is a stock observed instantaneously and revalued with every tick, while $U^{\text{native}}$ accumulates at transaction prices over the window, so a price rise — not a fall — can lift measured $\Delta \ln E^{\text{wrapper}}$ on revaluation that no usage produced. Unit terms cancel that term; the USD series exposes it. The deflation convention here is therefore unit denomination, which is distinct from the workload unit-price deflation of Red Line 14 Condition B (a compute-price index, not the asset price): same word, different deflators, both published.

Recursive Claim Ratio (RCR).
Exposure held in wrappers whose underlying is itself another wrapper or derivative, divided by total wrapper exposure — delta-adjusted on both sides, over the same window as SER. One minus RCR is the share of wrapper exposure that bottoms out in the native asset directly.

Native Use Share (NUS).
The share of observable economic activity touching the asset that actually settles through the protocol-native monetary loop, where the universe is defined as all activity on public venues and wrappers reporting the asset (USD value of transfers and wrapper flows over the window), and the numerator is the USD value of native-loop settlement (fee-paying, proof-carrying, or corridor) over the same window. The universe is pre-declared with the metric; activity invisible to public data is excluded from both numerator and denominator and acknowledged as a coverage limit, not silently assumed zero.

Holder Cohorts, Vintage, and Policy Concentration

Flow elasticity is not a permanent product characteristic, and treating it as one is a modeling error. Product launch date predicts holder behavior [Green 2026a]: older funds contain embedded winners who are more likely to skim gains after a rally, whereas newly launched products may contain momentum-oriented holders with no gains to realize and therefore nothing to trim. So

$$\varepsilon_{i,t} = f(\text{product age},\; \text{embedded gains},\; \text{holder cohort},\; \text{narrative regime},\; \text{volatility})$$

Telemetry should therefore track product age, average holder cost basis where inferable, the realized/unrealized gain distribution, rolling elasticity, statistical break dates, holder-cohort turnover, and fund-flow response after drawdowns.

This matters more, not less, in an agent economy. Automated treasury systems, robo-advisers, and AI allocation agents may share common rebalancing policies, producing a machine-readable version of holder elasticity at scale. The protocol should therefore monitor concentration not only of holders but of holder operating rules.

Policy Concentration Ratio

The share of net asset demand governed by the largest common rebalancing templates, treasury algorithms, robo-advisers, or agent policies. Picture a thousand independent drivers, each in their own car, all running the same navigation app: ownership is distributed, but on the day the app says “take the exit,” they all take the exit. An asset can have decentralized ownership and highly centralized behavior; only the second predicts what happens on a bad day.

Capital Survival: AUM Is Not Investor Return

One further metric prevents a specific and common confusion. A leveraged wrapper can survive commercially while repeatedly destroying investor capital: reverse splits preserve a presentable share price, fresh inflows replenish assets, and the sponsor continues collecting fees on a product whose successive holder cohorts were harmed. Persistent AUM is therefore not evidence of successful capital preservation.

Capital Survival Ratio (CSR)

At the product level, every term must be an aggregate dollar amount — net assets, not per-share NAV, which would mix a per-unit price into a sum of dollar flows:

$$\mathrm{CSR}_i = \frac{\text{current net assets} + \text{cumulative distributions} + \text{cumulative redemptions}}{\text{cumulative subscriptions}}$$

Because the stated purpose is to ask whether successive cohorts survived, the product-level figure is only a summary. The cohort form is the one that answers the question, for cohort $c$ with cohort-attributable value $V_{c,t}$:

$$\mathrm{CSR}_{c,t} = \frac{V_{c,t} + \sum_{\tau \le t} \text{cash returned}_{c,\tau}}{\sum_{\tau \le t} \text{capital contributed}_{c,\tau}}$$

This is a multiple on invested capital by vintage; a dollar-weighted return over the same cohort carries the same information (a cohort’s $\mathrm{CSR}$ exceeding 1 after $T$ quarters corresponds to a positive dollar-weighted IRR over those flows, so the two are orderings of one object, not independent evidence). A product can show $\mathrm{CSR}_i$ near or above 1 while late cohorts sit well below 1, which is precisely the failure the metric exists to expose. Accounting implementations vary, but the purpose does not: AUM is not investor return, product survival is not holder survival, and a wrapper can be an excellent business for its sponsor and a disaster for everyone who owned it.

Dealer Balance Sheets and Hedge Paths

Wrapper exposure does not necessarily arrive as direct spot purchases. Dealers may implement it with swaps, futures, baskets, or options, and counterparty capacity affects how — and whether — the exposure reaches the underlying market. Product-level exposure demand must therefore never be read as an identical quantity of spot orders.

Publish: the wrapper counterparty list; top-$N$ dealer share; physical holdings versus swaps; swaps versus options; average derivative maturity; delta- and gamma-adjusted exposure; collateral and margin requirements; evidence of counterparty caps; and changes in hedge-instrument mix.

Dealer capacity warning. A migration from swaps toward options can indicate that dealer balance-sheet capacity is binding. When dealers are short calls, rising spot and rising volatility can require additional underlying purchases, adding a gamma feedback loop on top of the mechanical one. This is an empirical warning to watch for, not a universal law to assume.

Convenience-Yield Telemetry: Pricing the Holder-Side Service Flow

VerifyPrice, VerifyReach, and VerifySettle measure the stack; the wrapper vector measures the realization plane; the Native Monetary Buyer Map measures who is holding and how. None of them prices the thing the monetary claim actually rests on. Chapter 13: Why Hold the Base Asset? relocates the premium to a regime-contingent convenience yield — a holder-side service flow with no cash flows to discount — and then concedes it is unsized. The concession is honest but incomplete: unsized does not mean unmeasurable, and an unsized quantity with no instrument is indistinguishable from an article of faith. Storage theory [Kaldor 1939] [Working 1949] extracts convenience yield from observable prices rather than asserting it (the forward-curve slope net of carry); the crypto-native analog is the lending and derivatives complex around the asset. The thesis therefore publishes a fifth measurement family whose job is to make the premium a number rather than a hope.

Instruments.

For each venue publishing a rate, report:

Base-asset lending rates.
The market-clearing rate for borrowing the base asset itself, segmented by venue, term, and counterparty class. A borrower pays this rate to be short the asset; what they are paying for is the units. When holders of the bearer service lend out their units, they are selling the service flow for the term of the loan — so the lending rate is the direct market price of temporary access to bearability, the closest available analog to a lease rate.

Forward and perpetual basis.
Forward price minus spot, and perpetual funding rate, net of the reference interest rate. Persistent positive basis that exceeds carry costs indicates demand for deferred or levered exposure outrunning demand to hold the units — demand for the price story rather than the bearer service. Persistent negative basis indicates the reverse: entities that need the units (operators meeting collateral calls, shorts delivering into settlement) bidding against the float.

Wrapper basis.
The premium or discount of a custody-restricted wrapper over the value of its native holdings. A persistent premium is the price of not holding natively: legal wrapper, custody, and access convenience purchased in place of self-custody, agency, and exit. It is the complement of the lending rate — both price the friction between native holding and representative holding — and under Chapter 13: Why Hold the Base Asset? a large and rising wrapper premium with stagnant native use is financialization, not monetary adoption.

What the instruments read.

Convenience yield is a residual claim on holding, extracted from prices that also contain discount-rate and risk information, so each reading requires the same care as $\varepsilon$ in Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture:

• Lending rate decomposition. Borrow demand has three sources: directional short interest, market-making inventory financing, and operational short squeeze against locked float. Segment by borrower class where observable; an operational squeeze (collateral calls meeting immobile supply) is a liquidity event, not a premium reading.

• Regime conditioning. The thesis’s claim is specifically regime-contingent: the yield should rise in the corridor where substitutes weaken while the stack still works, and the Pressure–Capacity Corridor predicts an inverted U rather than a slope (Chapter 8: The Triad and the Monetary Candidate). The instrument earns its place only if the rate series is published against the macro-state model of Chapter 29: Adoption Curve & Ecosystem Dynamics and the pressure index $R$ of Chapter 13: Why Hold the Base Asset?, so that $\text{convenience yield} = g(R)$ becomes an estimable function rather than a slogan, read as the pre-registered corridor increment of Red Line 16. An increment ruled out is the null result and must be reported as such.

• Both tails checked. A convenience yield that appears only in benign states — holders renting out units for yield-farming while nobody needs the bearer service — is a fee-like cash flow, not the regime-contingent service flow, and belongs in the DCF bucket with the rest of Chapter 13: Why Hold the Base Asset?.

The null result is publishable.

The instrument is falsification machinery, not advocacy. If, after the stack delivers measurable service, the lending and basis series show no corridor increment above the pre-registered minimum — holders charge no meaningful premium to part with units in the corridor where substitutes weaken — then the holder-side mechanism is absent at the size the claim needs, and the store-of-value claim has lost its mechanism in public. That outcome belongs on the Value Capture Board beside fee coverage, and it is a more direct test than any red line currently operating on it: the red lines test whether the chain broke; this tests whether the premium exists.

Buyer Quality and Price Provenance

Wrapper vectors answer which product is transmitting exposure. They do not answer who is absorbing the risk, with whose capital, under what mandate, at what leverage, against which liability, through which benchmark, and with what capacity to sit through a mark. That is the sovereign-market question of Chapter 3: The World Forces New Monetary Primitives, applied to the native asset’s own realization plane. Publish, as a checklist rather than as a multiplicative index:

• Persistence ($P$). Does the bid recur because contributions, a mandate, or a liability continue, or because a trade has not yet finished?

• Horizon ($H$). Is the holder matching a multi-decade promise, a quarterly risk limit, or a daily reset?

• Liability match ($M$). Is the purchase offsetting an enduring obligation, or following a weight?

• Loss-bearing capacity ($B$). Can the holder absorb marks without forced sale, margin call, or redemption?

• Countercyclicality ($C$). Does incremental buying increase when prices fall, or does the governing rule absorb less risk precisely then?

A high-persistence, low-match, low-countercyclicality buyer is the automatic index flow of Chapter 3: The World Forces New Monetary Primitives: it keeps arriving and still fails as an anchor. A leveraged relative-value fund can score the opposite way on persistence and the same way on loss-bearing capacity. Neither score is a number to multiply into a headline $Q_A$. The fields exist so that “there is demand” cannot be reported without saying what kind.

Price then requires a provenance model, not only a feed: who bought, with whose capital, under what mandate, at what leverage, with what redemption terms, against which liability, through which benchmark, and with what capacity to survive losses. A policy that treats the resulting price as an external referendum on credibility is reading an instrument the state and the financial industry themselves constructed. That is the epistemic loop Chapter 3: The World Forces New Monetary Primitives already warns about, now stated as a VerifyFlow requirement: no buyer-quality ledger, no inference from the long yield—and no inference from the native asset’s price either.

Native Monetary Buyer Map

Buyer quality belongs inside the monetary chain, not only in the external price model. Publish a Native Monetary Buyer Map that reconciles protocol flows and holder cohorts without pretending that pseudonymous addresses are known persons:

Just-in-time fee acquisition.
Share of fee-paying units acquired within pre-declared windows before expenditure, versus fees paid from retained balances.

Operator sell-through and inventory.
Rewards and fee receipts sold, retained, hedged, or pledged by operators, by cohort and interval, with a new-participant split classified by principal (Chapter 26: Extended Telemetry). Its retained share is the earned-acquisition reading of Chapter 34: Objections & Responses.

Burns and net issuance.
Gross burns, gross issuance, and net issuance separately; a burn is supply arithmetic, not evidence of a buyer.

Self-custodied reserve demand.
Net accumulation in addresses or proofs-of-control classified under published, conservative reserve criteria, excluding custodial and wrapper inventories.

Wrapper demand.
Custodial, fund, treasury-company, and synthetic exposure reported apart from native reserve holdings.

Leverage.
Borrowed funding, derivatives, rehypothecation, liquidation sensitivity, and margin terms where observable.

Holding period.
Cohort survival and realized holding-duration distributions, not a single average that mixes fees with reserves.

Loss-bearing capacity.
Evidence that the funding source can absorb marks without margin call, redemption, or forced sale.

Countercyclical accumulation.
Whether native self-custodied reserve cohorts add units during drawdowns and regime-pressure episodes rather than merely after recoveries, read net of exercise, so that a cohort which spends into a stress episode is not scored as a cohort that left.

Outflow classification.
Every reserve-cohort outflow is classed as forced liquidation (margin call, redemption, forced sale), operating turnover, or exercise — units spent on triad services, settlement, or exit during a declared stress episode. Exercise counts for the holder-side mechanism, not against it: a balance that falls because it was used for what it was held for is the mechanism working. Forced liquidation counts against loss-bearing capacity; turnover is neutral.

The map must reconcile identities only to the degree evidence permits. Unknown holdings remain unknown; they are not assigned to the most favorable category. Unknown is a coverage limit, not a quality grade, and taking part in the measurement programme is not a condition of privacy: the map publishes its coverage and selection limits instead. Gross native volume passes Premise 7 only when the retained, self-custodied, unlevered or transparently financed, loss-bearing, countercyclical cohort is material and persistent.

The map also carries a representation discipline that every published aggregate in this chapter inherits: any aggregate over households or holders must disclose its weighting rule. The weighting rule is a moral choice made visible. Dollar-weighted and person-weighted summaries of the same underlying observations can move in opposite directions — and neither is the false one. The arithmetic is exact. The gap between the two means is the covariance of spending weight and experience over mean spending weight, $\bar{x}_{\text{dollar}} - \bar{x}_{\text{person}} = \operatorname{Cov}(C_i, x_i)/\bar{C}$, so a positive covariance between spending weight and experience lifts the dollar-weighted mean above the person-weighted mean; the identity is about means, and a statement about the person median needs a separate argument about the shape of the distribution. That is the mechanism behind the “two economies” reading of the same dataset (Chapter 3: The World Forces New Monetary Primitives). Board aggregates therefore publish their weights (units transacted, addresses, identities, delta-equivalent exposure) alongside the number, and where a dollar-weighted and a person-weighted reading of the same series diverge persistently, both are shown rather than the more favorable one. A verified aggregate that describes almost no actual participant is not a measurement failure; it is a choice of weights, and the choice is now visible.

Principal Map

The Native Monetary Buyer Map asks who warehouses native monetary risk. It classifies by behavior and reconciles identities only to the degree evidence permits. It does not ask what kind of thing the holder is, and in an economy of delegating agents (Chapter 7: The Delegation Economy: Who Buys Verification) that omission lets one operator’s fleet read as a distributed constituency. The Principal Map is the overlay that closes the gap. It is not a board of its own: it classifies every native flow and every reserve cohort already reported elsewhere by ultimate principal, to the degree evidence permits, and publishes the residue as its own category rather than assigning it favorably.

Series published from the map,

each on the same window as the board it overlays:

Principal shares
of native fee turnover, prover collateral, corridor liquidity, and the self-custodied reserve cohort, by class.

Human-Revocable Share (HRS).
The fraction of agent-controlled native balances whose key root is held by a human with standing and whose revocation is a protocol operation. Feeds the ninth requirement (Chapter 4: First Principles: What a SoV Must Survive) and the watch clause on Red Line 12.

Native Policy Concentration Ratio (NPCR).
The Policy Concentration Ratio of Chapter 26: Extended Telemetry computed over native positions—collateral, liquidity, reserves—rather than over wrapper flows: the share of each native series governed by the largest policy templates. Exit correlation across templates during declared stress episodes is published beside it, so that if policy concentration proves a poor proxy for behavioral concentration the substitution can be made on evidence.

Agent-originated share by operator class.
Fleet-originated versus independently originated native demand, as defined in Chapter 7: The Delegation Economy: Who Buys Verification. Companion to the Homestead Ratio on the Layer 0 Capacity Board.

Cross-Perimeter Share (CPS).
The fraction of receipt-bearing hops whose principal chain crosses an operator boundary (Chapter 7: The Delegation Economy: Who Buys Verification). It requires the optional principal_chain context field of the PIDL receipt (Appendix A: Formal Model of Verification Asymmetry & VerifyPrice). Until that field is in use across a material share of receipts, CPS is published as not computable, with the covered share stated; operator-level inference from settlement graphs is a weaker fallback and is labeled as such wherever it is shown.

Representation discipline.

The map inherits the weighting rule of the buyer map: unit-weighted and principal-weighted readings of the same series can diverge, and both are shown. A board that reports ten thousand self-custodied holders and one policy template has reported one holder; the principal-weighted figure says so.

Companion to the triple divergence.

The joint failure signature of Chapter 33: The Closed Sovereign Stack—positive WNG, no corridor increment in convenience yield, falling Homestead Ratio—gains a companion, not a fourth term: falling HRS. A stack that is losing the closed-stack contest and the wrapper contest while its remaining native activity is agent-controlled with no human root is failing three ways at once and reading green on the Value Capture Board.

Control Overlay

The Principal Map asks whose balance a native flow is. The supply side poses the same question, and every concentration figure in this Part leaves it open: who controls the prover, the router, the corridor, or the facility that a series counts as separate. Separate keys, separate legal entities, and separate sites can all answer to one controller, borrow from one creditor, and obey one court, and capacity arranged that way fails together under the pressure it was dispersed to survive. Layer 0 already treats a shared transformer vendor, firmware signer, or legal safe harbor as a dependency group that removes nominally separate facilities at once (Chapter 17: Layer 0: Verifiable Machines & Energy); the overlay extends that treatment from equipment to ownership, contract, and law. Technical redundancy becomes independence only when control is independent too.

Like the Principal Map, the overlay is not a board of its own. It records seven fields for each operator that a board already counts, to the degree evidence permits (registry filings, published financing and lease terms, operator attestations, and the receipt correlation the house-share estimate already uses), and it publishes what cannot be established as unknown, never as independent:

Operator and ultimate controller.
The party that runs the capacity, and the party that can direct it through ownership, contract, or a key it holds.

Admission and refusal authority.
Who can admit, refuse, or suspend a workload, a customer, or a counterparty on that capacity, and under whose terms.

Jurisdiction.
Where the operator, its controller, and its physical assets can each be compelled, listed separately where they differ.

Revenue and residual claims.
Who receives the fees, and who holds the claim on what remains if the operator is sold or wound up.

Creditor and rescue rights.
Who can take the machines and contracts on default, and who can rescue them on terms of its own; at operator scale the second is the enclosure by rescue of Chapter 5: Threat Model.

Replacement path.
Whether an independent operator can take over the capacity’s obligations, at what cost, and how quickly against the workload’s tolerated interruption (Chapter 17: Layer 0: Verifiable Machines & Energy).

User rights after replacement.
Whether reservations, credentials, receipts, and refund paths survive a change of operator or controller, or lapse with it.

Where it attaches.

The overlay adds no layer and no threshold. It changes what four existing readings may count as separate.

• House share and prover concentration. The house-share estimate of Chapter 25: Layer 6: Governance & Telemetry infers common control from receipt correlation, which cannot see a common owner whose operators share no site, stake source, or timing, and the overlay supplies that evidence. The prover-concentration weights of Chapter 25: Layer 6: Governance & Telemetry still apply to the share the protocol can attribute; the share under common control is published beside them, so a fleet split across many keys or entities shows as the gap between the two.

• The Principal Map. The operator boundary of the Cross-Perimeter Share (Chapter 7: The Delegation Economy: Who Buys Verification) and the operator class of the agent-originated share (Chapter 7: The Delegation Economy: Who Buys Verification) are both read through the overlay, so that operators under one controller are not counted as separate perimeters or classes.

• Layer 0 dispersion. A common controller or a common secured creditor is a dependency group in the sense of Chapter 17: Layer 0: Verifiable Machines & Energy, so a scenario can remove every facility in it at once, as a default, a rescue, or a single compulsion order would. The jurisdiction field records the controller’s jurisdiction beside the site’s, so a fleet sited in many jurisdictions and controlled from one is visible against the concentration penalty of Chapter 17: Layer 0: Verifiable Machines & Energy, which partitions the fleet by where its facilities sit.

• The corridor. $A_{\mathrm{full\mbox{-}stack}}(R)$ credits redundant paths only to the degree that they fail independently under pressure (Chapter 8: The Triad and the Monetary Candidate), and paths with one controller, creditor, or jurisdiction do not.

Five operators that answer to one controller are one house.

The Public Boards

Metrics surface as twelve public boards or maps. The original five have grown to twelve as the thesis has extended from pure verification economics into physical capacity, political economy, dependency, holder quality, and market structure:

Proof & Compute Board.
Summarizes VerifyPrice per workload, SLA attainment, queue depths, and failure modes.

Settlement & Privacy Board.
Reports swap success, refund safety by corridor, time-to-finality, and anonymity-set health.

Neutrality & Admission Board.
Tracks time-to-first-proof for new entrants, top-N share, geo/ASN distribution, and house share, read through the control overlay (Chapter 26: Extended Telemetry).

Layer 0 Capacity Board.
Extends hardware-profile telemetry with Facility Energy Receipts and Facility Capacity Receipts (Chapter 17: Layer 0: Verifiable Machines & Energy): grid node, interconnection class, outage history, backup duration, fuel mix, cooling dependency, and Physical VerifyPrice (Chapter 22: Layer 4: Truth & Work). Reports both Sovereign Optionality and scenario-specific Delivered Verified Capacity — how much of the grid still lights up when the weather turns — plus active binding constraints, substitution latency, and dependency groups (Chapter 17: Layer 0: Verifiable Machines & Energy). Tracks whether the compute/proof layer is physically resilient or just another hyperscaler/cloud bottleneck, including the Homestead Ratio (Chapter 5: Threat Model) and, as its demand-side companion, the agent-originated share by operator class and the Cross-Perimeter Share (Chapter 26: Extended Telemetry).

Economic Coverage Board.
Charts fee-coverage ratio, real-resource VerifyPrice against its constitutional SLOs, and demand curves indexed to policy events.

Value Capture Board.
Tracks fee coverage, native-asset burn rates, collateral lockup volumes, issuance vs. capacity growth, workload mix (budgeted vs. speculative), and bypass-channel indicators (operator off-ramp rates, stablecoin-denominated fee share), the M1+M2 share of verified units, the link-9 instruments — haircut dispersion, free-choice denomination share with the quote/settle matrix, acceptance breadth — and the off-ledger exposure disclosure series of Chapter 13: Why Hold the Base Asset?. Native fee turnover and collateral lockup are additionally reported by principal class (Chapter 26: Extended Telemetry). This board makes the Value Capture Lemma from Chapter 8: The Triad and the Monetary Candidate auditable: if value capture is failing, it shows here before it shows in price. It also carries the triple divergence composite — persistently positive WNG, no corridor increment in regime-conditioned convenience yield, and falling Homestead Ratio against improving closed-stack service metrics — which is the observable signature of the joint failure mode named in Chapter 33: The Closed Sovereign Stack.

Wrapper Dominance Board.
Tracks whether the asset is becoming a financial wrapper rather than money: the Wrapper Dominance Ratio (Chapter 13: Why Hold the Base Asset?) alongside its component series (ETF/wrapper AUM, custodied balances, exchange balances, wrapped supply, native fee share, non-custodial settlement volume, shielded settlement volume, collateral lockups). A rising WDR while native usage stagnates is surfaced here before it appears anywhere else.

Agency Preservation Board.
Tracks non-custodial usage share, selective-disclosure scope, dossier-reconstitution risk, and forced-disclosure incidence (Chapter 27: Legal, Policy, and Jurisdictional Posture), operationalizing the ninth SoV requirement (Chapter 4: First Principles: What a SoV Must Survive). This board is optional in early phases but becomes load-bearing once the protocol has material institutional and administrative-state interaction. It also carries the Human-Revocable Share of agent-controlled native balances (Chapter 26: Extended Telemetry).

Market Realization & Wrapper Board.
Reports the VerifyFlow vectors (Chapter 26: Extended Telemetry): wrapper inventory by class, assets and delta-equivalent exposure, creations and redemptions, holder flow elasticity, net mechanical gain, Wrapper Recycling Ratio, constituent concentration, market-depth ratios, hedge-instrument mix, counterparty concentration, the Wrapper–Native Growth Gap, custodial versus self-custody shares, recursive wrapper exposure, cross-jurisdiction exposure, holder-cohort statistics, and the convenience-yield telemetry of Chapter 26: Extended Telemetry (lending rates, forward and perpetual basis, wrapper basis, published against the regime-pressure index).

Native Monetary Buyer Map.
Separates just-in-time fee acquisition, operator sell-through and inventory, burns and net issuance, self-custodied reserve demand, wrapper demand, leverage, holding period, loss-bearing capacity, and countercyclical accumulation (Chapter 26: Extended Telemetry). It asks who warehouses native monetary risk, not merely whether demand exists. Every cohort on it is read through the Principal Map overlay (Chapter 26: Extended Telemetry)—principal shares and the Native Policy Concentration Ratio—so that one operator’s fleet cannot read as a constituency.

Common-Cause Dependency Board.
Maps dependencies crossing nominally independent facilities or jurisdictions: hardware and accelerator vendors, firmware and signing systems, energy and fuel markets, cables and network routes, identity, custody, market making, banking, legal recognition, cooling-water basins, and software distribution. For each dependency publish affected capacity, substitutable alternatives, substitution latency, correlated stress scenarios, and the DVC loss if the group fails. The correlated physical-failure framing is adapted selectively from Doomberg’s A Minor Detail [Doomberg 2026c], treated as scenario commentary rather than forecast.

Sponsor Dependency Board.
Reports subsidy concentration, politically contingent demand, cloud-credit dependence, dominant-customer exposure, state or foundation veto power, operator exit capacity, sponsor-withdrawal sensitivity, conflicting terminal objectives, capacity removable on short notice, and spillover to neutral third parties. Subsidized operators and sponsors are separate strategic actors even when their current incentives align. The principal–agent framing is adapted selectively from Doomberg’s Over Target [Doomberg 2026d]; inferred intent and tactical escalation claims are excluded.

Do not merge the Value Capture Board and the Market Realization & Wrapper Board. They answer different questions, and collapsing them destroys the distinction the thesis depends on:

• Value Capture Board: Is service value accruing to the native asset?

• Market Realization & Wrapper Board: What is currently setting its price?

The Value Capture Board stays focused on protocol economics. The Native Monetary Buyer Map asks whether a monetary-risk warehouse exists. VerifyFlow stays focused on market realization. A reader needs all three to distinguish service accrual, monetary adoption, and financialization.

These boards are not marketing pages; they are part of the protocol’s public interface.

Detecting Drift

Drift is the failure mode that never announces itself. Nothing breaks; everything erodes — a few milliseconds added to p95 here, a few points of share consolidated there — and each reading is individually explicable, which is precisely why an adversary (or mere entropy) prefers it to an attack. Telemetry exists to catch the trend while it is still a trend:

Verification cost creep.
VerifyPrice shows p95 verify time creeping up. Response: R&D lab proposes fixes; governance ratifies changes.

Verifier concentration.
80–90% of verifications performed by one hardware profile. Response: adjust rewards to subsidize diverse profiles.

Reachability degradation.
VerifyReach shows a major country blocking protocol ports. Response: shift transports, promote alt routes. You can dam a river; you cannot dam the rain — the response is always to add paths faster than the adversary can close them.

Corridor fragility.
VerifySettle shows corridor success dropping. Response: re-weight corridors, onboard new LPs.

Making Neutrality and Repression-Resilience Falsifiable

Neutrality and repression-resilience are usually sold as moral properties. In this thesis, they are falsifiable hypotheses:

Neutrality hypothesis:
“No actor or group can reliably censor, privilege, or front-run specific flows across Layers 1–5 without being detected and without other actors being able to route around them.”

Repression-resilience hypothesis:
“Under YCC, capital controls, DPI, and blacklists, the triad’s core capacities retain sufficient DVC and the base asset’s self-custodied holder constituency retains sufficient agency to remain a monetary candidate.”

Telemetry makes these hypotheses testable:

• If VerifyReach shows certain flows consistently blocked and no alternatives emerge, neutrality is falsified.

• If VerifySettle shows privacy corridors collapsing under regulation, repression-resilience is falsified.

• If VerifyPrice shows verification cost pushed beyond reach, “anyone can verify” is falsified.

A system that cannot tolerate bad news cannot be money; it can only be marketing.

Policy-Attack Stress Harness

A monetary stack designed for repression should publish the exact conditions under which it considers itself passing or failing. For each attack scenario, the tests and pass criteria are:

Yield-curve control & negative real yields:

• Test: Over 24–36 months of $-300$ to $-500$ bps real yields, FeeCoverage (retained fees, burns excluded) as a share of security budget is stable or rising.

• Pass: Tokens behave like claims on useful capacity, not synthetic bonds.

On-/off-ramp throttling:

• Test: Non-custodial corridors maintain $\geq 95\%$ success with no protocol-attributable loss (Chapter 23: Layer 5: Value & Settlement); per-asset anonymity metrics remain above their thresholds (Chapter 23: Layer 5: Value & Settlement).

• Pass: Users can move capital via non-custodial rails even when custodial ramps are hostile.

Provenance mandates:

• Test: Canonical provenance workloads have healthy VerifyPrice; regulators can run verify(receipt) with commodity tooling.

• Pass: The triad is the cheapest way to comply with provenance mandates.

Hardware backdoor mandates:

• Test: A non-trivial share of receipts are tied to open or sampled hardware profiles, not a single opaque TEE.

• Pass: Hardware mandates become one option among many, not a kill switch.

When the stack claims “we can survive policy attacks,” the proof is not a blog post; it is a corpus of stress-harness runs with metrics and receipts.

Market-Realization Stress Tests

The harness above stresses repression and availability. The Market Realization Plane needs its own scenarios, because the compositional adversary (Chapter 5: Threat Model) does not respond to any of the tests above. Each scenario is run against the VerifyFlow vectors of Chapter 26: Extended Telemetry.

A. Wrapper inflow cannon.

A large spot or thematic fund launches; creations arrive independent of daily returns; holdings are concentrated; native liquidity is shallow. Measure: $Q^{RD}/V$, constituent concentration, price impact, native-use response, WNG. Question: does the bid convert into native usage, or only into price?

B. Elasticity regime break.

A $2\times$ or $3\times$ wrapper grows rapidly and holder elasticity drifts toward zero, so recycling declines. Measure: $\kappa$, Wrapper Recycling Ratio, volatility feedback, reversal symmetry. Question: has a product quietly become a momentum amplifier?

C. Creation halt.

Wrapper inflows stop while protocol-native usage stays constant, removing passive support. Measure: price drawdown, native fee coverage, governance response. Pass: native fee coverage remains sound and governance does not respond by inflating issuance or subsidizing price.

D. Overnight gap or market halt.

The underlying gaps beyond a daily-reset wrapper’s viable range before it can rebalance. Measure: wrapper solvency, dealer collateral calls, liquidation paths, cross-venue settlement. Pass: native protocol operations continue unaffected; wrapper failure stays contained in the Market Realization Plane.

E. Swap-capacity exhaustion.

Dealers reduce swap exposure and funds migrate to options. Measure: implied-volatility demand, gamma hedging, dealer concentration, collateral requirements, spot–volatility correlation.

F. Price up, protocol flat.

Price triples and wrapper AUM grows while native fees, settlement, proofs, and compute usage do not. Expected result: market success, monetary-adoption failure, and an automatic dashboard warning. A thesis that cannot raise an alarm during a rally is not falsifiable.

The adversary here does not send exploits; it sends letters. Layer 6 sits where protocol meets law and politics, and the encounter is asymmetric: code can be amended in a release cycle, but sanctions regimes, travel rules, and court precedents move on their own clock and do not consult the changelog. If the triad is to be sustainable, it must support lawful privacy, defend itself against bans without being defined by them, and avoid capture by any single jurisdiction. That means designing for the law as it is — including where it is hostile — rather than for the law as the cryptography would prefer it.

Lawful Privacy as Protocol Design

“Lawful privacy” is often a euphemism. Here it means something precise:

• By default, settlement and compute flows are private.

• By design, participants can opt into selective disclosure via viewing keys and receipts.

Constitutional Constraint: Policy = Predicates

Policy compliance is defined as ZK-checkable predicates over credentials and receipts, plus selectively disclosed audit windows via viewing keys.

It is not defined as global graph inspection or universal traceability. Any policy requiring ubiquitous transaction tracing is treated as incompatible with the monetary design.

What Lawful Privacy Is Not

Lawful privacy is not a promise that users can ignore legal obligations. It is a design posture in which the protocol minimizes unnecessary disclosure while allowing users to produce scoped, auditable evidence when they choose or are legally required to do so. Specifically:

• Lawful privacy does not guarantee immunity from subpoena, tax reporting, sanctions enforcement, or employment obligations.

• It does not mean that regulators will accept predicate-only compliance in all jurisdictions. Some jurisdictions will reject it.

• It does not mean that users can evade capital controls or hide from governments. The protocol provides technical confidentiality, not legal immunity.

• It does mean that the protocol itself does not require surveillance infrastructure, and that disclosure is always at the holder’s discretion rather than built into the protocol.

The legal posture is defensive, not antagonistic: the thesis designs for resilience under legal heterogeneity, not for confrontation with law.

Social Coercion Metrics: When “Optional” Becomes Mandatory

The protocol already acknowledges that lawful privacy is a technical guarantee, not a social guarantee (Chapter 5: Threat Model): it cannot prevent coercion to disclose keys, but it can raise the cost of mass surveillance, preserve optionality, and make coercion visible through telemetry. The remaining question is when optional disclosure becomes mandatory in practice.

Forced Disclosure Incidence.
Reported cases where employers, banks, landlords, visa processes, exchanges, or benefits agencies require viewing keys.

Selective Disclosure Scope.
Average breadth of information disclosed per audit event.

Dossier Reconstitution Risk.
Probability that repeated selective disclosures can reconstruct the user’s full graph.

Non-Custodial Practicality Index.
Share of flows that can be completed without a KYC chokepoint at equivalent service quality.

Lawful privacy fails socially before it fails cryptographically. If viewing keys become routine prerequisites for employment, banking, housing, travel, or benefits, optional disclosure becomes administrative disclosure—the social-layer expression of the Administrative Repression pattern introduced in Chapter 5: Threat Model. The protocol cannot stop all coercion, but it can measure whether coercion is becoming systemic. These four metrics feed the Agency Preservation Board (Chapter 26: Extended Telemetry).

Lawful privacy: what the protocol can satisfy versus what current law demands. The right-hand column is not a design boundary the protocol can hold by engineering; it is the law as written, and predicate compliance is unlawful under it in most major jurisdictions until the law changes.

Read the table honestly.

It is tempting to head the right column of this table “Cannot Require,” as if the protocol held a boundary that regulators must respect. That framing is wrong. The Travel Rule (FinCEN; FATF Recommendation 16 [FATF 2025]; the EU Transfer of Funds Regulation) obliges obligated entities to transmit and retain actual originator and beneficiary identity data — name, account, amount — not set-membership proofs. A regulated institution cannot lawfully satisfy that obligation with predicates, no matter how sound the cryptography. The accurate statements are:

• Within the current law, predicate compliance is an engineering option that is not yet a legal option. It requires legislative or rule-level change in every major jurisdiction before a regulated counterparty can rely on it. The protocol’s contribution is to make that change expressible: when a jurisdiction moves, the machinery exists to comply with far less surveillance than universal tracing would need.

• Outside regulated perimeters, the predicates are simply private. P2P settlement between non-obligated parties is not a Travel Rule event anywhere today. The design buys lawful headroom at the edges while the institutional perimeter remains a policy question, not a protocol one.

• Who curates the cleared set is a hard, unresolved question. A “sender $\in$ cleared-set” proof requires an oracle maintaining the set: a sanctions-list curator inside a privacy protocol is simultaneously a chokepoint, a legal attack surface, and a party with liability. The thesis does not have an answer and declines to pretend otherwise.

Securities Law: Classification Is Transaction-Specific

The strongest legal threat to the asset is not a ban. It is classification, and part of the exposure is created by the thesis’s own design choices, so Chapter 28: Operator & Investor Checklist cannot treat classification as weather. This section is dated: its sources are as of 13 October 2026, and the posture moves.

The governing frame.

The test remains Howey [SEC v. Howey 1946] — an investment of money, in a common enterprise, with a reasonable expectation of profit derived from the efforts of others — and the Commission’s interpretive release of March 2026 [SEC 2026a] states expressly that it does not supersede or replace that test (§I). The release separates two questions that are easy to run together: whether a crypto asset is itself a security, and whether a transaction in it is subject to an investment contract. A non-security asset can be sold subject to an investment contract; the promises and circumstances of the sale decide whether it is; and an issuer that fails to perform the managerial efforts it promised can face liability for that offering even after the asset has separated from it (§IV). Governance rights do not by themselves make an asset a security: the release contemplates digital commodities whose holders vote on technical and governance matters such as software upgrades and treasury expenditures (§III.A). Protocol mining and protocol staking are addressed by the Commission itself (§V.A, §V.B), so this analysis rests on the release rather than on the earlier Division staff statements on mining and staking [SEC 2025a] [SEC 2025b], which have no legal force.

A transaction inventory, not a token label.

The design creates several kinds of transaction, and each is examined on its own facts: what is promised, who controls performance, what financial rights exist, and what the purchaser is asked to rely on.

Burns and fee routing.

The fee split’s burn is where the economics and the law meet most directly. Economically, the thesis treats a burn as a buyback (Chapter 13: Why Hold the Base Asset?). On the legal side, the Division of Corporation Finance’s staff FAQ, updated 28 September 2026 [SEC Division of Corporation Finance 2026b], addresses buyback programmes, protocol-funded burns included (Q2.5): where a crypto system is functional and has no central party, announcing a buyback of a non-security asset is not a representation or promise to undertake essential managerial efforts, while for a system that is not functional, presenting a buyback as creating yield or return could be. The FAQ is a staff view without legal force, and its qualification — no central party — is the one this design has to earn. A burn fraction or fee split that token governance can adjust is discretion over the return to holders. Whether governance concentrated enough to exercise it amounts to a central party is the question to examine, not a settled answer in either direction. The same caution runs the other way: a fixed supply schedule is not legal clearance. The rights, the control structure, the representations, and the transaction decide together.

The design tension, as a question.

Removing holder-returning mechanics (no burns, purely consumptive fees) weakens Condition 2 of the lemma and moves the asset toward a pure service medium. Keeping them strengthens the cash-flow claim and keeps governance concentration and discretionary return management open as legal questions. Fixing issuance and fee policy ex ante, beyond governance reach, removes the discretion that would make anyone’s continuing efforts the source of return, and it is the version closest to what a store-of-value constitution should look like anyway (Chapter 25: Layer 6: Governance & Telemetry); it narrows the exposure without conferring clearance. Red Line 7 tracks whether lawful participation remains possible; the classification of each transaction in Chapter 27: Legal, Policy, and Jurisdictional Posture determines whether it can be satisfied in the largest capital pools.

This section is analysis, not advice.

Jurisdictions differ, enforcement posture shifts, and no statement here is legal advice. Any part of this architecture needs design-specific legal review before it is offered to anyone. The thesis exposes the legal questions accurately; it does not decide them through token terminology.

Defense-in-Depth Against Bans and Sanctions

Regimes may attempt to ban privacy assets, sanction addresses, mandate KYC at all edges, or classify triad services as “unlicensed financial institutions.”

The live precedent for this section is not a statute but a sanctions action and the prosecutions that followed it, and the sequence has to be read to its end, because it is tempting to stop at the point most favourable to the thesis. OFAC designated Tornado Cash in August 2022 [OFAC 2022], treating a non-custodial, autonomously operating privacy protocol as such as a sanctionable entity. In Van Loon v. Department of the Treasury [Fifth Circuit 2024] (5th Cir., November 2024) the Fifth Circuit held that the protocol’s immutable smart contracts are not “property” of a foreign national and therefore not designable under IEEPA, and OFAC delisted the contracts on 21 March 2025 [OFAC 2025]. That is the half usually told. The other half: Alexey Pertsev was convicted of money laundering in the Netherlands in May 2024 [Rechtbank Oost-Brabant 2024]; and Roman Storm was convicted in the Southern District of New York on 6 August 2025 of conspiracy to operate an unlicensed money-transmitting business (18 U.S.C. §1960), with the jury hung on the money-laundering and sanctions-conspiracy counts (United States v. Storm [SDNY 2025]). The lesson is therefore not the one the first half suggests. Non-custodial design defeated designation of the code. It did not defeat prosecution of the coders. A court agreed that nobody controlled the contracts, and a jury nonetheless convicted the person who wrote and maintained the front end of running a money-transmitting business. Developer liability is not a residual risk after the architecture is right; it is a first-class risk surface that the architecture does not reach. Three consequences for this stack:

• Developer and operator liability is a first-class risk surface, not a footnote to Layer 5’s corridor design, and it is the surface that survived the strongest possible architectural defence. Anonymous or distributed development, jurisdictional separation of maintainers from operators, the absence of any operated front end or relayer that a prosecutor can call a “business,” and legal entity structure (Chapter 27: Legal, Policy, and Jurisdictional Posture) are not conveniences; they are the difference between a delistable product and a prosecution target, and after Storm they are not a guarantee of either.

• Exchange delisting is the working enforcement mechanism, not the ban itself. Monero and Zcash were not outlawed in most jurisdictions; in the jurisdictions where regulated venues operate under Travel Rule and MiCA-style obligations [EU 2023] — the EU, the UK, Japan, South Korea, Australia, and the large US venues — they were made practically inaccessible by compliance burden at those venues, while remaining freely tradable elsewhere and peer-to-peer everywhere. Corridor design must assume the fiat on-ramp is the chokepoint that closes first (Chapter 13: Why Hold the Base Asset? engages the substitute channel this creates).

• Non-custodial is a legal argument against designation, not a shield against prosecution. The strongest available defence of the protocol is precisely the non-custodial architecture this thesis specifies — no controller, no admin keys, no ability to freeze — because it is the fact pattern that defeated the Tornado Cash designation in court. The design should maximize those properties deliberately, because they are load-bearing in litigation over the code. They did nothing for the coders, and the thesis does not pretend they will do more for this stack’s.

Layer 6 cannot prevent law from existing, but it can:

• Avoid giving any single jurisdiction a kill switch — including the one the protocol’s own emergency path would otherwise hand to whoever can compel three of five signers, which is why the censoring subset of that path is advisory by default (Chapter 25: Layer 6: Governance & Telemetry).

• Maintain jurisdictional diversity in hardware profiles, proof factories, corridor LPs, and foundation incorporation.

• Provide fallback modes: local-first clients, mesh/satellite relays, minimal CLI modes that maintain basic functionality under degraded conditions.

The legal posture is resilience under legal heterogeneity: the stack does not advertise itself as a tool to evade law, but designs for continued operation across a diverse legal landscape where some jurisdictions are friendly, some hostile, and most ambiguous.

Labs, Foundations, and Neutral Router Commitments

Key commitments:

Neutral router charters.
Router operators commit to content-agnostic routing. Deviation is punished in-protocol and reputationally.

Foundation / lab structure.
Legally separate entities with public charters that define roles and explicitly renounce certain powers.

Multi-jurisdiction footprint.
Incorporations and key staff spread across legal regimes to avoid single-point capture.

The last piece of Layer 6 is a practical checklist: how builders, operators, and allocators decide whether this stack qualifies as a next-generation store of value. It is deliberately unglamorous, and that is the point. Everything before this chapter argued the thesis at full strength; a checklist is where you stop believing the argument and start checking it. Read it as the stack’s own answer to “what would change your mind?” — each question below has a yes that strengthens the claim and a no that weakens or falsifies it.

Triad Supply: Privacy, Proofs, Compute

For each leg of the triad:

Privacy:

• Are there live, non-custodial privacy corridors with measurable anonymity sets?

• Are shielded pools growing in depth and churn?

• Are lawful-privacy patterns (viewing keys + receipts) actually used?

Proofs:

• Is there robust supply of proofs for canonical workloads?

• Are VerifyPrice SLOs met consistently?

• Is proof production diversified across hardware profiles and geographies?

Compute:

• Are meaningful amounts of useful compute being proven?

• Is there a liquid market for Work Credits?

• Are triad workloads tied to real-world demand?

Value Capture & Anti-Bypass

The most important questions for evaluating whether the SoV thesis holds:

• Can users buy equivalent Privacy, Proofs, or Compute service without the native asset?

• Are fees actually paid in the asset, or do most operators accept and immediately off-ramp alternatives?

• Are burns and collateral lockups material relative to total supply?

• Is there a visible bypass channel (hyperscaler-hosted provers, stablecoin-denominated services) that captures most of the demand without flowing through the asset?

• Does governance have the power to redirect value away from holders (e.g., by eliminating burns, inflating supply, or changing fee routing)?

• Is the Wrapper Dominance Ratio (Chapter 13: Why Hold the Base Asset?) rising while native fee share, private settlement, and collateral lockups stagnate?

• Is price being cited as evidence of monetary adoption in place of native fee, burn, collateral, and settlement series (Chapter 13: Why Hold the Base Asset?)?

If the answer to any of these is “yes,” the system may be useful infrastructure but the SoV thesis is weakened or falsified.

Institutional Holdability

• Is custody support available from regulated custodians?

• Is the legal classification clear enough for treasury or fund mandates?

• Is the asset auditable enough for institutional reporting requirements?

• Is liquidity deep enough for institutional-scale positions?

• Is there a valuation policy that allocators can apply (fee-flow models, comparable frameworks)?

Holdability is a virtue with a bill attached (Chapter 5: Threat Model). Every question above should therefore be paired with its market-realization counterweight:

• Does wrapper growth seed native usage, or substitute for it? Is the Wrapper–Native Growth Gap (Chapter 26: Extended Telemetry) persistently positive?

• What share of supply sits under custodial control (CCR), and how concentrated is that custody?

• Is delta-adjusted synthetic exposure (SER) large relative to liquid free float?

• Do daily-reset leveraged products exist on the asset, and what is their net mechanical gain $\kappa$ and Wrapper Recycling Ratio?

• Is exposure concentrated in a small number of dealers or counterparties, and has the hedge-instrument mix shifted from physical to swaps to options?

• Is demand governed by a small number of common rebalancing policies (Policy Concentration Ratio)?

• Where native demand or native holdings are agent-operated, are they classified by principal (Chapter 26: Extended Telemetry)? What share is one operator’s fleet, what share is governed by the largest policy templates on the native side, and what share of agent-controlled balances can a person still revoke through the protocol?

Holders and the Monetary Mechanisms

Everything above asks whether the conditions for moneyness hold. These questions ask whether it is happening, and fees, burns, and collateral cannot answer them.

• Does a persistent, self-custodied, loss-bearing cohort add through drawdowns (net of units spent on the service during stress, which count for it), or is native demand acquired just in time, sold on receipt, leveraged, or wrapped (Chapter 26: Extended Telemetry)?

• Why hold rather than convert on the day? Has the access experiment shown a material advantage for a held balance over the best Bitcoin-funded strategy, including provider-side conversion, for any workload and stress state (Chapter 13: Why Hold the Base Asset?)?

• Is the persistent bid a rule that absorbs less risk as prices fall, or leverage that leaves on a margin call (Chapter 3: The World Forces New Monetary Primitives)?

• Where agents hold the asset, does anyone ever revoke them? A human-revocable share that holds while the policy concentration of the same cohort rises is standing exercised by nobody (Chapter 5: Threat Model).

• Would a lender accept it without investigating it? Is cross-lender haircut dispersion on verifiable positions, across independently maintained underwriting approaches, lower than on opaque comparables of the same volatility (Red Line 17)?

• Does anyone reckon in it? Is free-choice denomination growing, and do insiders denominate their own short-tenor obligations in the unit (Red Line 18)?

• Is holding it worth more when substitutes fail? Does the convenience yield rise in the corridor band above the pre-registered minimum increment (Red Line 16)?

Stack Health: Layers 0–6

Layer 0.
Documented hardware profiles? Open hardware participation? Visible incident reports? Facility Capacity Receipts available and independently verifiable (Chapter 17: Layer 0: Verifiable Machines & Energy)? Physical VerifyPrice within bounds (Chapter 22: Layer 4: Truth & Work)? Issuance bounded by stressed Delivered Verified Capacity, with the active binding constraints named (Chapter 17: Layer 0: Verifiable Machines & Energy)?

Layer 1.
VerifyReach shows resilient connectivity? Alternative transports exist?

Layer 2.
Clients distributed via multiple channels? Reproducible and signed binaries?

Layer 3.
Pseudonymous credentials integrated? Actors can prove rights without doxxing? Non-custodial usage share and dossier-minimization score visible (Chapter 4: First Principles: What a SoV Must Survive)?

Layer 4.
Canonical workloads documented? VerifyPrice within SLOs? Proof production decentralized?

Layer 5.
Non-custodial corridors healthy and diversified? Refund safety enforced?

Layer 6.
Public dashboards? Documented governance processes? Recent incident reports?

Market Realization Plane.
Is VerifyFlow published at all (Chapter 26: Extended Telemetry)? Are wrapper inventory, creations/redemptions, flow elasticity, concentration, and the Wrapper–Native Growth Gap visible? Is the market-realization stress harness (Chapter 26: Extended Telemetry) run and reported? Remember that this plane sits around the stack, not inside it: its failure does not break the protocol, but its opacity breaks price interpretation.

Telemetry Honesty

Telemetry itself can be gamed. Checklist for honesty:

• Open data. Are raw metrics public? Can independent teams reproduce Verify* metrics?

• Client diversity. Metrics gathered by multiple operators?

• Incentive alignment. Any incentive to under-report problems?

• History. Historical series for metrics, or only recent snapshots?

Red Flags and Failure Patterns

Finally, some patterns that should trigger skepticism:

Closed hardware monoculture.
One TEE, one vendor, no sampling, no open profiles $\to$ Layer-0 cliff.

Opaque bridges.
“Magic multisig” bridges with no proofs, unclear jurisdiction, and no incident history $\to$ not settlement rails, just custodial risk.

Foundation fiat.
Major parameter or policy changes via blog post, with no on-chain trace, no telemetry, and no incident report $\to$ governance capture.

Zombie corridors.
Privacy rails that have not moved meaningful volume in months but still appear in marketing. Anonymity sets that are effectively dead.

Proof theater.
Lots of “ZK” branding but no public VerifyPrice metrics, no canonical workloads, no commodity verifiers.

Governance theater.
Token votes with single-digit participation deciding fundamental parameters; no constraints; no SLOs.

Price as proof.
Marketing that cites market capitalization, wrapper AUM, product launches, or trailing returns as evidence that the monetary thesis is working, while native fee, burn, collateral, and settlement series are absent or flat $\to$ financialization narrated as adoption (Chapter 13: Why Hold the Base Asset?).

Any one of these is survivable in the short run; taken together, they say:

“This is not a triad-backed money system; it is a platform dressed as one.”

A system with no telemetry is untrustworthy. A system with one vendor’s telemetry is fragile. A system with multi-source, reproducible telemetry has a shot at being money.

Part V closes the governance loop:

• It treats SLOs and dashboards as the constitution.

• It makes Verify* telemetry the lifeblood of neutrality and repression-resilience.

• It frames law and politics as constraints to be designed for, not as deities to be appeased.

• It gives builders and allocators a practical checklist for deciding whether a system’s “store of value” claim is mathematically grounded or just well-typeset.

With Layer 6 in place, the stack has all three angles: Money (triad as SoV), Stack (Layers 0–6), and Telemetry (Verify* keeping it honest). Part VI can now focus on dynamics (adoption curves, risk, and implementation sketches): how this thing actually gets built, traded, attacked, and, if it works, quietly becomes part of what the world calls “money.”