deviant/Parameters/Deviant_MASTER_context.md

Here is the project context document. Use it as reference for our session.

# Deviant — Master Project Context

> **Single combined reference.** Synthesized from four sources, newest-authoritative-first:
> 1. `project-context.md` — the **code-session master** (135 snapshots `0001→0132`, ADRs in `wiki/decisions.md`, `deviant_technical_spec_v2.7.md`). **This is the authoritative current technical state.**
> 2. `deviant_revenue_calculation.md` — business/economic model, taxonomy finalization, corpus, Bitcoin Cash alignment, governance design.
> 3. `deviant_mindmap.md` — naming, novels, vocabulary, cosmogenesis framing, strategy.
> 4. `deviant_init.md` — the founding brainstorm (architecture conceived end-to-end).
>
> Author/owner: **Deviant** (a Bitcoin Cash, big-blocker / on-chain-scaling–aligned project).
> Where the code session and the conversation chats disagree, the code session wins on *implementation facts*; the chats remain the source for *strategy, marketing, and rationale*. Naming differences are reconciled (see §2 — dual-register convention).

---

## 1. What Deviant is — goals and thesis

A **non-custodial Bitcoin Cash wallet + an on-chain asset protocol** (issuance, backing, and permissionless exchange) built on CashTokens and CashScript covenants. Thesis: Deviant's core distinction is **what it introduces** — **MBA** (assets with intrinsic, consensus-enforced BCH backing, unilaterally redeemable with no counterparty) and the **counterparty-free ASM** (permissionless swaps with no DEX/AMM/oracle/operator) — built **directly on Layer 1**, **eliminating trusted third parties wherever the chain can enforce a rule itself**. Bitcoin Cash's design — a **UTXO** model with native CashTokens and covenant introspection, **proof-of-work**, and **large-block on-chain scaling** — is the *enabling substrate* that makes these consensus-enforced *and* economical at scale; it is **not itself the differentiator** (other chains also run financial primitives on-chain, on different models, and it's unclear any other UTXO/PoW chain matches what CashScript enables here). The differentiator is the **backing (MBA) and the counterparty-free exchange (ASM) Deviant adds on top**.

Governing principle (stated in the governance work, applied throughout): **"What the chain CAN enforce, the chain SHOULD enforce."** A UI is a *reporter* of consensus facts, never an *authority*.

Broader framing (from the chats): the problem isn't only crypto — it's the **single point of failure** in *all* assets (issuer / custodian / counterparty). Deviant removes it **by construction** — not by regulation, not by trust. A **gold standard done by mathematics**. The protocol rate is the *gravitational center*; market prices orbit it. BCH satoshis are a **unit of account, not a price**.

---

## 2. Naming & taxonomy (current canonical)

**Three-axis classification:** mint rule (permissionless/managed) × backing (fixed rate / none) × supply (limited/unlimited) → an **8-cell taxonomy**.

**MBA — Backed-asset family.** Each unit carries an intrinsic, consensus-enforced BCH backing, redeemable unilaterally by the holder (no counterparty, oracle, or market). Members:
- **DEA** — hard-backed flagship (open mint, fixed rate, immutable).
- **PLA** — commodity-type. *(was "OLA / Open Limited Asset" in the chats)*
- **MCA** — bond-type (Managed Certificate Asset).
- **MTA** — tranche-type (Managed Tranche Asset).

**NBA — Non-Backed Asset family** (ADR-0027). Dual-register: **NBA** (technical) / **Token**, *classical tokens* (familiar); "Token" stays the wallet display label. No per-unit consensus backing invariant:
- **PTU** — game currency · **PTL** — mineable coins · **MTU** — meme/tokens · **MTL** — NFT/collectibles.
- **CDP-style stablecoins (DAI-shape) classify as PTU** — *collateral backs the debt, not the token* ("secured ≠ backed"). Stablecoins USDT/USDC reclassified **MTU** (ADR-0028).

**DRA — Dynamic-Rate Asset** (brand: **Elevation**; a.k.a. **ERA — Escalating-Rate Asset**) (ADR-0015; placement now resolved — it's an MBA): backing rate is a **transparent, published, deterministic function** of contract state (bonding curve / escalating or decreasing fee / exponential·step·arithmetic ladders). Transparency is mandatory — a masked single rate is a T-003 masquerade attack. **NAME UPDATE:** "Elevation" now brands the **DRA/ERA** (Dynamic/Escalating Rate Asset); the B→A soft→hard upgrade is now **Transition** (previously "Elevation").

**ASM — Automated Swap Mechanism:** permissionless, BCH-backed swaps, **no DEX/AMM/oracle/operator**. Consistent across all sources.

> **Acronym expansions — dual register (resolved).** The two readings run **in parallel, not competing**: a **technical** expansion and a **broad-audience** one for the same acronym.
> - **MBA**: technical = "**Minted** Backed Asset" · broad = "**Mathematically** Backed Asset"
> - **DEA**: technical = "**Direct Emission Asset**" (the more logical/mechanical reading) · broad = "**Deviant Equilibrium Asset**"
> Convention: use the **technical** expansion in the tech spec / developer docs, the **broad** expansion in marketing / public material.
> - **Family naming** settled: `DEA / PLA / MCA / MTA` (migrated from `DEA-L / OLA / DMA / DMA-L`).

---

## 3. Architecture — the load-bearing model

- **Self-backed UTXO + reservoir + `claim()`** *(the heart of the protocol)*. Each FT UTXO carries `tokenAmount × backingRateSats` of BCH **inside it**; redemption is a plain **P2PKH spend** (contract-free). Full FT supply (up to 2⁶³−1) is **pre-minted at genesis into a contract "reservoir"**; `claim(amount, recipientLockingBytecode)` drains it at the protocol rate, enforcing output shapes: `[0]` reservoir back, `[1]` FT to recipient backed at rate, `[2]` optional founder fee. Output count capped; trailing outputs checked for zero `tokenCategory` (V-001 fix).
- **The rate-peg invariant (never remove):** `require(tx.outputs[i].value == tokenAmount × backingRateSats)`. Pegged tokens cost ~10²¹ sats to drain (impossible); unpegged cost ~675 sats (free) — **18 orders of magnitude**. This single check is the one load-bearing security invariant (its absence = V-002, trivial drain).
- **Atomic swap:** two inputs (source FT P2PKH spend + target reservoir/minting NFT), **one tx**. Atomicity is **Bitcoin Cash consensus-level, not covenant-coupled** — proven YES on chipnet at snapshot **0008**. ASM is rate-function-agnostic. A 1% fee → consensus-enforced **~2% round-trip bid/ask spread**.
- **Two architectures / hybrid** (from the chats, still the model): **B = soft** (standard UTXOs, wallet-enforced, closed trusted groups only — surfaced as "Drafts/Labels," not real tokens); **A = hard** (covenant-enforced). Same tokenId across both; a **Transition** interface escalates B→A. **B-model definition poisoning (T-002) is irreducible** — mitigated only by wallet friction (D-4..D-8) and ecosystem plurality.
- **Rate tiers:** powers of 10 only; **minimum 1000 sats/unit** (load-bearing — dust + `value==grossSats` makes rate-0 contracts consensus-bricked). High/institutional tier 10 BCH/unit. **MBAs are divisible by default** (ADR-0039): atomic floor dust-safe 1000 sats, uniform **2-decimal default**; new creations only (deployed artifacts immutable).
- **CashTokens reality:** native consensus primitive (OP_RETURN tagging abandoned at ADR-0006); created by Genesis (TXID → immutable Category ID); category bytes use **consensus LE ordering** (`txidToConsensusBytes = hexToBin(hex).reverse()`). Introspection opcodes live on mainnet since **May 2022**.
- **Dust facts:** CashToken FT outputs need **675 sats** min (vs 546 P2PKH) due to ~42-byte token prefix; founder-fee output must clear 546 sats.

---

## 4. Code patterns worth preserving

- **Carried-rate trick (DRA / escalating NFTs):** store current rate/price in a **mutable NFT commitment** at the contract address; read via `int()`, enforce payout, ratchet the commitment (×mult / +inc). Un-resettable (position UTXO returns to contract). CashScript has **no `pow`/loops** → escalation via carried state; batch buys use **bounded unroll** (fixed N: `claim3()`, `claimBatch(k ≤ remainingInTier)`), **not** a variable `claimMany(n)`.
- **Co-spend-as-oracle:** one covenant attests by reading another covenant's NFT-commitment state in the same tx (no signer, no external oracle). Used in totes, Family D, voting tally. Pin layout by fixed `tx.inputs[i]`, **not** `this.activeInputIndex`.
- **`checkDataSig` oracle settlement:** 16-byte message, all uint32 LE (`timestamp, sequence, contentSequence, price`). Same format as AnyHedge & Paryon. Verifies *that* a key signed, not the *truth*.
- **Two-phase plan/execute:** every mutating wallet op = `plan*` (pure, previewable) + `execute*` (signs/broadcasts). Reifies D-5 friction (BCH magnitude shown before consent). Pre-broadcast audit gate refuses txs implying illicit minting. CLI preview-only unless `--yes`.
- **Contract-free batch burns:** `redeem-all`, `sweep-tokens`, `swap-all <target>` — all P2PKH spends, work on any registered MBA. Only `claim` (covenant mint) needs per-template integration.
- **Dependency-injected chain layer:** pure core (`src/`) tested with no network; `runtime.ts` provides `ElectrumUtxoSource`, broadcaster, `connectWallet()`. Crypto backend = **`@noble` shim replacing libauth WASM at build time** (ADR-0023, byte-for-byte) so one in-process core runs in any JS engine, no IPC.
- **KeyStore seam** (`src/wallet/keystore.ts`): platform-agnostic key custody (WebKeyStore AES-GCM/PBKDF2; CapacitorKeyStore Keychain/EncryptedSharedPreferences + biometric). R-017: `create()`/`restore()` derive at canonical BCH path so funds are visible to standard wallets.

---

## 5. Defense / threat model

- **D-1 canonical contract verification:** reconstruct template from published params; compare P2SH32 address **and** byte-exact redeem script on chain; pinned bytecode hash is a third layer (embedded canonical artifact, ADR-0008 A).
- **D-2 per-UTXO backing check:** `expected = units × rate`; flag/exclude UNDERBACKED.
- **D-3 verification source:** canonical artifacts embedded as JSON imports (browser-safe, no `fs`/`path`).
- **Threats:** V-001 rogue-minting NFT (output-cap/picker filter on `nft.amount>0`); V-002 missing rate-peg (drain); **T-001** non-canonical backdoor contract issuing underbacked FTs (D-1+D-2); **T-002** B-model poisoning (irreducible; D-4..D-8 friction); **T-003** masked DRA curve (transparency mandate).

---

## 6. Business / economic model, Bitcoin Cash alignment, positioning *(from the chats)*

- **Launch with no fundraising** — a **"proof-of-protocol-working demonstration"**, Bitcoin Cash community-first, Flipstarter-style page framed around DEA (mathematically guaranteed redeemable asset). Hero line: **"This is not a fundraise."** CTA asks to *verify*, not pledge. Revenue earned only from real activity (like Bitcoin's no-raise launch).
- **Founder fee:** on `claim()`/mint only, **immutable post-genesis** (chipnet-confirmed); **no fee on redemption**. The canonical wallet template caps it at 5% (0–500 bps) — a **wallet/template-level guardrail, not a protocol ceiling** (the protocol itself imposes no fee limit). Stepped fee canonical via **supply trigger** (`feeBps = min(base + (issued/step)·feeStep, maxFee)`); block-height trigger rejected (`tx.time` is only a CLTV bound). Honest UI = single flat slider + lock icon (two-slider fiction removed, 0082).
- **Three platform revenue streams:** (1) voluntary **marketing revenue-share** with the **Olympic tier ladder** (Free → Bronze → Silver → Gold → **Laurel**, the victor's wreath; "Olympian" is the alt name for the top tier), (2) **~0.5% wallet swap fee**, (3) **premium features** (anchored by DRA). Positioned as **Agora** — Deviant's asset launchpad and discovery marketplace, where founders publish assets and opt into platform promotion. Per-user revenue in MetaMask–Phantom range, defensible niche = **Bitcoin Cash-native + CashToken-native**.
- **Bitcoin Cash infrastructure support:** public commitment **25–50% of platform revenue** to Bitcoin Cash infrastructure, scaling toward the higher figure. Framed as **structural recognition of dependency, not philanthropy** ("most projects extract from their chain; Deviant inverts that"). Direct, 24/7-transparent. Two categories: **Category 1** protocol-level (nodes/BCHN, CashScript/CashTokens tooling, CHIP research) active at launch; **Category 2** application-level deferred. 25% floor at launch, scaling toward 50%, against revenue not profit.
- **The "Zero Properties"** (marketing): zero counterparty / intermediary / trust / liquidity-ceiling / fungibility-barrier risk, plus zero complexity·maintenance·contribution·dependence·friction. Marketing-only register; tech spec keeps qualifiers.
- **Positioning:** vs conventional tokens (ERC-20, BEP-20, and the like — financially and structurally disconnected from their base layer; MBAs are tied to it, so one asset's success amplifies the whole ecosystem); vs stablecoins (the **bankruptcy-protection floor** — on-chain recoverable value if an issuer fails, where a conventional stablecoin recovers $0); vs DEX (no order matching, no liquidity bootstrap, no counterparty wait). The **volatility paradox** (ADR-0033): the asset marketed as safe fails its advertised property under stress; an MBA promises nothing it cannot keep.
- **Slogan:** *Power Your Ideas.*
- **Naming lexicon (Greek / cosmic):** **CosmoGenesis** = the name of the default visual **theme/style** (dark cosmic — starfield + acid‑green; *cosmo* = world/universe + *genesis* = birth). **NOTE:** previously the wallet‑shell name; the wallet/client is now simply **Deviant**. The alternate style is **Editorial** (Fraunces serif). Toggle label reads "Style · CosmoGenesis / Editorial." · **Agora** = the asset launchpad, discovery, **and swap/exchange marketplace** — the space where users meet and trade (the ancient open marketplace; **absorbs the former "Orbital" swap-space role**) · **Orbital** = the asset **explorer** — market-cap-style data, rankings, and per-asset detail (the "charted heavens"; cf. coinmarketcap / cashtokensmarketcap) · **Metroon** = the filterable **asset list** (primary filter backed/non-backed; secondary: subcategory e.g. stablecoins, use-case e.g. game currency / tickets / memberships / collectibles; scope: mine / all) · **Avalanche** = the create/mint UI · **Poseidon** = the infinite-liquidity layer (deep as an ocean — the protocol-as-immutable-liquidity-provider, always available, unlimited) · **Athena (Athenae)** = the voting-system protocol (goddess of **wisdom and protection** — apt for capture-resistant collective decision-making) · **Themis (Themidae)** = the Tier-4 Elders (goddess of divine law, justice, and order). Voting docs additionally use **Athenian Democracy** terminology (sortition, citizens, chambers) as synonyms.
- **Olympus** = the **dApp platform layer** — the home where Deviant's first-party dApps reside (gods by domain). **DECIDED MODEL:** **Deviant** = the encompassing environment / project / identity (the whole house); the **CosmoGenesis wallet** = the client / front door; **Olympus** = the dApp platform layer that sits on top; **dApps** = residents of Olympus. **Athenae · Politeia Protocol = dApp #1** (governance, most built-out). **Agora** (ASM market) and **Avalanche** (MBA launch) are **candidate dApps**; future ones too (e.g. a prediction-market dApp ≈ Apollo). **NOT dApps — wallet-native surfaces/views:** Metroon (asset list), Orbital (explorer), Transition (B→A soft→hard upgrade). So the spec's "five interfaces" splits into **dApps** vs **wallet views**. Strict-pantheon note: Agora (a place) and Avalanche (non-Greek) sit outside the deity logic — kept deliberately for evocativeness (Agora ties to the Athenian thread); the strict forms would be Hermes (commerce) / Hephaestus (the forge). "Olympus, the shining one." The **Olympic tier ladder** (Free → Bronze → Silver → Gold → Laurel) is a separate medal-podium marketing motif, not the platform layer.
- **Metaphor — Asterae / Planitae (the invisible-force motif):** **Asterae** (stars; lit. "without support") + **Planitae** (planets; lit. "wandering"). The marvel is not disorder — it is that bodies with **no visible support** and **no visible force pushing them** nonetheless hold precise, stable trajectories. The force is real but unseen: gravity. This describes **Deviant's own paradigm**, *not* legacy tokens — an MBA has no visible support (no custodian, issuer, counterparty, or authority) and no visible operator directing it, yet holds its value and moves within exact order, held by an invisible-but-real force: the **mathematical backing / gravitational center** (the base-layer rate) enforced by consensus. Legacy unbacked assets have no such force at all — they simply fall. Use as the elevated narrative/visual motif for how *mathematics, not authority,* holds the system.
- **Resonance:** **DEA ≈ Dias / Zeus** (Δίας, king of the gods; shared root with *dyeus → day / light*, Latin *dies*) — a fortunate resonance for the **flagship** MBA (the "king" asset, seated atop Olympus) and a tie into the *light/shining* thread (Olympus = "the shining one"). *Decided:* Olympus = the **dApp platform layer** (above); the marketing ladder is **Olympic** (Bronze/Silver/Gold medals + **Laurel** crown), distinct from "Olympus."

---

## 7. Governance / voting system — **Athena (Athenae)** (ADR-0040, Phases A–F + EndorsementCovenant complete on chipnet)

- **Brand:** the voting-system protocol is **Athena (Athenae)** (goddess of **wisdom and protection** — fitting for capture-resistant collective decision-making); the Tier-4 Elders are **Themis (Themidae)** (Greek goddess of divine law, justice, and order). Documents use **Athenian Democracy** terminology — sortition, citizens, chambers — as accompanying synonyms (the design is structurally Athenian: sortition-based, citizen-gated, bicameral).
- **Athenian rank ladder (brand · functional):** **Metoikoi** (non-voting base — free participants, no vote/influence/decision power; the pool from which citizens are admitted) → **Polites** (Citizen; the citizen token = **Pinakion**, the Athenian ID ticket used in sortition) → **Bouleutai** (Delegated Member — the sortitioned Boule / council; *boulē* = "will") → **Themis** (Elder — divine law & justice; Areopagus parallel; Tier-4: veto / re-vote / extend) → **Nomothetes** (Founder — the lawgiver; alt: *Oikistes*). Greek names are the brand layer; functional names and code identifiers (`CitizenToken`, etc.) are unchanged.
- **Capture-resistant, Bitcoin-Cash-only** (off-chain/L2 activity is "counterfeit" to the protocol **until proved otherwise** — i.e. a claim must be validated by Bitcoin Cash network nodes against consensus and **confirmed on-chain, else rejected**; nothing counts until the nodes settle it, like a bank rejecting counterfeit notes). Voting-system **architecture is hardcoded/immutable**; votes can't change the system itself.
- **Three primitives:** PollCovenant (*Ekklesia*, allowlist) / TallyState (*Diapsephisis*, trustless tally) / StakeVoteTote (stake-weighted — **optional, never enforced**; **1p1v is the default**, a creator *may* opt into stake-weighting for treasury/shareholder contexts). Sybil resistance lives **upstream** (issuer allowlist or sortition).
- **Bicameral sortition + adaptive bootstrap + Elder/founder tiers.** Covenant stack: CitizenToken (**Pinakion**), ApplicationCovenant (**Engraphe**; A→E: single-chamber → bicameral → anti-grinding cap/fail-fast → paid-regardless escrow → commit-reveal secret ballot), RegistryState (**Katalogos**, adaptive threshold), BallotCovenant (**Psephos**), EndorsementCovenant (**Dokimasia**, on-chain pre-gate), ElderFreezeAction (**Graphe Paranomon**), ComplaintCovenant (**Euthynai**; removal = **Ostracism**). Sortition draw = **Kleroterion**.
- **ATHENIAN LEXICON (full, applied across spec + Athenae page + master):** the Athenian apparatus rebuilt as covenants and improved (no magistrate to bribe, no archon to forge a roll, no herald to miscount). Map: `CitizenToken`→Pinakion · `ApplicationCovenant`→Engraphe · `EndorsementCovenant`→Dokimasia · `RegistryState`→Katalogos · sortition draw→Kleroterion · `BallotCovenant`→Psephos · `PollCovenant`→Ekklesia · `TallyState`→Diapsephisis · `ComplaintCovenant`→Euthynai · demotion outcome→Ostracism · `ElderFreezeAction`→Graphe Paranomon · `StakeVoteTote`→(no analogue; **optional, never enforced** — 1p1v is the default, stake-weighting is opt-in). Tiers: Metoikoi/Metics · Polites · Bouleutai (boulē=will) · Themis/Themidae (Areopagus, *nomophylakes*) · Nomothetes. Greek = brand/display layer; code identifiers unchanged.
- **Layer-1 qualification filter (3 steps to grant a vote):** recommendation → random public confirmation → random delegate confirmation. Defends **both who can vote and who counts/displays results**.
- **Elders tier — Themis (Themidae)** (phased, e.g. 15/29 at 15k members; 16/30 at 16k): veto / re-vote / extend. Concern-raising carries **moderate cost, refunded if upheld** (can't be weaponized).
- **Anti-plutocracy economics:** acquiring voting weight requires **real BCH + real MBAs via ASM** (no leverage/short/derivative path) → attacker cost grows **geometrically**. **Backing must stay fixed and always-redeemable; only the non-recoverable fee escalates** (0125→0126 correction). DRA used as one option for the escalating-cost vote asset (others admissible). Off-chain endorsement counting abandoned (0124) — reintroduced a trusted verifier; replaced by on-chain `EndorsementCovenant` (~$0.15/day at 100 admissions/day).
- **Founder permanence retained** (against the usual sunset advice — "look what happened to Bitcoin without Satoshi"); flagged for a dedicated ADR if contentious.

---

## 8. Event / prediction markets

- **Totes** (pari-mutuel, binary, K=4, MBA-denominated, operator rake, refund/sweep) — chipnet-validated.
- **Oracle-settled bilateral escrows.**
- **Family D** (Polymarket-shape, ADR-0030): collateralized binary-share market, `split`/`merge` invariant `1 collateral → 1 YES + 1 NO`, oracle-settled, no pro-rata residual; configs 1–3 (BCH CLOB, MBA CLOB, fungible two-category), resting limit orders, SharePairAMM, oracle-priced vault.
- **ExpiringMBA** (ADR-0032): time-boxed self-backed instrument; "expiry" = CLTV gate + permissionless conversion (nothing is truly automatic on UTXO — no scheduler).

---

## 9. Current state — done, validated, in-flight

**Wallet core (`src/`) — feature-complete, live-validated on chipnet. ~445 unit tests passing.** Proven live on chipnet: balance, claim (incl. decreasing-fee `DeviantDescFeeSupply`), swap, tier-A/tier-B send, redeem, redeem-all, sweep-tokens, swap-all (both directions). D-1/D-2/D-3 verify layer in place. SQLite + LocalStorage registries. CLI (`deviant …`) + local web UI over one `runCommand` seam.
**Assets validated on chipnet:** ASM/ASM2 (fixed-rate); metal MBAs GLD/SLV/CUP (decreasing-fee, max-reservoir) + divisible GLDd/SLVd/CUPd.
**Shell (CosmoGenesis, Capacitor + React) — UI-complete, core runs client-side non-custodial in-WebView.** Four tabs (Main / Assets / Avalanche / Apps) + Settings; live balance/class derivation; swap flow (live rates + route detection + two-phase broadcast); on-ramp Discover (provider cards, KYC/reputation chips, jurisdiction gating, SideShift Tier-3 shift); seed-sweep; QR; activity history; token import; code-split ~315 kB app. **PWA beta live at `testchipnet.duckdns.org`** (chipnet + testnet4 only, mainnet structurally absent, non-dismissible beta banner, Let's Encrypt TLS).
**Prediction + Family D — chipnet-validated spikes** (see §8).
**AnyHedge / ParyonUSD track (~6–9 turns):** Turn 0 compat done (11 contracts compile under cashc 0.12.1); Turn 1 (AnyHedge) chipnet-validated; Turn 2 (Paryon bootstrap 7 contracts) scoped/pending; Turns 3–6 (composition + `DeviantHedgePair` tradeable FT) follow.
**Governance:** Phases A–F + EndorsementCovenant + full anti-plutocracy DRA curve spectrum (linear, exp ×2/×10, step, super-exp `(r·3.14)³`, dual-ladder) proven on chipnet. **Phase G remains:** canonical templates + wallet UI + regulatory pass; RemovalBondEscrow/TreasuryVault wiring; lazy-voter instrumentation.

> **Validation fact update** (supersedes the chats' "~130 chipnet tests"): first end-to-end swap at snapshot **0008**; the early **129+ atomic swaps** were the foundational proof the mechanism works (after which swap-specific counting stopped being the headline). The **~445-test** suite then predominantly exercises **MBAs across use cases, configurations, and adversarial / vulnerability scenarios** — what MBAs can do and whether they break — with **0 exploits / 100% peg integrity** throughout; **135 snapshot files** (`0001→0132`); current spec **v2.7**.

**Remaining / deferred:**
- Native device builds (Android Studio / Xcode) — runbook ready, needs SDKs; iOS WKWebView + biometric/camera plugins unproven on-device.
- **Mainnet validation + per-jurisdiction gating + regulatory counsel (R-016 blocks any real-money pilot).**
- Live re-verification of on-ramp Tier-2 / kycnot.me API shapes before mainnet.
- Wallet-side **genesis of DRA/descfee/escalating MBAs** (claim works; genesis UI builds only the canonical contract today).
- Spec amendment for max-reservoir recommendation (ADR-0037 A).
- `scripts/snapshot.mjs` numbering bug (`length+1` not `max+1`) — worked around; note duplicate-numbered snapshots.

---

## 10. Open questions

- **Oracle price-freshness binding** — production-blocking for every price-triggered instrument (hedge, CDP analog, OraclePricedVault). Covenants verify *that* an oracle signed, not *when*; no freshness bound yet.
- **MBA-floored meta-stable / basket-stable** (usd-rail §4.4) — needs pressure-testing before any ADR.
- **CDP round-trip without triggers** — killer scenario (−37.7% BCH): CDP loss permanent while hedge gain reverses; trigger defenses assume idealized timing + oracle trust.
- **Family D / tote multi-outcome (K>2)** — fixed K=4 validated; per-outcome sub-pool / merkle-accumulator for arbitrary K still open.
- **CashConnect co-sign payload mapping** (`WcTransactionObject → SignTransactionV0Params[]`); device validation of CashConnect/WizardConnect deferred.
- **Governance hardening on paper:** CLTV announcement delays, strict 3/3 Elder freeze (MVP uses 2), on-chain elevated demotion path, per-complainer fee ramp, treasury-routing, lazy-voter detection.
- **Founder permanence** — possible dedicated ADR if contentious.
- **Knowledgebase corpus drift** — older HTML overviews retain pre-ADR-0027/0033 framing ("soft-backed," old taxonomy); left until a full corpus repaint.

---

## 11. Working principles & constraints (cross-source)

- **"What the chain CAN enforce, the chain SHOULD enforce."** UI reports consensus facts; it is never the authority.
- **Precision over enthusiasm.** Enthusiasm attaches to the math model, not predicted social outcomes. Don't predict the market will "lean toward mathematical backing"; the only defensible claim is that the paradigm is a **tectonic shift relative to the conventional financial system**, consequences unknown.
- **Two taxonomies stay strictly separate:** backed/non-backed (what a sentence *observes*) vs the (future, separate) custody taxonomy. The tech spec is **implementation-only** (no taxonomy, no CBDC, no political framing).
- **Vocabulary:** "immutable" preferred; "ossified"/"set in stone" dropped. Use "Bitcoin Cash" (full name); "BCH" only for the unit of exchange/measurement (UoE). Word-level precision is load-bearing (chain split vs fork-off; alternative client vs hard fork; avoid "scarcity" framing; no motive attribution beyond structural pattern).
- **Process:** staged validation **regtest → chipnet → mainnet**; milestones as `snapshots/NNNN-*.md`; decisions as ADRs in `wiki/decisions.md`. Documentation precedes implementation; whitepaper follows validated implementation.
- **The owner leads the design**, arrives at correct conclusions independently, and routinely corrects Claude (arithmetic, framing, entity conflation, imprecise verbs, voting-system misreadings). Engage as a **precise technical collaborator, not a validator**.
- **Bitcoin history / block-size-war material** (BTC divergence from whitepaper, RBF "disperses adoption," "tame Bitcoin," the four readings of Adam Back incl. the un-endorsed "Trojan horse") is a **separate, non-public historical chapter** (possibly time-locked); Deviant stays publicly neutral on the BTC/BCH naming dispute.
- Implementation environment: **Claude Code**. Stack: TypeScript core + CashScript covenants + CashTokens; Capacitor + React shell; `@noble` crypto; SQLite/LocalStorage registries.

---

## 12. On-chain-only principle & parallel-session decisions *(2026-06-04/05)*

Durable digest of the parallel work session. Full detail in the four reference files (see Source map). These are **reference / governance / positioning** decisions — the **wallet tech spec (v2.8) is unaffected** (implementation-only discipline holds).

**On-chain-only design philosophy (project-wide principle).** The protocol is the only legitimate substrate; properties asserted off-chain are unverified claims, and Layer-2 is **structurally counterfeit** — the gold-standard/paper-note relationship is the *exact mechanics*, not a metaphor (paper was counterfeit from launch; the issuer's redemption promise is the fragile bridge). Crucially, verification is **active rejection, not passive invisibility**: the chain validates and *refuses* invalid transactions exactly as a bank inspects and refuses a counterfeit bill — there is no clever construction that bypasses verification, because verification *is* the only path through. Off-chain forms (wrapped tokens, custodial ledger entries, synthetics/derivatives, Lightning channel balances, sidechain holdings, off-chain governance tokens) are therefore not the asset.

**Voting-system refinements (design record — feed the Athenae spec on the next *governance* build, NOT the wallet spec).**
- **Strict layer separation.** Layer A — qualification machinery (sortition + vouching + bicameral confirmation + adaptive scaling) is **hardcoded and immutable; not votable by anyone** (no amendment pathway by design — adopted as built, or not adopted). Layer B — the polls the qualified electorate runs (creator-chosen rules). Structurally analogous to MBA contract immutability.
- **Three integrity layers, all on-chain:** *qualification* (who votes) → bicameral sortition; *counting* (who counts) → `TallyState` covenant; **presentation** (who displays results) → permissionless `close()`, covenant state **is** the result, no announcement layer. The **presentation layer is the newly-added third axis** — most deployed systems integrate at most the first two.
- **Elder confirmation over significant polls, with adaptive scaling** (replaces static 3-of-3): 1 Elder @ N≥1000 → 2 @ 2000 → **15-of-29 sortitioned Elders @ 15000+**, continuing without ceiling. **Trigger:** Delegated supermajority concern via a sortitioned 15-of-29 investigation (stops a captured Delegated minority from grinding the Elder layer). **Elder action scope:** veto + order re-vote/new poll + **extend the voting period** (defeats the "we vote, you don't notice, it passes" attack). Cost to raise a concern is moderate and **refunds if substantiated**; optional Elder recertification trigger for recursive accountability.
- **Attack-cost economics.** Bitcoin Cash has no native derivatives/leverage, so accumulation cost is **geometric** (the attacker's own demand moves price; ~2–5×, functionally unbounded at scale). The **ASM is the only MBA acquisition/redemption path** — no shorts, no distressed-price acquisition, no above-rate accumulation. **DRA** is the only MBA class whose escalating rate function gives protocol-encoded geometric anti-accumulation if used as a vote credential (calibration matters — legitimate users also face the escalation). Layers compose **multiplicatively**.

**Bitcoin Cash Infrastructure Support — v1.3 (final).** 25% of revenue at launch (floor, not target), scaling toward 50%, measured against revenue not profit. **Category 1** protocol-level (BCHN/nodes, CashScript/CashTokens tooling, CHIP research) active at launch and taking 100% of the allocation in Phase 1; **Category 2** applications deferred and **architected by the platform** with community feedback bounded to surface adjustments. Transparency in two layers: continuous **on-chain** (every disbursement a transaction) + **quarterly explanatory** disclosure. Framing locked: *"structural recognition of upstream dependency, not philanthropy."* Published **coupled with open release of the MBA Standard** at launch.

**Informational-environment thread (historical/positioning reference, stays in the separate — possibly time-locked — chapter; Deviant remains publicly neutral on the naming dispute).** Vol.14 (draft) reads the 2014–2017 environment through Bezmenov's four stages of ideological subversion, as companion to Vol.13 (the technical record). Position: BTC (post-SegWit) is not Bitcoin in the whitepaper sense; Bitcoin Cash, under the original rules, implements Satoshi's design. The *appearance* of a "contested debate" is itself the symptom of informational capture — engage from the documented position rather than reproducing the neutral framing.

**Integration verdict (integrate vs. reference).** Keep all four files as the standing **reference layer**; this section is the durable digest. Nothing here enters the **wallet** spec. The voting refinements are queued for the **Athenae governance spec** and only merge when governance is the active build target.

## 13. Source map

| Source | What it authoritatively provides |
|---|---|
| `project-context.md` (code session) | Current technical state, ADRs, covenants, threat model, validation counts, shell/PWA status, governance/prediction-market implementations. **Wins on implementation facts.** |
| `deviant_revenue_calculation.md` | Business/economic model, revenue streams, Bitcoin Cash alignment commitment, document corpus, gold-standard comparison, governance *design* rationale, taxonomy finalization. |
| `deviant_mindmap.md` | Naming conventions, the novels, vocabulary, cosmogenesis/UI framing, marketing strategy, Bitcoin-history chapter. |
| `deviant_init.md` | Founding rationale — how the wallet idea became a new asset paradigm; A/B/hybrid architecture; open-mint swap origin; earliest contract sketches; project naming. |
| `the_on-chain-only_design_philosophy_FOR-reference.html` | Project-wide on-chain-only principle: active-rejection framing, gold-standard parallel, bank↔protocol verification. Reference for all docs. |
| `deviant_voting-system-update_FOR-design-record.html` | Voting refinements (presentation layer, Elder adaptive-scaling confirmation, sortitioned trigger, attack-cost economics). Diff to the authoritative base voting-systems doc; feeds the Athenae spec on next governance revision. |
| `deviant_vol-14-draft_FOR-sophisticated-readers-and-historical-analysts.html` | Informational-environment history (Bezmenov framing, BTC≠Bitcoin). Separate historical chapter; reference. |
| `deviant_voting_counterfeight_whyonchain.md` | Full parallel-session summary (2026-06-04/05) documenting the three files above + Infrastructure Support v1.3. |

*The three individual conversation summaries remain available as standalone source-specific references; this master file is the persistent one going forward.*