deviant/Parameters/Deviant_MASTER_context.md

Here is the project context document. Use it as reference for our session.

Deviant — Master Project Context

Single combined reference. Synthesized from four sources, newest-authoritative-first:

1. project-context.md — the code-session master (135 snapshots 0001→0132, ADRs in wiki/decisions.md, deviant_technical_spec_v2.7.md). This is the authoritative current technical state.
2. deviant_revenue_calculation.md — business/economic model, taxonomy finalization, corpus, Bitcoin Cash alignment, governance design.
3. deviant_mindmap.md — naming, novels, vocabulary, cosmogenesis framing, strategy.
4. deviant_init.md — the founding brainstorm (architecture conceived end-to-end).

Author/owner: Deviant (a Bitcoin Cash, big-blocker / on-chain-scaling–aligned project). Where the code session and the conversation chats disagree, the code session wins on implementation facts; the chats remain the source for strategy, marketing, and rationale. Naming differences are reconciled (see §2 — dual-register convention).

---

1. What Deviant is — goals and thesis

A non-custodial Bitcoin Cash wallet + an on-chain asset protocol (issuance, backing, and permissionless exchange) built on CashTokens and CashScript covenants. Thesis: Deviant's core distinction is what it introduces — MBA (assets with intrinsic, consensus-enforced BCH backing, unilaterally redeemable with no counterparty) and the counterparty-free ASM (permissionless swaps with no DEX/AMM/oracle/operator) — built directly on Layer 1, eliminating trusted third parties wherever the chain can enforce a rule itself. Bitcoin Cash's design — a UTXO model with native CashTokens and covenant introspection, proof-of-work, and large-block on-chain scaling — is the enabling substrate that makes these consensus-enforced and economical at scale; it is not itself the differentiator (other chains also run financial primitives on-chain, on different models, and it's unclear any other UTXO/PoW chain matches what CashScript enables here). The differentiator is the backing (MBA) and the counterparty-free exchange (ASM) Deviant adds on top.

Governing principle (stated in the governance work, applied throughout): "What the chain CAN enforce, the chain SHOULD enforce." A UI is a reporter of consensus facts, never an authority.

Broader framing (from the chats): the problem isn't only crypto — it's the single point of failure in all assets (issuer / custodian / counterparty). Deviant removes it by construction — not by regulation, not by trust. A gold standard done by mathematics. The protocol rate is the gravitational center; market prices orbit it. BCH satoshis are a unit of account, not a price.

---

2. Naming & taxonomy (current canonical)

Three-axis classification: mint rule (permissionless/managed) × backing (fixed rate / none) × supply (limited/unlimited) → an 8-cell taxonomy.

MBA — Backed-asset family. Each unit carries an intrinsic, consensus-enforced BCH backing, redeemable unilaterally by the holder (no counterparty, oracle, or market). Members:

• DEA — hard-backed flagship (open mint, fixed rate, immutable).
• PLA — commodity-type. (was "OLA / Open Limited Asset" in the chats)
• MCA — bond-type (Managed Certificate Asset).
• MTA — tranche-type (Managed Tranche Asset).

NBA — Non-Backed Asset family (ADR-0027). Dual-register: NBA (technical) / Token, classical tokens (familiar); "Token" stays the wallet display label. No per-unit consensus backing invariant:

• PTU — game currency · PTL — mineable coins · MTU — meme/tokens · MTL — NFT/collectibles.
• CDP-style stablecoins (DAI-shape) classify as PTU — collateral backs the debt, not the token ("secured ≠ backed"). Stablecoins USDT/USDC reclassified MTU (ADR-0028).

DRA — Dynamic-Rate Asset (brand: Elevation; a.k.a. ERA — Escalating-Rate Asset) (ADR-0015; placement now resolved — it's an MBA): backing rate is a transparent, published, deterministic function of contract state (bonding curve / escalating or decreasing fee / exponential·step·arithmetic ladders). Transparency is mandatory — a masked single rate is a T-003 masquerade attack. NAME UPDATE: "Elevation" now brands the DRA/ERA (Dynamic/Escalating Rate Asset); the B→A soft→hard upgrade is now Transition (previously "Elevation").

ASM — Automated Swap Mechanism: permissionless, BCH-backed swaps, no DEX/AMM/oracle/operator. Consistent across all sources.

Acronym expansions — dual register (resolved). The two readings run in parallel, not competing: a technical expansion and a broad-audience one for the same acronym.

• MBA: technical = "Minted Backed Asset" · broad = "Mathematically Backed Asset"
• DEA: technical = "Direct Emission Asset" (the more logical/mechanical reading) · broad = "Deviant Equilibrium Asset" Convention: use the technical expansion in the tech spec / developer docs, the broad expansion in marketing / public material.
• Family naming settled: DEA / PLA / MCA / MTA (migrated from DEA-L / OLA / DMA / DMA-L).

---

3. Architecture — the load-bearing model

• Self-backed UTXO + reservoir + claim() (the heart of the protocol). Each FT UTXO carries tokenAmount × backingRateSats of BCH inside it; redemption is a plain P2PKH spend (contract-free). Full FT supply (up to 2⁶³−1) is pre-minted at genesis into a contract "reservoir"; claim(amount, recipientLockingBytecode) drains it at the protocol rate, enforcing output shapes: [0] reservoir back, [1] FT to recipient backed at rate, [2] optional founder fee. Output count capped; trailing outputs checked for zero tokenCategory (V-001 fix).
• The rate-peg invariant (never remove): require(tx.outputs[i].value == tokenAmount × backingRateSats). Pegged tokens cost ~10²¹ bits to drain (impossible); unpegged cost ~675 bits (free) — 18 orders of magnitude. This single check is the one load-bearing security invariant (its absence = V-002, trivial drain).
• Atomic swap: two inputs (source FT P2PKH spend + target reservoir/minting NFT), one tx. Atomicity is Bitcoin Cash consensus-level, not covenant-coupled — proven YES on chipnet at snapshot 0008. ASM is rate-function-agnostic. A 1% fee → consensus-enforced ~2% round-trip bid/ask spread.
• Two architectures / hybrid (from the chats, still the model): B = soft (standard UTXOs, wallet-enforced, closed trusted groups only — surfaced as "Drafts/Labels," not real tokens); A = hard (covenant-enforced). Same tokenId across both; a Transition interface escalates B→A. B-model definition poisoning (T-002) is irreducible — mitigated only by wallet friction (D-4..D-8) and ecosystem plurality.
• Rate tiers: powers of 10 only; minimum 1000 bits/unit (load-bearing — dust + value==grossSats makes rate-0 contracts consensus-bricked). High/institutional tier 10 BCH/unit. MBAs are divisible by default (ADR-0039): atomic floor dust-safe 1000 bits, uniform 2-decimal default; new creations only (deployed artifacts immutable).
• CashTokens reality: native consensus primitive (OP_RETURN tagging abandoned at ADR-0006); created by Genesis (TXID → immutable Category ID); category bytes use consensus LE ordering (txidToConsensusBytes = hexToBin(hex).reverse()). Introspection opcodes live on mainnet since May 2022.
• Dust facts: CashToken FT outputs need 675 bits min (vs 546 P2PKH) due to ~42-byte token prefix; founder-fee output must clear 546 bits.

---

4. Code patterns worth preserving

• Carried-rate trick (DRA / escalating NFTs): store current rate/price in a mutable NFT commitment at the contract address; read via int(), enforce payout, ratchet the commitment (×mult / +inc). Un-resettable (position UTXO returns to contract). CashScript has no pow/loops → escalation via carried state; batch buys use bounded unroll (fixed N: claim3(), claimBatch(k ≤ remainingInTier)), not a variable claimMany(n).
• Co-spend-as-oracle: one covenant attests by reading another covenant's NFT-commitment state in the same tx (no signer, no external oracle). Used in totes, Family D, voting tally. Pin layout by fixed tx.inputs[i], not this.activeInputIndex.
• checkDataSig oracle settlement: 16-byte message, all uint32 LE (timestamp, sequence, contentSequence, price). Same format as AnyHedge & Paryon. Verifies that a key signed, not the truth.
• Two-phase plan/execute: every mutating wallet op = plan* (pure, previewable) + execute* (signs/broadcasts). Reifies D-5 friction (BCH magnitude shown before consent). Pre-broadcast audit gate refuses txs implying illicit minting. CLI preview-only unless --yes.
• Contract-free batch burns: redeem-all, sweep-tokens, swap-all <target> — all P2PKH spends, work on any registered MBA. Only claim (covenant mint) needs per-template integration.
• Dependency-injected chain layer: pure core (src/) tested with no network; runtime.ts provides ElectrumUtxoSource, broadcaster, connectWallet(). Crypto backend = @noble shim replacing libauth WASM at build time (ADR-0023, byte-for-byte) so one in-process core runs in any JS engine, no IPC.
• KeyStore seam (src/wallet/keystore.ts): platform-agnostic key custody (WebKeyStore AES-GCM/PBKDF2; CapacitorKeyStore Keychain/EncryptedSharedPreferences + biometric). R-017: create()/restore() derive at canonical BCH path so funds are visible to standard wallets.

---

5. Defense / threat model

• D-1 canonical contract verification: reconstruct template from published params; compare P2SH32 address and byte-exact redeem script on chain; pinned bytecode hash is a third layer (embedded canonical artifact, ADR-0008 A).
• D-2 per-UTXO backing check: expected = units × rate; flag/exclude UNDERBACKED.
• D-3 verification source: canonical artifacts embedded as JSON imports (browser-safe, no fs/path).
• Threats: V-001 rogue-minting NFT (output-cap/picker filter on nft.amount>0); V-002 missing rate-peg (drain); T-001 non-canonical backdoor contract issuing underbacked FTs (D-1+D-2); T-002 B-model poisoning (irreducible; D-4..D-8 friction); T-003 masked DRA curve (transparency mandate).

---

6. Business / economic model, Bitcoin Cash alignment, positioning (from the chats)

• Launch with no fundraising — a "proof-of-protocol-working demonstration", Bitcoin Cash community-first, Flipstarter-style page framed around DEA (mathematically guaranteed redeemable asset). Hero line: "This is not a fundraise." CTA asks to verify, not pledge. Revenue earned only from real activity (like Bitcoin's no-raise launch).
• Founder fee: on claim()/mint only, immutable post-genesis (chipnet-confirmed); no fee on redemption. The canonical wallet template caps it at 5% (0–500 bps) — a wallet/template-level guardrail, not a protocol ceiling (the protocol itself imposes no fee limit). Stepped fee canonical via supply trigger (feeBps = min(base + (issued/step)·feeStep, maxFee)); block-height trigger rejected (tx.time is only a CLTV bound). Honest UI = single flat slider + lock icon (two-slider fiction removed, 0082).
• Three platform revenue streams: (1) voluntary marketing revenue-share with the Olympic tier ladder (Free → Bronze → Silver → Gold → Laurel, the victor's wreath; "Olympian" is the alt name for the top tier), (2) ~0.5% wallet swap fee, (3) premium features (anchored by DRA). Positioned as Agora — Deviant's asset launchpad and discovery marketplace, where founders publish assets and opt into platform promotion. Per-user revenue in MetaMask–Phantom range, defensible niche = Bitcoin Cash-native + CashToken-native.
• Bitcoin Cash infrastructure support: public commitment 25–50% of platform revenue to Bitcoin Cash infrastructure, scaling toward the higher figure. Framed as structural recognition of dependency, not philanthropy ("most projects extract from their chain; Deviant inverts that"). Direct, 24/7-transparent. Two categories: Category 1 protocol-level (nodes/BCHN, CashScript/CashTokens tooling, CHIP research) active at launch; Category 2 application-level deferred. 25% floor at launch, scaling toward 50%, against revenue not profit.
• The "Zero Properties" (marketing): zero counterparty / intermediary / trust / liquidity-ceiling / fungibility-barrier risk, plus zero complexity·maintenance·contribution·dependence·friction. Marketing-only register; tech spec keeps qualifiers.
• Positioning: vs conventional tokens (ERC-20, BEP-20, and the like — financially and structurally disconnected from their base layer; MBAs are tied to it, so one asset's success amplifies the whole ecosystem); vs stablecoins (the bankruptcy-protection floor — on-chain recoverable value if an issuer fails, where a conventional stablecoin recovers $0); vs DEX (no order matching, no liquidity bootstrap, no counterparty wait). The volatility paradox (ADR-0033): the asset marketed as safe fails its advertised property under stress; an MBA promises nothing it cannot keep.
• Slogan: Power Your Ideas.
• Naming lexicon (Greek / cosmic): CosmoGenesis = the name of the default visual theme/style (dark cosmic — starfield + acid‑green; cosmo = world/universe + genesis = birth). NOTE: previously the wallet‑shell name; the wallet/client is now simply Deviant. The alternate style is Editorial (Fraunces serif). Toggle label reads "Style · CosmoGenesis / Editorial." · Agora = the asset launchpad, discovery, and swap/exchange marketplace — the space where users meet and trade (the ancient open marketplace; absorbs the former "Orbital" swap-space role) · Orbital = the asset explorer — market-cap-style data, rankings, and per-asset detail (the "charted heavens"; cf. coinmarketcap / cashtokensmarketcap) · Metroon = the filterable asset list (primary filter backed/non-backed; secondary: subcategory e.g. stablecoins, use-case e.g. game currency / tickets / memberships / collectibles; scope: mine / all) · Avalanche = the create/mint UI · Poseidon = the infinite-liquidity layer (deep as an ocean — the protocol-as-immutable-liquidity-provider, always available, unlimited) · Athena (Athenae) = the voting-system protocol (goddess of wisdom and protection — apt for capture-resistant collective decision-making) · Themis (Themidae) = the Tier-4 Elders (goddess of divine law, justice, and order). Voting docs additionally use Athenian Democracy terminology (sortition, citizens, chambers) as synonyms.
• Olympus = the dApp platform layer — the home where Deviant's first-party dApps reside (gods by domain). DECIDED MODEL: Deviant = the encompassing environment / project / identity (the whole house); the CosmoGenesis wallet = the client / front door; Olympus = the dApp platform layer that sits on top; dApps = residents of Olympus. Athenae · Politeia Protocol = dApp #1 (governance, most built-out). Agora (ASM market) and Avalanche (MBA launch) are candidate dApps; future ones too (e.g. a prediction-market dApp ≈ Apollo). NOT dApps — wallet-native surfaces/views: Metroon (asset list), Orbital (explorer), Transition (B→A soft→hard upgrade). So the spec's "five interfaces" splits into dApps vs wallet views. Strict-pantheon note: Agora (a place) and Avalanche (non-Greek) sit outside the deity logic — kept deliberately for evocativeness (Agora ties to the Athenian thread); the strict forms would be Hermes (commerce) / Hephaestus (the forge). "Olympus, the shining one." The Olympic tier ladder (Free → Bronze → Silver → Gold → Laurel) is a separate medal-podium marketing motif, not the platform layer.
• Metaphor — Asterae / Planitae (the invisible-force motif): Asterae (stars; lit. "without support") + Planitae (planets; lit. "wandering"). The marvel is not disorder — it is that bodies with no visible support and no visible force pushing them nonetheless hold precise, stable trajectories. The force is real but unseen: gravity. This describes Deviant's own paradigm, not legacy tokens — an MBA has no visible support (no custodian, issuer, counterparty, or authority) and no visible operator directing it, yet holds its value and moves within exact order, held by an invisible-but-real force: the mathematical backing / gravitational center (the base-layer rate) enforced by consensus. Legacy unbacked assets have no such force at all — they simply fall. Use as the elevated narrative/visual motif for how mathematics, not authority, holds the system.
• Resonance: DEA ≈ Dias / Zeus (Δίας, king of the gods; shared root with dyeus → day / light, Latin dies) — a fortunate resonance for the flagship MBA (the "king" asset, seated atop Olympus) and a tie into the light/shining thread (Olympus = "the shining one"). Decided: Olympus = the dApp platform layer (above); the marketing ladder is Olympic (Bronze/Silver/Gold medals + Laurel crown), distinct from "Olympus."

---

7. Governance / voting system — Athena (Athenae) (ADR-0040, Phases A–F + EndorsementCovenant complete on chipnet)

• Brand: the voting-system protocol is Athena (Athenae) (goddess of wisdom and protection — fitting for capture-resistant collective decision-making); the Tier-4 Elders are Themis (Themidae) (Greek goddess of divine law, justice, and order). Documents use Athenian Democracy terminology — sortition, citizens, chambers — as accompanying synonyms (the design is structurally Athenian: sortition-based, citizen-gated, bicameral).
• Athenian rank ladder (brand · functional): Metoikoi (non-voting base — free participants, no vote/influence/decision power; the pool from which citizens are admitted) → Polites (Citizen; the citizen token = Pinakion, the Athenian ID ticket used in sortition) → Bouleutai (Delegated Member — the sortitioned Boule / council; boulē = "will") → Themis (Elder — divine law & justice; Areopagus parallel; Tier-4: veto / re-vote / extend) → Nomothetes (Founder — the lawgiver; alt: Oikistes). Greek names are the brand layer; functional names and code identifiers (CitizenToken, etc.) are unchanged.
• Capture-resistant, Bitcoin-Cash-only (off-chain/L2 activity is "counterfeit" to the protocol until proved otherwise — i.e. a claim must be validated by Bitcoin Cash network nodes against consensus and confirmed on-chain, else rejected; nothing counts until the nodes settle it, like a bank rejecting counterfeit notes). Voting-system architecture is hardcoded/immutable; votes can't change the system itself.
• Three primitives: PollCovenant (Ekklesia, allowlist) / TallyState (Diapsephisis, trustless tally) / StakeVoteTote (stake-weighted — optional, never enforced; 1p1v is the default, a creator may opt into stake-weighting for treasury/shareholder contexts). Sybil resistance lives upstream (issuer allowlist or sortition).
• Bicameral sortition + adaptive bootstrap + Elder/founder tiers. Covenant stack: CitizenToken (Pinakion), ApplicationCovenant (Engraphe; A→E: single-chamber → bicameral → anti-grinding cap/fail-fast → paid-regardless escrow → commit-reveal secret ballot), RegistryState (Katalogos, adaptive threshold), BallotCovenant (Psephos), EndorsementCovenant (Dokimasia, on-chain pre-gate), ElderFreezeAction (Graphe Paranomon), ComplaintCovenant (Euthynai; removal = Ostracism). Sortition draw = Kleroterion.
• ATHENIAN LEXICON (full, applied across spec + Athenae page + master): the Athenian apparatus rebuilt as covenants and improved (no magistrate to bribe, no archon to forge a roll, no herald to miscount). Map: CitizenToken→Pinakion · ApplicationCovenant→Engraphe · EndorsementCovenant→Dokimasia · RegistryState→Katalogos · sortition draw→Kleroterion · BallotCovenant→Psephos · PollCovenant→Ekklesia · TallyState→Diapsephisis · ComplaintCovenant→Euthynai · demotion outcome→Ostracism · ElderFreezeAction→Graphe Paranomon · StakeVoteTote→(no analogue; optional, never enforced — 1p1v is the default, stake-weighting is opt-in). Tiers: Metoikoi/Metics · Polites · Bouleutai (boulē=will) · Themis/Themidae (Areopagus, nomophylakes) · Nomothetes. Greek = brand/display layer; code identifiers unchanged.
• Layer-1 qualification filter (3 steps to grant a vote): recommendation → random public confirmation → random delegate confirmation. Defends both who can vote and who counts/displays results.
• Elders tier — Themis (Themidae) (phased, e.g. 15/29 at 15k members; 16/30 at 16k): veto / re-vote / extend. Concern-raising carries moderate cost, refunded if upheld (can't be weaponized).
• Anti-plutocracy economics: acquiring voting weight requires real BCH + real MBAs via ASM (no leverage/short/derivative path) → attacker cost grows geometrically. Backing must stay fixed and always-redeemable; only the non-recoverable fee escalates (0125→0126 correction). DRA used as one option for the escalating-cost vote asset (others admissible). Off-chain endorsement counting abandoned (0124) — reintroduced a trusted verifier; replaced by on-chain EndorsementCovenant (~$0.15/day at 100 admissions/day).
• Founder permanence retained (against the usual sunset advice — "look what happened to Bitcoin without Satoshi"); flagged for a dedicated ADR if contentious.

---

8. Event / prediction markets

• Totes (pari-mutuel, binary, K=4, MBA-denominated, operator rake, refund/sweep) — chipnet-validated.
• Oracle-settled bilateral escrows.
• Family D (Polymarket-shape, ADR-0030): collateralized binary-share market, split/merge invariant 1 collateral → 1 YES + 1 NO, oracle-settled, no pro-rata residual; configs 1–3 (BCH CLOB, MBA CLOB, fungible two-category), resting limit orders, SharePairAMM, oracle-priced vault.
• ExpiringMBA (ADR-0032): time-boxed self-backed instrument; "expiry" = CLTV gate + permissionless conversion (nothing is truly automatic on UTXO — no scheduler).

---

9. Current state — done, validated, in-flight

Wallet core (src/) — feature-complete, live-validated on chipnet. ~445 unit tests passing. Proven live on chipnet: balance, claim (incl. decreasing-fee DeviantDescFeeSupply), swap, tier-A/tier-B send, redeem, redeem-all, sweep-tokens, swap-all (both directions). D-1/D-2/D-3 verify layer in place. SQLite + LocalStorage registries. CLI (deviant …) + local web UI over one runCommand seam. Assets validated on chipnet: ASM/ASM2 (fixed-rate); metal MBAs GLD/SLV/CUP (decreasing-fee, max-reservoir) + divisible GLDd/SLVd/CUPd. Shell (CosmoGenesis, Capacitor + React) — UI-complete, core runs client-side non-custodial in-WebView. Four tabs (Main / Assets / Avalanche / Apps) + Settings; live balance/class derivation; swap flow (live rates + route detection + two-phase broadcast); on-ramp Discover (provider cards, KYC/reputation chips, jurisdiction gating, SideShift Tier-3 shift); seed-sweep; QR; activity history; token import; code-split ~315 kB app. PWA beta live at testchipnet.duckdns.org (chipnet + testnet4 only, mainnet structurally absent, non-dismissible beta banner, Let's Encrypt TLS). Prediction + Family D — chipnet-validated spikes (see §8). AnyHedge / ParyonUSD track (~6–9 turns): Turn 0 compat done (11 contracts compile under cashc 0.12.1); Turn 1 (AnyHedge) chipnet-validated; Turn 2 (Paryon bootstrap 7 contracts) scoped/pending; Turns 3–6 (composition + DeviantHedgePair tradeable FT) follow. Governance: Phases A–F + EndorsementCovenant + full anti-plutocracy DRA curve spectrum (linear, exp ×2/×10, step, super-exp (r·3.14)³, dual-ladder) proven on chipnet. Phase G remains: canonical templates + wallet UI + regulatory pass; RemovalBondEscrow/TreasuryVault wiring; lazy-voter instrumentation.

Validation fact update (supersedes the chats' "~130 chipnet tests"): first end-to-end swap at snapshot 0008; the early 129+ atomic swaps were the foundational proof the mechanism works (after which swap-specific counting stopped being the headline). The ~445-test suite then predominantly exercises MBAs across use cases, configurations, and adversarial / vulnerability scenarios — what MBAs can do and whether they break — with 0 exploits / 100% peg integrity throughout; 135 snapshot files (0001→0132); current spec v2.7.

Remaining / deferred:

• Native device builds (Android Studio / Xcode) — runbook ready, needs SDKs; iOS WKWebView + biometric/camera plugins unproven on-device.
• Mainnet validation + per-jurisdiction gating + regulatory counsel (R-016 blocks any real-money pilot).
• Live re-verification of on-ramp Tier-2 / kycnot.me API shapes before mainnet.
• Wallet-side genesis of DRA/descfee/escalating MBAs (claim works; genesis UI builds only the canonical contract today).
• Spec amendment for max-reservoir recommendation (ADR-0037 A).
• scripts/snapshot.mjs numbering bug (length+1 not max+1) — worked around; note duplicate-numbered snapshots.

---

10. Open questions

• Oracle price-freshness binding — production-blocking for every price-triggered instrument (hedge, CDP analog, OraclePricedVault). Covenants verify that an oracle signed, not when; no freshness bound yet.
• MBA-floored meta-stable / basket-stable (usd-rail §4.4) — needs pressure-testing before any ADR.
• CDP round-trip without triggers — killer scenario (−37.7% BCH): CDP loss permanent while hedge gain reverses; trigger defenses assume idealized timing + oracle trust.
• Family D / tote multi-outcome (K>2) — fixed K=4 validated; per-outcome sub-pool / merkle-accumulator for arbitrary K still open.
• CashConnect co-sign payload mapping (WcTransactionObject → SignTransactionV0Params[]); device validation of CashConnect/WizardConnect deferred.
• Governance hardening on paper: CLTV announcement delays, strict 3/3 Elder freeze (MVP uses 2), on-chain elevated demotion path, per-complainer fee ramp, treasury-routing, lazy-voter detection.
• Founder permanence — possible dedicated ADR if contentious.
• Knowledgebase corpus drift — older HTML overviews retain pre-ADR-0027/0033 framing ("soft-backed," old taxonomy); left until a full corpus repaint.

---

11. Working principles & constraints (cross-source)

• "What the chain CAN enforce, the chain SHOULD enforce." UI reports consensus facts; it is never the authority.
• Precision over enthusiasm. Enthusiasm attaches to the math model, not predicted social outcomes. Don't predict the market will "lean toward mathematical backing"; the only defensible claim is that the paradigm is a tectonic shift relative to the conventional financial system, consequences unknown.
• Two taxonomies stay strictly separate: backed/non-backed (what a sentence observes) vs the (future, separate) custody taxonomy. The tech spec is implementation-only (no taxonomy, no CBDC, no political framing).
• Vocabulary: "immutable" preferred; "ossified"/"set in stone" dropped. Use "Bitcoin Cash" (full name); "BCH" only for the unit of exchange/measurement (UoE). Word-level precision is load-bearing (chain split vs fork-off; alternative client vs hard fork; avoid "scarcity" framing; no motive attribution beyond structural pattern).
• Process: staged validation regtest → chipnet → mainnet; milestones as snapshots/NNNN-*.md; decisions as ADRs in wiki/decisions.md. Documentation precedes implementation; whitepaper follows validated implementation.
• The owner leads the design, arrives at correct conclusions independently, and routinely corrects Claude (arithmetic, framing, entity conflation, imprecise verbs, voting-system misreadings). Engage as a precise technical collaborator, not a validator.
• Bitcoin history / block-size-war material (BTC divergence from whitepaper, RBF "disperses adoption," "tame Bitcoin," the four readings of Adam Back incl. the un-endorsed "Trojan horse") is a separate, non-public historical chapter (possibly time-locked); Deviant stays publicly neutral on the BTC/BCH naming dispute.
• Implementation environment: Claude Code. Stack: TypeScript core + CashScript covenants + CashTokens; Capacitor + React shell; @noble crypto; SQLite/LocalStorage registries.

---

12. On-chain-only principle & parallel-session decisions (2026-06-04/05)

Durable digest of the parallel work session. Full detail in the four reference files (see Source map). These are reference / governance / positioning decisions — the wallet tech spec (v2.8) is unaffected (implementation-only discipline holds).

On-chain-only design philosophy (project-wide principle). The protocol is the only legitimate substrate; properties asserted off-chain are unverified claims, and Layer-2 is structurally counterfeit — the gold-standard/paper-note relationship is the exact mechanics, not a metaphor (paper was counterfeit from launch; the issuer's redemption promise is the fragile bridge). Crucially, verification is active rejection, not passive invisibility: the chain validates and refuses invalid transactions exactly as a bank inspects and refuses a counterfeit bill — there is no clever construction that bypasses verification, because verification is the only path through. Off-chain forms (wrapped tokens, custodial ledger entries, synthetics/derivatives, Lightning channel balances, sidechain holdings, off-chain governance tokens) are therefore not the asset.

Voting-system refinements (design record — feed the Athenae spec on the next governance build, NOT the wallet spec).

• Strict layer separation. Layer A — qualification machinery (sortition + vouching + bicameral confirmation + adaptive scaling) is hardcoded and immutable; not votable by anyone (no amendment pathway by design — adopted as built, or not adopted). Layer B — the polls the qualified electorate runs (creator-chosen rules). Structurally analogous to MBA contract immutability.
• Three integrity layers, all on-chain: qualification (who votes) → bicameral sortition; counting (who counts) → TallyState covenant; presentation (who displays results) → permissionless close(), covenant state is the result, no announcement layer. The presentation layer is the newly-added third axis — most deployed systems integrate at most the first two.
• Elder confirmation over significant polls, with adaptive scaling (replaces static 3-of-3): 1 Elder @ N≥1000 → 2 @ 2000 → 15-of-29 sortitioned Elders @ 15000+, continuing without ceiling. Trigger: Delegated supermajority concern via a sortitioned 15-of-29 investigation (stops a captured Delegated minority from grinding the Elder layer). Elder action scope: veto + order re-vote/new poll + extend the voting period (defeats the "we vote, you don't notice, it passes" attack). Cost to raise a concern is moderate and refunds if substantiated; optional Elder recertification trigger for recursive accountability.
• Attack-cost economics. Bitcoin Cash has no native derivatives/leverage, so accumulation cost is geometric (the attacker's own demand moves price; ~2–5×, functionally unbounded at scale). The ASM is the only MBA acquisition/redemption path — no shorts, no distressed-price acquisition, no above-rate accumulation. DRA is the only MBA class whose escalating rate function gives protocol-encoded geometric anti-accumulation if used as a vote credential (calibration matters — legitimate users also face the escalation). Layers compose multiplicatively.

Bitcoin Cash Infrastructure Support — v1.3 (final). 25% of revenue at launch (floor, not target), scaling toward 50%, measured against revenue not profit. Category 1 protocol-level (BCHN/nodes, CashScript/CashTokens tooling, CHIP research) active at launch and taking 100% of the allocation in Phase 1; Category 2 applications deferred and architected by the platform with community feedback bounded to surface adjustments. Transparency in two layers: continuous on-chain (every disbursement a transaction) + quarterly explanatory disclosure. Framing locked: "structural recognition of upstream dependency, not philanthropy." Published coupled with open release of the MBA Standard at launch.

Informational-environment thread (historical/positioning reference, stays in the separate — possibly time-locked — chapter; Deviant remains publicly neutral on the naming dispute). Vol.14 (draft) reads the 2014–2017 environment through Bezmenov's four stages of ideological subversion, as companion to Vol.13 (the technical record). Position: BTC (post-SegWit) is not Bitcoin in the whitepaper sense; Bitcoin Cash, under the original rules, implements Satoshi's design. The appearance of a "contested debate" is itself the symptom of informational capture — engage from the documented position rather than reproducing the neutral framing.

Integration verdict (integrate vs. reference). Keep all four files as the standing reference layer; this section is the durable digest. Nothing here enters the wallet spec. The voting refinements are queued for the Athenae governance spec and only merge when governance is the active build target.

13. Source map

Source	What it authoritatively provides
project-context.md (code session)	Current technical state, ADRs, covenants, threat model, validation counts, shell/PWA status, governance/prediction-market implementations. Wins on implementation facts.
deviant_revenue_calculation.md	Business/economic model, revenue streams, Bitcoin Cash alignment commitment, document corpus, gold-standard comparison, governance design rationale, taxonomy finalization.
deviant_mindmap.md	Naming conventions, the novels, vocabulary, cosmogenesis/UI framing, marketing strategy, Bitcoin-history chapter.
deviant_init.md	Founding rationale — how the wallet idea became a new asset paradigm; A/B/hybrid architecture; open-mint swap origin; earliest contract sketches; project naming.
the_on-chain-only_design_philosophy_FOR-reference.html	Project-wide on-chain-only principle: active-rejection framing, gold-standard parallel, bank↔protocol verification. Reference for all docs.
deviant_voting-system-update_FOR-design-record.html	Voting refinements (presentation layer, Elder adaptive-scaling confirmation, sortitioned trigger, attack-cost economics). Diff to the authoritative base voting-systems doc; feeds the Athenae spec on next governance revision.
deviant_vol-14-draft_FOR-sophisticated-readers-and-historical-analysts.html	Informational-environment history (Bezmenov framing, BTC≠Bitcoin). Separate historical chapter; reference.
deviant_voting_counterfeight_whyonchain.md	Full parallel-session summary (2026-06-04/05) documenting the three files above + Infrastructure Support v1.3.

The three individual conversation summaries remain available as standalone source-specific references; this master file is the persistent one going forward.