The ledger on the relays DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Precedence: where this document and definitions 0.3.0 differ, the definitions (docs/bsa-records-0.3.0.json) win; the difference is a mistake in this document, to be fixed.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

Whatever in this document is not marked as decided is a proposal waiting for the owner's yes. Every larger proposal names its question number. The owner's answers to questions 1–9 (16 October), the owner's answers to the open points the same afternoon, the owner's answers C1–C7 (17 October), the owner's answers 1A, 2A and 3A (the evening of 17 October) and the owner's answers before phase E (E-1 to E-9, 23 October) are written in as decided. What changed on 23 October carries a label: [Decided 23 Oct 2026, E-n] (the owner's decision), [Proposal] (my proposal, waiting for the owner's yes) and [Consequence] (follows from decisions, needs no new decision). What is still undecided is marked "open" (for example "open 8g") and gathered at the end.

The essence#

• The circle's ledger is on the relays, not on a server. It is a public, numbered chain of blocks. Every block carries the payments as the members signed them, everything that follows from them, and the balance of every account the block touched.
• Nothing is hidden. Every payment, amount, purpose, who paid whom, every balance, wave, gravity line, every project, every vote, decision and every member is public. The only things never public anywhere are private keys. There is no bank data in BSA, because BSA never pays anything out. There are no money deposits in BSA either, because that is "a different system altogether"; the wave grows only with what a member receives (both decided). A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin") (decided 6c, below).
• The ledger knows people only by their key. The name is only in the Lana profile and in the member home, which the person can change at any time. The ledger never copies a name (decided).
• The circle's node only checks, orders and signs. Its database is a cache: delete it and it is rebuilt from the relays. This is checked in public every morning.
• A payment counts when a majority of the circle's witnesses has confirmed it and at least three relays hold it (decided). The payer sees this within half a second to a second and a half (estimate).
• The community's money always goes to projects (decided). Project wallets, the reserve, the world account and the step-outward account have no key. Only a public rule that the witnesses check moves money on them.
• Every morning the daily seal and the full public snapshot of every account go to the relays. To restore a circle, the latest seal, the blocks from its morning on, a few older blocks the state names, and the blocks since are enough (clarification, 17 Oct 2026 (D4 review, round 3)).
• A million circles means a million small ledgers, each on its own relays, not one big one. The Lana relays in 38888 stay the directory.
• A circle's name is its circle id: the fingerprint of the founding charter (the found act) that the founder signs. The circle id is not a key, so nobody can steal it. The circle key is not the circle's name, so it can be replaced (decided 17 Oct 2026, C5); that it only stamps the circle record in the directory is a proposal.
• Every circle sets its own time limits and limits [Decided 23 Oct 2026, E-1]. The values in the definitions (for example 72 hours, 90 days, 7 days, 10 minutes) are only default settings. The Circle Heart changes them within the bounds of the definitions, with public notice and never retroactively. The world rules record and its signer are gone. The same for every circle: a project needs at least 3 Heart "for" votes and no "against"; the computation of money and gravity.
• The Circle Heart leads a circle [Decided 23 Oct 2026, E-2]: those who created the circle and care for it (formerly the "stewards"); one person in it is a "Heart member". The circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle.
• Projects and other proposals are decided by a vote, "all for, or it falls" [Decided 23 Oct 2026, E-5]: a proposal passes only if nobody is against at the end; a project also needs at least three Heart "for" votes. There are no objections any more.
• A person moves to another circle only with a reference [Decided 23 Oct 2026, E-9]: the ledger issues it by itself when a member says "I want to leave", is not in minus and has no open OWN process. The step they built, they get the same in the new circle. A person can be a member of one circle at a time, and only a member of an existing circle can found a new one (E-8). The details are in the section "The Circle Heart, members and moving between circles" below.

What "nothing local" means#

The rule: the circle's real ledger is the one on its relays. Everything else is only a copy. An entry exists when its block carries the signatures of a majority of witnesses and at least three of the circle's relays hold that same signed block (decided).

Everything is on the relays: every payment with the payer's signature, every act of a member, every vote and every decision, every project and every move of money onto it, every refusal with its reason, every balance after every entry, every account's morning gravity, the daily seal with the snapshot, the rate quotes, the references and the member homes. No threshold hides small circles.

Everything else is a cache that can be thrown away and rebuilt from the relays: the app's database, day files, database backups, copies on phones. A database backup only makes a restart faster. The real backup is the relays.

Only three things may stay on a computer:

1. private keys, with whoever holds them; never on a relay;
2. the witness guard: a few bytes in which a witness remembers which block it signed last, so it never signs two different blocks with the same number;
3. a block in flight: a signed block the relays have not confirmed yet, for a few seconds.

What goes away: the secret addition (salt) in the seal, the rule "numbers only from 20 accounts", the encrypted daily copy of balances for the circle-key keeper, encrypted proof backups on phones, proofs a member got only for their own account, and the rule that a new relay gets only the newest circle record.

The ledger: blocks, entries, account lines#

Picture the ledger as a notebook with numbered pages. Every page is a block. Each page carries the fingerprint of the page before it, so no page can be torn out, swapped or slipped in without everyone seeing it.

• An entry is one item in a block: a payment, one account's morning gravity, a member's act, a change of the circle's settings, a move of money to a project or the reserve, or a refusal with its reason. Every entry has its own sequence number in the circle, with no gaps.
• A payment sits in the block together with the member's signature, so nobody can forge it, not even the node.
• Every block ends with an account line for every account it touched: balance, wave, wave cap, gravity carry, debt and that account's entry counter. Anyone can check: the previous line plus the entries in this block give the new line.
• The line knows members only by their key (BSA ID). There is no name in the ledger.
• The sum of all balances in the circle is exactly zero after every block. Every witness checks it, and anyone can. Project wallets and the reserve are part of that sum.
• A block is small. When a circle is quiet, each payment goes into its own block at once. When it is busy, payments are gathered for at most one second (proposal: a circle of more than about 10,000 members raises this to two seconds) or up to about 120 payments.
• Payments between circles are entries in both ledgers: the hold and the final entry in the payer's circle, the receipt in the receiver's circle. Between currencies both ledgers carry both amounts and a reference to the rate quote the receiver's circle gave.
• The circle id is the fingerprint of the founding charter (the found act) that the founder signs; it is the circle's name for ever. Another charter has another circle id, so it is another circle. The first block, the genesis, carries the charter and is named by its fingerprint, the genesis digest (a digest, which does not change with the witnesses' signatures). The circle's link and QR code carry both, so an app accepts only a ledger whose first block carries that charter and that chains back to that digest (the circle id: decided 17 Oct 2026, C5; what the link and QR carry: proposal, question 10).

The path of a payment and when it counts#

1. Ana signs a note to Bojan in her browser. The note states the amount, the purpose and which note was her previous one. It is valid for at most ten minutes (the circle's default setting, E-1).
2. The app sends the note to the circle's node. The node is the witness that orders the blocks.
3. The node checks the signature, that the note follows Ana's latest note, that both are members and that Ana can pay (balance plus wave). It computes the new balances.
4. It closes the block and sends it to the other witnesses. Every witness computes every balance by itself and signs the block only if they match (decided).
5. The node sends the block with all signatures to every relay of the circle.
6. A payment counts when a majority of witnesses (3 of 4) has confirmed it and at least three relays hold it (decided). Sending to the other relays continues (proposal, question 17).
7. Ana's app reads the block itself from two relays, checks the signatures and its own line, and only then shows "paid · public on 3 of 4 relays". Bojan's app sees the block at the same moment.

Ana sees this within half a second to a second and a half (estimate). Today, with one server keeping the ledger, a payment takes about 12 milliseconds. Half a second is the price of a payment being public in three places at the moment it counts.

At the start there is a single witness, as in the live circle today. The app says so in public ("not yet decentralised"). There is no money cap (decided). An independent verifier checks the ledger every day, and there is a public restore check every day. Then four witnesses with four different owners, three of whom must agree. One owner holds at most one witness. Witnesses are computers; a draw among the circles' computers will choose them, which is the direction for phase I [Decided 23 Oct 2026, E-7]. Until there are enough circles to draw from, a circle has one witness, its own computer, publicly labelled. The Circle Heart adds, replaces or removes a witness by three votes for and none against; that is only for exceptions, for example to remove a witness that misbehaves until the next draw [E-7].

How the app reads#

• It reads from two relays at once. "Not found" counts only when both have said they are done.
• Silence is not nothing. A relay that does not answer does not mean the record is missing, and never means a balance of zero. Like calling the bank and nobody picks up: your money has not vanished.
• It always shows the real number, for example "2 of 4 answered".
• It reads blocks by number. Since numbers have no gaps, any missing page shows at once as a missing number.
• It checks every signature itself before showing anything. A relay can hide something, but it cannot forge anything.
• It reads the list of witnesses from the circle's ledger itself, not from the circle record in the directory.

How spending twice is prevented#

• Every member has their own chain of notes. Each note names the previous one. If Ana signs two notes that both point to the same previous note, only one can ever be booked. The other is refused in public as "stale". That is not fraud, just a phone that fell behind; the app reads again and signs anew.
• One block per number. Every witness remembers what it signed and never signs a second block with the same number. Two blocks with one number would need two majorities, and those always share at least one witness, which would have to sign both. A witness that does so leaves public proof and the circle replaces it.
• Cover (whether the payer has enough) is checked at an exact point in the ledger, the same for every witness.
• Between circles the payer's circle first holds the amount on its world account; only then does the receiver's circle book anything. If the receiver's circle does not answer, the booking is not undone by itself, and nobody pays a refund. The receiver's circle may book the note only before its expiry, by default at most 10 minutes after signing (the existing note rule). After 7 days (by default) the payer's circle itself looks into the receiver circle's public ledger on the relays: the blocks and seals up to the note's expiry. Since nobody can book a note after it has expired, the answer is final once the receiver circle's daily seals cover the whole time up to the note's expiry. If the receiver's circle did not book the payment, the held amount goes back to the payer, and the entry names the receiver circle's seals as its evidence, together with the seal just before them. Every witness checks those seals against the receiver circle's blocks, not only its seals. Only a block signed by a majority of the receiver circle's witnesses counts; a block that is not signed by a majority of the witnesses in office at the time (for example one signed only by an old or stolen key) is ignored, so it cannot stop the return, and a change of key or witnesses in the receiver's circle does not stop the check (proposal). To be honest: a key that was in office at the time (for example the key of a circle's only witness, stolen later) can still sign a second block with the same number; such a fork stops the check, and the amount stays held. That no block was left out is shown by the receiving circle's next block, booked after the last seal's morning. If that circle has booked nothing since, its next daily seal shows it instead; before using it, the witness confirms on at least two of that circle's relays that no new block exists. If any of this is missing, nothing is booked; if the receiving circle has stopped working, the amount stays held. If it did book it, the payment stands. If the receiver circle's ledger cannot be read, the payer's circle waits and never guesses; meanwhile it goes on booking everything else (decided). If a rate quote runs out before the payment is booked, the payment does not count and nothing is held. The app shows a new price and the payer signs again. Each circle applies its own settings here (the note's validity, the quote's validity, the 7 days) to what it books itself; if they do not match between the two circles, the only possible end is a refusal and a return to the payer: nothing is lost, and the sum of both ledgers stays zero [Proposal, E-1; details in the document "Currencies and exchange rates"].

The daily seal and the public snapshot#

Every morning, right after gravity at 04:00, the node makes the daily seal. The seal is like a stocktake at the end of the day:

• it closes the day: from which block to which, and a fingerprint of all of the day's entries;
• it carries the snapshot: every account's line, public and without any secret addition, cut into chunks (a circle of 1,000 members has 3 chunks, 0.2 MB in total);
• it states the number of payments, how much gravity moved, that the sum is zero, the three numbers of the step outward (the last is "built": the sum of balance and wave of every member's account, members who left included, since their money is still in the circle; clarification, 17 Oct 2026 (D1 review)) and which rate quotes the circle gave or relied on that day;
• it names the height from which the circle's settings are in force, and the circle key in office after the last block it covers (proposal); it no longer names a world rules version, since there are none [Decided 23 Oct 2026, E-1];
• it chains to the previous seal, so seals form a chain.

The witnesses sign the seal after computing it themselves. It goes to the relays every day, also on days without payments. Each witness publishes its own statement the same day: "I computed the same". Only the circle head, a pointer to the newest seal, goes to the Lana root relays. Proposal: heads are spread over the whole day, not the hour after 04:00, so circles do not crowd together.

Since everything is public, anyone can check any account, not only a member their own: yesterday's balance plus the payments and gravity give today's balance.

Gravity: a public rule with a public result#

Gravity is a rule that computes from public data in whole numbers only. So that phones need not compute everything, the node writes each account's result into morning blocks: how much was deducted, what carried over, the debt. The witnesses compute every line themselves. If one does not match, there is no morning: an alarm, never a guess.

How much gravity takes (clarification, 22 Oct 2026; the rule is unchanged, and the app, the ledger core and the independent verifier compute it this way). Every member has a wave (in the app also the "Step") and a balance. What a member holds in all is wave + balance. Gravity takes only from what lies above the wave (the plus, in the app the "crest"). The wave itself is never subject to gravity.

• As long as a member holds in all at most their wave, gravity takes nothing. Example: wave €1,000, €900 in all (balance −€100): no gravity.
• The plus up to the size of the wave flows gently: 330 millionths a day, about 1 % a month. Example: wave €1,000, €1,500 in all: a plus of €500, gravity about €0.17 a day.
• Where the plus is larger than the wave, that excess flows strongly: 22,840 millionths a day, half in about 30 days. Example: wave €1,000, €2,500 in all: a plus of €1,500; €1,000 of it flows gently (about €0.33 a day), €500 strongly (about €11.42 a day).
• What counts is the average plus from morning to morning, not the balance at one moment. A morning never takes more than the plus at the cut.
• For the first 60 days after the first receipt the excess too flows gently (the transition). Whoever gives nothing for 183 days has their whole plus flow strongly (resting).
• The numbers are the circle's start settings (band_ppm_day, excess_ppm_day, transition_days, rest_after_days); the Circle Heart can change them only within the bounds of the definitions.
• Gravity is never stronger than today's [Decided 23 Oct 2026, E-11]: the gentle part at most 330 ppm a day (about 1 % a month), the excess at most 22,840 ppm a day (half in 30 days), the transition at least 60 days, resting off or after at least 183 days. A change that makes gravity stronger needs at least 30 days of public notice, whatever the usual notice is; a gentler one takes the usual notice.
• The morning visits every account that is not closed: a member's, a frozen one, an excluded one and one that has left [Consequence of E-3: "a plus waits until gravity takes it to 0"]. Before, the morning did not visit accounts that had left, so leaving and coming back could escape gravity.

So that everyone gets the same result:

• the morning is cut by the time of each entry, not by when the node starts computing;
• each account's gravity is computed from its state at the cut, that is after the last entry before the morning. Payments do not wait for the morning. Before any entry after the morning hour (4:00 in the live circle) touches an account, that account's gravity is booked first. So the order in which the node books payments never changes anyone's gravity, and the order loses no debt; debt above the wave is still capped by the rule, as before (decided 17 Oct 2026, C2);
• an act (for example a vote) does not touch an account; only an entry that moves money from or to an account touches it, and only before such an entry is that account's gravity booked first (clarification, 17 Oct 2026 (D1 review));
• a new morning does not begin until the previous morning's gravity is booked for every account (clarification, 17 Oct 2026 (D1 review));
• the circle's settings (parameters) in force at the cut apply; a change of the settings never applies to a morning before the end of its notice: after an outage the missed mornings and deadlines before that end are booked with the old settings, and the new ones take effect only after them (completed 24 Oct 2026; never retroactive, E-1);
• the time zone, the morning hour and the version of the time-zone database are written at founding; in version 0.3.0 a circle cannot change them (decided 17 Oct 2026, C7). A witness always computes the start of the morning with that version of the time-zone database, not with its own newest one (decided 17 Oct 2026, evening, 2A). A witness that does not have that version signs no morning block and no seal (proposal). A clock-change day has 23 or 25 hours. If the morning hour fell right into the change, the first of the two equal hours counts, or the first moment after the skipped hour. In Ljubljana the clock change never touches a 4:00 morning;
• only whole numbers are used, with a single rounding rule; before the switch, 14 mornings in a row must give the same as today's computation;
• a missed morning (for example after an outage) is booked as its own morning, in order. When several mornings were missed, each later one computes as if the earlier ones had been booked on time: it takes into account what they deducted (clarification, 17 Oct 2026; today's app computes the same). After an outage the circle first books every missed morning, in order; payments wait only that long. Payments never wait for the current morning (clarification, 17 Oct 2026 (D4 review));
• a morning's deduction counts from the morning hour on, not from the moment it is booked, so the order in which the morning is booked never changes the next day's average (clarification, 17 Oct 2026);
• time is counted in whole seconds (only today's app has milliseconds).

Gravity books almost nothing today: every receipt below the wave cap grows the wave, and the same amount goes through the reserve to the project that is receiving, so balances do not rise.

Projects and the reserve: where the community's money goes#

Decided (16 October): the community's money always goes to projects. There is no longer one Common Good wallet from which someone pays an order. Nor is there a fund key.

• A project wallet has no key. Nobody can spend it alone. Only a public rule, which every witness recomputes by itself, moves money on it. The same holds for the reserve, the world account and the step-outward account (decided).
• A project is decided by a vote: all for, or it falls [Decided 23 Oct 2026, E-5]. Any member proposes a project. At publication they set how long the vote lasts; that cannot be changed afterwards [E-5, confirmed 23 Oct 2026]. The shortest duration is a circle setting, 72 hours by default [E-5 Dopolnitev], the longest 14 days by default [Proposal]. Every member votes, for or against; an "against" vote carries a short public reason. Each member's newest vote counts; they can change it until the vote ends. At the end a project passes only if nobody holds an "against" vote and at least three Heart members voted for it (a circle setting, at least 3) [E-5, E-1]. The proposer's and the recipient's "for" do not count toward those three: as before, a proposer never decides on their own proposal. Otherwise the project falls; it may be proposed again, changed. Who is a member and who a Heart member is taken as at the end of the vote [Proposal]. On a Heart member's proposal without money the proposer's own "for" counts too; on a project the recipient never counts for itself [Decided 23 Oct 2026, E-11].
• A project that passed opens once the recipient has consented (consent stays, as today for an order [Proposal]) and, for a step raise, once it fits under what the members have built. It opens by itself, even when no act brings that about: after every entry the projects that passed are checked again in the order they were published (clarification, 17 Oct 2026 (D1 review)). A project that has not opened 30 days after its publication (by default) ends.
• There are no objections and no stopped projects any more [Decided 23 Oct 2026, E-5]: an "against" vote replaces them (formerly decision 8c). During the vote the recipient can decline the project and the proposer can withdraw it; that ends the project and its votes. No Heart member rejects a project alone (decided 17 Oct 2026, C4).
• A project receives up to its own amount. Gravity and the new steps flow into it: what the morning gravity takes, and the part of every receipt that grows the wave.
• Once a project has collected its whole amount, it pays it in full to the doer (decided).
• Several projects at once: money flows to them in order, the oldest first until it is full, then to the next. For now there is no limit on the amount and no other limit (decided).
• A surplus goes to the reserve. Once a new project opens, the reserve moves to it automatically.
• The Circle Heart can close a project that is already receiving, with public notice (72 hours by default). Its money goes to the reserve and from there to the next project. A project that does not fill within 90 days (by default) ends by itself, and its money likewise goes to the reserve (decided). A closing counts only if at least k Heart members signed it (in the live circle 3 of 4) who are still Heart members when the closing is booked; otherwise the collected signatures do not count (clarification, 17 Oct 2026 (D1 review)).
• Several deadlines in the same second. When several deadlines fall in the same second, the return after a closing notice goes first, then the lapse of a project that is receiving, then the lapse of a project that never opened, then the end of a vote, then the expiry of a payment request; among equals, what was published first goes first (clarification, 17 Oct 2026 (D1 review); the end of a vote in this order: [Proposal, E-5]).
• Raising the step outward is a project like any other: a proposal, a vote (nobody against, at least three Heart "for" votes), filled by gravity and the new steps. Once it is full, the circle's step rises by that amount (decided; the vote: E-5). Proposal: the recipient of such a project is the step-outward account.
• The time limits and the number of Heart votes are circle settings [Decided 23 Oct 2026, E-1]. The 72 hours, 90 days, 30 days and three Heart votes are default values; the Circle Heart changes them within the bounds of the definitions, with notice and never retroactively. For every circle: at least three Heart "for" votes and no "against". A deadline that is already running keeps the length in force when it started: a project opened with 90 days to fill has 90 days, even if the circle later sets 30 (clarification, 17 Oct 2026 (D1 review)); the ledger writes down when a deadline ends, at its start [Consequence of E-1].
• The sum stays zero. Every move goes from one account of the circle to another.

How this runs in the ledger. Every inflow goes to the reserve first. In the same entry it goes on from the reserve to the project that is receiving, up to that project's amount. So the reserve is empty while any project can still receive. This is exactly the owner's "the wallet that holds the reserve moves on automatically". Every receipt thus makes a single move in the ledger, as today. The reserve is passed on to the projects after every entry, not only after one that brought money into the reserve, so a project that a contribution fills exactly is paid too (clarification, 17 Oct 2026 (D1 review)). Whoever leaves gives up their projects that are not yet receiving; the money of those that are receiving goes back to the reserve (proposal (D4 review, 17 Oct 2026)). The same happens at an exclusion [Proposal, E-3]. Whoever left can join again; their account stays, with the same balance (clarification, 17 Oct 2026 (D4 review, round 3)); whoever joins with an account the Heart closed starts at 0 [Consequence of E-3]. If the recipient of several projects leaves and the money of those projects returns to the reserve (a proposal, below), each project's money is passed on at once, project by project (clarification, 17 Oct 2026 (D1 review)).

Paying a project does not use up the community's money (decided). When a project pays a doer who is below the wave cap, their wave grows by the whole amount, and the same amount goes on at once, to the next project or to the reserve. So the brake on projects is the vote (nobody against and at least three Heart "for" votes), not money [E-5]. That is why the rule stays that the proposer's and the recipient's "for" do not count toward the Heart votes needed: nobody decides on a project that pays them. The sum stays zero.

To be honest: raising the step is the exception. Its money goes to the step-outward account, which has no wave, so it does not flow on: such a project really uses up the community's money. And since money flows in order with no limits, one large project holds back every project behind it until it is full or ends after 90 days. A circle with fewer Heart members whose "for" counts than its setting requires (at least three) can open no project; its start stays in the reserve.

When no project is receiving, the money stays in the reserve; this follows from decision 8. A new circle gets its first money from one start: at founding its reserve gets 1,000 in the circle's currency from the keyless account »izvor« ("origin"), which goes into minus by the same amount, so the sum stays zero; since paying a project does not use up the community's money, the start keeps going round (decided 6c, item 44). Money goes back to origin when the Heart closes an old account or a member moves to another circle with a reference: the reserve then returns that account's wave; the new circle opens the same step for the newcomer from its origin [Decided 23 Oct 2026, E-3 and E-9 (b); below]. What is still open is gathered at the end: contributions (open 8g), and whether the doer must be a member of the circle (open 8h).

The Circle Heart, members and moving between circles#

Decided 23 October 2026 (E-1 to E-9). It applies to definitions 0.3.0 (a draft); today it does not affect the live circle or the relays.

The Circle Heart [Decided 23 Oct 2026, E-2]

• A circle is led by those who created it and care for it. That is the Circle Heart; one person in it is a Heart member. Before, we called them "stewards".
• The circle's members do not elect the Heart. Whoever disagrees with the Heart leaves and creates their own circle.
• The Heart itself adds and removes Heart members: k Heart members decide (in the live circle 3 of 4; the number is a proposal), with public notice (72 hours by default). The founder seats the first Heart in the founding charter.
• The acts for changes of the Heart and of the witnesses are accepted: a Heart member's resignation, adding and removing a Heart member, changing k, replacing and removing a witness, and a witness's resignation [Decided 23 Oct 2026]; E-7's change applies to witnesses, E-1's to the notice.
• A Heart member who leaves the circle loses the Heart seat; the last Heart member cannot leave until the Heart adds another [Decided 23 Oct 2026, E-11].
• The records keep their technical names (steward_*, stewards_required) [Proposal]. In English: "Circle Heart" and "Heart member" [Proposal].

Circle settings instead of world rules [Decided 23 Oct 2026, E-1]

• Every circle sets its own time limits and limits. The values in the definitions are only default settings. The Circle Heart changes them within the bounds of the definitions.
• The world rules record (43920) and its signer are gone. The number 43920 stays reserved and is never used for anything else [Consequence].
• The same for every circle: a project needs at least 3 Heart "for" votes and no "against"; the computation of money and gravity.
• The default settings (the bounds are in the technical part, §3.1 rule 11; the bounds are a proposal):
  • a vote lasts at least 72 hours [E-5] and at most 14 days [Proposal];
  • a project needs at least 3 Heart "for" votes; a circle may require more, up to 9;
  • 72 hours of notice before a project closes; a project must fill within 90 days and open within 30 days;
  • the notice before a change of the circle key, the witnesses, the Heart members, the relays or the settings, and before a resignation: 72 hours (no longer fixed, E-1);
  • a payment into another circle: after 7 days the payer's circle itself looks into the other circle's ledger; a note is valid 10 minutes, a rate quote 10 minutes;
  • a signed act is valid 7 days; at most 20 refusals of one key a day go into the ledger;
  • an exclusion lasts 3 months (90 days); an invitation is valid 7 days; the circle is open or by invitation only; the maximum number of members (0 means no limit);
  • gravity and the wave as before (330 and 22,840 millionths a day, 60 and 183 days, the wave cap) and at most one second of gathering payments into a block.
• How a setting changes [Proposal, E-1]: k Heart members sign the proposed change; only one such proposal can be open at a time. The change counts only after public notice: at least 72 hours (a setting) and at least as long as the current value of every time that changes. Example: whoever shortens 90 days to 30 waits 90 days. So a stolen key cannot skip the warning. During the notice apps sign by the stricter of the two values.
• Never retroactively. A deadline that is already running keeps the length in force when it started. The ledger writes down, at its start, when it ends [Consequence of E-1].
• Between circles each circle applies its own settings to what it books itself. If they do not match (for example the receiver's circle has a shorter note validity), the payment can only be refused, and the payer gets the held amount back: nothing is lost, and the sum of both ledgers stays zero [Proposal; details in the document "Currencies and exchange rates"].

Votes: "all for, or it falls" [Decided 23 Oct 2026, E-5]

• As in Lana Aligns: for, or resistance. Every member votes. If anyone is against at the end, the proposal falls.
• Any member proposes a project; how a project is voted on is written above, in the section on projects.
• A Heart member may also put any other proposal, without money, to a vote (for example a rule of the circle). For it too: nobody against and at least three Heart "for" votes [Proposal: the same rule as for a project]. When the vote ends, the result is a public decision in the ledger.
• An "against" vote carries a short public reason. Each member's newest vote counts; they can change it until the end.

Admitting members [Decided 23 Oct 2026, E-6]

• The Heart chooses how the circle admits new members:
  • open: anyone joins by themselves;
  • by invitation only: a member gives a special invitation, valid once and for 7 days [Proposal];
  • a maximum number of members with a waiting list: combined with either.
• When a place frees (a leave, an exclusion, a closed account, a change of settings), the first on the waiting list joins automatically, in the order of applications.
• Whoever waits can withdraw from the waiting list by themselves [Proposal].
• The Heart always decides about an excluded person; they never come in from the waiting list by themselves.
• Whoever comes from another circle needs a reference from their last circle (below, E-9).

Exclusion [Decided 23 Oct 2026, E-3]

• The Heart can exclude any member, a Heart member too: always at least three Heart members: the larger of k and 3; a Heart of fewer than three cannot exclude [Decided 23 Oct 2026, E-10]. The exclusion counts at once, at the last vote needed, and carries a short public reason [the reason: Proposal]. A Heart member who is being excluded does not count toward their own exclusion.
• An excluded Heart member first loses the seat in the Heart.
• An exclusion lasts 3 months [E-3]; it is a circle setting, 90 days by default [Proposal].
• An excluded account: the money stays on the account, frozen. It does not pay, give, vote or propose; it receives nothing except payments that settle its debt (below). Gravity works on its plus every morning. It may send its plus to another circle (never the wave); the minus stays with the circle.
• Projects whose recipient is excluded end as at a leave: those not yet receiving are declined; the money of those that are receiving goes back to the reserve [Proposal].
• After the exclusion the person can apply to be admitted again; the Heart decides (at least three Heart members, the larger of k and 3 [Decided 23 Oct 2026, E-10]), and only if the circle has a free place. A former Heart member who comes back is a member only, not back in the Heart [E-3].
• An exclusion may name the number of the OWN case it was decided in [Proposal, E-4].

The reference: moving to another circle [Decided 23 Oct 2026, E-9]

• Moving from circle to circle goes with a reference. When a member says "I want to leave", the ledger issues the reference by itself if the conditions hold; otherwise it does not.
• The two conditions:
  • the member is not in minus (balance 0 or more); a debt must be settled in any case; someone else may settle it too, by payments into that account, but never above 0 [E-9]; also during an exclusion [Proposal; the owner's words: »če je bil izključen se rabi vrnit nazaj, poplačati predno se lahko seli«, "if he was excluded he needs to go back and pay before he can move"];
  • no open OWN process, also without a debt: the process must be closed first [Decided 23 Oct 2026, E-9 (a)]. To be honest: the Heart, which leads the processes, can hold a person back this way.
• If the conditions do not hold at the leave, the reference is issued by itself later, once they do: for example when someone settles the debt or the last OWN process closes [Proposal].
• No move without a reference. A new circle admits a person from another circle only with a valid reference from the last circle. This is a rule for every circle, not a setting [E-9]. Whoever has never been in any circle needs no reference [Proposal].
• The reference is a new public record (KIND 43921), signed by the node of the old circle. It carries a short report: the projects the person published, the projects they took part in (the projects that paid them [Proposal]), the step (wave) they built, that they have no open OWN process, and when they became a member and when they left [Proposal]. The new circle checks it against the old circle's public ledger.
• The step goes with the person [Decided 23 Oct 2026, E-9 (b), the owner's model; the bookings: Proposal]. In the old circle the balance is 0. The new circle opens the same step (wave) the reference states; as with every growth of a step, the same amount goes to the new circle's community (from its "origin"). The new circle sends that amount to the old circle's community as a payment between circles (across currencies at the old circle's rate, rounded up, so that the old circle gets at least the whole wave). The old circle closes the account (the wave to 0) and returns exactly that amount to its own "origin". Both communities hold what they held before: »zadeva se izniči«, "it cancels out".
  • Example: a wave of €1,000 in the old circle. The new circle opens a wave of €1,000 for the newcomer; €1,000 comes from origin into its reserve, and the reserve sends it to the old circle. The old circle receives €1,000, returns it to its origin, and the account's wave goes to 0.
  • A plus still on the old account stays there without a wave, and gravity takes it; once the balance is 0, the account is closed.
  • A reference is valid once. If the old circle refuses the payment (for example because the reference was used already, or the person went back there meanwhile), the new circle gets the amount back into its reserve and takes the step away: the unused part of the wave goes back to the origin, and the person stays a member [Decided 23 Oct 2026, E-11]. If the old circle stays silent, the payment waits, as with any circle that does not answer; this payment has no expiry, so it is never returned because the old circle did not book it (the old circle could still book it later) [Decided 23 Oct 2026, E-11 (1A)].
  • A join with a step is not possible while an earlier move out of this circle is not settled (until the old circle has received the payment for the first reference's step); so a wave never counts twice [Decided 23 Oct 2026, E-11].
  • A circle accepts a reference once [Decided 25 Oct 2026, E-13 (A)]. Every circle's ledger records for good every reference on which it granted a step (a u3 line in the state, under the state root and in the snapshot, so a restore from a seal keeps it too). This circle never accepts the same reference again: not at a join, not from the waiting list, not after a readmission, not after the person leaves and comes back (refused duplicate); nor while another join with the same reference waits on the waiting list, nor through a second signed copy of the same reference (a reference is the entry in the old circle, not a copy) [review of E-13]. Between circles nothing changes: the old circle answers one reference once, and another circle takes its unused step away (E-11).
  • [Decided 23 Oct 2026, E-10 (2A), safety] The amount the new circle sends counts against its step outward. Whoever brings a step that no longer fits under the step outward waits on the waiting list until it fits. So a circle that does not raise its step outward takes in no waves from elsewhere. A question for the owner: is that right?
• Whoever leaves may send their plus to another circle, like an excluded person [Proposal]: so a person who moves takes the plus along. A minus stays written in the old circle; the circle does not cover it when the person moves [E-3 Dopolnitev].
• To be honest: the ledger does not catch one person's two keys or a deleted member home; that would need Lana's person check.

Closing an old account [Decided 23 Oct 2026, E-3; confirmed 23 Oct: »ostalo si pravilno razumel«, "the rest you understood correctly"]

• The Heart can close an old account: of someone who left, is excluded, has moved or has died. At least three Heart members decide (the larger of k and 3) [Decided 23 Oct 2026, E-10], in public, with a public reason; the circle covers the minus of any account it closes [Decided 23 Oct 2026, E-10 4A]. It is never urgent, and nothing breaks if an account stays. But it is a good way for a community to remove surplus funds.
• The reserve covers a minus, but only if the member has died [E-3 Dopolnitev]. The ledger cannot see a death: the Heart judges it when it closes the account [Consequence]. Whoever leaves in minus does not get the minus covered by the circle.
• Gravity takes a plus down to 0 (or the person sends it elsewhere first). Until then the closing waits. It also waits while the account has a payment to another circle held [Proposal].
• Once the balance is 0, the wave goes to 0, and the reserve returns the same amount to the account "origin" (»izvor«), where the circle's first money came from. The community has that much less money; the sum stays zero.
• Examples:
  • wave €1,000, balance 0: the account closes at once, and the reserve returns €1,000 to origin;
  • wave €1,000, balance −€200 (the member has died): the reserve first covers €200, then returns €1,000 to origin; if the reserve does not hold at least €1,200, the closing waits;
  • wave €1,000, balance +€300: the closing waits until gravity takes the plus to 0. To be honest: that can take months (after 183 days without giving, the plus halves in about 30 days); there is no hurry.
• A Heart member's account cannot be closed while they are in the Heart. Whoever joins again with a closed account starts at 0 [Consequence].

OWN processes [Decided 23 Oct 2026, E-4]

• The Heart leads and oversees its circle's OWN processes. They run in the existing OWN apps, encrypted. Only a decision goes into the public ledger, for example an exclusion after a process.
• So that the ledger can judge the reference's condition by itself, the Heart writes into the ledger that a process is open (k Heart members) and that it is closed (one Heart member), with no content [Proposal, a consequence of E-9]. Opening needs k votes, because it can hold a reference back; closing needs one.
• To be honest: the content of an OWN process is not in the ledger. What is public is that a process runs, for whose key, and every decision.

Witnesses [Decided 23 Oct 2026, E-7]

• Witnesses are computers. The direction for phase I: they are drawn by lot among the circles' computers, from a public random number (for example a block of the Lana chain). The schedule is known in advance and changes regularly; a new witness loads the circle from its latest seal. Open for phase I: fake circles, matching the load, witnesses that stay away.
• Until there are enough circles to draw from, a circle has one witness: its own computer, publicly labelled (decision 3).
• The Heart's vote is only for exceptions, for example to remove a witness that misbehaves until the next draw: a witness is added, replaced or removed when at least three Heart members are "for" (the threshold is the larger of k and 3) and no one in the Heart is "against" [E-7, E-10].

Founding circles [Decided 23 Oct 2026, E-8]

• Only a member of an existing circle can found a new circle. Every circle grows from the first circle; the live circle is the root.
• The founding charter of a new circle names its parent circle, the one it grows from, and the founder's reference from it [Proposal: the shape; the reference: a consequence of E-8 and E-9].
• Every key can found a single circle, ever. The root relays remember the first founding charter of every founder and refuse a second one [Proposal: how].
• A person can be a member of one circle at a time. Whoever becomes a member of a new circle leaves the old one; with the reference (E-9) this holds for a founder too. The ledger ensures it by key, through the member home (30916; the newest counts).
• This replaces "at most three circles per founder" (item 13).
• To be honest: one person with two keys is not prevented; that would need Lana's person check.

Restore: when the server is gone#

You need only the circle's link or QR code, or the member home of any member. Then:

1. Find the circle and its relays. Trust only a ledger whose first block carries the founding charter whose fingerprint is the circle id, and that chains back to the genesis digest.
2. Read the first block and every change of witnesses and of the circle key (there are few).
3. Read the newest seal from two relays. A seal that at least two independent witnesses (not only the node) confirmed in their statements is preferred. Two different seals for one day are an alarm: stop and report.
4. Read every snapshot chunk and check it against the seal.
5. Read the blocks from the seal's morning to the end, from every relay at once. Check the signatures and recompute every entry. The circle's settings and every change of them are written in its blocks, so you need only the circle's relays [Consequence of E-1].
6. If a number is missing, look on the circle's other relays, in archives and with partners. If it is nowhere, stop and say which one is missing. Never guess.
7. Build the database and compare the fingerprint of the restored state with the seal.
8. The Circle Heart and the witnesses appoint a new node, which continues at the next number. The live circle has four Heart members: the founder and three other Heart members (decided). Proposal: a new node is signed by three of the four Heart members.

How long it takes (estimate at the measured speeds of the Lana relays):

A restore takes as long as reading one day of the ledger, whatever the circle's age, because it starts at the latest seal. That is why I propose at most 100,000 members per circle for now (question 13).

A new phone: scan the circle's QR code and the app reads everything from the relays; the balance shows in about a second. The only thing to keep is your BSA WIF.

The daily public restore check#

Every day after the seal, the node (and anyone else who wants to) restores the circle from the relays alone into an empty database, compares the result with the seal and publishes the result as a signed statement. If the check fails, every member sees it in the app ("restore check failed on …"), not only an administrator. So "the ledger can be restored from the relays" is a fact checked every day, not a promise. Experience taught us: a relay sync tool reported "0 synced, 2000 errors" for days and nobody noticed.

What is never public, and where the name is#

• Private keys: the members' BSA WIF and the keys of witnesses, Heart members and the circle. The key is the account and stays with the person. Likewise sign-in tokens.
• There is no bank data in BSA (decided). In the owner's words: "the funds are never paid out". So BSA has no payouts, no account numbers and no statements. Bank matters belong to Lana, not to BSA. This is no exception to the principle "everything is public": the data is simply not in the system.
• There are no money deposits in BSA (decided). In the owner's words: "that is a different system altogether". So BSA has no custodian, and nobody confirms that money arrived. The wave grows only with what a member receives.

Everything else is public for ever, including the purpose of a payment, a vote and the reason of an "against" vote, the reason of an exclusion, and a project's title and description.

The name (decided). The ledger knows people only by their key (BSA ID). The name is only in the Lana profile and in the member home. The person can change both at any time; a relay keeps only the newest version. The ledger (blocks, acts, seals, snapshots) never copies a name. In the owner's words: when a person changes their name, nobody knows any more what belonged to whom.

At every free-text field (purpose of a payment, reason of an "against" vote, reason of an exclusion, text of a motion, title and description of a project) the app warns: "public for ever; do not write names, personal or bank data". To be honest: a name can remain in old copies of a profile that someone saved, and in free text that someone writes. The ledger itself does not carry it. The legal review before the first entry and the free text beside the chain are dropped.

Sizes and capacity#

Estimates (the arithmetic is in the technical part):

• The four Lana relays, as the only copies, would carry the whole ledger of one 1,000-member circle for only about two years (at two payments a day), because the smallest has just 11 GB left. That is why every circle has its own relays (decided). The Lana relays stay the directory and a borrowed home for small circles, with limited space.
• The target of the sixth principle, 10 billion people and 100 billion payments a day, is 1.16 million payments a second, about half a million to one and a half million events a second, and 340 to 660 PB of disk a year for three copies. It is split over millions of cells: a 1,000-member circle has less than one block a second even at its busiest. Per person this is 34 to 66 MB a year, about 0.2 to 0.4 cents a year for disks and servers.
• Disks are cheap. Running thousands to tens of thousands of relays reliably is the hard part. Proposal: every circle pays for its own relays through a project (question 15).
• None of this is measured on our relays yet. The first build step measures it on a separate test relay; nothing is sent to the Lana relays.
• The block split (completed 24 Oct 2026): a block is at most 100,000 bytes, yet a circle never stops because of it. When a block's work (the duties at its start, the filling of projects, the joins from the waiting list) would pass the limit, the block closes after its last whole step and says so in public; the next block has the same time and goes on exactly where the last one stopped. The carried work keeps its order and its amounts; it is only spread over more blocks. About 100 small projects behind a big one, or about 450 tiny projects whose votes end in the same second, take a few blocks of the same second; payments wait that moment. Projects are not limited at intake (8b).

Decided#

the project owner, 16 October 2026 (principles):

1. The six development principles (linked in the box at the top).
2. The whole ledger is kept only through the relays, truly nothing local; applications only read from the relays.
3. Transparent, decentralised infrastructure is the basis of our development; nothing is ever hidden.
4. The four Lana relays will not carry 100 billion transactions; the system must be scalable.

the project owner, 16 October 2026 (answers to questions 1–9):

5. When a payment counts (question 1, "yes"). A payment counts when a majority of witnesses (3 of 4) has confirmed its block and at least three relays hold it. The app shows "paid · public on N of M relays".
6. Where the ledger lives (question 2, "yes"). From the first day every circle has its own box relay and, in all, at least four relays with at least three owners. The Lana relays in 38888 stay the root directory for ever and a borrowed home for small circles, with limited space. The rule "relays only from 38888" applies to root relays, not to circles' ledgers. This is the owner's yes to the new reading of the rule of 14 September.
7. Witnesses (question 3, "yes, as the assistant proposes, no money cap"). It starts with one witness; the app shows "not yet decentralised" in public. There is no money cap. The public label, the daily independent check and the public restore check stay. Then four witnesses with four different owners, three of whom must agree. At most one witness per owner. The circle chooses and replaces its witnesses itself. "Independent" means "can replace any particular partner", not "needs nobody". Since 23 Oct 2026 witnesses are computers that a draw will choose (the direction for phase I); until then a circle has one witness, and the Circle Heart adds or replaces a witness only for exceptions (item 62, E-7).
8. Heart members (formerly "stewards") (question 4, "the first people of the first circle (all of them)"). The live circle's Heart members are the founder and two others. A project is approved by three (since 23 Oct 2026 they vote for it, item 60). In the afternoon the project owner explained that they are a Heart member, and added a Heart member: there are four Heart members (item 34). Their BSA IDs go into the ledger once it is built. The name Circle Heart: item 56 (E-2).
9. Public for ever, and the name (question 5, "A person can change their name, and then nobody knows any more what belonged to whom"). The ledger knows people only by their key (BSA ID). The name is only in the Lana profile and in the member home; the person can change both at any time. The ledger never copies a name. The legal review as a condition before the first entry and the free text beside the chain are dropped. The warning at every free-text field stays: "public for ever; do not write names, personal or bank data".
10. Bank data and payouts (question 6, "Bank data is unnecessary in this system … because the funds are never paid out"). BSA has no bank data and no payouts. Dropped: payout requests, the payout entry, "held for payouts", the monthly bank reserve statement and the payout brake. Question 6 is no longer an exception to principle 1: the data is simply not in the system. There are no money deposits either (item 35).
11. Rates (question 7, "the seller's circle proposes an exchange rate and the buyer accepts it … the circle chooses the source itself"). The receiver's circle (the seller's circle) proposes a rate from a source it chooses itself: an outside service, some day also a record on the relays. The payer sees the converted price. If it suits them, they sign the payment with both amounts; if not, they do not pay. A rate quote is a public signed record of the receiver's circle: source, rate, time and how long it is valid. Both circles' ledgers carry both amounts and a reference to the quote. This replaces the decision that the owner's key signs the rate every hour, and the proposal of several publishers and a middle value. The owner's rate key is no longer needed; some day it may be one of the sources a circle chooses. The starting source is decided in item 42; how a circle changes its source stays a proposal (below).
12. Projects instead of Common Good (question 8, "money always goes to projects, which have no key … So it is always projects that are funded"). The community's money always goes to projects. Project wallets and the reserve have no key; only a public rule the witnesses check moves money on them. A project starts receiving once three have approved it and nobody has objected. An objection to a newly published project stops it: it cannot start receiving. A project that receives does so up to its own amount. Gravity and the new steps flow into it. A surplus goes to the reserve; once a new project is approved, the reserve moves to it automatically. The ledger's sum stays zero. The single Common Good wallet and the fund key are dropped. When no project is receiving, the money stays in the reserve; this follows from decision 8 (formerly open 8d). The details are decided in items 36 to 41 and 43. Since 23 Oct 2026 a vote "all for, or it falls" replaces the approval and the objection (item 60, E-5).
13. Founding circles (question 9, "I like the founding of circles like this for now"). No personal approval. A circle's ledger is public from its first block. A circle enters the directory on the Lana relays by a rule the relay checks itself: the founder is registered in Lana, at most three circles per founder. On the borrowed Lana relays every circle has limited space. Proposal P3 (the project owner confirms the first circles; seals from five members) is dropped. Since 23 Oct 2026 only a member of an existing circle can found a new circle, and every key a single circle; "at most three circles per founder" is thereby dropped (item 63, E-8).

What follows and needs no new decision:

14. Every payment goes to the relays, with the balances after it. This reverses the rule adopted the same morning (16 October) that payment confirmations carry no balances.
15. No secret addition (salt) in the seal and no 20-account threshold.
16. When publishing is switched on, the whole history from the start goes to the relays, not only new records.
17. A new relay gets the circle's whole history before the circle lists it.
18. Settings, projects with their votes (formerly with their approvals and objections), and membership each get a signed public record.
19. Nothing stays on a server that cannot be rebuilt from the relays; this is checked every morning.
20. The words of the name are always in the member home (formerly proposal P9), because everything is public. When a person changes their name, the app rewrites the member home; the joining entry in the ledger carries only the key.

Earlier decisions that stay:

21. Root relays are only the Lana relays in the 38888 record (14 Sep 2026). From 38888 we read only the relay list; its currency values are LANA prices, not exchange rates (15 Oct 2026).
22. Every circle has its own app (circle in a box), never one master app for several circles (16 Oct 2026).
23. One currency per circle; no deduction and no threshold on payments between currencies (16 Oct 2026).
24. The BSA ID is the Nostr public key in HEX of the same private key as the LANA WIF, never npub (16 Oct 2026).
25. The Lana profile is mandatory and minimal (16 Oct 2026).
26. The member home is mandatory (16 Oct 2026).
27. One seal a day, after the 04:00 morning (16 Oct 2026).
28. Whoever creates a circle founds it (16 Oct 2026).
29. Circles start on borrowed Lana relays (16 Oct 2026).
30. The circle key is held by the app and the creator (16 Oct 2026).
31. Private keys go nowhere (16 Oct 2026).
32. Nothing goes to the relays without the owner's yes (16 Oct 2026).
33. 72 hours of public notice (formerly for an order, now for a project); a proposer never decides on their own proposal; every objection is answered in public before approval; the community's step outward (10 Oct 2026, simplified 15 Oct 2026). How the step is raised, and what happens to a payment to another circle that hangs, is now set by item 43. Since 23 Oct 2026, 72 hours is the shortest vote (a default circle setting), and there are no answers to objections any more, since there are no objections (items 55 and 60).

the project owner, 16 October 2026, afternoon (answers to the open points; verbatim: "A. jaz sem a Heart member, ok pol dodaj še Jasno · B. Pozabi na vplačila v denarju, ker to je čist drug sistem · C. OK · D. Naj teče po vrsti, omejitve ne rabijo biti zaenkrat nobene · E. DA · F. OK · G. DA · H. OK · I. Tega ne razumem, pojasni · J. OK", and for I, after the explanation, "ok"):

34. Heart members (formerly "stewards") (open 4a, "I am then add a fourth person too"). The live circle has four Heart members: the founder and three other Heart members. A project is approved by three of four (since 23 Oct 2026: at least three Heart "for" votes and no "against", item 60).
35. No deposits (open 6a, "Forget money deposits, that is a different system altogether"). BSA has no money deposits. Dropped: deposits, the custodian, deposit corrections (formerly open 6b), question 12, the deposit alarm, "paid in" in the account line, and the circle's main account, which stood only for money paid in. The wave grows only with what a member receives.
36. When a project pays (open 8a, "OK"). A project pays its doer once it has collected the whole amount.
37. Several projects at once (open 8b, "Let it flow in order, no limits are needed for now"). Inflow goes to projects in order, the oldest first. For now there is no limit on the amount and no other limit.
38. The objection (open 8c, "YES"). An objection is possible within 72 hours of a project's publication. The project stays stopped until the objector withdraws the objection. Once a project is receiving, an objection does not stop it. Replaced on 23 Oct 2026 by E-5 (item 60): there are no objections any more; an "against" vote takes their place.
39. Money on a project that is already receiving (open 8e, "OK"). The Circle Heart closes the project with 72 hours of public notice; the money goes to the reserve. A project that does not fill within 90 days ends by itself. Since 23 Oct 2026 the 72 hours and the 90 days are default circle settings (item 55).
40. Paying a project and the community's money (open 8f, "YES"). Paying a project does not use up the community's money: the doer's wave grows, and the same amount goes on. The brake is the Heart members' approval (since 23 Oct 2026: the vote, item 60). The sum stays zero.
41. Keyless accounts (open 8i, "OK"). The world account and the step-outward account have no key. The project owner also confirmed the circle's main account, but it went with the deposits (item 35).
42. The starting rate source ("OK"). The daily rate of the European Central Bank. The app shows the rate's date. A rate quote is valid for 10 minutes. To be honest: the bank itself says its daily rates are for information only and should not be used for transactions. It publishes them once per working day, around 16:00, so a morning rate is the previous working day's, and over holidays it can be 4 to 5 days old.
43. A payment to another circle that hangs, and the step outward (open 8j, "ok" after the explanation). Nobody pays a refund. After 7 days the payer's circle itself looks into the receiver circle's public ledger on the relays. If the receiver's circle did not book the payment (its daily seals cover the whole time up to the note's expiry), the held amount goes back to the payer; if it did book it, the payment stands. If the receiver circle's ledger cannot be read, the payer's circle waits and never guesses. Raising the step outward is a project like any other: a proposal, three Heart members approve, no objection (since 23 Oct 2026: the vote, item 60), filled by gravity and the new steps. Once it is full, the circle's step rises by that amount.

the project owner, 16 October 2026, later the same day (answer to open 6c; verbatim: »6c, da«, "6c, yes"):

44. The first money in a new circle (open 6c, "6c, yes"). At founding, the circle's reserve gets one start (»zagon«): 1,000 in the circle's currency. It is booked from a keyless account, »izvor« ("origin"), which goes into minus by the same amount, so the ledger's sum stays zero. The start is not used up but keeps coming back (8f): a project pays a doer below the wave cap, the doer's wave grows, and the same amount goes on to the next project or to the reserve. There is no other first money: no starting wave for members, no bridge from Lana. The account name »izvor« / "origin" and the exact shape of the entry are a proposal for definitions 0.3.0 (plan step C1). The live circle (one member, no payments) gets the same start when its ledger begins (proposal: 1,000 EUR).

the project owner, 17 October 2026 (answers to phase C; verbatim: »1. DA - parametre shrani v posebni KIND tako, da ce zaznamo da ga svetovno spremenimo se spreminjo na vseh apliakcijah · 2. DA · 3. DA · 4. DA · 5. Ne razumem zakaj tega takoj ne narediš · 6. DA — Prosim pojasni točko 5 predno gremo na D«, and after the explanation of points 5 and 1: »7 Da, Lahko narediš vse skupaj v fazi D , evo preklopil sem na MAX, good luck, javi ko bo«):

45. The world rules record (C1, decided 17 Oct 2026; »1. DA - parametre shrani v posebni KIND tako, da ce zaznamo da ga svetovno spremenimo se spreminjo na vseh apliakcijah«, "1. YES - keep the parameters in a separate KIND, so that when we change it world-wide they change in every application"; after the explanation »7 Da«, "7 Yes"). The time limits (72 hours of notice and for objections, 72 hours before a project closes, 90 days, 7 days, 10 minutes) and the three Heart members who approve a project are the same for every circle; a circle cannot change them. They are written in one world-wide rules record with its own KIND (43920, "BSA Rules"), so a change of that record counts in every app. The record is signed by the same key that publishes the definitions on lananostr.site. A change counts only from the day written in the record, at least 7 days after it is published, and never retroactively. Every block and every seal names the rules version it went by, so a restore from the relays always gives the same result. Later several signatures can be required (for example 3 of 5). The first version is the values of definitions 0.3.0; it also holds the validity of an act and the limit on refusals (item 47). Replaced on 23 Oct 2026 by E-1 (item 55): the time limits and limits are circle settings; there is no world rules record (43920) any more.
46. Payments never wait for the morning (C2, decided 17 Oct 2026; »2. DA«, "2. YES"). Each account's gravity is computed from its state just before the morning. Before any entry after the morning hour touches an account, that account's gravity is booked first (visit before touch). So the order the node picks never changes anyone's gravity, and the order loses no debt (debt above the wave is still capped by the rule, as before).
47. Refusals of non-members, the validity of an act and the limit on refusals (C3, decided 17 Oct 2026; »3. DA«). When someone who is neither a member nor an applicant sends a note or an act, the circle only answers the sender and writes nothing into the ledger. An exception the definitions add (a proposal, not part of decision C3): a note from another circle that the other circle already holds is refused in the ledger, so the other circle can return the amount. Every act (proposal, vote …) is valid for at most 7 days after signing; after that it can no longer be booked. At most 20 refusals of one key a day go into the ledger; above that the circle only answers. Both numbers were in the world rules record (item 45); since 23 Oct 2026 they are circle settings (item 55).
48. No Heart member rejects a project alone (C4, decided 17 Oct 2026; »4. DA«). There is no rejection by a single Heart member. Only an objection stops a project, and the project stays stopped until the objector withdraws the objection (since 23 Oct 2026 there are no objections: a project falls if anyone is against at the end of the vote, item 60). The act that rejected a project and the status "rejected" are gone.
49. The circle id; the circle key can be replaced (C5, decided 17 Oct 2026; »5. Ne razumem zakaj tega takoj ne narediš«, "5. I do not understand why you do not do this right away"; after the explanation »7 Da, Lahko narediš vse skupaj v fazi D«, "7 Yes, you can do it all together in phase D"). A circle's name is its circle id (»rojstna številka«): the fingerprint of the founding charter (the found act) that the founder signs. It is not a key, so nobody can steal it. A thief cannot found a false circle under the same name, because his charter would have another circle id. The circle key is not the circle's name, so it can be replaced. Three of the four Heart members replace a stolen or lost key with 72 hours of public notice (since 23 Oct 2026 the 72 hours are a default setting, no longer fixed, item 55); the witnesses book the change. Proposal: the new key counts from the next block, and from then on a circle record signed by the old key no longer counts. The circle id never changes.
50. The first-seen rule ("the first ledger stands") (C6, decided 17 Oct 2026; »6. DA«). For every circle id the root relays remember the first genesis digest and the founder, and refuse any later circle record with different ones. The rule goes into the letter to the Lana relay owner (phase G). Since the circle's name is now its circle id and the circle key can be replaced (item 49), the rule is only extra safety.
51. Time zone, morning hour and time-zone database (C7, decided 17 Oct 2026; »7 Da«). They are written at founding and do not change in version 0.3.0. A later version of the definitions may say how a circle follows new clock-change rules.

the project owner, the evening of 17 October 2026 (answers to the three questions after phase D; verbatim: »vsi da«, "all yes", to the proposal »1A, 2A, 3A«):

52. Who signs the world rules (1A, decided 17 Oct 2026, evening; »vsi da«). For now the world rules record (item 45) is signed only by the key that publishes the definitions, that is, the project owner's. Several signatures (for example 3 of 5) are introduced before the first circle the project owner does not run joins (for example the first circle from another ecosystem). Who the signers will be is still open. To be honest: one key for the whole world is in tension with principle 3 (no central authorities); this decision limits the tension in time and says it openly. Dropped on 23 Oct 2026 by E-1 (item 55): there are no world rules and no signer of them any more, so this tension is gone.
53. The time-zone database version (2A, part of C7, decided 17 Oct 2026, evening; »vsi da«). At founding the circle writes down, besides its time zone and morning hour, the version of the time-zone database (tzdata). The witnesses compute the morning hour with that version, not with their own newest one. In version 0.3.0 it never changes; not even the Circle Heart can replace it. That the Circle Heart may replace it (for example when a country drops the clock change) can only come with a later version of the definitions.
54. The transition period (3A, decided 17 Oct 2026, evening; »vsi da«). The 60 days of gentler gravity run for each account from its own first receipt, as definitions 0.3.0 say. Today's app counts them from the circle's start; the live circle has no payments, so today this affects nobody. At the switch to the new gravity the per-account rule applies.

the project owner, 23 October 2026 (answers before phase E; verbatim in _reports/2026-10-16-knjiga-na-relejih/odlocitve-2026-10-16.md, section "Odgovori pred fazo E" with its subsections "Dopolnitev" and "Referenca"; it applies to definitions 0.3.0 (a draft, round 5) and does not affect the live circle or the relays today):

55. Circle settings instead of world rules (E-1; »Dejmo da lahko upravitelji spreminjajo svetovna pra vila zase, ker na koncu edino kar je pomembno je balance«, "Let the stewards change the world rules for themselves, because in the end the only thing that matters is the balance", and »72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "72 hours cannot be fixed; it can be a default setting that they can change"). Every circle sets its own times: the public notice and the vote (72 hours), 90 days to fill, 30 days to open, 7 days for a payment into another circle, 10 minutes for a note, the validity of an act and the daily limit on refusals. The values in the definitions are only default settings, which the Circle Heart changes within the bounds of the definitions. There is no common signer of world rules any more: the world rules record (43920, item 45) and item 52 (1A) are dropped, and the field of trusted people in 38888 is not needed for this. The same for every circle: a project needs at least 3 Heart "for" votes and no "against"; the computation of money and gravity. 72 hours is fixed nowhere: the notice before a change of the circle key, the witnesses or the Heart members is a default setting too (this changes item 49). Proposal: a change of any time counts only after the current time has run out, and never retroactively, so a stolen key cannot skip the warning.
56. The Circle Heart (E-2; »Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala«, "From now on the stewards will be the Circle Heart; that is what their seat will be called", and »tisti ki je ustvarili krog in ga negujejo tisti imajo moč... tisti, ki jim kaj ni prav gredo lahko ven in ustvarijo svoj boljši krog«, "those who created the circle and nurture it have the power... those who do not like something can leave and create their own better circle"). The stewards are called the Circle Heart; one person is a Heart member. The power lies with those who created the circle and nurture it. The circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle. The Heart adds and removes Heart members (k = 3, the proposal stays). Proposal: the technical names in the records (steward_*) stay; in English "Circle Heart" and "Heart member".
57. Exclusion (E-3; »Upravitelji lahko izključijo vsakega člana s tremi glasovi za izključitev«, "The stewards can exclude any member with three votes for the exclusion" · »KO je član enkrat bil izključen je izključitev avtomatsko 3 meseci. Nato pa lahko član ponovno zaprosi za vstop o čemer odločajo Srce kroga«, "Once a member has been excluded, the exclusion is automatically 3 months. Then the member can apply again, and the Circle Heart decides" · »vključitev nazaj nekoga ki je bil v srcu pomeni zgolj da je postal član ne potem avtomatsko da se vrne v srce«, "taking back someone who was in the Heart means only that they became a member, not that they automatically return to the Heart"). The Heart excludes any member, a Heart member too, by three votes, at once, with a public reason (the reason: proposal). An exclusion lasts 3 months by itself; then the person can apply to join, and the Heart decides (proposal: three votes). A former Heart member who comes back is a member only, not back in the Heart. The money stays on the account, frozen (it does not pay, it does not receive); gravity works on the plus; the person may take their plus to another circle, and the minus stays with the circle.
58. Closing old accounts (E-3, confirmed in the supplement: »ostalo si pravilno razumel«, "the rest you understood correctly"; the owner's words: »Določeni stari računi se lahko brišejo in z njem tudi kapacitete... ko se brišejo bo Srce rabilo vrniti denar, da gre kapaciteta na nulo... se nikamor ne mudi in niti ni škode nobene če obtsane«, "Certain old accounts can be deleted, and with them the capacities... when they are deleted, the Heart will need to return money so that the capacity goes to zero... there is no hurry and no harm at all if it stays"). The Heart can close old accounts and with them the wave. The circle (the reserve) covers a minus up to 0, but only if the member dies; whoever leaves in minus does not get it covered when they move (supplement). Gravity takes a plus to 0. Once the balance is 0, the wave goes to 0 and the reserve returns the same amount to the account "origin"; the community has that much less money. It is not urgent, and there is no harm if an account stays; it is a good way for a community to remove surplus funds.
59. OWN processes (E-4; »Upraviteolji tudi vodijo in ndazorujejo OWN procese. To dodaj.«, "The stewards also lead and oversee OWN processes. Add this."). The Heart leads and oversees its circle's OWN processes. They run in the existing OWN apps, encrypted; only a decision goes into the public ledger (for example an exclusion after a process).
60. Votes "all for, or it falls" (E-5; »To je kot, da bi dal na glasnovanje projekt in vsi lahko glasujejo za, če je ne proti zadeva pade. Torej projekt rabi imeti vsaj 3 glasove za iz Srca kroga in nobenega proti in 72 ur biti na glasovanju«, "It is as if you put a project to a vote and everyone can vote for; if anyone is against, it falls. So a project needs at least 3 votes for from the Circle Heart and none against, and 72 hours on the vote" · in the supplement: »Trajanje glasovanja, ok da je nakjrajsi 72 ur«, "The vote's duration: ok, the shortest is 72 hours"). As in Lana Aligns (for / resistance). The Heart puts any proposal to a vote; every member votes; if anyone is against at the end, the proposal falls. A project needs at least 3 Heart "for" votes and no "against". The proposer sets the duration at publication, and it never changes afterwards; the shortest duration is 72 hours by default (a circle setting). An "against" vote can be changed during the vote (what counts is the state at the end) and carries a short public reason. A proposal that fell may be proposed again, changed. A proposal without money is a public decision in the ledger. It replaces item 38 (8c: an objection stops a project until the objector withdraws it).
61. Admitting members (E-6; »Srce kroga lahko tudi omeji sprejamnje avtomatsko novih članov... v tem primeru se lahko nov član pride samo še na povabilo (recimo se ustvari nek posebno vabilo s strani člana... Upravitelji pa lahko omejijo skupnost na največje dovoljeno število in potem je waiting lista«, "The Circle Heart can also limit the automatic admission of new members... in that case a new member can come only by invitation (say a special invitation made by a member)... And the stewards can limit the community to a maximum number, and then there is a waiting list"). The Heart chooses: open (anyone joins by themselves), by invitation only (a member's special invitation; proposal: valid 7 days, once), or a maximum number of members with a waiting list (combined with either). When a place frees, the first on the waiting list joins automatically, in the order of applications; the Heart always decides about an excluded person.
62. Witnesses (E-7; »MA priče po mojem ni tak problem, če rečemo 3 rabijo biti za in noben proti da se doda oz zamenja Pričo«, "Witnesses are not such a problem, I think, if we say 3 must be for and none against to add or replace a witness" · in the supplement: »Priče se dodajo ali zamenjajo s 3 glasovi Srca za in nobenim proti. Priče, ki so drugi krogi z žrebom, so zapisane kot smer za kasneje. / A niso priče računlaniki in se določajo z žrebom«, "Witnesses are added or replaced with 3 Heart votes for and none against. Witnesses that are other circles drawn by lot are written as a direction for later. / But aren't witnesses computers, and chosen by lot?"). The Heart adds or replaces a witness with three votes for and none against (within the Heart). Witnesses are computers; a draw among the circles' computers chooses them (the direction for phase I: a public random number, for example a block of the Lana chain; the schedule is known in advance and changes regularly; a new witness loads the circle from its latest seal). Until there are enough circles to draw from, a circle has one witness, its own computer, publicly labelled (item 7). The Heart's vote is only for exceptions (for example to remove a witness that misbehaves until the next draw).
63. Founding circles (E-8; »Predlagam da novi krog lahko ustanovi samo nekdo ki je član nekega Kroga. Torej vsi krogi zrastejo z enega prvega korga. in jaz bi omejil da lahko vsak ustvari samo en krog in dokler potem postane član novega iz starega iztopi, ker ne more hkrati sedeti v dveh krogih«, "I propose that only someone who is a member of some circle can found a new circle. So all circles grow from one first circle. And I would limit it so that everyone can create only one circle, and when they then become a member of the new one they leave the old one, because they cannot sit in two circles at once"). Only a member of an existing circle can found a new circle; every circle grows from the first circle. Everyone can found a single circle. Whoever becomes a member of a new circle leaves the old one: a person can be a member of one circle at a time. This replaces "at most three circles per founder" (item 13). One key = one circle is ensured by the member home (30916, the newest counts); it does not prevent one person with two keys (that would need Lana's person check).
64. The reference (E-9; »Odpustnico preimnuj v refrenco in tam notri se zapise tudi kratko poročilo o objavljenih projektih in na katerih je sodeloval, vključno z kakšnim korako si je zgradil da dobi istega tam, pove se tudi da nima odprtih OWN procesov... Če ima odpr own proces in hkrati negativno stanje se frerenca sploh ne zida.. refrenca se zapise v Novi NOSTR KIND«, "Rename the discharge letter to a reference, and in it also write a short report on the projects published and those they took part in, including what step they built, so that they get the same one there; it also says they have no open OWN processes... If they have an open OWN process and at the same time a negative balance, the reference is not issued at all... the reference is written in a new NOSTR KIND" · »Torej ko nekod reče želim iztopiti iz kroga se refrenca izda sama če so izpolnjeni pogoji... če niso se je ne... nekdo ki ima dolg bo tako rabil nekoga drugega ki mu bo poplačal in v vsakem primeru se vrniti nazaj... brez refrence se ne prestopa«, "So when someone says I want to leave the circle, the reference is issued by itself if the conditions are met... if not, it is not... someone with a debt will then need someone else to pay it for them, and in any case go back... there is no moving without a reference" · »Sprejema se v nov krog samo z refrenco, brez tega ni nič«, "A new circle admits only with a reference; without it there is nothing"). Moving from circle to circle goes with a reference (in the supplement: the "discharge letter", »odpustnica«). It is issued by itself when a member says "I want to leave" and the conditions hold; otherwise it is not issued. A member gets it only when not in minus; a debt must be settled in any case, and someone else may settle it too (payments into the account, at most up to 0). An open OWN process together with a minus: no reference. It carries a short report: the projects published, the projects the person took part in, the step (wave) they built, so that they get the same one in the new circle, and that they have no open OWN processes. It is written in a new KIND (43921; checked free). No move without a reference: a new circle admits a person from another circle only with a reference (a rule for every circle, not a setting). The circle covers a minus only if the member dies (and when the Heart closes the old account; supplement). Questions (a) and (b) are answered (item 66). A consequence (proposal): the Heart writes the opening and closing of an OWN process into the ledger (with no content); whoever has never been in any circle needs no reference (proposal).
65. Acts for changes of the Heart and of the witnesses (D8; written as accepted in the section "Odgovori pred fazo E"). Accepted: a Heart member's resignation, adding and removing a Heart member, changing k, replacing and removing a witness, and a witness's resignation; E-7's change applies to witnesses (item 62), E-1's to the notice (item 55).
66. The answers on the reference (E-9 (a) and (b); »1 a, / 2 torej če prestopi v drug krog in je tukaj nvo 0 in v drugem odpre korak... potem mu lahko drugi krog pošlje tej skupnosti ta denarki ga je dobil od tega člana ki ga je ustanovil nov korak.. in se zadeva izniči«, "1 a, / 2 so if he moves to another circle and here it is 0 and in the other he opens a step... then the other circle can send this community the money it got from this member who founded a new step.. and it cancels out"). (a) An open OWN process blocks the reference also without a debt; the process must be closed first (the Heart, which leads the processes, can hold a person back this way). (b) In the old circle the balance is 0; the new circle opens the same step the reference states, and as with every growth of a step the same amount goes to its community (from its "origin"); the new circle sends that amount to the old circle's community (a payment between circles, at the rate when the currencies differ); the old circle closes the account (the wave to 0) and returns exactly that amount to its "origin". Both communities hold what they held before.
67. Four questions after round 5 (E-10; »1B, vendar OWN proces lahko sproži vsak.. ostalo ok / 2A / 3A / 4A«, "1B, but anyone can start an OWN process; the rest ok / 2A / 3A / 4A"). An exclusion, a readmission, an account close and the witness exceptions always need at least three Heart members (the larger of k and 3; a Heart of fewer than three cannot do them); any member opens an OWN process, one Heart member closes it; the wave a reference brings counts against the new circle's step outward; the longest vote is 14 days by default; the Heart may close anyone's account with a public reason and cover its minus.
68. After the review of round 5 (E-11; »1a,2a in 3c«, "1a, 2a and 3c"). The hold of a move has no deadline: only the old circle's confirmation or refusal ends it; a silent old circle means waiting. On a proposal without money the proposer's own vote counts; on a project the recipient does not count for itself. Gravity is never stronger than today's (the excess: half in 30 days; the gentle part: about 1 % a month), and a change that strengthens it needs at least 30 days of public notice. Protections (consistent with the decisions): a Heart member who leaves loses the Heart seat; a join with a step is not possible while an earlier move out of this circle is not settled; a reference is valid once: if the old circle refuses it, the new circle takes the step away.
69. Used references (E-13; »A«). Every circle's ledger records for good every reference on which it granted a step (in the state, under the state root, in the snapshot); this circle never accepts the same reference again — not at a join, not from the waiting list, not after a readmission, not after the person leaves and comes back. Between circles nothing changes: the old circle answers one reference once, another circle takes its unused step away (E-11). Before, only the node's check at the door prevented a reuse, not an admission from the waiting list.

The decision of 16 October that the owner's rate key signs the rate reference every hour is replaced by item 11. The earlier rule that the community refunds a payer after 7 days by public decision (10 and 15 October) is replaced by item 43. The review's proposal of 16 October that the time limits are written in the definitions, so that a change needs a new version of the definitions, is replaced by item 45. Today's rule that one steward (now a Heart member) can reject a project is dropped by item 48. The review's proposal of a fixed circle key that is part of the circle's address is replaced by item 49. On 23 October items 45 (the world rules record) and 52 were replaced by item 55, which also turns the fixed 72 hours of item 49 into a default setting. Item 38 (the objection, 8c) was replaced by item 60. "At most three circles per founder" in item 13 was replaced by item 63. The part of item 7 that the circle chooses its witnesses itself is replaced, for the future, by item 62 (a draw, phase I).

Proposals and questions waiting for the owner's yes#

Still open after the owner's answers:

• Open 3a: seven witnesses in a large circle. Proposal: a circle above about 10,000 members has seven witnesses, five must agree. Whether one owner may then hold two is for the project owner to decide. Until the project owner answers: at most one witness per owner.
• Open 8g: a contribution to a project. May a member give to a project only their plus, as today, and not from their wave? Proposal: only the plus. Whatever exceeds what the project still lacks goes to the reserve. A contribution that names no project goes to the reserve and from there to the projects.
• Open 8h: the doer of a project. Must the doer of a project be a member of the circle? For example whoever gives the circle a relay. Proposal: yes, the doer joins the circle first.
• Proposals that come with the afternoon decisions. They follow from the decisions, but the project owner has not confirmed them explicitly:
  • the Circle Heart's other acts (settings, relays, the rate source, a new node) and closing a project are signed by k Heart members, in the live circle three of four (for replacing the circle key this is decided, item 49); an exclusion, a readmission, closing an account, the witness exceptions and recovery always need at least three Heart members (the threshold is the larger of k and 3; item 57) [Decided 23 Oct 2026, E-10]; any member opens an OWN process alone, one Heart member closes it [Decided 23 Oct 2026, E-10];
  • the recipient of a project consents to it or declines it, as today for an order;
  • a project that is already receiving is also closed, and its money goes to the reserve, when the doer steps back or leaves the circle, when the proposer withdraws the project, or when the doer is no longer a member at the time of payment;
  • the 90 days count from the day the project started receiving;
  • a project that has not opened 30 days after its publication (a default setting) ends; there is no money on it yet (as today for an order);
  • a vote that comes after the end of the vote is refused by the circle in public, with its reason (there are no objections any more, item 60);
  • the recipient of a project to raise the step is the step-outward account; it needs no consent, because the account has no key, and since the account has no wave, such a project really uses up the community's money;
  • the step is lowered by a vote like a project (nobody against, at least three Heart "for" votes), but never below what the circle has already used outside; the money goes from the step account to the reserve and from there to a project; in definitions 0.3.0 the ledger does not book a lowering yet, because the rule is not complete;
  • if the receiver circle's ledger cannot be read, the payer's circle tries again every day after the morning.
• A proposal on the starting rate source. A circle changes its source by an act of the Circle Heart, at any time. The Circle Heart is alerted when the rate is older than 120 hours.
• The circle key is only a stamp on the mirror (for decisions 3, 8 and C5): a proposal; it follows from the decisions, but the project owner has not confirmed it. The circle key signs only the ledger's mirror, the circle record in the directory, which counts only if it matches the ledger, and once the founding charter in block 1: the ledger decides who the witnesses and relays are, and there is no fund key any more. It replaces the part of proposal P2 about what the key signs. That the circle key can be replaced is decided (item 49).

New proposals and questions of the supplement of 17 October 2026 (they follow from decisions C1 and C5; definitions 0.3.0 hold them as proposals until the project owner confirms or change them):

• Dropped on 23 Oct 2026 by E-1 (item 55): the bounds of the world rules, the ledger adopting a rules version, the signing time of a rules record, and the question of who signs the world rules. There are no world rules any more; the bounds of the circle settings are a new proposal (below).
• Every block checks by the settings in force for it. The validity of a note and a quote, the number of Heart votes and the refusal limit are checked by the settings in force at the booking [Proposal, E-1]. A deadline that is already running keeps the length in force when it started; the ledger writes down, at its start, when it ends [Consequence of E-1]. The vote and the time within which a project opens count from the project's publication; the time within which it fills, from its opening; the notice before it closes, from the last signature the closing needs; the 7-day check, from the hold; the validity of an act, from its signing. While a change of the settings is announced but not yet in force, apps sign by the stricter of the two values (for example the shorter validity of a note).
• The circle key in every seal. A daily seal carries the circle key of the newest mirror up to the last block it covers; at the height of a change that is already the new key, which also signs the circle record of that height. The circle head copies it, both under the witnesses' signatures, so an app that finds the circle in the directory picks the right circle record. A block holds at most one roles entry (a change of witnesses, the Circle Heart, the node, relays, the rate source or the circle key), so one height of the ledger always means one mirror, and a second entry in the same block cannot undo the first (for example a key change). To be honest: anyone can publish a circle record with the same circle id. A circle record counts only if it is signed by the circle key that the ledger's mirror names at the height the record gives (at the height of a change already the new key), if it equals that mirror and if it points to the right first block.
• The new key signs for itself. At a change the new key signs itself (proof of possession, pop) and so shows that whoever proposes it really holds it; nobody can name a key someone else holds. The signature also covers the circle id and the time of the proposal, so it can never be used again later. The circle key is never the founder's, a witness's or a Heart member's key, and the new key is not the key already in office.
• The notice of the changes the Circle Heart decides. The notice for witnesses, relays, Heart members, k, recovery, the circle key, the settings and a resignation is a circle setting, 72 hours by default, and no longer fixed [Decided 23 Oct 2026, E-1; formerly C5 "a fixed 72 h"]. A change that makes gravity stronger has at least 30 days of public notice [Decided 23 Oct 2026, E-11]. A change of the settings has a notice at least as long as the current value of every time that changes, so not even a shorter notice shortens the protection against a stolen key [Proposal, E-1].
• Open: circle heads on the root relays. Whether a root relay accepts the 30915 head of a circle it is not configured for (checked against the witnesses of its pinned record). The prepared write policy accepts heads only of configured circles.
• The clarifications of 17 Oct 2026 (D1 review) need no decision from the project owner; two of them make the owner's "never retroactive" concrete (C1, now E-1): a project opens without an act once its last condition holds, and a running deadline keeps the length in force when it started.

New proposals and questions with the decisions of 23 October 2026 (they follow from decisions E-1 to E-9; definitions 0.3.0 hold them as proposals until the project owner confirms or change them):

• The brake on a moving step [Decided 23 Oct 2026, E-10 (2A)]: for safety, the amount the new circle sends to the old circle for a newcomer's step counts against its step outward (used + amount ≤ step). Whoever brings a step that no longer fits under the step outward waits on the waiting list until it fits. So a circle that does not raise its step outward takes in no waves from elsewhere. Is that right?
• Answered: "three" [Decided 23 Oct 2026, E-10]. An exclusion, a readmission, an account close and the witness exceptions always need at least three Heart members: the threshold is the larger of k and 3; a Heart of fewer than three cannot do them.
• The bounds of the circle settings (the table in the technical part, §3.1 rule 11). The longest vote is 14 days by default; a vote always ends before a project's time to open runs out.
• Changing the settings: k Heart members sign; only one change is open at a time; the notice is at least as long as the current value of every time that changes; during the notice apps sign by the stricter value. If fewer than k of its signers are in the Heart at the end of the notice, the change is void.
• Between circles each circle applies its own settings; a mismatch ends only in a refusal and a return to the payer (the document "Currencies and exchange rates").
• Votes: at the end the roles count as they are then (who is a member, who a Heart member); a proposal without money follows the same rule as a project (nobody against, at least three Heart "for" votes); the recipient's consent stays; a vote after the end is refused in public; among deadlines in the same second, the end of a vote comes after the lapses of projects and before the expiry of payment requests.
• Exclusion: a short public reason is required; the duration is a circle setting, 90 days by default; an excluded person's projects end as at a leave; an exclusion may name the number of an OWN case.
• The reference: the ledger issues it at the leave or later, once the conditions hold; the record 43921 also says when the person became a member and when they left; "took part" means the projects that paid them; a new circle checks the reference against the old circle's ledger and keeps it, with the old circle's block, on its own relays too, so that it restores by itself; whoever has never been in any circle needs no reference; the root relays keep member homes (no deletion); a payment that settles a debt does not grow the wave; settling is possible during an exclusion too; whoever has left may send their plus to another circle.
• OWN processes in the ledger: opening (any member, alone [E-10]) and closing (one Heart member), with no content.
• Founding: the founding charter names the parent circle and the founder's reference; the root relays keep the first founding charter of every founder and refuse a second; whether the founder was a member of the parent circle when founding is checked by the root directory and by readers (details in phase G).
• Admitting: an invitation is valid 7 days and once; whoever waits withdraws from the waiting list by themselves; a maximum of 0 members means no limit.
• Names: the technical names (steward_*, stewards_required) stay; in English "Circle Heart" and "Heart member".

Other questions:

• Question 17: it counts at three relays, sending to the others continues, the app always shows the real "N of M". This changes the owner's rule of 14 Sep that publishing waits for every relay's answer.
• Question 14: decision 2 says at least four relays with at least three owners. Proposal: while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. I count the four Lana relays as one owner until the project owner says otherwise. Tension: until the Lana relay owner adds the write rules, only the box relay counts, so under item 5 no payment could ever count, and the circle would depend on one outside owner. Decide: (a) the circle books nothing until then; (b) until then the Lana relays count as copies with the public label "copies without protection against deletion"; (c) until then the circle finds two more relays with the same rules at other owners.
• Question 18: a new letter to the Lana relay owner (replaces proposal P6). The Lana relays count as copies of a ledger only once they apply the ledger rules (no entry is ever deleted). When the Lana relays count as copies depends on this letter (the tension under question 14). The letter also carries the size of the space for hosted circles (proposal: 1 GB or one year per circle). It also carries the first-seen rule (decided, item 50) and the request that root relays keep member homes (no deletion) and the first founding charter of every founder (proposal, E-8 and E-9); the request about the world rules record is dropped (item 55). Proposed for how the relays apply the first-seen rule: root relays keep every circle's founding charter, and remember a circle's first record only when they hold its founding charter and the same founder signed it (or, for a circle configured on the relay, when its configured circle key signed the record), so nobody can be the first to claim someone else's circle id. A replaced (retired) key counts only in the role it had (an old circle key, for example, only for old circle records, never for blocks).
• Question 10: 38888 stays the starting directory, but no circle depends on it: the link and QR code carry the circle id, the genesis digest and the circle's relays. This changes how much a circle relies on 38888, not which relays are root relays.
• Question 13: at most 100,000 members per circle for now; the limit rises after measurements.
• Question 15: a circle pays for its relays through a project (formerly: from Common Good by an order, which no longer exists); partner circles keep copies for each other.
• Question 16: profiles and member homes are on the Lana relays only while a circle is borrowed; later on circle relays and index relays.
• Question 19: a fast relay may remove an old record only once it is proven stored on at least three archive relays of different owners; box relays never remove anything.
• Question 20: every circle writes into its ledger the version of the definitions it runs on. The circle's settings are in the state of every block, and every seal names the height from which they are in force (item 55).
• Question 21: a vote, an "against" vote with its reason included, is signed with the member's key and public; there are no objections any more (item 60). The ledger carries no name (item 9); the app shows the name from the profile. The purpose of a payment stays optional, with the warning at the field.
• Question 23: a daily summary of each witness's votes is public; a single vote on request or as evidence (a vote that is not in a block is not published by itself: a small exception to principle 1).
• Question 24: project images (formerly order images) are not on the relays; their fingerprint and address are (a departure from principle 2 "everything on the relays"; so it is the project owner's).
• Question 11 (guardians for a stolen key) adds act types to the ledger; it is described in the document "Running a circle".
• Question 12 (a deposit limit per signature) is dropped, because there are no deposits (item 35).
• Proposal P2 (stays): the circle key lives in the app in the creator's browser and on a paper copy; the server holds only the node key. What the key signs is the proposal above (the circle key is only a stamp on the mirror); a stolen or lost key is replaced by the Circle Heart (item 49).
• Proposal P7: one yes per version of the definitions and one yes to switch on each kind of record.