The world relay network DRAFT 0.3.0

Plain-words text · Technical specification · All documents

English text rendered from the project's source documents. The Slovene original is on lananostr.site. Where this text and the definitions differ, the definitions win.

Precedence: where this document and definitions 0.3.0 differ, the definitions (docs/bsa-records-0.3.0.json) win; the difference is a mistake in this document, to be fixed.

Foundation. Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden. All transactions are public and stored on the relays, so the ledger can be restored from them at any moment. Applications only read from the relays, check and show. The six development principles: docs/nacela-razvoja.md.

This document is the overview of the world relay network: which relays there are, what lives on which, how things are found, how a ledger is restored and how much the whole can carry. How a circle's ledger is built (blocks, entries, account lines, the seal, restore step by step) is in the document "The ledger on the relays". Who decides in a circle (witnesses, the Circle Heart, acts) is in the document "Running a circle: witnesses and the Circle Heart".

Where we are today. The live circle still keeps its ledger in a database on its own server and does not publish payments. Publishing to the relays is switched off. This document describes the design. Only what is marked as decided and listed at the end under "Decided" is decided; the owner's answers to questions 1–9 of 16 October, the owner's answers to the open points the same afternoon, the owner's answers to points C1–C7 of 17 October, the owner's answers 1A, 2A and 3A of the evening of 17 October and the owner's answers before phase E (E-1 to E-9) of 23 October are there too. What changed on 23 October carries the label [Decided 23 Oct 2026, E-n], [Proposal] or [Consequence] (follows from a decision). Everything else is a proposal waiting for the owner's yes, larger proposals with their question number; what is still open is marked "open" (for example "open 8g"). Nothing goes to the relays until the project owner says "yes".

The essence#

• Every payment is public on the relays. A relay is a public server that stores signed records. The circle's ledger is a numbered chain of blocks. A block is like a page in a book: it carries the payments with the payers' signatures, everything that follows from them, and the balance of every account the entry touched. Every page carries the fingerprint of the page before it, so no page can be torn out or swapped without it showing.
• The circle's ledger lives on the circle relays. From the first day every circle has its own box relay and, in all, at least four relays with at least three owners (decided). Circles start on borrowed Lana relays (decided) and are hosted there, with limited space, while they are small. A million circles means a million small books, not one big one, each on its own relays.
• A payment counts when a majority of witnesses has confirmed it and at least three relays hold it (decided). A witness is a computer with some owner that recomputes every entry by itself and signs it only if it adds up. The payer sees "paid · public on 3 of 4 relays" within half a second to a second and a half.
• The node only checks, orders and signs. The node is the witness of the circle that accepts payments, puts them in order and packs them into blocks. Besides keys, whatever the server holds is only a temporary copy for speed. Delete it and it is rebuilt from the relays. This is checked every morning.
• Root relays are only the Lana relays listed in the Lana System Parameters record (38888); four today. From 38888 we read only the relay list. The root relays are a directory, like a phone book: which circles exist, where their ledgers are, their latest seals and members. The directory grows with the number of circles and members. The ledgers grow with payments, each on its own circle's relays.
• Every circle has one daily seal, every morning right after gravity. The seal closes the day and publishes the full balance of every account. Since payments and balances are public, anyone can check any account, not only a member their own.
• Payments between circles go directly from node to node, for speed. Every step (hold, acceptance, final entry) is written in public in both circles' ledgers. Between currencies the receiver's circle gives the rate, and the payer accepts it or does not pay (decided).
• Every member is in the world directory (mandatory) and is found by their BSA ID (public key) or by name. The name is only in the Lana profile and the member home; the ledger knows people only by their key (decided). The BSA ID is described in the document "BSA ID and the Lana profile".
• The only things never public anywhere are private keys and session tokens (what the browser keeps while you are signed in). There is no bank data in BSA, because BSA never pays anything out, and there are no money deposits, because that is "a different system altogether" (both decided).
• The four Lana relays will not carry 100 billion payments a day. So the network grows with the circles: every circle brings its own relays (decided) and pays for its own ledger (proposal, question 15).
• Witnesses will be chosen by lot among circles [Decided 23 Oct 2026, E-7]: witnesses are the circles' computers; every circle is a witness for others and they for it; the schedule comes from a public random number (for example a block of the Lana chain) and changes regularly. This is the direction for phase I; until then a circle has one witness, its own computer. Below, "Witnesses drawn by lot among circles".
• There is no world rules record any more [Decided 23 Oct 2026, E-1]: periods and limits are each circle's settings and live in its ledger. The root relays hold no rules that apply to every circle.
• From circle to circle with a reference [Decided 23 Oct 2026, E-8 and E-9]: a person is a member of one circle at a time; their newest member home says which circle is the last. A new circle admits them only with the reference of their last circle, which it reads from the old circle's relays (a new record, 43921; the number: a proposal).

Five kinds of relays#

Where things live#

There is no longer a day file kept only on the server. The node does not hand out proofs: anyone computes them from the public records. A person's name is only in the Lana profile and the member home; it is nowhere in the ledger (decided).

What the Lana root relays hold#

1. The Lana System Parameters record (38888). We read only its relay list. The prices in it are LANA prices and have nothing to do with LetsBalance; they are not exchange rates.
2. The 0.3.0 definitions describing all records below, signed by the Lana authority. Proposal: every circle writes into its own ledger which version it runs on, so nobody can change its rules while it runs (question 20). Nobody changes the periods and limits for every circle at once: they are each circle's settings (decided 23 Oct 2026, E-1).
3. There is no world rules record any more (decided 23 Oct 2026, E-1; formerly C1 and 1A). KIND 43920 is retired; its number stays reserved and is never used again. The periods and limits are each circle's settings: written in the found act and in the state of the circle's ledger, and changed by the Circle Heart within the bounds of the definitions. So the root relays hold no rules for every circle, and the witnesses do not read any. Said plainly: this removes the only key that reached every circle (1A), and with it that tension with principle 3.
4. Every circle's record. It is a mirror of the ledger: it shows the circle's name, currency, witnesses, Circle Heart, relays and (proposal) parent circle as the ledger says. Where mirror and ledger differ, the ledger counts. The directory is kept per circle id (the fingerprint of the found act; decided 17 Oct 2026, C5). The record is signed by the circle key in office, and that key can be replaced. Said openly: any key can store a record naming a circle id on a root relay; only a record signed by the circle key named by the ledger's mirror at the height the record gives (at the height of a key change already the new key), equal to that mirror and pointing to the right first block, counts. Proposal: the root relays also keep every circle's found act (below, "Write rules") and remember every founder's first found act; they do not accept a second circle of the same founder (one circle per key, decided 23 Oct 2026, E-8).
5. The circle head, the mirror of the latest daily seal, replaced every day. Proposal: circles send their heads spread over the whole day, each at its own time, so they do not crowd into the hour after 04:00. The head names (proposal) the circle key in office, so the app finds the right circle record by it. It no longer names a rules version, since there is no world rules record (E-1).
6. Lana profiles and, while a circle is hosted, member homes. Proposal: member homes are never deleted, because a person's newest member home says their last circle and a new circle reads it before admitting someone from another circle (decided 23 Oct 2026, E-8 and E-9; where and how: proposal).
7. While a circle is hosted: its ledger, but only in limited space (decided), and only once the relay owner has added the write rules (below). How much space is still a proposal: 1 GB or one year per circle, whichever comes first (question 18).

The root relays no longer hold rates. The receiver's circle gives a rate quote, and the quote lives on that circle's relays (decided; see the document "Currencies and exchange rates").

The root relays do not carry the payments of large circles. Phones read the root relays only at first install.

The circle relays#

• The box relay. Every circle gets its own relay together with its app. With it the circle keeps its own copy of the ledger at home from the first day (decided).
• At least four relays with at least three owners (decided). Three copies with the same owner are not three copies: one owner can delete them all. Proposal (question 14): while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. We count the four Lana relays as one owner until the project owner says otherwise.
• Write rules. The box relay has them built in; the Lana relays need their owners to add them:
  • the relay knows a circle by its circle id and by the circle key in office; every ledger record names its circle by its circle id (decided 17 Oct 2026, C5);
  • blocks, seals and snapshots are accepted only from the witnesses the circle's ledger names;
  • rate quotes are accepted only from the circle's node;
  • the circle record is accepted only when the circle key in office signed it; after a key change the old key counts only for circle records signed before the change; a retired key counts only in its own role, so the old circle key can sign no block, seal or rate quote (proposal);
  • acts are accepted only from members and applicants of that circle, with a limit on how much one person may send; the found act of a circle the relay keeps is accepted from its founder;
  • references (43921) are accepted only from the circle's node (proposal, E-9); there is no world rules record any more (E-1);
  • statements are accepted from the witnesses and from anyone else, with the same limit, because a verifier's challenge must always get through;
  • the root relays remember, for every circle id, the first genesis digest and founder they saw, and refuse a later circle record with another genesis digest or another founder (the first-seen rule, "the first ledger stands"; a request in the letter to the Lana relay owner, decided 17 Oct 2026, C6). Since a thief cannot found a false circle under the same circle id, this is now only extra safety. Proposal: the root relays keep every circle's found act; they remember a circle's first record only when they hold its found act and the same founder signed it (or, for a circle configured on the relay, when its configured circle key signed the record), and only once every write rule of the relay has accepted the record; so nobody can be first to claim another's circle id;
  • the root relays remember every founder's first found act and do not accept a second circle of the same founder (one circle per key, for ever; decided 23 Oct 2026, E-8; how: proposal); they never delete member homes (proposal, E-9);
  • ledger records cannot be deleted: the relay refuses every deletion request and every expiry;
  • ledger records are exempt from every clean-up;
  • archive relays accept records of any age (today the Lana relays refuse a record older than 10 years, so they could not take old history);
  • the rules are tested on a separate test relay before anything goes to the relays.
• The Lana relays count as a copy only once they have these rules. Today they accept almost anything and do not refuse deletions. What this means for the first circles is open (the tension under question 14 below).
• Morning copy check. Every morning the circle compares the copies between its relays and sends whatever is missing anywhere. The app shows "copies 4 of 4".
• Who pays for the relays. Proposal: every circle through a project, like everything the community pays for; sister circles keep copies for each other (question 15).
• Witnesses will be chosen by lot among the circles' computers (below, "Witnesses drawn by lot among circles"; decided 23 Oct 2026, E-7). The exceptions, when the Circle Heart removes a witness, and the details are in the document "Running a circle: witnesses and the Circle Heart".

When a payment counts#

1. The member signs the payment in the browser. The key never leaves the device.
2. The node checks the signature, the cover and membership, puts the payment in order and closes a block. When it is quiet, a block holds a single payment and closes at once.
3. Every witness recomputes every number of the block from its own copy of the ledger and signs only if it adds up. When three of four have signed, the block is confirmed.
4. The node sends the block to every circle relay.
5. The payment counts when three relays confirm they hold it (decided). The payer's app reads the block itself from two relays, checks the signatures and the arithmetic and shows "paid · public on 3 of 4 relays".

• How long it takes: about half a second to a second and a half while the circle is hosted on the Lana relays; about 0.3 to 0.9 seconds with its own relays nearby. Today, with everything on one server, it takes about 12 thousandths of a second. The difference is the price of a payment being public on three relays and checked by a majority of witnesses. These are estimates; we will measure them on the test server once the project owner says yes.
• Sending to the other relays continues, and the app always shows the real "N of M" (proposal, question 17). This changes the rule of 14 September that publishing waits for every relay: the slowest Lana relay answers only after about a second, and every payment would wait that long.
• A payment never waits for a directory read. It waits only until three relays hold it.
• At the start there is a single witness (the live circle). The app says so in public, "not yet decentralised". There is no money cap (decided). The public label, the daily independent check and the morning restore check protect. So it stays until there are enough circles for the witness draw (decided 23 Oct 2026, E-7).

How things are found#

1. Start. A member gets their circle's link or QR code. It carries the circle id (the fingerprint of the found act the founder signs; the circle's name for ever), the genesis digest (the fingerprint of the ledger's first block) as an extra pin (by both the app recognises the real circle) and the addresses of at least two circle relays. The app reads the Lana relays only at first install or when it looks for a circle it does not know yet, and always only those in the newest 38888.
2. Who is the member. By key or by name it finds their member home, which names their circle; the newest one counts, since a person is a member of one circle at a time (decided 23 Oct 2026, E-8). A member's address carries their circle the way an account number carries its bank, so paying needs no worldwide lookup.
3. Which circle. The circle record names the relays and the witnesses. On the root relays the app looks it up by the circle id. There can be several such records, because anyone can store one; the app takes the one signed by the circle key in office, which the ledger names and, as proposed, also the circle head. Since the record is only a mirror, the app reads witnesses and relays from the ledger itself.
4. Balance and history. The app reads them from the circle relays and checks the signatures and the arithmetic itself. It asks the node only to book a new payment.
5. Before paying, the app checks in the ledger that the receiver joined the circle and has not left. The member home is a pointer; the ledger is the truth.

Reading rules. Always from two relays at once. "Not found" holds only after both said they are done. A silent relay does not mean "nothing" and never means balance 0. The app always says how many relays answered. Blocks are numbered, so every gap shows as a missing number.

Speed (measured on 16 October on the Lana relays): with the connection already open a read takes 0.06 to 0.2 seconds; with opening the connection 0.5 to 0.9 seconds. Every record is signed, so anyone may pass it on and nobody can forge it.

Adding and removing relays#

• Only the Lana authority adds a root relay, by listing it in 38888. Before that it is filled with a copy of an existing root relay and checked by record count. Within the next 24 hours, each at a random time, circles send it their circle record and head. A root relay gets only the directory and every circle's found act (proposal); there is no world rules record any more (E-1).
• A circle adds a circle relay itself, by an entry in its ledger (who decides is in "Running a circle"). Before listing it, the circle copies the whole ledger history onto it: every block from the first, every seal, snapshot, act and statement, the rate quotes and the partner blocks relied on. Only when it has checked that the relay holds every block number from 1 to the newest and that the seals match does it list the relay.
• Removing: an entry in the ledger. Whatever the relay still holds does no harm, because everything is signed.
• An archive relay can be run by anyone. The circle names it in its record.
• At the start a circle begins on borrowed Lana relays and with its own box relay. The old proposal P4, that circles set up their own relays only from about 2,000 circles, is replaced by the owner's decision on question 2 (a box relay from the first day).

Keeping the copies the same#

• The circle itself sends every block to every relay of its own. The Lana relays copy to each other live only a fixed list of 45 kinds of records, and BSA records are not among them. We do not rely on that.
• Every morning and after every outage the circle compares the copies between its relays. Only fingerprints are compared, so it is cheap. Whatever is missing anywhere is sent again. The app shows the result.
• BSA records must not be carried by our shared tool that keeps the Lana relays in step until its four faults are fixed. With more than 500 new records of one kind in ten minutes it skips the oldest. It loses records that carry the same time to the second. When a connection fails, it believes it has copied the whole history. Every round it reloads everything, so with many records it never finishes.

The daily seal and the snapshot#

• Every morning, right after gravity at 04:00, the node closes the day. The seal says which blocks belong to the day and carries the fingerprints of every entry of the day and of every account's balance. With it, a snapshot goes to the relays: every account's balance, cut into snapshot chunks of at most 100 KB.
• There is no secret addition and no 20-account threshold. The number of payments and the gravity are public in every circle, even the smallest.
• The witnesses recompute the seal and sign it. Each publishes its own daily statement with the fingerprint of the state it computed itself.
• The seal lives on the circle relays. Only its mirror, the circle head, goes to the root relays (proposal: spread over the whole day).
• There is a seal every day, also on days without payments. Everyone sees a day without a seal: it means the node is down.
• The seal is a public stamp on history, not a confirmation of payment. A payment already counts earlier, once three relays hold it.
• Anyone can compute for any account: yesterday's balance + signed payments ± gravity = today's balance.

Payments between circles#

1. Ana in circle A pays Bojan in circle B. If circle B has another currency, Ana's app first asks circle B for a rate quote. Circle B's node signs the quote; it states the source, the rate, the time and until when it is valid (10 minutes, decided; since 23 Oct 2026 a default setting of circle B, E-1). The app shows Ana the converted price. If it suits her, she signs one payment with both amounts and a reference to the quote; if not, she does not pay (decided).
2. Circle A checks Ana's cover, the step outward and, between currencies, the quote, exactly as circle B will check it. If the quote runs out before the payment is booked, the payment does not count and nothing is held; the app shows a new price and Ana signs again. Otherwise circle A holds the amount on the circle's world account and books this in public.
3. For speed, node A sends the payment directly to node B. Circle B's witnesses can also read it from circle A's relays.
4. Circle B checks that circle A really confirmed the payment, that Bojan is its member and, between currencies, that both amounts match its quote and that circle A held the payment before the quote ran out. Circle B always honours its own valid quote. Then it books the receipt in public, or a public refusal with its reason.
5. Circle A turns the hold into a final entry that names the block of circle B it relies on, but only if circle B booked exactly the right amount for the same payment; otherwise it counts as a refusal.
6. If circle B does not answer, the entry in A is not undone by itself, and nobody pays a refund (decided). Circle B may book a note only before its expiry, by default at most 10 minutes after signing (the existing note rule; a circle setting, E-1). If the two circles have different settings, each applies its own to its own side; a mismatch can only end in a refusal and a return to Ana, and nothing is lost (proposal; in detail in the document "The ledger on the relays"). After 7 days (a default setting of circle A) circle A itself looks into circle B's public ledger on circle B's relays. Nobody can book a note after it has expired, so the answer is final once circle B's daily seals cover the whole time up to the expiry of Ana's note. If circle B did not book the payment, circle A gives the held amount back to Ana and names circle B's seals as its evidence in the entry, together with the seal just before them; every witness of circle A checks those seals against circle B's blocks, not only its seals. Only a block signed by a majority of circle B's witnesses counts; a block that no majority of the witnesses in office at the time signed (for example one signed only by an old or stolen key) is ignored, so it cannot stop the refund. Two blocks with one number, each signed by such a majority, are a fork, so the evidence is not used; a key that was itself that majority at the time (for example the only witness of a one-witness circle, whose key was later stolen) can still make such a fork. A change of key or witnesses in circle B does not stop the check. Which blocks count here (the witnesses' majority, a fork, a key change) is a proposal. That no block was left out is shown by circle B's next block, booked after the last seal's morning. If circle B has booked nothing since, its next daily seal shows it instead; before using it, the witness confirms on at least two of circle B's relays that no new block exists. If any of this is missing, nothing is booked; if circle B has stopped working, the amount stays held. If it did book it, the payment stands and circle A makes it final. If circle B's ledger cannot be read (its relays are silent, a block is missing or there is no seal yet), circle A waits and never guesses, and meanwhile it goes on booking everything else. So no book is ever left contradicting another.
7. Every circle stays at zero through its own world account. A circle also copies to its own relays the partner's block it relied on and the rate quote, so it restores without the partner.
8. A sales limit for any one circle stays an option (proposal P5). Since every circle's ledger is public and checked by witnesses, any circle can recompute another circle's step and its use. A lying node is visible to everyone, so the limit loses most of its reason.

Witnesses drawn by lot among circles (the direction for phase I)#

Decided 23 Oct 2026, E-7 (»Jaz bi mogoče celo razmišljal da so naključni krogi in da se skozi lahko spreminjajo in drug drugega gledamo... torej vsi krogi so tudi priče in potem se medsabo zavek toliko časa premešajo tako da nenehno vse kroži... potem o tem ne bi bilo treba razmišljati«, "I would maybe even think that they are random circles, and that they can change all the time and we watch each other... so all circles are also witnesses, and then they keep being mixed among themselves so that everything keeps circulating... then we would not have to think about it"; the addition: »A niso priče računlaniki in se določajo z žrebom«, "But aren't witnesses computers, and they are chosen by lot"): witnesses are computers, chosen by lot among the circles' computers. This is the rule and the direction for phase I; 0.3.0 has no code for it.

• Every circle is a witness for others. Every circle puts its computer into a common draw. So circles watch each other, and everything keeps circulating [Decided 23 Oct 2026, E-7].
• The draw comes from a public random number that nobody knows in advance and nobody can choose, for example a block of the Lana chain [Decided 23 Oct 2026, E-7]. Since the number is public, anyone can check by themselves that the draw was fair [Consequence].
• The schedule changes regularly and is known in advance, so a new witness gets ready in time [Decided 23 Oct 2026, E-7].
• A new witness loads the circle from the latest seal and from there on checks everything itself [Decided 23 Oct 2026, E-7]. The seal, the snapshot and the blocks are on the circle's relays, so a new witness needs nothing from the old one [Consequence].
• One witness until then. Until there are enough circles to draw from, a circle has one witness, its own computer, labelled in public "not yet decentralised" (decision 3, unchanged for 0.3.0) [Decided 23 Oct 2026, E-7].
• The Heart's vote only for exceptions, for example to remove a witness that misbehaves until the next draw: at least three Heart members for (the larger of k and 3) and no Heart member against [Decided 23 Oct 2026, E-7 and E-10]. In detail in the document "Running a circle".
• At most one witness per owner stays: two drawn computers of the same owner must not both be witnesses of the same circle [Consequence of decision 3].
• Open for phase I [Decided 23 Oct 2026, E-7: these are the open points]: fake circles (whoever makes many empty circles would get more places in the draw); matching the load (a large circle must not get too small a computer); absent witnesses (what happens when a drawn witness does not work, so that the circle still stays alive).
• Said plainly (principle 5). A circle then no longer chooses its witnesses itself and depends on the network of circles, not on one circle. Principle 5 says every community is a technically independent cell. The tension is smaller because no single witness can do anything alone (three of four must agree) and anyone can recompute the ledger; whether that is enough is for the project owner to decide [Consequence of E-7].

The world member directory#

• A member home is a short record signed by the member, into which a witness of their circle adds an attestation that they really are its member. A member cannot claim a circle that is not theirs, and a circle cannot claim a person who is not its member.
• The member home is mandatory: every member is in the directory. The truth about membership is the joining and leaving entry in the circle's ledger; the member home points to it. A person is a member of one circle at a time; their newest member home says which circle is the last (decided 23 Oct 2026, E-8).
• A Lana profile is mandatory and minimal.
• What is public: everything. On joining the app says so in one sentence: "Everything in this circle is public on the relays: payments, purposes and balances."
• The words of the name are always in the member home, so search by name is fast. This follows from the principle that everything is public (formerly proposal P9).
• The name is not in the ledger (decided). The ledger knows people only by their key. The name is only in the Lana profile and in the member home; the person can change both at any time, and a relay keeps only the newest version. When a person changes their name, the app rewrites the member home. In the owner's words: then nobody knows any more what belonged to whom. To be honest: a name can remain in old copies of a profile that someone saved, and in free text that someone writes.
• Search: by key at once. By name: by the full name ("janez novak") or by one word of the name. The app shows at most 50 results; if there are more, it asks for the full name. Searching by part of a name is offered by search services anyone can run. Since results are signed, a search service can hide someone but cannot invent anyone.
• Where: always on the circle relays; while the circle is hosted, also on the Lana relays; with millions of members on index relays (proposal, question 16).
• Moving (decided 23 Oct 2026, E-8 and E-9; replaces proposal P1): a person moves from circle to circle with a reference. When they say "I want to leave" in the old circle and have settled (no minus and no open OWN process, E-9 (a)), the reference is issued by itself; it is booked in the old circle's ledger, and the node publishes it as a 43921 record (the number: a proposal) on the circle's relays. The new circle reads it, checks it against the old circle's public blocks and does not admit the person without it. The BSA ID stays the same, so whoever pays notices nothing; the person publishes a new member home that points to the new circle. In the new circle they get the same step; the new circle sends the same amount to the old circle's community, which closes the old account and returns the amount to its own »izvor« ("origin"), so both communities stay as they were (E-9 (b)). For the relays this is one payment between the two circles, written in both ledgers [Consequence of E-9 (b); the shape: Proposal, §3.11 of docs/knjiga-na-relejih.md ("Membership, exclusion, the reference and closing accounts")]. Said plainly: a deleted member home or a second key of the same person is not caught (that would need Lana's person check); proposal: the root relays never delete member homes. And plainly too: in the live circle today almost every active member is below zero because they gave (by design); such a member gets no reference until the debt is settled, by them or by someone else [Consequence of E-9].

Circle in a box#

• Every circle has its own application; there is no single main application for several circles. A new circle is made by anyone copying the LetsBalance app and running it on their own server.
• The box also holds the circle relay, with the write rules built in (decided).
• The founder signs the founding act (the found act) in the browser. Its fingerprint is the circle id, the circle's name for ever (decided 17 Oct 2026, C5). The act goes into the first block of the ledger; the link carries the fingerprint of that block, the genesis digest, as an extra pin. Details are in the document "New circle: circle in a box".
• Whoever creates a circle founds it; there is no personal approval (decided). A circle enters the directory on the Lana relays by a rule the relay checks itself. Only a member of an existing circle founds a new one, and each key only one; the founder leaves the old circle with a reference; every circle grows from the first one (decided 23 Oct 2026, E-8; the reference: E-9).
• Decided (16 October): the circle key is held by the app and the creator. Proposal P2 (stays): that is the app in the creator's browser and a paper copy; the server holds only the node key. Proposal: from the decisions on questions 3 and 8 it follows that the circle key signs only the ledger's mirror and, once, the found act in block 1; this would replace the part of P2 about what the key signs. The project owner have not confirmed it explicitly. The circle key can be replaced (decided 17 Oct 2026, C5): the circle's name is its circle id, not a key. A stolen or lost key is replaced by k Heart members (three of four in the live circle) with public notice, 72 hours by default (a circle setting, E-1); the new key signs a proof that whoever proposes it really holds it; it also signs the circle id and the time of the proposal, so the proof can never be used again (proof of possession; proposal); the witnesses book the change; the new key is in office from the next block (proposal). The circle id stays the same. A thief cannot found a false circle under the same circle id, because his found act has another id. The first-seen rule on the root relays (a request in the letter to the Lana relay owner, decided 17 Oct 2026, C6) is therefore only extra safety.
• A member types their BSA WIF into their own circle's app. The app signs in the browser and never sends the key to the server.

Rates#

Decided (16 October), in the owner's words: "the seller's circle proposes an exchange rate and the buyer accepts it".

• Rates for payments between currencies do not come from 38888.
• The receiver's circle proposes the rate (the seller's circle), from a source it chooses itself: an outside service, some day also a record on the relays.
• The payer decides. The app shows the converted price. If it suits them, they sign the payment with both amounts. If not, they do not pay.
• A rate quote is a public signed record of the receiver's circle: source, rate, time and until when it is valid. The node of that circle signs it. Both circles' ledgers carry both amounts and a reference to the quote.
• Quotes live on the relays of the circle that gave them. The payer's circle also copies the quote it relied on to its own relays, so it restores without the partner. The root relays no longer hold rates.
• This replaces the decision that the owner's key signs the rate every hour, and the proposal of three publishers and the middle rate. The owner's rate key is no longer needed; some day it may be one of the sources a circle chooses.
• The starting source (decided): the daily rate of the European Central Bank (public, free, for EUR, USD and GBP). The node reads it once a day. The app shows the rate's date. A quote is valid for 10 minutes; this time is a default setting of the receiving circle (decided 23 Oct 2026, E-1; formerly the world rules record, C1). Proposal: a circle changes its source by an act of k Heart members; the Heart members are alerted when the rate is older than 120 hours.
• Everything about this is in the document "Currencies and exchange rates".

What is public and what is not#

Everything is public: every payment, amount and purpose, who paid whom (by key), every account's balance and wave after every entry, every account's gravity, every project with its votes, every vote for or against, signed with the voter's key (an "against" with its reason), every move of money to a project and the reserve, every decision, every exclusion with its reason, every reference, every account closing, every change of settings, witnesses, the Circle Heart and the circle key, every member, every booked refusal of a member or applicant with its reason (by default at most 20 of one key a day; above that the circle only answers), every rate quote, the seals, snapshots and witness statements. The exception: the content of OWN processes is encrypted in the OWN apps; only that a process runs, and the decision, reach the ledger (decided 23 Oct 2026, E-4). This is a tension with principle 1 for the owner to decide.

Never public, anywhere: private keys (members' BSA WIF and the keys of witnesses, Heart members and the circle) and session tokens.

There is no bank data in BSA (decided). BSA never pays anything out, so it needs neither account numbers nor statements. Bank matters belong to Lana. There are no money deposits in BSA either (decided), because that is "a different system altogether". The wave grows only with what a member receives.

Public for ever. Once a record is on three relays nobody can remove it again. That is why the ledger knows people only by their key, and the name is only in the profile and the member home, which the person can change (decided). At every free-text field (purpose of a payment, the reason of an "against", the reason of an exclusion, title and description of a project) the app warns: "public for ever; do not write names, personal or bank data". The legal review before the first entry and the free text beside the chain are dropped.

Restoring from the relays#

If a circle's server disappears, the ledger is restored on any other computer:

1. Find the circle: from the link or QR code, from any member's home, or from the directory on the Lana relays. Only what leads back to the circle id and the genesis digest counts.
2. Read who the witnesses are: from the ledger, from the founding and from every change of witnesses.
3. Take the latest daily seal from two relays; prefer one that at least two witnesses confirmed independently in their statements.
4. Read the snapshot and check every chunk against the seal.
5. Read the blocks from the seal up to today from all relays at once, check the chain and the signatures, and recompute every entry.
6. If a block is missing, look for it on other circle relays, in archives, with partners and with the witnesses. If it is nowhere, stop and report its number. Never guess.
7. Build a temporary copy for speed.
8. To continue booking, the Circle Heart (k Heart members) and the witnesses name a new node by an entry in the ledger.

There is no world rules record any more (E-1): the circle settings are in the state of its ledger, so a restore needs only the circle's relays.

How long it takes (seal plus one day of blocks): a circle of 1,000 members a few seconds, of 100,000 members 2 to 12 minutes, of a million members from a quarter of an hour to two hours. The time depends on how much happened since the last seal, not on the circle's age.

A check every morning. After the seal the node (and anyone else) restores the circle from the relays alone and compares the result with the seal. The result is a public statement. If the check fails, every member sees it in the app, not only the Circle Heart.

A new phone reads everything from the relays. Only the BSA WIF must be kept.

When something fails#

Capacity#

The numbers are estimates unless marked "measured". Basis: a payment takes about 1.2 to 3.5 KB with everything it carries; records take twice their own size on disk (measured); people pay during 16 hours of the day; a third of payments go to another circle.

One circle

• The box relay of a 1,000-member circle needs 20 to 90 GB a year for four copies. That is little.
• In small circles the block's envelope (header and signatures) takes the most space, because almost every payment goes to the relays in its own block, in under a second.
• One circle must fit on one relay, because every circle relay holds the whole circle. Hence the proposal that a circle has at most 100,000 members for now and that a bigger community splits into several circles (question 13).

The world

• 100 billion payments a day is 1.16 million payments a second. It is not one system but the sum of millions of light cells. No part sees the whole world.
• Per person that is 34 to 66 MB of disk a year, about 0.2 to 0.4 US cents a year. Disks are cheap. What is costly is running very many relays reliably: from 3,200 to 58,600 relays, depending on how much each can take, or from 2 to 10 million small box relays of 22 to 57 GB a year each.
• The largest public Nostr relays today take only a few records a second. Nobody has done anything like this yet.

Root relays (the directory)

• A million circles: circle records and heads take about 9 GB; 12 new heads a second.
• Ten million circles: about 90 GB and 116 heads a second. The smallest Lana relay would need a bigger disk, or the Lana authority adds root relays.
• The profiles and member homes of 10 billion people would take about 25 TB on every root relay. The smallest Lana relay takes about 11 million profiles and 7 million member homes today. Hence index relays at large scale (proposal, question 16).

Today's four Lana relays (measured and read on 16 October 2026)

• Four small servers with identical software. Free disk: 11, 90, 23 and 51 GB; the smallest is 70 % full.
• Today they take 2,245 to 4,513 records a day; they are almost idle.
• One query returns at most 500 records for each search condition (filter). Copies of the same kind of record differ between them by up to 18 %.
• Writing is open to anyone today, deletion and expiry of records are switched on, and records older than 10 years are refused.
• As the only place for ledgers they would carry the whole ledger of one 1,000-member circle for only about two years (at 2 payments a day), half a year at 10 payments a day. Hence circle relays.
• How fast they confirm a write was not measured, because nothing was sent to them.

Not measured yet: how fast a relay confirms a write and how much writing it sustains; whether a confirmed record is really kept when the power goes; how many connections one relay holds; what a relay does with a record that was deleted once. We measure this on a separate test server with the same settings as the Lana relays, once the project owner says "yes". Nothing is sent to the Lana relays for it.

Decided#

Principles (the project owner, 16 October 2026)

1. The six development principles (document "Development principles").
2. "The whole ledger is kept only through the relays, truly nothing local; applications only read from the relays."
3. "Transparent, decentralised infrastructure is the basis of our development, and nothing is ever hidden."
4. "The four Lana relays will not carry 100 billion transactions; the system must be scalable."

The owner's answers to questions 1–9 (the project owner, 16 October 2026)

5. When a payment counts (question 1, "yes"). When a majority of witnesses (3 of 4) has confirmed its block and at least three relays hold it. The app shows "paid · public on N of M relays".
6. Where a circle's ledger lives (question 2, "yes"). From the first day every circle has its own box relay and, in all, at least four relays with at least three owners. The Lana relays in 38888 stay the root directory for ever and a borrowed home for small circles, with limited space. The rule "relays only from 38888" applies to root relays, not to the relays on which circles keep their ledgers: this is the owner's yes to the new reading of the rule of 14 September. It replaces the old proposal P4 (own relays only from about 2,000 circles).
7. Witnesses (question 3, "yes, as the assistant proposes, no money cap"). It starts with one witness, labelled in public "not yet decentralised". There is no money cap. The public label, the daily independent check and the public restore check stay. Then four witnesses with four different owners, three of whom must agree. At most one witness per owner. The circle chooses and replaces its witnesses itself (this part was changed on 23 Oct 2026 by item 63: the draw). "Independent" means "can replace any particular partner", not "needs nobody".
8. The people who decide (question 4, "the first people of the first circle (all of them)"). In the live circle the founder and two others decide; the founder is one of them. A project is approved by three. In the afternoon the project owner explained that they are a Heart member, and added a Heart member: four (item 36). Since 23 Oct 2026 they are called the Circle Heart (item 58).
9. Public for ever, and the name (question 5, "A person can change their name, and then nobody knows any more what belonged to whom"). The ledger knows people only by their key. The name is only in the Lana profile and in the member home; the person can change both at any time, and a relay keeps only the newest version. The ledger never copies a name. The legal review as a condition and the free text beside the chain are dropped. The warning at every free-text field stays.
10. Bank data and payouts (question 6, "Bank data is unnecessary in this system … because the funds are never paid out"). BSA has no bank data and no payouts. Dropped: payout requests, the payout entry, "held for payouts", the monthly bank reserve statement and the payout brake. Question 6 is no longer an exception to principle 1. There are no money deposits either (item 37).
11. Rates (question 7, "the seller's circle proposes an exchange rate and the buyer accepts it … the circle chooses the source itself"). The receiver's circle proposes the rate from a source it chooses itself. The payer sees the converted price and, if it suits them, signs both amounts; if not, they do not pay. A rate quote is a public signed record of the receiver's circle. This replaces the earlier item on the owner's rate key and the proposal of three publishers. The starting source is decided in item 44; how a circle changes its source stays a proposal (below).
12. Projects instead of Common Good (question 8, "money always goes to projects, which have no key … So it is always projects that are funded"). Project wallets and the reserve have no key; only a public rule the witnesses check moves money. A project starts receiving once three have approved it and nobody has objected; an objection to a newly published project stops it (since 23 Oct 2026 the consensus vote "all for, or it falls" instead, item 61). A project receives up to its own amount; gravity and the new steps flow into it. A surplus goes to the reserve, and the reserve moves automatically to a newly approved project. The sum stays zero. The single Common Good wallet and the fund key are dropped. When no project is receiving, the money stays in the reserve; this follows from decision 8 (formerly open 8d). The details are decided in items 38 to 43 and 45.
13. Founding circles (question 9, "I like the founding of circles like this for now"). No personal approval. A circle's ledger is public from its first block. A circle enters the directory on the Lana relays by a rule the relay checks itself: the founder is registered in Lana, at most three circles per founder. On the borrowed Lana relays every circle has limited space. To be honest: the Lana register, one body, keeps the list of who is registered in Lana; a circle not listed keeps working through its link and QR code (question 10). Proposal P3 ("the project owner confirms the first circles; seals from five members on") is dropped. "At most three circles per founder" was replaced on 23 Oct 2026 by item 64 (only a member of an existing circle, one circle per key).

What follows from the principles and answers and needs no new decision

14. Every payment goes to the relays, with both balances after it.
15. The secret addition (salt) in the seal is gone, and so is the 20-account threshold: counts are always public.
16. When publishing is switched on, the whole history from the start goes to the relays, not only new records.
17. A new relay gets the circle's whole history, not only the latest circle record.
18. Settings, projects with their approvals and objections (since 23 Oct 2026 with votes, item 61), and membership each get their own signed public record. So the truth about membership is the entry in the ledger; the member home points to it. This changes the text of the decision of 16 October "a member is whoever has a member home on the relays": a member is whoever has a joining entry in the ledger and no leaving entry; the member home stays mandatory as a pointer (item 28). The joining entry carries only the key, never a name.
19. Nothing stays on a server that cannot be rebuilt from the relays; this is checked every morning.
20. The words of the name are always in the member home (formerly proposal P9). When a person changes their name, the app rewrites the member home.
21. The root relays no longer hold rates; rate quotes live on circle relays (from item 11).

Earlier decisions that stay

22. Root relays are only the Lana relays in 38888; from 38888 only the relay list is read (14 September 2026). The currency values in 38888 are LANA prices, never exchange rates (15 October 2026).
23. Every circle has its own application (circle in a box), never one main application for several circles. A member types their BSA WIF into their own circle's app, which signs in the browser; the risk that a dishonest circle captures the key is accepted (16 October 2026).
24. One currency per circle; payments between currencies have no deduction and no threshold for an unusual rate move (16 October 2026).
25. The BSA ID is the Nostr public key in HEX of the same private key as the LANA WIF, never npub (16 October 2026).
26. The Lana profile is mandatory and minimal; the app fills the wallet field (16 October 2026).
27. One seal a day, after the 04:00 morning gravity, every day, also without payments (16 October 2026).
28. The member home is mandatory (16 October 2026).
29. Whoever creates a circle founds it (16 October 2026); since 23 Oct 2026 only a member of an existing circle, one circle per key (item 64).
30. Circles start on borrowed Lana relays (16 October 2026).
31. The circle key is held by the application and by whoever creates the circle (16 October 2026).
32. A member with a negative balance is not moved: the owner's answer "that does not exist" (16 October 2026). Since 23 Oct 2026 moving is possible with a reference, which a member in minus does not get until the debt is settled (item 65); proposal P1 is replaced by it.
33. An order (now a project) is public for 72 hours before it is decided, and every objection is answered in public before approval; the circle has a step outward, which the community decides in public (10 October 2026, simplified 15 October 2026). How the step is raised, and what happens to a payment to another circle that hangs, is now set by item 45. The notice and the answer to objections were replaced on 23 Oct 2026 by the vote (item 61).
34. Private keys never go anywhere (16 October 2026).
35. Nothing goes to the relays without the project owner's explicit yes on the definitions (16 October 2026).

the project owner, 16 October 2026, afternoon (answers to the open points; verbatim: "A. jaz sem a Heart member, ok pol dodaj še Jasno · B. Pozabi na vplačila v denarju, ker to je čist drug sistem · C. OK · D. Naj teče po vrsti, omejitve ne rabijo biti zaenkrat nobene · E. DA · F. OK · G. DA · H. OK · I. Tega ne razumem, pojasni · J. OK", and for I, after the explanation, "ok")

36. Four (open 4a, "I am then add a fourth person too"). The live circle has four: the founder and three other Heart members (since 23 Oct 2026 the Circle Heart, item 58). A project is approved by three of four (since 23 Oct 2026: three Heart votes for and nobody against, item 61).
37. No deposits (open 6a, "Forget money deposits, that is a different system altogether"). BSA has no money deposits. Dropped: deposits, the custodian, deposit corrections (formerly open 6b), question 12, the deposit alarm, "paid in" in the account line, and the circle's main account, which stood only for money paid in. The wave grows only with what a member receives.
38. When a project pays (open 8a, "OK"). A project pays its doer once it has collected the whole amount.
39. Several projects at once (open 8b, "Let it flow in order, no limits are needed for now"). Inflow goes to projects in order, the oldest first. For now there is no limit on the amount and no other limit.
40. The objection (open 8c, "YES"). An objection is possible within 72 hours of a project's publication. The project stays stopped until the objector withdraws the objection. Once a project is receiving, an objection does not stop it. Replaced on 23 Oct 2026 by the vote (item 61).
41. Money on a project that is already receiving (open 8e, "OK"). The project is closed with 72 hours of public notice (since 23 Oct 2026 the Circle Heart closes it; the notice is a circle setting, item 57); the money goes to the reserve. A project that does not fill within 90 days ends by itself.
42. Paying a project and the community's money (open 8f, "YES"). Paying a project does not use up the community's money: the doer's wave grows, and the same amount goes on. The brake is the approval (since 23 Oct 2026 the vote, item 61). The sum stays zero.
43. Keyless accounts (open 8i, "OK"). The world account and the step-outward account have no key. The project owner also confirmed the circle's main account, but it went with the deposits (item 37).
44. The starting rate source ("OK"). The daily rate of the European Central Bank. The app shows the rate's date. A rate quote is valid for 10 minutes. To be honest: the bank itself says its daily rates are for information only and should not be used for transactions; it publishes them once per working day, so a rate can be a day old, or 4 to 5 days over holidays.
45. A payment to another circle that hangs, and the step outward (open 8j, "ok" after the explanation). Nobody pays a refund. After 7 days the payer's circle itself looks into the receiver circle's public ledger on the relays. If the receiver's circle did not book the payment (its daily seals cover the whole time up to the note's expiry), the held amount goes back to the payer; if it did book it, the payment stands. If the receiver circle's ledger cannot be read, the payer's circle waits and never guesses. Raising the step outward is a project like any other: a proposal, three approve it, no objection (since 23 Oct 2026 the vote, item 61), filled by gravity and the new steps. Once it is full, the circle's step rises by that amount.

the project owner, 16 October 2026, later the same day (answer to open 6c; verbatim: »6c, da«, "6c, yes")

46. The first money in a new circle (open 6c, "6c, yes"). At founding, the circle's reserve gets one start (»zagon«): 1,000 in the circle's currency. It is booked from a keyless account, »izvor« ("origin"), which goes into minus by the same amount, so the ledger's sum stays zero. The start is not used up but keeps coming back (8f): a project pays a doer below the wave cap, the doer's wave grows, and the same amount goes on to the next project or to the reserve. There is no other first money: no starting wave for members, no bridge from Lana. The account name »izvor« / "origin" and the exact shape of the entry are a proposal for definitions 0.3.0 (plan step C1). The live circle (one member, no payments) gets the same start when its ledger begins (proposal: 1,000 EUR).

The decision of 16 October that the owner's rate key signs the rate every hour is replaced by item 11. The earlier rule that the community refunds a payer after 7 days by public decision (10 and 15 October) is replaced by item 45.

the project owner, 17 October 2026 (answers to the phase C points; verbatim: »1. DA - parametre shrani v posebni KIND tako, da ce zaznamo da ga svetovno spremenimo se spreminjo na vseh apliakcijah · 2. DA · 3. DA · 4. DA · 5. Ne razumem zakaj tega takoj ne narediš · 6. DA — Prosim pojasni točko 5 predno gremo na D«, and after the explanation of points 5 and 1: »7 Da, Lahko narediš vse skupaj v fazi D …«)

47. The world rules record (C1, "YES – store the parameters in a separate KIND, so that when we change it world-wide they change in every application"; after the explanation, "you can do it all together in phase D"; decided 17 Oct 2026). The time values (72 hours of publication and objection, 72 hours before closing, 90 days, 7 days, 10 minutes) and the three who approve a project are the same for every circle; a circle cannot change them. They live in one world-wide record of its own kind, KIND 43920 BSA Rules, signed by the same key that publishes the definitions on lananostr.site. A change counts only from the day written in the record, at least 7 days after it is published; never retroactively. Every block and seal names the rules version it used, so a restore from the relays always gives the same result. Later several signatures can be required (for example 3 of 5). For the relays: every version lives on the root relays for ever, where the witnesses read them every day, and a circle's relays may keep a copy; as proposed, the block that adopts a version embeds it (rules_adopt), so a restore needs only the circle's relays. Said openly: one key changes values for every circle, and principle 3 asks for no central authority; its reach is bounded by the notice, by never retroactive, by the fixed list of values and by the bounds of each value (the bounds are a proposal). Replaced on 23 Oct 2026 (item 57): there is no world rules record any more; KIND 43920 is retired and its number stays reserved; the periods and limits are circle settings.
48. Payments never wait for the morning (C2, "YES"; decided 17 Oct 2026). Payments never pause for the morning; gravity follows visit before touch: an account's gravity is booked right before the first entry that touches it after the morning. An act (for example a vote) does not touch an account; only an entry that moves money does (clarification, 17 Oct 2026 (D1 review)).
49. Refusals and how long an act is valid (C3, "YES"; decided 17 Oct 2026). A refusal of a key that is neither a member nor an applicant is answered and never booked. An act is valid for 7 days. At most 20 refusals of one key a day are booked. Since 23 Oct 2026 the 7 days and the 20 refusals are default circle settings (item 57).
50. An objection stops a project (C4, "YES"; decided 17 Oct 2026). None of those who approve a project rejects it alone; only an objection stops it. Replaced on 23 Oct 2026 (item 61): there is no objection any more; a single "against" of any member makes a project fall.
51. The circle id; the circle key can be replaced (C5, "I do not understand why you don't do this right away"; after the explanation, "you can do it all together in phase D"; decided 17 Oct 2026). The circle's name is its circle id (the fingerprint of the found act the founder signs), not a key. A stolen or lost circle key is replaced by three of four (now Heart members) with 72 hours of public notice (since 23 Oct 2026 by default; a circle setting, item 57); the witnesses book the change. For the relays: the root directory is kept per circle id; every ledger event names its circle by its circle id; the circle record is signed by the circle key in office; the link and QR carry the circle id, at least two relay hints and the genesis digest (what exactly they carry is a proposal, Q10). Said openly: any key can store a circle record naming a circle id on a root relay; only a record signed by the circle key named by the ledger's mirror at the height the record gives (at the height of a key change already the new key), equal to that mirror and pointing to the right first block, counts.
52. The first-seen rule, "the first ledger stands" (C6, "YES"; after the explanation it stays in the letter; decided 17 Oct 2026). The request that the root relays keep, for every circle id, the first genesis digest and founder they saw goes into the letter to the Lana relay owner (phase G). Since a thief cannot found a false circle under the same circle id (item 51), it is now only extra safety.
53. Time zone and morning hour (C7, "7 Yes"; decided 17 Oct 2026). A circle's time zone, morning hour and tzdata version are written at founding and do not change in 0.3.0.

The earlier statement of this document that the circle key could not be replaced in 0.3.0 is withdrawn: item 51 replaces it.

the project owner, the evening of 17 October 2026 (answers to the three questions after phase D; verbatim: »vsi da«, "all yes", to the proposal »1A, 2A, 3A«)

54. Who signs the world rules (1A, "all yes"; decided 17 Oct 2026, evening). For now the world rules record (item 47) is signed only by the key that publishes the definitions, that is, the project owner's. Several signatures (for example 3 of 5) are introduced before the first circle the project owner does not run joins (for example the first circle from another ecosystem). Who the signers will be is still open. Said openly: one key for the whole world is in tension with principle 3 (no central authorities); this decision limits the tension in time and says it openly. Dropped on 23 Oct 2026 (item 57): there is no world rules record any more.
55. The time-zone database version (2A, part of item 53, "all yes"; decided 17 Oct 2026, evening). At founding the circle writes down, besides its time zone and morning hour, the version of the time-zone database (tzdata). The witnesses compute the morning hour with that version, not with their own newest one. In 0.3.0 it never changes; not even the Circle Heart can replace it; that they may (for example when a country drops the clock change) can only come with a later version of the definitions.
56. The transition period (3A, "all yes"; decided 17 Oct 2026, evening). The 60 days of gentler gravity run for each account from its own first receipt, as definitions 0.3.0 say. Today's app counts them from the circle's start; the live circle has no payments, so today this affects nobody. At the switch to the new gravity the per-account rule applies.

the project owner, 23 October 2026 (answers before phase E; the owner's words and the full decisions are in the document "Running a circle" under "Decided")

57. Circle settings instead of world rules (E-1, »72 ur ne more biti fiksno to je lahko default nastavitev, ki jo lahko spremeinijo«, "72 hours cannot be fixed; it can be a default setting that they can change"). Every circle sets its own periods and limits; the values in the definitions are default settings, which the Circle Heart changes within the bounds of the definitions. There is no world rules record and no signer any more (1A is dropped); KIND 43920 is retired, its number stays reserved. The same for every circle: a project needs at least three Heart votes for and none against; the money and gravity computation. For the relays: the root relays hold no rules for every circle any more; the settings are in each circle's ledger.
58. The Circle Heart (E-2, »Upravitelji bodo po novem Srce kroga, tako se bo njihova postavitev imenovala«, "From now on the stewards will be the Circle Heart; that is what their office will be called"). The circle's members do not elect the Heart; whoever disagrees leaves and creates their own circle; the Heart itself adds and removes Heart members (k = 3, the proposal stays).
59. Exclusion and old accounts (E-3). The Heart excludes any member with three votes, at once, for 3 months; it can close old accounts (the wave returns to the origin; the circle covers a minus only on a death).
60. OWN processes (E-4). The Heart leads and oversees them; they run encrypted in the OWN apps; only the decision reaches the ledger.
61. The consensus vote "all for, or it falls" (E-5). All members vote; the proposer sets the duration, the shortest 72 hours by default; a project needs at least three Heart votes for and none against. Replaces 8c (item 40) and C4 (item 50).
62. Joining (E-6). Open, invite only, or at most so many members with a waiting list; the first on the list comes in by itself; the Heart decides about an excluded person.
63. Witnesses by lot (E-7, »A niso priče računlaniki in se določajo z žrebom«, "But aren't witnesses computers, and they are chosen by lot"). Witnesses are computers, chosen by lot among the circles' computers; the direction for phase I is above, in "Witnesses drawn by lot among circles". Until then one witness, the circle's own computer; the Heart's vote only for exceptions.
64. Founding (E-8, »Torej vsi krogi zrastejo z enega prvega korga.«, "So all circles grow from one first circle."). Only a member of an existing circle founds a new one; one circle per key, for ever; a person is a member of one circle at a time; one person with two keys is not prevented. For the relays: the root relays remember every founder's first found act (proposal).
65. The reference (E-9, »Sprejema se v nov krog samo z refrenco, brez tega ni nič«, "A new circle admits only with a reference; without it there is nothing"). The reference is issued by itself when a member says "I want to leave" and has settled; nobody moves without it. For the relays: a new record 43921 (the number: a proposal) on the circle's relays; a new circle reads the newest member home and the reference of the last circle. Answered the same day (»1 a,« and »... in se zadeva izniči«, "... and the matter cancels out"): (a) an open OWN process blocks the reference also without a debt; (b) the new circle opens the same step and sends the same amount to the old circle's community, which closes the account and returns the amount to its »izvor«.

Proposals and questions waiting for the owner's yes#

Still open after the owner's answers

• Open 3a (waiting for the owner's answer): seven witnesses in a large circle. Proposal: a circle above about 10,000 members has seven witnesses, five must agree. Whether one owner may then hold two is for the project owner to decide. Until the project owner answers: at most one witness per owner.
• Moving with a step, safety (for E-9 (b)) [Proposal]: the wave the new circle opens counts against its step outward; a join whose wave no longer fits under the step waits on the waiting list. A question for the owner: a circle that cannot raise its step then takes in no waves from elsewhere (a founder in a new circle with step 0 waits too).
• Answered on 23 Oct 2026 (E-10): the owner's "three" for an exclusion and for the witnesses means always at least three Heart members (the larger of k and 3).
• Tensions with the principles (23 Oct 2026), for the project owner to decide: witnesses drawn by lot from the network of circles (principle 5); admitting someone from another circle depends on reading the old circle's ledger (principle 5); the live circle as the root of every circle (principles 3 and 5); the Heart's power (principle 3), including holding back a reference with an open OWN process (E-9 (a)); encrypted OWN processes (principle 1). The tension of 1A (one key for the whole world) is removed.
• Open 8g and 8h (contributions to a project, the doer of a project) are described with their questions in the documents "The ledger on the relays" and "Running a circle".
• Proposals that come with the afternoon decisions follow from the decisions, but the project owner has not confirmed them explicitly; all of them are listed in "The ledger on the relays". Two matter for the relays: the Heart's other acts, including listing or removing a circle relay, are signed by k Heart members (three of four in the live circle; for replacing the circle key this is decided, item 51); if the other circle's ledger cannot be read, the payer's circle tries again every day after the morning.
• A proposal on the starting rate source: a circle changes its source at any time by an act of k Heart members; the Heart members are alerted when the rate is older than 120 hours.
• The circle key is only a stamp on the mirror (for decisions 3 and 8): a proposal; it follows from the decisions, but the project owner has not confirmed it. The circle key signs only the circle record, which is the ledger's mirror, and, once, the found act in block 1; the ledger decides who the witnesses, the node and the relays are. It would replace the part of proposal P2 about what the key signs. That the circle key can be replaced is decided (item 51).
• The circle key in the seal and the head (proposal, for item 51): every daily seal, and so every circle head, names the circle key in office under the witnesses' quorum, so a reader of the root directory picks the right circle record. A daily seal carries the circle key of the newest mirror up to the last block it covers; at the height of a key change that is already the new key, which also signs the circle record of that height. A block holds at most one roles entry, so one height of the ledger always means one mirror, and a second entry in the same block cannot undo the first (for example a key change). At a key change the new key signs a proof of possession (pop), so nobody can name a key that someone else holds; the proof covers the circle id and the time of the proposal, so it can never be used again. The circle key is never the founder's, a witness's or a Heart member's key.
• Open (new, for items 51 and 52): root relays and the circle key. A root relay does not know which circle key is in office for a circle it is not configured for. It therefore stores a circle record with a known circle id and the right genesis digest from any key that names itself in the record; readers take the key from the newest circle head and from the ledger. Open: should a root relay accept a circle record for such a pinned circle id only from the key its newest head names? In the write rules as prepared, a root relay accepts a circle head only for circles it is configured for; whether it should accept the head of every pinned circle is open as well.
• Circle settings: proposals (for item 57). Proposal: the bounds of every setting (the table is in the document "Running a circle"); the Heart changes the whole set at once, k Heart members; the notice lasts at least the notice of a change (72 hours by default) and at least as long as the period being changed was, so a stolen key cannot skip the warning; a new value applies from the first block after the notice ends, never retroactively; during the notice apps sign with the stricter value; across circles each circle applies its own values to its own side. The open question whether the 72-hour notice of changes to witnesses, relays, recovery and the circle key should follow the world rules record is answered: it is one circle setting, the notice of a change (item 57). The question who holds the keys of the world record is dropped.

Other questions

• Proposal (question 10, waiting for the owner's yes): 38888 as a directory, not a dependency. 38888 stays the starting directory, as the project owner decided, but no circle depends on it to work: the link and QR code carry the circle id, the genesis digest and the addresses of its relays; anyone may copy the signed directory to other relays; when reads become too many, the Lana authority adds root relays. This keeps the owner's decision but takes away its role as the only source.
• Proposal (question 13, waiting for the owner's yes): circle size. At most 100,000 members for now; the limit rises when measurements show it works.
• Proposal (question 14, waiting for the owner's yes): relay owners at the start. Decision 2 says at least four relays with at least three owners. Proposal: while a circle is borrowed, three relays of at least two owners are enough (the box relay and the Lana relays); this is a temporary departure from decision 2, so it is for the project owner to approve; at least three owners at the latest when the circle gets four witnesses. I count the four Lana relays as one owner until the project owner says otherwise. it is open whether they really are one owner. Tension: until the Lana relay owner adds the write rules, only the box relay counts, so under item 5 no payment could ever count, and the circle would depend on one outside owner. Decide: (a) the circle books nothing until then; (b) until then the Lana relays count as copies with the public label "copies without protection against deletion"; (c) until then the circle finds two more relays with the same rules at other owners.
• Proposal (question 15, waiting for the owner's yes): who pays for the relays. Every circle through a project (formerly: from Common Good by an order, which no longer exists); sister circles for each other.
• Proposal (question 16, waiting for the owner's yes): profiles and member homes at millions of members. While a circle is hosted, on the Lana relays; later on circle relays and index relays.
• Proposal (question 17, waiting for the owner's yes): does a payment wait for every relay. It counts at three; sending to the others continues; the app always shows the real number. This changes the rule of 14 September.
• Proposal (question 18, waiting for the owner's yes): the letter to the Lana relay owner. A new letter instead of the old one (formerly proposal P6): please accept the new kinds of records under rules we provide as ready code; no deletion of ledger records; the first-seen rule for every circle id (this part is decided, item 52); every founder's first found act kept and a second circle of the same founder refused (item 64); member homes never deleted (proposal, item 65); BSA records kept out of our sync tool; an exception to the connection limit for the circle server; limited space for hosted circles; who runs which relay; whether they are ready to hold public ledgers with personal data. The request to confirm that the relays find records quickly by their tags is dropped: we measured on 16 October that they do. That the space for hosted circles is limited, the project owner decided (item 13); the size is a proposal: 1 GB or one year per circle, whichever comes first. When the Lana relays count as copies depends on this letter (the tension under question 14). The letter is sent only after the project owner's "yes".
• Proposal (question 19, waiting for the owner's yes): old records on fast relays. A fast relay may remove an old record only once it is proven to be kept on at least three archive relays of different owners; box relays never remove anything. Not needed in the first years.
• Proposal (question 20, waiting for the owner's yes): definitions. Every circle writes into its ledger which version of the definitions it runs on. (There is no world rules record any more, item 57; the circle settings are in the ledger's state at every block.)
• Proposal (question 23, waiting for the owner's yes): witness votes. A daily summary of each witness's votes is public; a single vote as evidence (a vote that is not in a block is not published by itself: a small exception to principle 1).
• Question 12 (a deposit limit per signature) is dropped, because there are no deposits (item 37).
• Proposal (question 24, waiting for the owner's yes): project images (formerly order images). On three independent file servers; on the relays their fingerprint and address (a relay record may be at most 128 KB). This is a departure from principle 2 "everything on the relays"; so it is the project owner's.
• P1 Moving (replaced by decisions E-8 and E-9, items 64 and 65): moving is possible only with a reference, which is issued by itself once the member has settled. Said plainly: in the current app almost every active member is below zero because they gave; that is by design. Such a member gets no reference until the debt is settled (by them or by someone else), so almost nobody can move without settling first [Consequence of E-9]. Whether that is right is for the project owner to decide.
• P2 Where the circle key lives (stays a proposal): the app in the creator's browser and a paper copy; the server holds only the node key. What the key signs is the proposal above (the circle key is only a stamp on the mirror). A stolen or lost key is replaced by the Circle Heart (item 51).
• P5 Sales limit (stays an option): like a shop that lets a new customer run a tab only up to some amount. With a public ledger checked by witnesses it loses most of its reason. Proposal: none for now; the list of circles a circle does not sell to stays.
• P7 The "yes" for publishing (stays a proposal): one "yes" per version of the definitions and one "yes" to switch on each kind of record, not one per record.
• Test server: most numbers in this document are estimates. Proposal: a separate test server with the same relay as the Lana relays; on it we measure write speed, whether a relay really keeps what it confirms, and what it does with a deleted record. Nothing is sent to the Lana relays for it. waiting for the project owner's "yes".