A protocol for human self-cultivation.

During Phase 1 the founder holds the upgrade key, and most of the protocol stays changeable on purpose. Eighteen functions are welded at deploy — retirement, the grievance channel, free speech, the permanent action log, and the anti-whale and supply floor. Welding means those eighteen refuse replacement and refuse removal: the chain itself turns the transaction down. And here is the part that sentence leaves out, which matters more than the eighteen. The weld is a flag in ordinary contract storage, and an upgrade can carry initialisation code that runs against that storage — so the weld can be cleared, but not in one step: it takes code written for that purpose plus one upgrade call that runs it, every step a public on-chain artefact. (How many transactions that is depends on whether the code already exists, so this page no longer gives a number.) (This page said “one owner transaction” until 2026-09-02. That was false and it understated our own protection: no upgrade operation on its own unwelds anything — replacement and removal are refused by the contract, and there is no unlock.) The honest promise is not that they cannot be changed. It is that nobody can change them without a visible owner transaction on a public chain — the protection is that you would see it, not that it is impossible. It does not freeze the protocol, because new functions can still be added beside them. The identity module and the joiner arithmetic are deliberately not welded, so the joining rules can still be repaired. Everything unwelded is a promise the protocol intends to keep, not one it is structurally bound to — and that is the honest difference. The upgrade key ends at retirement: it transfers, in one transaction, to the successor address named in advance. Be exact about what that is and is not — there is no timelock on it, or on any other founder power: a diamond cut, an ownership transfer and a solvency mint are each one immediate transaction, with no vote, no delay and no second signature. What bounds the key is the welded eighteen, a public chain, and our diligence — and the third of those is a person, not a mechanism. The veto becomes the Council's, exercised at a golden-ratio supermajority of 0.618 — 233 of 377 seats at full size — and the power of the purse transfers the same way; no chamber may spend alone.

The count is eighteen, and that part is settled. A re-derivation on 2026-09-01 produced twenty and was withdrawn on 2026-09-02: the deploy composes eighteen, and two test suites assert exactly that number, so a passing build is the measurement. This page said the figure should be read as “disputed, not measured” between those two dates. That was wrong, and it was wrong in the direction that costs a reader least — it hedged a number that was already checkable. Two things remain true and are worth more than the count. The eighteen cannot be read back off the chain: no function exposes the welded set, so this figure describes the code we deploy, and you cannot verify it the way you can verify a balance. And which functions make up the eighteen is not separately checked — the five groups named above come from the deploy code and are very likely right, but no test asserts them individually, so any five groups totalling eighteen would satisfy every check we have. The claim this figure sits beside never depended on the number: no upgrade operation on its own can unweld anything, at eighteen or at twenty.

The same honesty applies to your tokens, and this is the largest example of it. Every transfer of HMN between two registered people calls into the upgradeable part of the protocol before it completes, and if that call fails the transfer fails. On the diamond live since 2026-09-01 (0xf6b7eec7…4efe; the 2026-08-06 one this paragraph originally described is tombstoned, and the hook was re-checked on the new chain — recordTrade routes to a facet there), two things would do that: removing the called function in an owner transaction, or a wiring mistake that makes it refuse. So whoever holds the upgrade key can halt HMN transfers, or block particular ones, for as long as they hold it. Be precise about what that is and is not: it can stop tokens moving, and it cannot itself move them. This particular lever is censorship, not confiscation: it cannot spend your balance or reassign it to anyone.

There is one separate path that can take tokens, and it is not this one. A fraud conviction, carried through every appeal, can burn part of a convicted person’s balance. It is bounded in three ways worth knowing: it can never take you below the joining grant your cohort minted, the amount is re-clamped to that limit at the moment it executes, and what is taken is re-minted into the Coherence Commons rather than destroyed or paid to an accuser — the community later decides its use. We mention it here because a page that told you your balance could never be touched would be wrong.

We did not add this in order to have it. It is the price of those protections being enforceable at all: the alternative — letting that call fail silently — would have permanently given up any future ability to enforce the wallet cap or to freeze a single account after a fraud finding. Both choices are permanent, because the token contract cannot be upgraded after launch, and there is no third option. The founder ruled on it in August knowing precisely this. It is held by the founder now and by the High Council after the handover, and like every other power here, using it takes a visible transaction on a public chain — the protection is that you would see it.