PHEUN: A Peer‑to‑PeerAnchorStream Mesh Network

1Introduction

The internet a person uses today is not one network. It is a stack of private services, each of which can say no. A certificate authority decides your name is real. A cloud decides your service stays reachable. A platform decides your speech exists. A registrar decides you own a word. A store decides your software may run. None of it is conspiracy — it is the predictable shape of any system where the cheapest way to work at scale is to put one party in the middle.

Removing that party is not a matter of building a nicer one. It requires that four problems be solved at the same time, because solving one alone recreates the others:

1. Identity with no issuer — nobody who can grant you a name, and therefore nobody who can take it.
2. Publication with no host — no server whose removal removes the content.
3. Storage with no provider — payloads of real size, held by the network, with nobody paying rent to an owner.
4. Governance with no administrator — rules that change, decided by the people they bind.

A single global chain solves the first two and fails the last two. Total ordering caps writes far below the rate of ordinary human conversation, and real payloads get priced out or pushed off-chain to exactly the intermediaries the design meant to remove.

So we removed the total order. A ledger does not need one sequence to be consistent. It needs every honest participant, given the same inputs, to reach the same conclusion about where a record belongs and whether it is genuine. Make placement a function of the record's own bytes and validity a proof the record carries with it, and two nodes that have never exchanged a packet agree about a record on sight.

That substrate is the AnchorStream, and the rest of this paper is what it is, how it works, and what a civilisation can build on it.

2What an AnchorStream Is

An AnchorStream is a permanent, public, unordered ledger of fixed-size records, sharded across the whole population that reads it.

Every entry has two parts, and keeping them apart is the central design decision of the system.

Part one — the anchor. Exactly 420 bytes. Public, permanent, immutable from the moment it is born. It is not the content: it is a byte-addressed record of metadata about the content — who signed it, when, what kind of thing it is, what it replies to, what document it belongs to, what language it is in, where in the world it is about, ten tags describing it, and a cryptographic commitment to the content itself.

Part two — the payload. Anything from a few bytes of text to ten gigabytes of film. Sealed with authenticated encryption before it leaves the author's machine, cut into fragments, and scattered across the peers nearest to it in an address space.

The scattering is a duty, not the only way a payload is held, and the difference matters enough to state here rather than bury in §10. A peer the address space assigned a fragment to holds exactly one sealed piece and cannot read any of it — it has ciphertext and no anchor. But a citizen who pinned the payload, or who simply watched it and still has it cached, holds every fragment and can read all of it, because they hold the anchor too. Complete copies are not a leak in the design; they are the design. They are what makes a popular film fast, and the network keeps an index of who has one precisely so readers can find them.

Which is exactly why the scattered floor exists. Popular content is carried by the people who wanted it. Unpopular content has nobody who wanted it — and that is the case the floor and the healing (§10) are built for: a payload nobody pinned and nobody kept is still held, still findable, and still repaired, by peers who never chose it and cannot read it.

The anchor addresses the payload by holding the hash of the payload together with its manifest, and that hash is simultaneously the anchor's primary key, its routing address, and the proof that the bytes you eventually reassemble are the bytes the author signed. Change one byte of the content and the hash changes, the commitment breaks, and the reader rejects it before a single byte of plaintext exists.

Three things secure the AnchorStream, and they do different jobs.

Math decides where. A record's bucket is a pure function of its own fields. There is no allocator, no coordinator, no negotiation about who stores what — every node computes the same answer independently, which is why placement costs nothing and cannot be gamed.

Encryption decides who can read and who can forge. Payloads are sealed with AES-256-GCM under a key derived from the anchor. Anchors are signed with ML-DSA-65, a post-quantum signature, and the signature covers all 420 bytes. Peer sessions are ML-KEM-1024. Everything is hashed with BLAKE3. These are not "good enough for now" choices: a permanent public ledger is being recorded by adversaries today and decrypted whenever that becomes possible, so classical primitives were never an option.

Determinism decides whether we agree. Two nodes walking the same bucket with the same inputs observe the same byte order, compute the same digests, and reach the same verdict. Consensus is not a protocol that runs and can stall — it is arithmetic that holds.

Not a blockchain. There is no single linked chain of blocks, no miners, no stake, no block interval, and no global sequence anything competes for. Two anchors created on opposite sides of the world in the same millisecond are placed independently and neither is aware of the other, because they were never contending for the same resource.

3The 420-Byte Anchor

Every action on the network — a post, a comment, a vote, a course, a film, a published site, an offer of work — is the same record. Forty-one fields, at frozen byte positions, in eight blocks.

Read that table again as what it is: a catalogue card. Every anchor arrives pre-classified — by who, when, what kind, what language, what place, what maturity rating, what document, what parent, and ten tags of the author's choosing. Nothing needs to be inferred later by a machine reading the content, because the author declared it at birth and signed the declaration.

The signature covers all 420 bytes. Not just the content hash — the title, the tags, the timestamp, the category, the place, everything, with only the signature's own fingerprint excluded because it cannot sign itself. A relaying peer cannot rewrite your title or retag your post; a single flipped byte invalidates the signature and the anchor dies at the next hop.

Fixed size is a feature, not a constraint. It makes storage cost predictable per record instead of per payload. It makes the wire format frameless. It makes a bucket's contents a flat array of equal-length rows. And — the next section — it makes search fast in a way that variable-length records simply cannot be.

4Why Search Is Instant, at Any Size

This is the property most easily missed, and it is the one that makes the platform feel like software rather than like a distributed system.

Because every field sits at a frozen byte offset, a field is extracted with a plain byte-range read: the Guide ID is bytes 100 to 115, always, in every anchor ever written. No parsing. No schema lookup. No deserialisation.

That means the database can build an ordinary B-tree index directly on the byte range. Thirty-three of them exist, one per queryable field, each defined as a substring expression over the raw 420-byte column:

CREATE INDEX guide_idx ON anchor_stream
  ((encode(substring(anchor_420b from 101 for 16), 'hex')));

The consequences compound:

• A node answers in logarithmic time. Filtering, counting and sorting a bucket are index seeks, not scans. A node holding a hundred million anchors answers a filtered question in about as many steps as one holding a hundred thousand.
• A node only holds one ten-thousandth of the world. Its index is over its slice, never the whole stream.
• So the network divides the work rather than multiplying it. A global search fans one small announce out across the buckets; every node answers for its own slice in logarithmic time on that slice; the results merge. Adding citizens adds index capacity in exactly the proportion it adds anchors.

There is no crawler, no inverted index to rebuild, no ranking service, no search company. The index is the routing law plus the byte layout. That is the whole apparatus, and it is why a question addressed to the entire network comes back in seconds instead of requiring somebody to have crawled the network in advance.

5Ten Thousand Buckets and the Dispatcher

The ledger is partitioned into ten thousand Sacred Anchor Index buckets. Every anchor belongs to exactly one, and which one is a pure function of the anchor's own fields.

Which field decides depends on what the anchor is, and this dispatch is where the cheap queries come from:

The pay-off is concrete. Opening a governed document is one query to one bucket, and it returns the opener, every amendment ever proposed, and every ratification. Loading a thread is one query to the parent's bucket. Counting a viral vote is a fan-out — because the ballots were deliberately scattered so no single node carries the load.

Only the genesis is placed by identity, and that is deliberate. Everything else a person writes scatters by its own hash. Routing one person's entire output to one bucket would put the cost of a popular author on whichever nodes happened to hold it, and would make that bucket a convenient place to stand and watch one person. One predictable record is what verification needs; more than that is a liability.

Two consequences fall out:

There is no sequencing bottleneck. Nothing competes for a position. Throughput is bounded by the network's aggregate bandwidth, and that bound grows with participation instead of being fixed by protocol. At a billion citizens the network carries on the order of a hundred thousand new anchors per second; any one node sees the five to twenty per second that land in its own bucket.

Nobody stores everything. You hold one bucket — one ten-thousandth of the world's history — plus your own complete personal chain. That is what makes a full node affordable on ordinary hardware at planetary scale, and it is the difference between a design a billion people can run and one that consolidates into data centres because storing everything eventually requires one.

Correctness needs enough nodes per bucket: the target is at least five independent community holders each, which at ten thousand buckets is fifty thousand relationships — comfortably inside a per-node budget of about sixty-six thousand connections. Coverage is measured continuously and repaired by targeted discovery whenever a bucket drops below its floor.

6HOPE — the Protocol Underneath

Everything above rides HOPE: Hardened Onion Post-quantum Exchange, PHEUN's native peer-to-peer protocol. It is pure UDP. There is no TCP session, no HTTP, no API gateway, no broker, and no server anywhere in the node-to-node path. A browser talks to its own node over a local connection; nodes talk to each other only over HOPE.

The name is the specification in four letters:

• Hardened — fail-closed cryptography, per-peer token-bucket egress limits, and a network fingerprint checked before any authenticated traffic passes. A node running different constants is dropped at the handshake rather than quietly corrupting the bucket it shares with you.
• Onion — a three-hop onion overlay, with fail-closed ML-KEM-1024 session keys, wrapping the traffic where correlation matters most: direct messages and call setup.
• Post-quantum — ML-DSA-65 signatures, ML-KEM-1024 key encapsulation, AES-256-GCM sealing, BLAKE3 hashing, throughout the mesh, with no classical fallback path anywhere.
• Exchange — a mesh of peers, each budgeted at roughly sixty-six thousand connections, of which fifty thousand fund the five-per-bucket coverage invariant and the remainder absorb bursts and multi-coverage peers.

UDP is the right substrate because the atomic unit is a 420-byte record and most exchanges are one datagram. Sessions rekey on a schedule so compromising a current key reveals no prior epoch. Packets above the safe path size are chunked at the application layer and reassembled before processing, with the path MTU discovered by probe and confirmed only by acknowledgement.

One decision deserves naming because it is unusual: a node learns its own public address from the mesh, and nowhere else. There is no third-party address service and none may ever be added. A peer that received your packet necessarily observed your post-NAT source address, so it reports it back — and two distinct verified peers must agree before you adopt it, because a single lying peer could otherwise make you advertise a black hole or somebody else's address. Nodes behind carrier NAT reach the network through a rotating relay overlay, where a client hides behind a small set of relay hosts and rotates slots when one is overloaded.

7Your AnchorChain

Every citizen owns exactly one chain, and it is the spine of their identity.

The first anchor you ever write is your genesis. It binds your Guide ID to your public key, and it is the root every later claim about you is measured against. Every anchor after it carries two things: a 32-byte pointer to the previous anchor you signed, and a monotonic counter — genesis is 1, then 2, then 3, forever, with no gaps.

That is the Personal AnchorChain, and it is walked. At every login your node walks the chain from your local tip upward, pulling anchors from the mesh and persisting each one, so your node holds its own complete history across all ten thousand buckets even though it serves only one of them to others.

The counter is what makes the chain provable rather than merely present. Because it is monotonic from one with no gaps, a reader checks 1..max against the anchors themselves and knows exactly which positions are missing — it does not have to trust anybody's claim about how many anchors you have written. A count is a peer's assertion and can be wrong in both directions. The chain proves itself.

Anyone can walk anyone's chain. Hand somebody your sixteen-character Guide ID and they can retrieve everything you have ever published, in order, from the mesh — your whole public history as one readable sequence. There is no profile page to visit and there never will be, because the chain is the profile. It cannot be curated after the fact, cannot be partially deleted, and cannot be shown to one reader and hidden from another.

The chain is also the fork detector. Because your key regenerates from your nine inputs on any machine, two devices signed in at once can each extend the same tip before either learns of the other, producing two anchors at the same position under the same key. No protocol can prevent that — both signatures are genuine. But every node walking the chain sees the conflict and reaches the same verdict independently, and the identity locks. A locked identity is dead by design; the remedy is a new one, and the old history stays readable forever. Single-device discipline is a real requirement, not a suggestion.

8Birth — the Anchor Proves Itself

An anchor entering the ledger must be proven genuine. The question is who does the proving, and the obvious answer fails at scale in a way worth stating precisely.

Elect a committee to attest, and the attestation is only useful to a receiver who can verify the committee's key. At planetary scale a node knows a vanishing fraction of the network, so an arbitrary receiver almost never holds an arbitrary attester's key. Propagation dies roughly one hop past the committee's own neighbours. The attestation authenticates the committee, which is not the thing in question.

So the anchor authenticates itself. Every propagation carries the new anchor, the author's genesis, the author's previous anchor, the full public key, and the signature — about six and a half kilobytes, of which the signature alone is 3,309 bytes. That is not overhead; it is the product. Every receiver re-runs the entire proof with nothing it does not already hold:

• the signature verifies over the whole anchor under the carried key;
• the key hashes to the fingerprint committed inside the anchor;
• the anchor's routing bucket, recomputed, matches the one it claims;
• its timestamp falls inside a bounded window of the receiver's clock;
• the new anchor, the genesis and the previous anchor all carry the same key fingerprint — one keypair across the whole chain;
• the chain pointer equals the previous anchor's hash, and the counter is exactly one greater.

That proves a well-formed chain under a single keypair. It does not yet prove that keypair owns the identity — and here the design earns its security. The receiver additionally compares the carried genesis, byte for byte, against the canonical genesis the network holds at that identity's own bucket. Since a Guide ID's keypair is not derivable by a third party, ownership is first claim, and this single comparison is what binds an anchor to its rightful author. An impostor's fabricated genesis has a different hash, and the anchor is refused.

That canonical lookup is itself corroborated: three independent holders are queried in parallel and only bytes two of them return identically are accepted, so one lying holder cannot install a fabricated record and erase somebody's real history. Holders who answer but disagree fail closed and the check retries. The one relaxation is stated rather than buried — if exactly one holder answers at all, its answer is taken, because refusing to proceed on an unanswerable question would stall the network precisely when it is thinnest.

Propagation is offer-based, not broadcast. A holder announces a 34-byte hash to peers covering the relevant bucket; a peer that lacks it asks; only then does the six-and-a-half-kilobyte proof move. Announcements deduplicate by hash, so the cascade converges and never loops.

Verified is not published. The author waits for storage receipts from two independent holders before considering the anchor born and releasing its payload fragments — because an anchor nobody stored would be unfindable by any future query, and the fragments already scattered would have no anchor to address them. If the receipts do not arrive, the mint fails closed and retries. The network never half-publishes.

9Dual-Witness Sync — and the Right to Post

Self-verification settles what may enter. A second, entirely separate mechanism settles whether two nodes holding the same bucket actually agree — after a restart, a partition, or a cold start.

Anchors in a bucket are grouped into fixed sixty-second time windows. Each window gets a digest; the digests form a sixteen-way tree seven levels deep — 268 million windows, about five hundred years of capacity — and the tree has a root.

Two nodes compare roots. Match, and they are byte-identical for that bucket, in one round trip, regardless of how much history the bucket holds. Differ, and they descend the tree and exchange only the windows that actually diverge. Each window digest commits the full 420 bytes of every anchor in canonical order, never just their identifiers — a digest over identifiers alone would let a peer serve tampered bytes under honest names.

The comparison is over settled history only. Windows older than ten minutes have had time to reach everywhere and are frozen, their digests cached forever; the recent edge is handled by ordinary propagation. Without that split, two perfectly synchronised nodes would never match, because the newest anchors are always in flight somewhere.

Two witnesses, chosen with deliberate randomness. A node that finds itself behind does not take the missing window from whoever offers it. It shuffles the peers covering that bucket — a real Fisher-Yates shuffle, every round — takes a handful as witnesses, and commits nothing until two of them return byte-identical content. The shuffle is load-bearing, and for a reason that is easy to miss: with a fixed order, a contested pair — one liar and one honest holder — would be re-sampled every single cycle, the honest pair would never come up, and one liar could stall a perfectly resolvable bucket forever. Rotating the sample means the liar has to be drawn again and again to keep the stall going, so a contested window converges instead of hanging. A node that can reach only one holder waits, and says so, rather than single-trusting.

There is exactly one exception, pinned to an identity rather than earned by circumstance: a single named launch node may accept one witness, and only while fewer than two other holders exist, so the second node on an empty network has somewhere to sync from. Everyone else needs two, at every stage of the network's life.

The gate: sync your bucket before you may post

Here is where the two systems meet, and it is the quiet centre of PHEUN's anti-abuse design.

A node may not mint an anchor until its own bucket is fully synced and corroborated — LIVE. Not partially. Not optimistically. Your node must have pulled its entire slice of world history, compared roots with witnesses, and been found missing nothing that its witnesses corroborate. Only then does the posting route open.

The second half of the gate cross-references identity: the genesis in your own chain must equal, byte for byte, the genesis the network corroborated into your bucket. An impostor's fabricated genesis can never equal the corroborated one, and a node that tried to write its own into its served slice would read as ahead of its witnesses, be quarantined, never go LIVE, and fail the first guard.

Why this is the right anti-abuse primitive. It cannot be faked, because the only way through is to actually do the work — download the slice, hold it, prove it matches. It costs disk and bandwidth rather than a puzzle, so it is not a lottery a fast machine wins. It requires no captcha, no phone number, no identity document, no payment, and no administrator's approval. And it scales the right way: the cost of pretending to be a thousand citizens is a thousand synced buckets, permanently, and the ledger only grows.

Your node earns the right to speak by carrying its share of everyone else's history. That is the entire social contract of the network, expressed as a gate.

10The PayloadWeave — Storage That Heals Itself

The anchor is 420 bytes. The payload can be ten gigabytes. Here is how the network holds it without anybody hosting it.

Splitting: the square-root law

Fragment count trades two costs against each other. Placement cost grows with the number of fragments — each one is a peer to find and a session to establish. Per-holder cost grows with fragment size, which shrinks as the count rises. The two balance where the count is the square root of the size:

That is the geometric mean of the costs it sits between, and it is why neither term ever runs away. A ten-gigabyte film becomes about 2,560 fragments of four megabytes each — not the hundreds of thousands a fixed small chunk size would demand, and not a handful of enormous ones. Small payloads floor at two fragments, so even a short text post is split and sealed exactly like a film.

Placing: rank, not hash

The peers closest to the anchor's address in a 256-bit space form its neighbourhood, and each is assigned exactly one fragment index by its rank in that ordering — the r-th closest peer holds index r mod F.

This is coverage-complete by construction. The F closest peers take the F distinct indexes one each; every subsequent group of F does the same. No index can be orphaned while any peer remains. An independent per-peer hash could hand the same index to everyone and strand another; rank cannot.

The result is the property that makes planetary storage possible: a holder keeps about one fragment per payload, no matter how big the payload is. A phone can help store a film it will never watch.

Three tiers, and only one of them is durability

The third exclusion is the honest one. Cached copies raise serving capacity enormously — a popular film is served by everyone who watched it — but counting them in a durability figure would inflate it with storage that may be gone tomorrow. So they are not counted.

Healing: the floor is maintained, not merely placed

An author scatters ten copies of each index and then stops paying. From that moment the network takes over.

Every holder periodically counts, via a network search rather than a local guess, how many other holders its index has. Whenever the count is below thirty-two, it pushes another copy to a willing peer. The count must come from the network because no node knows the network — a node's own neighbours are a biased sample of the address space, and a holder reasoning from them alone would conclude every fragment is dying and replicate forever without ever reaching a real holder.

The check relaxes as an index proves stable: first after an hour, then on a golden-ratio backoff out to weekly, and monthly for content nobody is touching.

So the resting state of a payload is ten to thirty-two live copies of every index, restored whenever churn takes one away. Durability here is a maintained level, not a decay curve. A holder that disappears is replaced. Content nobody pins and nobody watches sits at exactly the floor and stays there — that is the immortality guarantee, and it is unconditional, because the overwhelming majority of anchors are never fetched again after publication and their survival rests entirely on a floor that repairs itself.

The arithmetic, including the bad case

Healing absorbs attrition, so the interesting question is the one it cannot reach: a large fraction of the network unreachable at the same moment, before anything can be re-pushed. With R holders per index and a the chance an arbitrary one is reachable, an index survives unless every holder is absent, and the payload reconstructs only if every index survives:

That exponent is a coupon-collector penalty, and it is why file size governs durability. For a ten-gigabyte payload at the maintained floor:

That last row is a mass outage or partition, not an operating point, and it is printed because a storage claim that quotes only its best case is not a claim. It is also the one case healing cannot help with, because healing needs somewhere to push to. The lever is pinning: because R sits inside an exponent, a handful of people who care about a film move it from 8 % to 92 %. Content is protected by the fact that somebody cares about it — no payment, no contract, no storage market.

Finding the bytes

A reader holding an anchor knows the payload's address but not who holds its fragments, and contacting thousands of strangers would cost more than the download. So the query travels instead of the reader: a small request is forwarded through connections that already exist, each node doing constant work — reject duplicates, check a membership filter, reply if it holds anything needed, forward the rest closer. Per-node load is constant in network size.

Nearest-first alone fails, instructively: every participant offers nearly the same low ranks, the search collapses into the innermost sliver of the holder band, and a large payload comes back one third complete — which is a failure, not a degraded success, because the manifest and signature are split across fragments and one missing index makes the stream unparseable. The correction is that a node already inside the neighbourhood also forwards outward, past its own distance, so the wavefront sweeps the whole band instead of converging on its centre.

With that, every payload from a kilobyte to the ten-gigabyte maximum is located completely, in a single round, at ten million, a hundred million and a billion nodes alike — from canonical placement alone, with no pinner, no cache and no directory. About 4,400 nodes are asked for the largest payload at ten million participants and about 84,000 at a billion. The payload is found in under a second; the download takes as long as the bytes take.

11Finding Things — No Algorithm, No Index, No Owner

There is no recommender on PHEUN. No engagement ranking, no boosted post, no promoted account, no editor, no moderator, no content team. Not as an omission — there is no party who would benefit from one, because there is no advertising plane and nobody is paid for your attention.

What replaces it is three mechanisms, each of which you drive.

Subscription. You subscribe to what you care about and matching anchors arrive as they are born, typically within one to two minutes. Five kinds cover the surface: an identity, so you follow everything a person ever publishes; a document, so you follow every proposal and vote against a governed text; a hashtag, which doubles as a mention so you learn when someone names you; a parent anchor, so you follow the replies to one thing; and a thread origin, so you follow a conversation even where it branches.

Doing that naïvely would not scale — registering every interest with every peer covering every bucket would mean millions of registrations per person. Instead your node elects one peer per bucket and hands it a single compact filter covering every subscription at once. Adding interests enlarges the filter; it does not multiply the contracts.

Search. For everything older than a subscription, a query fans out across the buckets and merges the replies — using the byte-offset indexes of §4, so each node answers for its slice in logarithmic time. Filters narrow in both directions: every axis has an include-only form and an exclude form, over who signed it, category, type, tags, language, place, audience rating, and how long the media runs. They compose, with exclusion as a veto — so show me everything tagged Art, in Spanish, excluding anything tagged Violence is one query, and no operator's permission is involved. A question about the entire world resolves within a minute.

The permanent link. Every anchor has a citation address that never changes:

pheun://sai<bucket>/<guideId>/<pacCount>

A bucket, a citizen, and a position in that citizen's chain. Read it aloud and it means the fourth thing this person ever wrote. It contains no host, no domain, no server, no session token and no expiry, and because chains are append-only and anchors are immutable it resolves to the same bytes forever. There are no dead links on PHEUN, and nothing to renew.

That is what turns reading into building. Paste those links into your writing and you have citations that outlive you. Collect the anchors you have found into vault collections — your own libraries, permanently pinned, which is simultaneously an act of curation and an act of preservation, because pinning is exactly the lever that raises a payload's durability. Publish a site — a static, signed, single-page artefact assembled from a fixed registry of about thirty components, distributed as an ordinary payload with no registrar and no host — and put your library on it.

A researcher who cites a hundred anchors, pins them, and publishes a site indexing them has done something no web page can do: made a bibliography that cannot rot, and made the sources more durable by citing them.

12Private Channels — the One Deliberate Exception

Direct messages and voice and video calls are not anchors and never enter the ledger.

This is a considered exception, not an oversight. An anchor is public and permanent by construction, so minting one per message would put an undeletable, publicly visible record of who spoke to whom and when into a ledger with no delete operation — a metadata disclosure far worse than anything payload encryption prevents. What a citizen publishes is permanent; what they say privately is not.

Private traffic is end-to-end encrypted peer-to-peer and held only in each participant's own store. Message content and destination ride the three-hop onion, so no single relay learns both ends. Call media never enters the mesh at all — once setup completes it flows directly between the two participants.

Reachability and contact are different questions, and contact is gated. Your Guide ID appears in everything you publish, which is right for authorship and wrong as a phone number — it would mean anyone who reads a post can ring your node forever. So messages and calls require proof of a contact code you issue.

Three properties make the code work where a block-list would not:

• It is checked on every inbound attempt, never only the first. There is no "known contact" short-circuit. Every message and every call is admitted by proving the current code, or it is refused.
• So the control is the code, not a per-person list — and it is deliberately blunt. Changing your code cuts off everyone still holding the old one, friends included. There is no way to revoke one individual while leaving the rest admitted, and that is the honest description: a per-person block would mean "admitted once, admitted forever" for everyone else, which leaves a citizen who published their code with no remedy but removing spammers one at a time, forever, by hand. Bluntness is what makes the control work.
• The gate sits before connection negotiation, not at the interface. Negotiating a call discloses your address to whoever you negotiate with, so refusing after it rings is already too late.

Your Guide ID is the permanent name; the contact code is the number. Cutting everyone off would be unusable if it were permanent, so it is not: a new code reaches the people you keep automatically, one at a time, riding your next message to each of them sealed inside the encrypted envelope. You do not redistribute anything by hand. There is deliberately no bulk push, because broadcasting a new code to everyone you have ever spoken to would hand it straight back to every spammer you changed it to escape — the broadcast is the leak.

So the cost of rotating is not lost contacts; it is a short quiet period with the people you have not written to yet. A code buys revocability, never secrecy — one posted in public is readable forever, and the remedy is always the same: change it, and let your own messages carry the new one.

13The Digital Constitution — Building a Civilisation Line by Line

Rules that bind people should be changed by those people and by nobody else. Since there is no administrator, governance cannot be an override. It has to be ordinary use of the ledger — and it is.

PHEUN ships two governed documents: the Digital Constitution, which is the rule layer for conduct on the network, and the Digital Curriculum, which is a body of shared knowledge built the same way. They use identical machinery, because the machinery is the point: a document is a platform institution, drawn from a closed one-byte registry compiled into every node, so every node resolves it to the same document without asking anyone. There is no free-form document name, therefore no race and nothing to squat.

A document is a sequence of numbered lines, and each line carries a version.

• Opening the document is an anchor.
• Proposing a new line, or a new version of an existing line, is an anchor.
• Every ballot is an anchor.
• Recording the outcome is an anchor.

So the document is not stored anywhere in particular. It is derived — identically, by every node that reads the same anchors — and it cannot be edited out from under anyone, because amendment is append-only like everything else. The line-and-version model means you can read not just the current text but every version any line ever had and the vote that ratified each one. The document carries its own complete legislative history, permanently, with no archive to maintain.

Two gates decide an amendment, and the second exists because the first is insufficient in a way that is easy to miss. A three-quarters supermajority governs the ratio of approval. But a ratio alone is satisfied by a single unopposed vote — one participant, no opposition, unanimous, one hundred percent. So a participation quorum also applies, derived from the median turnout of recent successful amendments, and a proposal must attract engagement comparable to what the document's own history established.

The median is deliberate. A maximum would ratchet up permanently after one unusually well-attended vote and freeze the document forever — nothing could pass, and because nothing passed the bar could never come down. The quorum is document-wide rather than per-line, so a new line must clear the standard the document itself set rather than ducking it by opening a fresh line. And a floor applies before any history exists, because otherwise the first amendment passes on one vote and sets a near-zero bar for everything after it.

A new line may be opened only once the previous one has been ratified, so nobody can stack competing unratified lines and pollute the document with text that never settles.

This is what "build a digital civilisation together" actually means here. Not a slogan — a document, written by its citizens one ratified line at a time, carrying its own history, enforced socially rather than technically, and owned by nobody.

14A Public Square, Not a Mask

PHEUN is not an anonymity network, and this paper will not imply otherwise.

It is a public library and a town square. Your Guide ID appears in every anchor you write. Your entire chain is walkable by anyone holding those sixteen characters. Anchors are readable by everyone, forever, and the key that opens a payload derives from its public anchor — so anyone with the anchor can read the content. Publication means publication.

Your network address is visible to the peers you serve. It has to be: establishing an encrypted session, selecting holders, and routing fragments all require knowing which machine is on the other end. And because a bucket assignment is a public function of a public identity, anyone may deliberately join your bucket to become one of those peers. The honest statement of the goal is: finding a specific citizen costs real participation, and being found is survivable. It is not, and cannot be, that your address stays secret — a node that serves fragments and receives propagation has to answer strangers.

This is a design choice, not a limitation we are apologising for, and the whole architecture rests on it:

• Provenance. A cited anchor names its author and its position in that author's chain. You can walk back and read everything else they wrote. A claim on PHEUN comes with the whole record of the person making it.
• Accountability without moderators. There is no report button and no takedown, so the only thing standing between the network and abuse is that everything is attributable and permanent. Anonymity plus permanence plus no moderation would be indefensible. Attribution is what makes the absence of a moderator survivable.
• A library needs shelves, not disguises. The value of the AnchorStream as a civilisational record — citations that resolve forever, a curriculum with its full legislative history, a chain you can read end to end — depends entirely on records being attributable and permanent.

What is protected is scoped and stated exactly. What you say privately stays private — messages and calls are never anchors, are end-to-end encrypted, and ride the onion. Who may contact you is gated by a code you control and can rotate. Payload content is sealed in transit and at rest, so peers storing your fragments hold ciphertext they cannot read without the anchor. And a citizen who wants a separate public face creates a separate Guide ID — which is pseudonymity by choice, with a chain of its own, and not the same thing as anonymity.

You are a citizen with a name, in public, on the record. That is the deal, and it is the deal on purpose.

15What We Do Not Claim

Identity loss is final. Forget your inputs and the identity is gone — permanently, with no recovery authority anywhere. Published history stays readable forever but becomes inert. That is the direct cost of having nobody who can reset it for you, which is the same property that means nobody can take it from you.

A Guide ID is a claimed name, and the handle race is real. Your Guide ID is one of the nine inputs — a sixteen-character name you choose — and it is claimed first-come. A desirable name can be taken before you arrive, exactly as in DNS. What is absent is the market around it: no registrar, no fee, no renewal, no expiry, no arbitration, no seizure by anyone including us — and no resale, structurally, because the name is a seed input, so selling it would mean handing over all nine inputs and the entire identity with every signature it has ever made. Squatting is possible; it has no exit.

Two devices can fork a chain. The same inputs regenerate the same key anywhere, so a person signed in twice can extend their chain twice before either device learns of the other. Both signatures are genuine and no protocol can prevent it. The network detects it deterministically and locks the identity; the remedy is a new one.

Sybil resistance is economic, not cryptographic. The bucket-sync gate costs real disk and bandwidth, and the ledger only grows — but that curve is weakest exactly when the network is youngest. There is no proof-of-work, no stake, and no identity check.

Governance is permissionless, and that cuts both ways. Early on, when storage cost is still small, a determined party running many nodes can influence outcomes. The quorum makes that expensive rather than impossible.

Availability is not guaranteed for unpopular large payloads. §10 prints the exact figure rather than a reassurance: a very large payload nobody pins, under severe churn, can become unrecoverable.

Permanence applies to mistakes. There is no delete. An anchor published in error is published forever, and there is nobody to appeal to — the same property that prevents censorship, seen from the other side.

Participation has a floor. A full node needs a real machine, a persistent connection, roughly five to ten megabits per second, and disk that grows. That is deliberate — it is what makes identities costly — but PHEUN is not reachable from a borrowed device, and it is not weightless the way an account on somebody else's computer is.

"Post-quantum" is a claim about the mesh, and it is scoped. Everything crossing the network between nodes uses the standardised post-quantum selections, with no classical fallback path. Three surfaces sit outside that boundary, and they are named rather than glossed:

• Live call media. It rides the browser's own encrypted media transport, whose handshake is still classical, and a web application gets no say in that. Call signalling is post-quantum; the frames are not yet. Per-frame encryption keyed from the session we already hold is a build item, not a limit of the design.
• Your browser talking to your own node. Ordinary web certificates, because no browser yet trusts a post-quantum one. Under one-person-one-node that is usually a machine talking to itself, and only crosses a wire when you open your node from another device on your own network.
• Push notifications, if you switch them on. The Web Push standard fixes its own cryptography and it is classical throughout. The push service still cannot read the payload, but it is not harvest-proof, and a message notification carries a short preview of the text. Push is off until you enable it.

Recorded traffic on those three paths is what a future quantum computer opens. Messages, anchors, payloads and call signalling are not.

Post-quantum is not invulnerable. The primitives defend against the quantum attack that motivates them. They do not defend a compromised endpoint, a stolen device, or a future cryptanalytic result — which is why the format carries algorithm selectors, so future anchors may use future primitives while every anchor already written stays verifiable under the ones that signed it.

16Conclusion

An AnchorStream is a ledger that does not need a sequence.

Every action is a 420-byte record, catalogued in forty-one fields at frozen byte offsets, signed across all of it, and placed in one of ten thousand buckets by a function of its own contents. The frozen offsets let a database index the bytes directly, so a node answers about its slice in logarithmic time and the network divides the work of a global search instead of multiplying it. The buckets mean nobody stores everything, so a full node fits on ordinary hardware at planetary scale. The dispatcher co-locates what belongs together — a document with its whole history, a conversation with its replies — and scatters what would otherwise concentrate.

The proof rides with the record, so every receiver re-runs it and a forgery dies at every hop. Replication is corroborated by two randomly-drawn witnesses, so a lie held by one machine is contested by an honest one. And the right to write is earned by carrying your share of everyone else's history — the one anti-abuse gate that cannot be faked, because the only way through it is to actually do the work.

Payloads are sealed, split by a square-root law, scattered by rank so no index is ever orphaned, and held at a floor the network maintains rather than lets decay — with the arithmetic printed, worst case included.

On that substrate: a feed nobody ranks, a search that reaches every anchor on Earth and takes instructions in both directions, a citation link that resolves forever, libraries that make what they cite more durable by citing it, private channels that were never in the ledger, and a constitution the citizenry writes one ratified line at a time.

No token. No fee. No mining. No advertisement. No algorithm. No administrator. No kill switch. No delete.

One human, one node, one chain, one slice of a shared history that nobody can rewrite — including us. What the network remembers, it remembers permanently. What it cannot do, it cannot be compelled to do. And every citizen stands in it under their own name, in public, on the record.

References