PHEUN: A Peer‑to‑PeerAnchorStream Mesh Network

1Introduction

The internet a person uses today is not one network. It is a stack of private services, each of which can say no. A certificate authority decides your name is real. A cloud decides your service stays reachable. A platform decides your speech exists. A registrar decides you own a word. A store decides your software may run. None of it is conspiracy — it is the predictable shape of any system where the cheapest way to work at scale is to put one party in the middle.

Removing that party is not a matter of building a nicer one. It requires that four problems be solved at the same time, because solving one alone recreates the others:

1. Identity with no issuer — nobody who can grant you a name, and therefore nobody who can take it.
2. Publication with no host — no server whose removal removes the content.
3. Storage with no provider — payloads of real size, held by the network, with nobody paying rent to an owner.
4. Governance with no administrator — rules that change, decided by the people they bind.

A single global chain solves the first two and fails the last two. Total ordering caps writes far below the rate of ordinary human conversation, and real payloads get priced out or pushed off-chain to exactly the intermediaries the design meant to remove.

So we removed the total order. A ledger does not need one sequence to be consistent. It needs every honest participant, given the same inputs, to reach the same conclusion about where a record belongs and whether it is genuine. Make placement a function of the record's own bytes and validity a proof the record carries with it, and two nodes that have never exchanged a packet agree about a record on sight.

That substrate is the AnchorStream, and the rest of this paper is what it is, how it works, and what a civilisation can build on it.

2What an AnchorStream Is

An AnchorStream is a permanent, public, unordered ledger of fixed-size records, sharded across the whole population that reads it.

Every entry has two parts, and keeping them apart is the central design decision of the system.

Part one — the anchor. Exactly 512 bytes. Public, permanent, immutable from the moment it is born. It is not the content: it is a byte-addressed record of metadata about the content — who signed it, when, what kind of thing it is, what it replies to, what document it belongs to, what language it is in, where in the world it is about, ten tags describing it, and a cryptographic commitment to the content itself.

Part two — the payload. Anything from a few bytes of text to ten gigabytes of film. Sealed with authenticated encryption before it leaves the author's machine, cut into fragments, and scattered across the peers nearest to it in an address space.

The scattering is a duty, not the only way a payload is held, and the difference matters enough to state here rather than bury in §10. A peer the address space assigned a fragment to holds exactly one sealed piece and cannot read any of it — it has ciphertext and no anchor. But a citizen who pinned the payload, or who simply watched it and still has it cached, holds every fragment and can read all of it, because they hold the anchor too. Complete copies are not a leak in the design; they are the design. They are what makes a popular film fast, and the network keeps an index of who has one precisely so readers can find them.

Which is exactly why the scattered floor exists. Popular content is carried by the people who wanted it. Unpopular content has nobody who wanted it — and that is the case the floor and the healing (§10) are built for: a payload nobody pinned and nobody kept is still held, still findable, and still repaired, by peers who never chose it and cannot read it.

The anchor addresses the payload by holding the hash of the payload together with its manifest, and that hash is simultaneously the anchor's primary key, its routing address, and the proof that the bytes you eventually reassemble are the bytes the author signed. Change one byte of the content and the hash changes, the commitment breaks, and the reader rejects it before a single byte of plaintext exists. The hash is taken over its author's identity and chain position too, and the anchor travels with a 32-byte digest of its payload, so every node that receives it can check, without the payload, that the address it carries is its author's own.

Three things secure the AnchorStream, and they do different jobs.

Math decides where. A record's bucket is a pure function of its own fields. There is no allocator, no coordinator, no negotiation about who stores what — every node computes the same answer independently, which is why placement costs nothing and cannot be gamed.

Encryption decides who can read and who can forge. Payloads are sealed with AES-256-GCM under a key derived from the anchor. Anchors are signed with ML-DSA-65, a post-quantum signature, and the signature covers all 512 bytes. Peer sessions are ML-KEM-1024. Everything on the wire is hashed with BLAKE3, and the nine answers behind a Guide ID are stretched with memory-hard Argon2id before they become a key, so each offline guess is expensive. These are not "good enough for now" choices: a permanent public ledger is being recorded by adversaries today and decrypted whenever that becomes possible, so classical primitives were never an option.

Determinism decides whether we agree. Two nodes walking the same bucket with the same inputs observe the same byte order, compute the same digests, and reach the same verdict. Consensus is not a protocol that runs and can stall — it is arithmetic that holds.

Not a blockchain. There is no single linked chain of blocks, no miners, no stake, no block interval, and no global sequence anything competes for. Two anchors created on opposite sides of the world in the same millisecond are placed independently and neither is aware of the other, because they were never contending for the same resource.

A ledger of authorship, not of ownership

This is the idea the rest of the design follows from, so it is worth stating carefully.

A blockchain answers the question who owns this coin now? Ownership is exclusive: if one coin is spent twice, the two spends conflict and something must choose a winner. Global order, mining, finality and fees all exist to make that choice.

An AnchorStream answers a different question: who said this, when, and is it unaltered? Two statements made in the same millisecond are simply both true. The conflict that consensus exists to resolve does not occur.

The precise reason is that every chain has a single writer. A position in a citizen's chain is exclusive, but only the holder of that citizen's key can write it; anyone else's attempt fails verification at every node. The only possible conflict is the owner against themselves — the same key signing two different records at one position from two devices — and the AnchorStream does not pick a winner there either. It voids the identity (§7), which is tolerable because the harm stays with the one who caused it.

Three consequences follow. Because every node checks a record's proof locally, the ledger shards: a node holds one bucket and is fully correct about it. Because there is no scarce ordering to sell, there is nothing to auction, so there are no fees. And each bucket is eventually consistent, deliberately: holders converge on the same bytes, and nothing waits for the whole world to agree.

The places where an AnchorStream does need care are exactly the places where something is exclusive between strangers: who claimed a name first, who opened a document first, and how many people voted. Each gets its own rule — a first-claim, a single opening, a counted quorum — answered where the question lives, never by one sequence of the whole world.

3The 512-Byte Anchor

Every action on the network — an update, a reply, a vote, a course, a film, a published site, an offer of work — is the same record. Forty-one fields, at frozen byte positions, in eight blocks.

Read that table again as what it is: a catalogue card. Every anchor arrives pre-classified — by who, when, what kind, what language, what place, what age rating, what document, what parent, and ten tags of the author's choosing. Nothing needs to be inferred later by a machine reading the content, because the author declared it at birth and signed the declaration.

The signature covers all 512 bytes. Not just the content hash — the title, the tags, the timestamp, the category, the place, everything, with only the signature's own fingerprint excluded because it cannot sign itself. A relaying peer cannot rewrite your title or retag your anchor; a single flipped byte invalidates the signature and the anchor dies at the next hop.

Fixed size is a feature, not a constraint. It makes storage cost predictable per record instead of per payload. It makes the wire format frameless. It makes a bucket's contents a flat array of equal-length rows. And — the next section — it makes search fast in a way that variable-length records simply cannot be.

The record is the same bytes everywhere. The 512 bytes the author signs are the 512 bytes that cross the network and the 512 bytes a holder's database stores. There is no text encoding, no envelope and no re-serialisation between signature and storage, so there is nothing in between that could quietly change a byte.

4Why Search Is Instant, at Any Size

This is the property most easily missed, and it is the one that makes the platform feel like software rather than like a distributed system.

Because every field sits at a frozen byte offset, a field is extracted with a plain byte-range read: the Guide ID is bytes 100 to 115, always, in every anchor ever written. No parsing. No schema lookup. No deserialisation.

That means the database can build an ordinary B-tree index directly on the byte range. Twenty-seven of them exist, one per queryable field, each defined as a substring expression over the raw 512-byte column, keyed on the field's raw bytes:

CREATE INDEX guide_idx ON anchor_stream
  ((substring(anchor_bytes from 101 for 16)));

The consequences compound:

• A node answers in logarithmic time. Filtering, counting and sorting a bucket are index seeks, not scans. A node holding a hundred million anchors answers a filtered question in about as many steps as one holding a hundred thousand.
• A node only holds its own bucket. At PHEUN's 4,096 buckets that is about one four-thousandth of the world, and its index covers that slice, never the whole stream.
• So the network divides the work rather than multiplying it. A global search fans one small announce out across the buckets; every node answers for its own slice in logarithmic time on that slice; the results merge. Adding citizens adds index capacity in exactly the proportion it adds anchors.

There is no crawler, no inverted index to rebuild, no ranking service, no search company. The index is the routing law plus the byte layout. That is the whole apparatus, and it is why a question addressed to the entire network comes back in seconds instead of requiring somebody to have crawled the network in advance.

5Buckets and the Dispatcher

The ledger is partitioned into a fixed number of AnchorStream Index buckets — 4,096 in PHEUN. Every anchor belongs to exactly one, and which one is a pure function of the anchor's own fields.

Which field decides depends on what the anchor is, and this dispatch is where the cheap queries come from:

The pay-off is concrete. Opening a governed document is one query to one bucket, and it returns the opener, every amendment ever proposed, and every ratification. Loading a thread is one query to the parent's bucket. Counting a viral vote is a fan-out — because the ballots were deliberately scattered so no single node carries the load.

Only the genesis is placed by identity, and that is deliberate. Everything else a person writes scatters by its own hash. Routing one person's entire output to one bucket would put the cost of a popular author on whichever nodes happened to hold it, and would make that bucket a convenient place to stand and watch one person. One predictable record is what verification needs; more than that is a liability.

Two consequences fall out:

There is no sequencing bottleneck. Nothing competes for a position. Throughput is bounded by the network's aggregate bandwidth, and that bound grows with participation instead of being fixed by protocol. If a billion citizens each write one anchor a day, the network carries about twelve thousand new anchors a second; a node holding one of 4,096 buckets sees about three a second, and the design carries twenty — seven times that — before it strains.

Nobody stores everything. You hold one bucket — about one four-thousandth of the world's history, roughly ninety gigabytes a year at that billion-citizen rate — plus your own complete personal chain. That is what makes a full node affordable on ordinary hardware at planetary scale, and it is the difference between a design a billion people can run and one that consolidates into data centres because storing everything eventually requires one.

How many buckets, and how many holders

Both numbers are parameters, and they are chosen together.

Holders per bucket. Correctness needs two: two independent storage receipts before an anchor counts as born, and two agreeing witnesses before a node accepts history it missed (§8, §9). One more is a spare, so a single failure never stalls either. PHEUN therefore keeps three holders of every bucket connected to every node. An implementation that wants a larger coalition before it trusts anything can require more witnesses and keep more holders; the price is connections.

Buckets. Every node keeps its few holders of every bucket connected, so the bucket count sets each node's connection bill. At 4,096 buckets and three holders each that is 12,288 connections, out of a per-node budget of about sixty-six thousand — a number a node behind a home router can hope to keep, which matters because most citizens are behind one. More buckets would make each one lighter and the bill heavier; fewer would do the opposite. Fewer buckets also fill sooner: in a network of ordinary community nodes, with no special nodes holding everything, every bucket has two holders more often than not once there are about forty-six thousand participants.

Coverage is measured continuously, and a bucket that loses its spare is repaired by targeted discovery straight away.

6HOPE — the Protocol Underneath

Everything above rides HOPE: Hardened Onion Post-quantum Exchange, PHEUN's native peer-to-peer protocol. It is pure UDP. There is no TCP session, no HTTP, no API gateway, no broker, and no server anywhere in the node-to-node path. A browser talks to its own node over a local connection; nodes talk to each other only over HOPE.

The name is the specification in four letters:

• Hardened — fail-closed cryptography, per-peer token-bucket egress limits, and a network fingerprint checked before any authenticated traffic passes. A node running different constants is dropped at the handshake rather than quietly corrupting the bucket it shares with you.
• Onion — a three-hop onion overlay, each layer under a fresh, fail-closed ML-KEM-1024 encapsulation to that hop's own key, wrapping the traffic where correlation matters most: direct messages and call setup.
• Post-quantum — ML-DSA-65 signatures, ML-KEM-1024 key encapsulation, AES-256-GCM sealing, BLAKE3 hashing, throughout the mesh, with no classical fallback on any path that crosses it.
• Exchange — a mesh of peers, each budgeted at roughly sixty-six thousand connections, of which about twelve thousand keep three holders of every bucket in reach and the rest serve multi-bucket peers, bursts and discovery.

UDP is the right substrate because the atomic unit is a 512-byte record and most exchanges are one datagram. A long-lived ordered stream would stall every message behind one lost packet; over UDP each message gets exactly the reliability it needs, and the ordering that matters — a citizen's chain — is enforced by the pointers inside the anchors, not by the transport.

Binary, and nothing repeated. Every message has exactly one binary layout. Keys, signatures, anchors and fragments cross the wire as their raw bytes — never as text, never re-encoded — and every decoder accepts only the one canonical form of a value and refuses anything else. A datagram carries no sender field, no timestamp and no connection identifier: once two peers share a key, a datagram that opens under it can only have come from that peer.

Sealed unless it proves itself. Two peers agree a key by post-quantum key encapsulation when they first meet, and from then on every datagram between them is sealed under it, with a separate key for each direction so that neither side can ever reuse the other's nonce. Anything that acts on who sent it is accepted only sealed. The few messages that may travel in the clear each carry their own proof — a signature, a cookie, a seal of their own — or change nothing.

No amplification for strangers. A node sends more than a few dozen bytes to an unproven address only after that address has echoed a cookie, proving it receives what is sent to it. The cookie is computed, not stored, so a flood of strangers costs a node bandwidth it already spends and no memory at all.

Liveness by evidence, almost free at rest. Each connected pair proves a round trip once every few minutes: one side probes, the other echoes, and the next probe returns the echo's nonce, so a single exchange proves both directions. Each probe also carries a short fingerprint of the sender's state — which buckets it holds, where it can be reached — so a peer pulls the full state only when the fingerprint changes. A peer that stops answering is withdrawn from every role at once, rather than kept until a timer expires. Kept warm this way, fifty thousand live peers cost a node about a tenth of a megabit per second in each direction while nothing else moves.

Private conversation has its own keys. A direct message or call travels through other nodes, so it is sealed end to end under a session made just for that conversation, authenticated by both citizens' identity keys and re-keyed while it carries traffic. Compromising a key today reveals nothing sealed under an earlier one.

Messages larger than one datagram are split at the application layer and reassembled before processing, with the path size measured by probe and confirmed only by acknowledgement.

One decision deserves naming because it is unusual: a node learns its own public address from the mesh, and nowhere else. There is no third-party address service and none may ever be added. A peer that received your packet necessarily observed your post-NAT source address, so it reports it back — and two distinct verified peers must agree before you adopt it, because a single lying peer could otherwise make you advertise a black hole or somebody else's address.

Most citizens are behind a home router, and the design assumes it. A node that cannot accept connections from strangers registers with a small set of publicly reachable relay hosts — ordinary nodes, chosen by a hash so clients spread evenly over every host. Sealed traffic reaches it through them, handed on unopened. A stranger who needs a fragment it holds asks through its relay, and the request carries a return token so the answer comes back the same way, without the stranger ever learning where the holder lives. Only those few hosts know a relayed node's home address, and a host under attack rotates its slots.

7Your AnchorChain

Every citizen owns exactly one chain, and it is the spine of their identity.

The first anchor you ever write is your genesis. It binds your Guide ID to your public key, and it is the root every later claim about you is measured against. Every anchor after it carries two things: a 32-byte pointer to the previous anchor you signed, and a monotonic counter — genesis is 1, then 2, then 3, forever, with no gaps.

That is the Personal AnchorChain, and it is walked. At every login your node walks the chain from your local tip upward, pulling anchors from the mesh and persisting each one, so your node holds its own complete history across every bucket even though it serves only one of them to others.

The counter is what makes the chain provable rather than merely present. Because it is monotonic from one with no gaps, a reader checks 1..max against the anchors themselves and knows exactly which positions are missing — it does not have to trust anybody's claim about how many anchors you have written. A count is a peer's assertion and can be wrong in both directions. The chain proves itself.

Anyone can walk anyone's chain. Hand somebody your sixteen-character Guide ID and they can retrieve everything you have ever published, in order, from the mesh — your whole public history as one readable sequence. There is no profile page to visit and there never will be, because the chain is the profile. It cannot be curated after the fact, cannot be partially deleted, and cannot be shown to one reader and hidden from another.

The chain is also the fork detector. Because your key regenerates from your nine inputs on any machine, two devices signed in at once can each extend the same tip before either learns of the other, producing two anchors at the same position under the same key. No protocol can prevent that — both signatures are genuine. But every node walking the chain sees the conflict and reaches the same verdict independently, and the identity locks. A locked identity is dead by design; the remedy is a new one, and the old history stays readable forever. Single-device discipline is a real requirement, not a suggestion.

8Birth — the Anchor Proves Itself

An anchor entering the ledger must be proven genuine. The question is who does the proving, and the obvious answer fails at scale in a way worth stating precisely.

Elect a committee to attest, and the attestation is only useful to a receiver who can verify the committee's key. At planetary scale a node knows a vanishing fraction of the network, so an arbitrary receiver almost never holds an arbitrary attester's key. Propagation dies roughly one hop past the committee's own neighbours. The attestation authenticates the committee, which is not the thing in question.

So the anchor authenticates itself. Every propagation carries the new anchor, the author's genesis, the author's previous anchor, the full public key, and the signature — about six and a half kilobytes, of which the signature alone is 3,309 bytes. That is not overhead; it is the product. Every receiver re-runs the entire proof with nothing it does not already hold:

• the signature verifies over the whole anchor under the carried key;
• the key hashes to the fingerprint committed inside the anchor;
• the anchor's routing bucket, recomputed, matches the one it claims;
• its timestamp falls inside a bounded window of the receiver's clock;
• the new anchor, the genesis and the previous anchor all carry the same key fingerprint — one keypair across the whole chain;
• the chain pointer equals the previous anchor's hash, and the counter is exactly one greater.

That proves a well-formed chain under a single keypair. It does not yet prove that keypair owns the identity — and here the design earns its security. The receiver additionally compares the carried genesis, byte for byte, against the canonical genesis the network holds at that identity's own bucket. Since a Guide ID's keypair is not derivable by a third party, ownership is first claim, and this single comparison is what binds an anchor to its rightful author. An impostor's fabricated genesis has a different hash, and the anchor is refused.

That canonical lookup is itself corroborated by multiple witnesses: several independent holders of the identity's bucket are asked in parallel, and only bytes enough of them return identically are accepted, so one lying holder cannot install a fabricated record and erase somebody's real history. PHEUN asks three and needs two to agree; an implementation may ask more and demand more. Holders who answer but disagree fail closed, and a bucket that does not answer is a reason to wait and retry, never a reason to accept. There is no fallback to a single witness. Bucket assignment is public, so an attacker can deliberately become one holder of a victim's bucket; trusting a lone answer would hand that attacker the victim's identity. The only exception belongs to the network's first few nodes, named in the code, and only while no second holder exists — it lets an empty network start, and it switches itself off the moment a second holder appears.

Propagation is offer-based, not broadcast. A holder announces a 34-byte hash to peers covering the relevant bucket; a peer that lacks it asks; only then does the proof — just under seven kilobytes — move. Announcements deduplicate by hash, so the cascade converges and never loops, and it stays inside the bucket's holders rather than flooding the network.

A missed announcement is repaired, not lost. An announcement is one unacknowledged datagram, and receivers refuse anchors dated far from now, so a dropped announcement would otherwise be permanent. Three things close the gap while an anchor is fresh. Holders keep every new anchor's full proof for the whole live window — ten minutes in PHEUN — so it can still be served. The author re-announces to holders that have not yet confirmed. And holders of the same bucket regularly compare short fingerprints of what each holds in recent time slices, offering each other only what differs. After the window, the anchor is settled history, and settled history belongs to the second mechanism (§9).

Verified is not published. The author waits for storage receipts from two independent holders before considering the anchor born and releasing its payload fragments — because an anchor nobody stored would be unfindable by any future query, and the fragments already scattered would have no anchor to address them. A receipt is a message, and a missing one proves nothing, so when none arrive the author asks the bucket directly whether its exact bytes are there before deciding. If they are not, the mint fails closed and retries. The network never half-publishes.

9Dual-Witness Sync — and the Right to Publish

Self-verification settles what may enter. A second, entirely separate mechanism settles whether two nodes holding the same bucket actually agree — after a restart, a partition, or a cold start.

Anchors in a bucket are grouped into fixed sixty-second time windows. Each window gets a digest; the digests form a sixteen-way tree seven levels deep — 268 million windows, about five hundred years of capacity — and the tree has a root.

Two nodes compare roots. Match, and they are byte-identical for that bucket, in one round trip, regardless of how much history the bucket holds. Differ, and they descend the tree and exchange only the windows that actually diverge. Each window digest commits the full 512 bytes of every anchor in canonical order, never just their identifiers — a digest over identifiers alone would let a peer serve tampered bytes under honest names.

The comparison is over settled history only. Windows older than ten minutes have had time to reach everywhere and are frozen, their digests cached forever; the recent edge is handled by ordinary propagation. Without that split, two perfectly synchronised nodes would never match, because the newest anchors are always in flight somewhere.

Two witnesses, chosen with deliberate randomness. A node that finds itself behind does not take the missing window from whoever offers it. It shuffles the peers covering that bucket — a real Fisher-Yates shuffle, every round — takes a handful as witnesses, and commits nothing until two of them return byte-identical content. The shuffle is load-bearing, and for a reason that is easy to miss: with a fixed order, a contested pair — one liar and one honest holder — would be re-sampled every single cycle, the honest pair would never come up, and one liar could stall a perfectly resolvable bucket forever. Rotating the sample means the liar has to be drawn again and again to keep the stall going, so a contested window converges instead of hanging. A node that can reach only one holder waits, and says so, rather than single-trusting. Agreement outvotes; it never requires unanimity, because unanimity would hand any one peer a free veto.

Two is the number PHEUN requires, and it is the smallest that works: one witness is a single point of trust, and two independent copies that match byte for byte are already strong evidence. An implementation can require three or more agreeing witnesses, at the price of slower catch-up and more holders per bucket. The structure does not change.

A node that finds itself ahead of its witnesses — holding settled history that none of them corroborates — has no innocent explanation the network can check, so it stops: it holds the bucket for nobody, witnesses for nobody and waits for its operator to clear the copy and sync again. And a node that has been cut off past the live window stops claiming its bucket and catches up before it serves again, because a holder that keeps claiming a bucket while missing anchors would pass its gap to everyone who trusts it.

There is exactly one exception, pinned to an identity rather than earned by circumstance: a single named launch node may accept one witness, and only while fewer than two other holders exist, so the second node on an empty network has somewhere to sync from. Everyone else needs two, at every stage of the network's life.

The gate: sync your bucket before you may publish

Here is where the two systems meet, and it is the quiet centre of PHEUN's anti-abuse design.

A node may not mint an anchor until its own bucket is fully synced and corroborated — LIVE. Not partially. Not optimistically. Your node must have pulled its entire slice of world history, compared roots with witnesses, and been found missing nothing that its witnesses corroborate. Only then does the publishing route open.

The second half of the gate cross-references identity: the genesis in your own chain must equal, byte for byte, the genesis the network corroborated into your bucket. An impostor's fabricated genesis can never equal the corroborated one, and a node that tried to write its own into its served slice would read as ahead of its witnesses, be quarantined, never go LIVE, and fail the first guard.

Why this is the right anti-abuse primitive. It cannot be faked, because the only way through is to actually do the work — download the slice, hold it, prove it matches. It costs disk and bandwidth rather than a puzzle, so it is not a lottery a fast machine wins. It requires no captcha, no phone number, no identity document, no payment, and no administrator's approval. And it scales the right way: the cost of pretending to be a thousand citizens is a thousand synced buckets, permanently, and the ledger only grows.

Your node earns the right to speak by carrying its share of everyone else's history. That is the entire social contract of the network, expressed as a gate.

10The PayloadWeave — Storage That Heals Itself

The anchor is 512 bytes. The payload can be ten gigabytes. Here is how the network holds it without anybody hosting it.

Splitting: the square-root law

Fragment count trades two costs against each other. Placement cost grows with the number of fragments — each one is a peer to find and a session to establish. Per-holder cost grows with fragment size, which shrinks as the count rises. The two balance where the count is the square root of the size:

That is the geometric mean of the costs it sits between, and it is why neither term ever runs away. With PHEUN's current settings a ten-gigabyte film becomes about 2,560 fragments of four megabytes each — not the hundreds of thousands a fixed small chunk size would demand, and not a handful of enormous ones. Small payloads floor at two fragments, so even a short text anchor is split and sealed exactly like a film. The base unit and the largest fragment are parameters; the square root is the law.

Placing: rank, not hash

The peers closest to the anchor's address in a 256-bit space form its neighbourhood, and each is assigned exactly one fragment index by its rank in that ordering — the r-th closest peer holds index r mod F.

This is coverage-complete by construction. The F closest peers take the F distinct indexes one each; every subsequent group of F does the same. No index can be orphaned while any peer remains. An independent per-peer hash could hand the same index to everyone and strand another; rank cannot.

The result is the property that makes planetary storage possible: a holder keeps about one fragment per payload, no matter how big the payload is. A phone can help store a film it will never watch.

A holder keeps only what opens. Every fragment arrives with the anchor it belongs to, and the holder checks that the fragment's seal opens under that anchor before it keeps a byte, then discards the anchor and keeps only ciphertext. Nobody can squat a slot with garbage to censor a payload, and junk is never copied onward by healing.

Three tiers, and only one of them is durability

The third exclusion is the honest one. Cached copies raise serving capacity enormously — a popular film is served by everyone who watched it — but counting them in a durability figure would inflate it with storage that may be gone tomorrow. So they are not counted.

Healing: the floor is maintained, not merely placed

An author scatters a floor of copies of each index — ten, in PHEUN's launch settings — and then stops paying. From that moment the network takes over.

Every holder periodically counts how many other holders its index really has, and whenever the count is below a healing target — thirty-two in PHEUN — it pushes another copy to a willing peer, carrying the anchor so the receiver can check the bytes open before it keeps them. The count is of holders that answer, never a guess: a holder keeps a register of the co-holders it has learned of and asks them directly, and only when too few answer does it search the network more widely. It cannot reason from its own neighbours, because they are a biased sample of the address space — a holder judging from them alone would conclude every fragment is dying and replicate forever without ever reaching a real holder.

The check relaxes as an index proves stable: first after an hour, then on a golden-ratio backoff out to weekly, and monthly for content nobody is touching.

So the resting state of a payload is between the floor and the target — ten to thirty-two live copies of every index in PHEUN — restored whenever churn takes one away. Durability here is a maintained level, not a decay curve. A holder that disappears is replaced. Content nobody pins and nobody watches sits at exactly the floor and stays there — that is the immortality guarantee, and it is unconditional, because the overwhelming majority of anchors are never fetched again after publication and their survival rests entirely on a floor that repairs itself.

The arithmetic, including the bad case

Healing absorbs attrition, so the interesting question is the one it cannot reach: a large fraction of the network unreachable at the same moment, before anything can be re-pushed. With R holders per index and a the chance an arbitrary one is reachable, an index survives unless every holder is absent, and the payload reconstructs only if every index survives:

That exponent is a coupon-collector penalty, and it is why file size governs durability. For a ten-gigabyte payload at the maintained floor:

That last row is a mass outage or partition, not an operating point, and it is printed because a storage claim that quotes only its best case is not a claim. It is also the one case healing cannot help with, because healing needs somewhere to push to. The lever is pinning: because R sits inside an exponent, a handful of people who care about a film move it from 8 % to 92 %. Content is protected by the fact that somebody cares about it — no payment, no contract, no storage market.

Finding the bytes

A reader holding an anchor knows the payload's address but not who holds its fragments, and contacting thousands of strangers would cost more than the download. So the query travels instead of the reader: a small request is forwarded through connections that already exist, each node doing constant work — reject duplicates, check its exact in-memory index of what it holds, reply if it holds anything needed, forward the rest closer. Per-node load is constant in network size.

Nearest-first alone fails, instructively: every participant offers nearly the same low ranks, the search collapses into the innermost sliver of the holder band, and a large payload comes back one third complete — which is a failure, not a degraded success, because the manifest and signature are split across fragments and one missing index makes the stream unparseable. The correction is that a node already inside the neighbourhood also forwards outward, past its own distance, so the wavefront sweeps the whole band instead of converging on its centre.

With that, every payload from a kilobyte to the ten-gigabyte maximum is located completely, in a single round, at ten million, a hundred million and a billion nodes alike — from canonical placement alone, with no pinner, no cache and no directory. About 4,400 nodes are asked for the largest payload at ten million participants and about 84,000 at a billion. The payload is found in under a second; the download takes as long as the bytes take.

Fetching needs no connection. Fragment bytes are public ciphertext that check themselves, so a reader pulls them from strangers without a handshake. After one cookie round trip the holder answers in small slices, one per datagram, and keeps no record of the request; the reader keeps the window, re-asks only for lost slices, and resumes from another holder where one stopped. A holder behind a home router is reached through its relay (§6). That is what lets a reader gather a film from thousands of holders it will never meet again.

11Finding Things — No Algorithm, No Index, No Owner

There is no recommender on PHEUN. No engagement ranking, no boosted anchor, no promoted account, no editor, no moderator, no content team. Not as an omission — there is no party who would benefit from one, because there is no advertising plane and nobody is paid for your attention.

What replaces it is three mechanisms, each of which you drive.

Subscription. You subscribe to what you care about and matching anchors arrive as they are born, usually within moments and at most a couple of minutes. Five kinds cover the surface: an identity, so you follow everything a person ever publishes; a document, so you follow every proposal and vote against a governed text; a hashtag, which doubles as a mention so you learn when someone names you; a parent anchor, so you follow the replies to one thing; and a thread origin, so you follow a conversation even where it branches.

Doing that naïvely would not scale — registering every interest with every peer covering every bucket would mean millions of registrations per person. Instead you follow up to 300 things, and your node writes them into one compact contract and hands it to one peer per bucket, chosen so that everyone's contracts spread evenly across that bucket's holders. While nothing changes, nothing is resent: an eight-byte fingerprint of the contract rides the regular liveness check, and a holder asks again only when it no longer matches. A holder that is full says so, and your node picks the next one.

Search. For everything older than a subscription, a query fans out across the buckets and merges the replies — using the byte-offset indexes of §4, so each node answers for its slice in logarithmic time. Filters narrow in both directions: every axis has an include-only form and an exclude form, over who signed it, category, type, tags, language, place, audience rating, and how long the media runs. They compose, with exclusion as a veto — so show me everything tagged Art, in Spanish, excluding anything tagged Violence is one query, and no operator's permission is involved. A question about the entire world resolves within a minute.

The permanent link. Every anchor has a citation address that never changes:

pheun://asi<bucket>/<guideId>/<pacCount>

A bucket, a citizen, and a position in that citizen's chain. Read it aloud and it means the fourth thing this person ever wrote. It contains no host, no domain, no server, no session token and no expiry, and because chains are append-only and anchors are immutable it resolves to the same bytes forever. There are no dead links on PHEUN, and nothing to renew.

That is what turns reading into building. Paste those links into your writing and you have citations that outlive you. Collect the anchors you have found into vault collections — your own libraries, permanently pinned, which is simultaneously an act of curation and an act of preservation, because pinning is exactly the lever that raises a payload's durability. Publish a site — a static, signed, single-page artefact assembled from a fixed registry of about thirty components, distributed as an ordinary payload with no registrar and no host — and put your library on it.

A researcher who cites a hundred anchors, pins them, and publishes a site indexing them has done something no web page can do: made a bibliography that cannot rot, and made the sources more durable by citing them.

12Private Channels — the One Deliberate Exception

Direct messages and voice and video calls are not anchors and never enter the ledger.

This is a considered exception, not an oversight. An anchor is public and permanent by construction, so minting one per message would put an undeletable, publicly visible record of who spoke to whom and when into a ledger with no delete operation — a metadata disclosure far worse than anything payload encryption prevents. What a citizen publishes is permanent; what they say privately is not.

Private traffic is end-to-end encrypted peer-to-peer and held only in each participant's own store, sealed there under a key only their login yields — a copied disk opens nothing. Message content and destination ride the three-hop onion, so no single relay learns both ends. Call media never enters the mesh at all — once setup completes it flows directly between the two participants.

Reachability and contact are different questions, and contact is gated. Your Guide ID appears in everything you publish, which is right for authorship and wrong as a phone number — it would mean anyone who reads an anchor can ring your node forever. So messages and calls require proof of a contact code you issue.

Three properties make the code work where a block-list would not:

• It is checked on every inbound attempt, never only the first. There is no "known contact" short-circuit. Every message and every call is admitted by proving the current code, or it is refused.
• So the control is the code, not a per-person list — and it is deliberately blunt. Changing your code cuts off everyone still holding the old one, friends included. There is no way to revoke one individual while leaving the rest admitted, and that is the honest description: a per-person block would mean "admitted once, admitted forever" for everyone else, which leaves a citizen who published their code with no remedy but removing spammers one at a time, forever, by hand. Bluntness is what makes the control work.
• The gate sits before connection negotiation, not at the interface. Negotiating a call discloses your address to whoever you negotiate with, so refusing after it rings is already too late.

Your Guide ID is the permanent name; the contact code is the number. Cutting everyone off would be unusable if it were permanent, so it is not: a new code reaches the people you keep automatically, one at a time, riding your next message to each of them sealed inside the encrypted envelope. You do not redistribute anything by hand. There is deliberately no bulk push, because broadcasting a new code to everyone you have ever spoken to would hand it straight back to every spammer you changed it to escape — the broadcast is the leak.

So the cost of rotating is not lost contacts; it is a short quiet period with the people you have not written to yet. A code buys revocability, never secrecy — one published in an anchor is readable forever, and the remedy is always the same: change it, and let your own messages carry the new one.

13The Digital Constitution — Building a Civilisation Line by Line

Rules that bind people should be changed by those people and by nobody else. Since there is no administrator, governance cannot be an override. It has to be ordinary use of the ledger — and it is.

PHEUN ships two governed documents: the Digital Constitution, which is the rule layer for conduct on the network, and the Digital Curriculum, which is a body of shared knowledge built the same way. They use identical machinery, because the machinery is the point: a document is a platform institution, drawn from a closed one-byte registry compiled into every node, so every node resolves it to the same document without asking anyone. There is no free-form document name, therefore no race and nothing to squat.

A document is a sequence of numbered lines, and each line carries a version.

• Opening the document is an anchor.
• Proposing a new line, or a new version of an existing line, is an anchor.
• Every ballot is an anchor.
• Recording the outcome is an anchor.

So the document is not stored anywhere in particular. It is derived — identically, by every node that reads the same anchors — and it cannot be edited out from under anyone, because amendment is append-only like everything else. The line-and-version model means you can read not just the current text but every version any line ever had and the vote that ratified each one. The document carries its own complete legislative history, permanently, with no archive to maintain.

Two gates decide an amendment, and the second exists because the first is insufficient in a way that is easy to miss. A three-quarters supermajority governs the ratio of approval. But a ratio alone is satisfied by a single unopposed vote — one participant, no opposition, unanimous, one hundred percent. So a participation quorum also applies, derived from the median turnout of recent successful amendments, and a proposal must attract engagement comparable to what the document's own history established.

The median is deliberate. A maximum would ratchet up permanently after one unusually well-attended vote and freeze the document forever — nothing could pass, and because nothing passed the bar could never come down. The quorum is document-wide rather than per-line, so a new line must clear the standard the document itself set rather than ducking it by opening a fresh line. And a floor applies before any history exists, because otherwise the first amendment passes on one vote and sets a near-zero bar for everything after it.

A new line may be opened only once the previous one has been ratified, so nobody can stack competing unratified lines and pollute the document with text that never settles.

One citizen, one vote, and anyone can check the count. Every ballot a citizen casts on one proposal lands in the same bucket, and its holders count only the first. When the window closes the ballot set is frozen — the network refuses records dated minutes away from now — so every complete count of it is the same number. The verdict records that number, and any citizen can press Verify to count again themselves: a verdict the recount contradicts is marked as potential fraud and never stands on their node. Admission does not count — counting there would make it depend on each holder's view and split the network; the reader is the judge.

This is what "build a digital civilisation together" actually means here. Not a slogan — a document, written by its citizens one ratified line at a time, carrying its own history, enforced socially rather than technically, and owned by nobody.

14A Public Square, Not a Mask

PHEUN is not an anonymity network, and this paper will not imply otherwise.

It is a public library and a town square. Your Guide ID appears in every anchor you write. Your entire chain is walkable by anyone holding those sixteen characters. Anchors are readable by everyone, forever, and the key that opens a payload derives from its public anchor — so anyone with the anchor can read the content. Publication means publication.

Your network address is visible to the peers you serve. It has to be: establishing an encrypted session, selecting holders, and routing fragments all require knowing which machine is on the other end. And because a bucket assignment is a public function of a public identity, anyone may deliberately join your bucket to become one of those peers. The honest statement of the goal is: finding a specific citizen costs real participation, and being found is survivable. It is not, and cannot be, that your address stays secret — a node that serves fragments and receives propagation has to answer strangers.

This is a design choice, not a limitation we are apologising for, and the whole architecture rests on it:

• Provenance. A cited anchor names its author and its position in that author's chain. You can walk back and read everything else they wrote. A claim on PHEUN comes with the whole record of the person making it.
• Accountability without moderators. There is no report button and no takedown, so the only thing standing between the network and abuse is that everything is attributable and permanent. Anonymity plus permanence plus no moderation would be indefensible. Attribution is what makes the absence of a moderator survivable.
• A library needs shelves, not disguises. The value of the AnchorStream as a civilisational record — citations that resolve forever, a curriculum with its full legislative history, a chain you can read end to end — depends entirely on records being attributable and permanent.

What is protected is scoped and stated exactly. What you say privately stays private — messages and calls are never anchors, are end-to-end encrypted, and ride the onion. Who may contact you is gated by a code you control and can rotate. Payload content is sealed in transit and at rest, so peers storing your fragments hold ciphertext they cannot read without the anchor. And a citizen who wants a separate public face creates a separate Guide ID — which is pseudonymity by choice, with a chain of its own, and not the same thing as anonymity.

You are a citizen with a name, in public, on the record. That is the deal, and it is the deal on purpose.

15What We Do Not Claim

Identity loss is final. Forget your inputs and the identity is gone — permanently, with no recovery authority anywhere. Published history stays readable forever but becomes inert. That is the direct cost of having nobody who can reset it for you, which is the same property that means nobody can take it from you.

A Guide ID is a claimed name, and the handle race is real. Your Guide ID is one of the nine inputs — a sixteen-character name you choose — and it is claimed first-come. A desirable name can be taken before you arrive, exactly as in DNS. What is absent is the market around it: no registrar, no fee, no renewal, no expiry, no arbitration, no seizure by anyone including us — and no resale, structurally, because the name is a seed input, so selling it would mean handing over all nine inputs and the entire identity with every signature it has ever made. Squatting is possible; it has no exit.

Two devices can fork a chain. The same inputs regenerate the same key anywhere, so a person signed in twice can extend their chain twice before either device learns of the other. Both signatures are genuine and no protocol can prevent it. The network detects it deterministically and locks the identity; the remedy is a new one.

Sybil resistance is economic, not cryptographic. The bucket-sync gate costs real disk and bandwidth, and the ledger only grows — but that curve is weakest exactly when the network is youngest. There is no proof-of-work, no stake, and no identity check.

Governance is permissionless, and that cuts both ways. Early on, when storage cost is still small, a determined party running many nodes can influence outcomes. The quorum makes that expensive rather than impossible.

Availability is not guaranteed for unpopular large payloads. §10 prints the exact figure rather than a reassurance: a very large payload nobody pins, under severe churn, can become unrecoverable.

Permanence applies to mistakes. There is no delete. An anchor published in error is published forever, and there is nobody to appeal to — the same property that prevents censorship, seen from the other side.

Participation has a floor. A full node needs a real machine, a persistent connection, roughly five to ten megabits per second, and disk that grows. That is deliberate — it is what makes identities costly — but PHEUN is not reachable from a borrowed device, and it is not weightless the way an account on somebody else's computer is.

"Post-quantum" is a claim about the mesh, and it is scoped. Everything crossing the network between nodes uses the standardised post-quantum selections, with no classical fallback path. Three surfaces sit outside that boundary, and they are named rather than glossed:

• Live call media's transport. It rides the browser's own encrypted media transport, whose handshake is still classical, and a web application gets no say in that. So every frame is sealed before it gets there — AES-256-GCM in the browser, under a per-call key that travels only inside the post-quantum call setup. The transport is classical; what it carries is not.
• Your browser talking to your own node. Ordinary web certificates, because no browser yet trusts a post-quantum one. Under one-person-one-node that is usually a machine talking to itself, and only crosses a wire when you open your node from another device on your own network.
• Push notifications, if you switch them on. The Web Push standard fixes its own cryptography and it is classical throughout. The push service still cannot read the payload, but it is not harvest-proof — so a message notification names the sender and carries none of the text. Push is off until you enable it.

Recorded traffic on the last two paths is what a future quantum computer opens; on the first, it opens only the transport around frames still sealed post-quantum. Messages, anchors, payloads, call signalling and call media are not.

Post-quantum is not invulnerable. The primitives defend against the quantum attack that motivates them. They do not defend a compromised endpoint, a stolen device, or a future cryptanalytic result — which is why the format carries algorithm selectors, so future anchors may use future primitives while every anchor already written stays verifiable under the ones that signed it.

16Building an AnchorStream

PHEUN is one network. The AnchorStream is a design, and this section is for anyone who wants to build another on the same foundations.

In one breath: fixed-size anchors; payloads as a second layer, sealed and held by the network; every field indexed at its byte offset, so discovery is fast at any size; and single-writer, append-only chains — with no global ledger order anywhere.

Five things make a ledger an AnchorStream. Remove any one and the others stop holding each other up.

1. A fixed-size record at frozen offsets, signed whole. Every field at a known position, so a database indexes the raw bytes directly and search is logarithmic at any size; the signature over every byte, so no relay can rewrite a field.
2. Placement as a pure function of the record. A fixed set of buckets and a dispatcher that names, for each kind of record, the field that decides its bucket. No allocator, no coordinator, and related records land together where that makes them cheap to read.
3. Single-writer chains. Each identity's records link to the one before and carry a counter with no gaps, so a chain proves its own completeness and the only conflict possible is an identity against itself — which voids it.
4. Self-verifying birth. A new record travels with everything needed to check it: its key, its signature, its author's first record and its previous one. Every receiver re-runs the proof and checks the author's first record against what several independent holders agree it is.
5. Multi-witness sync over settled history. Holders of a bucket compare a tree of digests over fixed time windows that commit the full bytes, and accept missing history only when enough independent witnesses return the same bytes. Recent history is repaired by propagation; settled history by sync.

Everything else is a parameter. The record size, the field layout, the bucket count, how many holders a node keeps per bucket, how many witnesses must agree, the length of the live window, the size of a time window, the fragment law's base unit, the replication floor and healing target, and the kinds of record and what they mean — each is a choice. PHEUN's choices are tuned for one person running one node on ordinary hardware behind a home router, at a billion people. A network with fewer, stronger nodes might choose fewer buckets and more witnesses; an archive that never changes might choose a longer window.

Primitives are selectors, not commitments. PHEUN's record carries a byte naming its signature scheme, its hash and its payload cipher, so new records can move to new algorithms while every old record stays verifiable under the one that signed it. Build that in from the first record; it is the only way a permanent ledger outlives its cryptography.

What holds the guarantees up. A record enters the shared ledger only when the network admits it — never because the node that wrote it says so — and missing history is accepted only on the word of several witnesses, never one. Keep those two and the five foundations hold, whatever is built on top.

What can be built is open. A record is a typed, signed, placed statement that can point at others, and new types are added without touching old ones. Chains, links, subscriptions and the records that answer one another can be combined in more ways than this paper could list. PHEUN builds a public square, a library and a constitution on them; other networks will build other things.

Two networks built this way with different parameters are siblings, not versions of each other: each binds its parameters into a fingerprint its nodes compare when they meet, so they never mistake one another's buckets for their own.

17Conclusion

An AnchorStream is a ledger that does not need a sequence.

Every action is a 512-byte record, catalogued in forty-one fields at frozen byte offsets, signed across all of it, and placed in one of a fixed set of buckets by a function of its own contents. Only its author can extend the chain it belongs to, so no two records ever compete, and the ledger needs no global order at all. The frozen offsets let a database index the bytes directly, so a node answers about its slice in logarithmic time and the network divides the work of a global search instead of multiplying it. The buckets mean nobody stores everything, so a full node fits on ordinary hardware at planetary scale. The dispatcher co-locates what belongs together — a document with its whole history, a conversation with its replies — and scatters what would otherwise concentrate.

The proof rides with the record, so every receiver re-runs it and a forgery dies at every hop. Replication is corroborated by independent witnesses drawn at random, so a lie held by one machine is contested by an honest one. And the right to write is earned by carrying your share of everyone else's history — the one anti-abuse gate that cannot be faked, because the only way through it is to actually do the work.

Payloads are sealed, split by a square-root law, scattered by rank so no index is ever orphaned, and held at a floor the network maintains rather than lets decay — with the arithmetic printed, worst case included.

On that substrate: a feed nobody ranks, a search that reaches every anchor on Earth and takes instructions in both directions, a citation link that resolves forever, libraries that make what they cite more durable by citing it, private channels that were never in the ledger, and a constitution the citizenry writes one ratified line at a time.

No token. No fee. No mining. No advertisement. No algorithm. No administrator. No kill switch. No delete.

One human, one node, one chain, one slice of a shared history that nobody can rewrite — including us. What the network remembers, it remembers permanently. What it cannot do, it cannot be compelled to do. And every citizen stands in it under their own name, in public, on the record.

References