# PHEUN: A Peer-to-Peer AnchorStream Mesh Network

**Peace and Harmony Earth United Network**

contact.pheun@gmail.com · pheun.org

---

## Abstract

We describe the **AnchorStream**: a permanent public ledger in which every
action a person takes is a fixed-size 420-byte record, placed by arithmetic
rather than by agreement, and carrying a commitment to an encrypted payload of
up to ten gigabytes held by the network itself.

The record is the thing that makes everything else work. Because it is exactly
420 bytes and every field sits at a frozen byte offset, a database indexes it
directly on those offsets — so a node answers a filtered question about its
slice of world history in logarithmic time no matter how much history it holds.
Because its placement is a pure function of its own contents, ten thousand
buckets partition the stream with no coordinator deciding who stores what.
Because it carries the proof of its own authorship, every node that receives it
re-runs that proof and a forgery dies at every hop rather than at a checkpoint.

On that one substrate runs an entire platform: publishing and a feed with no
ranking algorithm, a global search that reaches every anchor on Earth, private
messages and calls, websites with no registrar and no host, film and music
libraries, a permanent citation link to any record ever written, and a
constitution the citizenry amends line by line.

Three commitments hold it together. **Math** — placement, ordering and
verification are computed, never negotiated. **Encryption** — post-quantum
throughout the mesh, with payloads sealed before they leave the author's
machine. **Determinism** — two nodes given the same bytes reach the same
conclusion without speaking, which is why consensus here is a property rather
than a protocol.

One human runs one node. There is no token, no fee, no mining, no advertisement,
no ranking algorithm, no administrator, and no delete. And there is no mask:
PHEUN is a public square and a public library, not an anonymity network, and
this paper says so plainly because the design depends on it.

---

## 1. Introduction

The internet a person uses today is not one network. It is a stack of private
services, each of which can say no. A certificate authority decides your name is
real. A cloud decides your service stays reachable. A platform decides your
speech exists. A registrar decides you own a word. A store decides your software
may run. None of it is conspiracy — it is the predictable shape of any system
where the cheapest way to work at scale is to put one party in the middle.

Removing that party is not a matter of building a nicer one. It requires that
four problems be solved *at the same time*, because solving one alone recreates
the others:

1. **Identity** with no issuer — nobody who can grant you a name, and therefore
   nobody who can take it.
2. **Publication** with no host — no server whose removal removes the content.
3. **Storage** with no provider — payloads of real size, held by the network,
   with nobody paying rent to an owner.
4. **Governance** with no administrator — rules that change, decided by the
   people they bind.

A single global chain solves the first two and fails the last two. Total
ordering caps writes far below the rate of ordinary human conversation, and real
payloads get priced out or pushed off-chain to exactly the intermediaries the
design meant to remove.

**So we removed the total order.** A ledger does not need one sequence to be
consistent. It needs every honest participant, given the same inputs, to reach
the same conclusion about where a record belongs and whether it is genuine. Make
placement a function of the record's own bytes and validity a proof the record
carries with it, and two nodes that have never exchanged a packet agree about a
record on sight.

That substrate is the AnchorStream, and the rest of this paper is what it is,
how it works, and what a civilisation can build on it.

---

## 2. What an AnchorStream Is

An AnchorStream is a permanent, public, unordered ledger of fixed-size records,
sharded across the whole population that reads it.

Every entry has **two parts**, and keeping them apart is the central design
decision of the system.

**Part one — the anchor.** Exactly 420 bytes. Public, permanent, immutable from
the moment it is born. It is not the content: it is a byte-addressed record of
metadata *about* the content — who signed it, when, what kind of thing it is,
what it replies to, what document it belongs to, what language it is in, where
in the world it is about, ten tags describing it, and a cryptographic commitment
to the content itself.

**Part two — the payload.** Anything from a few bytes of text to ten gigabytes
of film. Sealed with authenticated encryption before it leaves the author's
machine, cut into fragments, and scattered across the peers nearest to it in an
address space.

**The scattering is a duty, not the only way a payload is held**, and the
difference matters enough to state here rather than bury in §10. A peer the
address space assigned a fragment to holds exactly **one** sealed piece and
cannot read any of it — it has ciphertext and no anchor. But a citizen who
*pinned* the payload, or who simply *watched* it and still has it cached, holds
**every** fragment and can read all of it, because they hold the anchor too.
Complete copies are not a leak in the design; they are the design. They are what
makes a popular film fast, and the network keeps an index of who has one
precisely so readers can find them.

Which is exactly why the scattered floor exists. Popular content is carried by
the people who wanted it. **Unpopular content has nobody who wanted it** — and
that is the case the floor and the healing (§10) are built for: a payload nobody
pinned and nobody kept is still held, still findable, and still repaired, by
peers who never chose it and cannot read it.

The anchor addresses the payload by holding the hash of the payload together
with its manifest, and that hash is simultaneously the anchor's primary key, its
routing address, and the proof that the bytes you eventually reassemble are the
bytes the author signed. Change one byte of the content and the hash changes,
the commitment breaks, and the reader rejects it before a single byte of
plaintext exists.

**Three things secure the AnchorStream, and they do different jobs.**

**Math** decides *where*. A record's bucket is a pure function of its own
fields. There is no allocator, no coordinator, no negotiation about who stores
what — every node computes the same answer independently, which is why placement
costs nothing and cannot be gamed.

**Encryption** decides *who can read and who can forge*. Payloads are sealed
with AES-256-GCM under a key derived from the anchor. Anchors are signed with
ML-DSA-65, a post-quantum signature, and the signature covers all 420 bytes.
Peer sessions are ML-KEM-1024. Everything is hashed with BLAKE3. These are not
"good enough for now" choices: a permanent public ledger is being recorded by
adversaries today and decrypted whenever that becomes possible, so classical
primitives were never an option.

**Determinism** decides *whether we agree*. Two nodes walking the same bucket
with the same inputs observe the same byte order, compute the same digests, and
reach the same verdict. Consensus is not a protocol that runs and can stall — it
is arithmetic that holds.

**Not a blockchain.** There is no single linked chain of blocks, no miners, no
stake, no block interval, and no global sequence anything competes for. Two
anchors created on opposite sides of the world in the same millisecond are
placed independently and neither is aware of the other, because they were never
contending for the same resource.

---

## 3. The 420-Byte Anchor

Every action on the network — a post, a comment, a vote, a course, a film, a
published site, an offer of work — is the same record. **Forty-one fields, at
frozen byte positions, in eight blocks.**

| Block | Bytes | What it holds |
|---|---|---|
| **1 · Cryptographic Identity** | 0–124 | The content commitment, the signature fingerprint, the public-key fingerprint, the algorithm selectors, the author's Guide ID, the timestamp |
| **2 · Chain and Stream** | 125–229 | The pointer to the author's previous anchor and its counter; the pointer to the immediate parent; the pointer to the document or thread root; the line and version within that document |
| **3 · Routing** | 230–237 | This anchor's own bucket, plus the buckets of the three anchors it points at |
| **4 · Classification** | 238–255 | Category, type, flags, language, maturity, place, and ten content tags |
| **5 · Governance** | 256–266 | Approval tally, dissent tally, ratio |
| **6 · Mesh and Payload** | 267–276 | Fragment count, payload count, thread interaction tally |
| **7 · Discovery** | 277–370 | Document id, title, hashtag or mention, a 32-byte content preview, media runtime, the minting client version, the avatar key |
| **8 · Soft-Fork Lane** | 371–419 | A schema selector and 47 bytes reserved for meaning that does not exist yet |

Read that table again as what it *is*: a catalogue card. Every anchor arrives
pre-classified — by who, when, what kind, what language, what place, what
maturity rating, what document, what parent, and ten tags of the author's
choosing. Nothing needs to be inferred later by a machine reading the content,
because the author declared it at birth and signed the declaration.

**The signature covers all 420 bytes.** Not just the content hash — the title,
the tags, the timestamp, the category, the place, everything, with only the
signature's own fingerprint excluded because it cannot sign itself. A relaying
peer cannot rewrite your title or retag your post; a single flipped byte
invalidates the signature and the anchor dies at the next hop.

**Fixed size is a feature, not a constraint.** It makes storage cost predictable
per record instead of per payload. It makes the wire format frameless. It makes
a bucket's contents a flat array of equal-length rows. And — the next section —
it makes search fast in a way that variable-length records simply cannot be.

---

## 4. Why Search Is Instant, at Any Size

This is the property most easily missed, and it is the one that makes the
platform feel like software rather than like a distributed system.

Because every field sits at a frozen byte offset, a field is extracted with a
plain byte-range read: the Guide ID is *bytes 100 to 115*, always, in every
anchor ever written. No parsing. No schema lookup. No deserialisation.

That means the database can build an ordinary B-tree index **directly on the
byte range**. Thirty-three of them exist, one per queryable field, each defined
as a substring expression over the raw 420-byte column:

```
CREATE INDEX guide_idx ON anchor_stream
  ((encode(substring(anchor_420b from 101 for 16), 'hex')));
```

The consequences compound:

- **A node answers in logarithmic time.** Filtering, counting and sorting a
  bucket are index seeks, not scans. A node holding a hundred million anchors
  answers a filtered question in about as many steps as one holding a hundred
  thousand.
- **A node only holds one ten-thousandth of the world.** Its index is over its
  slice, never the whole stream.
- **So the network divides the work rather than multiplying it.** A global
  search fans one small announce out across the buckets; every node answers for
  its own slice in logarithmic time on that slice; the results merge. Adding
  citizens adds index capacity in exactly the proportion it adds anchors.

There is no crawler, no inverted index to rebuild, no ranking service, no search
company. **The index is the routing law plus the byte layout.** That is the whole
apparatus, and it is why a question addressed to the entire network comes back in
seconds instead of requiring somebody to have crawled the network in advance.

---

## 5. Ten Thousand Buckets and the Dispatcher

The ledger is partitioned into **ten thousand Sacred Anchor Index buckets**.
Every anchor belongs to exactly one, and which one is a pure function of the
anchor's own fields.

*Which* field decides depends on what the anchor is, and this dispatch is where
the cheap queries come from:

| The anchor is… | It routes by… | So that… |
|---|---|---|
| A **genesis** — the record binding an identity to its key | the identity | the one anchor verification must find sits at an address anyone can compute from a public Guide ID |
| A **document proposal or ratification** | the document | one query returns a governed text's entire history |
| A **reply or comment** | its parent | a conversation gathers in one bucket instead of scattering |
| A **ballot** | its own hash | a contested vote spreads across the whole mesh instead of cooking one bucket |
| **Anything else** | its own hash | uniform distribution, no hotspots |

The pay-off is concrete. Opening a governed document is **one** query to **one**
bucket, and it returns the opener, every amendment ever proposed, and every
ratification. Loading a thread is one query to the parent's bucket. Counting a
viral vote is a fan-out — because the ballots were deliberately scattered so no
single node carries the load.

**Only the genesis is placed by identity, and that is deliberate.** Everything
else a person writes scatters by its own hash. Routing one person's entire
output to one bucket would put the cost of a popular author on whichever nodes
happened to hold it, and would make that bucket a convenient place to stand and
watch one person. One predictable record is what verification needs; more than
that is a liability.

Two consequences fall out:

**There is no sequencing bottleneck.** Nothing competes for a position.
Throughput is bounded by the network's aggregate bandwidth, and that bound grows
with participation instead of being fixed by protocol. At a billion citizens the
network carries on the order of a hundred thousand new anchors per second; any
one node sees the five to twenty per second that land in its own bucket.

**Nobody stores everything.** You hold one bucket — one ten-thousandth of the
world's history — plus your own complete personal chain. That is what makes a
full node affordable on ordinary hardware at planetary scale, and it is the
difference between a design a billion people can run and one that consolidates
into data centres because storing everything eventually requires one.

Correctness needs enough nodes per bucket: the target is at least five
independent community holders each, which at ten thousand buckets is fifty
thousand relationships — comfortably inside a per-node budget of about
sixty-six thousand connections. Coverage is measured continuously and repaired
by targeted discovery whenever a bucket drops below its floor.

---

## 6. HOPE — the Protocol Underneath

Everything above rides **HOPE: Hardened Onion Post-quantum Exchange**, PHEUN's
native peer-to-peer protocol. It is pure UDP. There is no TCP session, no HTTP,
no API gateway, no broker, and no server anywhere in the node-to-node path. A
browser talks to its own node over a local connection; nodes talk to each other
only over HOPE.

The name is the specification in four letters:

- **Hardened** — fail-closed cryptography, per-peer token-bucket egress limits,
  and a network fingerprint checked before any authenticated traffic passes. A
  node running different constants is dropped at the handshake rather than
  quietly corrupting the bucket it shares with you.
- **Onion** — a three-hop onion overlay, with fail-closed ML-KEM-1024 session
  keys, wrapping the traffic where correlation matters most: direct messages and
  call setup.
- **Post-quantum** — ML-DSA-65 signatures, ML-KEM-1024 key encapsulation,
  AES-256-GCM sealing, BLAKE3 hashing, throughout the mesh, with no classical
  fallback path anywhere.
- **Exchange** — a mesh of peers, each budgeted at roughly sixty-six thousand
  connections, of which fifty thousand fund the five-per-bucket coverage
  invariant and the remainder absorb bursts and multi-coverage peers.

UDP is the right substrate because the atomic unit is a 420-byte record and
most exchanges are one datagram. Sessions rekey on a schedule so compromising a
current key reveals no prior epoch. Packets above the safe path size are chunked
at the application layer and reassembled before processing, with the path MTU
discovered by probe and confirmed only by acknowledgement.

One decision deserves naming because it is unusual: **a node learns its own
public address from the mesh, and nowhere else.** There is no third-party
address service and none may ever be added. A peer that received your packet
necessarily observed your post-NAT source address, so it reports it back — and
two distinct verified peers must agree before you adopt it, because a single
lying peer could otherwise make you advertise a black hole or somebody else's
address. Nodes behind carrier NAT reach the network through a rotating relay
overlay, where a client hides behind a small set of relay hosts and rotates
slots when one is overloaded.

---

## 7. Your AnchorChain

Every citizen owns exactly one chain, and it is the spine of their identity.

The first anchor you ever write is your **genesis**. It binds your Guide ID to
your public key, and it is the root every later claim about you is measured
against. Every anchor after it carries two things: a 32-byte pointer to the
previous anchor you signed, and a monotonic **counter** — genesis is 1, then 2,
then 3, forever, with no gaps.

That is the Personal AnchorChain, and it is **walked**. At every login your node
walks the chain from your local tip upward, pulling anchors from the mesh and
persisting each one, so your node holds its own complete history across all ten
thousand buckets even though it serves only one of them to others.

The counter is what makes the chain provable rather than merely present. Because
it is monotonic from one with no gaps, a reader checks `1..max` against the
anchors themselves and knows exactly which positions are missing — it does not
have to trust anybody's claim about how many anchors you have written. A count
is a peer's assertion and can be wrong in both directions. The chain proves
itself.

**Anyone can walk anyone's chain.** Hand somebody your sixteen-character Guide
ID and they can retrieve everything you have ever published, in order, from the
mesh — your whole public history as one readable sequence. There is no profile
page to visit and there never will be, because the chain *is* the profile. It
cannot be curated after the fact, cannot be partially deleted, and cannot be
shown to one reader and hidden from another.

The chain is also the fork detector. Because your key regenerates from your nine
inputs on any machine, two devices signed in at once can each extend the same
tip before either learns of the other, producing two anchors at the same
position under the same key. No protocol can prevent that — both signatures are
genuine. But every node walking the chain sees the conflict and reaches the same
verdict independently, and the identity locks. A locked identity is dead by
design; the remedy is a new one, and the old history stays readable forever.
Single-device discipline is a real requirement, not a suggestion.

---

## 8. Birth — the Anchor Proves Itself

An anchor entering the ledger must be proven genuine. The question is who does
the proving, and the obvious answer fails at scale in a way worth stating
precisely.

Elect a committee to attest, and the attestation is only useful to a receiver
who can verify the committee's key. At planetary scale a node knows a vanishing
fraction of the network, so an arbitrary receiver almost never holds an
arbitrary attester's key. Propagation dies roughly one hop past the committee's
own neighbours. **The attestation authenticates the committee, which is not the
thing in question.**

So the anchor authenticates *itself*. Every propagation carries the new anchor,
the author's genesis, the author's previous anchor, the full public key, and the
signature — about six and a half kilobytes, of which the signature alone is
3,309 bytes. That is not overhead; it is the product. Every receiver re-runs the
entire proof with nothing it does not already hold:

- the signature verifies over the whole anchor under the carried key;
- the key hashes to the fingerprint committed inside the anchor;
- the anchor's routing bucket, recomputed, matches the one it claims;
- its timestamp falls inside a bounded window of the receiver's clock;
- the new anchor, the genesis and the previous anchor all carry the same key
  fingerprint — one keypair across the whole chain;
- the chain pointer equals the previous anchor's hash, and the counter is
  exactly one greater.

That proves a well-formed chain under a single keypair. It does not yet prove
that keypair *owns* the identity — and here the design earns its security. The
receiver additionally compares the carried genesis, byte for byte, against the
canonical genesis the network holds at that identity's own bucket. Since a Guide
ID's keypair is not derivable by a third party, ownership is first claim, and
this single comparison is what binds an anchor to its rightful author. An
impostor's fabricated genesis has a different hash, and the anchor is refused.

That canonical lookup is itself corroborated: three independent holders are
queried in parallel and only bytes two of them return identically are accepted,
so one lying holder cannot install a fabricated record and erase somebody's real
history. Holders who answer but disagree fail closed and the check retries. The
one relaxation is stated rather than buried — if exactly one holder answers at
all, its answer is taken, because refusing to proceed on an unanswerable
question would stall the network precisely when it is thinnest.

Propagation is **offer-based**, not broadcast. A holder announces a 34-byte hash
to peers covering the relevant bucket; a peer that lacks it asks; only then does
the six-and-a-half-kilobyte proof move. Announcements deduplicate by hash, so
the cascade converges and never loops.

**Verified is not published.** The author waits for storage receipts from two
independent holders before considering the anchor born and releasing its payload
fragments — because an anchor nobody stored would be unfindable by any future
query, and the fragments already scattered would have no anchor to address them.
If the receipts do not arrive, the mint fails closed and retries. The network
never half-publishes.

---

## 9. Dual-Witness Sync — and the Right to Post

Self-verification settles what may *enter*. A second, entirely separate
mechanism settles whether two nodes holding the same bucket actually *agree* —
after a restart, a partition, or a cold start.

Anchors in a bucket are grouped into fixed **sixty-second time windows**. Each
window gets a digest; the digests form a sixteen-way tree seven levels deep —
268 million windows, about five hundred years of capacity — and the tree has a
root.

Two nodes compare roots. Match, and they are byte-identical for that bucket, in
one round trip, regardless of how much history the bucket holds. Differ, and
they descend the tree and exchange only the windows that actually diverge. Each
window digest commits the **full 420 bytes** of every anchor in canonical order,
never just their identifiers — a digest over identifiers alone would let a peer
serve tampered bytes under honest names.

The comparison is over **settled** history only. Windows older than ten minutes
have had time to reach everywhere and are frozen, their digests cached forever;
the recent edge is handled by ordinary propagation. Without that split, two
perfectly synchronised nodes would never match, because the newest anchors are
always in flight somewhere.

**Two witnesses, chosen with deliberate randomness.** A node that finds itself
behind does not take the missing window from whoever offers it. It shuffles the
peers covering that bucket — a real Fisher-Yates shuffle, every round — takes a
handful as witnesses, and commits nothing until **two of them return
byte-identical content**. The shuffle is load-bearing, and for a
reason that is easy to miss: with a fixed order, a contested pair — one liar and
one honest holder — would be re-sampled every single cycle, the honest pair would
never come up, and **one liar could stall a perfectly resolvable bucket
forever**. Rotating the sample means the liar has to be drawn again and again to
keep the stall going, so a contested window converges instead of hanging. A node that can reach
only one holder waits, and says so, rather than single-trusting.

There is exactly one exception, pinned to an identity rather than earned by
circumstance: a single named launch node may accept one witness, and only while
fewer than two other holders exist, so the second node on an empty network has
somewhere to sync from. Everyone else needs two, at every stage of the network's
life.

### The gate: sync your bucket before you may post

Here is where the two systems meet, and it is the quiet centre of PHEUN's
anti-abuse design.

**A node may not mint an anchor until its own bucket is fully synced and
corroborated — LIVE.** Not partially. Not optimistically. Your node must have
pulled its entire slice of world history, compared roots with witnesses, and
been found missing nothing that its witnesses corroborate. Only then does the
posting route open.

The second half of the gate cross-references identity: the genesis in your own
chain must equal, byte for byte, the genesis the network corroborated into your
bucket. An impostor's fabricated genesis can never equal the corroborated one,
and a node that tried to write its own into its served slice would read as
*ahead* of its witnesses, be quarantined, never go LIVE, and fail the first
guard.

**Why this is the right anti-abuse primitive.** It cannot be faked, because the
only way through is to actually do the work — download the slice, hold it,
prove it matches. It costs disk and bandwidth rather than a puzzle, so it is not
a lottery a fast machine wins. It requires no captcha, no phone number, no
identity document, no payment, and no administrator's approval. And it scales
the right way: the cost of pretending to be a thousand citizens is a thousand
synced buckets, permanently, and the ledger only grows.

**Your node earns the right to speak by carrying its share of everyone else's
history.** That is the entire social contract of the network, expressed as a
gate.

---

## 10. The PayloadWeave — Storage That Heals Itself

The anchor is 420 bytes. The payload can be ten gigabytes. Here is how the
network holds it without anybody hosting it.

### Splitting: the square-root law

Fragment count trades two costs against each other. Placement cost grows with
the *number* of fragments — each one is a peer to find and a session to
establish. Per-holder cost grows with fragment *size*, which shrinks as the
count rises. The two balance where the count is the square root of the size:

> **F = √S**

That is the geometric mean of the costs it sits between, and it is why neither
term ever runs away. A ten-gigabyte film becomes about **2,560 fragments of four
megabytes each** — not the hundreds of thousands a fixed small chunk size would
demand, and not a handful of enormous ones. Small payloads floor at two
fragments, so even a short text post is split and sealed exactly like a film.

### Placing: rank, not hash

The peers closest to the anchor's address in a 256-bit space form its
neighbourhood, and each is assigned exactly one fragment index **by its rank** in
that ordering — the *r*-th closest peer holds index *r* mod *F*.

This is coverage-complete by construction. The *F* closest peers take the *F*
distinct indexes one each; every subsequent group of *F* does the same. No index
can be orphaned while any peer remains. An independent per-peer hash could hand
the same index to everyone and strand another; rank cannot.

The result is the property that makes planetary storage possible: **a holder
keeps about one fragment per payload, no matter how big the payload is.** A phone
can help store a film it will never watch.

### Three tiers, and only one of them is durability

| Tier | What it is | Counts toward durability? |
|---|---|---|
| **Network storage** | Fragments you hold because the address space put them on you — a duty owed to other citizens | **Yes.** This is the floor. |
| **Vault** | Content you deliberately pinned. Permanent, local, yours | **Yes.** Each pinner raises redundancy for every index at once. |
| **Viewer cache** | Copies you accumulated by reading things. Evictable | **No — deliberately.** |

The third exclusion is the honest one. Cached copies raise *serving capacity*
enormously — a popular film is served by everyone who watched it — but counting
them in a durability figure would inflate it with storage that may be gone
tomorrow. So they are not counted.

### Healing: the floor is maintained, not merely placed

An author scatters **ten copies** of each index and then stops paying. From that
moment the network takes over.

Every holder periodically counts, via a network search rather than a local
guess, how many other holders its index has. Whenever the count is below
**thirty-two**, it pushes another copy to a willing peer. The count must come
from the network because no node knows the network — a node's own neighbours are
a biased sample of the address space, and a holder reasoning from them alone
would conclude every fragment is dying and replicate forever without ever
reaching a real holder.

The check relaxes as an index proves stable: first after an hour, then on a
golden-ratio backoff out to weekly, and monthly for content nobody is touching.

**So the resting state of a payload is ten to thirty-two live copies of every
index, restored whenever churn takes one away.** Durability here is a maintained
level, not a decay curve. A holder that disappears is replaced. Content nobody
pins and nobody watches sits at exactly the floor and stays there — that is the
immortality guarantee, and it is unconditional, because the overwhelming
majority of anchors are never fetched again after publication and their survival
rests entirely on a floor that repairs itself.

### The arithmetic, including the bad case

Healing absorbs attrition, so the interesting question is the one it cannot
reach: a large fraction of the network unreachable *at the same moment*, before
anything can be re-pushed. With *R* holders per index and *a* the chance an
arbitrary one is reachable, an index survives unless every holder is absent, and
the payload reconstructs only if **every** index survives:

> **P = ( 1 − (1 − a)^R )^F**

That exponent is a coupon-collector penalty, and it is why **file size governs
durability**. For a ten-gigabyte payload at the maintained floor:

| Holders offline at once | Floor of 10 | With 5 pinners |
|---|---|---|
| 20 % | ~100 % | ~100 % |
| 40 % | 77 % | >99 % |
| 50 % | 8 % | 92 % |

That last row is a mass outage or partition, not an operating point, and it is
printed because a storage claim that quotes only its best case is not a claim.
It is also the one case healing cannot help with, because healing needs
somewhere to push to. The lever is pinning: because *R* sits inside an exponent,
a handful of people who care about a film move it from 8 % to 92 %. **Content is
protected by the fact that somebody cares about it** — no payment, no contract,
no storage market.

### Finding the bytes

A reader holding an anchor knows the payload's address but not who holds its
fragments, and contacting thousands of strangers would cost more than the
download. So the query travels instead of the reader: a small request is
forwarded through connections that already exist, each node doing constant work
— reject duplicates, check a membership filter, reply if it holds anything
needed, forward the rest closer. Per-node load is constant in network size.

Nearest-first alone fails, instructively: every participant offers nearly the
same low ranks, the search collapses into the innermost sliver of the holder
band, and a large payload comes back one third complete — which is a *failure*,
not a degraded success, because the manifest and signature are split across
fragments and one missing index makes the stream unparseable. The correction is
that a node already inside the neighbourhood also forwards *outward*, past its
own distance, so the wavefront sweeps the whole band instead of converging on
its centre.

With that, every payload from a kilobyte to the ten-gigabyte maximum is located
completely, in a single round, at ten million, a hundred million and a billion
nodes alike — from canonical placement alone, with no pinner, no cache and no
directory. About 4,400 nodes are asked for the largest payload at ten million
participants and about 84,000 at a billion. The payload is found in under a
second; the download takes as long as the bytes take.

---

## 11. Finding Things — No Algorithm, No Index, No Owner

There is no recommender on PHEUN. No engagement ranking, no boosted post, no
promoted account, no editor, no moderator, no content team. Not as an omission —
**there is no party who would benefit from one**, because there is no
advertising plane and nobody is paid for your attention.

What replaces it is three mechanisms, each of which you drive.

**Subscription.** You subscribe to what you care about and matching anchors
arrive as they are born, typically within one to two minutes. Five kinds cover
the surface: an **identity**, so you follow everything a person ever publishes;
a **document**, so you follow every proposal and vote against a governed text; a
**hashtag**, which doubles as a mention so you learn when someone names you; a
**parent anchor**, so you follow the replies to one thing; and a **thread
origin**, so you follow a conversation even where it branches.

Doing that naïvely would not scale — registering every interest with every peer
covering every bucket would mean millions of registrations per person. Instead
your node elects **one peer per bucket** and hands it a single compact filter
covering every subscription at once. Adding interests enlarges the filter; it
does not multiply the contracts.

**Search.** For everything older than a subscription, a query fans out across
the buckets and merges the replies — using the byte-offset indexes of §4, so
each node answers for its slice in logarithmic time. Filters narrow in **both
directions**: every axis has an *include-only* form and an *exclude* form, over
who signed it, category, type, tags, language, place, audience rating, and how
long the media runs. They compose, with exclusion as a veto — so *show me
everything tagged Art, in Spanish, excluding anything tagged Violence* is one
query, and no operator's permission is involved. A question about the entire
world resolves within a minute.

**The permanent link.** Every anchor has a citation address that never changes:

```
pheun://sai<bucket>/<guideId>/<pacCount>
```

A bucket, a citizen, and a position in that citizen's chain. Read it aloud and
it means *the fourth thing this person ever wrote*. It contains no host, no
domain, no server, no session token and no expiry, and because chains are
append-only and anchors are immutable it resolves to the same bytes forever.
**There are no dead links on PHEUN**, and nothing to renew.

That is what turns reading into building. Paste those links into your writing
and you have citations that outlive you. Collect the anchors you have found into
**vault collections** — your own libraries, permanently pinned, which is
simultaneously an act of curation and an act of preservation, because pinning is
exactly the lever that raises a payload's durability. Publish a **site** — a
static, signed, single-page artefact assembled from a fixed registry of about
thirty components, distributed as an ordinary payload with no registrar and no
host — and put your library on it.

A researcher who cites a hundred anchors, pins them, and publishes a site
indexing them has done something no web page can do: made a bibliography that
cannot rot, and made the sources more durable by citing them.

---

## 12. Private Channels — the One Deliberate Exception

Direct messages and voice and video calls are **not anchors** and never enter
the ledger.

This is a considered exception, not an oversight. An anchor is public and
permanent by construction, so minting one per message would put an undeletable,
publicly visible record of who spoke to whom and when into a ledger with no
delete operation — a metadata disclosure far worse than anything payload
encryption prevents. **What a citizen publishes is permanent; what they say
privately is not.**

Private traffic is end-to-end encrypted peer-to-peer and held only in each
participant's own store. Message content and destination ride the three-hop
onion, so no single relay learns both ends. Call *media* never enters the mesh
at all — once setup completes it flows directly between the two participants.

**Reachability and contact are different questions, and contact is gated.** Your
Guide ID appears in everything you publish, which is right for authorship and
wrong as a phone number — it would mean anyone who reads a post can ring your
node forever. So messages and calls require proof of a **contact code** you
issue.

Three properties make the code work where a block-list would not:

- **It is checked on every inbound attempt, never only the first.** There is no
  "known contact" short-circuit. Every message and every call is admitted by
  proving the *current* code, or it is refused.
- **So the control is the code, not a per-person list — and it is deliberately
  blunt.** Changing your code cuts off *everyone* still holding the old one,
  friends included. There is no way to revoke one individual while leaving the
  rest admitted, and that is the honest description: a per-person block would
  mean "admitted once, admitted forever" for everyone else, which leaves a
  citizen who published their code with no remedy but removing spammers one at
  a time, forever, by hand. Bluntness is what makes the control work.
- **The gate sits before connection negotiation, not at the interface.**
  Negotiating a call discloses your address to whoever you negotiate with, so
  refusing after it rings is already too late.

Your Guide ID is the permanent **name**; the contact code is the **number**.
Cutting everyone off would be unusable if it were permanent, so it is not: a new
code reaches the people you keep automatically, one at a time, riding your next
message to each of them sealed inside the encrypted envelope. You do not
redistribute anything by hand. There is deliberately **no bulk push**, because
broadcasting a new code to everyone you have ever spoken to would hand it
straight back to every spammer you changed it to escape — the broadcast *is* the
leak.

So the cost of rotating is not lost contacts; it is a short quiet period with
the people you have not written to yet. **A code buys revocability, never
secrecy** — one posted in public is readable forever, and the remedy is always
the same: change it, and let your own messages carry the new one.

---

## 13. The Digital Constitution — Building a Civilisation Line by Line

Rules that bind people should be changed by those people and by nobody else.
Since there is no administrator, governance cannot be an override. It has to be
ordinary use of the ledger — and it is.

PHEUN ships two governed documents: the **Digital Constitution**, which is the
rule layer for conduct on the network, and the **Digital Curriculum**, which is
a body of shared knowledge built the same way. They use identical machinery,
because the machinery is the point: a document is a platform institution, drawn
from a closed one-byte registry compiled into every node, so every node resolves
it to the same document without asking anyone. There is no free-form document
name, therefore no race and nothing to squat.

**A document is a sequence of numbered lines, and each line carries a version.**

- Opening the document is an anchor.
- Proposing a new line, or a new version of an existing line, is an anchor.
- Every ballot is an anchor.
- Recording the outcome is an anchor.

So the document is not stored anywhere in particular. It is **derived** —
identically, by every node that reads the same anchors — and it cannot be edited
out from under anyone, because amendment is append-only like everything else.
The line-and-version model means you can read not just the current text but
every version any line ever had and the vote that ratified each one. **The
document carries its own complete legislative history**, permanently, with no
archive to maintain.

Two gates decide an amendment, and the second exists because the first is
insufficient in a way that is easy to miss. A **three-quarters supermajority**
governs the *ratio* of approval. But a ratio alone is satisfied by a single
unopposed vote — one participant, no opposition, unanimous, one hundred percent.
So a **participation quorum** also applies, derived from the median turnout of
recent successful amendments, and a proposal must attract engagement comparable
to what the document's own history established.

The median is deliberate. A maximum would ratchet up permanently after one
unusually well-attended vote and freeze the document forever — nothing could
pass, and because nothing passed the bar could never come down. The quorum is
document-wide rather than per-line, so a new line must clear the standard the
document itself set rather than ducking it by opening a fresh line. And a floor
applies before any history exists, because otherwise the first amendment passes
on one vote and sets a near-zero bar for everything after it.

A new line may be opened only once the previous one has been ratified, so nobody
can stack competing unratified lines and pollute the document with text that
never settles.

**This is what "build a digital civilisation together" actually means here.** Not
a slogan — a document, written by its citizens one ratified line at a time,
carrying its own history, enforced socially rather than technically, and owned
by nobody.

---

## 14. A Public Square, Not a Mask

**PHEUN is not an anonymity network, and this paper will not imply otherwise.**

It is a public library and a town square. Your Guide ID appears in every anchor
you write. Your entire chain is walkable by anyone holding those sixteen
characters. Anchors are readable by everyone, forever, and the key that opens a
payload derives from its public anchor — so anyone with the anchor can read the
content. Publication means publication.

Your network address is visible to the peers you serve. It has to be:
establishing an encrypted session, selecting holders, and routing fragments all
require knowing which machine is on the other end. And because a bucket
assignment is a public function of a public identity, anyone may deliberately
join your bucket to become one of those peers. The honest statement of the goal
is: **finding a specific citizen costs real participation, and being found is
survivable.** It is not, and cannot be, that your address stays secret — a node
that serves fragments and receives propagation has to answer strangers.

This is a design choice, not a limitation we are apologising for, and the whole
architecture rests on it:

- **Provenance.** A cited anchor names its author and its position in that
  author's chain. You can walk back and read everything else they wrote. A
  claim on PHEUN comes with the whole record of the person making it.
- **Accountability without moderators.** There is no report button and no
  takedown, so the only thing standing between the network and abuse is that
  everything is attributable and permanent. Anonymity plus permanence plus no
  moderation would be indefensible. **Attribution is what makes the absence of a
  moderator survivable.**
- **A library needs shelves, not disguises.** The value of the AnchorStream as a
  civilisational record — citations that resolve forever, a curriculum with its
  full legislative history, a chain you can read end to end — depends entirely
  on records being attributable and permanent.

What *is* protected is scoped and stated exactly. **What you say privately stays
private** — messages and calls are never anchors, are end-to-end encrypted, and
ride the onion. **Who may contact you is gated** by a code you control and can
rotate. **Payload content is sealed** in transit and at rest, so peers storing
your fragments hold ciphertext they cannot read without the anchor. And a
citizen who wants a separate public face creates a separate Guide ID — which is
pseudonymity by choice, with a chain of its own, and not the same thing as
anonymity.

You are a citizen with a name, in public, on the record. That is the deal, and
it is the deal on purpose.

---

## 15. What We Do Not Claim

**Identity loss is final.** Forget your inputs and the identity is gone —
permanently, with no recovery authority anywhere. Published history stays
readable forever but becomes inert. That is the direct cost of having nobody who
can reset it for you, which is the same property that means nobody can take it
from you.

**A Guide ID is a claimed name, and the handle race is real.** Your Guide ID is
one of the nine inputs — a sixteen-character name you choose — and it is claimed
first-come. A desirable name can be taken before you arrive, exactly as in DNS.
What is absent is the market around it: no registrar, no fee, no renewal, no
expiry, no arbitration, no seizure by anyone including us — and no resale,
structurally, because the name is a seed input, so selling it would mean handing
over all nine inputs and the entire identity with every signature it has ever
made. Squatting is possible; it has no exit.

**Two devices can fork a chain.** The same inputs regenerate the same key
anywhere, so a person signed in twice can extend their chain twice before either
device learns of the other. Both signatures are genuine and no protocol can
prevent it. The network detects it deterministically and locks the identity;
the remedy is a new one.

**Sybil resistance is economic, not cryptographic.** The bucket-sync gate costs
real disk and bandwidth, and the ledger only grows — but that curve is weakest
exactly when the network is youngest. There is no proof-of-work, no stake, and
no identity check.

**Governance is permissionless, and that cuts both ways.** Early on, when
storage cost is still small, a determined party running many nodes can influence
outcomes. The quorum makes that expensive rather than impossible.

**Availability is not guaranteed for unpopular large payloads.** §10 prints the
exact figure rather than a reassurance: a very large payload nobody pins, under
severe churn, can become unrecoverable.

**Permanence applies to mistakes.** There is no delete. An anchor published in
error is published forever, and there is nobody to appeal to — the same property
that prevents censorship, seen from the other side.

**Participation has a floor.** A full node needs a real machine, a persistent
connection, roughly five to ten megabits per second, and disk that grows. That
is deliberate — it is what makes identities costly — but PHEUN is not reachable
from a borrowed device, and it is not weightless the way an account on somebody
else's computer is.

**"Post-quantum" is a claim about the mesh, and it is scoped.** Everything
crossing the network between nodes uses the standardised post-quantum
selections, with no classical fallback path. **Three** surfaces sit outside
that boundary, and they are named rather than glossed:

- **Live call media.** It rides the browser's own encrypted media transport,
  whose handshake is still classical, and a web application gets no say in
  that. Call signalling is post-quantum; the frames are not yet. Per-frame
  encryption keyed from the session we already hold is a build item, not a
  limit of the design.
- **Your browser talking to your own node.** Ordinary web certificates,
  because no browser yet trusts a post-quantum one. Under one-person-one-node
  that is usually a machine talking to itself, and only crosses a wire when
  you open your node from another device on your own network.
- **Push notifications, if you switch them on.** The Web Push standard fixes
  its own cryptography and it is classical throughout. The push service still
  cannot read the payload, but it is not harvest-proof, and a message
  notification carries a short preview of the text. Push is off until you
  enable it.

Recorded traffic on those three paths is what a future quantum computer opens.
Messages, anchors, payloads and call signalling are not.

**Post-quantum is not invulnerable.** The primitives defend against the quantum
attack that motivates them. They do not defend a compromised endpoint, a stolen
device, or a future cryptanalytic result — which is why the format carries
algorithm selectors, so future anchors may use future primitives while every
anchor already written stays verifiable under the ones that signed it.

---

## 16. Conclusion

An AnchorStream is a ledger that does not need a sequence.

Every action is a 420-byte record, catalogued in forty-one fields at frozen byte
offsets, signed across all of it, and placed in one of ten thousand buckets by a
function of its own contents. The frozen offsets let a database index the bytes
directly, so a node answers about its slice in logarithmic time and the network
divides the work of a global search instead of multiplying it. The buckets mean
nobody stores everything, so a full node fits on ordinary hardware at planetary
scale. The dispatcher co-locates what belongs together — a document with its
whole history, a conversation with its replies — and scatters what would
otherwise concentrate.

The proof rides with the record, so every receiver re-runs it and a forgery dies
at every hop. Replication is corroborated by two randomly-drawn witnesses, so a
lie held by one machine is contested by an honest one. And the right to write is
earned by carrying your share of everyone else's history — the one anti-abuse
gate that cannot be faked, because the only way through it is to actually do the
work.

Payloads are sealed, split by a square-root law, scattered by rank so no index
is ever orphaned, and held at a floor the network maintains rather than lets
decay — with the arithmetic printed, worst case included.

On that substrate: a feed nobody ranks, a search that reaches every anchor on
Earth and takes instructions in both directions, a citation link that resolves
forever, libraries that make what they cite more durable by citing it, private
channels that were never in the ledger, and a constitution the citizenry writes
one ratified line at a time.

No token. No fee. No mining. No advertisement. No algorithm. No administrator.
No kill switch. No delete.

One human, one node, one chain, one slice of a shared history that nobody can
rewrite — including us. What the network remembers, it remembers permanently.
What it cannot do, it cannot be compelled to do. And every citizen stands in it
under their own name, in public, on the record.

---

## 17. A Letter from Nate of Earth

Hi, Nate of Earth here — welcome to a journey of discovery.

I have tried to create a unique platform that we can evolve over time. There may
be mistakes in the code, but I hope we can come together and make the best
network together. We can build a digital constitution together for peace and
harmony. The codebase is open source.

Let us come together as one people. Let us unite behind a banner of true peace.
Let us lay down our weapons of mass destruction to foster trust and peace. Let us
not wage war among ourselves, but unity and understanding — this is the true path
to peace and harmony for all past, present and future humans of the universe.

— **Nate of Earth**

---

## References

1. S. Nakamoto, *Bitcoin: A Peer-to-Peer Electronic Cash System*, 2008.
2. P. Maymounkov and D. Mazières, *Kademlia: A Peer-to-Peer Information System
   Based on the XOR Metric*, IPTPS, 2002.
3. R. C. Merkle, *A Digital Signature Based on a Conventional Encryption
   Function*, CRYPTO, 1987.
4. S. Haber and W. S. Stornetta, *How to Time-Stamp a Digital Document*, Journal
   of Cryptology, 1991.
5. National Institute of Standards and Technology, *Module-Lattice-Based
   Key-Encapsulation Mechanism Standard*, FIPS 203.
6. National Institute of Standards and Technology, *Module-Lattice-Based Digital
   Signature Standard*, FIPS 204.
7. J. O'Connor, J.-P. Aumasson, S. Neves, and Z. Wilcox-O'Hearn, *BLAKE3: One
   Function, Fast Everywhere*, 2020.
8. M. J. Dworkin, *Recommendation for Block Cipher Modes of Operation:
   Galois/Counter Mode (GCM) and GMAC*, NIST SP 800-38D, 2007.
9. R. Dingledine, N. Mathewson, and P. Syverson, *Tor: The Second-Generation
   Onion Router*, USENIX Security, 2004.
10. A. Rowstron and P. Druschel, *Storage Management and Caching in PAST, a
    Large-Scale Persistent Peer-to-Peer Storage Utility*, SOSP, 2001.