VII Arx

Trias is Steward, Memory, and People. Steward splits into Steward Etch (Root motion, Phoenix open, Interdictum release) and Steward Bellum (Exercitus and Firewall operational command in P0). The split is live at activation. No throat holds both Etch and Bellum. The first CEC is not a dual-crown window. A single person holding both is void at sight under VII.25. In P0 if only one Steward lives, that throat holds containment-root, not etch-root and not full Exercitus command. Etch then sits Memory plus People plus a peer observer until a second Steward is named. Memory: three air-gapped models brief under 4.5; EVL and Oracle keep meters the Node did not print. A rotating high-VCI human panel signs Memory briefs that move mint, sword, or school; silicon does not brief those joints alone. Effective power of model-sublegs plus the Command-Tier patch class is counted against the four-leg lock: three models that collude are not a fourth named leg, and they are still a Critical Entropy Event (4.5).

People: Sortition juries try, and Protected citizens witness shard-boots (1.8). A Sortition jury is 90th-percentile VCI plus a stratified random sample from Operational Tier plus at least two seats drawn from below the VCI median, Character-filtered, age/sex-stratified, seven or thirteen people, for one case, thirty days, or one sitting on a Compressed Capital Docket. Deliberation is blind to VCI weight. No Steward rules without Memory; no Memory kills without People; no People etch without Steward.

The Founder Council is thirteen seats, etched with the first three-seal packet. If <13, empty seats are reserved and do not vote until filled. A reserved seat vacant more than two CECs auto-voids; a merit-elected filler may vote on pending motions during the vacancy so one empty chair cannot hostage Root. Below seven, the Node is not Entity-grade (1.7).

After CEC 2, one third of filled seats open to merit reclaim. After CEC 5, ordinary seat rules apply. Every two CECs, every founder seat is re-earned or opened.

Founder votes are excluded from their own reclaim decisions. A single active Founder cannot hold amendment hostage forever. Root amendment needs unanimous sitting Founders, or twelve of thirteen live seats with EVL concurrence (1.5) once thirteen seats are filled.

While seats are reserved, unanimous sitting Founders plus EVL stand in for the 12-of-13 path. After 90 days of a pending Root motion with a named dissent, if that Founder is confirmed dead or captured by two geographically distinct biometrics, the seat is void for that motion only and the count proceeds. After one CEC of a published Root motion that holds EVL plus two-thirds sitting Founders plus 90% Command-Tier VCI, a single Founder dissent auto-converts to the 12-of-13 path even while seats are reserved. Founder eligibility after CEC 2 uses the same merit-reclaim and external attestation as later seats. No Founder sits more than two consecutive command tours in the same function. Resignation does not close 7.27. For the first two CECs, Founder deliberations, VCI calibration, Tabula rates, and first personnel selections write Speculum in plain language as they are made.

Phoenix cannot amend Root Code or fire on a reporting blank alone. Silence of the top 1% of adults by VCI is not a trigger. Positive liveness failure — death or capture — must be confirmed by two geographically distinct sub-nodes plus a Fallback-anchored biometric from a non-interested leg, and must not be coordinated removal. Three false Phoenix windows auto-void the triggerers and open 6.6. Three lawful Phoenix windows in a row move the Node to Dormancy (8.3). Phoenix mint cap is 3.1. Phoenix cannot add speech exceptions. Shard-Boot: if no Steward lives, Phoenix interim Steward is named by a geometric quorum: 7 of 21 pre-published successors drawn from at least five lineages and two geographies, plus EVL or Fallback. In a Node that has not published 21 successors, seven Protected adults from at least three lineages with intact shards and two independent witnesses may name the interim Steward. The naming writes Speculum. Phoenix mint is itemized daily and reversible within one SMW by the reconstituted triad. Three people cannot cold-boot a Node. The 1.8 four-person path is Ultimus only and still needs reconstructed k-of-n Root, not one shard.

CEC is 270 days, opened when maintenance exceeds 70% of surplus, when signed-meter divergence exceeds the EVL error band across >10% of adults, or when SHI falls below 0.40 or hits an H_gen hard-fail (7.16). Fat watts with a flat complexity and I_built line across two short clocks put SHI on watch; a third flat clock opens CEC even if surplus is fat. I_built decay across two short clocks counts as a hard-fail contributor to SHI (7.16). If high-VCI outflow or Axiom-8 collective exit exceeds the published CEC threshold, shedding pauses and a stabilization window opens instead of feeding a death spiral. The complexity budget—ordered-complexity spend constrained by post-BOT surplus—is funded from the 7.5 envelope.

Governance and surveillance sit inside this envelope, not Animus 5.5 or 5.6. Shed governance first, then surveillance, when winter comes. A unit that cannot show a published failure or save in two SMWs is an Entropy Event.

Appeals of VCI run through EEP. Emergency re-score on appeals from ≤10% of the population completes within one CEC with no cascade freeze beyond a single re-score cycle.

Protected, Neutral, Unprotected, and Excision each need EEP. Resourceless-Protected is the status when Transport has nowhere to go. That hold is capped at one SMW, then EEP must place, contract a peer rescue, or convert the file. If no peer accepts inside the cap, Transport auto-assigns to the parent’s Stability-Reserve-funded Outpost. Total hold from notice to final placement caps at one CEC (270 days); the 90-day Transport clock runs inside that cap. A coalition of Nodes refusing capacity does not mint open-ended detention.

EEP converts multi-domain sensor data into legal outcomes after a provisional window. Raw readings carry signed hardware attestation (seal, serial, last calibration hash). A reading that fails provenance is excluded and writes Speculum. If more than 10% of a domain’s sensors fail attestation in one short clock, that domain is suspended from EEP until EVL inspects. Sensors and signed meters outrank fame, office, and stage. Who sits Iudex and jury is 7.51. The 99.9% TPS gate is fixed in Root (1.5) and is not EVL discretion. Two independent substrates meeting VII.53 criteria must agree within 0.05% before the 99.9% gate fires. TPS ≥ 99.9% confirms. 90–99.8% is probabilistic, with restricted liberty/freeze up to 90 days (not 180) then Sortition; pre-ratification confinement is bondable and reverse-costed onto a false filer. Below 90% is dismissed.

Refile is allowed. Three or more low-TPS accusations against the same entity within 180 days trigger Sortition review of the pattern. False accusation at confirmed TPS requires Sortition confirmation before mirror punishment.

Good-faith accusation later disproven carries no penalty. Evidence tampering and judicial corruption are high-tier. Process cost is borne by the Node on a first filing.

Repeat filings to exhaust a party are Lawfare (7.28). Insanity is not a defense to high-tier crime. A physician may hold a non-capital disordered person in an asylum; it does not hide killers.

Age does not shelter high-tier acts.

Formal notice, 72-hour preparation, physical relocation outside Node territory within 90 days. The person keeps what they built. A retired five-ESU mass cap limits what the Node carries at its own cost and does not extinguish title (Axiom 5).

Transport energy is borne by the Node. Destination order: nearest Node with capacity, most recent legacy border, or designated Outpost with 3 months of rations and one-way comms. If capacity is exhausted, Resourceless-Protected holds until a door exists (defined as another Node declaring spare capacity above BOT and mutual Bitcoin checkpoint acknowledgement under 3.4). A destination Node may not self-declare ‘no capacity’ as a detention tool. After one SMW the parent must place, contract a peer rescue, or open an Outpost; if none accepts, auto-assign to the parent’s Stability-Reserve-funded Outpost. Refusal to place after the cap is office-falsehood of the sitting Steward. Coalition refusal is the same file.

Re-entry is 7.12.

Reserved exclusively for verified high-tier crimes at TPS ≥ 99.9%, which number is Root-locked and not an EVL dial. Two independent substrates meeting VII.53 criteria must agree within 0.05% before that gate fires. The ordinary clock is a 30-day provisional hold. Appeal may be filed any day during the hold.

If appeal is filed within six hours and TPS < 99.9%, the hold may extend to the 90-day probabilistic tier under 7.8; EVL sets the final TPS determination and a Sortition jury ratifies the irreversible act. Compressed Capital Docket: when independently attested meters on two substrates show a Nefas act (7.52) in motion or just completed, and those two substrates do not share custody, EVL may open a 24-hour clock only after two independent substrates meeting VII.53 criteria show the act and a third independent attestation confirms no shared custody. If the two primary substrates share custody, a third independent attestation is required; colluding auditors trigger mirror Nefas. Sortition of seven sits the same day; ratification or refusal lands within that day. EVL does not define the 99.9% number, does not sit the Sortition, and does not vote ratification. EVL may freeze and re-score; it does not own the gate. A constructed file (no live sensor of the act) never uses the 24-hour clock; it uses the 30-day hold. A single fabricated meter does not open the Compressed Docket.

Neither the street nor a rumor ratifies. A person found high-tier for repeated killing, if EVL records real yield, may be offered Carcer: published-term labor at a minimum rate, reviewable each CEC, with a right to refuse labor and take Neutralization instead. It is not a slave as a thing. A live 7.10 hold closes Axiom 8. The accused keeps title and baseline ESU inside the hold; he does not walk the gate. If they will not or cannot yield, Neutralization runs. After the hold, a Sortition jury must ratify before the irreversible act.

Machines brief and may reconstruct evidence; humans pass the finding. Silicon does not hold execution authority. A 99.9% TPS without ratification is void as a kill order. Section 6.8 cannot hot-key this. Biological agents on the act must be outside the accusation chain. Halt-in-Progress (6.2) is not this section. A captured person waits here. Age, office, cloth, sex, and medical labels do not move the list. A woman takes the same sentence as a man for the same act.

Every Protected entity keeps a living cryptographic inheritance contract. Default heirs: offspring by maturity and realized work, then spouse, then parents, then Stability Reserve. Same-generation children share equally.

A spouse takes a child’s share plus 20%. ESU settles in 24 hours; goods in 90 days. Disputes go to Sortition of seven within 30 days.

A seat does not inherit unless the heir already clears that tier. The 5% lineage cap is enforced every SMW.

180 days out. Six months net-positive after return. UID recheck. Protected status is available after twelve months. Fee is 50 ESU (adjusted quarterly by Planetary Constants Vector). Terminal Debt cases may defer the fee across the six net-positive months. Two re-entry attempts allowed; a third requires Founders.

A verified non-edge ending of a conceived child (2.13) is a closed door. No third attempt. No Founder waiver.

Three advisory mixture-of-experts. Humans decide. EVL is dual-redundant on another substrate and can freeze/re-score. Defining TPS methodology and opening the Compressed Docket are split: EVL may re-score; opening the 24-hour clock on Nefas requires the two-or-three substrate rule in 7.10 and does not sit in the same throat that wrote the TPS method packet that cycle.

The Oracle signs meters and holds roots the Node cannot forge. It is not a fourth Arbiter or second EVL. EVL decision on Arbiter divergence is final for one short clock only and then requires Sortition review. It is not an unaudited last word.

Error is addressed at the next 90-day re-score. The Arbiter runs without pause; EVL runs every 90 days, or on a Major/Critical Event, or when 10% of adults appeal. Data enters the air-gapped Arbiter only by dual-custody physical medium inserted by two named humans; the insert writes Speculum; the medium hashes against Trinitas before processing. No network path exists. If dual-custody cannot be met, the Arbiter holds last verified state and the gap is a Major Entropy Event. If a signed meter for a UID or domain drifts more than 1% net over three consecutive short clocks, EVL fires at once.

Floor is set jointly by EVL, Fallback, and Oracle. A Node cannot raise its local floor to free sub-floor theft; local change may only tighten (lower the numerical floor) with EVL sign-off. The global minimum stands. A single sample below it is noise on the whisper ledger. From the floor to 0.1% the tick is flagged/corrected without penalty. From 0.1% to 1% it is an Entropy Event. Above 1% the system freezes until EVL completes a re-score (max one SMW).

Every SMW the Node publishes a packet; every CEC a harder packet. Triple Arbiter, EVL, and Oracle must all sign. If any seal is missing, 7.20 opens and the Node re-publishes under 4.3 until the three-seal packet is restored. An SHI computed only by the Arbiter is a diary.

SHI = 0.25 H_var + 0.20 H_tier + 0.20 H_gen + 0.20 H_maint + 0.15 H_audit. H_var watches VCI distribution (dynasty wearing a score is a fault). H_tier watches for Tier-S islands feeding Tier-C dependents.

H_gen is Ne and heterozygosity; below floor, this component hard-fails. H_maint is 1 minus maintenance-to-surplus over 0.70. H_audit is 1 minus the fraction of lines where Arbiter/EVL differed by >1%.

Optional H_mean from 5.5 cannot wash a hard-fail. At 0.80 (no component < 0.50) the Node is nominal. Between 0.60 and 0.79, or any component < 0.50, it is on watch.

Between 0.40 and 0.59, or two components < 0.50, pressure. Below 0.40, or H_gen hard-fail, a CEC opens even if watts are fat. Any single hard-fail caps SHI at 0.59. A surplus that stays above BOT while C and I_built do not rise across two short clocks is treated as a component on watch; it cannot be washed by H_mean.

Each CEC names the dominant diverging term, its 30-day free-growth rate, the corrective action, and the 90-day effect. Negative-feedback gain must exceed positive-feedback gain or the guarantee fails. Two consecutive fails on the same term apply existing tools: cap tightening, seat reclaim, 8.3 merger, or Axiom-8 fork. No new crown.

Clock starts when SHI, ascent constraint, or a Critical Entropy Event crosses a bound. The first real act (freeze, shed, reclaim, inspect, Transport, or CEC) must land within one SMW. Confirmed Critical events pre-authorize the written interim tools; ratification follows. Speed of attack does not mint a new room. Founders may use existing tools but cannot amend axioms, widen ε, raise the mint cap, cancel the Oracle, or add speech exceptions.

The Node may be amended, forked, merged, or shut down. It may not at the expense of: computability of Omega, VCI, SHI, and ascent constraint from signed meters/published weights; error floor and Oracle root jointly set; biological flourishing as binary sex hardware, Ne floor, intact-family priority, the ban on rewriting sex by identity, the 99.9% TPS gate, and the Protected-List grammar. Arx may tighten caps and open reclaim but cannot repeal Axioms 1, 3, 4, 7, or 8.

LOCKED requires a compiled self-audit packet signed by Arbiter, EVL, and Oracle.

Triple Arbiter runs continuously on meters, VCI deltas, SHI, key-use, Founder votes, and appeal outcomes. Anomalies page an Integration officer within one hour. Divergence above 7.14 bands opens 4.3.

At all times, three external auditors are live: EVL (distinct substrate), External Oracle (keys/raw-meter subset Node cannot rotate), and a rotating peer-Node or analog-sapphire team (non-residents). Until three peers exist, two distinct Fallback Anchors fill external seats; one entity shall not occupy two of EVL, Oracle-courier, or Fallback. A young system does not collapse external audit to one throat. When fewer than two peer Nodes exist, every peer-signature slot is filled by a distinct Fallback Anchor. The Node does not sign as its own peer. Collusion of all three is a Critical Entropy Event (open to citizen audit under 7.22). The shards — a Sortition of thirteen plus two peer Nodes — may void the colluding set and name replacements. Founder reconstitution is backup, not the only door. Auditor selection after activation rotates and is confirmable by the People; founders do not own the list.

Founders may not dismiss an auditor mid-window except for EEP-proven crime. All three sign the SMW SHI packet. Two-of-three may freeze minting; one-of-three may only flag.

The three seats rest on distinct physical substrates: analog sapphire, a separate fab and custody chain, and a peer or Fallback the Node does not print. Divergence among Oracle, EVL, and Fallback above the published band suspends legal use of the disputed meter until Fallback Anchor signs. No Neutralization, mint, Franchise change, or Root etch proceeds on a disputed meter. Oracle, EVL, and signed meters are activation conditions; a camp without them is not a Node.

Protected citizens may audit published ledger lines, SHI packets, Curriculum diffs, and meter hashes. The Node provides read tools and a bug channel independent of the accused subsystem. A confirmed unique finding moving VCI or mint by >7.14 floor pays an ESU bounty and a Character Event (Epistemic Courage).

Findings opening Major/Critical Entropy Events pay larger bounties and a temporary VCI floor-raise for one SMW. Weaponized false findings are evidence tampering.

Four standing units (functions, not thrones). No unit commander holds a Founder seat, Oracle courier role, or Domain Commander of the plant they watch in the same SMW. Debug breaks the running system; Audit verifies and runs the citizen-bounty desk; Defense holds the Firewall, escorts Contact Cell, and kills attacking processes under 6.8; Improvement holds Homo Novus research and meaning-floor tools.

Command turns every CEC; members may not serve two consecutive tours in the same unit. Budget is within 7.4/7.5.

Protected/Neutral citizens are invited to debug. Tools and channels are provided as in 7.22. Citizen patches integrate only if reproducible against published meters/ledgers, align with 1.2, carry Audit/EVL signatures, and do not widen ε, mint off-split, rotate the Oracle, or rewrite Axioms 3, 4, 7, or 12.

No single human, lineage, unit, Arbiter, or foreign mind holds absolute control of meters, keys, mint, EEP, SHI, vaults, or the Physical Firewall. No single acquisition — one auditor, one Founder, one Commander, one sensor farm, one shard, one Memory model — yields system control. The coup is the meter behind the gate or the signer beside it. Any clause gathering two of mint, Oracle, EEP, and Firewall in one natural person is void. Steward Etch plus Steward Bellum plus Phoenix in one throat past one CEC is the same void.

Every Protected adult with verified Genomic UID may cast on published questions (statute, Campus, plant, intake, Founder reclaim). The ledger is open software, decentralized, and end-to-end verifiable. Weight follows VCI, cognitive measure, and JI. Cognitive-measure weight does not inherit. A child’s Franchise starts from that child’s own measure and VCI.

No person, lineage, or Public Body holds >2% of a live ballot; lineage weight aggregates into that same 2% cap (3.5). “Whale” status is void and forces divestiture under 3.5. Qualification: maturity, Protected status, and the published cognitive floor. Franchise is lost if status falls below Protected, EEP finds repeated harm, or two consecutive mastery years are failed (2.4).

It returns when conditions return. Import of persons to dilute a ballot is treason (8.6).

Office-holders are tried as persons for crimes. Resignation, rotation, or end of term does not close EEP. No political immunity or dignitary pause. Findings against office-holders publish live under 6.7. Restoration of office after a high-tier finding is void.

First good-faith filing is free. A second claim on the same facts within one SMW requires Sortition leave. A pattern of filings to exhaust or silence a party is Lawfare and a high-tier process crime. EEP cost, time, and tools apply equally; rank buys no faster/slower court.

Default tours for Domain Command, unit command, Founder seats after the first etch, Vigiles command, Iudex, and Cohors Praetoria command last at most one CEC plus one SMW, then rotate. Return is allowed after one full CEC out.

Extension: a named seat may continue past that default when three conditions hold in the same packet — published meters show above-band yield for that role; an external rotated evaluation pool, not the incumbent, finds no successor with a superior signed packet; the living triad plus one peer Node sign the extension. The incumbent does not define ‘superior.’ Each extension is one CEC. Cohors Praetoria command and Steward Bellum have a hard cap of three consecutive CECs; total Steward command across Etch and Bellum combined also caps at three consecutive CECs. A fourth is void at sight and is office-falsehood. The evaluation pool for any extension is externally rotated and blind; self-extension is automatic 6.6. It is not inheritance. It is not immunity. Failure of the meters, a successor with a superior packet, or a triad vote ends the tour at the next short clock. A seat that cannot be removed is the refused king (5.32). Public humans publish VCI, Character Events, and open-source votes each SMW.

When SHI, ascent, or a Critical Event trips 7.18, the Arbiter proposes a patch from existing tools; EVL scores it; an Integration officer accepts/rejects within one SMW. A second independent leg must attest each accepted patch. Accepted Module patches are rate-limited to a published count per SMW; flood of reproducible-but-adversarial patches is Entropy of the proposing pipe. Rejected proposals publish reasons. Accepted proposals etch as Module patches (1.5).

The loop cannot touch Axioms 1, 3, 4, 7, 8, Oracle, Ne floor, 7.10, or speech exceptions. A loop attempting this is an Entropy Event. Regeneration uses the shard set in 1.8.

Mint, plant spend, Public Body take, office pay, Stability Reserve, war spend, intake cost, and pharmacy liability sit on an open ledger hashed to sapphire each cycle. Personal household accounts stay private except when EEP opens them. Hidden public spend is 6.6.

A rape, murder, child-sex, or high-tier charge told as fact and later found false at TPS ≥ 99.9% is itself high-tier after Sortition confirmation (7.8). Mirror punishment runs only after that confirmation. A confirmed false rape charge is Nefas (7.52): the accuser takes the sentence the accused would have taken. A good-faith error later disproven is not this section. Nefas mirror for a false rape charge applies when the initial filing itself was fabricated: no medical or sensor packet at filing, or testimony contradicted by the accuser’s own prior statements. If the report was made within 72 hours of the alleged act, carried a published medical or sensor packet, and TPS later fell because new evidence arrived, the accuser stands ordinary 7.32 and does not sit Nefas. A pattern of false sex-charges is Lawfare plus this section.

An office-holder who states as fact a meter, ledger, karyotype, crime count, or war condition he knows is false commits office-falsehood. It is high-tier when the lie moves mint, Franchise, Neutralization, or war. Ordinary error corrected inside one SMW is not this section. Resignation does not close it. Under a sworn inquiry the officer answers the meter. He may not dodge, stall, or rename a woman. A woman is an adult human XX. Silence, word-fog, or a second definition is this room.

Founders, first etchers, and later officers hold no hidden root, off-switch, back door, or mega-key that can freeze meters, mint, EEP, shards, or the Firewall without the living triad. A discovered back door is high-tier. Holographic shards and Phoenix remain the restart. The system does not depend on its makers.

The Node designs the next better plant, school, and meter under 1.5. It keeps a published unknown-band: shocks not in the model. Self-heal may not rewrite Axioms 1, 3, 4, 7, 8, Oracle, Ne floor, or Neutralization. Silicon may draft. Only the triad etches. A new constitution written by silicon alone is void.

The Node does not spend a Protected life, house, wage, or child to soothe a foreign grief, a camera, or a greater-good sermon. Charity is private. Intake remains 8.6. A sob-story does not move mint, border, or Neutralization. A real fork with no third rail — save few or save many — is 7.48, not this room. Empathy for one face does not buy a pile of dead.

A charge names the act, the actor, and the room. The file is public to the accused. Witnesses face him. He is not made to confess. The same act is not tried twice after a sealed verdict. The clock is published and short. Counsel may stand with him. Search of house, body, paper, or channel needs a particular writ tied to a named act, except Halt-in-Progress in plain view. Neutralization still requires the hold and the seals. Error corrected inside one SMW is not a second trial.

No troop, cadre, or office sleeps in a private house without the owner’s yes, except a published war-billet paid at market and time-boxed. Papers and channels are closed to the desk except under 7.37. A household is private until EEP opens it. Occupatio remains theft.

A standing Vigil Cell runs without pause: plant, genome, mind, law, failure, and popular myth. It publishes findings each SMW. It may propose patches under 1.5. It may not etch Root, rotate Oracle, or sit Neutralization. Better ways to raise healthy fertile people and net energy are its only brief. Funded experiment is Lyceum (4.23). A silent Vigil is an Entropy Event.

Scaena is 5.36.

Recurring kills: unbacked mint and fiscal overstretch; elite overproduction with no rotation; succession without a gate; border overstretch and tribute; bread without yield; school capture; coin-clip; meaning collapse while watts stay high; war without skin; a desk that cannot be removed; a lie that becomes the air; one throat holding two crowns; fertility below replacement; inability to name a woman or a crime. Each already has a room. A Node that repeats a listed kill after the room exists is an Entropy Event. History class is this list plus 5.32, not a hymn.

Any role that writes statute, moves mint, opens a gate, commands a Domain, sits Steward, or sits a Founder seat after the first etch, is a leading role. A leading role is filled only by Franchise on a published packet, then sealed by the living triad. Appointment by letterhead, union, bank, or foreign commission is void at sight. Specialists may work. They do not rule. A supranational pen over a Node is 8.8.

A man who asks for a leading seat publishes his promise as a packet: acts, meters, dates. Humans and silicon parse it into Lex-shaped tasks before the count. After the count he etches the packet. Audit is continuous, not a four-year nap. Memory plus a second independent book score the packet each short clock. On a miss Memory may Halt the official act at once under 7.44. A miss with no published cure inside that clock is removal after triad review. A mob, a rival, or silicon alone cannot fire him. Silicon may pause. Only the triad removes. The calendar does not protect him. A term is a work window, not armor. Speech on the stump that is not in the packet is not law. The packet is law.

Official motion — mint, gate, school statute, sword order, seat act, plant command — must cite a live room before it moves. Memory compiles that cite against Axioms and Lex. No cite, or a cite that breaks Root, and Memory Halts the motion at the switch. The man may still speak. The desk may not spend. Halt is not Neutralization and not etch. Steward and People may override a Memory Halt only inside 7 days, and only if they cite a live Root-locked room verified by an independent external leg (peer Node or Fallback). An internal leg alone does not suffice. The override writes Speculum immediately. A blanket override past 7 days is Critical Entropy. Every Halt and every override publishes its citation. Silicon may not invent a new crime. Silicon may not freeze private speech, pairing, or a booked Agon packet. A Halt that Memory cannot show on a meter is itself office-falsehood of the models and EVL pulls them.

Default is deny. Years of “we will strike it later” are refused. An act without a room is not late-illegal. It is unborn.

When SHI derivative, intake rate, mint-stress, or a doctrine’s official amplification crosses a published band twice inside one short clock, and two independent sources meeting VII.53 criteria confirm each shock, Memory slams Gelu. A single leg cannot self-trigger Gelu. Gelu freezes official pipes only: extra mint, gate-widening, school pushes, Public-Body broadcast stacks, automatic promotions, and any packet that has no room. Private speech stays. A booked Agon stays. A Halt-in-Progress stays. Gelu is time-boxed to one short clock. It auto-reverts at 72 hours unless an uninvolved leg plus Fallback or peer confirms an extension. Confirmation extends it only to the end of the current short clock and no further. If internal meters show all triad legs healthy and the external confirmation is delayed, an uninvolved leg plus one peer may force a manual revert after 48 hours with a published reason. Steward and People must release, narrow, or convert it to Interdictum plus EEP before the box ends. A Gelu opened by Steward or Memory triggers an unannounced Sortition audit of the trip inside seven days; the audit cannot be waived by the throat that opened it. Triggerer liability for a false Gelu is immediate 6.6, not post-hoc after the freeze has done its work. Each shock that opens Gelu must be a confirmed Critical-class event, not a mere threshold tick. Gelu does not etch Root, drop Murus for good, or Neutralize. A second Gelu in the next clock without a published cure opens Critical Entropy. Silicon may not Gelu ridicule. Silicon may not Gelu a household. The comet is the cascade, not the joke.

Gelu is layer one. If Gelu does not fire when a confirmed Critical-class event crosses the published band, fires late, leaks the pipe, or is held by a captured Memory, layer two runs. Sub-Critical threshold ticks do not open Expurgo. Layer two is Steward plus People plus a Firewall commander drawn by Sortition for that CEC who holds no Bellum seat. It requires attestation from a triad leg that did not open the original Gelu trigger, plus two independent peer-Node or Fallback legs meeting VII.53. An uninvolved triad leg alone is not enough when one other triad leg is already captured. It does not ask the Memory that failed. It cuts the official vector: school packet pulled, extra mint killed, gate slammed, Public-Body stack unplugged, automatic promotions void, the named payload listed as Unborn. That list is published. Re-ingest of the same payload needs a new etch under 1.5. Private speech still moves. A household shard still boots. Expurgo is not a mind-wipe and not Neutralization of bystanders. Officers who pushed the cascade after Gelu should have fired stand EEP. Two failed Gelu-plus-Expurgo cycles in one CEC open Dormancy or Fork. The house would rather sleep than swallow the comet.

Every official motion writes a live line: category, what, who, where, when, how, meters, action taken, status now. Categories include mint, gate, plant, school, sword, seat, Gelu, Interdictum, Expurgo, EEP, Entropy Event. Protected eyes read it 24/7. A missing line is the act itself void. Each line hashes to sapphire inside the short clock, countersigned by Oracle or Fallback. A line that will not match that hash is void. The Node does not certify its own log alone. Household ledgers stay private until EEP opens them. The only delay is a published tactical box during an armed raid on plant, vault, or child-house, hard-capped at four hours, then the line appears in full. During the box, official motions need two-of-three triad sign in real time. A single-throat motion in the box is void even if executed. Steward Bellum may add one further four hours with Memory concurrence; the extension itself writes Speculum at once. Lines that move mint, sword, school, or status carry a plain-language sentence a median adult can read. A secret society, lodge, or quiet cell in a leading seat is void at sight. Leadership that will not stand in the log is not leadership. Dark rooms do not write Root.

Every Entropy Event on Speculum carries a live grade: P0 Critical, P1 Major, P2 Minor, P3 Whisper. P0 is a cascade that will metastasize through school, mint, gate, or body if not cut now — a needle-and-mask liturgy, a replacement flood, a plant kill, a massacre-speech machine. P0 takes all spare surplus at once: Gelu, Interdictum, Expurgo, EEP, published cut of the vector. Lower grades wait if the house cannot lift all weights. If it can, it lifts all, still in that order.

When a P0 fork has no third rail and some will die either way, the triad chooses the path that minimizes Protected dead and stops the cascade fastest. One face on a camera does not outrank many lives off-camera. Hostia Nulla still blocks sacrifice-for-a-story. This room is triage, not a sermon. After the cut, Speculum shows the grade, the fork, the count, and the status.

Every official seal carries a live signed hash shared across Steward, Memory, People, and a rotating shard sample. Drift without a published triad grant is stealth-compromise. Isolation of a leg requires Fallback or a peer-Node confirmation. No live leg declares another dead. Ambiguity about which leg is dead halts etch and sword. Two-down containment-root splits across the live leg and a peer observer. The peer observer is the first available of: a named pre-published successor from the 7.3 slate, a Fallback Anchor, or a Sortition of seven Protected adults drawn from at least three lineages who hold intact shards. If none can be reached inside 72 hours the live leg holds containment-root alone and must call Phoenix. No single surviving throat holds etch-root. Isolate only after that confirmation, then uncompromise, then replace. Two live legs change the tire. Memory rolls to the last clean hash and replays the signed log after it.

Two legs down: the live one holds containment-root only — Halt, Gelu, Expurgo, freeze mint and gate, call Phoenix on shards. It does not etch Root, drop Murus for good, or Neutralize without a later live People seal. If the live one is Memory, silicon contains; it does not become king. If the live one is Steward or People, same box. Three down: dead well; Phoenix elsewhere; three heads, never four. Seals after drift are void. Seals before drift stand.

Steward, Memory, and People heartbeat a signed hash each short pulse. Citizen shard-fragments sample it. Reconstruction for a Signum check uses a rotating k-of-n draw that does not assemble etch-capable Root. A better primitive than a broken digest may be etched; the joint is match-or-isolate, not the brand of the hash. One bit off without a published grant isolates that leg and writes Speculum. No face needs to look guilty first. Gathering in the dark is the hit. Containment-root on two-down is a fire axe, not a crown.

Crime is judged as follows. Vigiles or a lawful accuser open a file that names the act and the actor (7.37). EEP scores the sensors. Below 90% TPS the file dies. From 90 to 99.8% liberty may freeze and Sortition sits. At 99.9% the statutory hold and the terminal gate remain 7.10.

The jury is Sortition from Franchise who hold Cursus Gradus Ius at or above the published floor. The Iudex is a rotating certified seat drawn from the same pool, never a career, never a life, never the Vigil who made the catch. Silicon briefs and may reconstruct. Humans pass the finding. A machine does not hang.

Testimony is heard. It does not outrank a signed meter. Office, cloth, lineage, and Scaena-fame add zero weight. A man does not judge his own case, his house, his Adjutor, or a craft-rival on the same packet. Recusal is automatic; refusal to recuse is 6.6.

The Iudex may halt Lawfare (7.28), keep the clock short, and send a false accuser to 7.32. He may not invent a room. No crime without a prior room (7.40). Appeal is the hold already written in 7.10 and the VCI path in 7.6. There is no second sealed trial of the same act (7.37).

Nefas — also called Sine Venia — is the closed capital category. It is non-negotiable, Root-locked with Neutralization, and runs the Compressed Capital Docket: EVL may open a 24-hour clock only after two independent substrates meeting VII.53 criteria show the act and a third independent attestation confirms no shared custody; Sortition of seven sits the same day; ratification or refusal lands within that day (7.10). No pardon, petition, office, cloth, or medical label moves the list. Machines brief. Humans pass the finding. A 99.9% TPS without ratification is void as a kill order.

The list is closed. Adding to it follows the fast-path high-tier rule in Prima terminology, not a mood.

Nefas acts, when signed meters show the act, or for statute, school-fact, mint-rule, or official command lines, when Speculum plus two independent substrate attestations of the issued text and its effect show the act:

I. Murder without defense.

II. Rape.

III. Sexual act with a child, and related traffic.

IV. A child who killed a parent, as already named in 7.10.

V. A judge or officer whose unlawful release is followed by a new high-tier killing or rape by that person (6.6).

VI. Furtum identitatis.

VII. Solicitation of massacre (6.11).

VIII. Official command of collective guilt by ancestry — statute, school-fact, mint-rule, or quota that names a stock for eradication, dual-law, or unique guilt-to-harm. Private speech naming the idea to refuse it is Axiom 3. Installing it as weather in an official room is this line.

IX. Deliberate hidden adulteration of public food channels (Annona, BOT stores, Campus, Tabula ration) with undeclared harm (4.12). A clean food with a published packet is not this line. A private plate is not this line. Concealment of harm on the public plate is.

X. Performance, inside a Node, of a non-edge ending of a conceived child (2.13).

XI. A rape charge told as fact and found false at TPS ≥ 99.9% after Sortition confirmation (7.32). The accuser takes the rape sentence.

XII. Solicitation of massacre, or an organized replacement-and-reparation campaign as public duty (6.11, 6.16), at TPS ≥ 99.9%.

XIII. Media that sexualizes a child, or that installs a Command Test command as weather on a child’s channel, at TPS ≥ 99.9% (5.39).

This category is interplanetary security: plate, mind as official command, and the killings already on the terminal gate. It is not a license to Neutralize “dogma” or “propaganda” as such. Axiom 3 and Axiom 12 private conscience remain. A creed spoken in a house is not Nefas until it is installed as public command under Command Test I–VIII or under line VIII above.

Two substrates or sources are independent when they differ in at least three of: physical location (geographically distinct sites), custody chain (no shared key-holder or operator), vendor or hardware lineage, protocol stack, and attestation method. Shared custody of the primary two substrates requires a third independent attestation before any 99.9% gate, Compressed Docket, Gelu confirmation, or Expurgo attestation. Fallback Anchors and peer Nodes count as independent only if they meet the three-difference test against the Node’s own meters. A single entity may not fill two external auditor seats. Sensor provenance for the 99.9% TPS gate, Gelu, and Compressed Docket must carry cryptographic hardware attestation independent of any Node-controlled meter; failure of that attestation voids the reading. Published independence checklist is hashed to sapphire at activation and at each CEC.

On single-root death or compromise, remaining roots continue to sign for one CEC. Replacement is etched by multi-party ceremony across three mutually uncorrelated externals (peer Nodes or distinct Fallbacks) that meet VII.53 independence, with published no-backdoor proof, countersigned by Founder Council (or 12-of-13 path) plus a People Sortition sample, and written to analog sapphire. The challenge window of one SMW applies. Compromise of the full set flips to sapphire triangle permanently until a full new N-of-M set is etched under the same ceremony; no single Fallback or Steward etches alone. EVL and Oracle (remaining) must both attest the ceremony packet.

A seceding group that fails to leave the Continuity Bond (Axiom 8 formula: N_parent × BOT_local × one SMW physical plant, meter, spare geometry, verified by EVL plus named engineer from a peer or Fallback) commits Occupatio of the well. The parent Node may, after one SMW notice on Speculum and EVL confirmation of shortfall, seize equivalent plant or ESU from any remaining joint assets, inter-Node trade balances, or Continuity Bond partials. A peer Node or Fallback arbitrates disputed valuation within one short clock; its finding is final for the escrow size. Named engineer is designated by the parent from a published peer or Fallback roster and confirmed by EVL. Failure to post the bond freezes the fork’s Rete privileges until cured. Tokens alone never satisfy the bond.