Strings are not people
Visitors, anonymous claims, qualified identities, feature commitments, beta activations, and active users remain separate numbers. Only the declared qualified or committed class enters a threshold.
Live support · capacity · trust · readiness ledger
Features do not unlock because a progress bar filled once. They become eligible only when qualified demand, sustainable support, effective capacity, trust quorum, and operational readiness all meet their published requirements—and stay healthy through a proof window.
No pay-to-vote governance. No imaginary capacity. No automatic activation.
Platform-wide truth first
Production standing has not been loaded.
One public state machine
A lifecycle label is an operating statement, not a marketing mood. Threshold changes require a dated explanation. An unlock that falls below its maintenance floor shows the failing requirement and recovery window.
Feature ledger
Unpublished thresholds show as unpublished. Missing signed measurements show as unavailable. Neither state produces a fake percentage.
No feature matches this view.
Public methodology
Advertised disk, bandwidth, compute, or geography never enters an unlock score by itself. Measurements must use privacy-safe signed aggregates and an independently reviewable methodology.
Visitors, anonymous claims, qualified identities, feature commitments, beta activations, and active users remain separate numbers. Only the declared qualified or committed class enters a threshold.
Build reserve, recurring support, unrestricted platform reserve, and feature-directed support remain separate pools. A settled donation never silently becomes a subscription or vote.
effective = raw × availability × successful jobs × performance × standing
Launch targets then apply a safety margin before any shared allocation is promised.
The ledger counts only fresh possession of independently pinned gate keys. Every real domain still requires direct authoritative-DNS observation.
If the pinned witness quorum disappears, new proofs and publication lock. Existing valid domain credentials are not silently revoked.
Security, recovery, abuse controls, redundancy, monitoring, incident response, exit, and required independent review remain hard gates.
A weighted average would let an enormous donation disguise missing security or capacity. The weakest applicable requirement is the honest result.
The ledger establishes evidence eligibility. Existing signed Daemonet milestone records still require an independent release signature; this public JSON cannot activate a feature.
Maintenance and exit
The default model launches with 125% recurring-cost and capacity coverage, warns after seven days below the healthy floor, enters At Risk after fourteen days, and begins a sunset review if critical status survives its published recovery window.
Accept normal growth while reserves and operations remain inside policy.
Publish the failing requirement and recovery action.
Pause growth when necessary; show the remaining grace period.
Begin the announced sunset review rather than improvising.
Advance warning, new-user cutoff, export instructions, final operating date, self-hosting or migration guidance, entitlement behavior, and stored-data disposition must exist before a capacity-backed feature launches.
Audit the promises
The catalog is source-controlled and schema-validated. Live public aggregates are calculated server-side. The snapshot contains no individual names, node addresses, topology, fine-grained location, or application activity.
Help without becoming inventory
Private-alpha claims count only as top-of-funnel interest. Feature commitment, directed support, and capacity enrollment remain closed until their own cryptographic and operational controls exist.