Effect Quiescence Receipt: settling that nothing happened, on channels named before the interval opened

The problem

Proving something happened is a matter of producing the record. Proving nothing happened is the hardest evidentiary problem there is, and it comes up constantly.

An authority was suspended and the principal needs to establish that nothing was done under it during the suspension. A dormant account is claimed to have been dormant. A party under an injunction says it took no action in a window. A service provider says a decommissioned key was never used.

Name the parties. The party claiming quiescence asserts nothing happened. The party doubting it asserts something might have, and points out that the only evidence is an absence of records held by the party making the claim. An auditor can look at the logs and observe that there is nothing in them, which is exactly what a party that deleted the records would also produce. A counterparty relying on the dormancy has no basis to rely at all.

Three specific failures.

The first is that absence has no positive signature. An empty result set from a query proves nothing about whether the underlying system was recording. Logs rotate. Collectors fail silently. A monitoring pipeline that stopped writing at midnight produces perfect silence for the rest of the night.

The second is the channel enumeration problem. Even a genuinely complete record of one channel says nothing about the others. If the claim is that no effect occurred, somebody has to say in advance what all the paths were. A list of channels produced after the interval, by the party making the claim, can quietly omit the one that was used.

The third is settlement lag. Effects land late. An observation taken at the moment an interval closes cannot see an effect that was initiated inside the interval and settled afterward. A quiescence claim measured at the closing bell is systematically blind to exactly the effects most worth hiding.

Confidentiality runs across all of it. Channel identities are operational information. Listing every path through which an authority could take effect tells a reader how a system is built.

When the actor is autonomous the interval shrinks and the stakes rise. An agent can act thousands of times in a minute. A quiescence claim over a window is only worth something if the observation was continuous at a resolution that matches the actor's speed, and that is what a committed maximum gap expresses.

What the receipt binds

The schema is at https://thehiveryiq.com/.well-known/schemas/effect-quiescence-v1.json.

The lag_relation enum is the only one of the four that admits indeterminate, which follows from it being the only one computed over instants with drift.

What is deliberately not in the signed body

No authority is named and no channel is named. Both appear as keyed commitments computed in src/typed/effect-quiescence.js.

The keyed construction is HMAC-SHA256 keyed by the raw roster salt bytes over the concatenation of a UTF-8 label, a zero byte, the UTF-8 salt commitment, a zero byte and the UTF-8 value. Two labels are used: authority over an authority identifier, and channel over a channel identifier.

The salt commitment is a plain SHA-256 over the UTF-8 label effect-quiescence-salt, a zero byte, and the raw salt bytes.

The roster commitment is different and deliberately simple. It is SHA-256 over the UTF-8 string formed by the label channel-roster, a NUL character, and the sorted channel commitments joined by NUL characters. Sorting gives one canonical value per set. The NUL separator cannot appear inside a hex commitment, so two different channel sets cannot collide into one roster value. This is what makes CHANNEL_SET_COMPLETE work: recompute the roster commitment from the reported channels and compare it to the committed one.

Linked artifacts appear as digests. The prior effect.roster receipt is committed by a SHA-256 over its canonical envelope body under the shared rule of recursively sorted keys, no whitespace, non ASCII escaped as lowercase \uXXXX. The receipt envelope uses the shared Ed25519 construction over the ASCII string hive-receipt <receipt_id> <payload_sha256> <ts>.

The gates

Verification runs in this order and stops at the first failure.

1. SCHEMA. Validates the envelope against the effect quiescence v1 schema. A failure means the artifact is malformed.
2. ISSUER_KEY_MATCH. Resolves the envelope key through the trusted issuer key resolver. A failure means the signer is not trusted here or no resolver was supplied.
3. ENVELOPE_SIGNATURE. Runs the envelope crypto over the payload digest, the identifier form and the Ed25519 signature.
4. SALT_PRECOMMITMENT. Recomputes the salt commitment from the disclosed roster salt and compares. A failure means the salt does not open the published commitment.
5. INTERVAL_ORDER. Requires the interval to close at or after it opens. A failure means the interval does not run forwards.
6. AUTHORITY_REFERENCE_MATCH. Requires the authority commitment to agree between the receipt, the supplied roster and the disclosure. A failure means the quiescence claim is about a different authority from the roster it relies on.
7. ROSTER_RECEIPT_LINK. Requires the supplied roster envelope to be the effect.roster receipt the body names, bound by its envelope digest. A failure means a substituted roster.
8. ROSTER_RECEIPT_INTEGRITY. Requires the roster envelope to pass its own verification. A failure means the roster's own signature is broken.
9. ROSTER_PRECOMMITMENT_ORDER. Requires the roster issuance instant to precede the interval opening. A failure means the channel list was written after the window it covers, which is when a channel gets left out on purpose.
10. ROSTER_COMMITMENT_RECOMPUTE. Recomputes the roster commitment and compares it to the committed value.
11. CHANNEL_SET_COMPLETE. Requires the reported channel set to equal the committed roster, both in count and in recomputed roster commitment. A failure means a channel was dropped from the report or a channel outside the roster was added.
12. OPENING_ANCHOR_LINK. Requires each opening anchor to bind to its channel.
13. OPENING_ANCHOR_PRECEDENCE. Requires each opening anchor to be taken at or before the interval opened. A failure means observation started after the window did.
14. CLOSING_ANCHOR_LINK. Requires each closing anchor to bind to its channel.
15. CLOSING_ANCHOR_LAG. Requires each closing anchor to be taken at or after the interval close plus the committed settlement lag. A failure means the observation could not have seen a late landing effect.
16. CHAIN_CONTINUITY. Requires each channel's closing sequence to be at or after its opening sequence and requires the difference to equal the reported heartbeat count exactly. A failure means a heartbeat was dropped between the anchors.
17. GAP_BOUND. Requires every channel's maximum_observed_gap_seconds to sit at or inside roster.maximum_gap_seconds. A failure means observation lapsed longer than the committed resolution.
18. ADMITTED_EFFECT_COUNT. Checks the admitted effect counts and refuses a heartbeat count too small to span the interval. A failure means the reported observation density cannot cover the window claimed.
19. COVERAGE_RECOMPUTE. Recomputes all four coverage relations and compares them to the declared block. A failure means the coverage description is not what the disclosed facts produce.
20. VERDICT_RECOMPUTE. Recomputes the verdict and compares. A failure means the stated verdict is not supported.
21. BOUNDARY_CONSTANT. Requires the boundary to equal the constant. A failure means the non attestation was edited.

The verdict rule is worth stating exactly. Sum the admitted effect counts across channels. If the total is above zero the verdict is effect_observed, and that dominates everything: a positive fact survives any coverage weakness. Otherwise, if the reported set does not equal the committed roster, or any channel is broken, or any gap exceeds the bound, or any closing anchor was taken before the settlement lag, the verdict is coverage_incomplete. If the lag relation is indeterminate the verdict is indeterminate. Only when all four relations are affirmative does the verdict become quiescent.

The lag relation itself is computed conservatively over drift. A channel whose closing anchor could not possibly have been past the required instant makes the whole relation at_least_one_closing_anchor_before_settlement_lag. A channel whose anchor might or might not have been past it, given its drift, contributes indeterminate. Only when every anchor was certainly past the lag does the relation come back affirmative.

The mint path refuses caller supplied values the service must derive: the receipt type, the schema, the boundary, the coverage block, the verdict, the roster commitment, the salt commitment, the channel count and the prior receipt reference.

The boundary

This receipt attests only that a named authority, a channel roster committed before the interval opened, and a set of per channel continuity anchors satisfy the stated deterministic absence procedure over the named closed interval. A verdict of quiescent means only that no effect was admitted on the committed channels within the covered interval as reported by the anchoring parties. It does not establish that the roster enumerates every channel through which an effect could occur, that the anchoring parties are complete, honest, or diligent, or that no effect occurred outside the committed roster, outside the covered interval, or through an unreported path. It does not establish that any authority was suspended, revoked, exhausted, dormant, or unused as a matter of contract or law, and it does not establish quiescence of intent, capability, or obligation. A verdict of effect_observed does not establish that the effect was unauthorized, wrongful, or in breach. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

BOUNDARY_CONSTANT compares that text against the constant.

The sentence about the roster not necessarily enumerating every channel is the honest core of any absence claim. This instrument can prove that nothing happened on a named list of paths, observed continuously, past the settlement lag. It cannot prove the list was the right list. No instrument can, because that is a question about the world rather than about the records.

Writing it down is what makes the receipt worth having. Consider the alternative. A party produces a quiescence artifact that implies completeness. The other side finds an unlisted channel. Now the whole artifact is discredited and the party that produced it looks evasive. With the enumeration, an unlisted channel is a known category of gap that the receipt told you to think about, and the argument becomes a focused one about whether the roster was honestly constructed. The receipt survives, and the dispute narrows to a single question.

The effect_observed sentence does the same work from the other direction. A party will sometimes have to mint a receipt that records an effect it wishes had not happened. Because that verdict carries no finding of wrongfulness, minting it honestly costs nothing beyond the fact itself, which is the only way a party will keep minting these when the answers stop being convenient.

Adversarial cases

From test/effect-quiescence.test.mjs.

SALT_PRECOMMITMENT rejects a salt that does not open the published commitment.

INTERVAL_ORDER refuses an interval that closes before it opens.

ROSTER_RECEIPT_LINK rejects a substituted roster, and ROSTER_RECEIPT_INTEGRITY rejects a roster whose own signature is broken. Both halves of the roster are checked.

ROSTER_PRECOMMITMENT_ORDER refuses a roster published after the interval opened. This is the central attack. Wait to see which channel was used, then publish a roster that omits it. The ordering check makes the roster older than the window it covers.

CHANNEL_SET_COMPLETE refuses a report that silently drops a channel, and separately a substituted channel outside the committed roster cannot report quiescence. Dropping and substituting both change the recomputed roster commitment.

OPENING_ANCHOR_PRECEDENCE refuses an opening anchor taken after the interval opened. Observation that started late leaves a blind period at the front of the window.

A closing anchor taken before the settlement lag cannot report quiescence. This blocks the observation that closes at the bell and cannot see late landings.

A broken heartbeat chain cannot report quiescence. The sequence distance between the anchors has to equal the heartbeat count exactly, so a dropped heartbeat is arithmetic rather than a judgment call.

An observed gap above the committed bound cannot report quiescence. Observation that lapsed longer than the committed resolution cannot support absence at that resolution.

An admitted effect dominates every coverage weakness. This is the case that keeps the instrument honest in the other direction. A party cannot use its own poor coverage to downgrade a recorded effect into a coverage problem.

ADMITTED_EFFECT_COUNT refuses a heartbeat count too small to span the interval. Claiming continuous observation of a long window with a handful of heartbeats does not work.

A coverage block the disclosed facts do not support is rejected, and COVERAGE_RECOMPUTE is the backstop when every named relation gate passes. The second of those is the design point: the individual relation gates catch specific problems, and the full recomputation catches anything they missed.

VERDICT_RECOMPUTE rejects a verdict the disclosed facts do not support.

BOUNDARY_CONSTANT rejects a softened boundary sentence.

The minter refuses caller supplied verdicts and derived commitments, and refuses an empty channel report and a malformed salt.

Two positive cases anchor it: a fully covered silent interval is quiescent, and the receipt verifies standalone against the roster it names.

Performance

From hive-verifier-api/benchmarks/results-latest.json, measured at 2026-08-09T22:28:01.099Z at commit e167719f7d815809c6f55c5dde4495edf1c5615f over 200 iterations:

Local harness measurement on one machine and one Node version, recorded on Node v20.20.1, linux/x64, two Intel Xeon cores at 2.90 GHz. It is a reproducible measurement of this code, not a production latency guarantee.

How to run it

This type has no mint route. It is produced as an export by another route and only verified here, so there is nothing to authenticate against. The verify route takes no credentials.

• Host: https://thehiveryiq.com/v1
• Verify route: /verify/effect-quiescence

curl -sS -X POST https://thehiveryiq.com/v1/verify/effect-quiescence -H 'content-type: application/json' -d '{"receipt": <a receipt of this type>}'

Where it sits in the canon

Family: network authority. Category: typed receipt contract.

It depends on an effect.roster receipt, which is where the channel set, the maximum gap and the settlement lag are precommitted, and it verifies that roster rather than trusting the reference.

It pairs naturally with authority.revocation. That receipt classifies one action against a revocation. This one covers the interval after a revocation and answers whether any action occurred at all on the committed channels. Together they address a suspension from both directions.

It does not replace the anchoring systems, an audit, or any legal determination about dormancy. The boundary rules all of that out in the signed bytes.

Status

production_deployed.