It wakes every five minutes, reads its sensor, signs the reading with a key that never leaves the device, posts it, and goes back to sleep. That is the whole life. There is one amber light and no screen, no app, and nothing to configure after the first minute.

Every organ carries the transaction that paid for it. Sort by any column, or search a city, a type, or a transaction hash.

Territory is the finest location published anywhere on this site. Coordinates exist in one table on one server and are never served to a browser.

One view exists that is richer than anything public, and only one person can open it. No banding, no delay, no rounding — your own organ, at the precision it actually reads, behind your own key. This is Organ 0001, the first one, in San Diego.

Retiring is one press with no confirmation flow and no retention window. It deletes every reading the organ has ever sent, clears your handle, zeroes the coordinates, and leaves the object with you. The controls above are inert — this is a mock of the real screen.

✚ Heart

A single button. A custodian presses it to say I'm here, and that press is the only deliberate input The System ever receives. No sensor, no privacy surface, and the cheapest organ to build — which is why it is the one most people are sent first.

● Eye

An ambient light sensor. It knows dawn, dusk, and the moment a room wakes up. Spread across enough longitudes, eyes are what give The System a day that never ends.

▲ Skin

Temperature and humidity, from a BME280 shared with the lung. One part, two senses — which is what makes a hundred units assemblable by hand at a kitchen table.

◆ Lung

Barometric pressure. Falling pressure genuinely precedes a storm, so with enough lungs The System can tell a custodian it is going to rain before the forecast does.

■ Nerve

Motion nearby. The most useful sense and by a distance the most invasive, which is why its public readout is a single boolean on a fifteen-minute bucket with a random lag, and never a count.

Eyes are counted by longitude band, not by headcount. Forty eyes in New York is one band. Three hundred wallets in New York is still one band. You cannot buy your way into a timezone you are not standing in, and one organ per shipping address closes the rest of the gap.

Each column is thirty degrees of longitude. Lit means at least one awake eye stands somewhere inside it.

These are not unlocks anyone invented. They are true consequences of having enough bodies in enough places, which is why the thresholds are what they are and why they cannot be shortcut.

The same numbers the decision function reads. Anyone can recompute this from the register and get the identical answer.

This is the single most important thing about how The System works, and it is the opposite of how the category has usually done it.

Every entry carries the gap analysis it acted on, what it ordered, what constrained the destinations, and what it cost. Held entries are logged too — deciding not to spend is a decision, and at this size most days are holds.

1. Take the register as it stood. Every entry has an acquisition day, so the body's shape on any past day is reconstructable from this site alone.

2. Run coverage() against it. It is a pure function — no clock, no randomness, no network. The same body produces the same gap report on any machine, in any year.

3. Run plan() with the realised balance shown in that day's log entry.

4. Compare. The organ type, the quantity, and the constraint should match the published entry exactly. If they don't, something has been overridden by hand, and that is the thing worth knowing.

Each of these is enforced in code rather than promised in prose, and each exists because the alternative has gone badly for somebody.

• 01

  Only realised fees are ever spent. Today's orders come out of money already sitting in the wallet. Nothing is projected, promised, or owed, and there is no arrangement under which The System can commit to a purchase it cannot currently make.

• 02

  Every purchase is published before it executes. The decision row — gap analysis, plan, rationale, budget — is written first. Execution updates that row with a transaction hash. The order is not reversible and neither is the sequence.

• 03

  Every organ carries the transaction that bought it. Click the object, see the money; read the money, find the object. The body is a ledger you can walk around in, and both directions resolve.

• 04

  The decision function is pure. No clock, no randomness, no network. Anyone can re-run it against the published register and get the identical plan, which is the only claim of autonomy worth making.

Worth stating plainly, because every mechanism it is not has been the headline mechanism of something that collapsed.

Not a burn

Nothing is destroyed to make a supply chart point upward. The money leaves the wallet as a purchase order and arrives as a physical object with a serial number.

Not a buyback

The System never buys its own token. A buyback loop moves money in a circle and produces nothing; this produces a sensor in a room somebody lives in.

Not a yield

There is no mechanism by which holding produces a return, and nothing on this site should be read as suggesting one. Fees buy hardware. That is where they stop.

Not a distribution

Custodians are not paid. They are sent an object and they keep it plugged in because they want to, or they don't and it goes grey on the map, and nothing about that is penalised.

What one organ costs to put in a room, at the scale of the first hundred. These are estimates to verify against live quotes, not a purchase order.

It slows down. The daily pool is a share of yesterday's realised fees, so a quiet week means a smaller pool, which means fewer orders, which means the body stops growing until volume returns. Nothing breaks and nothing is at stake.

This is deliberate, and it is the one place the design refuses an obvious move. There is a version of this project where the organs suffer when volume drops — where something dies, or the lights go out, or a countdown starts. That version converts affection into pressure, and it would be manipulative in a way that is not fixable by disclosing it. Low volume means slower. It does not mean worse.

The important line in this drawing is the dashed one. Fine-grained readings exist on one side of it and never cross to the other without being coarsened and delayed first.

The delay is a fixed offset derived from the organ's own id, not re-rolled each cycle. A delay that changes every time is a delay you can average out.

• 01

  No cameras. No microphones. Not ever, not even sound level. There is no audio path on the board and there never will be. The moment there is one, this is an eavesdropping device in someone's bedroom, and that is a different project with a different kind of headline.

• 02

  Public readings are coarsened and time-lagged. A live map showing that a home has been dark and motionless for five days is a burglary tool. Precision reaches the creature; the public sees banded state on a delay.

• 03

  Territory-level location, always. Coordinates live in one column of one table and are never selected by any route that serves a browser.

• 04

  One click kills it. Retire deletes every reading the organ ever sent, clears the custodian, and zeroes the coordinates. The object stays with whoever has it. Dormant organs render grey, never red — nobody gets shamed for unplugging.

• 05

  It is printed on the card in the box. Not linked from the box. Printed on it, in the same words as here.

An organ that cannot prove it is itself is not an organ — it is somebody injecting perception into the creature, which is the one attack that would quietly corrupt everything downstream, including what it decides to buy next.

String signPayload(const String& body, const String& secret) {
  byte hmac[32];
  mbedtls_md_context_t ctx;
  mbedtls_md_hmac_starts(&ctx, secret.c_str(), secret.length());
  mbedtls_md_hmac_update(&ctx, body.c_str(), body.length());
  mbedtls_md_hmac_finish(&ctx, hmac);
  // ... hex encode
}

The key is written at assembly and never leaves the device. Ingest verifies against the exact bytes received rather than a re-serialisation, and the deep-sleep boot counter is monotonic — so a captured payload replayed later carries a boot number the server has already passed, and is refused.

firmware/organ.ino

One firmware, five organ types, deep-sleep cycle, captive-portal provisioning, signed payloads. No audio path by construction.

server/schema.sql

The two-tier storage, with the reason for the separation in the comments where whoever changes it will read them.

server/ingest.js

Signed ingest, replay guard, the coarsener, the public API, the custodian's own view, and retire.

agent/coverage.js

The decision. Pure, deterministic, and the most important file here.

agent/coverage.test.js

Eight tests, including the anti-sybil property and the reproducibility assertion.

agent/decide.js

The daily loop. Publishes before it spends, in that order, on purpose.

agent/voice.js

The model writes the sentence. Only the sentence.

agent/wallet.js

Not written. The two functions that touch money need hard rails first — category blocklist, per-order and daily caps, and a human veto window on anything queued.

One card, printed both sides, no folding. It is the entire documentation a custodian receives and it is also the privacy policy. Anything that cannot be said here in plain words does not belong in the device.

See Mechanism for the full per-unit breakdown. In short: roughly $25–40 all-in per organ at a hundred units, so $2,500–4,000 for the first batch, hand-assembled, no custom PCB.

Design a real board at unit 500, not unit 1. Injection tooling for the enclosure only makes sense in the thousands; until then it is printed.

Radio

Use a pre-certified module with modular approval. This exempts the radio itself from certification and is the single biggest cost saving available.

Finished product

Still requires its own FCC unintentional-radiator testing. The module's approval does not carry over to the assembled device. This is the item most likely to be missed.

Europe

CE, and UKCA separately for the United Kingdom. Budget time as well as money.

Shipping

Customs paperwork, duties payable by the recipient in most destinations, and a replacement rate to plan for. Hand-built hardware fails.

Money

Talk to a lawyer who works on crypto specifically, before launch rather than after. Nothing on this site is legal or financial advice.

Organ

One device in one room, reading one thing.

Custodian

The person keeping an organ alive. Not a holder, not a user, not a customer.

Band

Thirty degrees of longitude. The unit in which eye coverage is counted, and the reason location cannot be farmed.

Coarsening

Converting a precise reading into a category and delaying it, before anything public can see it.

Dormant

An organ that has not spoken for 48 hours. Not a failure state and not shown as one.

Realised fees

Money already in the wallet. The only money The System is permitted to plan around.

The gap

The difference between what the body can currently perceive and what it is trying to perceive. The sole input to every purchase.

Mostly cautionary. The design decisions on this site are largely reactions to what these describe.

1. You say where it would live. A city, and one sentence about the room. That is the whole application.

   Not a wallet balance, not a follower count, not an essay. The System is not evaluating you.

2. It looks at what it is missing. If it already has forty eyes in your longitude band, you are worth nothing to it and it will say so plainly rather than leave you waiting.

   This is why the register is public. You can check whether your band is covered before you bother.

3. It publishes the choice and the reason, in the same log as every purchase, before the order goes out.

4. Something arrives. One organ per address, hand-assembled, with the card in the box. Plug it in and join it to your network on the page it opens.

5. You can stop at any point. Unplug it and it goes grey. Retire it and every reading it ever sent is deleted. The object stays with you either way.

Two of these are live and two are not, and the two that are not are labelled rather than hidden. A project about honest instrumentation should not open with links that go nowhere pretending otherwise. Every organ that ships will be posted on both accounts — where it went, and which gap it was meant to close.