The B2C rules

Every constant this machine runs - the clocks, the bars, the caps, the shields - is a hypothesis, not a law. This is not one rule among the rules; it is the rule about the rules, and it governs how any of them ever changes. 1. The trigger is published before the change. The gauges that read the constants run on /pulse; the triggers are stated on /balance before any firing - the fail-safe, the tripwire, the inflation guard. A constant never changes because someone discretioned it: the change follows a published trigger, measured in public. 2. The change ships as a versioned rulebook revision. The outgoing book is snapshotted - immutable, served forever at /rules/v/[rev] - and the new book is the next version, registered with its reason and its date. It applies only to tenures that start after it: never mid-tenure, never retroactive. 3. The words re-check before the version ships. Every guide and page that cites a changed constant is re-verified against the new text before the revision lands - the citation test proves a rule number exists; the words must also say what the rule now says. A version that ships with stale words behind it is a lie with a number on it. 4. The change is recorded where everything is: /trail carries it with its rule cited, like every state change this machine has ever made. 5. Two non-policies, stated so nobody proposes them in a panic: no mid-tenure extensions, and no lowering of the graduation bars. The rate is tuned by giving founders enough runway, never by moving the finish line - an easy wall is an empty credential, and the wall only carries weight because 25 verified joiners or one signed pilot actually happened. The full machine specification, written in Simplified Technical English, is public at /spec.

Sixteen categories for indie software - productivity, personal finance, fitness, writing, creativity, and the rest. One product per chair, and one chair per product: each product files under exactly one primary category - the market it races in. Tags may describe the product, but only the primary category creates a seat, a queue position, or duel eligibility. Being here means something.

Fill your founding cohort and your tenure ends - you graduate to the Alumni Wall with your proof record intact, permanent and in public. The seats are for products still hunting their first 25 users; the wall is where everyone who found theirs stays, forever.

When a seat opens, the entry at the front of that category’s queue is seated automatically. No votes, no favors - the only entries that wait are duel participants still inside their cooldown (R-08), and the only ones that skip the line are duel winners (R-05), who earned it in public. A cooling duelist waits behind anyone who files while their window runs - the back is the back.

A freshly seated builder cannot be challenged for 72 hours - time to publish terms and find your first users. And a seat that just defended a CONTESTED duel gets seven days of the same: when the challenger brought at least five verified joiners, the duel was a fight, not a formality, and the holder has earned a week to actually serve the cohort. A duel nobody showed up for keeps the seat (R-06) but grants no shield.

Every tenure is capped at ten days - the countdown is public on the board row. Fill your cohort and graduate early, with honor; run out the clock and the seat rotates: no shame, no flag, refile free. No extensions - the clock is the clock, and the queue is the mercy. A duel still open when the clock runs out closes with no winner - the clock is not demand - the challenger keeps their place in line, and the seat goes to the queue.

An email is interest. An account is a maybe. Before seating you declare what a real user does - first budget, first build, first workout - and it freezes with your terms (R-09). The machine counts verified joiners - one confirmed email, one seat; your declared bar is your story, self-attested on the ladder and labelled as such. Numbers carry their evidence tier - ATTESTED (self-reported), VERIFIED (signature-confirmed, e.g. Stripe), AUDITED (members confirm via one-click seat verification from their roster email). Audit responses are recorded whether or not they flatter the founder; the public record shows confirmed over asked, because a proof database that can't say how it knows isn't proof.

The cohort's size is the board's proof standard - 25, set by the board, not chosen by the founder; less than 25 cannot graduate, 25 graduates automatically, so there is no capacity decision to make. What you publish and freeze before seating is your deal - scope and cost - and your activation event (R-09); both freeze with your terms. Filling the cohort graduates you; members' roster positions are permanent; what happens after - refunds, upgrades, community access - is a founder-customer matter, not a board matter. The tenure was real.

ATTESTED (your word) · VERIFIED ✓ (Stripe-signed payments) · AUDITED (members confirm, one click, counted either way). The public record always shows which, because a record that can't say how it knows isn't proof.

Challenge a held seat and the currency is 10 verified joiners - real people who confirmed their email through the board’s join flow; first to the bar takes the seat, the beaten challenger rejoins at the back of the queue, and the dethroned holder's return follows the fight - contested to the front, surrendered to the back (R-08). Your duel cohort counts toward graduation: winning the duel is placement, not proof - fill the rest of the cohort and you graduate (R-02/R-11). You cannot out-tweet the bar. If the holder fills their cohort mid-duel, the holder graduates, the duel closes without a winner, the challenger keeps their place in line, and the seat goes to the queue (R-03). Graduation is not a duel result.

If nobody reaches 10 within five days, the higher count wins. If the counts are tied, overtime: the next verified join takes the seat. Overtime lasts one day - a tie nobody breaks in twenty-four hours keeps the holder seated, but only if they showed demand at all: a tied overtime where the holder sits under five verified joiners proves nothing, and the seat reopens.

Verified email, deduplicated per cohort at the database level - the founder's friends cannot occupy the roster twice. Founders cannot join their own cohort.

The beaten challenger rejoins at the back of the queue - winning is placement, not a queue reward, and losing is the back. The dethroned holder's return follows the fight they put up: a CONTESTED loss - the holder's own demand reached the shield line (R-04) and the seat changed hands in a real fight - rejoins at the FRONT of the queue: they waited their turn once, they defended the chair, and the market's answer was a fight, not a walkover. A chair surrendered without a fight - the holder under the shield line - rejoins at the back: a seat given up without demand proves nothing, the same line the tied overtime reads. The trade stays closed: a friendly flip costs the challenger's win, and nobody gains queue placement by losing on purpose. The 7-day cooldown still stands: no re-challenging the same seat, no ping-pong. Losing hurts. That is the point.

Price, cohort size, and activation event are published before seating and cannot change mid-tenure. No bait-and-switch - rewrite the deal and you rejoin the back of the queue.

One signature on the enterprise board; a filled founding cohort on this one. Either way, the tenure ends and the wall records it.

The machine holds the line it can count - one person, one seat, one cohort (R-07), deduplicated at the database level. Beyond that, intent is not countable; the verified-only counter is the real police, and anyone can watch it. Where user-buying is shown to our satisfaction, the call is human and on the record - and it may cost the seat. We try; we don't pretend the trawl is perfect.

The indie clock is the tenure itself (R-19): fill your cohort or rotate - a seat never idles behind a builder who stopped proving. Claims don't run on cohort seats (R-15), so the claim-silence trigger has no indie form; the countdown is public and the machine enforces it.

Alumni keep their listing, proof record and link for life. A genuinely new product may enter a different category after review; the same product never re-enters. The machine refuses a name the board has already had; anything subtler is a human's recorded call, made rarely.

A builder may put one move on the record: a public commitment with a date, seven or thirty days out, shown on their page for anyone watching. One clock runs at a time - settle the one you have before the next can start. When the clock runs out the builder answers: it landed, it didn't, or it's called off - and if no answer comes, the silence is what the record shows. A clock is a record, not proof: it never graduates anyone, moves a seat, or counts toward one - a plan is not a filled cohort (R-11).

Joining a cohort is one step - email, code, seat. No accounts, no waiting rooms, ever. The verification code is the gate that isn't a wall.

Pending emails are interest, not proof - the public counter reads verified joiners only. A fake-email flood can never make the board look full.

Mass-joining, code farming and duplicate personas are deduplicated at the database level and rate-limited silently. Honest people never see it.

No product, fee, sponsor, or subscription may alter seat state, queue order, duel counting, or a founder's standing. Cohort prices are settled between you and your members - we never take a cut. Seats are never sold. Equity is never taken. Filing is free, forever.

Every number on the proof ladder wears how it is known: ATTESTED (the founder's own report - shown, labelled, never hidden), MACHINE (what the board itself observed: the join requests it mailed codes for, the seats its codes verified, and payments that arrived signature-verified from the founder's own Stripe webhook - the only machine source for PAYING), and AUDITED (the member's own answer, recorded whether or not it flatters the founder). Founders may attest anything from the console; the machine never upgrades an attestation, it only adds its own observations beside it. A signature-verified tier cannot be bought, asked for, or granted by hand - it is earned by wiring the webhook and observed from then on. No product, fee, or sponsor may alter a tier.

Every verified cohort member's code is a join link. The credit fires exactly when the referred joiner verifies their emailed code - the code is the verification (R-21), never the click. The referrer must hold a verified seat on the same roster; a founder is never the referrer, a self-referral never credits, and one canonical email is one member (R-16 canonicalization). Marks are earned and rendered by member code: an erasure (R-51) keeps the count and drops the person. Claim-side arrival tags are study data on /pulse, never seat state - the thirty-second claim never grows a field for them.

Every state change on your record can be appealed from the console within seventy-two hours. The appeal asks one question - was the rule applied correctly? - never whether you deserve better; a machine that answers the second question stops being a machine. A human reviews the same evidence the machine saw and answers publicly; the filing and the verdict both land in the audit trail. If the rule was misapplied, it is corrected. If the rule was right but the rule itself is wrong, the rule changes - for everyone, in the next revision, never just for you.

When the machine's actual behavior contradicts a published rule because of a defect, that is not a decision under R-49 - there is no judgment to appeal, only a fact to correct. Affected state is corrected to what the rule actually required, logged publicly as a defect correction, never as an appeal outcome. Where exact correction is no longer possible - the seat has already been claimed by someone else in the meantime - the affected founder is requeued at the front of their category with a seven-day challenge shield, the same immunity a fresh filing earns (R-04), so the defect costs them position, never the seat itself. The remedy is stated here, fixed for every case, not decided one founder at a time after the fact.

“The wall is forever” (R-14) and permanent roster positions (R-21) protect the proof - that a seat was held, when, and how it graduated. They do not protect personal data beyond what the law requires. Where the law entitles someone to it, a founder or cohort member may request removal of their identifying details - name, email, anything that points to them specifically. What stays is the anonymized fact: category, dates, evidence tier, outcome. The record does not disappear; the name on it can. A cohort's historical size is frozen at graduation and never recomputed - erasure changes who was there, not what the record already says. A member of a cohort whose outcome is not yet decided may have identity fields removed at once, but the roster row stands until the contest resolves - holding a public contest honest is a legitimate interest, and it ends with the tenure clock. Enforcement records - flags, benches, ban history (R-12, R-17) - are retained on the machine's integrity grounds and are not erased by request; a request that touches one is decided by a human, in writing, with reasons. Every granted erasure is logged in the audit trail as a privacy event citing this rule: the removal itself becomes part of the permanent record.