1. The Gap

An agent that admits a harmful deviation against a party it can identify does not get to forgive itself. The architecture of U.S. Provisional Application No. 64/117,812 creates an other-directed reparation arc bound to that party's identity primitive, and the arc is discharged only upon completion of a matched pair whose second observation is the harmed party's own acceptance. A restorative mutation the agent performs on itself discharges nothing. Until the arc discharges, its amount stands accumulated in a retention register, and when the total in that register exceeds the declared aggregate retention, the permission condition that lets the agent deviate at all is foreclosed. The register is the running total, and only a completed matched pair lowers it.

That design opens a narrower question the filing has to answer with care: what is the granularity of a discharge? One disclosed form is splittable. Under partial reparation acceptance, the counterparty accepts a stated portion, that portion is removed from the register, and a residual arc is created for the part not accepted. Splittability is not always the granularity a deployment wants. Some directed obligations should settle all at once or not at all, and for those the filing discloses a second form under which no portion of the arc's amount leaves the register unless the exchange completes in full.

Enforcing that atomicity is a task for escrow, and the conventional escrow tools reach for a trusted third party, a consensus authority that orders the legs, or a channel opened by pre-negotiated session state. None settles on the strength of a temporally proximate matched pair alone, and none escrows what this mechanism escrows.

2. Mechanism

The discharge of an other-directed reparation arc is placed under a dual-lock escrow in which each of the two parties holds one lock. Dual-lock control is one of several custody forms an escrow custody record may carry, alongside a credentialed authority, cryptographic contract logic, and time-, event-, or oracle-triggered release. What makes this application distinctive is not the lock form but the thing under lock.

The escrowed content is the removal of the accumulated amount of the arc from the retention register the agent maintains in its append-only lineage field. It is not a value quantity handed from one party to another but a single operation on the agent's own retention register, held in suspense. The escrow governs whether and when the agent is permitted to strike the arc's amount from that register.

The pair that releases it is the ordinary reparation exchange. The first governed observation is a reparation acknowledgment artifact the agent emits to the counterparty named in the arc's binding field, enumerating the permitted deviation record that occasioned the arc, the policy constraint overridden, the amount apportioned to that counterparty, and the action classes to which it is directed. Emission decrements the agent's authorization budget by a declared amount, without regard to whether the deviation it acknowledges was warranted. The second governed observation is a reparation acceptance determination produced by an asserting party of the harmed origin-equivalence class, and produced by that party alone. It is not produced by the agent, by the agent's principal, or by any adjudicator, arbiter, or third party appointed to judge the sufficiency of the reparation. Only the harmed side can complete the pair.

The temporal condition on completion is a discharge window expressed as a count of successor epochs of the agent's own dynamic agent hash chain, so it is not advanced by any other party or by manipulation of a clock available to a hosting execution node. It is the sole temporal condition on the pair, subsuming the pairing rule's time component while leaving its scope-partition and identity conditions in force.

Release is binary. The escrowed removal is released, and the arc thereby discharged, only upon completion of the matched pair. On completion within the window, each party appends a settlement-lineage entry, the agent's being a reparation settlement entry bound to the arc; the accumulated amount is removed from the register; the unrectified dissonance the arc contributed to the integrity compliance score ceases; and the self-esteem aggregate receives its positive entropy-scaled increment. All of that happens together, without an intermediary and without centralized consensus.

If the pair does not complete, nothing partial survives. The escrowed removal is returned unchanged by a rollback record upon a timeout, a non-acceptance, or a failed fulfillment. A timeout detector identifies a first observation that received no matching second within the window; a non-acceptance detector identifies a second observation that explicitly rejects the pairing; a failed-fulfillment detector identifies a fulfillment that does not satisfy the declared completeness of the transaction. Responsive to any of the three, the rollback record reverts the partially executed settlement state and is itself appended to lineage. That record carries a failure-class field, the detector that fired, each settlement-state element reverted with its value before and after, and the escrow custody record concerned. The rollback removes no entry of the append-only lineage field. It reverts settlement state and never the recorded past, so the attempt and its failure to discharge both remain readable.

This is the property the filing states directly: a partially completed exchange effects no partial discharge. The retention-register removal is atomic against completion of the pair. Under this form there is no residual arc, because nothing partial is removed to leave a remainder of. The obligation either clears whole or stands whole.

The filing is explicit that this is a chosen granularity rather than the only one. The dual-lock escrow of the discharge is an alternative to partial acceptance and the residual arc, the two standing as the atomic and the splittable forms of settlement of one directed obligation. Both are disclosed, and a deployment selects which governs a given class of arc: the splittable form where a half-accepted reparation should leave a running remainder, the atomic form where a directed obligation must not be treated as fractionally satisfied, with the escrow enforcing the all-or-nothing.

The escrow custody record and its release or rollback are appended to the two parties' own lineages, and the discharge is theirs to complete or let lapse: two parties, one lock each, one register operation held between them and released by their own matched pair.

3. Operating Parameters

The escrow of the discharge declares no threshold of its own: its release is all-or-nothing, so there is no partiality parameter to set. The parameters that bear on it govern the exchange it gates, each declared in the signed policy object.

  • Discharge window. A count of successor epochs of the agent's dynamic agent hash chain, within which the acceptance must arrive for the pair to complete and the removal to release. It is not advanceable by another party or by a hosting node's clock.
  • Failure classes that trigger rollback. Timeout, non-acceptance, and failed fulfillment, plus any further class declared in the governing policy object. Each has its own detector, and any one returns the escrowed removal unchanged.
  • Authorization-budget decrement on acknowledgment. Emission of the reparation acknowledgment artifact, the pair's first observation, decrements the authorization budget by a declared amount whether or not warranted, with a declared cadence and a declared count bounding re-emissions for one arc.
  • Escrow-depth bound. The governing policy object bounds the escrow depth of a settlement, the count of nested or successively conditioned escrow custody records bearing on it. A single dual-lock discharge escrow sits at depth one, and a placement that would exceed the bound is not performed, the refusal recorded without incrementing any refusal meter.

No numeric value for any of these is fixed by the mechanism, and none is asserted here. The one hard invariant it does declare is structural rather than numeric: no portion of the accumulated amount leaves the register until the pair completes in full.

4. Composition

The dual-lock escrow of the discharge inherits its parts from two regions of the filing. From the reparation section it takes the other-directed reparation arc, the retention register, the aggregate retention, and the foreclosure that fires when accumulation exceeds that aggregate. From the matched-pair settlement section it takes the escrow custody record with its dual-lock custody form, the rollback record, and its failure detectors. The mechanism is where those two lineages meet: it escrows a reparation-side register operation using a settlement-side lock.

It composes closely with the aggregate retention. The register removal is the event that lowers the accumulation tested against that aggregate, and because the removal is atomic against completion, no portion of that accumulation leaves the register on a half-finished exchange. This bears on the per-integrity-scope form of the aggregate retention, where one retention applies to arcs recorded against the interpersonal integrity component and a second to arcs recorded against the global component, foreclosure firing when either accumulation exceeds its own aggregate retention. Under an atomic discharge, no per-scope accumulation is lowered except by a pair that completes in full.

It composes with the other settlement refinements of the region. Under the partition-scoped escrow rule, a discharge escrow admitted in the non-empty intersection of two parties' scope partitions is held only within those partitions, and on timeout while that intersection is empty the content is returned unchanged by a rollback that increments no refusal meter. It coexists with the reparation containment suspension, which holds an arc's contribution steady while a containment determination stands, and with the delegated acceptance authorization, under which a verified delegate or principal of the counterparty can produce the completing acceptance. In each case the escrow governs only the atomicity of the register removal. The same dual-lock primitive appears elsewhere escrowing different content, notably an authorization escrow over a settlement-binding authorization or a gate transition: the lock form is general, and what is escrowed is chosen per settlement. Here the choice is the discharge itself.

5. Prior-Art Distinction

The relevant art is bilateral settlement and escrow. Each category below is a real design, and the mechanism differs from all on the same two axes: what is escrowed and who must release it.

Trusted-third-party escrow interposes an escrow agent that holds the subject of an exchange and releases it upon a condition. The dual-lock escrow of the discharge interposes no such agent. Each of the two parties holds one lock, and the release condition is completion of a matched pair between those two parties alone.

Atomic swaps and hashed timelock contracts effect a cross-ledger exchange conditioned on disclosure of a preimage within a timelock, requiring each leg to be committed to a distributed ledger whose ordering a consensus authority establishes. This mechanism commits nothing to a ledger and depends on no ordering authority. Its temporal condition is a successor-epoch count on the agent's own hash chain, and its subject is an internal register operation.

Two-phase commit and distributed-consensus commit coordinate the parties through a coordinator or a quorum that fixes a single agreed ordering before the exchange is finalized. Here there is no coordinator and no quorum, a temporally proximate pair of governed observations settling the matter directly. Payment-channel settlement meters a sequence of exchanges against a channel opened by pre-negotiated session state; this mechanism opens no channel and negotiates no session state, the two parties needing only to exchange the acknowledgment and the acceptance.

The deepest distinction is in the escrowed content. Every category above escrows a value or commitment moving between parties. This escrow holds a removal of an accumulated amount from the agent's own retention register, an internal register operation that no counterparty ever receives. Escrow of that register removal, released atomically on a bilateral matched pair with no intermediary, ordering authority, or channel, is the structural position the filing occupies. Nothing here asserts that any named system infringes; these categories simply address a different object under different release conditions.

6. Disclosure Scope

This article describes subject matter disclosed in U.S. Provisional Application No. 64/117,812, Section 10.12, at paragraph [0495], read with the reparation-arc and retention-register machinery of Section 8 and the matched-pair, escrow, and rollback machinery of Section 6 of the same application.

What is disclosed is the placement of the discharge of an other-directed reparation arc under a dual-lock escrow in which each of the two parties holds one lock; the identity of the escrowed content as the removal of the arc's accumulated amount from the retention register maintained in the append-only lineage field; release of that removal, and discharge of the arc, only upon completion of the matched pair; return of the removal unchanged by a rollback record upon a timeout, a non-acceptance, or a failed fulfillment; the resulting atomicity, under which a partially completed exchange effects no partial discharge; and the standing of this form as the atomic alternative to the splittable partial-acceptance-and-residual-arc form of settling one directed obligation.

What is not asserted here is any numeric value for the discharge window, the escrow-depth bound, the authorization-budget decrement, or any other declared parameter; the filing leaves these to the signed policy object. The underlying matched-pair, retention-register, aggregate-retention, escrow-custody, and rollback primitives are disclosed elsewhere in the application and are recited here only as context, not as independent claims. This is a technical and defensive publication of what the provisional discloses, and nothing in it enlarges that disclosure.