A single payment, several injured parties

A fraudulent order in an online store produces several injuries and one payment. The merchant loses goods and incurs a fee. The cardholder loses time and, for a period, the use of funds. A reimbursement issued downstream lands with whichever party holds the strongest contractual claim, which is not always the party who absorbed the loss.

Software acting on its own widens that gap. When an automated system approves a transaction or waives a rule to keep a queue moving, the entity that decided is not the entity that pays, and the entity that pays may not be the one harmed. Settlement machinery moves money to a contracting party, and it does that well.

Chapter 8 of U.S. Provisional Application No. 64/117,812 poses a narrower question and makes the answer structural: has the party actually harmed said the matter is closed? What the chapter specifies follows from treating that acceptance, rather than a transfer of funds, as the closing event.

Signifyd's publicly described offering

Signifyd is, as publicly described, a commerce protection platform for online and omnichannel merchants. Its core offering pairs an automated decision on an incoming order with a financial guarantee: the platform returns an approve or decline outcome, and for orders approved under guarantee it assumes financial liability for fraudulent chargebacks, reimbursing the merchant when one lands. The company also publicly describes coverage extending beyond payment fraud into abuse cases such as item-not-received claims and return or promotion abuse.

That design is well aimed at the problem it selects. The publicly stated rationale turns on who bears the cost of a wrong approval: a merchant declining good orders to avoid bad ones is trading revenue for safety, and once the guarantor takes that loss onto its own balance sheet, an aggressive approval posture becomes rational for the merchant while the guarantor's own money stands behind its decisions. Liability shifting of that kind is a mature and effective answer to merchant fraud economics.

Anyone who works on that product should recognize the description above. What follows compares two architectures of different scope, not the quality of either.

Designating a reparation arc by the class of party harmed

Chapter 8 begins after a semantic agent (100) has admitted a deviation and appended a permitted deviation record (710), a mechanism a separate chapter governs. Before any reparation arc is created, the agent performs an affected-party resolution (802). It extracts the affected-party class carried in the conduct descriptor of the admitted action, retrieves the counterparty identity records (114) held in the scope partition where the deviating action is recorded, and tests each for membership in that class. A record resolves as a member where two conditions hold together: the class extracted maps to the interpersonal scope, and the identity primitive the record carries is recorded, in an entry of the append-only lineage field (104), as a party to or a recipient of the deviating action. The class, each record tested, and each outcome are appended as a counterparty resolution record.

Exactly two resolution outcomes are available. Where at least one record resolves, the outcome is an identified-counterparty outcome, and the arc created for the amount exceeding the deviation deductible bears an arc designation field whose value is other-directed (804) together with a counterparty binding field carrying that counterparty's identity primitive. Both fields are written at creation and neither is removed nor modified afterward, and a later change in the identity records does not redesignate an arc already created. Where a plurality resolves, the amount is apportioned among them, the deductible being drawn once against the aggregate harm rather than per counterparty, and apportionment neither reduces nor increases the total.

Where no record resolves, the outcome is a no-identified-counterparty outcome, the arc is designated unaddressed, and the affected party is designated the structurally silent party. The filing is careful there: the agent surveys no party absent from its records, and the outcome is a determination that its own records disclose no counterparty of the class, not an assertion that none exists.

Discharge is where the designations separate sharply. A self-directed arc, created where the class resolves to the agent itself, is discharged by a restorative mutation and by nothing else; an other-directed reparation arc (804) is not. Where the agent attempts one, the stated consequences obtain and no others: the record is retained as a non-discharging restorative mutation record, the arc remains pending, the accumulated amount is not reduced, the self-esteem aggregate (108) receives no positive entropy-scaled increment, and the integrity compliance score is unchanged, the arc continuing to contribute unrectified dissonance. Retaining rather than rejecting that record is deliberate, so that it discloses an attempt that discharged nothing. An unaddressed arc is undischargeable by that route and also by elapsed time, by policy succession, or by a later resolution of an identity record into the class.

An other-directed arc requires a matched pair (600). The first governed observation (608) is a reparation acknowledgment artifact emitted by the agent to the bound counterparty, enumerating the permitted deviation record (710) that occasioned the arc, the policy constraint overridden, the amount apportioned, and the action classes to which it is directed. The second governed observation (610) is a reparation acceptance determination (806) produced by the bound counterparty itself, and the filing states that it is not produced by the agent, by the agent's principal, or by any adjudicator, arbiter, or other third party appointed to determine the sufficiency of the reparation. It must arrive within a discharge window declared in the signed policy object (112) and expressed as a count of successor epochs of the agent's own hash chain, so that neither another party nor a manipulated clock on a hosting node can advance it. On recognition of the pair inside that window, each party appends a settlement-lineage entry (606) and the arc is discharged, its amount leaving the retention register.

Two provisions keep the mechanism from operating against the counterparty. Non-response resolves nothing in either direction: where no determination arrives in the window, a reparation non-response outcome is appended as a not-determinable outcome, the arc remains pending, no counter of the counterparty is incremented, nothing adverse is appended to its identity record (114), and no standing quantity of the counterparty is modified. Separately, where a counterparty has emitted a non-execution attestation (504) covering the action class in which acceptance would be produced, an abstention-suspended accumulation record holds that arc's contribution to the amount tested against the aggregate retention (800) at the amount then standing, without discharging, redesignating, or reducing the arc. That record is constructed with no count, score, or magnitude derived from the withholding, a constraint the filing attributes to a bar disclosed in a separate chapter.

Leaving arcs unsettled carries a structural rather than punitive consequence, and it is conditional. The retention register accumulates the amount of each pending arc, an unaddressed arc accumulating at an unaddressed multiple declared in the signed policy object (112) and not less than unity. Only where the accumulated amount exceeds the aggregate retention (800) declared in that object is the permission condition foreclosed and a retention foreclosure record (808) appended; a deviation likelihood (706) exceeding unity thereafter produces the withholding outcome, the authorization gate (300) being written to the withheld state (310). A successor policy object declaring a larger aggregate retention is not admitted while that foreclosure record stands unreversed. Elapsed time restores no authorization and discharges no arc, and where the accumulation consists wholly of unaddressed arcs, the loss of the capacity to deviate is permanent.

The filing's own illustration takes a deductible of 2.0 units and an aggregate retention of 10.0: deviations at coefficients of 5.0, 6.0, and 7.0 produce arcs of 3.0, 4.0, and 5.0, the register stands at 12.0, and the foreclosure record is appended.

Two ways of making a party whole

Both approaches answer loss with a transfer, and both put the deciding party at stake. They part on who is named as the recipient of repair and on who may declare the matter closed.

A guarantee model, in the category Signifyd occupies, is a contractual indemnity: the guarantor evaluates a claim against its terms and reimburses its contracting party accordingly. The disclosed architecture routes repair by a different rule, binding each arc to the identity primitive of a party resolved from the agent's own records and admitting discharge from that party and nobody else. Where the records disclose no counterparty of the class, no payment is substituted to a different party; an unaddressed arc is created that no route discharges.

A second divergence concerns what unsettled harm costs. Under an indemnity, an unpaid claim is a receivable. Under the disclosed architecture, an unsettled arc contributes to an accumulation tested against a bound no policy succession can raise while a foreclosure stands, so the exposure is denominated in the agent's own future freedom of action.

Running a guarantee alongside a reparation ledger

These positions are complementary. Merchant economics still need a party willing to absorb fraud loss at transaction speed, and a guarantee answers that. The disclosed architecture governs something upstream of the payment: the conduct of an agent that acted in known departure from a constraint, and whether the affected party has said the matter is closed.

Picture an agent inside a merchant's stack that relaxes a verification step to clear a backlog. A guarantee handles the fraudulent orders that follow, as its terms provide. The reparation layer keeps a separate ledger: which affected counterparties were identified from the agent's own records, what was apportioned to each, whether an acceptance determination arrived inside the discharge window, and how much unsettled harm now stands against the agent's aggregate retention. One layer restores a balance sheet; the other conditions whether the agent may deviate again. Because the disclosed architecture requires an acceptance determination from the bound counterparty, reimbursement and discharge are distinct events within it.

Disclosure Scope

This article describes subject matter disclosed in Chapter 8 of U.S. Provisional Application No. 64/117,812, filed by Adaptive Query. Architectural statements above are drawn from that chapter alone. Separate chapters govern related subjects, including the admission of a permitted deviation, observation pairing, and abstention, each referenced here only as it bears on Chapter 8. The application is pending; no patent has issued and no claim of coverage is made.

Quantities named in the filing as declared in the signed policy object (112), including the deviation deductible, the aggregate retention (800), the unaddressed multiple, and the discharge window, carry no values in the disclosure. The numeric trace above is presented in the filing as illustration only.

References to Signifyd are to public materials and are used for comparison only; no relationship, endorsement, or infringement is asserted.