Appearance
Dual claim
A listed gift card has two exits, and the holder never loses the right to either.
- Someone buys it, and the holder gets cash.
- The holder spends it in the shop.
Whichever happens first, happens. That promise is why listing costs the holder nothing.
Why this is not a concession
Every incumbent takes custody or binds the holder to the listing in some form, to guarantee delivery, because you cannot confidently sell an asset you might lose mid-sale.
We do the reverse, for an economic reason: listing has to be free to be worth doing. A card in a drawer earns nothing. Listing is strictly better only if the holder can still use the card. If listing means "you may no longer spend your own money without penalty", most holders rationally skip it, and supply never fills.
So self-use is one of the two intended endings, and nothing is priced against it.
What that means in code
- No bond, slashing or penalty. Nothing is staked against the holder using their own property.
- The reputation system must not learn from it. Self-use does not make a holder a worse counterparty, so counting it against them would punish what the promise guarantees.
- First claim is permanent. No state tells the holder they may not spend their own card.
- A leftover's deposit sits on the shopper, never the holder. When a till purchase leaves part of a card, the shopper who left it puts down a deposit for the rest, at face (see Settlement). The holder stakes nothing. Reputation learns only from a remainder found short that nobody marked, never from self-use the holder marked. Built and tested offline for the card till, not deployed. Marking a remainder as self-used is not built yet.
A collision is almost never fraud. Usually someone forgot the card was listed.
The one thing self-use cannot do
executing → cancelled is deliberately illegal in the intent state machine.
Once a buyer is at a till with a live code, the holder cannot cancel the listing. First claim still means the holder may use the card at any time, but doing so during an open reveal causes a collision, settled by the balance checks before and after the window.
The three cases differ by when:
| Listing state | Holder uses the card | Outcome |
|---|---|---|
offered (live, unmatched) | anytime | Listing cancelled. No fault. |
executing (reveal open) | during the window | Settled as a collision, not cancelled |
| terminal | n/a | Nothing to affect |
The collision, and the case balance cannot resolve
A balance reading cannot tell buyer-spent from holder-spent: the number falls either way. When it drops and the buyer says the scan failed, the system does not guess. It opens a dispute with an hours-scale window, shorter than the cash advance's 45 days, because an in-store collision is decidable the same day: the holder walked into a shop or did not, and the receipt exists that day. Freezing money for six weeks over a two-minute event would be its own failure.
Status
Built, not proven. The state machine, the collision settlement, and the dispute window are implemented and tested. No real holder has ever used a real listed card mid-reveal, because no real card has been revealed.
Built, but deliberately not wired
Reveal reputation tracks how often a holder's cards end up contested. The code is written and not wired. It computes a rate only over enough history, because judging someone on two reveals is noise and too few to count as evidence. It stays unwired because there is nowhere to store it, and a reputation that resets on every process restart would be worse than none.