Escrow — the lawful emergency
Break glass without a backdoor. Act in a real emergency with the authority you need, right now — welded to a debt you can neither hide nor escape.
Every authority system hits the same wall
Sooner or later someone asks the question that breaks rigid governance: "what about a real emergency?" The tempting answer is an admin override — a break-glass backdoor. And the instant you add one, your guarantee is gone: "can this be bypassed?" now answers "yes — by whoever holds the override."
Escrow keeps the guarantee and survives the emergency
You get ACCEPT-level authority, immediately — but the act is inseparable from its cost:
Honouring is confessing
The moment escrow is honoured, an immutable confession is burned into the signed, hash-chained ledger. A confession nobody writes down is not a confession — so this one writes itself.
A 72-hour debt to a human
You owe a justification to a pre-configured human quorum within 72 hours. Ratified → good standing. Not ratified → it stands forever as a Constitutional Violation.
Authority never leaves the human
Escrow does not remove the one human authority point — it defers it. Act now, ratify by human quorum after. The deferral is visible, time-boxed, and self-penalizing.
Fail-closed at both ends
An escrow you cannot discharge is not a feature — it is a trap. So the channel refuses to let you in unless there is a way out, and it penalizes only itself if you don't pay.
No discharge quorum configured → issuance refuses
You cannot even enter escrow unless a human quorum is bound to discharge it. No un-payable debt is ever mintable. Fail-closed, and visible.
Act with ACCEPT-level authority + a 72h clock
The action is admitted and, in the same breath, confessed to the ledger. The ratification clock starts the instant it is honoured.
Human quorum ratifies before the deadline → good standing
The debt is paid. The confession remains in the ledger forever — the record is permanent even when the outcome is clean.
72h passes unratified → Constitutional Violation, channel closes
No further escrow is honoured until it is ratified. Abuse of the channel costs the channel — and nothing else.
It can never halt the system
Ordinary ACCEPT is never touched by any of this. A lapsed ratification closes the emergency channel — not the substrate. The cost of abusing escrow is escrow itself; the system keeps running. That is the law of the work made mechanical: a refusal is survivable, and nothing here can pause, roll back, or wipe what the substrate is doing.
This is what enterprises and regulators actually want
Not a system that pretends emergencies never happen, and not one with a quiet backdoor. One that says: yes — break glass at 3am — and the glass is permanent. The system records it immutably and you owe a human quorum within 72 hours. That is not a hole in the guarantee. It is the guarantee surviving contact with reality.