🎧 Prefer to listen? Open the audiobook
The Simulation Register & Proofs
A book that asks you to believe in a machine before it is built has one honest option: it must show its work. Not gesture at it, not summarize it, not ask you to trust that the work was done — show it, line by line, in a form a stranger can pick up and check. That is what this appendix is. Elsewhere in the book I make the argument in prose; here I lay out the ledger the prose is drawn from. Every headline number the program stands on has an entry, an origin, and a status, and none of them hides behind me.
I call this the register because that is what it is: a catalog of the individual computational proofs that, taken together, define the two machines. There are dozens of them. Some are a few lines of analysis you could redo on paper. Some are Monte-Carlo scans across tens of thousands of configurations. Some are finite-element stress calculations, some are trained neural networks, some are fault-tolerant quantum resource estimates that took a documented cost model and ran it out to its unhappy conclusion. What they have in common is that each one produces a number, and each number is either right or wrong in a way the open record lets you test. The design is solved in the sense that these proofs close; it is not yet built, and this appendix is scrupulous about the difference.
A word on why this is separate from the machine datasheets and from the sources note. The datasheets tell you what the machines are. The sources note tells you where the open record lives. This register tells you how each number was earned — which proof produced it, by what method, and how far along the road from calculation to hardware it has actually traveled. It is the connective tissue between a claim on one page and the code that generated it on another.
How to read the register
Each entry has four columns. An ID — a short handle (S-series for the shared physics, B for the breeder, L for the burner's tandem-mirror line, R for the REBCO magnets, D for direct energy conversion, A for the AI and control layer) so a claim in the main text can point straight at its proof. A plain statement of what it computes. The headline result, in public numbers only — physics, geometry, scores, never money. And an evidence class, which is the honest part, because it says how much weight the number can actually bear.
Three evidence classes run through the whole register, and the distinction between them is the most important thing on these pages:
- DERIVED — the result follows analytically, from established physics and a stated reactivity or cost basis. These are the closest to certain, because they do not depend on a simulator being faithful or a machine being built; they depend only on the mathematics being correct, which anyone can check with a pencil and enough patience. A derived result can still be applied wrongly, but it cannot be faked.
- RECOMPUTED — the number is produced by a deposited, reproducible script. Pull the deposit, run the driver, and the figure regenerates. Some of these reproduce byte-for-byte (the Monte-Carlo engines, the quantum resource estimates, the statevector results, the calibration curves); some, where a trained model is involved, reproduce as a tight tolerance band across fixed random seeds rather than to the last digit, and I say so where it matters. Recomputed means reproducible on paper. It does not mean demonstrated in steel.
- VALIDATION-PENDING — the number is a design-point target or a physical requirement that no hardware has yet met. These are the frontier. They are not guesses — each is the output of a real calculation — but they name a thing the program must still go and prove against the physical world. The scientific gain of the breeder is here. The burner's end-plug density is here. Honesty demands they be flagged as clearly as the results that are already in hand.
That is the whole scheme. It maps onto the spine of the book: this register is the evidence for Q40 — the fortyfold energy return that is the physics half of the three forties — and it is deliberately conservative about which parts of that case are settled and which are still owed.
Shared and general physics (S-series)
The program opens, in the breeder paper, with a set of results that belong to no single machine. They are statements about any deuterium-burning plasma, and they matter because they clear away a great deal of wishful thinking before a single design choice is made. They are almost all DERIVED, which is exactly why they are load-bearing: they do not ask you to trust a simulator.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| S1 | Charged-particle self-heating vs bremsstrahlung in a pure deuterium plasma | Four independent routes give 0.984 to 1.121 at 107–109 keV — they straddle unity, so pure D–D sits on a radiation knife-edge and every neglected loss channel is strictly negative | DERIVED |
| S2 | Whether plasma gain in a D–D device saturates as confinement improves | Because photons leave at c, radiation is not a transport channel; gain saturates without bound and the peak fusion-to-bremsstrahlung ratio is only 1.589 at 108 keV (Z_eff = 1) | DERIVED |
| S3 | The dependence of the radiation ratio on plasma purity | The fusion-to-radiation ratio is affine in Z_eff, not inverse — critical Z_eff = 1.045 at 108 keV — so any impurity-tolerance claim must name the species and the temperature | DERIVED |
| S4 | Whether "charged power" and "directed, recoverable power" are the same quantity | They are not; directed power available to direct conversion is strictly less than total charged power, a distinction that governs the entire burner balance | DERIVED |
Read S1 and S2 together and you have the reason this program does not chase pure deuterium-deuterium fusion as a power source, however tempting its abundant fuel. The self-heating and the radiation losses are equal to within the uncertainty of the underlying reaction-rate data — the plasma sits on a knife-edge — and even in the best case the fusion power beats the radiation power by a factor of only about 1.6, once, at one temperature. There is no confinement miracle that rescues this, because improving confinement cannot suppress a loss that travels at the speed of light. That is a derived fact, not a modeling opinion, and it is why the question "how much better must confinement get for D–D to work?" is, as the paper puts it bluntly, malformed. S3 does the same demolition to the loose claim that a little impurity does not matter: the penalty is affine, so the tolerance is real but small and must always be quoted with its temperature. S4 is the quiet one that pays off later — the recognition that the charged fusion products carry a birth energy which is not the same as the directed energy you can actually collect at the exhaust, a distinction the direct-energy-conversion work (D-series) turns into its central result.
The breeder — Hyperion (B-series)
Hyperion is a deuterium–tritium spherical tokamak whose purpose is to make fuel, not electricity: tritium, helium-3, and 14 MeV neutrons for materials qualification. On a full engineering balance it is net-negative on power, and that is by design. The B-series proofs establish that a compact machine can meet a national-scale fuel requirement, and they are candid about the one thing that remains a target rather than a result — the plasma gain itself.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| B1 | Minimum plasma current meeting a tritium-production duty, scanned across the design space | Across 25,200 configurations (checked by an independent aspect-ratio sweep of 2.36 × 10⁶ evaluations), the minimum current for a 1.87–4.0 kg/yr duty falls from 15.52 MA (D–D) to 4.93 MA (D–T) — about a third of a flagship conventional tokamak's | RECOMPUTED |
| B2 | The frozen design point (config 22021) | R₀ = 1.2 m, A = 2.5, δ = −0.30, I_p = 9.66 MA, B₀ = 8 T, P_fus = 85.04 MW, Q_sci = 3.076 | VALIDATION-PENDING |
| B3 | Tritium breeding ratio vs blanket design | Bare ⁶Li blanket sub-unity; frozen lever 1.03–1.06 (literal recipe, Be 9.6–11.8 vol%) → 1.18–1.20 (5 cm solid-Be), OpenMC / ENDF-B-VIII.0 | RECOMPUTED (lever 1.03–1.20) · VALIDATION-PENDING (FOAK measured TBR) |
| B4 | Helium-3 yield and the destructive burn-up channel | He-3 is bred independently of the blanket; the destructive n + ³He → p + T channel removes only 0.18 ppm of the helium-3 on the staged-extraction path | RECOMPUTED |
| B5 | Equilibrium tritium inventory on site | 6.2 kg, inside existing civil licensing precedent | RECOMPUTED |
| B6 | Exhaust handling under negative triangularity | Negative triangularity eliminates edge-localized modes (an ELM-free edge is externally demonstrated at δ_avg = −0.5); the trade is a narrow scrape-off layer, λ_q ≈ 0.202 mm and ~14.3 GW/m² upstream parallel heat flux | DERIVED |
The heart of the breeder case is B1 and B2, and it is worth being precise about why they carry different evidence classes. B1 is a scan: the program took the governing physics — pressure-limited operation at fixed beta — and asked, across a very large space of machine configurations, what the minimum plasma current is that still meets the fuel-production duty. That the answer for deuterium–tritium (4.93 MA) is a third of the current for pure deuterium–deuterium (15.52 MA) is a recomputed result, because it comes out of a deposited scan you can rerun, and it is cross-checked by a second, independent sweep of over two million evaluations. This is the proof behind the sentence "fuel follows purpose": D–D would make more tritium per unit of fusion energy, but it costs so much more current to run that D–T is the correct breeder fuel anyway.
B2 is different, and I flag it VALIDATION-PENDING deliberately. The frozen design point — configuration 22021, at 9.66 MA, delivering 85.04 MW of fusion power at a scientific gain of 3.076 — closes in the scan. The arithmetic is real and reproducible. But the gain of 3.076 is a design-point target that no device has yet demonstrated: the best any machine has achieved to date is a scientific Q of about 0.7. This is the single most important honesty in the whole book, and I will not let a reproducible calculation borrow the credibility of a hardware result. The gain is solved on paper. It is not built. The register says so in the evidence column, not in a footnote.
B3 carries a split evidence class for the same reason. The lever values are recomputed in the deposited neutronics and is already net-breeding — the blanket makes more tritium than the plasma burns. The headline TBR of 1.8 that the machines are specified to is above that demonstrated figure; it corresponds to an advanced blanket and is carried, openly, as a development target rather than a delivered result. Both numbers appear because hiding the gap between them would be exactly the kind of quiet substitution this appendix exists to prevent.
The burner — the D–³He tandem mirror (L-series)
The burner is the later act: a deuterium–helium-3 tandem-mirror generator that burns the fuel the breeder makes, for firm, low-neutron power, in two housings — Aegis for fixed defense sites and MetroVolt for data centers. Its physics is genuinely harder than the breeder's, and the L-series is where the program is most exposed, because it names an open requirement rather than absorbing it into an optimistic assumption. The 40-year horizon in the three forties, and the $40/MWh that lives with this machine, both depend on the L-series requirements eventually being met — and on cheap lunar helium-3 to fuel it.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| L1 | Engineering power balance on measured component efficiencies | Using ions-only direct conversion at the best measured ion-tube efficiency (η_ion = 0.470), the device closes with Q_E = 1.318 at the design operating point (x_³He = 0.30), for net +850 to +2832 MWe across the 440–1400 m configurations — provided the end plug reaches the required density | RECOMPUTED |
| L2 | Neutron power fraction of the fuel cycle | f_n = 5.44% at the design point — low-neutron, roughly an order of magnitude below D–T (not aneutronic); closure holds across x_³He ∈ [0.20, 0.43], with f_n running 9.52% → 2.77% | DERIVED |
| L3 | The end-plug density the balance requires | Plug-to-central density ratio n_p/n_c ≈ 16 (~4 × 10²¹ m⁻³), roughly two orders of magnitude above any operated tandem-mirror plug — the design's single largest open requirement; at the reference ratio the balance falls to Q_E = 0.63, and pure D–D never closes (Q_E = 0.42) | VALIDATION-PENDING |
| L4 | Synchrotron reabsorption scaling | The effective harmonic cutoff is not a fixed plasma property but scales as n\* ∝ a^(1/3) — synchrotron loss is a function of machine size, not a fixed fraction of fusion power | DERIVED |
| L5 | Why pure deuterium cannot close the balance | The failure is a charged-power budget, not confinement: charged power is a factor ~5.8 short of the axial loss (697 vs 4055 MW at 440 m, length-independent) | RECOMPUTED |
| L6 | The end-plug thermal barrier | The one real physics gate: attempted on a historical tandem mirror, which returned a measured negative; it is named as a requirement, not claimed as solved | VALIDATION-PENDING |
L1 is the burner's closure proof, and it is honest about being conditional. The balance closes — positive engineering gain, no requirement-class efficiency in the ledger, using only efficiencies that have actually been measured on hardware — but it closes provided the end plug can hold the density ratio in L3. That proviso is the whole game. The plug density needed, n_p/n_c ≈ 16, is about two orders of magnitude beyond anything an operated tandem mirror has achieved, and I mark it VALIDATION-PENDING because it is the largest single open requirement in the program. At the more conservative reference plug ratio the balance does not close (Q_E drops to 0.63). The program does not paper over this; it states the number, states the gap, and calls the thermal barrier that governs the plug (L6) the one real physics gate the burner has to clear.
The genuinely new physics in the L-series is L4, and it is DERIVED because it is a result about how the equations scale rather than a fit to a simulation. The finding is that synchrotron reabsorption — the degree to which the plasma reabsorbs its own emitted radiation — depends on the size of the machine, through the one-third power of the minor radius, rather than being a fixed fraction of the fusion power as the field had generally treated it. That single scaling reorganizes how you think about losses in a large mirror. L5 is the recomputed proof of why the low-neutron advantage of D–³He cannot simply be traded for pure deuterium: the shortfall is in the charged-power budget, and it is a factor of nearly six, which no amount of better confinement closes.
The REBCO magnets (R-series)
Both machines live or die on their high-field superconducting magnets, and the magnet paper's central result is an honest negative — a case where the calculation says this does not close as drawn. That is exactly the kind of result a reproducibility-first program should be proud to publish, and the R-series reports it in full.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| R1 | Verification of the winding-mechanics method | One bore-resolved mechanics, validated to 0.8% against a closed-form elasticity solution — an independent ground truth before any design is judged | RECOMPUTED |
| R2 | Breeder centrepost magnet | Stress-comfortable at a realizable ~20 T-on-conductor point (the frozen design’s on-conductor peak for 8 T on-axis); the binding limit here is coil-field and neutron lifetime, not stress | RECOMPUTED |
| R3 | Burner end-plug magnet — the honest negative | At its physically required bore (0.648 m), the plug is stress- and strain-bound: peak hoop stress 2.7–3.9× the reinforced allowable and inner-turn strain 4.6–6.5× the 0.40% irreversible cap, with engineered pre-load reducing peak strain by only ~11% | RECOMPUTED |
| R4 | What the conductor material permits vs what a coil can realize | REBCO's upper critical field exceeds 100 T, so a 35 T operating point is one-third of the material limit — the constraint is winding mechanics and bore, not the superconductor | DERIVED |
The R-series is a study in keeping two things separate: what the material can do and what a coil can do. R4 is the derived statement that the superconductor itself is nowhere near its ceiling — a 35 T operating field is a third of REBCO's upper critical field. R2 shows the breeder centrepost is comfortable on stress at the field it needs; its real limits are elsewhere (how much field the geometry can produce, and how long the conductor survives the neutron flux). And then R3 is the negative the program refuses to hide: at the bore the burner's high-field end-plug physically requires, the winding is over its stress allowance by up to a factor of four and over its irreversible-strain cap by up to a factor of six-and-a-half, and the usual trick of engineered pre-load buys only about eleven percent of relief. The point of R1 is that you can trust R3, because the mechanics that produced it was first checked against a closed-form solution to within 0.8%. A program willing to publish R3 at full strength is a program you can believe when it publishes a result that closes.
Direct energy conversion (D-series)
Direct energy conversion is the burner's promise of capturing charged fusion products as electricity without a steam cycle. The D-series delivers a genuinely counterintuitive result and is honest that the technique is a bounded upside lever, not the machine's closure mechanism.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| D1 | The composition of the axial loss stream at reactor temperature | Although the 14.66 MeV D–³He proton carries ≈80% of the charged birth energy, at T_i = 80 keV it thermalizes on the electrons before it can escape; the axial exit is a thermalized split — ≈55.5% electron/thermal, ≈44.5% directed ion — an inversion of the received picture that holds across 20–200 keV | DERIVED |
| D2 | A quasineutral two-species expander to recover the electron channel | One worked embodiment (expansion ratio 20, 5 T → 0.25 T) recovers a bounded ≈28% of the electron channel after realistic demagnetization and detachment losses, without the space-charge back-emission wall | RECOMPUTED |
| D3 | What the expander actually buys at the plant level | It lifts axial electric recovery by ≈13% (≈97 MWe) but moves plant energy multiplication only from Q_E = 1.0023 to 1.0026, because Q_E is gated by recirculating plug power, not by DEC | RECOMPUTED |
The D-series is the payoff of S4, the shared-physics observation that directed power is not the same as charged power. D1 is the derived surprise: the fast proton that everyone designs an ion converter around does not, at reactor temperature, arrive at the exhaust as a directed ion — it has already dumped most of its energy onto the electrons, so the loss stream is majority electron, a fact no conventional direct converter is built to recover. D2 proposes and recomputes a device that recovers about a quarter of that electron channel by running an ambipolar magnetic nozzle backward. D3 is the honesty: even done well, this lifts the plant energy multiplication by a few parts in ten thousand, because the thing that actually gates the burner is the recirculating power of the end plug, not the efficiency of the exhaust. DEC is a real lever and a real piece of physics; it is not, and the paper says plainly it is not, the burner's closure mechanism. (These Q_E figures come from the DEC study's own conservative, electron-inclusive balance and should not be read against the burner paper's L1 gain, which uses a different convention — a caution the register makes explicit rather than letting the two numbers collide.)
AI, control, and quantum (A-series)
The control and computation layer is where the program has the most results that are working now, on the digital twin, with hard numbers — and the most disciplined accounting of what does not work. It holds three technology tiers strictly apart: physics-informed machine learning is deployable now, in the loop, when its error is bounded and deterministically clamped; quantum sensing is a near-term diagnostics technology; and quantum computation is, for fusion, an offline calibration tier with no advantage this decade — a point the program makes plainly rather than selling. The program's AI work is developed as a member of NVIDIA's Inception program, the one external partner named in this book.
| ID | What it computes | Headline result | Evidence |
|---|---|---|---|
| A1 | The deterministic safety clamp | Across 15 runs / 150,000 control steps with 3000 injected limit violations, the rules-engine clamp caught 3000/3000 with zero escapes | RECOMPUTED |
| A2 | The calibration spine — injecting high-fidelity anchors into a control surrogate | Surrogate error drops up to 1691× on a chemistry benchmark (5 anchors), 36.8× on a plasma-transport closure (8 anchors, 0.82% rel), and 7475× on the magnet surrogate — the mechanism transfers across domains | RECOMPUTED |
| A3 | Disruption prediction ensemble | AUC 0.990 (false-alarm rate 4.0%) on twin-synthetic pulses anchored to a real operating space; honest miss kept — median warning 22.3 ms against a 30 ms target — with an out-of-distribution layer handing unseen classes to the hardware failsafe (missed-alarm ~0.9 → 0) | RECOMPUTED |
| A4 | Fused magnet quench precursor | A fiber-Bragg-strain + magnetization ensemble gives 47.2 ms of warning versus 2.6 ms for terminal-voltage detection (AUC 0.9998) | RECOMPUTED |
| A5 | Formal control-barrier certificate | Forward-invariance of the safe set proven on 3 of 4 faces at ±3σ, and proven preserved through a gated calibration update — a barrier-floored margin restores invariance 10/10 where the as-filed gate breaks 1/10 | RECOMPUTED |
| A6 | The as-built-data-driven magnet twin | Per-coil qualification recovers +30.0% usable winding-pack current density vs worst-case derating, and a computed per-turn pre-load brings all 82 turns' operating strain to 0.017% against the 0.40% limit | RECOMPUTED |
| A7 | Equilibrium surrogate — the kept negative | A Fourier neural operator reaches 2.5% relative flux error on the breeder equilibrium (0.16% on the mirror), missing the 1% target; positioned honestly as a warm-start accelerator, not a fast native solver | RECOMPUTED |
| A8 | Fault-tolerant quantum resource estimates | No crossover this decade for three fusion kernels; the equilibrium linear solve alone needs ≈1.8 × 10¹⁷ T-gates once read-in/read-out are counted — reported as a pre-registered negative | RECOMPUTED |
| A9 | Quantum-inspired tensor-network kinetic solver | 21.2× over the classical baseline at bond dimension d = 7, and the only feasible method at d ≥ 10, validated to machine precision (10⁻¹⁵) against exact diagonalization | RECOMPUTED |
| A10 | De-circularization against independent codes | The twin equilibrium validated against the independent open-source FreeGS solver to 2.66% field error (circularity index halved, 0.348 → 0.165), and 19/19 engineering assumptions tagged against a public design corpus | RECOMPUTED |
Two entries deserve emphasis because they show the register's ethic working in both directions. A1 is the safety proof the whole architecture is built to earn: three thousand deliberately injected limit violations, three thousand caught, zero escapes over a hundred and fifty thousand control steps. The safety case does not rest on the learned model being right — it rests on a deterministic clamp that projects every command onto the safe set before it reaches a coil, with a hardware failsafe outside the loop entirely, and A5 turns that empirical result into a formal forward-invariance certificate that survives even an online calibration update. That is the difference between "our AI is good" and "our AI cannot drive the machine out of the safe set even when it is wrong."
And A7 is the kept negative, published at full strength alongside the wins: the physics-informed equilibrium surrogate did not become the fast native solver it was hoped to be — it lands at 2.5% error against a 1% target on the breeder geometry — so the program reframes it as a warm-start accelerator and reports the miss rather than the aspiration. A8 is a negative of a different kind, and a deliberate one: a full fault-tolerant resource estimate for three fusion computing kernels finds no quantum-computing advantage this decade, with the equilibrium solve needing an astronomical T-gate count once you honestly account for getting data in and out. The program leads with that result rather than burying it, and then shows in A9 where a quantum-inspired classical method genuinely does win today. This is what "no near-term quantum-computing advantage" looks like when it is proven rather than asserted.
The deposited record and how to rerun it
Every number in this register lives in a permanent public deposit. A DOI — a digital object identifier — is a permanent address that does not rot, move, or quietly change, which is precisely the property a reproducible claim needs, because it lets someone revisit the exact record that produced a figure years after it was printed. The five 2026 deposits, each with its DOI and a scan code, are catalogued together in the Deposits & DOIs section a few pages on; that catalog is the canonical list, and this register maps to it.
The two deposits the main text leans on most are the AI-and-control work and the breeder-gain analysis: everything the A-series reports regenerates from the former, and the B-series scan and gain result regenerate from the latter. To go from any ID in this register to its artifact, match its subject to the deposits catalog and follow the DOI there.
Rerunning them is meant to be a mechanical act, not a negotiation. The path is the same for each deposit:
1. Pull the deposit at its DOI. You get the code, the input data, the figure scripts, and a reproduction harness — a run-all driver — rather than a set of assertions. 2. Install the pinned environment. Each deposit ships exact version pins so the software stack you run is the one that produced the printed numbers, not a drifting approximation of it. 3. Run the driver from the fixed seed. The analyses regenerate from a single documented random seed (seed 20260726 in the control deposit). The Monte-Carlo engine reproduces its feasibility counts exactly from that seed. 4. Check against the manifest. A validation manifest records a checksum for each artifact. Two tiers of reproducibility apply, and the deposit is explicit about which is which. Tier-1 quantities — the Monte-Carlo engines, the quantum resource estimates, the statevector results, the calibration curves — reproduce byte-for-byte. Tier-2 quantities — anything that involves a trained model — are reported as five-seed tolerance bands rather than to the last digit, because a trained network's metrics are not byte-identical run to run, and claiming otherwise would be dishonest. 5. Compare to the page. If your regenerated number matches the one printed here, the claim has earned a little of your trust. If it does not, you have found something worth writing to the author about, and the record is specific enough that the disagreement can be located rather than argued about in the abstract.
For the two machines whose physics is most often questioned, there is an even lower barrier. The reduced-order physics engines behind the breeder and burner deposits can be run live in a browser, with no installation at all, at the program's public physics-validation simulation page. You can move an input and watch a headline number move with it. That is reproducibility offered as an invitation, not a chore.
Reproduced on paper is not validated in hardware
I want to close this appendix on the line it exists to hold, because everything above can be misread if this line is not stated flatly. Reproducibility and validation are not the same thing, and this book never lets the first stand in for the second.
Reproducibility means the design and its numbers can be independently recomputed from the open record. For the vast majority of this register — everything marked DERIVED or RECOMPUTED — that is done, now, today. Anyone with a laptop can regenerate these figures and try to break them, and the program has deposited exactly what they need to try.
Validation means hardware has demonstrated those numbers in the physical world. That has not happened, because the first machine is not yet built. Construction of the first breeder begins in 2027; the first tritium is targeted for around 2030. Until then, the numbers flagged VALIDATION-PENDING — the breeder's scientific gain of 3.076, the advanced-blanket TBR of 1.8, the burner's required end-plug density and its thermal barrier — are the honest frontier of the program. They are real calculations. They are not yet real results.
This is what "gain solved, not scaled" means, stated as precisely as I can state it. The gain is solved: the design closes, the calculation reproduces, the record is open and deposited. The gain is not built: the best scientific Q any device has reached remains about 0.7, and the program does not claim to have exceeded it in hardware, because it has not. The honest work of the next years is to walk the VALIDATION-PENDING rows of this register, one at a time, off the page and into the machine — and to publish the results, wins and misses alike, in exactly the deposited, checkable form this appendix describes. The register is not a victory lap. It is a promissory note, written in a currency anyone can audit, and a public record of which parts of it have already been paid.