A capsule that unlocks in 2076 is a financial promise, not just a technical one.
The Storage Trust Fund answers the only question that matters for a 50-year product:
who pays for year 37? Every flow below is shipped code - the ledger,
the consent gate, the accrual engine, and the public health feed (DD-019/DD-020,
plan 14, smoke-tested 49/49).
Every long-dated capsule carries its own endowment.
At creation, the storage horizon decides everything. Short capsules pass straight
through. 10+ year capsules require the storageTrustConsent agreement
(server-enforced - an old client can't skip it) and get a reserve entry. Beyond 50
years, a purchased Century Capsule entitlement is consumed,
extending the same rail to 100 years.
flowchart TD
A(["fa:fa-box-archive Seal a capsule"]) --> H{"fa:fa-hourglass-half Storage horizon?"}
H -->|"< 10 years"| S["fa:fa-check Standard capsule
no reserve needed"]
H -->|"10-50 years"| C{"fa:fa-file-signature Storage trust
agreement accepted?"}
H -->|"50-100 years"| CE{"fa:fa-medal Century entitlement
owned? ($99.99 SKU)"}
CE -->|no| R1["fa:fa-ban 400 rejected
app shows purchase prompt"]
CE -->|"yes - consumed
at creation"| C
C -->|no| R2["fa:fa-ban 400 rejected
consent is mandatory"]
C -->|yes| M["fa:fa-calculator principal =
GB x 8c/yr x fundedYears x 4.0
fundedYears = horizon + 2yr buffer"]
M --> L[("fa:fa-book storage_trust_entries
PostgreSQL ledger")]
L --> T["fa:fa-tag capsule tagged
storageFunding: trust
+ consent in audit log"]
style A fill:#14262a,stroke:#34d399,color:#e8f4f0
style H fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style S fill:#14262a,stroke:#8aa6a0,color:#8aa6a0
style C fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style CE fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style R1 fill:#2a1416,stroke:#f87171,color:#fca5a5
style R2 fill:#2a1416,stroke:#f87171,color:#fca5a5
style M fill:#14262a,stroke:#34d399,color:#e8f4f0
style L fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style T fill:#14262a,stroke:#34d399,color:#e8f4f0
Worked example: a 750MB video, 25-year unlock → 6¢/year expected cost × 27 funded years × 4.0 safety factor = ~£6.48 reserved. Rates are fixed at creation - config changes never reprice existing entries. The earmark is non-blocking: a ledger hiccup logs a warning, never fails the capsule.
A monthly job (POST /admin/trust-fund/accrue, EventBridge-scheduled in
production) debits one month of expected cost from every open entry and writes a
fund-health snapshot. The snapshot row doubles as the idempotency guard - retries
and double-triggers are no-ops.
sequenceDiagram
participant T as Monthly trigger
participant J as Accrual job
participant L as Trust ledger (pg)
participant A as Audit log
T->>J: run for month M
J->>L: snapshot for M exists?
alt already ran this month
L-->>J: yes - skip (idempotent)
else first run
J->>L: consumed += ceil(annual/12) on every open entry
J->>L: flag entries where consumed >= principal
Note over J,L: underfunded entries are NEVER deleted -
they keep accruing as a visible obligation
J->>A: AUDIT#STORAGE_TRUST entry per newly underfunded capsule
J->>L: write snapshot: principal, liability,
health ratio = remaining / PV(liability)
alt ratio below minimum (1.5)
J->>A: STORAGE_TRUST_HEALTH_ALERT
end
end
Health ratio is the whole fund in one number: remaining principal ÷ present value of every open entry's remaining cost. Above 1.0, every sealed capsule is covered; the 4× safety factor keeps it well above that by construction.
A reserve entry ends one of three ways - and each one is honest: cancellations get their unused principal back, unlocked capsules donate their surplus to the pool, and entries that run dry become a flagged platform obligation, never a deleted memory.
flowchart LR
AC["fa:fa-circle-play ACTIVE
accruing monthly"] -->|"creator cancels
before unlock"| RF["fa:fa-rotate-left REFUNDED
principal - consumed
returned"]
AC -->|"unlock date
reached"| RL["fa:fa-unlock RELEASED
surplus stays in
the fund"]
AC -->|"consumed ≥ principal
before unlock"| UF["fa:fa-triangle-exclamation UNDERFUNDED
keeps accruing
ops covers the gap"]
UF -.->|"audit log +
admin alert"| AD["fa:fa-gauge-high Admin dashboard
underfunded table"]
UF -->|"unlock date
reached"| RL
style AC fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style RF fill:#14262a,stroke:#34d399,color:#e8f4f0
style RL fill:#14262a,stroke:#34d399,color:#e8f4f0
style UF fill:#2a2014,stroke:#fbbf24,color:#fde68a
style AD fill:#14262a,stroke:#8aa6a0,color:#8aa6a0
The never-deleted rule is the fund's first law: an underfunded capsule is an operations expense, not a deletion candidate. The same promise is in the end-user agreement, the marketing page, and the audit trail.
The reserve math assumes deep-archive rates - so the platform actually has to pay deep-archive rates. S3 lifecycle rules tier sealed capsule masters down automatically, and a daily warming job restores content before unlock so delivery is instant from the recipient's perspective (DD-020).
flowchart LR
U["fa:fa-upload Sealed capsule
archival master"] --> S3["fa:fa-database S3 Standard
$23/TB/mo"]
S3 -->|"30 days"| GIR["fa:fa-snowflake Glacier IR
$10/TB/mo"]
GIR -->|"180 days"| DA["fa:fa-icicles Deep Archive
$0.99/TB/mo
~1c/yr per capsule"]
DA -->|"48h before unlock:
daily warming job
initiates restore"| W["fa:fa-mug-hot Restored &
ready to stream"]
W --> DEL(["fa:fa-envelope-open Instant delivery
at unlock"])
style U fill:#14262a,stroke:#34d399,color:#e8f4f0
style S3 fill:#14262a,stroke:#34d399,color:#e8f4f0
style GIR fill:#14262a,stroke:#34d399,color:#e8f4f0
style DA fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style W fill:#14262a,stroke:#34d399,color:#e8f4f0
style DEL fill:#0e3b2e,stroke:#34d399,color:#e8f4f0
Deep Archive is ~23× cheaper than Standard. A 750MB capsule resting there costs roughly a penny a year raw - the fund reserves at a fully-loaded 8¢/GB/year and then quadruples it. Restore tier escalates (Standard → Expedited) if unlock is close.
The same ledger feeds the admin dashboard, a public health endpoint, and the marketing page's live panel. The public surface exposes aggregates only - never capsule IDs, user IDs, or per-entry amounts (smoke-tested for identifier leaks).
flowchart TD
L[("fa:fa-book Trust ledger
entries + monthly snapshots")] --> ADM["fa:fa-user-shield GET /admin/trust-fund
full detail: entries,
underfunded, largest"]
ADM --> P1["fa:fa-gauge-high Admin costs page
health panel +
manual accrual button"]
L --> PUB["fa:fa-globe GET /trust-fund/health
PUBLIC - no auth
aggregates only"]
PUB --> P2["fa:fa-bullhorn marketing trust-fund page
'Funded. Not Hoped For.'
live health panel"]
PUB --> P3["fa:fa-mobile-screen In-app agreement
links the public page
at consent time"]
style L fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style ADM fill:#14262a,stroke:#34d399,color:#e8f4f0
style PUB fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style P1 fill:#14262a,stroke:#8aa6a0,color:#8aa6a0
style P2 fill:#14262a,stroke:#34d399,color:#e8f4f0
style P3 fill:#14262a,stroke:#34d399,color:#e8f4f0
The status the public sees is honest in both directions: fully_funded / healthy / attention - and the attention state explicitly says the gap is funded from operations, never by deleting capsules.
Today the reserve is an internal, auditable earmark. The ledger was designed for a custody handover: an interim segregated account first, then a legal trust or foundation whose sole purpose is funding capsule delivery - protection that survives even the company.
flowchart LR
E1["fa:fa-book TODAY
internal earmark
ledger + safety factor"] --> E2["fa:fa-building-lock INTERIM
segregated/escrow account
ring-fenced cash"]
E2 --> E3["fa:fa-building-columns PHASE 3
legal trust / foundation
independent trustee,
annual audit"]
E3 --> WD["fa:fa-heart Wind-down clause:
if the platform ever ceases,
the fund delivers the
outstanding capsules"]
style E1 fill:#0e3b2e,stroke:#4ade80,stroke-width:2px,color:#e8f4f0
style E2 fill:#14262a,stroke:#34d399,color:#e8f4f0
style E3 fill:#14262a,stroke:#34d399,color:#e8f4f0
style WD fill:#0e3b2e,stroke:#34d399,color:#e8f4f0
Code-side, the handover is a custodian column and a transfers table - no changes to earmark math, accrual, refunds, or the consent gate. Full prep doc: docs/architecture/STORAGE_TRUST_FUND.md.
The legal entity does not exist yet. Until it does, external copy says "reserved in the storage trust fund" - not "legal trust protection". Entity structure, jurisdiction, and interim ToS wording are open questions in the prep doc.