Bonded Stall

How a listing moves

1. The writer uploads a draft. The stall strips foreign zero-width marks, hashes the canonical bytes, and appends a version. Prior hashes stay.
2. A 128-bit nonce is mixed in. Only that commitment goes to an OpenTimestamps calendar and an RFC 3161 timestamp authority.
3. The public page shows a short discontinuous preview, marked for that viewer. The canonical file is not marked.
4. Full text opens only in a logged reading room after a clickwrap. Staff use the touch-the-file contract.
5. Withdrawal ends the display license and deletes the public text. Hashes, proofs, and the access log remain. A sealed copy remains only if the writer asked.

Records

Each sealed version stores the content hash, the nonce, the commitment, the calendar proof, the RFC 3161 token, the word count, the pen name, and the time. The Proof Pack is a JSON file plus the .ots and .tsr files. A sealed legal name, if the writer adds one, is encrypted in a separate row. The public listed-as-of page shows the pen name, the listing id, the date, and a hash prefix.

Display license

Writer grants HappyRock a limited, revocable, non-exclusive, non-transferable license to host and display the listing and authorized preview, and to run stated safety/integrity scans. No other rights. License ends on withdrawal. No sublicense except as needed to operate hosting and payments. No training rights. No house-created derivative of the manuscript.

Patronage

Coin in an author’s jar is patronage: a gift to the pen name. It is not a purchase of the literary work and grants no copyright or license. A house subscription is time in the room. It is venue access, not a purchase of the work.

This is not a purchase of the literary work and grants no copyright or license beyond the viewing rules already accepted.

Scans

Scans run only for safety, prohibited-content rules, generative-prose detection, and inventory integrity. HappyRock does not train models on stall text and does not keep embeddings after a scan unless the writer opts into similarity watch. The writer can see what ran, when, the result class, and how long it is kept. Withdrawal deletes the full text and any derived embeddings. Hashes and proofs remain.

Withdrawal

Withdrawal is the writer’s act and it ends the display license. HappyRock deletes the full text. It retains hashes, timestamp proofs, and audit metadata. A sealed copy is kept only if the writer asked for one before withdrawal. Featured and archive are merchandising labels, not editorial acceptance.

What a proof is

This proves this exact file existed by this date. It does not transfer copyright and it does not, by itself, prove legal authorship.

Copyright registration assist

Registering every early draft can clutter a later filing of the finished work. You are the claimant. HappyRock is a filing helper and limited agent at most, and is not the copyright owner. Nothing is filed unless you say so for this version.

1. You choose one stable version, not every typo save.
2. You are the claimant. HappyRock L.L.C. is not listed as the copyright owner.
3. The deposit copy is generated from that version’s canonical bytes.
4. The walkthrough is the U.S. Copyright Office path for an unpublished literary work.
5. Nothing is filed until you confirm this version in a separate act.
6. A confirmation number, if you later paste one, is stored in the Proof Pack.

Touch-the-file

I will keep this text confidential. I will not copy it out, train on it, share it, or publish it. I take no interest in the manuscript’s copyright. Work I do on platform code or scan reports is for HappyRock L.L.C. The manuscript is not assigned.

Retention

• Canonical manuscript bytes. While listed: Kept, byte-identical to the cleaned upload. After withdrawal: Deleted, unless the writer opted to keep a sealed copy.
• Derived preview, canaries, lexical marks, zero-width marks. While listed: Built per session, not stored as the work. After withdrawal: Deleted.
• Embeddings. While listed: Not kept, unless similarity watch is on. After withdrawal: Deleted.
• Content SHA-256, nonce, commitment, .ots, RFC 3161 token. While listed: Append-only. After withdrawal: Kept.
• Scan log (purpose, time, result class). While listed: Kept for the stated retention. After withdrawal: Result class kept; text not kept.
• Full-text access log. While listed: Kept. After withdrawal: Kept.
• Sealed legal name. While listed: Encrypted, apart from the manuscript. After withdrawal: Kept only for the writer’s request or lawful process.
• Public listed-as-of record. While listed: Pen name, listing id, hash prefix, date. After withdrawal: Same. No full text.

What each control does not prove

• SHA-256 of canonical bytes. Proves: This exact byte string was the version we sealed. Does not prove: Who wrote it, or that no other copy existed earlier. Failure: A hash of the wrong buffer is a proof of the wrong file.
• OpenTimestamps calendar. Proves: The commitment was seen by a public calendar before a later Bitcoin block. Does not prove: Authorship, or that the stall still hosts the file. Failure: Calendars lag. An incomplete .ots is not yet calendar-independent. A 404 of the stall does not erase a proof the writer already downloaded.
• RFC 3161 token. Proves: An institutional TSA signed the commitment at a UTC time. Does not prove: The other proof, or copyright ownership. Failure: A TSA can be offline or later distrusted. Keep both proofs.
• Canary sentences. Proves: A leaked preview matches a session we issued. Does not prove: The leaker’s legal identity if the session was shared. Failure: A careful rewrite drops the canary.
• Keyed lexical marks. Proves: Some function-word choices in a preview match a session key. Does not prove: Anything about the canonical file. Failure: Synonym wash or a full rewrite removes them. They are off if the writer disables them.
• Zero-width payload. Proves: The HTML preview once carried a session mark. Does not prove: Survival after copy into a plain editor. Failure: Sanitizers strip U+200B and its neighbors. Treat this layer as weak.
• Display license plus withdrawal. Proves: The house’s permission to show the listing ended when the writer withdrew it. Does not prove: That every cache on earth dropped the preview. Failure: A platform 404 removes the stall’s copy. It does not recall a reader’s notes.

Non-goals

• No publisher posture.
• No exclusive rights, no first-publication rights, no editing or commissioning.
• No ISBN and no house colophon.
• No training on drafts.
• No purchase of the manuscript as a product.
• No watermark on the canonical file.
• No house-created derivative kept as the work.