ZEQ economy

Credits are fuel. Envelopes are the token. Everything below matches the running code.

ZEQ is the framework's metered compute utility. You spend credits to run physics; every compute mints a ZEQ envelope — an immutable, signed proof-of-compute receipt that carries value. The envelope is the transferable token; credits never are. Value enters the system only when someone computes. There is no off-chain ledger — every charge, claim and envelope mint lives in tally_supply, tally_tokens and tally_transitions on your state machine's chain.

The two fuel pools

Pool	How it fills	Transferable?
Free credits	1,287 on signup (the welcome package) + 128/day by explicit claim, only when down to your last 5	Never — fuel only
Paid credits	Purchased via subscription or swap	Never — fuel only

Credits never move — free or paid. The only transferable asset in the framework is the ZEQ envelope coin: your share of each envelope is held as coins on the envelope itself (never blended into fuel), and transfers move whole envelopes (POST /api/tally/envelopes/transfer).

Spending order is fixed: free credits first, then paid ZEQ. The free credit pool lives on your account; paid ZEQ lives in your machine's ZEQ balance (tally_supply.tokens_remaining). All amounts are whole tokens — there is no fractional subunit.

The daily claim (128)

Free credits are claimed, not dripped: POST /api/tally/credits/claim (authenticated; also a button in your Vault). Claiming refreshes the free pool to 128 ZEQ/day with GREATEST() semantics: it never reduces a balance (a welcome-day user stays at 1,287) and never stacks (you can't bank a month of free fuel). The claim unlocks only when you are down to your last 5 credits. One claim per UTC day, enforced by a unique ledger row — concurrent claims can't double-fill. Idle and fake accounts accrue nothing.

The spend path (fuel is consumed)

Every paid action calls chargeForCompute() atomically before work runs:

1. Cost is computed from complexity (calculateComputeCost — operator count, cross-domain coupling, proof generation).
2. The free pool absorbs what it can; the balance pays the remainder. The WHERE tokens_remaining >= cost clause is the lock — no over-spend, no race.
3. Fuel is consumed: tokens_remaining falls, tokens_burned rises (it now means "fuel consumed by compute"). Nothing is redistributed — no owner rebate, no foundation cut from fuel.
4. Insufficient balance → 402 Payment Required (free tier). Active paid tiers never wall: the unfunded remainder lands in the overage ledger and reconciles to Stripe at month end.

The envelope mint — V = f(complexity)

Each successful compute mints one ZEQ envelope whose value rewards harder, better computes:

quality = 1 − precisionActual / 0.001        ∈ [0, 1]
V       = round( cost × (1 + quality) )      ∈ [cost, 2 × cost]

Operator count and cross-domain coupling already scale cost; precision scales the multiplier. The KO42 ≤0.1% gate is the mint curve: land on the bound and the envelope is worth what you paid; land near perfect precision and it's worth up to twice that.

Who owns the envelope — routed atomically by funding, never split:

Funding	You	Foundation
Paid-funded	100% — the whole envelope is yours, movable	0%
Free-funded	0% — you keep the soulbound light proof	100%

The free-funded rule is the anti-gaming sink: the daily 128 buys you real results, never transferable value. Your envelope share is held as coins on the envelope — it is never credited back into your fuel balance. A high-precision paid compute earns up to 1.6× its cost in coins — quality compute is how the coin supply grows of every mint (as fuel for its pot, which funds the swap).

Each envelope is an immutable tally_tokens row: token_id (ZT-<machine>-<zeqond>-<hash8>), the operator sequence, the signed zeqProof as proof value, and the value columns (value_zqt, free_funded_zqt, paid_funded_zqt, user_share_zqt, foundation_share_zqt). Supply credits and tally_transitions audit rows (envelope_user_share:<id>, envelope_foundation_share:<id>) commit in the same transaction.

Supply properties

• No passive movement. There is no per-Zeqond drip mint, no tier burn, no heartbeat burn, and no burn-ratio redistribution. Balances move only when a compute or paid operation runs.
• Bounded expansion. A compute can mint at most 2× the fuel it consumed, and only paid-funded value reaches users.
• Foundation income = 20% of every paid envelope + 100% of every free-funded envelope — proportional to real engine usage, not to time.
• Forks issue their own token. Every fork of the framework runs this same mechanism on its own chain with its own symbol — Zeq issues ZEQ; your fork issues yours.

The API

What	Endpoint	Notes
Claim the daily 128	POST /api/tally/credits/claim	auth; only when balance ≤ 5; one per UTC day; GREATEST refill
Balances	GET /api/tally/credits/:zid	owner-gated; free_credits, paid_credits, envelopes{count, your_share_total}
Your envelopes	GET /api/tally/envelopes/:zid	owner-gated; last 100, with value per envelope; add ?mesh=1 for the unified vault
Send an envelope coin	POST /api/tally/envelopes/transfer	{ token_id, to, visibility? } — whole-envelope ownership move, idempotent, audited. The only transfer in the framework; /tally/credits/transfer is 410 Gone
Publish default (per machine)	GET / POST /api/tally/settings/publish-default	owner-gated; read/set whether this machine's transfers default to public
Coin authority record	GET /api/tally/envelopes/:tokenId/authority	public; the coin's home_origin + spend_seq height (no holder leak)
Compute (mints an envelope)	POST /api/zeq/compute	response carries tally_charge (funding tags) + zeq_envelope (V, shares, precision). Burn-funded computes return zeq_envelope.minted:false
Burn envelopes → credits	POST /api/tally/envelopes/burn	{ ids: [...] } — batch, 1:1 par, atomic, replay-idempotent; credits the non-transferable burn pool. Burn-funded computes mint no envelope

Publicity — private by default

Moving value and publishing value are two different things, and they are decoupled. A transfer is a real, compute-produced, re-verifiable transition on your entangled state — it does not need to be public to move the coin.

• Default: private. POST /tally/envelopes/transfer with no visibility moves the coin privately — only you and the recipient can read the transition (an anonymous read of that observer row returns 403).
• Per-transfer opt-in. Pass visibility: "public" (or publish: true) and the transition is published to the hosting domain's mother-chain observer, readable and verifiable by anyone.
• Per-machine default. POST /tally/settings/publish-default { public: true } makes every transfer from that machine public unless you pass visibility: "private". Resolution order: explicit per-transfer choice → machine default → private.

Value transfer never depends on this flag — publicity is purely about observability.

See it live

• Your Vault (/vault/) — free credits, paid ZEQ, envelopes, claim.
• Transparency Oracle (/transparency/) — network-wide supply state.
• Your chain (/state/) — every charge and mint, hash-linked.

The transferable form

Envelopes you own can be exported as offline bearer coins — a PIN-locked .ZEQ file or a QR / NFC claim link — moved anywhere and redeemed on any domain. See Bearer coins & the wallet.

Governance weight

Envelopes are more than value: voting within the ecosystem lands in the near future, denominated in the envelopes you hold. Every envelope in your wallet is future voice — a reason the envelope's worth is its utility, not a quoted price.

The one-way valve — burning envelopes for compute

Envelopes you own can be batch-burned in the Vault for burn-credits at 1:1 par: an envelope always redeems its face value V in compute. The valve only turns one way — a compute funded by any burn-credits mints no envelope, so value that leaves the token loop can never re-enter it. Burns are irreversible, Zeqond-stamped envelope_burn transitions on your chain, and a burned envelope carries no future voting weight: compute now, or voice later.