PLAN · IN DESIGN

Anchoring

We do not put the ledger on a chain. We publish its fingerprint to all of them — one 32-byte Merkle root a day, committing to the whole snapshot.

A chain would move settlement finality off our infrastructure. It would not change how Flashy Gold is earned or redeemed, and putting every entry on one would make Gold transferable by construction — which contradicts everything this property says it is not.

So we anchor the record instead of migrating it. Each day's snapshot is committed to a single Merkle root. Publishing that root as a transaction means the record for that date cannot later be altered without detection, and a holder can prove their own entry was included in a total we published — without us disclosing anyone else's balance.

Why this reaches every chain

A root is thirty-two bytes and has no chain affinity. Publishing to six chains is not six bridge integrations — it is the same thirty-two bytes, six times. So “which chain” stops being an architectural decision and becomes a deployment list, which is the entire technical content of the claim that Flashy assets can live on all of them.

The port

export interface AnchorTarget {
  readonly chain: string
  publish(root: Hex32, at: Date): Promise<AnchorReceipt>
  verify(receipt: AnchorReceipt): Promise<boolean>
  explorerUrl(receipt: AnchorReceipt): string
}

The same shape as LedgerStore in @flashylabs/ledger. One port, N adapters, a domain that never learns where anything is kept. Adding a chain is implementing this interface and appending a row.

The chains we anchor to

ton-testnet

TON Testnet

The strategic home, on testnet first. Proves the pipeline against the chain our holders are closest to, at no cost and with no claim that it is production.

base-sepolia

Base Sepolia

The credibility anchor, on testnet first. EVM, so the deepest auditor and tooling pool. Proving the pipeline here costs nothing and means the first mainnet root is not the first root we have ever produced.

One transaction per chain per day. At Q1–Q2 2026 median fees that is on the order of $7 per chain per year, independent of how many entries the day contained — which is why adding a chain is a configuration row rather than a budget decision.

What is not anchored, and why

The asset. Anchoring commits to a record; it does not issue a token, create a market, or make a balance transferable to a stranger. Nothing in this design presumes that Flashy Gold ever becomes transferable — that would be a governance and counsel decision, not an engineering one, and the value of the architecture above is precisely that it does not assume the answer.

∅ No root has been published

A root cannot be anchored before the invariant passes. Committing immutably to numbers we cannot verify would make the drift permanent and public rather than merely present. This page ships receipts with the first green run — the exit criteria are here.