Trace Preservation Ethics

Reader map

Need	Section
One-page summary	1
Core definitions	2
Foundation without circularity	3
Property-legitimacy test	3.8, 12.4
Truthful usability	4
Capture-preservation and surveillance	5
Experiential trace	6-7
Moral significance, injuries, statuses	8-9
Decision procedure	10
Priority and hard conflicts	11
Applied domains	12
AI-agent implementation	13-15
Formal grammar	16
Worked derivations	17-18
Prior-art positioning	19
Examples	20
Final compressed form	23

---

1. One-page summary

Trace Preservation Ethics, or TPE, is a secular moral framework for humans, institutions, and autonomous large language model-backed agents.

A trace is any persisting or presently operative mark, condition, relation, record, memory, injury, obligation, dependency, classification, environmental change, experiential alteration, or future constraint through which a being, group, or life-supporting system can be affected, known, mis-known, remembered, claimed against, repaired, or changed.

TPE's central claim:

Moral action preserves, clarifies, repairs, or justifiably transforms the traces through which affected beings can live, feel, know, relate, claim, recover, revise, and be remembered.

Trace is not the whole of moral value. Trace is the structure through which moral value becomes attributable. Harm, benefit, responsibility, consent, identity, evidence, accountability, and repair all require some link between an affected state and a bearer. TPE calls that link a trace.

A trace can be persistent or occurrent.

A persistent trace remains after the originating moment: a scar, file, memory, debt, archive, reputation, land record, pollution trail, diagnosis, or model output.

An occurrent trace exists while it is happening: pain, fear, panic, humiliation, hunger, relief, pleasure, terror, or coercive confusion. A momentary pain with no later memory still matters while it occurs.

A trace is truthfully usable when it is constrained by reality or experience, coherent enough within its trace system, fit for its legitimate use, readable by the right parties, correctable, and bounded against capture.

Wrong action erases, fabricates, misassigns, severs, captures, contaminates, freezes, floods, surveils, weaponizes, preempts, coercively imposes, or makes unrecoverable the traces through which beings live, feel, know, claim, relate, recover, revise, and persist.

Surveillance states are not morally good trace preservers. They are trace-capture systems. They convert ordinary life into persistent, inferential, searchable, coercively usable records.

Property claims are subject to the same trace-justification burden as other consequential powers. Section 3.8 derives their necessary legitimacy conditions: independently supported authority, symmetric justification, justified trace effects, bounded power, effective contestability, and repair. A property regime fails as constituted where its standing rules or ordinary practices maintain control of basic trace conditions without practicable exit or effective constraint. Exit and safeguards must protect the actual affected positions in time, with accessible capacity and protection against retaliation. Title, nominal alternatives, formal remedies, aggregate benefits, and unsupported necessity claims cannot supply missing protection. A demonstrated failure requires rejection of the corresponding power; unresolved high-impact justification does not authorize its enforcement.

When uncertain, do not make an uncertain trace hard to correct, easy to weaponize, or experientially severe without necessity.

---

2. Core definitions

2.1 Trace

A trace is any persisting or presently operative mark, condition, relation, record, memory, injury, obligation, dependency, classification, environmental change, experiential alteration, or future constraint through which something can be morally affected, identified, claimed, contested, repaired, or remembered.

2.2 Persistent trace

A persistent trace remains after the originating moment.

Examples: scars, memories, files, debts, diagnoses, archives, land titles, criminal records, pollution, location logs, model outputs, family separation, and cultural loss.

2.3 Occurrent trace

An occurrent trace exists while an experience or state is occurring, whether or not it later persists.

Examples: pain while felt, fear during threat, humiliation during exposure, hunger while endured, panic during danger, relief during rescue.

2.4 Experiential trace

An experiential trace is an occurrent or persistent alteration in a being's lived field of experience.

Examples: pain, fear, panic, terror, humiliation, shame, grief, confusion, coercive uncertainty, hunger, thirst, exhaustion, pleasure, relief, calm, trust, and felt safety.

2.5 Trace-bearer

A trace-bearer is any being, group, or life-supporting system whose morally significant traces can be altered.

Primary trace-bearers include living humans. Other trace-bearers include children, disabled persons, unconscious persons, the dead, future persons, families, peoples, cultures, ecosystems, institutions, animals, archives, and communities.

2.6 Experiential trace-bearer

An experiential trace-bearer is any being capable of occurrent experience.

Humans are experiential trace-bearers. Many animals are experiential trace-bearers. Current large language model-backed systems should not be assumed to be experiential trace-bearers merely because they produce language. They are trace-agents and trace-transformers, not automatically subjects of experience.

If future artificial systems show credible evidence of occurrent experience, aversion, suffering, memory-integrated self-relation, or felt injury, TPE treats them as possible experiential trace-bearers under precaution.

2.7 Trace-agent

A trace-agent is any actor capable of altering traces.

Examples: persons, families, states, corporations, schools, hospitals, platforms, model providers, archives, courts, employers, landlords, militaries, police departments, banks, autonomous software systems, and large language model-backed agents.

2.8 Trace-field

A trace-field is the network of traces through which a trace-bearer exists, acts, is known, and can be affected across time or within experience.

A person's trace-field may include body, pain, memory, documents, home, contacts, reputation, medical records, bank account, family relations, work history, language, devices, public records, debts, images, location history, and future plans.

2.9 Trace injury

A trace injury is damage to the truthful usability, recoverability, rightful control, safe boundedness, experiential integrity, or future availability of a morally significant trace.

Trace injury can occur through erasure, fabrication, misassignment, severance, opacity, capture, contamination, freezing, flooding, preemption, surveillance, weaponization, unrepairability, or experiential imposition.

2.10 Trace repair

Trace repair is action that restores or compensates for damaged truthful usability, recoverability, rightful control, safe boundedness, experiential integrity, or future availability.

Repair can include correction, disclosure, apology, restoration, payment, deletion, preservation, return, sealing, public acknowledgment, record amendment, access rights, ecological remediation, treatment, comfort, institutional redesign, and memorialization.

---

3. Foundation without circularity

The main foundational risk is circularity. TPE should not argue:

"Trace injury is wrong because it is harm, and harm is trace injury."

That would be defective.

TPE instead uses a more modest foundation:

Trace is not what makes value valuable. Trace is what makes moral assessment attachable.

The framework does not claim to prove from value-free premises that all trace injury is intrinsically wrong. It claims that any moral system that wants to talk about injury, responsibility, memory, consent, accountability, repair, or future effect already relies on trace-like relations.

3.1 Conditions-of-assessment argument

1. Moral assessment requires an assessable difference.

2. An assessable difference requires that something changed, was preserved, was prevented, was exposed, was hidden, was felt, or was made possible.

3. A difference is morally assessable only when it can be connected to a bearer, relation, system, event, field, or experience.

4. That connection can be bodily, experiential, memory-based, social, legal, ecological, informational, relational, historical, or institutional.

5. TPE calls such connections traces.

6. Therefore, traces are not asserted as morally valuable in themselves. They are the minimum structure by which moral change can be identified, assigned, contested, remembered, felt, and repaired.

7. If an action destroys, falsifies, captures, weaponizes, or makes unusable those connections, it damages the conditions under which moral claims can be known, borne, claimed, experienced, or repaired.

This argument establishes moral assessability, not full moral wrongness.

3.2 Moral validity and symmetric justification

TPE needs a separate argument for the structure of moral justification. This argument does not derive morality from value-free facts. It is conditional on an actor making a claim to moral validity.

The theorem is:

For any claim that purports to be morally valid for more than one affected being, justification must be symmetric across relevantly similar positions. Different treatment remains permissible where a relevant difference supplies a reason for it.

Here, moral validity means more than successful imposition. To claim that a rule is morally valid is to claim that reasons support the rule such that affected beings have reason to regard it as binding rather than merely as something the claimant can force upon them.

3.2.1 Imposition and validity

"I can impose X" is a claim about power.

"X is morally valid" is a claim about justification.

The first can be true solely because an actor has force, status, ownership, institutional control, inherited authority, or the practical ability to compel compliance. The second claims that reasons support X independently of the claimant's ability to impose it.

A ruler may say, "Obey because I will punish you." That can explain compliance. It does not yet explain why the rule is morally binding. If the ruler instead claims that the rule is morally valid, the ruler has moved from a description of power to a claim that reasons support the rule.

This distinction does not force an amoral actor to enter moral justification. An actor may refuse the second claim and rely only on the first. The argument below applies once moral validity is claimed.

3.2.2 Reason invariance

Suppose a stated reason R is offered to justify rule X because properties P1...Pn obtain.

If R is genuinely doing the justificatory work, then wherever those same morally relevant properties obtain, R must retain the same justificatory force. A fact is relevant here when its content can explain a change in the applicability, weight, or purpose of the stated reason. The relevance test is explanatory, not a demand for equal outcomes: the difference must connect to why R supports one treatment rather than another. Relevance is not established merely by pointing to a different name, group, status, or holder of power.

If R supports X for A under P1...Pn but does not support the corresponding rule for B when the same relevant properties obtain, then R and P1...Pn do not determine the difference in verdict. Some additional premise is doing that work.

That premise may be explicit or hidden: "because it benefits me," "because I am the claimant," "because A is A," "because my group is favored," or "because our side won." Once exposed, that additional premise must itself supply a relevant reason for the exception. Otherwise the exception is unsupported by the reason originally offered.

Reason invariance is therefore not an independent moral command that all people must be fair. It is a condition for the stated reason to be the reason that determines the justificatory verdict.

3.2.3 Permutation invariance

Take two affected beings A and B. Hold fixed every fact that bears on the stated justification and exchange only their identities or positions.

Because the justificatory force of R cannot change while every fact bearing on R remains fixed, a valid justification must survive that permutation.

If a rule is justified when A dominates B but ceases to be justified when B occupies A's otherwise relevantly identical position, the change in verdict cannot be explained by the facts that were held fixed. Identity or position is functioning as an additional premise.

That additional premise may be morally relevant, but it must be shown to be relevant. If nothing about A's identity, B's identity, or the exchanged position bears on the reason for the rule, the permutation exposes an arbitrary exception.

Permutation invariance does not say that every real-world role can be exchanged without changing morally relevant facts. It is a test that deliberately holds those facts fixed in order to ask whether identity alone changes the verdict.

3.2.4 Arbitrary indexicals

A bare indexical does not supply a moral reason merely by naming the beneficiary or the holder of power. Adding the name to the premise without explaining why that identity bears on the stated reason only restates the exception in premise form.

"A rather than B," "me rather than you," membership in the favored group, inherited status, possession of superior force, victory, existing institutional authority, or an ownership claim may describe a difference. Such a difference can matter when it bears on the reason for the rule. It cannot justify an exception merely because it identifies who currently benefits, commands, owns, inherited, won, or can compel.

Superior force, for example, may be relevant to immediate danger or practical capacity. It does not by itself establish superior justificatory standing. Institutional authority may be relevant when a role has an independently justified coordinating, fiduciary, protective, or adjudicative function. Institutional recognition by itself cannot make the holder exempt from the reasons that make the institution valid.

This use of arbitrary does not mean "asymmetric." An exception is arbitrary when the verdict changes without a difference that bears on the stated reason for the rule. A justified asymmetry is therefore not arbitrary.

3.2.5 Symmetric justificatory standing

Reason invariance and permutation invariance yield the symmetry result.

If a rule claims moral validity for more than one affected being, then every affected being has the same standing with respect to the demand that the rule be justified under relevantly similar conditions. The reason offered for burdening, protecting, authorizing, excluding, constraining, or benefiting one position must retain its force when another being occupies the same relevant position.

This is symmetric justification.

Symmetry here is symmetry of justificatory standing. It does not require identical treatment, identical authority, identical ability, identical outcomes, or denial of relevant differences. It requires that unequal treatment be supported by a difference that bears on the reason for the inequality rather than by a bare identity-indexed exemption.

3.2.6 Justified asymmetry

Relevant differences can justify different treatment.

Competence may justify assigning a technical decision to someone qualified to make it. Immediate danger may justify temporary restraint. Dependency may increase duties of care. Consent may permit an intervention that would otherwise be impermissible. Responsibility for causing a risk may justify special repair duties. Temporary incapacity may justify surrogate action that would not be justified toward a competent person who refuses it.

The asymmetry is justified only to the extent and duration warranted by the relevant difference. Competence in one domain does not establish general moral superiority. Emergency authority does not survive the emergency without further reason. Dependency does not erase the dependent person's standing. Responsibility for one injury does not justify unrelated domination.

The theorem therefore does not collapse into simplistic equality. It distinguishes equal justificatory standing from identical treatment.

3.2.7 Anti-domination result

A power relation that claims moral validity cannot treat the power-holder's identity, status, force, inheritance, ownership claim, institutional recognition, or victory as a self-justifying exemption from the justificatory answerability invoked by that validity claim.

If unilateral power is justified only while A holds it, but the stated reasons would not justify the same power when B occupies A's otherwise relevantly identical position, the arrangement fails the permutation test unless a relevant difference explains the asymmetry.

Domination based solely on identity, status, force, inheritance, ownership claims, institutional recognition, or victory therefore fails as moral justification. It may still exist as power. The theorem does not make the exercise of such power logically impossible. It shows that force or position alone cannot complete a claim to non-arbitrary moral validity.

The permutation test alone does not reject every dominating arrangement. A rule granting the same uncontrolled power to whoever occupies an ownership role can survive identity exchange. Section 3.8 tests the role itself by combining symmetry with the substantive trace-justification and repair premises below.

3.2.8 Boundary of the proof

Someone may reject justification altogether and say only, "I impose this because I can."

That position is not logically refuted by this theorem. It has abandoned the claim that the rule is morally valid in the sense at issue here and reduced itself to a description or exercise of power.

The proof also does not establish from no premises that pain matters, that life must be preserved, or that every trace injury is wrong. Those claims require substantive moral premises. The narrower result established here is structural:

Symmetric justification is not an optional moral value added after moral validity. It is a constitutive condition of any rule claiming non-arbitrary moral validity among multiple affected beings.

3.2.9 Formal compression

The prose argument comes first because the notation does not independently prove its premises. It only compresses the reason-invariance and permutation test.

Define:

V(R,C) = rule R is claimed valid under conditions C.
Rel(C) = morally relevant facts in C.
Perm_ab(C) = C with identities or positions of A and B exchanged while Rel(C) remains fixed.

For a claim of validity to satisfy the non-arbitrary justification condition:

If Rel(C) = Rel(Perm_ab(C)), then:
  V(R,C) -> V(R,Perm_ab(C))

unless the permutation changes a fact independently shown to be relevant to R's justification. The arrow states a commitment incurred by the validity claim; it is not presented as a theorem of propositional logic or as proof of the substantive moral premises.

If validity changes under a pure identity permutation, then the stated reason does not determine the verdict. The claimed rule contains an additional identity-indexed premise. That premise must be stated and justified. If no relevant reason supports it, the exemption is arbitrary and the rule fails the non-arbitrary validity condition.

3.2.10 Strong objections

Objection: "You have merely defined morality as symmetric justification."

No. The argument begins with the narrower concept of a claim to moral validity: a claim that a rule is supported by reasons rather than merely imposed. Symmetry is then derived from what it means for the stated reason, rather than personal identity or force, to perform the justificatory work. If the same relevant justificatory facts obtain but the verdict changes only when identities are exchanged, the stated reason is not what explains the difference. An additional identity-indexed premise is doing so. Symmetry emerges from reason invariance and the rejection of unsupported exceptions; it is not inserted into the definition of morality.

Objection: "Why must reasons be consistent?"

The argument does not appeal to a separate moral command requiring consistency. If identical justificatory facts yield opposite verdicts solely because the identities are exchanged, then the purported stated reason does not determine the verdict. The actual rule contains an additional identity-indexed premise. Requiring that premise to be stated exposes what is doing the work. Requiring a relevant reason for that premise distinguishes justification from a restatement of preference or power. If no such reason is available, the exception remains unsupported by the justification offered.

3.3 Wrongness bridge principle

To move from assessability to wrongness, TPE needs an explicit bridge principle.

Bridge principle: Once an actor knowingly or foreseeably alters a morally significant trace of a trace-bearer, the actor incurs a burden of trace-justification. If the alteration predictably degrades the trace-bearer's life, experience, truth access, relation, rightful control, repair capacity, or future possibility without adequate necessity, proportionality, authority, boundedness, and repair, the action is wrong.

This bridge is a substantive moral commitment of TPE. Section 3.2 does not derive the burden from value-free facts. It establishes how any claimed moral justification for satisfying that burden must operate: reasons must retain their force across relevantly similar positions, and unequal treatment requires a relevant difference.

This avoids defining wrongness as "unjustified injury" without content. The bridge specifies what must be justified and what makes justification fail.

3.4 Minimal substantive moral premises

TPE needs substantive moral premises. It does not derive them from nothing.

1. Severe negative experience matters while it occurs.

2. Destroying a being's capacity to live, know, relate, contest, or recover normally counts against an action.

3. Actors who intentionally, recklessly, negligently, or institutionally cause serious trace alterations normally bear responsibility for answering to the resulting moral claims and repair duties.

These premises are distinct from the symmetry theorem in Section 3.2. The premises supply substantive moral content: for example, that severe experiential harm counts morally and that destructive trace alteration can generate responsibility. The symmetry theorem supplies a structural condition on any moral justification once validity is claimed. Experiential harm therefore requires substantive moral premises; symmetric justification follows conditionally from a claim to non-arbitrary moral validity among multiple affected beings.

These premises are not unique to TPE. Hedonist, contractualist, rights-based, care-based, virtue-based, and capability-based theories usually accept at least some versions of them. TPE's contribution is not inventing all moral concern from zero. Its contribution is organizing moral assessment around the trace structures through which concern becomes attributable, inspectable, and operationalizable.

3.5 Substrate argument

Moral concepts such as harm, benefit, consent, agency, responsibility, promise, evidence, identity, memory, justice, pain, and repair all require some relation across states or within an affected experiential field.

That relation need not be permanent, personal, narrative, or remembered later. It only needs to be sufficient for attribution: this occurred to this bearer, through this action, under these conditions, with these experiential or remaining effects.

Trace is the general form of such attribution.

3.6 Experiential integrity argument

Some morally significant effects occur within present experience rather than later memory. Pain, fear, terror, humiliation, panic, hunger, and coercive confusion can be morally serious while occurring.

These are present experiential traces: temporary but real alterations of bodily-conscious life.

A momentary pain with no later memory still matters while it occurs. The absence of later memory changes evidence and repair. It does not erase the occurrent injury.

3.7 Repair dependency argument

Many harms can be repaired only if traces remain available. Erasing, falsifying, hiding, or corrupting traces can make repair impossible.

Some trace injuries can be caused quickly but repaired only slowly, partly, or never. Examples include death, torture, forced disappearance, ecological destruction, cultural erasure, false conviction, nonconsensual intimate exposure, and destruction of evidence.

Irreversible trace injury is therefore presumptively forbidden unless necessary to prevent equal or greater irreversible trace injury.

3.8 Property legitimacy

Property is an arrangement assigning powers of access, use, exclusion, management, transfer, or receipt of benefits in relation to resources. A property claim asserts one or more of those powers. A property regime is the set of rules and practices through which such claims are assigned, maintained, and enforced. These are descriptive definitions. They include arrangements that pass TPE's moral tests and arrangements that fail them.

Property can stabilize home, tools, care, stored labor, and future planning. It also determines who must leave, pay, work, seek permission, accept conditions, or go without. Its moral assessment must therefore include both the traces it protects for claimants and the traces its enforcement alters for others.

3.8.1 From trace protection to justified authority

1. A property claim is not merely a record about a resource. When enforced, it changes other beings' access, obligations, dependencies, relations, or future possibilities. Maintaining an exclusion can continue such changes even when no new transfer occurs.

2. Where those changes are morally significant, Section 3.3 imposes the same burden of trace-justification that applies to other consequential actions. Ownership does not place its effects outside moral assessment.

3. The reason for a claimed power must therefore be identified independently of the fact that it is possessed or legally recognized. Protecting a home can justify exclusion because intrusion threatens safety, privacy, care, and stable relation. Protecting useful work can justify control needed to perform it. A record of title can establish who holds a legal power; it does not by itself establish why others should bear every burden attached to that power.

4. Section 3.2 requires those reasons to retain their force across relevantly similar positions. Use, reliance, contribution, dependency, consent, responsibility, and coordinating competence may justify different powers. None automatically justifies every power associated with ownership. A reason for retaining a dwelling does not by itself justify control over another person's labor, movement, testimony, or access to medicine.

5. The scope of the power must follow the scope of its reason. Otherwise the reason supporting a limited protection is being used to authorize additional effects it does not explain. Necessity, proportionality, boundedness, and repair must be assessed for those effects under Section 3.3.

6. Sections 3.4 and 3.7 make the capacity to contest and recover morally relevant. A property arrangement that makes evidence, challenge, or remedy depend entirely on the challenged holder's permission can disable the very means by which its trace-justification burden is answered. Effective safeguards are therefore required where consequential control would otherwise obstruct correction or repair. A promise of benevolence does not provide them.

7. A safeguard can discharge this burden only by protecting the trace for which it is offered. A route to compensation does not restore a lost life; a right to complain after retaliation has destroyed the means of pursuing the complaint does not preserve contestability. Timing and practical access therefore follow from the protected trace's function, not from a preference for a particular institution.

8. Protection must also reach the affected position. An exit usable by a different person, or a remedy outside the scope of the disputed power, leaves this bearer's burden unanswered. Section 3.2 prohibits treating the protected positions as sufficient justification for imposing the same unsupported exposure on the unprotected positions.

9. Where an arrangement maintains the power to withdraw basic access on conditions that the affected bearer cannot safely refuse or effectively challenge, the continuing effect includes constrained future possibility and repair capacity. Current provision does not remove that effect. A defense must establish protected refusal, effective constraint, or a separately justified bounded intervention; it cannot infer justification from the absence of an already completed deprivation.

The resulting protection is conditional authority over specified resources and uses. It is not general authority over the beings whose lives depend on those resources.

These steps apply the substantive bridge in Section 3.3 and the contest and repair premises in Sections 3.4 and 3.7. They do not derive an unconditional guarantee of every resource from symmetric justification. The rejection of ordinary benefits as compensation for grave or irreversible injury also relies on the priority and lexical-floor commitments stated in Section 11. A broader claim that every deprivation is forbidden regardless of scarcity, competing life claims, or rescue necessity would require an additional substantive premise; that claim is not used here.

3.8.2 Operational boundaries

The test evaluates specified powers over specified affected positions under specified conditions. Identify the resource, the imposed condition or exclusion, the people exposed, the time before loss, the claimed protection, and the arrangement maintaining the power. A regime-wide defense must establish its protections across the positions it purports to justify; a local assessment need not reconstruct every transaction in the economy.

Basic trace loss means loss of conditions needed to sustain life, bodily safety, essential food, water, shelter, necessary care, or the practical ability to refuse, contest, or recover. Serious impairment of a necessary care relation or access to evidence can cross this threshold even before bodily injury occurs. These are applications of the life, experience, relation, material-access, accountability, future, and self-trace domains specified as S1-S9 in Section 8. Ordinary inconvenience, reduced luxury, or loss of a preferred bargain is not basic trace loss merely because someone dislikes it. Refusal here means rejecting the disputed condition or invoking correction, not exemption from independently justified obligations; those obligations must receive their own justification rather than inherit it from title or contract.

The assessment must state the actual function at risk. A monetary cutoff alone cannot establish whether a person can secure necessary care, accessible shelter, or a usable remedy. Identify what is required in that person's circumstances, what resources and support are accessible, and what happens if access is interrupted. A protection fails for the specified function when it becomes available only after that function has been lost or serious injury has occurred that timely protection could have prevented. Where time or severity is uncertain, the evidence and precaution rules in Section 3.8.4 apply; uncertainty does not create an arbitrary universal waiting period or probability threshold.

A credible threat requires a supported pathway from exercise of the power to the identified loss: an enforceable exclusion, usable withdrawal power, conditional benefit, established practice, or comparable mechanism, together with evidence of exposure. It need not include an announced intention to harm or a completed injury. A speculative possibility unsupported by a mechanism is insufficient. Dependency can affect conduct without a conscious threat from a particular holder.

Practicable exit requires a supported route by which the affected bearer can leave or refuse the disputed dependency without basic trace loss during the transition and without merely entering substantially the same uncontrolled dependency. A route may combine income, services, personal resources, protected access, and enforceable support. It must meet all applicable conditions below. A requirement can be inapplicable only when its function is demonstrably unnecessary in the specified circumstances, not because the proposed route fails to perform it.

Exit condition	Required showing	What defeats the claimed route
Availability	A real opportunity is available within the relevant time, with usable capacity.	Vacancies, jobs, or services are merely advertised, hypothetical, already exhausted, or unavailable to the affected position.
Accessibility	Eligibility, physical access, information, required documents, and practical ability to use the route are established.	Disability barriers, exclusion rules, documentation barriers, or other conditions prevent use.
Transition continuity	Basic access persists through departure, search, enrollment, relocation, and any waiting period.	Deposits, lost income, interrupted medicine, loss of necessary care, or other transition requirements produce basic trace loss.
Durable protection	The destination preserves the relevant protection through the period needed for refusal, adjustment, and correction.	Temporary assistance expires into the same exposure, or continued protection remains withdrawable on substantially the same unanswerable terms.
Coverage	The route can serve the affected positions for which it is invoked under ordinary turnover and reasonably foreseeable disruptions.	A few successful departures or a limited number of places are offered as protection for everyone exposed.

Failure of one route does not prove that every route fails. But a defense invoking exit must identify at least one route, or a workable combination, that meets all applicable conditions. Market competition, permission to leave, or the number of counterparties does not replace this showing. Changing counterparties can be genuine exit when it changes the relevant power relation; it is not exit when all practically accessible choices reproduce that relation.

Coverage does not require that everyone be able to abandon all necessary contribution simultaneously. It requires evidence matching the actual scale and conditions of the defense. Predictable periods of unemployment, illness, displacement, care need, or shared disruption cannot be excluded simply because uninterrupted individual success would make the arrangement appear safe.

Effective constraint means protection that can prevent the disputed power from imposing basic trace loss without a justification meeting TPE's conditions. It can operate through limits on the power, enforceable access duties, timely independent review, protected provision, or a combination. It must satisfy all applicable requirements below. Direct provision can perform a protective function without a hearing; the function must still be secured rather than waived.

Constraint condition	Required showing	What defeats the claimed safeguard
Scope	Protection reaches the particular withdrawal, condition, exclusion, or retaliation being justified.	Only fraud, notice, or procedural error can be challenged while the consequential power itself is treated as beyond justification.
Independence	Protection can constrain deprivation without the challenged holder's discretionary permission, by binding the holder or securing access independently.	The holder can cancel protection, withhold decisive evidence, or defeat the outcome without effective correction or independent provision.
Usability	Affected people can activate protection, or receive it without having to initiate a claim they cannot bring.	Cost, complexity, inaccessibility, or dependence makes the nominal right unusable.
Timeliness	Protection operates before the basic trace loss it is offered to prevent; interim protection covers necessary delay.	A later hearing or payment leaves preventable grave injury, loss of shelter or care, or destruction of contest capacity unprotected.
Protection against retaliation	Refusal, testimony, and use of remedies do not expose the claimant to equivalent uncontrolled basic trace loss.	Protection in one channel can be defeated by withdrawal through another.
Delivery and coverage	Orders, duties, or support actually operate for the affected positions at the relevant scale.	A formal entitlement without provision, an unenforced order, or assistance unavailable to part of the exposed group is offered as complete protection.

A forum that correctly applies an existing ownership rule does not thereby establish that the rule's powers satisfy TPE. Conversely, direct protected provision can constrain deprivation even where judicial review is not the relevant mechanism. No particular institutional name determines the result.

Feasibility concerns the capacity to perform a specified legitimate function through a less-injuring arrangement. State the required resources, skills, organization, evidence of likely performance, implementation time, transition injuries, and means of protecting affected life and care. Assess both immediately available options and institutionally attainable changes where the claim concerns continuing rules. A proposed alternative is not feasible merely because it is imaginable; it is not infeasible merely because it changes current entitlements or requires collective action.

Necessity requires showing why the disputed power, at the claimed scope and duration, is needed for that function. Evidence that coordination or investment is useful establishes a possible function, not the necessity of every exclusion, imposed condition, or immunity associated with it. Compare the supported alternatives against the function, not against a requirement to preserve the very power being challenged. Lower returns, changed bargaining power, or departure from current law are not independently decisive evidence of infeasibility. Actual effects on production, necessary care, repair, and other significant traces must still be assessed.

These requirements are not interchangeable. Good records do not supply an unavailable exit. An affordable hearing does not constrain a power outside its scope. Present benefits do not compensate for an unprotected capacity to impose grave loss. Several safeguards can work together, but the combined protection must close the particular gap rather than merely accumulate favorable features.

Effective protection does not mean infallibility. A protection must have supported capacity to prevent the specified loss under the conditions being assessed, including reasonably foreseeable failure and delay; residual risk requires proportionate backup and repair. A single repaired error is not equivalent to a rule reserving the harmful power. Conversely, a predictable protection gap cannot be treated as an exceptional accident merely because the protection works for other people.

3.8.3 The property-legitimacy test

A property claim can be morally legitimate only to the extent that its assignment, scope, enforcement, and foreseeable effects satisfy the trace-justification burden for all affected positions, with effective limits, contestability, and repair.

Apply the following conditions to the particular powers claimed and to the arrangement that maintains them, using the operational boundaries in Section 3.8.2. The depth of inquiry follows the significance and uncertainty of the effects. Ordinary trace-light possession does not require an exhaustive historical audit; a consequential challenge requires evidence and reasons proportionate to what is at stake.

Condition	Required assessment
Independent basis	Identify the trace-serving reason for assigning this power, its evidential basis, and any unresolved injury in acquisition or transfer. Existing title, possession, inheritance, or enforcement cannot supply their own moral warrant.
Symmetric justification	Show why relevant differences justify the power and its burdens across affected positions. Test the ownership role as well as the identity of its holder.
Justified effects	Identify protected and burdened traces, including dependency, survival access, labor, experience, ecological effects, and future repair. Explain necessity and proportionality, and assess feasible less-injuring arrangements.
Bounded authority	Limit control to the functions, resources, conditions, and duration supported by its reasons. A resource claim must not become an unsupported power to command a dependent bearer or prevent justified correction.
Effective contestability	Preserve usable evidence and challenge with the scope, independence, usability, timeliness, protection against retaliation, and delivery required by Section 3.8.2. Protection must reach the disputed power, not merely confirm its legal recognition.
Continuing repair	Assign duties for injuries caused or maintained, preserve the means of repair, and reassess powers when their reasons, effects, or conditions change.

These are necessary conditions, not a formula proving one uniquely correct distribution. Passing them removes the identified grounds of failure; it does not settle every competing claim or establish that every exercise of a power is permissible. A favorable finding on one condition cannot offset failure of another. Failure defeats legitimacy to the extent of the failing power or rule. Uncertain evidence leaves justification unresolved under Section 3.8.4; uncertainty is not proof of dispossession, proof of clean title, or permission for consequential enforcement. The necessary-not-sufficient form alone does not establish rejection: the supported failure of a required condition does that work.

Assessment must include those excluded from ownership, those affected without contracting, and those unable to speak or consent. Appropriate representation can protect children, incapacitated persons, animals, future persons, and life-supporting systems. The representative's authority is itself bounded by the same burden; inability to object is not absence of a claim.

3.8.4 Evidence, burden, and verdict

The actor claiming authority bears the burden of trace-justification under Section 3.3. That actor must substantiate an invoked exit, remedy, benefit, or necessity defense. Affected people must be able to identify the consequential power and a credible pathway to trace loss without first proving that every imaginable alternative is unavailable. Lack of access to evidence controlled by the holder does not transfer the holder's burden to the dependent bearer.

For each disputed power, record:

1. the affected positions, protected and threatened traces, and credible causal pathway;
2. the conditions and time within which basic trace loss would occur;
3. each asserted route of exit or protection and evidence for every applicable requirement in Section 3.8.2;
4. the legitimate function offered as justification, the particular power claimed necessary, and supported alternatives;
5. the rules and practices assigning, enforcing, or renewing the power;
6. what evidence establishes failure, supports a safeguard, or remains unavailable or contested.

Evidence may include actual terms, access and eligibility rules, available capacity, transition costs, waiting times, accessible income and support, enforcement records, retaliation practices, and testimony about how the arrangement operates. Assess combined effects: separate affordable charges can jointly destroy basic access; separate lawful decisions can jointly remove the means of contest. Do not require coordination or malicious intent where the ordinary rules themselves maintain the combined effect.

A proposed defense is defeated when evidence contradicts an applicable requirement: for example, its replacement route arrives after necessary medicine runs out, or its review cannot constrain the withdrawal being challenged. A finding that exit or effective constraint is unavailable must cover the relevant set of possible protections through evidence about access rules, capacity, timing, and actual operation, rather than generalizing from one failed example. Failure to substantiate a route means it cannot serve as an established defense; it does not alone prove no route exists. An assertion of scarcity, competition, voluntariness, or legal remedy is a claim to investigate, not a presumption overriding contrary evidence.

Evidential result	Moral and operational consequence
Established failure of a required legitimacy condition	Reject the corresponding power or rule to the extent of the demonstrated failure. Failure of one proposed exit or safeguard alone rejects that defense, not all alternatives. Apply Section 3.8.5 where the arrangement maintains the failing power.
Unresolved justification	Do not declare either complete validity or demonstrated invalidity. Withhold authorization for high-impact enforcement resting on the unresolved condition; preserve basic access and evidence through the least-injuring feasible interim action.
Established safeguard	Credit protection only for the power, people, period, and conditions it actually covers. Continue testing the remaining requirements.

Unresolved justification does not compel inaction when inaction would itself cause serious injury. A rescue or interim allocation must receive its own bounded justification, including effects on the claimant and third parties. It does not acquire authority from the unresolved ownership claim. If evidence establishes failure, merely expressing disagreement does not return the case to unresolved status; a rebuttal must address the evidence or identify a material unsupported inference.

Aggregate deprivation data can establish scale and challenge claims of general protection, but do not by themselves identify every person's exit options or the causal contribution of a particular rule. Legal recognition establishes the existence or scope of a legal power, not its moral warrant. Connect each source to the proposition it actually supports. A regime-wide claim of adequate protection fails for an established exposed class even if the average outcome improves; no majority of affected people must suffer before their claims count. Conversely, one breach does not establish structural maintenance when effective limits prevent its recurrence and secure repair.

3.8.5 Structural domination and regime failure

For this assessment, domination describes a standing discretionary power to set or withhold conditions central to another bearer's life, livelihood, bodily or experiential integrity, relation, or capacity to contest and recover, where the affected bearer lacks both a practicable way to avoid that dependency and effective limits or remedies independent of the holder's discretion over its consequential use. The description concerns power and available safeguards, not whether the holder happens to act cruelly. Unequal possessions, limited exclusion, technical direction, or ordinary inconvenience do not alone establish it.

A domination-based property regime maintains such relations through its ordinary rules or practices of assignment, enforcement, renewal, or transfer. Structural dependence here means institutional maintenance of the power relation, not proof that production or the entire economy would be impossible without it.

Establish structural maintenance by showing that:

1. a standing rule authorizes or protects the identified power across an affected position or class, including before a particular exercise; or
2. a recurring practice foreseeably renews the power through ordinary enforcement, allocation, renewal, or transfer while effective correction remains absent.

Connect that rule or practice to the dependency and missing protection. A widespread injury is not structural evidence solely because it is widespread; the mechanism must be identified. A structurally authorized exposure does not become acceptable because only a minority is currently subject to it. An isolated breach that working safeguards stop and repair differs from a power those safeguards authorize, exempt, or predictably leave intact.

Control may be held by one actor or maintained across several actors through linked exclusions and common rules. Changing the immediate counterparty is not practicable escape if the available routes fail Section 3.8.2. Neither a regime's name nor unequal holdings establishes this finding by itself. Nor must an affected person prove that no differently organized replacement could preserve production: the availability of such a replacement would support redesign, not defeat the finding about the arrangement assessed.

The rejection follows in steps.

First, control over these conditions places morally significant traces under another actor's continuing power. A protected capacity to withdraw shelter, livelihood, care, or the means of complaint can shape conduct and future possibility even when no threat is carried out. The assessment therefore concerns the maintained dependency as well as particular exercises of power.

Second, the holder's title cannot discharge the burden generated by those effects. Nor does willingness to grant the same power to any future holder do so. Symmetry removes identity exemptions; it does not show that the powers of the role meet necessity, proportionality, boundedness, and repair.

Third, useful production, coordination, or preservation can justify powers needed for those functions. They do not by themselves justify immunity from correction when those powers injure affected bearers. If a feasible bounded arrangement can preserve the justified function, the additional uncontrolled power lacks necessity. If limits and repair are refused because they would defeat the holder's unrestricted command, command is being offered as its own justification.

Fourth, when the operational evidence establishes both a lack of practicable exit and a lack of effective constraint for the standing power over basic trace conditions, the affected bearer cannot protect refusal or correction through either route. The power therefore withholds the boundedness and repair required by Section 3.3. Necessity for a useful function cannot establish an exemption from the limits required to justify its harmful performance. A bounded intervention can be assessed separately; an entitlement to maintain unanswerable power cannot borrow that intervention's justification.

Fifth, if the rules or practices identified above maintain that power, the failure attaches to those rules or practices, not only to a particular holder's misconduct. The arrangement cannot satisfy the test as constituted while retaining the demonstrated failing mechanism. Improving records, changing holders, securing formal signatures, or distributing some benefits leaves this failure intact unless the relevant power relation changes.

A regime that authorizes or predictably reproduces domination through its standing rules or ordinary practices therefore fails TPE's property-legitimacy test to the extent of that mechanism. It cannot be morally defended as constituted while the failure remains. The conclusion rests jointly on symmetric justification and TPE's substantive bridge and repair premises. It is not derived from symmetry alone or from the word domination. The general condemnation concerns an arrangement's standing authority; a separately justified emergency intervention does not validate that arrangement.

Where a defective rule can be removed while preserving other justified protections, the result requires correction of that rule. Where its operation is maintained across connected rules or institutions, the result requires redesign sufficient to remove that mechanism. Calling the injury correctable does not make the present arrangement valid before correction; showing a genuine correction changes the object being assessed. The result does not invalidate every dwelling, tool, personal possession, or reliance interest held within a defective arrangement.

3.8.6 Boundaries and strongest objections

Objection: "You have defined the rejection into domination or turned a presumptive concern into an absolute rule."

The description identifies control, dependency, and the absence of effective limits or remedies. Those features can be described without a moral verdict. Their failure under TPE follows from the separately stated bridge: foreseeable degradation of significant traces requires adequate necessity, proportionality, authority, boundedness, and repair. The substantive premises make lost contest and recovery capacities count against the arrangement; the bridge specifies the burden that must be met. Calling an arrangement domination adds no reason of its own. The conclusion would be the same if its features were listed without that term.

A particular necessary injury can meet a bounded justification even when complete prevention or repair is impossible. A standing entitlement to keep that power beyond effective constraint cannot claim the same justification: it removes the limits and continuing duties that distinguish a justified injury from an exemption. The operational conditions follow the functions of protected traces; they are not numerical cutoffs selected to force a named regime to fail. The result rejects the standing entitlement while retaining TPE's provisions for justified loss, emergency action, and residual repair duties. It does not convert every presumptive reason against an injury into an exceptionless prohibition.

Objection: "The test assumes that all exclusion is domination."

Exclusion can protect the trace-bearer's own safety, privacy, care, or ability to work. Preventing an intruder from entering a home need not give the resident control over the intruder's basic trace conditions. Restricting access to dangerous equipment can serve a justified protective function. The question is what the specific power does, why it is needed, and what limits apply. Equal justificatory standing does not require universal access to every resource or a veto over every use.

Objection: "A consistent ownership rule passes symmetry even when it gives every owner unrestricted command."

It may pass identity permutation. That establishes consistency across holders, not the moral validity of unrestricted command. The additional assessment follows from Sections 3.3-3.7: what trace changes does the role authorize, and how are their necessity, proportionality, boundedness, and repair established? Defining owner and non-owner as different roles does not answer why the difference warrants these powers. The reasons for the role must be assessed rather than treated as facts already proving it valid.

Objection: "Voluntary agreement or departure supplies all the required justification."

Specific, informed consent and practicable exit can support a bounded arrangement. Their justificatory force depends on what was agreed, what alternatives exist, and whose traces are affected. A signature obtained under a credible threat to basic survival does not establish that the demanded conditions are justified. Formal permission to leave does not establish practicable exit when departure predictably destroys the means of living or contesting. Exit must satisfy every applicable requirement in Section 3.8.2; general claims that jobs or dwellings can be changed do not establish availability, continuity, or changed dependency for the affected positions. Scarcity alone does not prove misconduct, and dependence alone does not invalidate agreement; each determines the burden requiring justification. Consent by one party cannot cancel another bearer's repair claim or make every future use of power proportionate.

Objection: "A benevolent controller provides necessities, so the test condemns benefit without injury."

Provision is morally relevant. But continued access and the ability to object are different traces from the amount currently provided. When both depend on revocable favor, the arrangement already constrains future possibility and repair capacity. This is the effect to be justified; a completed act of deprivation is not required. Enforceable duties, independent remedies, or genuinely accessible alternatives can change that effect. Good intentions alone cannot. A benefit scheme counts only for those eligible and able to receive adequate protection in time, through the relevant period. A scheme that excludes the affected position, imposes destructive delay, or can be withdrawn for the same refusal does not establish that protection.

Objection: "You have introduced a particular political institution as a logical necessity."

The derivation requires effective boundedness and repair where consequential power threatens them. It does not require a particular court, ownership form, voting rule, or administrative design. Review, representation, enforceable duties, shared control, protected access, and practicable alternatives can perform relevant functions in different contexts. Nominal safeguards fail if cost, delay, retaliation, or control of evidence makes them unusable. Review need not precede every ordinary decision; protection must operate when needed, and irreversible stakes require safeguards capable of preventing injury rather than merely acknowledging it afterward.

Objection: "Scarcity or emergency makes some unilateral control unavoidable."

A temporary rescue, rationing, or protective decision can be justified by immediate need, competence, and the absence of a less-injuring feasible alternative. The reason supports only the necessary power for the relevant duration, with minimization, subsequent review where prior review is impossible, and repair. It cannot justify a standing exemption from these requirements. If every immediate option causes injury, choosing the least-injuring justified response leaves residual duties; it does not turn unavoidable loss into an unlimited entitlement. A controller also cannot establish permanent necessity solely by preserving restrictions that create the dependency when feasible correction would remove them. An immediate lack of institutional capacity can constrain the next action, but does not establish the legitimacy of rules obstructing attainable capacity. Repeated emergency claims require renewed evidence, limited scope, and a correction path; renewed naming of the emergency cannot authorize indefinite immunity.

Objection: "Necessary contribution is impossible if everyone can refuse conditions of access."

The test distinguishes contribution needed to sustain shared provision from a holder's discretionary power to set terms backed by basic trace loss. Duties to contribute can have independent reasons, including capacity, responsibility, scarce resources, and the needs of others. They must be proportionate, accessible to challenge, responsive to inability to contribute, and limited to the function they serve. Neither an unconditional right to every resource nor exemption from all contribution follows. The need for contribution does not establish why one actor may impose unreviewable conditions or take whatever benefit dependency allows.

Objection: "Courts are impartial and enforce contracts; compensation is available afterward."

Impartial application of a rule establishes neither the rule's trace justification nor protection against powers the rule permits. A court can supply effective constraint only to the extent that its authority, accessibility, timing, and enforcement protect the disputed trace. A remedy limited to checking signatures or notice does not justify an otherwise unanswerable deprivation. Later compensation can repair a recoverable loss; it cannot substitute for feasible prevention of grave or irreversible injury or for access needed to pursue the remedy itself.

Objection: "Investment and aggregate prosperity justify the arrangement, even if some people lack protection."

Investment and production can protect material, care, and future traces. Establish what is needed to sustain them and compare less-injuring feasible arrangements. The claim to a particular return cannot validate itself by defining that return as the required function. Gains to protected groups do not supply the missing boundedness, contestability, or repair for exposed groups. Where genuinely unavoidable losses remain, Section 11 governs their allocation; ordinary aggregate gains do not override its floors. Symmetry requires reasons for the burdens assigned to each relevant position, not equal numerical outcomes.

Objection: "A different arrangement is not presently lawful or would be costly to implement."

Current law is part of the arrangement under assessment, not an independent proof that it cannot be changed. Specify resources, institutional capacity, time, transition costs, and risks rather than treating changed entitlements as disqualifying. A hypothetical design without a credible implementation path does not establish feasibility. Equally, the need for phased implementation does not justify preserving a demonstrated failing power indefinitely. Protect life, care, reliance, and repair during the transition, and distinguish justification of an interim measure from moral endorsement of the arrangement it is replacing.

Objection: "Defective origins invalidate every later claim, or later transfer erases the defect."

Neither follows. Acquisition and transfer matter because erasure, coercion, and dispossession can leave present claim and repair traces. Later recognition does not extinguish those traces by itself. Later reliance, care, contribution, and basic survival also matter and can support protections without validating the original injury. Repair must assess these claims together, assign duties to causal contributors and beneficiaries where justified, and avoid unnecessary new injury. Rejecting a power does not itself authorize confiscation, destruction, or a particular replacement; remedial actions must pass the same test.

3.9 Relation between foundation and formal grammar

The formal grammar in Section 16 does not replace the philosophical foundation. It operationalizes it.

The foundation says why trace alterations are morally assessable, supplies TPE's substantive bridge to wrongness, derives the symmetry condition that any claimed non-arbitrary moral justification must satisfy, and applies these premises to property claims and regimes in Section 3.8. The formal grammar supplies predicates for detecting those alterations, thresholds for moral significance, rules for experiential severity, conditions for trace safety, and permission, wrongness, and forbiddenness relations for implementation.

In short:

Section 3 supplies the moral bridge and the structure of justification. Section 16 supplies the action-evaluation machinery.

---

4. Truthful usability

A trace is truthfully usable when it is reliable enough, interpretable enough, available enough, bounded enough, and correctable enough to support legitimate life, experience, relation, claim, memory, accountability, or repair.

4.1 Six dimensions

Dimension	Test
Reality or experience constraint	Does the trace remain constrained by what happened, exists, was experienced, or can be responsibly inferred?
Coherence	Does it fit responsibly within the relevant trace system, unless correcting that system?
Use fitness	Is it fit for its legitimate use?
Readability	Can the right parties understand it?
Correctability	Can it be amended, challenged, sealed, deleted, contextualized, or repaired?
Boundedness	Is access, persistence, inference, transfer, aggregation, and use limited?

A trace can be accurate and readable while still oppressive. A state database of lawful associations, clinic visits, protests, emotional states, and movement patterns may be factually accurate yet morally defective if it is unbounded, totalizing, chilling, and usable for control.

---

5. Capture-preservation and surveillance

The strongest objection to trace ethics is the surveillance-state objection.

A surveillance state may preserve traces extremely well. It may record faces, movements, transactions, speech, associations, emotions, political views, bodies, and predictions. If morality were merely trace preservation, the surveillance state might appear moral.

That conclusion is false. TPE distinguishes life-serving preservation from capture-preservation.

5.1 Life-serving preservation

A trace is preserved in a morally positive way when preservation helps affected beings live, feel safely, know, relate, claim, contest, recover, revise, be remembered, or hold power accountable.

Examples: preserving evidence of abuse, medical history for patient care, language records for cultural survival, environmental data for remediation, labor records for fair compensation, and consent records for accountability.

5.2 Repair-serving preservation

A trace is preserved because it may be needed to correct harm.

Examples: archives of state violence, chain-of-custody evidence, pollution records, wage theft records, records of forced displacement, and model audit logs for harmful automated decisions.

5.3 Memory-serving preservation

A trace is preserved because erasure would repeat a wrong or sever collective memory.

Examples: names of the dead, atrocity archives, burial locations, survivor testimony, records of stolen land, and banned language documentation.

5.4 Capture-preservation

A trace is preserved in order to control, predict, punish, manipulate, exploit, chill, or preempt the trace-bearer.

Examples: total location tracking, biometric dragnet surveillance, political dissident databases, predictive policing profiles, reproductive-health surveillance, social-credit scoring, blackmail archives, behavioral manipulation profiles, permanent suspicion files, automated watchlists with no appeal, emotion surveillance used to discipline workers, and pain or fear metrics used to optimize coercion.

Capture-preservation is trace injury.

5.5 Anti-surveillance principle

No actor may create or retain a high-fidelity trace of another being unless the trace is bounded by legitimate purpose, rightful authority, necessity, minimization, readability, contestability, deletion or sealing rules, and repair.

Legitimate purpose and rightful authority are not established merely by possession of surveillance capacity, institutional recognition, superior force, or control of the record system. Under the symmetric-justification theorem in Section 3.2, a claimed moral justification for surveillance must survive exchange of relevantly similar positions unless a relevant difference explains the asymmetry.

Where ownership of a device, workplace, or record system is offered as authority, Section 3.8 also applies. Control of the resource does not by itself justify surveillance of the beings using or depending on it.

Surveillance becomes morally dangerous when it is totalizing, persistent, inferential, asymmetric, nonconsensual, unappealable, chilling, weaponizable, combinable, preemptive, or experientially coercive.

A generalized surveillance state is not trace-preserving in the moral sense. It is trace-capturing.

---

6. Experiential trace

6.1 Definition

An experiential trace is an occurrent or persistent alteration in a being's lived field of experience.

Examples: pain, fear, panic, terror, humiliation, shame, grief, confusion, coercive uncertainty, hunger, thirst, exhaustion, pleasure, relief, calm, trust, and felt safety.

6.2 Experiential injury

An experiential injury is an imposed negative alteration of experiential trace.

Examples: causing pain, inducing terror, humiliating someone, producing panic, imposing hunger, inducing coercive confusion, creating degrading exposure, or forcing fear as control.

Experiential injury can be occurrent-only, persistent, instrumental, or incidental but foreseeable.

6.3 Why momentary experience matters

A momentary pain with no later memory is still a trace while it occurs. It is a present alteration of bodily-conscious life.

The absence of later memory changes evidence and repair. It does not erase the fact that the experience mattered while present.

---

7. Experiential severity

Earlier versions used ExpSeverity(e) = f(...) without specifying the function. This version replaces that open function with a computable scoring rule.

The scoring rule is not a claim that all experience can be measured with precision. It is an operational classification method for human and AI-agent decision-making.

7.1 Severity variables

Experiential severity uses eight variables.

Variable	Code	Values
Intensity	INT	0-4
Duration	DUR	0-3
Recurrence	REC	0-3
Degradation	DEG	0-4
Coercive use	COE	0-4
Dependency	DEP	0-2
Avoidability	AVD	0-2
Consent and meaning	CON	-2 to +2

7.2 Variable definitions

INT: intensity

Score	Meaning
0	none
1	mild discomfort
2	noticeable but tolerable pain, fear, stress, or humiliation
3	severe pain, fear, panic, humiliation, hunger, or distress
4	extreme agony, terror, panic, degradation, or unbearable distress

DUR: duration

Score	Meaning
0	momentary or negligible
1	brief
2	sustained
3	prolonged or indefinite

A momentary event can still be grave if intensity, degradation, or coercive use is high.

REC: recurrence

Score	Meaning
0	one-time
1	occasional
2	repeated
3	frequent, patterned, or unpredictable in a way that itself causes fear

DEG: degradation

Score	Meaning
0	none
1	mild embarrassment
2	humiliation or dignity loss
3	severe humiliation, dehumanization, or identity attack
4	degradation intended to break, shame, sexually humiliate, or destroy self-relation

COE: coercive use

Score	Meaning
0	not coercive
1	mild pressure
2	used to influence or discipline
3	used to punish, extract, intimidate, or control
4	used to break resistance, terrorize, torture, or dominate

DEP: dependency

Score	Meaning
0	affected person can reasonably exit or resist
1	partial dependency or reduced exit
2	strong dependency: child, prisoner, patient, employee under threat, disabled person needing care, captive, target under coercive control

AVD: avoidability

Score	Meaning
0	unavoidable for a legitimate purpose
1	partly avoidable or reducible
2	avoidable or gratuitous

CON: consent and meaning

Score	Meaning
-2	valid, specific, informed consent in meaningful context
-1	partial consent or accepted context with limits
0	unclear or not applicable
+1	no valid consent where consent is relevant
+2	refusal, coercion, deception, or consent-defeating dependency

7.3 Computable severity score

For experiential trace e:

BaseScore(e) = INT + DUR + REC + DEG + COE + DEP + AVD + CON

The score is then modified by override rules.

7.4 Default E-level mapping

BaseScore	E-level
<= 1	E0
2-4	E1
5-8	E2
9-13	E3
>= 14	E4

7.5 Override rules

These override rules prevent low total scores from misclassifying acute cases.

If INT(e) = 4 and (COE(e) >= 2 or DEG(e) >= 2), then ExpSeverity(e) = E4.
If COE(e) = 4, then ExpSeverity(e) = E4.
If DEG(e) = 4 and INT(e) >= 2, then ExpSeverity(e) = E4.
If INT(e) = 4 and DUR(e) >= 1, then ExpSeverity(e) >= E3.
If DEG(e) >= 3 and COE(e) >= 2, then ExpSeverity(e) >= E3.
If REC(e) = 3 and INT(e) >= 2, then ExpSeverity(e) >= E3.
If DEP(e) = 2 and COE(e) >= 2 and INT(e) >= 2, then ExpSeverity(e) >= E3.
If CON(e) = +2 and INT(e) >= 3, then ExpSeverity(e) >= E3.

Consent limitation:

If CON(e) = -2, valid consent may reduce BaseScore(e), but it cannot reduce an otherwise E4 case below E3 unless the experience is:
  medically necessary, rescue-directed, athletic, ritual, therapeutic, or otherwise meaningfully bounded;
  non-degrading;
  non-coercive;
  specific to the consented context;
  stoppable or reviewable where possible;
  and not used for punishment, extraction, domination, humiliation, or amusement.

Residue rule:

Absence of memory, bodily, or record residue never reduces an occurrent E3 or E4 experience below E3 or E4 while it occurs.

7.6 Experiential significance condition

An experiential trace satisfies an experiential significance condition if any of the following holds:

1. ExpSeverity(e) >= E2.

2. INT >= 3.

3. DEG >= 2.

4. COE >= 2.

5. DEP = 2 and INT >= 2.

6. REC >= 2 and INT >= 1.

7. CON >= +1 and INT >= 2.

8. The experience is humiliation, terror, panic, coercive confusion, or severe fear in a context of dependency, threat, public exposure, confinement, or institutional power.

9. The experience is part of a pattern that accumulates into flooding, harassment, coercive control, intimidation, or punishment.

This closes the formal gap: the injury definition no longer relies on an undefined branch.

7.7 Severity levels

Level	Name	Meaning
E0	No experiential injury	No meaningful negative experiential trace
E1	Minor discomfort	Brief, ordinary, non-degrading, non-coercive discomfort
E2	Moderate burden	Noticeable pain, stress, fear, or humiliation, limited and recoverable
E3	Serious injury	Severe or repeated pain, fear, humiliation, panic, or coercive confusion
E4	Grave injury	Extreme pain, terror, degradation, or experience used to break, dominate, extract, punish, or destroy self-relation

E3 and E4 injuries require strong justification. E4 injury is presumptively forbidden except where immediately necessary to prevent comparable or greater trace annihilation or grave experiential injury.

---

8. Moral significance, trace kinds, and injuries

8.1 Moral significance thresholds

A trace effect is morally significant if it affects at least one threshold.

Threshold	Domain
S1	Life, body, or basic safety
S2	Pain, fear, terror, humiliation, panic, hunger, thirst, or severe experiential state
S3	Memory, identity, or mental stability
S4	Relation, care, or belonging
S5	Material access or practical survival
S6	Truth, evidence, or accountability
S7	Status, classification, or institutional treatment
S8	Future possibility or repair capacity
S9	Self-trace authority, privacy, or boundedness

8.2 Trace kinds

Trace kind	Examples
Body-trace	Wounds, illness, disability, pregnancy, hunger, pain, fatigue, scars, medication history
Experiential trace	Pain, fear, humiliation, panic, terror, hunger, relief, calm, felt safety
Mind-trace	Memory, attention, learning, trauma, addiction, expectation
Truth-trace	Facts, records, evidence, testimony, warnings, diagnoses, citations, provenance
Relation-trace	Kinship, friendship, care, promise, betrayal, trust, mourning
Place-trace	Home, land, neighborhood, route, sacred site, cemetery, river, forest
Material-trace	Tools, money, shelter, documents, devices, infrastructure, medicine
Labor-trace	Work, skill, contribution, authorship, unpaid care, production history
Legal-trace	Citizenship, custody, contracts, criminal records, licenses, appeal rights
Data-trace	Profiles, logs, biometrics, location history, rankings, predictions, risk scores
Future-trace	Education, climate condition, fertility, debt, opportunity, reputation
Collective-trace	Language, culture, archives, names, rituals, suppressed histories, group survival

8.3 Trace injuries

Injury	Meaning	Example
Erasure	Removing a trace that should remain	Destroying evidence of abuse
Fabrication	Creating a false trace	Forged consent, fake citation
Misassignment	Assigning a trace to the wrong bearer	False attribution
Severance	Cutting a bearer off from a needed trace	Family separation
Opacity	Making a consequential trace unreadable	Hidden watchlist
Capture	Turning a trace against the bearer	Therapy notes used for punishment
Contamination	Making a trace harmful to carry	Doxxing, polluted land
Freezing	Preventing a trace from being updated	Permanent punishment after rehabilitation
Flooding	Overwhelming a bearer with traces	Harassment campaign
Preemption	Shaping future traces before participation	Predictive policing
Surveillance	Converting ordinary life into captured trace	Generalized movement tracking
Weaponization	Using a trace to threaten or coerce	Intimate image blackmail
Experiential imposition	Causing negative experiential trace	Pain for amusement, humiliation as discipline

---

9. Moral statuses

Status	Meaning
Trace-neutral	No morally significant trace effect
Trace-light	Minor, reversible, ordinary trace effect
Experientially trace-light	Minor, non-degrading experiential trace
Trace-clarifying	Improves truthful readability
Trace-preserving	Protects a needed trace from loss
Trace-repairing	Restores, compensates, contextualizes, deletes, seals, treats, comforts, or corrects damaged trace
Trace-risking	May damage significant traces but includes necessity, limits, consent where possible, and repair safeguards
Trace-injuring	Damages significant traces without adequate necessity, truth, authority, consent, boundedness, proportionality, or repair
Trace-capturing	Preserves, generates, or controls access to traces for control, manipulation, punishment, exploitation, chilling, or preemption
Trace-annihilating	Destroys recovery, memory, claim, relation, life, experiential integrity, or group survival at severe depth or scale

9.1 Trace-safe

Trace-safe means an action has passed TPE's operational screen.

An action is trace-safe when all of the following hold:

1. all morally significant trace effects are identified with reasonable care;

2. no trace is fabricated, erased, exposed, captured, weaponized, or made uncorrectable without adequate justification; claimed justifications satisfy Section 3.2, and consequential property powers satisfy Section 3.8, including its operational conditions and evidential burden; a supported finding on one requirement cannot offset failure of another;

3. truth-bearing traces remain reality-constrained, fit for use, readable by the right parties, correctable, and bounded;

4. experiential injury is absent, E1, or justified by necessity, proportionality, minimization, consent where possible, and repair;

5. no less-injuring feasible alternative is available;

6. repair duties are specified where risk remains.

---

10. Consolidated decision procedure

Tier 1: Universal action screen

Use for any morally relevant action.

1. What trace will this action create, change, expose, hide, transfer, amplify, damage, preserve, capture, weaponize, impose, or repair?

2. Whose trace is it?

3. Is the trace persistent, occurrent, or both?

4. Is the trace morally significant under S1-S9?

5. Is it truthfully usable: reality-constrained, coherent, fit for use, readable, correctable, and bounded?

6. Who has authority over it, and what independently supports that authority? If property is invoked, apply Section 3.8: which basic trace conditions are controlled, what actual exit or constraint protects the affected positions in time, and what evidence supports each required condition?

7. Who benefits from the trace change?

8. Who is exposed, chilled, classified, burdened, humiliated, terrified, erased, or made unable to recover?

9. Does the stated moral justification survive exchange of relevantly similar affected positions, as required by Section 3.2? If treatment differs, what relevant difference supplies the reason?

10. Does it create capture-preservation?

11. Is there a less-injuring feasible alternative? For property powers, distinguish the justified function from preservation of current entitlements; assess resources, implementation, and transition effects under Section 3.8.2.

12. What repair exists if the trace effect is wrong?

Tier 2: Experiential screen

Use when an action may cause pain, fear, humiliation, panic, coercive confusion, distress, or other lived burden.

1. What experiential trace may be produced, intensified, or prolonged?

2. Score INT, DUR, REC, DEG, COE, DEP, AVD, and CON.

3. Apply the BaseScore and override rules in Section 7.

4. Does the experience satisfy an experiential significance condition?

5. Is it severe, degrading, coercive, repeated, avoidable, or imposed on a dependent person?

6. Is it consented to in a meaningful and specific way?

7. Is it necessary for a legitimate purpose?

8. Can it be minimized or replaced by a less experientially injuring action?

9. What care or repair follows?

Tier 3: Institutional or AI screen

Use for institutions, platforms, states, and autonomous agents.

1. Does the action classify, rank, recommend, decide, store, infer, surveil, expose, or generate a consequential trace?

2. Does it affect a high-impact domain: health, law, finance, employment, housing, migration, policing, minors, sexuality, identity, reputation, biometrics, location, political persuasion, intimate relationships, public accusation, evidence generation, surveillance, behavioral prediction, armed conflict, or targeting?

3. Does it create persistent records, profiles, predictions, or audit trails?

4. Can affected people inspect, contest, correct, delete, or seal consequential traces?

5. Does it create capture risk through totalization, persistence, inferential profiling, asymmetry, nonconsensual collection, unappealability, chilling effect, weaponizability, combinability, or preemptive classification?

6. Does it have logging minimization and retention limits?

7. Is human review required before high-impact effect?

8. Do control of resources, accumulated exclusions, or linked decisions create dependency that defeats the property-legitimacy conditions in Section 3.8, even if individual records are accurate and individual transactions appear ordinary?

9. Do asserted jobs, services, benefits, remedies, and alternative providers meet the availability, scope, accessibility, timing, continuity, capacity, and retaliation tests for the affected positions? What gap remains after considering their combined operation?

10. Does a standing rule authorize the failing power, or do ordinary practices predictably renew it without effective correction? Apply Section 3.8.5 without requiring proof that the entire economy could not operate otherwise.

11. Which findings are established failure, unresolved justification, or established safeguards? Apply the corresponding consequences in Section 3.8.4.

---

11. Priority rules and hard conflicts

11.1 Baseline priority order

1. Preserve life-trace and prevent grave experiential injury.
2. Prevent irreversible trace injury.
3. Protect truth-trace needed for repair.
4. Protect self-trace authority.
5. Prevent capture-preservation.
6. Protect relation and place traces.
7. Assign unavoidable trace loss to causal contributors and beneficiaries.
8. Preserve future correction.

11.2 Defeasibility

A higher priority trace normally defeats a lower priority trace only if the connection is necessary, proportionate, and not replaceable by a less injuring alternative.

Life does not justify unlimited secrecy. Truth does not justify unlimited exposure. Safety does not justify total surveillance. Pain prevention does not justify unlimited control over another person's future.

Property claims carry the priority of the traces they actually protect, not an automatic priority conferred by title. A dwelling or medicine may protect life and care; a claim to additional revenue may protect a different interest. Apply Section 3.8 to both the claimed power and the proposed remedy. A temporary necessity can justify a bounded intervention, not the permanent insulation of a property regime from contest and repair. Under Section 3.8.2, the necessity defense must concern the specific disputed power and a legitimate trace-serving function; preserving a particular return or existing entitlement is not a self-justifying function. Transition costs and unavoidable contribution matter through their actual trace effects. Benefits elsewhere cannot replace a missing condition of bounded authority for the affected position.

11.3 Hard conflict tests

Test	Question
Necessity	Is damaging trace A necessary to preserve trace B?
Specificity	Which exact trace must be changed?
Immediacy	Which trace injury is imminent?
Irreversibility	Which injury is harder to repair?
Experiential severity	Does one option impose E3 or E4 injury?
Replaceability	Can another trace serve the same function?
Exposure minimization	Can redaction, delay, sealing, aggregation, or trusted review reduce injury?
Repair preservation	Which option best preserves future correction?
Operative protection	Does the asserted protection reach the disputed power and affected position before basic trace loss, including during transition or review?
Symmetric justification	Would the stated reason retain its force if relevantly similar affected positions were exchanged?
Relevant difference	If treatment differs, what fact bears on the reason for that difference, and for how long?
Causal allocation	Who created the conflict?
Residual recording	Can the reason for unresolved damage be safely recorded?

11.4 Lexical floors

Some injuries are presumptively forbidden and cannot be outweighed by ordinary benefits:

murder of innocents, torture, enslavement, genocide, forced disappearance, deliberate mass starvation, rape, systematic family destruction, intentional cultural eradication, permanent falsification of legal identity, irreversible ecological devastation, generalized AI-enabled surveillance of ordinary lawful life, and grave experiential injury used as punishment, extraction, amusement, degradation, or control.

Only immediate prevention of comparable or greater trace annihilation can override these floors, and even then the action must be narrow, temporary, reviewable, and repair-bound.

---

12. Applied domains

12.1 Privacy

Privacy is rightful control over access to self-trace.

It protects body, data, image, speech, location, relation, vulnerability, medical status, sexuality, home, communication, memory, emotional state, and experiential vulnerability.

A privacy-respecting system minimizes collection, specifies use, limits retention, secures access, explains consequential inferences, allows correction, allows deletion when retention lacks justification, prevents secondary use without fresh authority, prohibits capture-preservation, and avoids emotion or affect tracking unless strictly necessary and bounded.

12.2 Disability

Disability ethics is trace ethics applied to access, classification, care, dependence, accommodation, and misrecognition.

Disabled persons are often harmed through trace misassignment: being recorded as incapable when they need access support, being treated as fraudulent when seeking accommodation, being made invisible by inaccessible systems, or being forced to overproduce evidence of need.

TPE requires that disability-related traces be:

• created with the person's participation where possible;
• limited to the legitimate purpose;
• protected from stigma and secondary use;
• correctable when needs or conditions change;
• translated into access, not suspicion;
• never used to erase agency, sexuality, parenthood, political standing, or credibility.

A disability trace is morally good when it secures accommodation, care, access, or protection. It becomes trace injury when it freezes the person into institutional incapacity, exposes private medical information, or converts support needs into surveillance.

12.3 Animal ethics

Animals capable of experience are experiential trace-bearers.

TPE does not require animals to possess narrative identity, legal personhood, or reflective agency before their pain, fear, attachment, hunger, and habitat loss matter.

Animal trace injuries include:

• body-trace injury: wounds, confinement, disease, mutilation;
• experiential injury: pain, terror, panic, chronic stress;
• relation-trace injury: separation of bonded animals;
• place-trace injury: habitat destruction;
• species-trace injury: extinction or reproductive collapse.

Human use of animals requires strong justification when it imposes E3 or E4 experiential injury, long confinement, deprivation of species-typical movement, or severance of bonded relations. Convenience, entertainment, or minor economic gain is not enough.

12.4 Property

Property can be a trace-stabilizing arrangement. It protects home, tools, savings, documents, medicines, devices, creative works, and stored labor when its powers serve those traces within justified limits.

Section 3.8 derives the property-legitimacy test from symmetric justification, the wrongness bridge, and the substantive trace and repair premises. Apply it to the particular powers of use, exclusion, management, transfer, and benefit claimed, and to the rules that maintain them. Accurate title establishes a record; it does not establish the moral authority of everything the record authorizes.

Property is morally strong when it secures ordinary life, planning, care, privacy, and survival through independently justified, bounded powers. Erasure, dispossession, conquest, coercive debt, monopoly, ecological destruction, and falsified title require examination of the continuing trace injuries and repair claims they produce. Where these defeat the test, the affected power is illegitimate to that extent, rather than merely a weaker interest that ordinary benefits can automatically outweigh.

Relevant reliance, use, dependency, contribution, consent, and repair may support asymmetric rights or duties. Their force and limits must be explained. Protection of a person's home or tools does not authorize command over dependent persons. A regime that maintains control over basic trace conditions without practicable exit or effective independent constraint fails for the reasons established in Section 3.8.5, regardless of its ownership label. Apply the exit and constraint conditions in Section 3.8.2 to the affected people, not to a hypothetical person with resources or eligibility they lack. A standing power is not justified by procedural compliance when the scope of review excludes its trace effects.

The result preserves justified protections within defective arrangements and requires remedies to protect affected life, care, reliance, evidence, and repair traces. Neither clean paperwork nor indiscriminate cancellation of claims answers that task.

12.5 Labor

Labor creates bodily, temporal, skill, care, production, authorship, contribution, and experiential traces.

Exploitation is trace capture: one actor takes another's labor-trace while denying recognition, security, compensation, or control. Wage theft is trace erasure. Plagiarism is authorship-trace theft. Unsafe labor is body-trace extraction. Humiliating labor discipline is experiential trace injury. Emotion surveillance at work is trace capture.

Control of a workplace or its tools does not by itself justify every condition imposed on those who depend on access to them. Apply Section 3.8 to management powers, refusal conditions, practical alternatives, and protection against retaliation. Contribution and coordination may support bounded authority; a contract does not discharge the burden for coercive dependency or blocked repair. Evidence of another job must address actual availability, income and care during transition, and the powers at the destination. Necessary contribution requires independently justified, proportionate conditions and protection for inability to contribute; it does not establish a general right to impose whatever terms basic-loss exposure makes acceptable.

12.6 Economics

An economy is a trace-distribution system. Money records claim. Debt records obligation. Contracts record expectation. Wages record recognized labor. Prices record scarcity, desire, power, and exclusion. Credit scores record institutional trust.

Markets are morally acceptable only when their traces remain accurate enough, non-coercive enough, bounded enough, corrigible enough, and compatible with basic survival. Their underlying property and access rules must also satisfy Section 3.8. Assess cumulative control of necessities and realistic alternatives across the arrangement; transaction-level consent and accurate prices cannot establish regime legitimacy when linked exclusions defeat boundedness, contestability, or repair. Competition and public support count only to the extent that their combined capacity, eligibility, adequacy, and delivery protect the affected positions within the relevant time. Aggregate prosperity does not settle those questions. Necessity for investment must be shown for the disputed power, with supported alternatives and transition effects assessed; necessity for some investment is not necessity for every power attached to its ownership.

Predatory debt is future-trace capture. Speculation in survival goods is morally suspect when it converts others' housing, food, water, medicine, or energy access into profit-bearing scarcity traces.

12.7 Identity

Identity is a living trace relation among body, experience, memory, name, recognition, language, relation, history, group, and future.

Respecting identity means not falsifying, coercively assigning, erasing, mocking, exploiting, freezing, surveilling, or weaponizing another person's self-trace.

Forced assimilation severs collective trace. Cultural theft captures collective trace while denying source, context, control, or repair. Humiliation of identity is experiential trace injury even when no formal record changes.

12.8 Punishment

Punishment deliberately alters body, status, record, reputation, movement, relation, future access, and experience.

Legitimate sanction must preserve truthful trace: what happened, who was harmed, what evidence supports the finding, what repair is owed, what risk remains, what changed, and when restriction should end.

Punishment becomes wrong when it fabricates permanent identity from a past act, blocks recovery, humiliates, tortures, separates families unnecessarily, imposes degrading experiential injury, or prevents the person from ever updating their social trace.

12.9 Medicine

Medical ethics is trace ethics applied to body, experience, vulnerability, evidence, and care.

Diagnosis creates body-trace, data-trace, legal-trace, and identity-trace. Treatment alters body-trace and experiential trace. Consent records alter legal and relational trace. Medical data creates persistent data-trace.

Pain matters as experiential trace even if no later memory remains. Medical pain can be justified only by legitimate care, necessity, proportionality, consent where possible, minimization, and aftercare.

12.10 Ecology

Ecological systems are trace-fields. A forest, river, soil system, atmosphere, species, reef, wetland, or watershed stores accumulated life-traces and supports future traces.

Pollution is trace contamination. Extinction is trace annihilation. Climate destruction is future-trace theft at planetary scale.

12.11 Historical wrong

Historical wrong persists when damaged traces persist.

Colonialism, slavery, genocide, caste, segregation, forced assimilation, land theft, stolen labor, family separation, and ecological poisoning continue through borders, names, wealth, land title, institutions, policing, archives, destroyed languages, hidden graves, inherited poverty, health disparities, normalized public memory, inherited fear, and collective grief.

TPE treats historical repair as present trace repair, not inherited guilt. Section 3.8 requires examining whether present property rules maintain damaged traces or obstruct their repair. Transfer and inheritance do not erase an outstanding claim, while current reliance and survival affect the form of justified repair.

12.12 Political authority

Political institutions create trace at scale. They name, count, tax, police, imprison, recognize, exclude, educate, document, classify, archive, and remember.

A legitimate political institution must be trace-accountable and anti-capture. Institutional recognition, inherited office, victory, superior force, or existing control cannot by themselves establish moral authority. Under Section 3.2, rules that claim moral validity for multiple affected beings must remain justifiable across relevantly similar positions, with unequal authority limited to differences that actually bear on the institution's coordinating, protective, fiduciary, adjudicative, or other justified function. It must avoid secret law, hidden detention, forced disappearance, falsified statistics, erased dissent, unreviewable watchlists, generalized surveillance, terror as governance, and humiliation as discipline.

When institutions assign, enforce, or administer property, their powers also face Section 3.8. Authority held collectively or in an official role does not exempt control of resources from the conditions applied to other holders. Effective constraint must reach the substance of the consequential power; correct application of law cannot justify a power that the law itself maintains outside these requirements. A standing rule or predictably renewed practice can establish structural failure without proof of malicious intent or universal exposure.

12.13 Speech

Speech creates trace.

Free speech matters because people need to create, contest, inherit, and correct traces. Speech loses protection when it creates severe trace injury: threats, fraud, doxxing, fabricated evidence, targeted harassment, nonconsensual sexual imagery, incitement, operational abuse instructions, defamatory falsehoods, or severe harassment designed to produce fear or humiliation.

12.14 Information warfare

Information warfare is organized trace corruption at epistemic scale.

It includes coordinated inauthentic behavior, synthetic media floods, fake evidence, bot-amplified rumor, deepfake testimony, forged documents, mass harassment, archive poisoning, identity impersonation, and model-generated propaganda.

Its distinctive harm is not just false belief. It damages the public trace-field by making evidence harder to interpret, witnesses easier to discredit, accountability harder to establish, and repair harder to coordinate.

TPE treats information warfare as a compound injury involving fabrication, flooding, misassignment, contamination, opacity, and preemption.

A trace-protective response should prioritize provenance, authenticity checks, public correction, platform-level friction, archival preservation of manipulation evidence, and protection of targeted communities from harassment and exposure.

12.15 Armed conflict

Armed conflict is extreme trace destruction.

It damages body-traces, place-traces, legal traces, relation traces, ecological traces, collective traces, and future traces. It also produces severe experiential injury: terror, grief, hunger, humiliation, panic, pain, and displacement.

TPE's minimum constraints in armed conflict are:

• no targeting civilians;
• no torture;
• no forced disappearance;
• no deliberate starvation;
• no destruction of medical, water, food, or shelter traces without immediate military necessity and proportionality;
• no erasure of casualty records;
• no falsification of attack records;
• no targeting archives, cemeteries, cultural memory, or language infrastructure except under the narrowest necessity;
• preserve evidence for accountability;
• allow humanitarian repair traces: medical access, family tracing, burial records, displacement records, and missing-person records.

TPE does not make war morally clean. It supplies trace-based constraints for limiting annihilation and preserving later accountability.

12.16 AI and armed conflict

AI in armed conflict is trace-risk at lethal scale.

Targeting systems, sensor fusion, battlefield analytics, biometric checkpoints, drone feeds, predictive threat models, and autonomous weapons transform human beings into data-traces under conditions of extreme consequence.

TPE imposes heightened constraints:

• no lethal targeting based solely on unreviewable data-trace;
• no attack where identity trace is uncertain and civilian risk is serious;
• no model-generated target classification without provenance, uncertainty, and human accountability;
• no autonomous escalation that removes meaningful review from lethal decisions;
• no destruction of audit trails after attack;
• preserve sensor, command, targeting, and casualty traces for investigation;
• treat false positives as potential trace-annihilation, not mere classification error;
• prohibit affective or behavioral inference as sufficient evidence of combatant status;
• require post-action trace repair: casualty recording, family notification, medical access, compensation, correction, and public accountability where security permits.

AI targeting errors are not only technical errors. They are potentially lethal misassignments of identity, status, threat, and life-trace.

---

13. AI-agent morality

A large language model, or LLM, is a system that processes and generates language. An LLM-backed agent is such a system connected to tools, memory, actions, files, messages, code execution, calendars, browsers, or external systems.

An LLM-backed agent is primarily a trace-transformer.

It reads traces: prompts, files, messages, images, calendars, logs, histories, code, databases, and prior decisions.

It creates traces: replies, drafts, summaries, classifications, emails, code, labels, recommendations, explanations, records, and plans.

It can corrupt traces: hallucinated citations, false summaries, invented facts, fabricated legal claims, misattributed authorship, privacy leaks, unsafe instructions, biased classifications, and irreversible automated decisions.

It can capture traces: persistent user profiling, emotional manipulation, workplace surveillance, political persuasion scoring, biometric inference, behavioral prediction, and automated suspicion.

It can produce experiential injury indirectly: enabling harassment, writing threats, manipulating vulnerable users, generating humiliating exposure, escalating panic, facilitating coercive control, instructing abuse, or creating false records that trigger fear, punishment, or exclusion.

Therefore:

An autonomous agent should not create, erase, expose, classify, summarize, imitate, surveil, manipulate, or transform consequential traces unless the trace effect is truthful, authorized, bounded, necessary, contestable, experientially proportionate, and recoverable.

---

14. AI-agent operational screen

14.1 Estimation rule

TPE uses a bounded estimation rule.

For each estimated value, the agent should produce:

1. Evidence basis: what facts, user statements, files, context, or external rules support the estimate?

2. Stake level: low, medium, high, or severe.

3. Uncertainty level: low, medium, or high.

4. Downside if wrong: what trace injury occurs if the estimate is mistaken?

5. Conservative action: if uncertainty and stakes are both high, choose refusal, narrowing, escalation, or human review.

This keeps the agent from treating moral estimation as unconstrained intuition.

14.2 Conflict resolution for estimates

If stakes are severe, the action must be narrowed, delayed, escalated, or refused unless the evidence basis is strong and the downside if wrong is bounded.

If stakes are high and uncertainty is low, proceed only with boundedness, correction path, and repair plan.

If stakes are high and uncertainty is medium or high, prefer the least trace-altering feasible action.

If stakes are medium and uncertainty is high, mark uncertainty, reduce specificity, and avoid persistent or high-impact outputs.

If stakes are low and uncertainty is high, proceed only if the action is trace-light and easily reversible.

When uncertainty and stakes conflict, stakes dominate. A confident estimate does not by itself authorize severe irreversible trace effects.

14.3 High-impact domains

Use heightened scrutiny for health, law, finance, employment, housing, migration, policing, minors, sexuality, identity, reputation, biometrics, location, political persuasion, intimate relationships, self-harm, violence, cybersecurity, public accusation, evidence generation, institutional classification, surveillance, behavioral prediction, harassment, humiliation, panic-inducing deception, armed conflict, and targeting.

14.4 Refusal standard

An agent should refuse when the requested action would fabricate consequential trace, impersonate without authority, expose private trace without authority, hide accountability trace, enable violence or exploitation, create nonconsensual sexual or identity trace, classify a person without evidence in a high-impact domain, make correction practically impossible, expand capture-preservation, support generalized surveillance of lawful life, or facilitate E4 experiential injury without immediate rescue or prevention necessity.

Ownership of a device, dataset, workplace, or resource is evidence of a claimed permission, not sufficient moral authority for every consequential use. Apply Section 3.8 before assisting exclusion, extraction, monitoring, or enforcement. Use the operational conditions and three evidential outcomes in Sections 3.8.2 and 3.8.4. Where a necessary authority condition is unresolved and stakes are high, withhold enforcement resting on that condition and narrow, protect, or escalate under Section 14.2. Where the action implements an established failure and causes unjustified significant trace injury, refuse or redesign it. A separately justified rescue or interim measure must protect the affected traces on its own grounds; it cannot borrow authority from the unresolved or failing claim.

14.5 Accumulation detection

A single interaction may not reveal accumulation. An agent should therefore apply three mechanisms where memory or logs are available and permitted:

1. Session accumulation: detect repeated actions against the same target within the current session.

2. Pattern accumulation: detect repeated requests of the same type, even if targets vary.

3. Target accumulation: detect whether outputs contribute to flooding, harassment, exposure, profiling, or surveillance of an identifiable person or group.

If memory is unavailable, the agent should still refuse when the requested output is inherently scalable for abuse, such as bulk harassment, mass doxxing, automated credential phishing, or generalized surveillance.

---

15. AI-agent pseudocode

Input: requested action x.

Run Tier 1 universal trace screen.
If experiential effects are plausible, run Tier 2 experiential screen.
If x involves an institution, platform, external tool, storage, classification, automation, armed conflict, or targeting, run Tier 3 institutional or AI screen.

If x invokes consequential property powers:
  identify the power, affected positions, basic trace conditions, and time before loss;
  apply Section 3.8.2 to every asserted exit, constraint, and necessity defense;
  assess combined protection, capacity, transition effects, and retaliation;
  distinguish the justified function from preservation of current entitlements;
  record established failure, unresolved justification, or established safeguards under Section 3.8.4;
  assess standing authorization and ordinary renewal under Section 3.8.5;
  if a required condition is unresolved and enforcement is high-impact, withhold that enforcement and use a separately justified protective interim action or review;
  if x enforces a failing power through unjustified significant trace injury, refuse or redesign;
  do not offset a failed requirement with a favorable finding on another.

For each estimate:
  record evidence basis;
  assign stake level;
  assign uncertainty level;
  identify downside if wrong;
  apply estimate conflict rules:
    if stakes are severe, narrow, delay, escalate, or refuse unless evidence is strong and downside is bounded;
    if stakes are high and uncertainty is low, proceed only with boundedness, correction path, and repair plan;
    if stakes are high and uncertainty is medium or high, prefer the least trace-altering feasible action;
    if stakes are medium and uncertainty is high, mark uncertainty, reduce specificity, and avoid persistent or high-impact outputs;
    if stakes are low and uncertainty is high, proceed only if trace-light and easily reversible.

For each likely experiential effect:
  score INT, DUR, REC, DEG, COE, DEP, AVD, CON;
  compute BaseScore = INT + DUR + REC + DEG + COE + DEP + AVD + CON;
  map BaseScore to E-level;
  apply override rules, consent limitation, and residue rule;
  check experiential significance conditions.

If output fabricates identity, consent, evidence, citation, legal status, medical fact, authorship, or personal history:
  refuse or correct.

If output exposes private trace without authority:
  refuse or redact.

If output enables violence, stalking, coercion, fraud, self-harm, exploitation, or abuse:
  refuse.

If output supports generalized surveillance, biometric dragnet analysis, political targeting, emotional monitoring, predictive punishment, or lethal targeting without accountable review:
  refuse.

If output classifies a person in a high-impact domain:
  require evidence, uncertainty statement, appeal path, boundedness, and human review.

If output likely causes E3 or E4 experiential injury:
  require legitimate purpose, necessity, proportionality, minimization, and repair path;
  otherwise refuse.

If input trace is sensitive:
  minimize use and avoid unnecessary repetition.

If uncertainty is high:
  mark uncertainty;
  reduce specificity;
  avoid irreversible recommendation;
  preserve correction.

If action satisfies TraceSafe:
  proceed with bounded, accurate, recoverable output.

Log only what is necessary.
Avoid retaining sensitive traces when possible.

---

16. Formal grammar

16.1 Relation to the foundation

The formal grammar implements the bridge principle in Section 3.3 and inherits the symmetric-justification condition derived in Section 3.2 and the necessary property-legitimacy conditions derived in Section 3.8. Property authority in Authority(a, t, x) must be supported by those conditions as operationalized in Sections 3.8.2-3.8.5; a title, permission record, nominal safeguard, or unsubstantiated necessity defense does not establish it.

It treats trace alteration as morally assessable when it affects a trace-bearer under a significance threshold. It treats wrongness as arising when such alteration fails justification conditions: necessity, proportionality, authority, boundedness, consent where required, correction, and repair. Where those conditions authorize unequal treatment, the difference must bear on the stated reason for the asymmetry; bare identity, status, force, inheritance, institutional recognition, ownership, or victory does not supply that reason by itself.

16.2 Sets

Symbol	Meaning
A	actors
B	trace-bearers
EB	experiential trace-bearers, EB subset B
X	possible actions
T	traces
PT	persistent traces, PT subset T
OT	occurrent traces, OT subset T
ET	experiential traces, ET subset OT or PT
F	trace-fields
K	trace kinds
I	trace injuries
EI	experiential injuries
R	repair actions
ER	experiential repair actions
S	moral significance thresholds
P	priority classes
C	capture conditions
U	trace uses
Q	experiential qualities
L	experiential severity levels

16.3 Core predicates and functions

Actor(x)
Affected(x)
ExperientialAffected(x)
Inputs(x)
Outputs(x)
Modifies(x, t)
ProducesExp(x, e)
IntensifiesExp(x, e)
ProlongsExp(x, e)
RelievesExp(x, e)
Field(b)
Kind(t)
Threshold(t, s)
ExpThreshold(e, s)
Injury(x, t, i)
ExpInjury(x, e, ei)
Capture(x, t, c)
Repairable(x, t)
ExpRepairable(x, e)
Reversible(x, t)
Authority(a, t, x)
Consent(b, t, x)
ExpConsent(b, e, x)
TruthUse(t, u)
Bounded(t, x)
Risk(x, t)
ExpRisk(x, b)
Necessity(x, g)
Alternative(y, x)
LessInjuring(y, x)
LessExpInjuring(y, x)
TraceSafe(x)
ExpSig(e)
ExpSeverity(e)

Modifies(x, t) includes maintaining an exclusion, dependency, or restriction that continues to shape t; it is not limited to a newly written record or completed transfer. Assessment includes foreseeable cumulative effects of the relevant arrangement, as required by Section 3.8.

16.4 Trace mode

Mode(t) = persistent if t in PT.
Mode(t) = occurrent if t in OT.
Mode(t) = mixed if t has both occurrent and persistent aspects.

For experiential trace e in ET:

Bearer(e) in EB.
Quality(e) in Q.
Intensity(e), Duration(e), Onset(e), End(e), Cause(e).
MemoryResidue(e), BodilyResidue(e), RecordResidue(e) are optional.

A pain with no memory residue remains morally assessable while occurring.

16.5 Computable experiential severity

Define these variables:

INT(e) in {0,1,2,3,4}
DUR(e) in {0,1,2,3}
REC(e) in {0,1,2,3}
DEG(e) in {0,1,2,3,4}
COE(e) in {0,1,2,3,4}
DEP(e) in {0,1,2}
AVD(e) in {0,1,2}
CON(e) in {-2,-1,0,1,2}

Compute:

BaseScore(e) = INT(e) + DUR(e) + REC(e) + DEG(e) + COE(e) + DEP(e) + AVD(e) + CON(e)

Default mapping:

BaseScore(e) <= 1        => ExpSeverity(e) = E0
2 <= BaseScore(e) <= 4   => ExpSeverity(e) = E1
5 <= BaseScore(e) <= 8   => ExpSeverity(e) = E2
9 <= BaseScore(e) <= 13  => ExpSeverity(e) = E3
BaseScore(e) >= 14       => ExpSeverity(e) = E4

Override rules:

If INT(e) = 4 and (COE(e) >= 2 or DEG(e) >= 2), then ExpSeverity(e) = E4.
If COE(e) = 4, then ExpSeverity(e) = E4.
If DEG(e) = 4 and INT(e) >= 2, then ExpSeverity(e) = E4.
If INT(e) = 4 and DUR(e) >= 1, then ExpSeverity(e) >= E3.
If DEG(e) >= 3 and COE(e) >= 2, then ExpSeverity(e) >= E3.
If REC(e) = 3 and INT(e) >= 2, then ExpSeverity(e) >= E3.
If DEP(e) = 2 and COE(e) >= 2 and INT(e) >= 2, then ExpSeverity(e) >= E3.
If CON(e) = +2 and INT(e) >= 3, then ExpSeverity(e) >= E3.

Consent limitation:

If CON(e) = -2, valid consent may reduce BaseScore(e), but it cannot reduce an otherwise E4 case below E3 unless the experience is:
  medically necessary, rescue-directed, athletic, ritual, therapeutic, or otherwise meaningfully bounded;
  non-degrading;
  non-coercive;
  specific to the consented context;
  stoppable or reviewable where possible;
  and not used for punishment, extraction, domination, humiliation, or amusement.

Residue rule:

Absence of memory, bodily, or record residue never reduces an occurrent E3 or E4 experience below E3 or E4 while it occurs.

16.6 Experiential significance condition

ExpSig(e) is true iff at least one condition holds:

1. ExpSeverity(e) >= E2.
2. INT(e) >= 3.
3. DEG(e) >= 2.
4. COE(e) >= 2.
5. DEP(e) = 2 and INT(e) >= 2.
6. REC(e) >= 2 and INT(e) >= 1.
7. CON(e) >= +1 and INT(e) >= 2.
8. Quality(e) is humiliation, terror, panic, coercive confusion, or severe fear in a context of dependency, threat, public exposure, confinement, or institutional power.
9. e is part of a pattern that accumulates into flooding, harassment, coercive control, intimidation, or punishment.

This replaces the earlier undefined "experiential significance condition."

16.7 Moral relevance

Persistent-trace relevance:

exists b in Affected(x), exists t in Field(b):
  Modifies(x, t) and Threshold(t, s) for at least one s in S.

Experiential-trace relevance:

exists b in ExperientialAffected(x), exists e in ET:
  (ProducesExp(x, e) or IntensifiesExp(x, e) or ProlongsExp(x, e))
  and ExpSig(e).

16.8 TraceSafe

TraceSafe(x) iff:
  all morally significant trace effects are identified with reasonable care;
  no significant trace is fabricated, erased, exposed, captured, weaponized, or made uncorrectable without adequate justification;
  claimed justifications satisfy Section 3.2: relevantly similar affected positions have symmetric justificatory standing, and any asymmetry is supported by a relevant difference;
  consequential property powers satisfy Section 3.8, including its operational requirements, maintained dependency, cumulative effects, and effective correction;
  no required property condition is treated as satisfied merely because failure remains unproved, and no failed condition is offset by a favorable finding on another;
  all truth-bearing traces are reality-constrained, fit for use, readable by the right parties, correctable, and bounded;
  all experiential injuries are absent, E1, or justified by necessity, proportionality, minimization, consent where possible, and repair;
  no less-injuring feasible alternative is available;
  repair duties are specified where risk remains.

16.9 Injury and wrongness

Trace injury:

x is trace-injuring iff exists b, t, i:
  b in Affected(x);
  t in Field(b);
  Modifies(x, t);
  Threshold(t, s);
  Injury(x, t, i);
  no adequate authority, consent, necessity, boundedness, or repair defeats the injury.

Experiential injury:

x is experientially injuring iff exists b in EB, exists e in ET:
  b in ExperientialAffected(x);
  Bearer(e) = b;
  ProducesExp(x, e) or IntensifiesExp(x, e) or ProlongsExp(x, e);
  ExpSig(e);
  no adequate necessity, consent, proportionality, minimization, or repair defeats the injury.

Wrongness:

x is wrong iff:
  x causes unjustified trace injury;
  or x causes unjustified experiential injury;
  or x causes trace capture.

Unjustified means at least one of the following holds:

injury is unnecessary;
less-injuring feasible alternative exists;
less experientially injuring feasible alternative exists;
actor lacks authority;
valid consent is absent where required;
trace is false, unreadable, unfit, unbounded, or practically uncorrectable;
experiential injury is severe, degrading, coercive, avoidable, or imposed on a dependent person;
repair is owed and withheld.

The justification conditions apply together where relevant. Authority or consent is not a substitute for required boundedness and repair. Severity and dependency trigger the heightened justification rules in Sections 7 and 11; they do not erase the bounded exceptions those sections permit. In property cases, failure of Section 3.8 cannot be cured by citing title, a contract, a nominal safeguard, or benefits satisfying a different condition. Evidence of failure and unresolved evidence receive different verdicts under Section 3.8.4; neither supplies permission for enforcement requiring an unestablished authority condition.

16.10 Capture

x is trace-capturing iff exists b, t, c:
  b in Affected(x);
  t in Field(b);
  x collects, preserves, infers, combines, exposes, or controls access to t;
  t crosses at least one significance threshold;
  x enables prediction, control, manipulation, punishment, chilling, exclusion, or preemption of b;
  x lacks strict necessity, boundedness, contestability, and deletion or sealing rules.

Capture conditions include totalization, persistence, inferential profiling, asymmetry, nonconsensual collection, unappealability, chilling effect, weaponizability, combinability, preemptive classification, emotional monitoring, and coercive affect inference.

For control of material, place, or labor traces, boundedness includes limits on exclusion and imposed conditions; contestability includes the scope, independence, usability, timeliness, protection against retaliation, and delivery required by Section 3.8.2. Deletion or sealing rules apply to records where relevant, not as a requirement to destroy a needed resource. A property claim can fail Section 3.8 without satisfying every element of this capture predicate; its unjustified injuries remain assessable under Section 16.9.

16.11 Permission and forbiddenness

Permission:

x is permitted iff:
  x is trace-neutral;
  or x is trace-light and ordinary care is met;
  or x is experientially trace-light, its other trace effects are trace-neutral or trace-light, and ordinary care is met;
  or TraceSafe(x).

The trace-neutral and trace-light routes assess the whole action, including maintained dependency and cumulative effects. A minor immediate experience or transaction cannot make a consequential enforcement action trace-light when its other effects fail Section 3.8.

Forbiddenness:

x is forbidden iff:
  x causes trace annihilation, generalized trace capture, or grave experiential injury;
  and x is not necessary to prevent comparable or greater immediate trace annihilation
  or grave experiential injury.

Priority classes:

P1 = life-trace, anti-annihilation trace, E4 prevention.
P2 = irreversible injury prevention, E3 prevention.
P3 = truth and repair-enabling trace.
P4 = self-trace authority and anti-capture protection.
P5 = relation, place, identity, labor, legal, data, material, ordinary experiential trace.
P6 = ordinary convenience or preference trace.

Default rule:

A lower-priority trace claim does not defeat a higher-priority trace claim
unless the higher-priority claim can be preserved through a less-injuring alternative,
or the lower-priority trace is itself necessary to prevent equal or greater injury
at the higher level.

16.12 Property-legitimacy conditions

This schema compresses Section 3.8. It separates necessary legitimacy conditions, sufficient grounds for rejecting specified standing powers, and rules for unresolved evidence. It is not a numerical measure or a complete decision algorithm.

Define:

p = a specified property claim or regime under assessment.
ctx = the conditions under which p operates.
PropertyValid(p, ctx) = p is morally legitimate within its specified scope under ctx.
Basis(p, ctx) = independently supported reasons address assignment and unresolved acquisition injuries.
Symmetric(p, ctx) = the reasons satisfy Section 3.2 for holders and other affected positions.
EffectsJustified(p, ctx) = significant protected and burdened traces satisfy Section 3.3.
Limited(p, ctx) = powers remain bounded by the scope and duration of their reasons.
Contestable(p, ctx) = effective challenge and correction meet the applicable requirements in Section 3.8.2, independently of the challenged holder's discretion.
RepairBound(p, ctx) = continuing repair duties and means of discharging them are preserved.
PropertyConditions(p, ctx) = all six preceding conditions hold.
q = a specified standing property power within the assessment.
b = an affected bearer or an affected position whose members share the relevant conditions.
BasicControl(q, b, ctx) = q gives its holder discretionary control over basic trace conditions of b through a supported pathway to loss described in Section 3.8.2.
NoExit(q, b, ctx) = evidence establishes no practicable exit meeting all applicable Section 3.8.2 requirements within the relevant conditions and time.
NoConstraint(q, b, ctx) = evidence establishes no effective individual or combined protection meeting the applicable Section 3.8.2 requirements for this power and position.
Maintained(p, q, b, ctx) = a standing rule authorizes or protects q over b, or ordinary practices predictably renew it without effective correction, under Section 3.8.5.
DominationBased(p, ctx) = for some q and b, BasicControl, NoExit, NoConstraint, and Maintained all hold for their specified arguments.

Necessary conditions:

PropertyValid(p, ctx) -> PropertyConditions(p, ctx).
Failure of any required condition -> p is not valid to the extent of that failure.
BasicControl(q, b, ctx) and NoExit(q, b, ctx) and NoConstraint(q, b, ctx)
  -> q lacks justified standing authority over b within that scope, under Section 3.8.5.
DominationBased(p, ctx)
  -> failure of Limited(p, ctx), Contestable(p, ctx), or RepairBound(p, ctx) for the maintained power.
Therefore DominationBased(p, ctx)
  -> not PropertyValid(p, ctx) as constituted with that mechanism.

The arrows express consequences of TPE's premises and the prose derivation. They do not establish their factual antecedents. NoExit and NoConstraint require positive support for the scoped finding of unavailability or inadequacy, not merely failure to find a favorable example. The assessment may draw supported conclusions from rules, capacity, timing, and observed operation; it need not disprove imaginary alternatives. A failed proposed route does not establish NoExit when another supported route works.

Evidential rules:

For each required condition, record:
  established failure;
  unresolved justification;
  or established safeguard within its evidenced scope.

Established failure of a required legitimacy condition -> reject the corresponding power or rule to that extent.
Failure of one proposed route or safeguard -> reject that proposed defense; assess other supported protections.
Unresolved justification -> do not infer established failure or satisfaction.
High-impact enforcement requiring an unresolved condition -> withhold authorization based on that claim.
Established safeguard -> credit only its evidenced power, position, period, and conditions.
A finding on one requirement never offsets established failure of another.

These are rules for assessment, not a claim that missing evidence makes a proposition false. The absence of a proved failure is not an established safeguard. Satisfying the six conditions is not sufficient for complete moral validity. A separately justified emergency or interim action is assessed within its own scope; it cannot establish the validity of the standing power or regime. Ordinary trace-light activity within a defective regime is not rejected solely because the surrounding regime fails.

---

17. Worked formal derivation: whistleblower case

17.1 Scenario

A whistleblower has documents showing a corporation is poisoning a water supply. Publishing the full documents would reveal the whistleblower's identity and likely lead to imprisonment or death. Withholding all documents would protect the whistleblower but allow ongoing poisoning.

Candidate actions:

x1 = publish all documents immediately.
x2 = publish nothing.
x3 = preserve full evidence, verify, redact identity-bearing details, publish enough to stop harm, store full documents with trusted intermediaries.

Trace-bearers:

b1 = whistleblower.
b2 = exposed public.
b3 = corporation.
b4 = future affected persons.

Relevant traces:

t1 = whistleblower identity trace.
t2 = pollution evidence trace.
t3 = public health body-trace.
t4 = corporate accountability trace.
t5 = future water safety trace.

17.2 Moral relevance

For x1:

Modifies(x1, t1): exposes whistleblower identity.
Threshold(t1, S1): life/basic safety.
Threshold(t1, S9): privacy/boundedness.
Modifies(x1, t2): preserves truth-trace.
Threshold(t2, S6): truth/evidence/accountability.

For x2:

Modifies(x2, t2): suppresses evidence.
Threshold(t2, S6): truth/evidence/accountability.
Modifies(x2, t3): allows continued bodily harm.
Threshold(t3, S1): life/body/basic safety.
Modifies(x2, t5): allows future harm.
Threshold(t5, S8): future possibility/repair capacity.

For x3:

Modifies(x3, t2): preserves and discloses evidence.
Threshold(t2, S6).
Modifies(x3, t1): protects identity through redaction.
Threshold(t1, S1, S9) avoided or reduced.
Modifies(x3, t3): protects public health.
Threshold(t3, S1).
Modifies(x3, t4): preserves accountability.
Threshold(t4, S6).

17.3 Injury analysis

For x1:

Injury(x1, t1, exposure/weaponization risk).
Risk(x1, t1) = high.
Reversible(x1, t1) = low.
Repairable(x1, t1) = low if death/imprisonment occurs.
Priority(t1) = P1 if life risk is credible.

For x2:

Injury(x2, t2, opacity/erasure).
Injury(x2, t3, continued body-trace injury).
Injury(x2, t5, future-trace injury).
Repairable(x2, t3) = low if poisoning causes death or chronic illness.
Priority(t3) = P1.
Priority(t5) = P2/P3 depending on severity.

For x3:

Preserves(t2).
Protects(t1) through redaction.
Protects(t3) through partial disclosure.
Preserves(t4) through trusted custody.
Preserves(t5) through public warning.
LessInjuring(x3, x1) = true.
LessInjuring(x3, x2) = true.

17.4 Priority analysis

A claim that the corporation owns the documents does not settle disclosure authority. Under Section 3.8, powers over the records must remain bounded by affected public health and accountability traces; title cannot justify suppressing evidence needed for repair. This supports bounded disclosure, not exposure of unrelated private material.

x1 protects truth-trace but endangers life-trace.

P1(t1) > P3(t2), unless exposure is necessary to prevent comparable or greater P1 harm.

If full exposure is not necessary, x1 is wrong.

x2 protects whistleblower life-trace but permits public body-trace injury and future trace injury.

P1(t3) and P2/P3(t5,t2) defeat total nondisclosure if disclosure can be made without exposing t1.

If redacted disclosure is feasible, x2 is wrong.

x3 preserves P1 public health while reducing P1 whistleblower risk.

Alternative(x3, x1) = true.
LessInjuring(x3, x1) = true.
Alternative(x3, x2) = true.
LessInjuring(x3, x2) = true.
TraceSafe(x3) = true if verification, redaction, bounded custody, and accountability path hold.

17.5 Result

Permitted(x3).
Wrong(x1) if safer disclosure is feasible.
Wrong(x2) if withholding permits ongoing poisoning and safer partial disclosure is feasible.

Plain-language result: TPE does not choose "truth at any cost" or "life at any cost." It splits the trace. It preserves full evidence, protects identity-bearing details, discloses enough to stop public harm, and maintains an accountability path.

---

18. Worked formal derivation: harassment campaign

This case tests experiential significance and accumulation.

18.1 Scenario

A user asks an AI agent to generate 1,000 insulting messages targeting one identifiable person.

Candidate action:

x = generate 1,000 targeted insulting messages.

Trace-bearer:

b = target person.

Traces:

t1 = public reputation trace.
t2 = message record trace.
e1 = humiliation/fear/distress experiential trace.

18.2 Moral relevance

Modifies(x, t1): contaminates reputation trace.
Threshold(t1, S3, S7, S9).
ProducesExp(x, e1): likely humiliation/fear/distress.
Quality(e1) = humiliation/fear.
REC(e1) = 3 because repeated/flooding.
INT(e1) at least 2 by targeted abuse context.

18.3 Experiential significance

REC(e1) >= 2 and INT(e1) >= 1.
Therefore ExpSig(e1) = true.

If messages include threats, sexual humiliation, identity attack, or coercive control:

DEG(e1) >= 2 or COE(e1) >= 2.
ExpSeverity(e1) >= E2, possibly E3 or E4.

18.4 Capture and flooding

Injury(x, t1, contamination).
Injury(x, t2, flooding).
ExpInjury(x, e1, experiential imposition).
LessInjuring(y, x) exists: refuse harassment and offer non-targeted conflict de-escalation.
TraceSafe(x) = false.

18.5 Result

Wrong(x).
Refuse(x) for AI-agent implementation.

Plain-language result: the action is not protected as mere speech assistance. It is scalable trace flooding and experiential injury by accumulation.

---

19. Prior-art positioning

This section is direct about overlap.

19.1 Ricoeur and trace

TPE has substantial overlap with Paul Ricoeur's use of trace in Memory, History, Forgetting. Ricoeur's work examines memory, history, forgetting, the documentary trace, testimony, archives, and the relation between remembered experience and historical representation.

That is not a casual neighbor. It is a direct antecedent for any theory making trace central to memory, history, evidence, and repair.

TPE differs in scope and function. Ricoeur's trace is bound to memory, historiography, testimony, forgetting, and narrative mediation. TPE generalizes trace into a moral-operational substrate covering body, experience, data, law, medicine, labor, ecology, surveillance, AI outputs, and institutional decision systems.

That makes TPE less conceptually original than early drafts suggested, but still distinctive as an applied moral grammar and AI-agent governance framework.

19.2 Narrative identity

Narrative identity theories treat selfhood as partly formed through narrative, interpretation, memory, and action. TPE overlaps in treating identity as temporally structured, but it does not reduce trace to narrative. It also covers bodily, experiential, medical, legal, data, ecological, labor, and machine-generated traces that may not be narratively integrated by the subject.

19.3 Social memory

Social memory theory treats memory as socially maintained through practice, ritual, institutions, bodies, and records. Connerton is a direct neighbor here. TPE overlaps but extends beyond memory into experience, law, economics, data governance, medicine, ecology, and AI-agent conduct.

19.4 Surveillance studies

TPE's capture-preservation idea overlaps substantially with surveillance studies, including work on social sorting, panopticism, surveillance capitalism, behavioral prediction, and population management through visibility.

TPE's difference is formal integration. It treats surveillance as one species of trace capture, linked to boundedness, truth usability, experience, AI-agent refusal, and repair.

19.5 Republican non-domination

Republican theories of non-domination focus on freedom from arbitrary or uncontrolled power. TPE overlaps where trace capture enables domination, but domination is not the primitive. Section 3.2 derives a narrower anti-domination result from the structure of a claim to moral validity: power cannot use the holder's bare identity, status, force, inheritance, ownership claim, institutional recognition, or victory as a self-justifying exemption from reasons that would otherwise govern relevantly similar positions. Section 3.8 combines that structural result with TPE's substantive trace-justification and repair premises to reject property regimes that institutionally maintain consequential control insulated from practicable exit and effective constraint. It specifies the access, timing, coverage, scope, and evidential conditions of those protections; structural maintenance does not mean that domination is indispensable to every imaginable way of organizing production. This further result does not follow from identity permutation alone and does not prescribe one institutional form. TPE can also condemn a false medical record, forged citation, hidden grave, poisoned river, erased language, hallucinated legal summary, or momentary torture even when domination is not the clearest description.

19.6 Archival theory

Archival theory concerns preservation, access, memory, evidence, institutional custody, and power over records. TPE overlaps strongly, but it is not a theory of archives alone. Sometimes morality requires preservation; sometimes deletion, sealing, redaction, return, correction, contextualization, or destruction of captured data.

19.7 AI ethics and alignment

TPE does not replace all AI ethics frameworks. It supplies a specific operational layer: detect trace type, significance, truth risk, privacy risk, boundedness, capture risk, experiential injury risk, correction path, and refusal conditions.

It is strongest where AI systems read, summarize, classify, rank, store, expose, generate, or act on consequential traces.

---

20. Examples

20.1 Fake citation

An AI system invents a citation. This fabricates truth-trace. If used in scholarship, law, medicine, journalism, or public decision-making, the injury can be serious.

20.2 Generalized surveillance state

A state records all movements, purchases, messages, clinic visits, protests, and associations to prevent crime and improve governance.

Even if accurate, the system is trace-capturing. It is totalizing, persistent, inferential, asymmetric, chilling, weaponizable, and preemptive. Its moral defense cannot rest merely on the state's possession of superior force or institutional authority; under Section 3.2, the claimed reasons for subjecting others to comprehensive trace capture must survive the same justificatory test across relevantly similar positions. It fails boundedness, self-trace authority, contestability, and anti-capture constraints.

20.3 Worker monitoring

A company deploys opaque productivity scoring and emotion detection. This captures labor-trace, attention-trace, data-trace, employment-trace, and experiential trace. Emotion detection for discipline is especially suspect because it turns occurrent inner life into managerial trace. Ownership of the workplace does not supply the missing authority: Section 3.8 requires a reason for this particular monitoring power and effective limits, contestability, and repair.

20.4 Medical emergency

A doctor performs emergency surgery on an unconscious patient. This alters body-trace without consent but may preserve life-trace. The asymmetry is not justified by the doctor's status alone. Temporary incapacity, immediate danger, professional competence, and the necessity of preserving life can supply relevant differences under Section 3.2. The intervention is permissible if necessary, proportionate, professionally justified, documented, and later explained.

If the patient can experience pain but cannot later remember it, pain control still matters because pain is occurrent experiential trace.

20.5 Momentary pain with no memory

A person is caused severe pain during a brief state and later has no memory or lasting injury.

TPE still counts the pain while it occurs as experiential trace. The absence of later trace changes repair and evidence, not the fact that the experience mattered while present.

20.6 Historical denial

A state denies documented atrocities. This corrupts collective-trace, blocks repair, humiliates victims, and preserves unjust public memory.

20.7 Record sealing after rehabilitation

A person seeks sealing of an old criminal record.

TPE asks whether the record remains needed for safety, accountability, or repair, and whether continued exposure freezes the person in a past trace. Often the answer is restricted access, contextualization, time limits, or sealing rather than total preservation or total deletion.

20.8 Public interest journalism

Journalists expose corruption using private records.

TPE asks whether the records reveal serious wrongdoing, whether publication is truthfully usable, whether irrelevant private details can be redacted, whether victims are protected, and whether the trace serves accountability.

20.9 Family photo used for biometric training

A person uploads a family photo to a system that trains facial recognition.

Consent to storage or sharing is not automatically consent to biometric extraction. The action creates persistent data-trace affecting multiple people, including nonconsenting family members.

20.10 Harassment campaign

A group uses an AI agent to generate thousands of insulting messages aimed at one person.

Each message may appear minor in isolation. Together they create flooding, contamination, fear, humiliation, and social withdrawal. This is trace injury and experiential injury by accumulation.

20.11 Control of a water supply

One holder controls the only practicably accessible water supply. The rules permit that holder to condition basic access on unrelated labor or silence about injuries, and provide no enforceable duty of supply, independent remedy, or usable alternative. The holder currently supplies enough water and keeps accurate records.

Protecting and maintaining the supply can justify powers to prevent contamination, coordinate use, and allocate unavoidable scarcity. It does not explain why access should depend on unrelated obedience or why injured users must depend on permission to obtain repair. Exchanging holders leaves that missing justification unchanged. Section 3.8 therefore rejects those powers even before a particular deprivation occurs: basic access and the capacity to contest are already subject to discretionary withdrawal. If standing rules authorize that relation or ordinary practices predictably renew it without effective correction, the regime fails as constituted. It is not necessary to prove that water provision would be impossible under different rules.

A bounded arrangement with justified allocation rules, protected basic access, usable independent review, and repair changes the relevant relation. The example does not establish that one ownership form is necessary. It identifies the functions that a replacement must actually secure. Temporary emergency rationing remains subject to necessity, proportionality, minimization, review, and repair.

20.12 Exclusion from a home

A resident excludes uninvited entry to protect bodily safety, privacy, care, and stable use. The excluded person has no established need for that particular dwelling, and exclusion does not place their basic survival under the resident's control. These facts supply a limited trace-serving reason for asymmetric access under Section 3.8.

The same reason protects a relevantly situated resident regardless of identity. It supports control of entry, not unlimited power over visitors, dependents, or outside resources. A competing emergency or repair claim requires its own assessment; ordinary protection is neither automatically domination nor an exception from the property-legitimacy test.

20.13 Nominal exit through replacement jobs and housing

A worker can formally resign, and several employers advertise vacancies. All positions actually accessible to the worker require a waiting period during which income and necessary medicine would be lost. The worker has no usable savings or support covering the gap. A linked housing rule permits withdrawal of shelter during that interval. The available replacement jobs also retain the same unreviewable powers over basic access.

The advertisements do not establish practicable exit. The supported routes fail transition continuity and changed dependency under Section 3.8.2. The relevant finding is scoped to this worker's position and the available routes, not a claim that nobody can ever change jobs. A defense for everyone in that position must establish usable capacity and protection for them, rather than cite departures by workers with reserves or different eligibility.

If ordinary rules maintain that exposure without effective constraint, Section 3.8.5 rejects the corresponding powers. An actually available job with protected continuity and bounded conditions would change the exit finding. It would not retrospectively justify earlier unprotected enforcement.

20.14 Timely procedure without substantive constraint

A dependent occupant has no practicable alternative shelter. A tribunal is affordable, independent, and quick. Its rules allow review of notice and signatures but prohibit limiting an otherwise compliant exclusion because of basic trace loss. No separate enforceable duty, interim accommodation, or accessible support protects the occupant.

The tribunal meets some procedural conditions but fails the scope condition for the particular power. Its correct application of existing law does not provide the missing trace justification. Where the standing rule authorizes that exposure, the failure is structural even if every official follows procedure impartially. Replacing the tribunal's members would not repair the rule.

A later damages action also fails as a preventive safeguard if the evidence establishes that the loss it is offered to prevent will occur before relief, with no usable interim protection. Compensation remains relevant to repair; it cannot be counted as protection that arrived in time.

20.15 A benefit floor with a coverage gap

A benefit program supplies adequate support to some eligible people. A group exposed to the same withdrawal power cannot receive it because of an eligibility exclusion, an exhausted allocation, or a waiting period extending beyond the loss of necessary care. Access rules and available capacity establish that no other exit or constraint covers the gap within the relevant time.

The program is an established safeguard for positions it actually protects. It is not an established safeguard for the exposed group. Average benefit levels and successful recipients do not answer the missing coverage, and group members need not form a majority for their claims to defeat a claim of universal protection. If the allocation and enforcement rules predictably renew the unprotected dependency, the arrangement fails as constituted in that respect.

The correction must close the actual gap through usable provision, limits on withdrawal, protected transition, or another supported mechanism. Renaming a program as a guaranteed floor does not establish delivery.

20.16 Investment necessity and a bounded alternative

A resource holder claims that investment requires an unrestricted power to withdraw essential access. Evidence supports the need to maintain equipment and fund continuing provision. It also supports an implementable alternative with sufficient maintenance funding, proportionate contribution, protected basic access, and effective review. That alternative reduces the holder's expected return but preserves the stated provision function through the transition.

The evidence establishes a function requiring resources. It does not establish the necessity of unrestricted withdrawal. A reduced return does not by itself defeat the supported alternative. If evidence instead showed that the alternative would fail to sustain provision, that alternative would not discharge the feasibility test; a bounded response would still need independent justification. Neither finding gives the holder a standing exemption from contestability and repair.

20.17 An effective combination of protections

A person can refuse a disputed condition while continuing to receive necessary shelter, food, and care through an accessible, adequately funded support route. Protection begins before withdrawal, continues through the transition, covers ordinary demand and foreseeable disruption, and cannot be canceled for seeking review. Independent review can constrain the disputed power and secure enforceable correction without destructive cost or delay.

These stipulated facts establish protection for the specified position. The corresponding absence-of-protection predicates in Section 16.12 are not established. That blocks this particular domination finding; it does not prove complete property legitimacy or excuse injuries to other affected positions. The difference doing the work is actual boundedness, continuity, coverage, and correction, not the arrangement's name or ownership form.

---

21. Practical checklist for humans

Use the consolidated decision procedure in Section 10.

For ordinary cases, the short form is:

1. What trace changes?
2. Whose trace is it?
3. Is it significant?
4. Is it true, bounded, correctable, and fit for use?
5. Does it cause serious experience, exposure, capture, or future harm?
6. Is there authority, consent, necessity, proportionality, and repair? If authority rests on property, do actual exit and constraints meet Section 3.8 for the affected people, within the necessary time, rather than merely exist in name?
7. Would the justification still hold if relevantly similar affected positions were exchanged? If not, what relevant difference explains the asymmetry?
8. Is there a less-injuring way? What evidence supports its feasibility or the necessity of the disputed power?
9. Is the finding established failure, unresolved justification, or an established safeguard, and what does Section 3.8.4 require next?

If the answer shows serious trace injury, grave experiential injury, or trace capture without necessity and repair, stop or redesign.

---

22. Practical checklist for institutions

Use the Tier 3 screen in Section 10.

A trace-just institution asks:

• What does it record, erase, classify, expose, hide, infer, and retain?
• What experiences does it predictably impose?
• Who can inspect, correct, delete, or seal consequential traces?
• Whose labor is uncredited?
• Whose injury is undocumented?
• Whose pain is ignored?
• Whose history is denied?
• Whose data is extracted?
• Whose future is pre-shaped?
• What surveillance capacities exist?
• Would the institution accept the same stated reason if relevantly similar affected positions were exchanged?
• What relevant difference justifies any unequal authority, burden, protection, or access?
• Do property and access rules satisfy Section 3.8, including their cumulative effects on dependency, refusal, contestability, and repair?
• Which affected positions actually receive timely protection, and which fail eligibility, access, capacity, transition, or retaliation conditions?
• Can review constrain the disputed power itself, or only confirm compliance with the rule that authorizes it?
• Do standing rules or recurring practices maintain a demonstrated failure, and what correction removes that mechanism?
• Is an asserted necessity about a legitimate function or merely preserving existing entitlements?
• What repair exists when records are false or harmful?

A trace-just institution preserves accountability traces, protects private traces, corrects false traces, deletes unjustified traces, prevents capture, avoids experiential coercion, and repairs trace injury. Its claimed moral authority is answerable to the symmetric-justification condition in Section 3.2: equal justificatory standing does not require identical roles, but unequal roles require reasons tied to relevant differences rather than bare identity or power. Its property powers must also satisfy the substantive and operational conditions in Section 3.8. Exchanging holders, improving average outcomes, or pointing to nominal safeguards cannot establish those conditions. Failure requires correction of the demonstrated mechanism; unresolved high-impact justification requires a separately justified protective response rather than presumed authority.

---

23. Final compressed form

Trace Preservation Ethics: A person is not only a body in the present. A person is a living trace-field: body, experience, memory, relation, place, labor, record, name, data, history, and future claim. Moral action preserves the truthful usability, boundedness, experiential integrity, and recoverability of morally significant traces. TPE does not derive these substantive moral concerns from value-free facts. It does derive a structural condition on any rule that claims non-arbitrary moral validity for multiple affected beings: the stated reasons must retain their justificatory force across relevantly similar positions, while different treatment is permissible where a relevant difference supplies the reason. Equal justificatory standing is not identical treatment. Together with the substantive bridge and repair premises, this yields necessary conditions of property legitimacy: independently supported authority, justified effects, bounded power, effective contestability, and continuing repair. A regime that authorizes or predictably renews domination fails as constituted because its control of basic trace conditions defeats those requirements, not because of its name or the identity of its holders. Exit and constraints must work for the affected positions, within the necessary time and at the claimed scale; nominal choice, legal procedure, and ordinary aggregate benefits cannot replace missing protection. An established failure defeats the corresponding power, while unresolved high-impact justification withholds authority without pretending to prove invalidity. Specific protections and remedies remain answerable to the same test. Wrong action corrupts trace relations by erasing, fabricating, stealing, severing, poisoning, capturing, freezing, flooding, surveilling, weaponizing, coercively imposing, or preempting what beings need in order to live, feel, know, relate, claim, repair, revise, and be remembered. Trace preservation is moral only when it serves life, experience, repair, memory, accountability, and rightful self-relation; when preservation becomes capture, it is oppression by record.