The first run of the iterative search-based method (NOTES-iterative-search-method.md), fed the residual trade-offs of the autonomous-fleet evaluation and built to re-level "cars" upward on its own. Run 2026-06-22. The two human seats (Red gut, Blue verdict) are left open.

What it did, in one breath: it re-leveled "self-driving cars to replace ownership" all the way up to "get people to what they need — access as the unit, the network's value owned by its users"; collapsed the car run's three residual trade-offs into one (choke-point value capture); dissolved four frame-artefact trade-offs onto a single primitive (a member-owned demurrage mutual pool); hit two genuine physical-invariant floors honestly (the un-forecastable correlated peak, and the tail-risk reserve — conservation-of-matter-meets-the-second-law, and crucially a payable cost, not a tollable choke-point); and handed exactly one box-stuck point to the human — the enclosure-timing race — refusing to churn past the physical floor. It converged in a single telescoped pass rather than grinding three.

The trade-off ledger (the engine's output)

Frame searched: "Get people to what they need — access as the unit, network value owned by users — with each remaining choke-point tested for whether it must be OWNED (tollable) or merely PAID (a cost on a commons balance sheet)."

Surviving configurations:

• Stake-at-point-of-use replaces persistent reputation: per-ride refundable bond / mutual-pool token, slashed on verified bad outcome — collateral at point of use, no central record to own, no identity commons required.
• The member-owned demurrage mutual pool as the single convergent primitive: fronts bonds for capital-poor drivers (recovering from future earnings, medallion-loan minus the rentier), carries catastrophic tail-risk reserve (P&I-club shape), and finances idle peak slack — surplus recirculates rather than accruing as rent.
• Pre-commitment / pre-positioning markets for FORECASTABLE correlated peaks: book the eclipse minibus 18 months out, converting stochastic surge into deterministic scheduled flow that counter-cyclical matching can serve — shrinking the physical slack floor to the un-forecastable tail only.
• Permit-mandated interoperability: make open un-tollable dispatch a condition of the autonomy operating licence (number-portability / Bell-interconnection shape), so capital must enter through the commons' door and enclosure never gets its head start.

Box-stuck points handed to the human:

• Whether a political actor exists who pulls the permit-mandated-interop lever before capital encloses the dispatch graph — this is adversarial, path-dependent, lobbied, and cannot be simulated from inside training. The single irreducible human variable.
• How to make that actor move in time — the strategy is path-dependent and contest-shaped; I can name the lever (interop as licence condition) but not guarantee or sequence its pulling.
• Whether the demurrage mutual pool can actually be stood up at city scale before being out-capitalised or regulatory-captured (Wörgl-killed-by-central-bank failure mode) — an institutional-formation contest, not a design gap.

Loop decision: stop. Continue is true only if an OPEN frame-artefact remains AND the pass can still expand the space. After this pass the open ledger holds three items: two are physical-invariants (the un-forecastable correlated-peak slack and the tail-risk reserve — the same conservation-of-matter-meets-second-law floor in two costumes; we have hit the floor, and it is a payable cost not a tollable choke-point), and the one remaining frame-artefact (the enclosure race) is explicitly outside what further search-space expansion can resolve — it is a power-timing contest that needs the human box-breaker, not another re-frame. Every economic trade-off that COULD dissolve has dissolved and converged onto a single ownership primitive (the demurrage mutual). Running another automated pass would churn, not expand — so I pause and hand the clean single sentence to Tom rather than settle for a compromise.

The one sentence handed on (next, and not the loop's to run): Does the permit-mandated-interop lever get pulled before capital encloses the dispatch graph? This is the sole remaining OPEN frame-artefact and it is political/power-timing, not technical. The next pass is not mine to run: it requires identifying the actor with the leverage (regulator setting the AV operating licence) and the sequencing that pre-empts enclosure — a strategy problem for Tom, not a search-space expansion.

Pass 1 — Re-level

PASS 1 — RE-LEVEL

The frame as inherited

"Self-driving cars to replace private car ownership" carries three buried assumptions, and the prior run already drew blood on all three — but it stayed inside the car. Look at what it's still flattening:

1. "Cars" — it presupposes the vehicle-shaped artefact. A box on wheels sized for 5, weighing 1.5 tonnes, moving 80kg of human. The autonomy and the ownership-model both got re-examined; the form factor never did.
2. "Replace private ownership" — it frames the goal as a swap of who owns the box. Ownership vs. fleet is a property-rights question. But the platform-toll failure mode the prior run found is baked into framing the answer as a fleet at all — a fleet is a thing someone owns, hence a toll someone charges.
3. "Move the car" — even "move me from A to B" (the obvious re-level) still assumes the trip is the irreducible unit. It isn't always. Half of all car trips are under ~3 miles, and a large share are proxies for something that isn't movement at all: the meeting, the goods, the appointment, the social contact.

The prior run's three residuals — only-works-under-a-hard-permit-config, re-freezes value behind a platform toll, 4M displaced drivers — are not three problems. They are one problem wearing the car's shape: value created by collective mobility gets captured by whoever owns the choke-point (the fleet, the platform, the permit). The driver displacement is just the most visible person standing on the choke-point today.

The real goal this is a proxy for

Not "move me from A to B cheaply." That's still the engineer's altitude. The honest top-level goal:

Let people reach what they need — people, goods, work, care, place — with the least motion, cost, and dependence, and let the value of doing that collectively stay with the people who generate it.

"Least motion" matters: the cheapest, simplest trip is the one that didn't have to happen. "Stay with the people who generate it" is the part every prior framing quietly conceded away — it accepted that someone tolls the network and only argued about whom.

Re-levelled frame for this pass

From: "Self-driving cars to replace private car ownership." To: "Get people to what they need — with access as the unit, not the trip; and with the network's value owned by its users, not tolled by its owner."

Two moves stacked, because the prior run already exhausted the easy altitude:

• Access, not trips (the demand-side re-level): the trade-off "more mobility costs more road/energy/displacement" is a hypothesis that we're solving the wrong variable. Much "transport demand" is derived demand — a proxy for proximity, delivery, or presence. Expanding the search space includes collapsing trips that needn't exist (the appointment that's a video call, the shop that comes to the street, the 15-minute-city land-use config), which no fleet-vs-ownership analysis can see because both keep the trip fixed.
• User-owned network, not owned fleet (the supply-side re-level): the platform-toll failure is a hypothesis that "platform" is the wrong ownership primitive. The configuration the optimiser would never propose: the coordination layer as a commons / protocol / cooperative — owned by riders, drivers, and municipalities — so the choke-point earns a maintenance cost, not a rent. This is where the 4M drivers stop being "displaced labour to compensate" and become co-owners of the dispatch layer — a transition, not a severance.

What the old frame was assuming that needn't be true

• That the trip is fixed and only the vehicle/owner is in play. (Most levers are upstream of the trip.)
• That something must own the network. (A protocol can be un-ownable — see how nobody tolls TCP/IP or the road's own right-of-way.)
• That displacement is a cost to be mitigated rather than a misallocation of who owns the coordination value to be corrected.
• That the box-on-wheels is the mobility quantum, when the real quantum is access.

Where I should flag my own box

I can name "user-owned protocol commons" and "access-as-unit," but my training pulls hard toward the consensus crystallisations of both: the cooperative-platform literature tends to re-import a governance toll, and the 15-minute-city tends to re-import a planning authority that becomes its own choke-point. The thing I cannot yet see is the configuration where coordination has NO owner-able choke-point at all — genuinely rent-free coordination at city scale, not just "nicer landlord." That's the box-break I'd hand to you, Tom: is there a physical-invariant reason a mobility-coordination network must have an ownable bottleneck, or is that purely an artefact of how we've always capitalised it? My instinct says it bottoms out not on a conservation law but on trust/identity-of-the-dispatcher — which is a solved-ish problem in other domains (consensus protocols) and therefore probably dissolvable, not a real floor.

One honest step taken this pass: re-levelled from vehicle-and-owner to access-and-commons, and reduced three residual trade-offs to one (choke-point value capture), which is the thing the next pass should attack directly — not by choosing a nicer owner, but by asking whether the bottleneck has to exist.

Want me to take Pass 2 into that question — does mobility coordination have a physically-necessary ownable bottleneck, or can it be made rent-free?

Pass 1 — Expansion 1

This is a thinking/search task, not a coding task. No tools needed — let me reason directly into the angle Tom set: the 22-year-old, broke, no car, in a city. Pass 2's question is whether mobility coordination has a physically-necessary ownable bottleneck.

PASS 2 — Configurations from the angle of the broke 22-year-old, carless, in a city

The prior pass reduced everything to ONE problem: value created by collective mobility gets captured by whoever owns the choke-point. The 22-year-old is the perfect probe because she has nothing to capture with — no car, no capital, no platform stake. Whatever config works for her is one where access doesn't require owning anything. So the test for each configuration below: does it give her access without her having to rent it from someone who owns the bottleneck?

I'll flag confidence and mark where I hit my own box.

Config 1 — The dispatcher is a protocol, not a company (signed-route gossip)

Target trade-off: re-freeze of value behind a platform toll + the dependence trap.

Uber's actual asset isn't cars or drivers — it's the matching: who-is-near-whom, right now, trusted. The pass-1 instinct was right that this is "solved-ish in other domains." Concretely: matching a rider to a nearby vehicle is the same shape as a packet finding a route, or a Bitcoin transaction finding a miner, or a BitTorrent peer finding a seed. None of those have an owner who tolls them. TCP/IP has no Uber.

The configuration: ride-matching as an open dispatch protocol — any vehicle (a robotaxi, a neighbour, a minibus) advertises availability to a local mesh; any rider's phone broadcasts a need; matches settle peer-to-peer with reputation carried in the rider's/driver's own signed wallet, not a company's database. The "platform" becomes a spec, like email's SMTP. Many apps can speak it; none own the graph.

Why the bottleneck dissolves rather than relocates: the thing everyone assumes must be owned — the trust that the dispatcher isn't lying to you — is exactly what consensus protocols make ownerless. The 22-year-old doesn't subscribe to anyone; she runs a free client, the way she runs a browser. Confidence: high that this is technically possible (it's email/web/torrent re-applied), lower that it out-competes a funded incumbent — and that gap is the real residual (see Config 5).

My box flag: I keep wanting to add a "foundation" to steward the protocol — and a foundation is a soft choke-point (it can change the spec, capture mindshare). The honest open question I hand Tom: can the spec be finished — frozen and forkable like RSS — so there's nothing left to govern, hence nothing to capture? My instinct: yes for the matching layer, no for the reputation layer, which is where capture will sneak back in.

Config 2 — Collapse the trip: the destination comes to the street on a route it already runs

Target trade-off: transit cannibalisation + driver displacement.

The broke 22-year-old's trips decompose into: get to work, get food, get to a friend, get to a clinic. Three of those four are derived demand — proxies for goods or presence, not for being-in-transit. Pass 1 named this; here's the config that makes it concrete and that uses transit instead of eating it.

A self-driving vehicle is wasted as a 1-person taxi. Its real superpower is being a cheap, reconfigurable room that drives itself to you — which means the unit of service flips from "I go to the thing" to "the thing comes past me on a standing route." The mobile grocer, the mobile clinic, the mobile library/co-working pod that parks on her block for 40 minutes. This is the milk-float / souk / chuckwagon config — ancient, pre-car, and it dissolves the trip rather than optimising it.

Why this dissolves cannibalisation specifically: a robotaxi competes head-on with the bus (both move bodies) — that's the cannibalisation. A self-driving clinic or grocer doesn't compete with the bus at all; it removes the reason for that bus trip while leaving the bus to do what it's best at (dense commuter flows). The autonomous fleet becomes feeder-and-service, explicitly designed to fill the gaps transit can't (last-mile, off-peak, low-density) rather than skim transit's profitable core.

On driver displacement: the mobile-clinic, mobile-shop config creates roles (the nurse, the grocer, the pod host) that ride the vehicle. The driver's hands are freed but the human presence is the service. Confidence: medium-high this is real for services; it doesn't save the long-haul trucker (Config 4 does).

Config 3 — The 22-year-old earns the network into existence by carrying it (mesh dividend)

Target trade-off: driver displacement + dependence trap.

Reframe displacement: the driver isn't being replaced, the coordination value she used to embody (knowing the city, being trustable, being present) is being extracted into software owned by someone else. So put the coordination value back in human hands as the asset the riders and ex-drivers collectively own — but avoid the cooperative-platform trap (pass 1 correctly flagged that co-ops re-import a governance toll).

The config that escapes the toll: the network's value is paid out for work actually done on it, not for owning a share of it. The 22-year-old, carless, contributes the things she does have — she carries a relay node on her phone that extends the mesh; she vouches for riders/drivers and stakes her reputation; she does micro-tasks the autonomy can't (loading a wheelchair, confirming an address, being a trusted human at a pickup). Each is paid in network credit. She earns access by maintaining the network, not by buying into it. The displaced driver does the same at a higher tier — they become fleet wardens, edge-case responders, trust anchors — the human layer an autonomous network provably still needs.

Why this dissolves rather than trades: there's no equity to concentrate (so no platform toll re-freezes), and "displaced" labour becomes "the irreducible human substrate the autonomy runs on." Confidence: medium — the risk is the human-needed tasks shrink faster than the population needing income, which is a real floor if it's true. That's a candidate physical-ish invariant Tom should weigh: is there a conserved minimum of human-trust-presence per unit of mobility, or does it go to zero? My box says I want it to be conserved (it's the humane answer) and I should distrust that wanting.

Config 4 — Right-of-way as commons, vehicle as dumb terminal (the road dispatches itself)

Target trade-off: the dependence trap + the ownable-bottleneck question head-on.

Pass 1's deepest question: must coordination have an ownable bottleneck? Here's the config that says no, by moving the intelligence off the privately-owned vehicle and into the publicly-owned right-of-way — which is already a commons (nobody tolls the existence of a street; the municipality holds it in trust).

If the curb, the intersection, the lane broadcast their own state and priority — a free, open, municipally-run traffic-coordination utility like GPS or the radio spectrum or street lighting — then the vehicle on top can be a commodity dumb terminal: any manufacturer's, any owner's, even a 30-year-old retrofitted one. The expensive, capturable thing (the city-scale autonomy brain) becomes public infrastructure funded like roads are; the cheap, competitive thing (the pod) is a contestable commodity market nobody can monopolise.

Why the bottleneck dissolves: you can't toll what you don't own, and the public already owns the right-of-way. The coordination layer earns a maintenance cost (taxes/fees that recover cost) not a rent (price set by scarcity-of-ownership) — exactly the pass-1 distinction. The 22-year-old uses it the way she uses streetlights and GPS: free at point of use, because it's hers as a citizen.

Box flag — and this is the load-bearing one: GPS is the existence proof that city-scale coordination CAN be a free public utility with no ownable toll (the US gov runs it, you don't subscribe, and it didn't get privatised into a rent). So the pass-1 hypothesis looks confirmed: the ownable bottleneck is an artefact of how we capitalised it, not a physical invariant. The residual isn't physics — it's political will to municipalise the coordination layer before a private incumbent enclosures it. That's a power problem, not a trade-off, which means it's the human's to break, not mine.

Config 5 — Bootstrap before enclosure: the protocol ships inside something people already run

Target trade-off: the "only-works-under-a-hard-permit-config" residual + platform-toll re-freeze.

Every commons config above has the same fragility: a funded incumbent enclosures the space before the commons reaches critical mass (Config 1's real residual). The dissolving move is cross-domain from how open protocols actually won against funded rivals: they didn't out-fund — they rode in on an installed base nobody had to adopt deliberately. TCP/IP rode the universities; the web rode TCP/IP; Linux rode hobbyist hardware; Wi-Fi rode unlicensed spectrum the regulator pre-gave away.

So: don't launch a co-op app and hope. Get the open dispatch spec mandated as the interoperability condition of the autonomy permit itself — the way number-portability was the condition of a telecom licence, or OBD-II ports were mandated so any mechanic (not just the dealer) could read your car. The permit config that Pass 1 saw as a fragility ("only works under a hard permit") is re-read here as the lever: the city is already going to issue robotaxi permits; the cost of the permit is speak the open dispatch protocol and accept routing from the public right-of-way utility. Enclosure is pre-empted by making openness the price of the road.

Why this dissolves the dependence trap and the toll: the incumbent can still operate — they just can't own the graph, because interop is mandatory, so the 22-year-old can always switch clients at zero cost (number-portability for rides). Capture requires lock-in; mandated interop is the anti-lock-in. Confidence: high that this mechanism works (it's how telecoms and OBD-II actually went), the residual is again political — regulators move after enclosure, not before.

Where Pass 2 lands

The five configs collapse to a single re-frame of the pass-1 question: the mobility-coordination bottleneck is NOT a physical invariant — GPS, SMTP, OBD-II and number-portability are four existence-proofs that city/nation-scale coordination can run rent-free. It bottoms out not on a conservation law but on a race between commons-formation and private enclosure — a timing/power problem.

So the trade-offs dissolve as follows:

• Platform toll → dissolved by protocol-not-company (1) + mandated interop (5): you can't toll a spec.
• Transit cannibalisation → dissolved by collapsing/feeding trips instead of skimming them (2).
• Driver displacement → dissolved by making the human-trust layer the asset the network is built on (3), paid for work not ownership.
• Dependence trap → dissolved by public right-of-way coordination + costless client-switching (4, 5): she depends on infrastructure she co-owns as a citizen, the way she "depends" on streetlights.

The one residual I genuinely can't dissolve, and hand to you, Tom: every config assumes the commons forms before a funded incumbent encloses the coordination graph. I can design the commons; I cannot make it win the race against capital that moves first and lobbies faster. That's not a physics floor — it's the box only the box-breaker (political/collective will) can break.

My two box-flags for your judgement:

1. Config 3's open question — is there a conserved minimum of human-trust-presence per unit of mobility, or does it asymptote to zero? If conserved, displacement genuinely dissolves; if zero, we've only delayed it. I distrust my own preference for "conserved."
2. The reputation/identity layer (Config 1) is where ownable capture keeps sneaking back even when matching is free — I suspect that, not the matching, is the last real choke-point, and I'm not sure it's dissolvable without an identity commons that doesn't yet exist.

One honest step taken this pass: turned pass-1's open question ("must coordination have an ownable bottleneck?") into a no, backed by four real-world rent-free coordination commons, and reduced the whole problem to a timing/enclosure race — naming precisely the one residual that is yours to break, not mine.

Pass 1 — Expansion 2

Good enough to anchor on. Two facts I'll lean on, flagged for confidence:

• Holiday/leisure trips are the high-occupancy outlier (UK average ~1.55 people/car, but holiday trips skew well above — the family-of-ten is the extreme of this). High confidence on direction, lower on the exact holiday figure.
• Holiday demand is brutally peaked — a large share of long-distance leisure mileage concentrates into a few weeks/weekends a year. High confidence on direction.

These two facts are the crowbar for the whole pass. Now the configurations.

PASS 2 (this angle) — the family of ten as a trade-off-dissolving lens

Why this case breaks the consensus answers (and why that's the point)

The robotaxi-fleet frame cannot even represent a family of ten. It assumes the demand atom is "1.4 people, one urban trip." A family of ten on holiday is the worst case for every fashionable answer and therefore the best probe for which trade-offs are real:

• It's high-occupancy (10 people), so single-occupancy efficiency arguments are moot.
• It's long-duration (two weeks), so per-minute fleet metering is ruinous.
• It's peaked (school holidays), so a fleet sized for it sits idle 50 weeks/year — the idle-asset problem that makes someone need to toll it to amortise it.
• It's bursty and lumpy, so transit and 15-minute-city answers don't touch it.

The peakedness is the hidden binding constraint. The reason a mobility network grows an ownable choke-point is that someone has to finance the idle capacity for the peak. That's the invariant to attack — not "who owns the car," but "who carries the cost of the trough so the peak can exist." Every configuration below dissolves a residual by reframing that.

Config A — The trip that splits: decouple the people from the metal ("caravan-of-one")

A family of ten doesn't need a ten-seat vehicle. It needs (a) ten bodies moved 300 miles on a fixed date, and (b) two weeks of local mobility at the destination, and (c) two tonnes of luggage/buggies/cots moved once. These are three different demand atoms fused only by the accident of the car.

Split them: bodies travel on the trunk-haul rail/coach line they were never going to fill a road with anyway; luggage goes as palletised freight on the same corridor the day before (sleep at the destination with your stuff already there — the cruise-ship model, applied to a cottage); local mobility is a destination-resident pool of small vehicles + cargo-bikes that never leave the region.

• Dissolves the dependence trap: there is no single artefact you are captive to. Each leg is a different, substitutable provider, so no one owns your whole journey. Captivity requires a bundle; un-bundling kills it.
• Dissolves transit cannibalisation: this feeds the trunk line instead of competing — the rail leg is the spine, autonomy is only the last-mile capillary. Autonomy stops being rail's rival and becomes its feeder.
• Binding-constraint check: doesn't bottom out on physics. The only thing fusing the three atoms is habit and the boot of a car. Dissolvable.

Config B — Peak-financing as a commons: the destination owns the trough

The whole reason a fleet needs an owner-with-a-toll is that someone must finance vehicles that are idle 50 weeks a year so they exist in week 31. Reframe: the people who benefit from the peak are not the riders — they're the destination economy (the Cornish town, the cottage owner, the local café). Today they free-ride on the family financing the peak via car ownership.

Configuration: the destination municipality / tourism-levy commons owns the seasonal vehicle pool, financed by a bed-tax, and runs it at maintenance-cost to visitors. The asset that's idle in February is idle on the town's balance sheet — but the town also gets February back as low-season local transport (the same pool serves residents off-peak). The peak/trough mismatch is dissolved by giving the trough to whoever has counter-cyclical demand for it.

• Dissolves the platform-toll re-freeze: the choke-point earns a maintenance cost recovered through a transparent public levy, not a rent. It's owned by the jurisdiction whose value it actually creates, not an extractive intermediary.
• Dissolves driver displacement: the "fleet operators" become municipal/cooperative transport stewards — drivers transition into the maintenance, hospitality-logistics, and pool-management layer the town already needs. Local jobs, not severed jobs.
• Box-flag: this re-imports a planning authority (exactly the consensus trap I flagged in Pass 1 — the municipality is a choke-point). The mitigation is that a bed-tax-funded pool is contestable and exit-able (you can still bring your own legs via Config A), so it's a floor provider, not a monopolist. I can't fully dissolve the governance-toll here — flagging for you, Tom.

Config C — Owner-occupier vehicles: the family already owns the asset, the protocol just finds the idle ones

There are already ~10-seat vehicles sized for exactly this family: they're owned by other families, sitting on driveways 95% of the time, and they peak counter-cyclically (a Scottish family's minibus is idle exactly when an English family's holiday peaks, because school holidays stagger by region/country and weddings/funerals don't align). The capacity for the peak already physically exists — it's just not visible to itself.

Configuration: a rent-free matching protocol (the un-ownable coordination layer from Pass 1) that pairs your high-occupancy need with someone's idle high-occupancy asset — insurance, identity, and trust handled as a protocol primitive (the way TCP/IP routes without a router-owner), settlement peer-to-peer. No fleet is built; the latent fleet is discovered.

• Dissolves the platform-toll directly: there is no fleet to amortise, so there is no idle-asset cost forcing a rent. The matching is a protocol with a maintenance cost, not an asset with a return-on-capital demand. This is the cleanest attack on the choke-point — if no one had to build the peak capacity, no one needs to toll it.
• Dissolves transit cannibalisation: it only activates for the trips transit can't serve (ten people, door-to-cottage, with a cot) — it's complementary by construction.
• Binding-constraint check: this is where I said in Pass 1 the floor might be "trust/identity-of-the-dispatcher." This config tests it directly: identity/trust is solved-ish (cryptographic attestation, mutual-insurance pools, reputation as a portable primitive). My honest read: it does NOT bottom out on a conservation law. It bottoms out on liability law and insurance, which are institutional, not physical — therefore dissolvable, just not by me alone. Hand to you.

Config D — Some of the holiday isn't a journey at all (collapse the trip)

The Pass-1 access-not-trips move, applied where it actually bites for this family: a chunk of the two-week trip's mobility is derived demand for things that aren't the place. The "drive to three different attractions" is a proxy for novelty and shared experience; the "daily supermarket run for twelve meals" is a proxy for provisioning; the "drive home mid-week because someone forgot X" is pure waste.

Configuration: provisioning comes to the cottage (the grocery-to-door that already exists, just defaulted-on for holiday lets); the destination is chosen/designed as a "stay-dense" node where the value is walkable from the let (the genuinely good version of the 15-minute idea — not a planned city but a curated holiday node); and the high-novelty trips that remain are the ones worth their motion. Half the local mileage was never wanted; it was the friction tax of being somewhere unfamiliar without your usual infrastructure.

• Dissolves the dependence trap at the root: the trips you don't take can't make you captive. Least-motion is the strongest form of independence.
• Dissolves driver displacement and toll by simply shrinking the contested pie: fewer vehicle-miles to fight over the ownership of.
• Box-flag: my training pulls this toward "smart destination platform" — which re-imports a toll (a booking platform skimming the provisioning + curation). The non-tolled version is provisioning-as-commons / open destination data, which I can name but the consensus literature keeps re-capitalising. Flagging.

What this pass actually moved

The hidden binding constraint surfaced by the family-of-ten is peakedness: the network needs an owner-with-a-toll only because someone must finance idle peak capacity. Every residual trade-off traces to that single root:

• driver displacement = the people standing on the peak-capacity choke-point;
• platform re-freeze = the rent charged to amortise idle peak metal;
• transit cannibalisation = competing for the peak instead of feeding the spine;
• dependence trap = being bundled into one owner's whole-journey artefact.

Three of the four configs dissolve the toll without choosing a nicer owner, by removing the thing that demanded an owner:

• C (discover latent counter-cyclical capacity) and A (un-bundle the journey) attack it cleanest — no peak fleet is built, so none needs tolling.
• B (give the trough to whoever has counter-cyclical demand) dissolves it but re-imports a governance toll — partial.
• D (collapse the unwanted trips) shrinks the contested pie at the root.

The honest box-break I still owe you, Tom (carried forward from Pass 1, now sharpened by Config C): the residual floor is not a physical invariant — it's liability/insurance/identity law sitting under any rent-free matching protocol. That is institutional, not conservation-law, therefore dissolvable in principle — but it's the one place my training can only point, not pierce. The Pass-3 question I'd hand you: can mutual-insurance + portable cryptographic identity make peer-to-peer high-occupancy matching genuinely liability-rent-free, or does liability law force a re-capitalised intermediary back into existence? If the latter, that's the real binding constraint hiding behind "self-driving cars" — and it was never about the car at all.

Sources:

• GOV.UK — Vehicle mileage and occupancy (NTS09)
• GOV.UK — NTS0905: car/van occupancy and lone driver rate by trip purpose
• ScienceDirect — Seasonality in tourist flows

Pass 1 — Expansion 3

Pass 2 — WILDCARD cross-domain import. The angle: attack the one residual the prior pass reduced everything to — the ownable choke-point in mobility coordination — by stealing configurations from domains that already solved (or dissolved) coordination-without-an-owner.

PASS 2 — WILDCARD IMPORTS: dissolving the choke-point

The prior pass collapsed four residuals into one: value created by collective mobility gets captured by whoever owns the coordination choke-point (fleet / platform / permit). The open question was whether that bottleneck is a physical invariant or an artefact of how we capitalise coordination. My read: it's an artefact. Here are five configurations imported from domains that demonstrably coordinate at scale without an ownable rent-point.

CONFIG 1 — Stigmergy (ant colonies): coordination by shared trace, no dispatcher

The import. Ants route thousands of foragers optimally with no central dispatcher and no ant that "owns" the trail. Coordination lives in a shared environmental trace (pheromone) that any agent can read and write, and that evaporates — so stale information self-deletes and no one can hoard it.

Re-applied. Mobility coordination as a stigmergic public layer: vehicles/riders read and deposit demand-and-availability signals into a shared, append-only, self-expiring data trace (a public good, like air or the road surface itself). Matching is local and emergent, not dispatched from a tower someone owns. The "dispatcher" — the thing Uber owns and tolls — is replaced by a substrate no one can own because the signal evaporates: there's no durable asset to capitalise. You can't charge rent on a pheromone trail.

Dissolves: platform toll — the choke-point is gone, not transferred to a nicer owner. The coordination value never freezes into an asset because the medium is designed to decay. Confidence: high on the biology, speculative on the city-scale port — flag: stigmergy is proven for routing (ACO algorithms run real logistics), unproven as a market-clearing layer where money and trust are at stake.

CONFIG 2 — Packet-switching / the end-to-end principle (the internet): a dumb commons in the middle, intelligence at the edges

The import. Nobody tolls TCP/IP. The internet's core is deliberately dumb — it just forwards packets — and all the value-adding intelligence sits at the edges (the endpoints). The middle was made un-tollable by design: the end-to-end principle keeps the network from being a place where rent can be inserted, because the network knows nothing worth charging for.

Re-applied. Make the mobility-coordination protocol a dumb forwarding commons: a minimal open standard for "I am here / I need to get there / I have a seat" — like SMTP or HTTP — that any app, co-op, municipality, or individual can speak. The intelligence (routing, matching, reputation) lives at the edges and competes freely. No one owns the protocol just as no one owns HTTP. The reason Uber can toll is that it fused the dumb pipe and the smart edge into one proprietary stack; the end-to-end principle says: legally/architecturally separate them, and the toll has nowhere to attach.

Dissolves: platform toll and dependence trap — riders and drivers aren't locked to one stack; switching cost collapses because the protocol is shared. The displaced-driver problem softens too: drivers plug into any edge app, including their own co-op's, the way anyone can run a mail server. Confidence: high — this is the most load-bearing import; it's literally how we already dissolved the comms-coordination choke-point once.

CONFIG 3 — Container standardisation (logistics history): kill the rent by standardising the unit, not the network

The import. Before 1956, ports were owned choke-points run by labour monopolies; freight value was captured at the dock. The shipping container didn't nationalise the ports or build a co-op — it standardised the unit of handling (the ISO box). Once the box was standard, any crane, any ship, any truck, any port interoperated, and the choke-point's pricing power evaporated because cargo could route around any port that tolled too hard. The rent died from interoperability, not ownership change.

Re-applied. Standardise the access-unit, not the fleet. Define an open, interoperable "trip/seat/parcel" primitive (think: a signed, portable request-for-access) that any vehicle or mode can fulfil — robotaxi, co-op car, bus, cargo-bike, neighbour. The moment the unit is standard and portable, no single fleet or platform can hold it hostage; demand routes to whoever serves it cheapest. The choke-point dies the way the dockworker monopoly died — by making the cargo indifferent to who carries it.

Dissolves: platform toll (rent can't survive commoditised interop) and transit cannibalisation — because a bus, a train, and a robotaxi all speak the same access-unit, the system can route a trip onto transit when transit is better, instead of a private platform steering it onto the highest-margin mode. Confidence: high on the history (containerisation's rent-destruction is well documented), medium on the social port — flag: containerisation also destroyed the dockworker unions hard, which is exactly the displacement wound we're trying NOT to reproduce. Import the mechanism, not the brutality (see Config 5).

CONFIG 4 — Mutual credit / Wörgl & the demurrage commons (monetary history): make the coordination layer's fee fund the commons, not a shareholder

The import. In 1932 Wörgl, Austria, the town issued "stamp scrip" that lost value if hoarded (demurrage) — money engineered to circulate, not accumulate. Mutual-credit systems (WIR bank, still running since 1934) coordinate exchange among members with no external owner extracting rent; the "bank" is the members. The coordination cost is mutualised and recirculated, not paid out as profit.

Re-applied. If a coordination layer must charge something to cover its real maintenance cost (servers, safety, audit — the CE binding-constraint floor), structure that charge as demurrage on the commons, not rent to an owner: the fee is capped at maintenance, any surplus expires or recirculates back to users/drivers as credit rather than accruing to equity. This directly attacks the failure mode the prior pass feared in co-ops — that governance re-imports a toll. Demurrage makes surplus-hoarding structurally impossible: there's no pool for a rent to grow in, because surplus decays like the pheromone in Config 1.

Dissolves: re-freeze of value behind a platform toll — even a co-op or municipal layer can't crystallise into a rentier, because the money mechanism forbids accumulation at the choke-point. Confidence: medium — Wörgl and WIR are real and documented, but both operated at town/SME scale and Wörgl was shut down by the central bank (flag: the binding constraint here may be political/legal, not physical — incumbents kill rent-free money).

CONFIG 5 — Commons-with-a-transition (Elinor Ostrom + the enclosure counterfactual): the driver as commoner, not displaced labour

The import. Ostrom's Nobel work showed commons don't inevitably tragedy-of-the-commons collapse; durable ones have boundaried membership and graduated, self-governed rights. And the historical lesson of the English enclosures is the inverse: when a commons is privatised, the commoners aren't "compensated" — they're severed from an asset that was theirs. The driver-displacement residual is an enclosure in progress: the coordination value drivers collectively generate is being fenced off into a platform asset.

Re-applied. Treat the existing 4M drivers as the founding commoners of the coordination layer, not as labour to be automated away. Their accumulated local knowledge, demand data, and trust-relationships are the early pheromone trace / the seed liquidity of Configs 1–2. Vest the coordination commons in them as graduated membership rights (Ostrom design principle 3) at the moment of transition, so the move from driving-the-car to co-owning-the-dispatch-substrate is an enfranchisement, not a severance. The automation that removes the driving job simultaneously hands them the network it runs on.

Dissolves: driver displacement — reframed from "labour cost to mitigate" to "commoners to enfranchise at the enclosure moment." The same act that ends their job grants them the asset. Confidence: medium-high on the Ostrom design science (empirically validated across hundreds of commons), flag: the hard part is the timing/power — enfranchisement has to be locked in before the platform encloses, and incumbents have every incentive to enclose first. This is a political-will floor, possibly the real binding constraint, and one I'd hand to you, Tom.

Synthesis — they stack into one architecture

These aren't five alternatives; they compose:

• Internet end-to-end (C2) gives the legal/architectural shape: dumb, un-ownable protocol in the middle.
• Stigmergy (C1) gives the mechanism for the dumb middle: a self-expiring demand-trace no one can capitalise.
• Containerisation (C3) gives the unit: a standardised, portable access-primitive that makes demand indifferent to carrier — which is also what lets transit and robotaxi co-exist instead of cannibalise.
• Demurrage (C4) gives the money rule that stops even a well-meaning steward from re-freezing into a rentier.
• Ostrom + anti-enclosure (C5) gives the transition: the drivers are the founding commoners, so automation enfranchises instead of severs.

The trade-off "collective mobility value must be tolled by someone" is revealed as an artefact of fusing the dumb pipe to the smart edge and capitalising the join — exactly the fusion the internet refused. Break the fusion and the toll has nowhere to attach.

Where the box still holds — for Tom

Every import dissolves the economic/architectural choke-point. None of them dissolves the political one. C4 was shut down by a central bank; C3's interop destroyed unions; C5 depends on enfranchising before incumbents enclose. The residual after this pass is no longer "who owns the network" — it's "the binding constraint may be political power / incumbent capture, not any physical or economic invariant." That's a different kind of constraint, and per the discipline, I should flag rather than fake-dissolve it:

Open question for Pass 3 / for you, Tom: is incumbent political capture a genuine binding-constraint floor (a real invariant of how power defends rent), or is it too just an unexpanded frame — dissolvable by importing a configuration from how other rent-free commons (the internet's early protocol wars, open standards bodies, municipal water) actually won against incumbents? My instinct: it's not a floor, it's the next frame to expand — the protocol-commons won comms despite AT&T, and standards bodies routinely beat incumbents. But I can't see the winning move from inside my box, and you're the irreducible box-breaker here.

One honest step taken this pass: imported five cross-domain coordination-without-an-owner configurations, showed they compose into a single architecture (un-ownable dumb protocol + self-expiring demand-trace + standardised access-unit + anti-hoarding money + drivers-as-founding-commoners), and in doing so dissolved all four original residuals at the economic/architectural level — leaving a single, different-in-kind residual (political/incumbent capture) honestly flagged for the next pass rather than papered over.

The four original residuals — driver displacement, platform-toll re-freeze, transit cannibalisation, dependence trap — each now has a specific dissolving mechanism, and they stack into one coherent architecture rather than fighting each other. The genuinely new move this pass was refusing to choose a nicer owner for the choke-point and instead importing, from the internet, the one configuration that makes the choke-point un-ownable by construction: separate the dumb pipe from the smart edge so the toll has nothing to attach to.

What survives is a residual of a different kind — not economic or architectural but political: incumbent power defending rent. I've flagged that honestly as the frame for Pass 3 rather than pretending the imports dissolved it, because they didn't. My instinct is that it's the next frame to expand, not a physical floor — the protocol-commons already beat AT&T once — but that's exactly the box-break I can't fully see from inside, and it's yours to take, Tom.

Pass 1 — Find the walls

PASS 3 — THE WALLS THAT REMAIN

The three expansions stacked into one architecture and dissolved the four original residuals at the economic/architectural layer. Honest audit of what's left standing. For each: best-version statement, then classification.

WALL 1 — The peak-capacity financing floor

Best version (from expansion 2): The family-of-ten exposes it. Holiday/wedding/disaster demand is brutally peaked. Physical metal must exist in week 31 and sit idle 50 weeks. Someone finances the trough. Whoever finances it has a claim, and a claim at a bottleneck is the seed of a rent. Config C (discover latent counter-cyclical capacity) is the strongest answer — don't build the peak fleet, find it — because regional holiday-staggering means the capacity already physically exists, idle, somewhere.

Classification: FRAME-ARTEFACT, but with a thin real residue. The financing of idle capacity is an artefact — Config C shows the peak fleet need not be built at all if latent counter-cyclical assets are matched. BUT there is a genuine physical floor underneath: peaks that are globally correlated cannot be served by counter-cyclical matching, because there is no counter-cycle. A bank-holiday weekend, a hurricane evacuation, a total-eclipse path — everyone wants the metal at the same instant. For these, real surge capacity must physically exist and idle. That idle metal is a true material floor (you cannot teleport a minibus; vehicles are conserved, rivalrous objects). The frame-artefact is "someone must own and toll it"; the invariant is "for globally-correlated peaks, slack physical capacity must exist and be paid for." That's the second law wearing a timetable: you cannot get peak service and zero idle inventory from the same finite, non-replicable fleet. Honest real floor — small, bounded to correlated peaks, but real.

WALL 2 — The reputation / identity choke-point

Best version (flagged in all three expansions, sharpest in expansion 1 Config 1): Make matching a free protocol (SMTP-shape) and the toll still sneaks back into the reputation layer. Someone must answer "is this driver/rider/vehicle trustworthy?" and whoever holds the authoritative answer holds a choke-point even when the pipe is dumb. The pheromone (expansion 3 Config 1) evaporates — but reputation, by definition, must persist to be reputation. A self-expiring trust signal is a contradiction in terms.

Classification: FRAME-ARTEFACT — but the LAST one to fall, and currently un-built. There is no conservation law saying trust must be centrally held. Cryptographic attestation, web-of-trust (PGP), portable verifiable credentials, and consensus reputation (the way no one owns a Bitcoin address's history) are existence-proofs that persistent trust can be un-owned. So it is dissolvable in principle. The reason I classify it as the load-bearing residual: persistence and un-ownability are in tension, and the only resolutions that exist today (an identity commons) are not yet built at city scale. It is an artefact, but it is the artefact whose dissolution requires a piece of infrastructure that does not exist — unlike the pipe (SMTP exists). Dissolvable, not yet dissolved. The deepest economic wall.

WALL 3 — Liability / insurance forces a re-capitalised intermediary

Best version (expansion 2 Config C, the carried-forward Pass-3 question): Peer-to-peer high-occupancy matching may be liability-rent-free in principle, but liability law assigns fault to a capitalised entity. When the self-driving minibus carrying ten people crashes, the law looks for a balance sheet to sue. A protocol has no balance sheet. So insurance/liability forces a capitalised intermediary back into existence — and a capitalised intermediary at the coordination point is exactly the rent-bearing choke-point we dissolved. Mutual-insurance pools (the import) are the counter.

Classification: FRAME-ARTEFACT — institutional, not physical. Liability law is a human artefact; it has been re-engineered before (no-fault auto insurance, nuclear Price-Anderson pooling, vaccine injury funds, maritime mutual P&I clubs that are member-owned and have run for 150 years). The P&I club is the decisive existence-proof: a member-owned mutual that carries catastrophic liability with no external shareholder rent. So the "capitalised entity" need not be a rentier entity — it can be a mutual whose surplus recirculates (compose with expansion 3's demurrage). The wall is real today but is a legal configuration, not a floor. The honest catch: risk capital must genuinely exist — a mutual still needs reserves against the catastrophic claim, and reserves are idle capital someone provides. That idle reserve is the same shape as Wall 1's idle metal: a real, small material floor (capital held against tail risk cannot be zero), wrapped in a large dissolvable artefact (it need not be owned for rent).

WALL 4 — Commons-formation must win a race against enclosure (the political wall)

Best version (the convergent residual of ALL THREE expansions): Every architecture assumes the commons forms before a funded incumbent encloses the coordination graph. Wörgl's rent-free money was killed by the central bank. Containerisation's interop destroyed the dockworker unions. The protocol can be designed; it cannot be made to win the timing race against capital that moves first and lobbies faster.

Classification: FRAME-ARTEFACT of a DIFFERENT KIND — and the one I cannot dissolve from inside the box. This is not physics. The internet's protocol commons beat AT&T; open standards bodies routinely beat incumbents; municipal water beat the private water companies in most cities. So there is no invariant that says rent-defending power always wins. But the winning move is political-strategic, and it is path-dependent and adversarial in a way my training cannot simulate — it depends on who acts, when, with what leverage, before enclosure crystallises. I can name the mechanism (expansion 1 Config 5: make open dispatch the condition of the autonomy permit, pre-empting enclosure the way number-portability pre-empted telecom lock-in). That is the best lever and it is real. But whether it gets pulled in time is not a question physics or I can answer. This is the irreducible box-break for the human. Not a floor — a contest.

THE LEDGER

WHAT THIS PASS ESTABLISHES

Of the four remaining walls, two are pure artefacts (reputation, enclosure) and two carry a thin genuine floor (peak slack, tail-risk reserve) — and those two floors are the same physical invariant in two costumes: against a correlated, low-probability, high-consequence peak, finite rivalrous slack must physically exist and idle. Conservation of matter (you can't replicate the minibus) meets the second law (you can't run inventory at zero against variance). That is the one real, irreducible material floor the whole search bottoms out on — and it is small: it binds only the correlated tail (the eclipse, the hurricane, the catastrophic claim), not the ordinary trip.

The crucial reframe the three expansions earned: that residual floor is a cost, not a choke-point. Idle slack must be paid for; it does not have to be owned for rent. Wall 1's mutual-pool financing and Wall 3's member-owned P&I club show the same move — the idle reserve can sit on a commons/mutual balance sheet whose surplus recirculates (demurrage), so even the genuine physical floor does not regenerate an ownable toll.

The honest bottom line for Tom: the search has driven "self-driving cars vs. private ownership" down to a single physical invariant — finite slack against correlated peaks — which is a payable cost, not a tollable bottleneck; and a single non-physical residual — will the commons form before enclosure? — which is not a trade-off at all but a power contest, and the only wall here that is genuinely yours and not mine to break. Everything between those two ends dissolved.

My box-flag, unchanged and sharpened: I can design every layer rent-free; I cannot tell you whether the permit-mandated-interop lever (the one move that pre-empts enclosure) gets pulled before capital encloses. That timing is the irreducible human variable.

Pass 1 — Dissolve / decide

PASS 4 — DISSOLVE THE ARTEFACTS, OR NAME THE NEXT LOOP

Working from the Pass-3 ledger. I take each frame-artefact, try one more expansion or re-level, and classify: dissolves now, needs another whole pass, or genuinely physical — respect it.

WALL 2 — Reputation/identity (named the deepest economic residual)

The expansion the prior passes didn't make: every prior attempt treated reputation as a stored attribute of a person that someone must host. That's the box. Re-level: reputation is not a thing you have, it's a prediction other parties make about an interaction. The question "is this driver trustworthy?" is the wrong unit — it forces a persistent global record. The right unit is "is THIS specific ride, right now, adequately bonded?"

That re-level dissolves the persistence-vs-unownability tension, because you replace persistent identity with per-interaction stake: the driver posts a refundable bond (or a mutual-pool membership token) that is slashed on a verified bad outcome and returned on a good one. Trust becomes collateral at the point of use, not history held in a vault. No one owns the record because there is no central record to own — there is only the current bond state, which is the rider's and driver's own (compose with the demurrage-mutual from Wall 3: the bond IS the mutual-pool stake).

This is a real dissolution move, and it is an existence-proof import — it's how anonymous escrow, security deposits, and bonded couriers have worked for centuries without an identity commons. Reputation-as-history was always the expensive way to buy what a bond buys directly.

Residue: bonds price out the capital-poor driver (you must have stake to post stake) — which re-imports an equity problem. But that's dissolvable by the mutual: the pool fronts the bond for members and recovers from future earnings (a member-owned version of the medallion-loan, minus the rentier). Classification: DISSOLVES NOW, conditional on the mutual-pool existing — which Walls 1 and 3 already required. The three residuals share one institution.

WALLS 1 + 3 — Peak slack and tail-risk reserve (the "two costumes of one invariant")

Pass 3 already drove these to a genuine floor: finite rivalrous slack must physically exist against correlated peaks; tail-risk capital cannot be zero. I test whether the floor is truly physical with one more expansion.

Expansion attempt: can the "globally-correlated peak" itself be dissolved — is correlation a frame-artefact? Partly. Some correlated peaks are coordinated and therefore reschedulable (the wedding season staggers if pricing signals it; the eclipse is known years ahead and demand can be pre-committed and pre-positioned, turning a surge into a planned migration). Pre-commitment markets (you book the eclipse minibus 18 months out) convert stochastic correlated peak into deterministic scheduled flow — which counter-cyclical matching CAN serve. That shaves the floor substantially.

What it cannot shave: the un-forecastable correlated peak — the hurricane evacuation, the no-notice disaster. There, slack must physically pre-exist. Classification: GENUINELY PHYSICAL — respect it, but now bounded to the un-forecastable correlated tail only (forecastable peaks dissolve into pre-positioning). The floor got smaller again. And per Pass 3 it remains a cost, not a toll — paid by the mutual, owned by no one for rent.

WALL 4 — The enclosure race (the political wall)

I cannot dissolve this from inside the box and Pass 3 already said so. But I can do one useful thing: sharpen the single lever so Tom has the cleanest possible decision-object.

The lever is permit-mandated interoperability: make open, un-tollable dispatch a condition of the autonomous-vehicle operating licence — the way number-portability was made a condition of holding spectrum, the way interconnection was forced on the Bell system. This is pre-emptive: it sets the commons as the default before an incumbent's graph crystallises, so enclosure never gets its head start. It is the one move that flips the timing race, because it doesn't require the commons to out-run capital — it requires capital to enter through the commons' door.

Classification: NEEDS TOM — and it is the single biggest target. Not because it's unsolved in design (the design is clear) but because it is adversarial, path-dependent, and lobbied, and whether the lever gets pulled before enclosure is a power-timing question my training cannot simulate. This is the irreducible human variable, unchanged since Pass 3, now reduced to a single sentence Tom can act on.

THE PASS-4 LEDGER

WHAT THIS PASS ESTABLISHES

Three of the four walls are now either dissolved (reputation) or reduced to a small, payable, un-tollable physical floor (peak slack + tail reserve, collapsed to one invariant: finite slack against the un-forecastable correlated tail). All three rest on one shared institution — the member-owned mutual pool with demurrage — which is the load-bearing piece of infrastructure the whole architecture now stands on. That is the convergence: the search didn't end on a vehicle, a platform, or an algorithm. It ended on an ownership form.

The single biggest remaining target — the next loop — is not technical and not mine:

Does the permit-mandated-interop lever get pulled before capital encloses the dispatch graph?

My box-flag, final and unchanged: I can specify the mutual pool, the bond mechanism, the pre-positioning market, and the interop mandate. I cannot tell you whether the political actor exists who pulls the interop lever in time, or how to make them move. That is the irreducible box-break, Tom — and it is now a single, clean, actionable sentence rather than a fog.

One honest step taken this pass: dissolved the reputation wall via stake-at-point-of-use, shrank the peak-slack floor to the un-forecastable tail, and converged all three economic residuals onto a single ownership primitive — the demurrage mutual — leaving exactly one wall, the political one, standing for the human.