The Boundary Register

A living, versioned account of what Mirror cannot do. Most vendors hide their limits behind marketing; publishing them is the stronger position, because it makes the claims about what Mirror can do checkable. For each boundary below: what it cannot do, why that is deliberate, and the honest upgrade path — marked [shipped], [buildable] (a real extension that keeps the design intact), or [declined] (an "upgrade" that would break the very properties that make Mirror worth using, and why we will not build it).

The rule every upgrade is judged against: does it stay blind to the operator, deterministic and byte-reproducible, free of a trusted third party, and runnable on a laptop with no ceremony? An upgrade that fails that test is not an upgrade; it is a different, weaker product wearing Mirror's name.

Boundary 1 — It sees bands, not exact numbers#

Cannot: distinguish two prices inside one band. In a 100–150 band, $101 and $149 both clear, so a mispricing up to the band's width hides by design.

Why deliberate: the blindness is the discarded precision. You cannot recover exactness without handing the operator the number, which is the whole thing the product refuses to do.

[shipped] Near-edge encoding (edge_margin). A value a rounding error from an edge now commits to both neighbouring bands, so two honest banks straddling an edge reconcile without a false divergent — and without widening the blind spot anywhere except at the edge. Opt-in per table, off by default, byte-identical when off.
[shipped] The blind-spot is measured. mirror-geometry computes, as arithmetic on the agreed table, the widest mispricing a band can hide — so a corridor can see its own blind spot and cut tighter (including logarithmic or risk-weighted edges, which are already allowed since edges are party-supplied).
[shipped] Progressive zoom (mirror-zoom). A bilateral, consent-based cascade: reconcile against a coarse table, and if either bank wants more assurance on one shipment it signs a request to re-read it under a finer table — one the corridor ratified and that nests under the coarse one — with a reason from a closed list. The counterparty signs consent or decline inside a window, and anyone checks the pair offline. The operator still sees only match / no-match each round and never sees the request; a refusal to zoom, or silence, is not proof of anything but is a signed fact an examiner can weigh. Same primitive, run iteratively — no new crypto. A corridor that wants finer resolution on every shipment ratifies the nested table outright (mirror-nested): standing consent.
[buildable, with a real trade-off] Sealed-value escrow. Commit the exact price under a key held by an independent quorum (not Mirror, not the counterparty), openable only on a divergent verdict by k-of-n auditors. Gives forensic precision on the 1% that diverge while the 99% stay sealed forever. The honest cost: the exact value now exists in the system, encrypted, where today it does not — a custody shift some corridors will want and others will refuse. It builds on mirror-escrow.
[declined] Auto-generating corridor tables. Having Mirror compute the band edges to cap the blind spot would make Mirror an authority on price — the manipulation target and determinism-killer the whole design avoids. Mirror measures the blind spot; the banks cut the table.

Boundary 2 — The bands must be agreed first (cold-start)#

Cannot: reconcile without a shared corridor table. No agreed edges, and the same number bands differently on each side, so nothing matches.

Why deliberate: Mirror invents no prices; the buckets are the parties' agreement, not Mirror's.

[shipped] An open corridor-table standard. Published as a proposal for ratification, so a table is an industry artifact two banks both reference rather than a bilateral negotiation. See the corridor-table standard.
[shipped] Table-discovery handshake (mirror-discovery). Each bank signs the list of tables it supports, named by hash with their granularity (bands, widest bounded ratio); both compute the same intersection and select the most granular mutual table — or return undetermined · no_shared_table. A table the two offers describe differently is reported and never chosen. Turns table agreement from a legal step into a software step; the corridor still ratifies. The honest cost: each bank learns which public tables the other supports. That discloses capability, not any trade, and it is not private set intersection.
[shipped] Shadow mode (mirror-shadow, the bander's shadow). The bander runs candidate tables over the bank's own multi-leg shipments through the operator's reconciliation kernel, inside the bank, submitting nothing, and reports counts per table, each table's blind spot and how many shipments change answer — so a compliance officer ratifies the table the data justifies. It extends mirror-internal's start-alone posture. It sees only the bank's own legs: cross-bank divergence comes from books it never reads.
[shipped] Time-bound corridors. A proposal may carry valid_until; after it the table judges nothing (table_expired), and a renewal is a new version — so a table agreed for a pilot or a volatile season cannot quietly outlive the agreement.
[shipped] Ratio corridors (mirror-ratio, band --reference-set, accept, screen). Each leg bands price ÷ a public reference on a published, closed, dimensionless table. The reference is the exact median of a quorum of cited public figures, refused when they disagree beyond a ratified spread, and only the files' hashes leave the bank. For goods with public reference prices, nothing is negotiated: one bank opens the corridor and the other accepts it. The honest cost is a new attack surface (the reference itself), and goods with no credible reference keep a negotiated table. See ratio corridors.
[declined] Mirror publishing the tables. An industry body (ICC/BAFT/WCO) ratifying tables is the goal; Mirror authoring the prices in them is the refused one. The ratio tables are protocol constants with no price in them (0.85 to 1.15 of whatever a corridor cites), so this refusal still holds.

Boundary 3 — If both banks state the same lie, they match#

Cannot: catch collusion. Mirror compares the parties to each other, never to reality, so two parties who state the same wrong number reconcile perfectly. A clear is "the stories agree," not "the trade is honest."

Why deliberate: there is no ground truth in a two-party system for any cryptography — including ZK or MPC — to check against. This is an information limit, not an engineering gap.

[shipped] Independent legs (the triangle). A trade is not only two banks: customs' declared value, a carrier's declared quantity, a cargo insurer's declared value are legs from parties with no stake in the price. Adding them turns "two banks agree" into "everyone on the trade agrees," and each independent vertex is one two-party collusion cannot reach.
[shipped] A measure of independence. mirror-independence counts the distinct organisations behind a clear (so one bank wearing three role-hats reads as one, not three), and grades how much a clear rests on parties who could have colluded — distinguishing a strong anchor (customs, carrier) from a weak one (a cargo insurer, whose value is often derived from the invoice). No score, no probability: it measures exposure to collusion, never collusion.
[shipped] Canaries. mirror-canary feeds the live operator known-answer trades it cannot tell from real ones — continuous, public proof the operator answers honestly, which MonetaGo cannot do because it can see its own data.
[buildable] Self-consistency. The rail already treats a leg resubmitted with different content as a hard finding. A rolling commitment to a party's own recent bands could flag a trade that breaks the party's own history — with the honest caveat that a legitimate market move trips it too, and a threshold on "how far off" edges toward the scoring the product refuses.
[shipped] A cited benchmark (mirror-benchmark, the bander's benchmark-leg). One bank cites a public market figure it already uses, such as an exchange settlement price for the same goods, basis and date, fetches it itself, and bands it under the shipment's own salt as a leg with the role benchmark, inside a market window the pair agreed. A corridor that requires it compares every trade leg with it, so two documents over-invoiced by the same amount, which agree with each other, both read divergent against the cited figure. It closes part of this boundary, not all of it: a figure the member banded falsely, or one that does not price this grade, is caught only at audit, by opening the leg against the public document. It can only add a comparison, so it never clears what the trade legs alone would not, and it is kept out of the trade match window so its wider window never widens what a clear asserts.
[declined] A market-price "truth oracle" that Mirror runs. A third leg that Mirror fetches, chooses or publishes makes Mirror a price authority (the manipulation target) and forfeits determinism — the commodity-feed idea refused every time. The line between this and the cited benchmark above is who holds the number: there, a member cites a public document and the figure never leaves the bank; here, Mirror would be the source. Neither is a witness: the independent third leg that opens the independence gate is still a party on the trade, never a market figure.

Boundary 4 — The operator sees the shape of your activity#

Cannot: hide metadata. The operator reads no message, but a commitment is a stable pseudonym, so it can count how many shipments a member sends and see which submissions concern the same one.

Why deliberate: the pseudonym's stability is what makes it a join key at all.

[shipped] Chaff (mirror-batch). Constant-size batches: a member's real commitments padded with cover entries the operator cannot tell apart by shape — the kernel refuses to emit a batch that is not shape-uniform — so the operator cannot count a member's real volume. Cost is compute, not architecture.
[shipped] Batch mixing (mirror-cadence). Every window emits exactly the same number of items on a fixed cadence, timestamped to the window, with cover derived from the corridor key so both counterparties generate the same decoys without coordinating. The operator cannot time a shipment or count a corridor's trades. What it does not claim: every cover item reconciling.
[buildable, heavy] Relay routing. For the most sensitive corridors, route commitments through consortium mix nodes so no relay sees both sender and operator. Real metadata anonymity, real infrastructure and latency cost — an option for dual-use goods, not a default.

Boundary 5 — Whoever holds the corridor key can guess#

Cannot: hide a value from the counterparty. Both sides hold the corridor key, trade references are low-entropy and sequential, and bands are few — so a key-holder can enumerate and recognise a commitment. Mirror blinds the operator, not a fellow key-holder; and a leaked key is retroactive.

Why deliberate: the shared key is what lets both sides derive the same commitment without a round of communication. That convenience is exactly what the enumeration exploits.

[buildable] A slow key-derivation. Derive the salt with a deliberately slow KDF (PBKDF2 at high iteration count — in the platform crypto, no new dependency) so each guess costs milliseconds and enumerating a batch costs days. Table-specified, so it stays byte-reproducible. Not built yet for one reason: it changes the salt every implementation must reproduce — the bander, the browser kit and five SDKs held to one set of vectors — so it ships as a protocol version with new conformance vectors, never as a patch.
[buildable] Per-transaction random nonce. Replace the guessable reference-derived salt with a random nonce exchanged over the banks' authenticated channel. The search space goes from thousands to 2²⁵⁶ and enumeration dies — at the cost of a communication round the reference-derived salt avoids. Mirror runs no bank-to-bank channel and will not route the nonce through the operator, so it needs a channel the pair already has.
[shipped] A hash ratchet (mirror-ratchet, the bander's ratchet-start and ratchet-turn). The shared secret advances by a keyed hash chain, so a leaked secret exposes its own period and later ones, never an earlier one — forward secrecy from a plain hash chain, no dependency. It turns on a ratified calendar (a day, a week or a month), not per transaction: a per-transaction ratchet needs the two banks' state kept in step trade by trade, and one missed trade splits the chains, while a calendar lets each bank compute a shipment's epoch from its date. Its honest limits: backups and snapshots of an old epoch defeat it, a key held in an HSM gets forward secrecy by rotation instead, and it hides nothing from the counterparty, which holds the same epoch.

Boundary 6 — It must be reproducible to the byte#

Cannot: do fuzzy, statistical, or machine-learned matching on the wire — two implementations must produce the identical commitment or two honest banks never match.

Why deliberate: byte-reproducibility is what lets anyone verify a verdict and lets an independent implementation interoperate. It is the property, not a constraint to route around.

[shipped] Fuzzy inside, exact on the wire. All the messy work — FX and unit normalisation (mirror-basis), reference and category canonicalisation (locator, attribute), and OCR/extraction (the bank's own tools) — happens inside the perimeter, before the exact commitment. The operator only ever sees the reproducible hash. The two concerns are already cleanly separated, and the bander's docai-import (mirror-docai) is the seam: fields a document-AI tool extracted pass a confidence gate the bank sets, are parsed under one declared number format, and become exact leg rows, with every held document counted by reason. The gate takes the vendor's confidence as stated; a confidently wrong field passes, and the document-AI page says so.
[shipped] One FX basis, pinned (mirror-fxbasis). Conversion was where two honest banks parted company: different publishers, fixing times and days. The pair now ratifies one public publisher and a rule for which file applies; each bank fetches the file itself, converts with exact rational arithmetic on its own machine, and commits the file's hash inside the pricing basis. Two banks with the same file get the same digits; two with different files are held undetermined. Mirror fetches, publishes and chooses no rate — a publisher naming Mirror or the operator is refused.
[shipped/buildable] A published canonicalisation standard. The spec already fixes how references, dates (strict ISO), HS headings, Incoterms, container numbers (ISO 6346), IMO and air-waybill numbers are normalised before hashing. Naming and versioning it as a standalone standard turns byte-reproducibility into an auditable compliance property: a differing hash is a canonicalisation fault, and it is detectable.

Boundary 7 — It is not zero-knowledge and not MPC#

Cannot: hide the one bit it reveals — same band or not. Stronger crypto (ZK, homomorphic, MPC) would hide more but needs special hardware or a setup ceremony.

Why deliberate: running on a plain laptop with no ceremony, and one readable file whose hash is its identity, is the moat — the thing the heavyweight-PET vendors repeatedly failed to convert into a business.

[buildable] Agility within the hash family. A corridor can already specify parameters (the edge_margin, the tolerance, and — see Boundary 5 — the KDF and its cost) in the table it ratifies. That is real, ceremony-free agility that keeps every party byte-identical.
[shipped] Multi-operator quorum. mirror-cosign lets several independent operators reach a verdict separately, so trust need not rest on one operator — threshold-integrity without threshold cryptography.
[declined] Pluggable ZK / Pedersen / SNARK backends. They demand a trusted-setup ceremony, reintroduce dependencies, and — worst — fragment interoperability: two banks on different backends produce different commitments and cannot reconcile, which reinstates the coordination problem the standard exists to remove. The one-primitive rule is why anyone can interoperate.
[declined] Additive secret-sharing to a second custodian. Splitting the value between Mirror and an auditor is "MPC without the ceremony" only in the pitch: comparing two banks' shared values for band-equality still needs a real multiparty computation, and it introduces a second custody party who can, with Mirror, reconstruct the value. It trades a clean "the operator sees nothing" for a murky "the operator sees a share."

A standing rule — the one this register caught its own author breaking#

The operator cannot read a band, but it can count how many commitments a leg carries — and that number is not noise. With tolerance t, a leg emits about 2t+1 commitments, so the count encodes the tolerance the operator prints on the signed match window, and the two-dimension kernel uses the same count as its anti-widening gate. The per-leg commitment count is a public, tolerance-encoding channel.

So any change to how many commitments a leg emits is screened against that first — and this register caught its own author. The near-edge encoding (Boundary 1) adds one commitment when a value sits next to an edge, and the operator, inferring the tolerance from the raw count, read it as one band too wide: a signed verdict could state a 4x blind spot where the truth was about 2.02x, or call a bounded window unbounded. It never cleared anything it shouldn't — it erred toward overstating the blind spot, which is the honest direction — but a signed record carrying a false number is a defect here.

The fix leaves the wire untouched, and that is the point. The margin is a property of the ratified table, not of a leg, so the operator reads it from its own registry (exactly as it reads the price ceiling) and uses it to read the window honestly: it knows a near-edge margin adds at most one band, subtracts that one band before inferring the tolerance, and widens the reported ratio by exactly (1+m)/(1-m), rounded up so it can never understate. The leg is byte-identical; a regression test pins the honest number. [shipped] The rule that falls out — do not overload the commitment count — is now the first screen any future proposal that changes commitment cardinality has to pass.

Triage of fourteen proposed cryptographic upgrades#

A later strategy memo proposed two "genius" fixes per boundary. Each was judged against the same rule as everything above: does it stay blind to the operator, deterministic, free of a trusted third party, and runnable on a laptop? Most of what was genuinely good was already shipped; most of what was new broke an invariant. Saying which is which, in public, is the point of this document.

Boundary 1 — bands, not exact numbers. Multi-scale overlapping tiles ("wavelet bucketing") is [declined, because it is dominated]: requiring two legs to co-bucket in each of N offset tables is, provably, co-bucketing in the one table whose edges are the union of all N — checked by brute force, zero disagreements over 31,375 price pairs. A single finer table gives the identical blind-spot reduction with fewer commitments and is already permitted. Homomorphic delta matching (Pedersen commitments + a range check) is [declined] — checking a hidden difference against a range is a zero-knowledge range proof, the excluded family.

Boundary 2 — the bands must be agreed first. A universal geometric (√2) price curve baked into the protocol is [declined]: a ratio curve still needs an absolute anchor and currency, so it removes no negotiation, and √2 is irrational, which the exact-decimal banding path refuses. Bloom/Cuckoo-filter + OPRF negotiation is [declined] — probabilistic membership means false positives on the wire; the goal is already met by the shipped blind corridor negotiation and DH-PSI.

Boundary 3 — a shared lie reconciles. zkTLS / TLSNotary proof from the payment session is [declined] (a zk-SNARK is the excluded family, and it proves a message was sent, not that its price was true). Independent supply-chain legs is [shipped]: bill of lading, air waybill, container (ISO 6346) and vessel (IMO) references are cargo-intrinsic keys, and mirror-independence grades how much a clear rests on parties with no stake in the price.

Boundary 4 — the operator sees the shape of activity. Epoch-rotating nullifiers / mixnets is [declined as specified] — rotating the join key per epoch breaks the very join duplicate-financing detection needs; the on-brand form is the SPEC's own blind locator plus padded batches. Deterministic chaff / constant-rate padding is [shipped] as mirror-batch and mirror-cadence.

Boundary 5 — whoever holds the corridor key can guess. Argon2id / VDFs is [declined] (neither is in browser WebCrypto, so either breaks the byte-parity that lets two banks derive the same salt); the same goal via a table-specified PBKDF2 cost is [buildable]. A Signal-style Double Ratchet is [declined as specified] — its asymmetric half needs a per-message key exchange; its symmetric half is the plain hash ratchet, now [shipped] under Boundary 5, turned by the calendar.

Boundary 6 — reproducible to the byte. MinHash / LSH fuzzy bucketing on the wire is [declined]: LSH makes near items collide only probably, with designed-in false positives — the opposite of fail-closed. The honest form is already shipped (fuzzy inside your own perimeter, exact on the wire). A canonicalisation pipeline splits: whitespace, case, sorted keys and standard reference formats are [shipped]; phonetic reduction (Soundex/Metaphone), which merges genuinely different names, is [declined] on the wire.

Boundary 7 — not zero-knowledge, not MPC. Folding SNARKs (Nova / Halo2) is [declined] — no trusted setup does not fix a second commitment scheme that cannot reconcile against the first, a heavy dependency, and a verifier no bank's crypto team can re-implement in an afternoon. VOLE-based two-party computation is [declined] — it replaces "a blind operator compares hashes" with an interactive protocol between the two banks, a different trust model and a different product.

Sharper evidence, same three states — the evidence taxonomy [shipped]#

A later memo asked the right question: not "how do we make Mirror detect more" but "how do we make the evidence it already produces sharp enough that a bank's own investigators and SAR process become dramatically more accurate — without Mirror ever holding a score or a filing decision." That is the only upgrade direction that strengthens detection without destroying the moat, and it is now built.

A bare divergent is a true signal and a poor exhibit. mirror-taxonomy folds the signed verdicts a party already holds for one shipment — the base price-band verdict, the two-dimension quantity-vs-price split, the independence grade, an attribute disagreement, a concurrent-exposure collision — into a single, deterministic fact pattern: which kind of mismatch fired, how large it is structurally (a count of divergent pairs, the names of the diverging dimensions, an independence grade), and the exact signed bytes to cite. Four properties keep it on the right side of the line, each test-enforced:

It is a fold, not a new judgement. It restates fields the sub-verdicts already carry and derives nothing they did not establish. It holds no raw value — it never had one — so it opens no channel to the operator, which does not hold these records. There is deliberately no operator route that produces it: the fold is party-side by construction, and the operator stays blind.
It is not a score. Every magnitude is a count or a categorical label copied verbatim from an input; nothing is combined or weighted into a number. assertNoScore runs over the whole record before it is returned.
It is not a filing decision. mirror-taxonomy.assertNoDecision refuses to emit if any field is a filing / suspicion / escalation / recommendation key. The decision stays inside the bank, with a human, where Mirror cannot reach it and cannot create tipping-off risk.
It does not vouch for authenticity. Each entry cites its source by sha256, so a supervisor re-verifies the originals. The party-side assembler — the bander's casepack command — verifies every exhibit's ES256 signature before folding and refuses one it cannot, running entirely on the sealed on-prem machine.

This is the honest form of the memo's "local genius layer": the heavy, bank-specific intelligence stays inside the bank's perimeter, fed by a signed, offline-verifiable exhibit rather than by a number Mirror had no business inventing. With progressive zoom (Boundary 1) it is what a corridor reaches for before it reaches for sealed-value escrow's custody cost — precision without a value ever existing in the system.

Triage of an infrastructure-and-moats memo#

A later memo proposed turning Mirror into "the global trust layer for physical commerce" — owning the corridor tables, triggering settlement, and licensing a regulator's dashboard. The good half of it is already built; the ambitious half breaks the invariants that make the product legally viable. Judged against the same rule as everything above, published here because the declines are the moat.

Dynamic corridor tables from a price oracle / an "AI band generator" is [declined] — the commodity-feed idea, refused every time it appears. Mirror invents no prices; an oracle makes Mirror a price authority (the manipulation target) and forfeits the determinism the SR 11-7 dossier rests on. The honest form of "own the corridor tables" is not authorship, it is a REGISTRY of party-ratified tables: the [shipped] open corridor-table standard and mirror-public (table hashes), and the [shipped] table-discovery handshake under Boundary 2. Banks ratify the bands; Mirror holds their hashes and provenance, never their prices.
Atomic settlement triggers — a verdict that releases funds is [declined, and it is the most dangerous suggestion here]. Mirror never moves, holds or settles money. A reconciled that pays out inverts fail-closed catastrophically — a false clear becomes an irreversible payment, and the operator joins the settlement-and-liability path it exists to stay out of. This is enforced, not merely intended: kernel/mirror-iso20022.js refuses any settlement or release instruction outbound, and the verifier-side cannot-list now REFUSES a signed record that carries one. Mirror attaches the proof a bank's own rail settles against; it is not the rail.
A shared "known ghost-shipment pattern" database across banks (the pattern-matching half of the sanctions-routing idea) is [declined] — a deterministic pattern database shared between institutions is the surveillance-dressed-as-privacy honeypot the whole design refuses, the same objection that killed the hashed-identifier knowledge graph. The BLIND half is [shipped]: destination and control-list consistency is an attribute reconciliation (mirror-attribute), and duplicate cargo financing is mirror-concurrent-exposure through the cargo-intrinsic key — both flag a disagreement without any shared list of who is bad.
The regulator's systemic-typology map is [shipped], and stronger than the memo assumes: mirror-macro computes the divergence rate, velocity and structurally dark (ghost) corridors live from signed reconciliations, and now carries a k-anon-gated breakdown by typology class (over-invoicing, quantity mismatch, concurrent exposure, misdeclaration) — a real-time heat map of financial-crime structure with no invoice, name or amount ever seen, every cell withheld below k distinct members. The topological graph the memo pictures is a UI on top of data that already exists and is already private.
Blind ESG / carbon reconciliation is [shipped]: mirror-attribute is the same primitive over a party-supplied versioned vocabulary rather than a price table, so a carbon-credit or certification equality check is an attribute reconciliation today — doubling the addressable surface with no new crypto. Honest boundary, as everywhere: a match proves the parties AGREE, never that the green claim is TRUE; collusion greenwashes past it exactly as it launders past a price clear.
IoT / telematics container attestation is [buildable] and needs no new trust model: a smart container's signed weight, seal and route is simply another independent leg, the customs/carrier vertex mirror-independence already grades. Mirror accepts a signed telematics leg and diverges when it disagrees with the paper. Honest cost: it adds a hardware root of trust (the device enclave), so it is a stronger optional anchor, not a default, and a spoofed device still colludes.
Regulatory safe-harbor recognition and the "legal shield" narrative are real, and out of scope for code: they are what the published spec, the enforced cannot-list and the runnable test suite exist to make possible. The substance a compliance officer needs is already here — an offline-verifiable signed receipt instead of a black-box score, mirror-evenhand answering de-risking with arithmetic, and a rail structurally incapable of the filing decision that creates tipping-off risk. That is a positioning job, not a primitive to build.

Triage of a "genius feature" memo: co-signed verdicts#

The memo asked for the one structural property a single operator cannot have: that no one operator's word is the verdict. Judged by the same rule:

Co-signed verdicts across independent operators is [shipped, tested in one process]: a corridor names its operators and k, the members ratify the list with the table, and a verdict is co-signed only when k distinct listed operators sign the identical record, with no dissent. See federation.
The honest limit, stated where it matters: a federation is only as independent as the organisations that run it. Mirror can run all the keys, and the rules refuse two keys under one organisation name, but a shared owner behind two names is not visible to the code. The independent operators are an outside matter, and no corridor should name a federation until they exist.
Not threshold ECDSA and not MPC: each operator signs with its own key. That is replication with quorum, and the register says so rather than letting the word "federation" sound like cryptography it is not.
Operators that disagree do not co-sign, and an operator that does not answer is not a veto. An operator that answers with a different governance for the corridor is.

Triage of a "publish a format, not a network" memo#

A later memo argued that consortium trade platforms died on commercial alignment, not on technology, and that Mirror should be free at the rail, own the vocabulary and stop asking two competitors to negotiate. Its structural moves, judged by the same rule:

Bands as a ratio to a public benchmark is [shipped]: ratio corridors under Boundary 2.
One bank opens a corridor; the counterparty opts in is [shipped]: authoring is one corridor.propose, joining is mirror-bander accept, which shows what is being accepted and refuses a corridor outside the admitted shape. The one-bank day-one case is mirror-bander screen: counts of the bank's own off-market prices, computed inside the bank.
The salt derived by the witness, not the banks is [buildable, as a reviewed design]. Done properly it is an oblivious PRF (RFC 9497): a bank obtains the commitment for its own band without learning the witness's key, and cannot test other bands without asking the witness, which can log and rate-limit every query. That would close the counterparty enumeration of Boundary 5. Its cost is structural: the witness becomes an online dependency for every leg. It is built only against the RFC's published test vectors, or commissioned, never improvised.
A PSI join between the two banks is [declined for now]: it needs a bank-to-bank channel, and Mirror deliberately has none. The join key is already a keyed locator commitment the operator cannot enumerate (§4).
Per-period batch commitments are [shipped in part]: batch mixing and cover traffic exist party-side; a sorted per-period commitment that replaces per-leg commitments would change the protocol's unit of comparison and is not built.
A per-attestation fee charged to the witness is [declined]: it is a volume fee, which the signed refusals rule out for any party, because a fee per attestation gives Mirror an interest in how many there are. Witnesses are paid by the banks directly, outside Mirror.
A flat member fee with corridors never metered is a pricing decision, not an invariant. It is open, and it is the owner's to make.

Why this document exists#

The strongest thing that can be said about a cryptographic AML rail is not a list of what it catches — it is an honest account of what it cannot, verified by anyone. A vendor whose pitch depends on the illusion of doing everything cannot publish a page like this. Mirror can, because its limits are deliberate and its upgrades are on the reader's terms, in the reader's perimeter, at the reader's speed. That is not the fine print. It is the product.

Read alongside the cannot list (what it refuses to do, each enforced by a test), the threat model, the protocol spec, and the honest comparison. This register is versioned; each entry moves from buildable to shipped as it lands, and nothing is marked shipped that is not in the test suite.