The timer that decides you are gone

Any posthumous transfer runs into one question: who learns, and how, that the moment has come. A notary has a death certificate; a distributed system has none and cannot have one — it has access neither to registries nor to hospitals.

What remains is an indirect sign. The person stopped showing signs of life in the system, therefore they are probably gone. The assumption is imperfect by construction, and all the engineering here amounts to lowering the cost of getting it wrong.

The silence threshold in the specification is 360 days. The number is not arbitrary and is worth holding in mind: almost a year without a single action.

Too short a term is dangerous in the obvious way. A person travels, falls ill, changes a phone, disappears from the network for three months — and the system declares them dead while they live. An error in that direction is irreversible: rights are transferred, access belongs to somebody else.

Too long a threshold is dangerous differently, and that is rarely considered. The heir waits for years; in that time they may not survive themselves, may lose the wallet, or may simply forget the archive exists. A year is an attempt to stand between those two troubles.

On top of the main term there is a seven-day warning window. That matters more than it looks: the mechanism does not fire silently. Before transferring rights it grants a week for the person to show a sign of life and cancel everything. Any action in the system resets the timer.

The right to control the Ark is issued as an SPL-standard token on Solana — the Inheritance Token. What passes is not a password and not a file but the right itself, and that changes the shape of the problem: a password can be copied unnoticed, whereas a token moves by a transaction that is visible.

There are two transfer scenarios. The active one: during their lifetime the person specifies the heir's wallet address and signs a deferred transaction. And the automatic one, on the timer. The first is more reliable because it does not depend on the silence assumption being correct; the second exists for the case where the first never got done.

The neatest part of the construction is splitting the key by Shamir's scheme. The key is nowhere stored whole: it is cut into shares, and reconstruction requires collecting an agreed number of them.

The point is that the single point of failure disappears. Breaking one store yields nothing; losing one share is not fatal. That is precisely the property an ordinary «password in an envelope at the notary» lacks: the envelope is either intact and stealable, or lost, and then nothing helps.

Storage costs money, and a person who is gone cannot pay. So payment is moved into the same deflationary router: five per cent of a service transaction is burned, sixty-five goes to the treasury to buy the resource for permanent storage, and unclaimed ambassador shares — up to thirty per cent — are also sent to burning.

The logic is the same as across the project's economy: storage is paid for not by a subscription that will lapse, but by a one-off contribution to a fund that lives on the gap between yield and the falling price of storage.

First and foremost, a false trigger. Three hundred and sixty days plus a week's warning greatly reduce the risk but do not remove it. A person in a long illness, without access to devices, is formally indistinguishable from one who has died.

Second, the heir as the weak link. The scheme will faithfully transfer rights to a wallet named at some point in the past. If the heir has lost access to it, or the address was entered with an error, a flawlessly executed protocol delivers the archive nowhere.

Third, the oracle network watching for activity. It is distributed, which is right, but it remains part of the system: the timer works while it works.

My conclusion is this. Automatic transfer is not a substitute for a will but insurance for the case where no will was left. The most sensible thing someone who has read the specification can do is not to rely on the timer: make the active transfer while alive, and tell the heir out loud that they have received it.