Everything Happens Somewhere
The missing idea in practically every digital trust design
Sign your name on a contract and you are bound by it. Sign the same name on a birthday card and you have sent a greeting. Practise the same strokes on a napkin and you have done nothing at all. Forge them onto someone else’s cheque and you have committed a crime.
The ink is identical in every case. The hand is the same hand. What changes is the room.
You have known this your whole life. Nobody taught it to you. You read the room without thinking, every day, a thousand times a day, and you are almost never wrong. A signature means one thing in a lawyer’s office and another on a postcard, and you have never once confused the two. The most important fact about your signature is not held in the pen. It is held in the setting around it.
Keep that in mind, because it is the whole article.
A signature is one case of a much larger pattern. Shake a stranger’s hand at the end of a negotiation and you have closed a deal. Shake it at a funeral and you have offered condolence. Raise your hand in a meeting and you have voted. Raise it on a street corner and you are a man stretching his shoulder. Say “I do” in front of a registrar and you are married. Say it in rehearsal and you are an actor reading a line.
In each pair, the physical act is the same. The body does the same thing. The setting decides what the act becomes. A small physical event — a few strokes, a clasp of hands, a raised arm, two spoken words — and the room around it turns that event into an agreement, a vote, a marriage.
Money works this way. Ownership works this way. Citizenship, a verdict, a licence, a debt — none of them live inside an object you can pick up and hold. All of them live in an act plus a setting. Take away the setting and you are left with the bare act, which means nothing on its own. A philosopher named John Searle wrote the rule down in a single line: something counts as something, in a context. I will come back to him at the end. For now the plain version carries us. Things become what they are because of where they happen.
The room we forgot to build
Then we moved our lives onto the internet, and we forgot to build the room.
The machines we built are extraordinary at one job. They move data from one place to another with perfect fidelity. A file leaves your computer and arrives on the far side of the planet, every bit intact, in a fraction of a second. The network can prove the file arrived exactly as it was sent. It cannot tell you whether the file is true, whether it was authorised, whether it binds anyone to anything. The wire moves the act and never builds the room.
So we patched the hole by hiring people to stand in it. Every institution you deal with online exists, in part, to supply the setting the wire left out. The bank vouches that the money is real. The platform vouches that the seller is a seller. The certificate authority vouches that the website is the website. The identity checkers vouch that you are you. Each one is a prosthetic for the same missing limb. The internet moves acts beautifully and builds no room to hold them, so we pay a thousand middlemen to stand where the room should be.
The most serious attempt, and where it slips
For the last fifteen years, the most serious attempt to fix this has gone by the name of tokenization. It began with a real insight, which deserves saying plainly. Move the value itself, not merely a message about the value. Stop sending an instruction to a bank and waiting for the bank to update a number. Put the thing on a shared record and let it move directly. That is a genuine idea, and the people who had it were aiming at exactly the right problem.
Watch what happens next, though, because the whole thing turns on one quiet move.
A token tries to carry its meaning inside itself. It is built to mean the same thing everywhere, to everyone, for all time, and that sameness is sold as the headline feature. No room required. The object holds the meaning wherever it travels. That is the promise. A house shows what the promise costs.
You buy a tokenized house, and the record says the token is yours. In the town where the house actually stands, ownership is whatever the land registry says it is, under the law of that place. As long as the two agree, nobody notices the gap. The day they disagree — a stolen key, a court order, a fraud — the courthouse wins. Every time. The token held a copy of the truth. The registry, the law, the court: that is the room where ownership actually happens, and the token only ever carried a photograph of it.
The token reached for ownership-everywhere and arrived at ownership-nowhere. By refusing to belong to any particular room, it lost its grip on the one thing that makes ownership real.
Push it one step further, because the failure runs deeper than “courts can override.” A driving licence can be suspended this afternoon. A police officer, a medical report, a magistrate, and by three o’clock the licence that was valid at noon is void. The licence is alive. Its status can change at any moment.
A token of that licence is a photograph of a status that has already moved on. It tells you what was true when the picture was taken. It cannot tell you what is true now. To stay current it would have to ask the issuing authority again and again, and at that point the issuing authority is the real source and the token is a slow, redundant copy of an answer the authority already holds.
Nothing went wrong at the courthouse. The mistake was made the moment a living thing was frozen into an object and sent off to mean the same thing forever.
A seven-hundred-year-old mistake
There is an older name for this mistake, and it carries seven centuries of hindsight.
Around seven hundred years ago, merchants in the Italian trading cities worked out something that went on to build the modern economy. Every transaction has two sides. You cannot honestly write down what you own without also writing down who owes you, or whom you owe. Money that comes in came from somewhere. A debt you hold is someone else’s obligation. Write down only your own side of the ledger — your assets, your coins, your tokens — and you have written half the truth. They called the broken old way single-entry. They called the repair double-entry, and double-entry is the bookkeeping that every bank, every company, and every economy has run on ever since.
A token is single-entry, brought back to life with cryptography. It records that the thing exists. It forgets the other side of the relationship. It says “this coin is here” and stays silent on who issued it, who backs it, who is owed. A bank deposit — the money sitting in your account today — is the opposite. A deposit is a liability, two-sided by its nature, an asset to you and an obligation to the bank, a live relationship with a named counterparty the law can reach. Tokenize that deposit and you keep your side and amputate the other. You have turned double-entry money back into a single-entry chip. A seven-hundred-year-old error with a fresh cryptographic finish.
The repair
So what does the repair look like?
It is the opposite move from the token. Instead of handing someone an object and hoping it carries its meaning out into the world, you bring the parties into a shared room. They agree, together, what is true. Each of them walks out holding a receipt that both of them signed, because every one of them were there at the moment it was true.
Inside the room
The room is built for this one encounter and torn down after it. While it stands, everyone in it must be able to answer the same short list of questions — and answer each by checking the same data, never by taking anyone’s word.
What do the words mean? Before two or more parties can agree that something is true, they have to read it the same way. “Four hundred and fifty thousand euros” and “title transferred” must mean exactly one thing to the buyer, the seller, and the bank alike, or the agreement is three people nodding at different sentences. The room fixes the dictionary first.
Who is here? Each party named and checkable, down to the hardware in its hand. No anonymous chair at the table.
What game are we playing? The room fixes the rules — the moves allowed, their order, what each one requires. It does not fix why anyone walked in. The buyer wants the machine, the seller wants the money, the bank wants its fee. They agree on the rules that hold those reasons together, and never have to agree on the reasons.
What can happen in here? Only the moves the rules permit. Everything else is impossible inside the room, the way an illegal move cannot be made on a chessboard. Nothing to police, because nothing else can occur.
What is true? Which proofs were presented, checked, and let in. The funds are locked. The licence is current. The title is clear. Each one a fact the room admitted only after every party could verify it.
What can come out, and what happens after? The outputs the rules allow and no others — a payment released, a title moved, a receipt issued. Then the room dissolves, or a new one opens, or the relationship stays live. One last thing is settled before anyone signs: who referees if the parties fall out later over what happened here. The answer is chosen in advance and written into the receipts, so a dispute already knows where to go.
Answer all of it and you sign. Agreement here means something narrow and hard: each party verified the same facts and put its name to them. When the last answer clears, the room runs, produces the only outcome its rules allow, and hands each party a receipt the others signed. No one was asked to trust anyone. The proof did the work.
The meaning stays in the room where it was made. What each party carries away is the agreement, co-signed, dated, anchored to the moment and the place it happened. If anyone ever disputes it, you can return to exactly that room, replay exactly what was agreed, and watch the truth reconstruct itself. The receipt is good because all parties made it together. Nobody has to be trusted to hold the master copy, because there is no master copy. There is the room, and the matching receipts the room produced.
This is how the real economy has always worked underneath the software. Two or more sides. A shared moment. A record both parties keep. Double-entry was the room rendered in ink. We are simply building the room again, this time in protocol.
For forty years, digital design has asked the same question in a hundred different forms. Which object should carry the value? Which token holds the ownership? Which file proves the identity? Every honest attempt to answer it has built a cleverer object — a better coin, a stronger key, a more tamper-proof file.
The question was wrong from the start. The thing that carries institutional meaning is a setting plus an act, a room and something done inside it. Every cleverer object aimed at the wrong target. Build the room, and the objects everyone was fighting to perfect turn back into what they always were. Receipts, signed by the people who were there.
Everything happens somewhere. An economic activity is executed somewhere. Ownership is established somewhere. A payment is finalised somewhere. Forty years of digital trust design has tried to build an economy of objects floating free of any somewhere, and has spent the whole time paying middlemen to stand where that somewhere should be. Those middlemen are the rent we pay for never building the room.
Build the room into the design, and the rent stops.
A closing note for readers who work on this directly.
You will object that context is not entirely absent from existing designs, and you are right. A verifiable presentation carries a domain. An OAuth token carries an audience. A capability scopes what it authorises. These are real, and they are fragments of the idea. Each one treats context as a small setting bolted onto an object — a field, a parameter, a flag attached to the thing that still does the real work. None of them makes the room the primary unit. The object stays at the centre and context decorates it. The shift described here turns that around. The room becomes the thing that exists, and the objects become the receipts, also known as verifiable claims, it issues.
The philosopher behind all of this is John Searle, whose formula — X counts as Y in C — is the source code of every institution humans have ever built. X is the raw act, the brute evidence. Y is the status it acquires. C is the context that grants it. Tokenization tried to collapse C into X, to bake the context into the object and ship it. C will not be baked in. C is the room, and a room cannot travel inside the thing that happens in it.