Field notes

Receipts Across the Light Delay

October 17, 2026 · about 8 minutes · which parts of the protocol survive a light delay, which break, and what a backbone between worlds would need

The problem distance makes

Every network protocol we use was written for a world where a question gets its answer in milliseconds. Take that away and most of them stop, not slowly but completely.

Light takes about 1.3 seconds to reach the Moon. It takes between 3 and 22 minutes to reach Mars, depending on where the two planets are in their orbits, and about 12 minutes on average. To the nearest star it takes 4.2 years. A handshake that needs three round trips takes a minute and a half to Mars at best and more than two hours at worst, and no one has yet proposed a handshake with Proxima Centauri. Even time itself needs renegotiating: in 2024 the White House directed NASA to establish a Coordinated Lunar Time by the end of 2026, because clocks on the Moon tick at a measurably different rate from clocks on Earth, and a unified standard was judged necessary for "the reliability of transactions" there (Reuters, via Gulf News).

The engineering answer to delay already exists. Delay-tolerant networking, standardized as the Bundle Protocol version 7 in RFC 9171, moves data as bundles that a node stores until it has a link to forward them over, for minutes or months, and it is the protocol chosen for NASA's LunaNet. What it does not have is an economics. Custody, the promise that a node will hold a bundle until it can pass it on, was dropped from the core of version 7 and is being redesigned as an extension, and nothing in the standard says why a stranger's relay should accept custody of your bundle at all. A government network does not need that answer. A backbone built by many parties does.

So the question for any proof-of-bandwidth protocol that wants to be that backbone is simple to state: which of its mechanisms survive the removal of the instant answer, and which were quietly assuming one?

What survives the delay unchanged

The surprising part is how much of Bandwidth Swap was already written for a disconnected world, not by design but because the receipt model never needed a third party to be present.

Receipts work offline and settle later. A receipt is a signed statement by the payer, countersigned by the relay, that a number of bytes crossed a link in a window. Nothing about making one requires anyone else to be reachable. The Mint sees it when the Mint sees it. On the bench the relay keeps receipts it could not deliver in an outbox and sends them when the Mint is back; a relay on Mars would keep them for the next pass of the orbiter. The paper's narrow resilience claim, that bytes keep moving while settlement is unreachable and settle later, is the exact property a light-delayed backbone needs, and it is already the claim Phase 1 is built to test by cutting the house's internet mid-window.

The payer's clock is the only clock. The protocol never asks two parties to agree what time it is. Timestamps in a receipt are the payer's; the relay only checks that the payer's clock is within a tolerance of its own. That rule is indifferent to whether the two clocks run at Earth rate or lunar rate, as long as the tolerance is set for the link. Coordinated Lunar Time is a problem for the people writing the tolerance, not for the receipt.

Disputes need no judge. A window settles at the smaller of the two signed counts, disputed or not. That rule was chosen so that neither party gains by lying, but its other virtue is that it can be applied by anyone, anywhere, at any time, from the two receipts alone. A dispute between Earth and Mars does not wait for a hearing; it was decided the moment both signatures existed.

Mints are local notaries, not a global ledger. A Mint signs what it settles and publishes a Merkle commitment that anyone holding a receipt can check. It does not need the agreement of other Mints to do its job, which is why a Mint on each world, settling its own links and reconciling with the others whenever a link allows, is the natural shape rather than a strained one. A chain that needs validators to agree every minute cannot span a 22-minute delay. A notary that needs only its own signature can.

Nothing is paid for being seen. Uptime, liveness checks and announcements earn nothing in the protocol, so a node that is unreachable for weeks because its planet is behind the Sun loses nothing but the windows it could not carry. A network that pays for availability would have to invent an excuse for conjunction. This one does not notice it.

What breaks, and what it would have to become

The parts that break are the parts with a number in them. Each number was chosen for a bench on one home network, and each one encodes an assumption about how fast an answer comes back.

The hour. A payment window is an hour because an hour is long enough to amortize the receipt exchange and short enough to bound what a relay fronts on credit. To Mars the exchange itself takes up to 44 minutes, and a link may only exist for the part of a day when a relay is above the horizon. The window would have to be the pass, not the hour: a receipt per contact, closed when the link closes, with the next window opening whenever the next link does. Nothing in the settlement rule cares how long a window is.

The five seconds. The clock tolerance is five seconds because synchronized nodes on a desk agree within a millisecond and a free-running one drifts past five seconds in about a week. Across a light delay the relay cannot even know the payer's clock without a model of the delay. The tolerance becomes a function of the link, five seconds plus the light time both ways plus the drift expected since the last contact, and the relay's check becomes "is this timestamp plausible for a signal that left when the payer says it did." Still the payer's clock; just a wider door.

Conditional payment. The target design pays each hop only when the next hop acknowledges, in the manner of a hash-time-locked contract. That lock has a timeout, and a timeout shorter than the round trip pays nobody. Across worlds the locks must run for days, which means a relay's capital is tied up for days per window, which means relays charge for the wait. The pilot's answer, prepaid windows settled by invoice, works at any delay because the credit risk is bounded by membership rather than by a timer; the open-network answer is a lock whose timeout is set from the route's light time, and a price that reflects it.

The burn and the settlement layer. Five percent of every fee leaves the network so that paying yourself is a loss. That only works if the burn is enforced somewhere, and the pilot enforces it nowhere because the pilot settles by invoice. On a multi-world network the enforcement point is the Mint that settles the receipt, which means the burn is only as good as the Mint, which means Mints on different worlds have to reconcile their ledgers whenever a link exists, and a Mint that under-burns has to be provable from its own published commitments. The fraud proof in the paper does that work; what is missing is the reconciliation protocol between Mints, which the paper leaves open even for Earth.

Bonds across worlds. A relay posts a bond with a Mint, and a lying relay is slashed. A bond held by a Mint on Earth is no comfort to a payer on Mars whose dispute the Earth Mint will not hear for a month. Bonds would have to be posted with the Mint nearest the link, and a relay serving two worlds would post two. That is more capital per relay, and it is the price of a dispute that resolves locally.

Route discovery. Announcements already live off the settlement layer and already carry no reward weight, so they survive. But routes between worlds are not discovered; they are computed from orbits. A relay's announcement would say when it will be reachable, not whether it is, and users would plan windows around an ephemeris the way deep-space operators already do. The receipt graph still ranks relays by what they actually settled, which is the only ranking that matters.

None of these are changes to what the protocol rewards. They are changes to the constants, and to one piece of machinery, settlement, that the pilot has deliberately not built yet. Version 0.3 of the paper now says so in an appendix: the protocol has no constants, only parameters of a link.

The protocol at three scales

The same receipt, with the constants set for the link. Delays are one-way light times; the bench row is what runs today, the others are what the preceding section implies, not anything that has been built.

The last column does not change. That is the whole argument: the proof is a signed agreement between the two parties on the link, and distance changes how long it takes to make one, not what it is.

Compared with the alternatives

Three other ways to run a backbone across the light delay, and where each one stops.

One operator's network. This is how deep space works today: one agency owns the antennas, the relays and the schedule, and trust is an organization chart. It works, and it will keep working for the agency's own traffic. It cannot be a backbone for anyone else, because the only way to join is to be the agency. The Bundle Protocol gives it a way to move bundles; it has no way to pay a stranger to carry one. Bandwidth Swap's receipt is that missing piece: a reason for a relay nobody owns to accept custody, and a way to settle with it later.

A consensus blockchain. The reflex answer to "many parties, no trust" is a chain, and a chain is the one design that cannot survive the delay. Consensus means a quorum agreeing on the next block within a bounded time, and a quorum spread across a 22-minute delay either waits 22 minutes per round or splits into one chain per world. A chain per world is just Mints by another name, with the added cost of every node replaying every receipt. The 2021 version of this paper was a chain. The 2026 version keeps only three things on a settlement layer, channel open and close, Mint summaries, and slashing, and it is exactly those three that can afford to be slow.

Self-reported proof. Proof-of-coverage and proof-of-uptime networks ask nodes to attest to themselves and have validators check. Across the delay the check is impossible in time, so the attestation becomes the proof, and a network that pays for attestations across a light delay is a network paying for stories it cannot verify for months. Receipts fail in the other direction: a receipt that never reaches a Mint simply pays nobody, which is the safe failure.

The pattern is that two-party agreements degrade with distance and many-party agreements break. A receipt needs the payer and the relay, and both are on the link by definition. Everything else in the protocol, the Mint, the burn, the bond, is bookkeeping that can wait for the next pass. That is not a property anyone designed in for Mars. It is what you get when the only proof you accept is the one from the party who was waiting for the bytes.

The modest claim

None of this has been run beyond three computers on a bench, 1.3 light-microseconds apart. What the bench showed is that two machines that are not trusted to agree can settle a window from their signatures alone, that a relay which over-claims is paid for what the payer signed, and that a relay whose clock drifts is declined and loses the window. Those three results are the ones that have to hold at any distance, and they are the ones the protocol got right first.

The interplanetary case is not a roadmap item. It is a way of asking which parts of a protocol are load-bearing. Put a light delay under Bandwidth Swap and the token economics, the validator committee and the uptime scores, all of which the 2021 paper had, fall away as things that needed an instant answer. What remains is a payer, a relay, a receipt, and a bookkeeper who can be late. A backbone for a galaxy would need more than that. It is hard to see how it could need less.

Sources: the Bandwidth Swap whitepaper, v0.3 (Appendix A, links with delay), the open questions, the kit, RFC 9171, Bundle Protocol version 7, custody transfer for BPv7 and LunaNet, the Coordinated Lunar Time directive, Earth to Mars light time.