Continuity Without Consensus: Toward Offline Digital Cash Without Secure Hardware

Preventing double-spending offline — with no secure element and no network to check against — is impossible in general: a spender briefly beyond every check can always spend the same value twice. Offline digital cash has therefore leaned on tamper-resistant hardware; this paper develops the connected-mode foundation for doing without it. Money requires two guarantees: local integrity — a party cannot spend what it does not have — and global uniqueness — the same value cannot be spent twice. Vesting both in a single agreeing authority forces global consensus and a single point of failure and of capture; and the consensus-free line since AT2 still derives both from one quorum-intersection round over a fixed validator set. This paper's contribution is architectural: it separates these two guarantees across two independently-operated layers, run by disjoint populations, and places adversarial double-spend safety in the layer the spender does not control. Because that safety is structural — bound neither to a token economy nor to a secure element — a spender who chooses their own witnesses still cannot force a double-spend, and no tamper-resistant hardware is required to enforce it. The uniqueness layer is where adversarial safety lives. It is a receiver-chosen, global consume-once check over a gossip mesh: a state consumed once is marked once, and any second spend of it — including one a colluding sender launders through witnesses of their own choosing — is caught at redeem and fails closed, reinforced by an authorship-gated same-sequence fork ban. This layer, not the sender-side witness round, is what a malicious sender cannot evade. The integrity layer secures the honest and crash-fault case and adds defense-in-depth. It replaces fixed-set quorum intersection with a per-wallet state chain: each transaction's sender-chosen witness set must overlap its predecessor's in at least ⌊k/2⌋+1 members, so two transactions that consume the same predecessor share a witness which — having marked that state consumed — rejects the second (the S-ABR mechanism). We are explicit that against a sender who seeds their own witnesses this overlap provides no guarantee: its role is to make the common, non-adversarial path self-enforcing, not to carry adversarial safety. When the network is unavailable the system enters a disclosed-risk partitioned (Ark) mode: offline transfers trade on bounded risk and reconcile against the connected-mode safety on reconnection, rather than depending on a secure element. Because the connected-mode safety is structural and needs no tamper-resistant hardware, it is the substrate on which such a hardware-free offline mode is built; that offline mode is implemented in the system, and a companion paper in preparation develops its risk model — a confidence index bounding offline exposure — in full. We frame this paper accordingly: a step toward offline digital cash without a secure element, establishing the connected-mode substrate here. For the sender-collusion case we establish, by exhaustive model-checking (TLA+/TLC) of the connected-mode composite, a two-part safety theorem (Theorem 1): no two conflicting branches are ever both durable on the honest converged view (Part 1) — verified non-vacuously, as a property of the dynamic fork ban rather than a definitional identity; the residual against a fully adversarial sender is a bounded receiver-selection risk governed by the uniqueness layer's honest fraction (Part 2) — a local double-spend that never enters the honest settled view, excluded after detection. We evaluate the implemented system as a deployed multi-node mesh whose cryptographic authority is a single canonical binary executed under two virtual machines. We are explicit throughout about what is proven, what is machine-checked over bounded configurations, and what remains open, and we claim no novelty for the intersection-relaxation principle nor for gossip-based detection — the contribution is their separation into independently-capturable layers. This record includes the full paper (PDF) and a reproducibility artifact (axiom-continuity-without-consensus-artifact.zip) containing the TLA+ safety specifications, the adversarial-injection harnesses, soak-test logs, and a snapshot of the canonical Core ELF (CoreID 42285e6b…) with its verification manifest. The paper text is licensed CC-BY-4.0; the code within the artifact bundle (TLA+ specifications, injection harnesses, and the soak harness) is licensed under the GNU General Public License v3, consistent with the AXIOM source repository.