Can I edit a sealed X-DOC I received?

No. Whoever receives a sealed X-DOC gets no pen at all: the writing gate refuses, so neither an old tab nor an alternative path can record a revision on top. You can read it, verify the seal, export the PDF, keep it, and pass it along exactly as it arrived.

What does the seal guarantee?

Four things, all verifiable without relying on X-ID: integrity (the content did not change, because the hash is recalculated and compared), anteriority (the content already existed at that hour, in UTC, under the hash), authorship (whoever drew it up is not rewritten) and ancestry (each version's seal includes the previous one, so the order between them is provable).

Does the seal prove the other party agreed to the document?

No. A sealed and unsigned document is dated text with authorship — which is already a lot, and is not an agreement. Agreement is another operation: the X-DOC for signature, where both parties sign the same hash. The seal proves what and when; the signature proves who agreed.

Can the sender change the content later?

No. The seal is not a permission the author grants and revokes, it is a property of the document — it holds for both sides. If the sender wants to correct something, they register the next version, and the previous one keeps verifying for as long as it exists.

What happens if I read a sealed X-DOC with no network?

You can read and decide freely offline, but the discharge only enters the registry once the connection is back. Until then the card reads "read · receipt on its way" and the red dot stays on — that is the difference between "I did my part" and "this is settled". When the network returns, the device dispatches it on its own.

What does the blinking red dot in the sealed X-DOCs box mean?

That something is still missing on that document — it does not count how many, it only signals a pending item. It goes out through three paths: reading, skipping, or recording that you will not read it.

If I remove a sealed X-DOC from my vault, is it destroyed?

No. Removing takes your copy off that device and nothing more: the sender still has theirs, and the seal keeps verifying. Nobody undoes a record in someone else's wallet.

Sealed X-DOC — the document that arrives to be read, verified and kept

What the seal guarantees

The seal of a sealed X-DOC is a SHA-256 hash: a 256-bit fingerprint of the content, computed on your own device at the moment of registration. It is the same cryptographic function that underpins Bitcoin. Change one comma and the whole hash changes — and that is what makes the guarantee verifiable by anyone, without depending on us.

integrityThis content has not changed

The recipient recomputes the hash and compares. A match: it is exactly the text that was sealed. No match: someone altered it afterwards.

priority in timeIt existed at this hour

The time travels in UTC, under the hash. It serves to prove the content already existed before some later event.

authorshipThis person drew it up

The link carries whoever sealed it, and that is never rewritten — not even when the document passes from hand to hand.

ancestryThis version continues that one

Each version's seal includes the previous one. That is why versions form a chain, and the order between them is provable.

And what the seal does not guarantee: intent. A sealed, unsigned document is dated text with authorship — which is already a great deal, and is not an agreement. Consent is another operation, with another seal: the X-DOC for signature, where both parties sign the same hash. A seal proves what and when; a signature proves who agreed.

What the recipient can and cannot do

This is the promise the operation is named after: whoever receives a sealed X-DOC gets no pen. And this is not a restriction hidden in the interface — it is the writing gate itself that refuses, so neither a stale tab nor some alternative route can record a revision on top of it.

The recipient can

Read the whole content, on the same sheet it was written on.
Verify the seal on their own device, offline and without asking us.
Export the PDF, which carries the seal band printed on the page.
Keep it in the Sealed X-DOCs box, to find it later.
Pass it on exactly as it arrived — the copy travels with the original seal.

Cannot

Edit the content. There is no route: no button, no screen, no gate.
Record a version of their own on top. The chain stays with whoever drew it up.
Be asked for a signature. The gate that promises "nothing is asked" does not come back for metal.
Re-seal before passing it on. What arrived goes onward as it arrived.

The seal cuts both ways. Whoever sent a sealed X-DOC cannot change that content either: the seal is not a permission the author grants and revokes, it is a property of the document. If they want to correct something, they register the next version — and the earlier one, the one in your hands, keeps verifying for as long as it exists.

How to send one

Every X-DOC is born sealed. So sending one to be read requires no special preparation: it requires choosing the right gate in the conversation, and choosing which version goes.

Register the document. Write it and seal it. Whatever is registered is already sealed — there is no "seal it later" step.
In the conversation, tap the + and choose Sealed X-DOC. The gate states the request: reading only.

Choose the version. If the document has more than one, the chain appears for you to point at which one goes in the memo — each link is a complete document, with its own seal.
Confirm the link that goes. The sheet opens for you to check the content and the seal before attaching — the last chance to see you are sending the right version.
Send the memo. The document travels alongside the message, inside that connection's conversation — and the card in the bubble already shows the seal and the padlock.

When to use it

The question that decides the gate is simple: what do I expect from the other person? If the answer is "that they read it, know it, and can prove it later" — it is sealed.

two hands exchanging the sealed document over a counter

Receipt and proof of paymentThe amount, the date and what was paid. Nobody needs to sign a receipt: they need to be able to prove it has not changed.

figure with a loupe examining the sealed report on the drafting table

Expert report, opinion or assessmentTechnical work delivered. The conclusion belongs to whoever signs the report — the other party receives it to read, not to rewrite.

three figures around a round table with the sealed minutes at the centre

Minutes of a meetingWhat was said and decided, with the hour. If someone disagrees later, the earlier minutes remain, and the correction is a new version.

a figure before the document mounted on the wall, with earlier versions receding behind it

Policy, rulebook or price list in forceThe content that applied on a given date. Changed? Register the next version — and whoever received the earlier one still holds proof of what applied back then.

two figures standing on either side of the table, looking at the sealed brief between them

Brief or approved scopeWhat was agreed before the work began. What was asked for stays on record, and the ask does not change shape along the way.

figure receiving the sealed notice through the door slot

Notice and announcementThe date the other party was informed. With the read receipt, it is proven the notice arrived — and the content cannot be rewritten afterwards.

If you expect the person to write, the gate is the Open X-DOC: they receive a seed and open a chain of their own, in parallel to yours. If you expect their consent, the gate is the X-DOC for signature. Three expectations, three gates — and it is always the expectation that decides, never the type of paper.

Where a sealed X-DOC lands when it arrives

Every sealed X-DOC that arrives for you goes to the Sealed X-DOCs box, in the wallet's main list, next to your conversations.

Sealed X-DOCs6 received · 2 to settle Yesterday

the box in the wallet's main list

The sealed X-DOCs box opens straight onto the sheet. The other operations have an intermediate screen — the chain — because there is a choice to make: which version to read, or where to start your own. Here there is no fork: the request is to read, so the sheet is the destination.

A document that has arrived and is not yet settled shows a blinking red dot. It does not count how many: it says something is still owed. And it goes out by three routes — reading, skipping, or recording that you will not read it.

The light follows the registry, not your tap. You can read and decide offline as much as you like, but the discharge only enters the registry once the connection is back: until then the card reads "read · receipt on its way" and the light stays on. It is not asking twice — it is the difference between "I did my part" and "this is settled". When the network returns, the device dispatches on its own.

The document stays on your device, and the card shows who it came from, with the connection's name and picture. Removing it from your vault takes your copy off this device and nothing more: the sender still holds theirs, and the seal keeps verifying — nobody undoes a record in someone else's wallet.