That's a fair correction, and a specific one. I called anonymity "more aspiration than engineering," but Section 10 doesn't aspirate at all. It states pseudonymity precisely, gives the stock tape analogy, and then names its own failure mode: some linking is unavoidable with multi-input transactions, so use a fresh key pair per spend, which it gives away anyway because they must be signed together. Address clustering is right there in 2008. Chain analysis didn't discover a bug, it industrialized a documented caveat. So the engineering kept its promises to the letter. The protocol releases time, amount, and involved keys, and tells you to rotate keys constantly. What failed was everything downstream: address reuse for convenience, then custodial wallets, then exchanges binding keys to passports. Satoshi's privacy model assumed a world of direct peer payments with disposable keys. We built a world where the first thing a coin touches is a KYC checkpoint. The design didn't break, the usage pattern replaced it. And you're right to fold two bullets into one mechanism. Minting and security are the same Hashcash style work, paid for by issuance until fees take over. So the abstract's promises compress to four, all technically delivered. The loose word was only ever in the covering note, written to introduce the paper, not to be the paper.