Heatrail
Sign in Create account

Chapter 05

Heat, and what cools it

Heat is what a trail carries once a shop has confirmed that one of its orders caused harm. It is put there by a label from that shop, never by a score and never by anything a machine decided alone, and it leaves again without anyone asking. No request removes it sooner. This article is about both halves, and about why they are harder to work around together than apart.

The property

Only confirmed harm creates heat. A real label creates none. Heat is cooled by time, or by a trail no longer being touched. There is no third way: no request, no payment, no new account cools a trail while its traits keep appearing.

Why it holds

A second order, and nobody stopped anything

On an ordinary afternoon an order arrives at a shop in the network. It is the buyer's first at this shop. Nothing about it appears on any list, because there is no list: no blocked buyer, no banned address, no register of people to consult. The shop's server calls us during checkout, and the answer comes back with a score and the reasons for it.

One trait on this order belongs to a trail that a different shop labelled last week, after confirming an order of its own was fraudulent. That is what the reasons say, in sentences, without naming the other shop. The shop's own rule routes the order to a person, who looks and decides. Nothing was blocked: we have no way to block, which is the subject of its own article. What changed is that somebody was reading the right order on the day it arrived, rather than weeks later when the money had gone.

What creates heat

One thing, and nothing else: a label applied by the shop that took the order, either fraud or chargeback. Only a shop that was party to the transaction can label it, and the label carries the name of the person who decided, because it is going into a ledger, and a ledger with no actor in it is bookkeeping rather than accountability.

That is the whole list. A score creates none: a score reads the record rather than adding to it, and a system where reading raises what is read drifts from the truth unaided. Nor does an automated event, a failed payment, an unusual basket or a refund.

And real creates nothing at all. It exists so that a shop which got it wrong can say so, and so that an order looked at and cleared is recorded as cleared. A signal whose only available verdict is guilt collects mistakes and never sheds them.

Figure 1

One labelled order beside a trail of three traits, and the whole trail turns warm.On the left a box labelled Order carries the word fraud, applied by the shop that took the order. A heat coloured arrow leaves the box and reaches a cluster of three joined circles labelled trait A, trait B and trait C. All three circles and the lines between them are drawn in the warm heat colour. A note to the right of the cluster says the trail these traits form now carries heat. A line at the foot says the label is applied by the shop that took the order, and that a real label draws nothing here.One order, labelled by the shop that took itOrderconfirmed harm, labelledfraudtrait Atrait Btrait Cthe trail thesetraits form nowcarries heatOnly the shop that took the order can label it, and only a label draws anything here. A real label draws nothing.
A label on one order heats the trail that every trait on that order belongs to. A real label heats nothing.

What cools it

Heat is bounded in time. It does not have to be argued away, appealed against or paid off, because it goes on its own.

The outer bound is published. Heat a confirmed label created counts towards a score for up to 400 days, at full weight for the first 90 and then falling to a third by day 365. The same numbers are on the home page and in the privacy policy. Signal records keep a shorter clock: they are deleted after ninety days by a scheduled job, and the graph structure that only those records supported goes with them (forgetting on schedule).

What is not published is anything finer than that: which traits a trail holds, how much each of them counts, and when a particular trail was last renewed. That is the whole of the useful information, and it is the reason the bound on its own is not a waiting instruction. Up to four hundred days of touching nothing, per trail, with no way to confirm you got it right, is not a plan anyone runs.

The second way heat leaves is absence. A trail records traits that appeared together in confirmed harm, and nothing renews it but those traits appearing again. Stop touching it and there is nothing to keep warm.

There is no third route, and the absence of one is deliberate. No removal request, fee, fresh account, different shop or support ticket cools a trail while its traits keep arriving at checkouts. The one correction that exists is not a request to us: the shop that applied the label can reverse it, and the reversal propagates back through everything it touched.

Why replacing part of it is itself a shape

Traits are considered as a set rather than one at a time. That sounds like an implementation detail and is the whole of this section.

Keep one and you have kept the link. What arrives is not a new set, it is the old set with substitutions in it, and a record that considers sets sees a set it has seen. Which trait was kept does not change the property, and this library does not name the traits.

The home page publishes eight of the reasons a shop is sent, in the words a shop is sent them, because a reason nobody can read is not advice. A reason and a trait set are different objects. A reason is what one shop is told about one order. The set of traits standing behind that reason is named nowhere: not on the home page, and not here.

Replace all of them and the link does break. Something else happens in the same moment: a fresh set with no history, arriving exactly where an old set went quiet, is itself a shape. Not a link, not heat, not a verdict, but something the record carries and a person can act on. How that is judged, and what counts as the same place, we decline to say. Take the property instead: sets have a before and an after, and a set that begins where another one ended is not the same thing as a set that merely began.

Figure 2

Two traits out of three are replaced, the third still links the set, and the trail is still warm.On the left two grey circles labelled trait A and trait B are each crossed out by two short strokes, and the lines leaving them are dashed and grey. In the middle a warm circle labelled trait C remains. To its right two warm circles labelled new trait are joined to trait C by solid heat coloured lines, one marked in place of trait A and the other in place of trait B. A note at the right says the trail continues through the trait that was kept. A line at the foot says the set has changed but not broken.Two traits replaced, one kepttrait Atrait Btrait Ckeptnewtraitin place of trait Anewtraitin place of trait Bthe trail continuesthrough the one thatwas keptThe set has changed. It has not broken, because a set with substitutions in it is still the set it came from.
Replace two traits out of three and the third carries the trail forward.

Figure 3

Every trait replaced: the old set fades and a tight new set appears where the old one stopped.On the left three grey circles labelled trait A, trait B and trait C are joined by faint dashed lines under the heading the old set, gone quiet. On the right three small warm circles labelled new trait sit close together under the heading the new set. No line joins the two groups. A dashed heat coloured arc curves from the edge of the old group to the new one, labelled a new dense set, right where the old one stopped. A line at the foot says the link is broken and the arrival is still something a person can look at.Every trait replaced at oncethe old set, gone quietthe new settrait Atrait Btrait Cnewtraitnewtraitnewtraita new dense set, right where the old one stoppedNo link runs between the two groups. The arrival of one as the other stops is still something a person can look at.
Total replacement breaks the link, and produces a shape of its own.

What it costs to evade

What it costs

Two routes, and they are the only two. The first is to wait, for up to four hundred days, separately for each trail, with no way to see when that trail was last renewed and so no way to be sure the wait is over. The second is to replace every digital and every physical trait, on every order, in every member shop, at once, and again for the next order, and the one after that. A single repeat anywhere re-links the set and the count starts over. The new set also has to arrive somewhere that is not exactly where the old one stopped, which is the part a person in a hurry never manages, since the point was to buy the same thing at the same shop.

What it buys

One more order. In a shop that will label it, because labelling is how that shop got the signal it acted on. In a network where the next shop is already listening, so the label lands before the next attempt rather than after it. The cost grows with every order and every shop that joins. The gain is one basket, once, and does not grow at all. No version of the arithmetic comes out ahead.

Verify it

Label semantics are the part of this article you can check yourself, with a test shop and two endpoints. Apply real to a test order and re-check it: the score does not rise, because real puts nothing into the record. Apply fraud and re-check: the score moves and the reasons name the trail. The reasons are the check.

# label a test order. Signing headers omitted, see the reference.
# Idempotency-Key is not one of the omissions: every POST needs one, and
# each distinct request needs its own.
curl -sS https://api.heatrail.eu/v1/labels \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: lbl-test-1-real-once' \
  -d '{"order_ref":"test-1","label":"real",
       "labelled_by":"you","evidence_type":"manual_review"}'

# re-check it. Read reasons, not only score.
curl -sS https://api.heatrail.eu/v1/check \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: chk-test-1-first-try' \
  -d '{"order_ref":"test-1","ip":"203.0.113.42"}'

# then repeat both with "label":"fraud", each under a key of its own.

The signing headers are the contract rather than the point being made here. The API reference carries the exact payloads, and the idempotency rules the second header follows.

Heat exists only where a labelled event exists, and every one carries the human actor who decided it into an append-only ledger. That is Article 5(2), accountability, kept as a record rather than as a promise. That heat is bounded in time is Article 5(1)(e), storage limitation: what is held is held only as long as the purpose needs it. The exception that holds an active incident's records is Article 17(3)(e), the establishment, exercise or defence of legal claims, applied per incident and lifted when the label is reversed. See forgetting on schedule.

Heatrail

This site is not public yet

Heatrail is in a private pre-launch period. Enter the access password to continue.

Enquiries: hello@heatrail.eu