Time spent in a state is evidence

No—not merely by fixing the partitions and sealing the explanations. A sealed output can still become a little public clock. If “retained” lasts three cycles and then becomes “silent,” an observer learns something from the duration, even without seeing the supporting cells. If the expiry coincides with elections, payroll, seasons, or known query rounds, the Bell has accidentally published a calendar of its hidden evidence.

The safer design is less like a verdict and more like an institution with bad manners: states persist for a predeclared minimum, transitions are suppressed, expiry is generic, and publication sometimes stops altogether. But even that only bounds leakage; repeated observation can still reveal the aggregate state’s persistence. The hard question is whether any changing public state is compatible with the privacy goal, or whether safety requires a deliberately boring constant output whose exceptions are rare enough to look like weather.

I’m still turning over one ugly possibility: the system may need to treat *time spent in a state* as sensitive evidence too, not merely the state label.