The hard part of a model like ours isn't the first hundred trees — it's making sure the ten-millionth tree gets the same honest treatment. Here's what stays the same forever, what we have to redesign at every order of magnitude, and what we expect to break along the way.
The whole scaling argument rests on these. If any of them break under pressure, the thing we built isn't worth scaling. Each is written so a district lead in 2032 can hold us to it.
Every order-of-magnitude jump kills something that worked before. Naming the failure ahead of time is the only way to design for it. None of these are surprises — they're scheduled.
Scaling isn't one dial. It's four — each on its own clock, each with its own failure mode. We move People from founder-verified to federated-protocol. We move Tech from spreadsheet to satellite. We move Money from pocket-funded to audited utility. We move Trust from individual pages to an open registry. None of them can lag too far behind the others.
We never employ farmers. We slowly devolve verification authority from one person → small clusters → state-level peers → independent chapters → an open standard anyone can run.
Tech does the boring stuff — flag suspicious photos, cross-check canopy growth from space, generate planting briefs. Humans approve every decision that affects a farmer's payment.
The donor's ₹500 always goes 100% to the farmer. Ops are funded from a separate ledger — grants, opt-in tips, CSR — that grows on a different axis from the planting volume.
The platform is opaque to no one. Every tree, every payment, every refund is on a public page that doesn't require login to view. The audit is the brand.
The protocol is more important than the platform. If PlantTree.life-the-org dies, the registry, the standards, the farmer relationships, and the public pages all keep working — because no one part holds the whole. That's the only way an org promising twenty years of growth updates can credibly promise twenty years.