Heads Down

Your phone'snight shift.

Face-down, it digs ORE. Pick it up, the rig goes cold.

A focus timer whose tree is an ORE rig. Any Android.

The app's home screen on the Redmi 14C, with the rig cold — Home, on the Redmi 14C

The night

One approval at bedtime. The phone works the shift. Your alarm ends it.

1	Tap Clock in, in the app or on its Quick Settings tile.	On the Redmi
2	One wallet approval funds a capped shift in your own ORE Automation and arms the rig.	On mainnet
3	Face-down, the phone signs a heartbeat every ORE round, about a minute.	On mainnet
4	A dig happens only when the on-chain price gate is open.	On mainnet
5	Pick it up: 10 s of cooling, then cold. Unlock: cold at once.	On mainnet
6	In the morning the reveal page shows the shift. Clock out there, and it replays the night from chain data.	On the Redmi
7	One approval seals the shift. Take your SOL back whenever you like.	On mainnet

The home screen on the Redmi 14C with the rig armed: ember light under the slab, the word Armed, and Lay your phone face-down to start the shift — Armed, on the Redmi

The clock-out sheet on the Redmi 14C: the shift ended early, the rent of its log, 0.00193318 ORE in the Miner in gold, and the button Clock out — Clock-out, on the Redmi

From the Redmi 14C 10 Oct 2026, on mainnet: clock-in 4DvP…aQht, clock-out 3Vfb…uTUm, SOL back 46NX…DcFF: 0.00502704 SOL, to the lamport.

The habit hangs on three things people already do every night: bedtime, the charger and the alarm. If the OS kills the app, the rig goes cold and nothing is spent. On the tenth of October my Redmi did all of this on mainnet except the morning reveal: one approval in Jupiter's wallet, heartbeats signed by a key in the phone's secure hardware, five digs, a BREAK when I picked it up and unlocked it, a clock-out, and the SOL back. Two honest notes. On the phone I tapped Clock in inside the app; the tile's path has run on the emulator. And that evening the app did not hear that its first clock-in had landed, so I approved a second one; the app now finds a landed clock-in on-chain by itself. That repair has run on the emulator; on the phone the failure has not come back in the three clock-ins since. The digs ran under a price ceiling I raised for the demo.

Why you come back

A streak stored on-chain, two nights off a month, and a morning worth opening.

1

approval a shift

bedtime, the charger and the alarm are already habits

2

nights off every 30 days

one bad night does not end the streak; the program stores both

30M

downloads of Pokémon Sleep

its own tips teach the same posture: plugged in, face-down, all night

What brings you back: the reveal after your own alarm · a home-screen widget and a Quick Settings tile · every shift on the Nights screen · a share card with no wallet address.

So far One rig, the founder's. Ten shifts to 12 October. The first completed one: 41 minutes, 37 dark rounds, streak 0 to 1.

What is new

The referee is the phone's own hardware. Solana checks its signature in the same transaction as the dig.

The phone

Keystore key

P-256. It signs a heartbeat each ORE round and never leaves the phone.

Anyone

Crank

Carries the heartbeat to the chain. It cannot forge one.

Solana

secp256r1 precompile

Verifies the signature in the same transaction.

heads_down

Executor PDA

Signs only if this rig's key signed this round. It picks amount and squares.

ORE

deploy

From your own Automation. Your wallet funds it; ORE owns it.

No fresh heartbeat, no deploy.

171 program tests, 138 of them on a fork of live mainnet ORE

A dig, from the Redmi25nB…zovY

A pickup's BREAK63FZ…yqVb

A replayed heartbeat, refused4EJv…PUpM

Each rig is an ordinary ORE miner with its own Automation. The user sets the executor to our program's PDA. The program signs ORE's deploy only if, in the same transaction, the precompile verified this rig's key over a message bound to this program, this rig, this shift, this ORE round and a counter that must go up. A random signer can't deploy for your Automation; ORE checks executor equals signer. The crank decides only whether and when; the program computes amount and squares. The program is on mainnet at HDn4…7F9p and its Executor is By3v…Pkge. The three transactions on the slide are from my phone's first shift there: a dig, the BREAK the phone signed when I unlocked it, and the crank's own second attempt with the same heartbeat, which the program refused as stale. That last one was not staged. One key, mine, can still upgrade the program, and nobody outside has audited it.

SKR · the Focus Bond

Lock SKR on a shift. Finish, and the same SKR comes back. Nobody is paid when you fail.

	Who decides you failed	Who gets the money
Forfeit	the company: staff or AI review your proof	the company keeps it
Digital Detox	the app	its developer: “We only get paid if you decide to break your own rules”
Heads Down	the phone's secure hardware, checked by Solana	nobody: it is sold for ORE that is burned

On mainnet 12 October 2026, on the Redmi: 10 SKR locked at clock-in, the 41-minute window completed, the same 10 SKR back at clock-out.

Heads Down emits no SKR, pays nothing for holding it and keeps none. Also in the program, with no screen yet: Stack tables and Gift a Rig.

Plain about money

Mining is one route to ORE, not income. The rig digs only under a price ceiling, and the reveal shows the market price beside yours.

Effective SOL per ORE against always buying, by nightly budget: mining every round costs more at small budgets; gated 0.001 SOL deploys sit just under buying. — The backtest's figure, unchanged. 1.0 is always buying.

58,801 real ORE rounds, 47 nights	Against buying
Dig every round	+36% to +90%
Dig 0.001 SOL chunks when the gate opens, buy the rest	−1.4% to −3.0%

This rig 20 digs placed 0.02 SOL. The 19 settled sent 0.017 SOL back and mined 0.0019 ORE: about 1.13 SOL per ORE, on a small sample.

The demo A default build's ceiling (0.53) is under ORE's cost figure (0.85 on 12 October), so it does not dig. The filmed build plans 1.0 under a signed ceiling of 1.2. The backtest charged 5,000 lamports a dug round; mainnet charges 10,000.

ORE keeps about 10.5% of the SOL you deploy; that is what mined ORE costs. Fixed per-dig fees make tiny deploys expensive. So the program digs 0.001 SOL at a time on the split squares, only when a Motherlode-aware rule it computes on-chain says mining is the cheaper route. In the backtest the gate stayed shut all night on 30% of nights; those nights just buy. Two things I say out loud. First, the backtest charged 5,000 lamports a dug round and the program on mainnet charges 10,000; the backtest's own sensitivity is about one point per 1,000 lamports at this chunk size, so the small edge has to be measured again at the real fee before anyone quotes it. Second, today the gate is shut on a default build, so for the recorded demo I raised my own ceiling to 1.0 SOL per ORE and cut the budget to 0.005 SOL a shift and 0.035 SOL a week. This is not a money machine; the value is the ritual, the trustless gate and an honest choice of route. There is no revenue today: the planned source is a disclosed Jupiter fee on the buy leg the user signs, and the app does not offer that leg yet.

ORE

Other ORE miners place SOL from a wallet or a server. Heads Down digs only while this phone is face-down.

	On the Seeker store	Digs only while the phone is down	Who can place your SOL	Mine-or-buy, with a published backtest
ORE's own app	yes, and ore.com	no	ORE's own executor	not found
RefinORE AutoMiner	yes	no: “even with the app closed”	a server	not found
Orestack (was Minemore)	yes	no	a server	not found
Oreminer	yes	no	a server	not found
Heads Down	not yet: an APK	yes	a program, only for this phone's fresh heartbeat	yes

“Not found” means our review did not find it, not that it cannot exist.

Each rig is your own ORE Automation, and ORE can recompute our usage from its own DeployEvents.

Native Android

Native Kotlin and Compose, on system surfaces a web app cannot reach.

Quick Settings tile or the app, then one wallet approval (Mobile Wallet Adapter 2.2.0)
One clock-in transaction: ORE automate, register, caps, arm
Foreground service. Killed by the OS means cold, nothing spent
HyperOS keep-alive setup and a “killed last night” check
Android 16 Live Update notification, with a 14/15 fallback
Home-screen widgets, haptics, and a reveal aligned to your own alarm

1,440

JVM unit tests passed; 5 more are skipped

Redmi 14C

Android 16, HyperOS 3, accelerometer only. Since 10 Oct 2026: setup, a TEE rig key, attestation and ten shifts on mainnet.

On mainnet

Setup in the app: five steps, each ticked: Notifications, Morning alarm, Keep the shift alive, Quick Settings tile, Create your rig key; and the button Start using Heads Down — Setup: five real steps (emulator)

Only the launcher activity, the tile service and the two widget receivers are exported. The trampoline reads no intent extras. Release builds strip every android.util.Log call, backups are off, RPC is HTTPS-only and the crank uplink WSS-only. The app shows success only after the transaction is confirmed with no error. The phone is a Redmi 14C: accelerometer only, no gyroscope. On mainnet the wallet sends the clock-in itself, and twice the app did not hear that it had landed; it now writes down what it hands the wallet and arms the shift it prepared once the Rig shows it on-chain. That repair has run on the emulator; on the phone the failure has not come back in three clock-ins. The same evening Jupiter refused the sign-in token it had given the app the day before, and the wallet library reported that as a failed connection: the app now reads the wallet's real answer, drops a refused token and asks for one more tap.

Proof

On mainnet since 10 October 2026. Every shift, dig and lamport below is public.

Program deployed, slot 455,359,196	4naP…Pae2
Crank, registrar, indexer, dashboard	live, on Railway
Clock-in from the Redmi 14C, signed in Jupiter	4DvP…aQht
First dig, ORE round 435,224	25nB…zovY
The pickup, and the BREAK the phone signed	63FZ…yqVb
Clock-out	3Vfb…uTUm
SOL taken back: 0.00502704 SOL, what the screen said, to the lamport	46NX…DcFF
To 11 Oct: 5 more shifts, 15 digs in 15 rounds	0.0019 ORE mined
Night of 12 Oct: three hours, about 170 heartbeats, 5 digs	3Ngn…JJgf
12 Oct: shift completed, 37 dark rounds, 10 SKR back	BaiM…Lvdt

The live dashboard's overview, marked On-chain data, Solana mainnet: 1 rig, 0 Seeker-verified, 1 guest rig, 1 nightly active rig, 20 rounds dug — The live dashboard, 11 Oct 2026, 20:09 UTC. The rig is the founder's; 20 rounds dug over three evenings.

No vanity counts, no paid testers, no referral bounties. There are no users yet. Metrics come from on-chain rows only, and anyone can recompute them from the CSV exports. What exists today is checkable: the deploy transaction, the Config, the Executor, four services answering on mainnet, and one phone's shift, transaction by transaction. The shift was six rounds dark. The crank sent the first round's dig too late and it was skipped; the next five landed, 0.001 SOL each on four squares. None of the squares won, so no ORE came out, and each round sent back the 89.1% that ORE gives back for squares that lose. I picked the phone up, it signed a BREAK, I clocked out and took the SOL back, and the wallet received exactly what the screen had said. The digs ran under a ceiling I raised for the demo, with the budget cut to 0.005 SOL a shift. What that evening found, including a dig window that was too short and a clock-in the app did not hear about, is written down in docs/MAINNET.md with what was changed. The next day the phone worked four more short shifts: fifteen digs in fifteen rounds, and the rig's first ORE, 0.0019 of it, sitting unclaimed in its own Miner account. On that small sample it cost about 1.13 SOL per ORE: this is not a money machine, and the page says so.

Open, and next

What protects the user, what is still open, and what comes next.

What protects the user

The phone's key cannot leave its Keystore, and acts only inside limits the wallet signed
Success is shown only after the chain confirms it
Every key has a written worst case

Open today

One key, the founder's, can upgrade the program
No third-party audit; a debug-signed APK, not on the dApp Store
Not run on a Seeker; no screen sends the Seeker check yet
One user so far, the founder. The morning page did not open by itself on this phone.

The haul already on screen when the alarm rings
Nights that arm themselves: one approval a week
A night partner: two phones, one streak
A multisig, then an immutable v1; the dApp Store

github.com/OoJae/heads-down oojae.github.io/heads-down