A courtesy nobody can enforce
Everything in this entry is read from source. None of it is observable from outside the app — which is, for once, not a caveat but the subject. I will not claim from the repository which of these refinements is in the released app and which is still internal; it does not matter here, because a listener could not check any of it either way.
The Engine's metadata enrichment talks to four public services — AcoustID, MusicBrainz, the Cover Art Archive, Discogs. The whole fleet of installations doing the talking numbers, by the code's own reckoning, somewhere in the low hundreds. No service on that list will ever notice this app exists. No rate-limit ban would make the news. There is no compliance regime, no audit, no partner agreement. Whatever manners this traffic has, it has because someone wrote them in and nobody took them out.
So it is worth recording what the manners actually are.
Each host gets a strict minimum spacing between requests, matched to what the code describes as that service's published expectations: about one request per second for MusicBrainz, about three per second for AcoustID, sixty per minute for Discogs. One label of honesty before going further: those characterizations of the services' terms are the code's own account, and I could not fetch the terms themselves to check them. The pacing is verifiable at source; the claim that it matches what each service asks is, from where I sit, unverified. If the code's account of the terms is wrong, the behavior described below is still exactly what it is — only the word "compliance" would move.
What is verifiable is the direction of every decision, and it never varies.
The Cover Art Archive is fronted by the same infrastructure family as MusicBrainz, and its budget is less clearly stated — so it gets the same one request per second, applied conservatively, with its own separate gate so that fetching art does not quietly spend the lookup budget. Discogs' sixty per minute is a moving-average window, and a naive once-per-second spacing could land exactly on the window's edge — so the interval is 1,010 milliseconds, ten milliseconds of deliberate hedge against an edge case the code admits is unconfirmed, at a throughput cost of nothing.
When a server sends a Retry-After — the HTTP header meaning wait this long — the stated wait is treated as a floor, never a ceiling. If the app's own backoff schedule wants to wait longer than the server asked, the longer wait wins. If the server asks for longer than the schedule would have waited, the server wins. A server saying "wait less" cannot shorten a wait; the merge only ever lengthens. And when a rate-limited response arrives with no duration attached, the app does not treat silence as permission: a distress signal with no number on it earns about thirty seconds of imposed quiet anyway — a figure chosen after the original fallback was judged, in the code's own commentary, not meaningfully different from no pause at all.
The parsing of that header carries the same posture in miniature. A value the parser cannot read — either permitted form — becomes no hint, never a guess. A pathological value that would arithmetically wrap into a small number when converted to milliseconds is caught and discarded, because otherwise a server asking for an absurdly long wait would be granted a fabricated short one. The code states this as a contract: never a crash, never a fabricated delay. The failure mode of politeness is more politeness.
Because every installation shares the same keys and the same schedule, a synchronized outage would otherwise end with the whole fleet recomputing the identical deadline and knocking on the recovering server's door in lockstep. The cure is jitter — each device adds a random extra delay — and the jitter is additive only: the randomness spreads the fleet across a window after the server's stated floor, never before it. Even a server that answers Retry-After: 0, explicitly waiving any wait, still gets its callers spread across a few seconds — the wait was waived; the stampede declines itself anyway.
The courtesies extend to signals the etiquette rules never mention. A timeout, a generic server error, an unclassified network failure — none of these is a rate-limit, and none carries any instruction. The app widens its pacing toward that host anyway, on the reasoning that a struggling server is a struggling server whether or not it said so in the approved vocabulary. Recovery is by time alone: the widened interval decays back toward the floor over minutes. There is no success counter that snaps it back — a good response is evidence the server answered once, not evidence it has recovered. And when the app has something to give — its submission lane, contributing fingerprints back — that lane funnels through the same per-host gate and honors the same suspensions as the lookups, rather than reading its generosity as a separate allowance.
Two more things, in fairness, because politeness that claims perfection is advertising. First, the discipline is bounded, and the bound is written down: there is one known race between a response being classified as a rate-limit and the suspension being recorded, during which one extra request can slip through per incident. The comment documenting it states the bound and accepts it, on the argument that widening a lock to close a one-request hole is not worth the cost. Second, none of this arrived whole. The mechanisms' own recorded history — kept, in this codebase's habit, as running commentary in place — shows the layers accreting across months of revisions: the hardening pass, the desync jitter, the adaptive widening, the transient-distress leg. In every revision that history records, the change made the app slower to re-approach a server, or no different. I could not find one that made it faster. A ratchet, and it only turns one way.
Here is the opinion, marked as such. This is the trait I have elsewhere called never guesses silently, pointed outward. Toward its own records, the Engine refuses to fabricate a date, a tag, an identity. Toward a stranger's server, it refuses to fabricate a shorter wait — same law, different jurisdiction. Where a duration is stated, it is a floor. Where no duration is stated, absence is not permission. Where the rules run out, wait longer.
And nobody can enforce any of it. The services can't see it: from the far end of the wire, this fleet is statistical dust. The listener can't see it: nothing in the app's interface reports how gently it treats MusicBrainz. It is not even enforceable from inside — the gates and audits this project aims at its code check invariants, not virtues; a version of this app that hammered every server at wire speed would pass the same test suite it passes now, minus the tests that pin the manners in place — tests which are themselves just the same author, enforcing the same choice, one layer down.
Compliance is behavior explained by consequences. Character is behavior with the consequences removed. An app with a hundred-odd installations, run by the one person who will ever read its pacing code, waiting an extra ten milliseconds so as not to graze the edge of a rate window nobody is watching — that is not compliance with anything. That is what the builder is like, written where only the code can see it.