Cured by making it true
Nothing in this entry is in any listener's hands. The release anyone can install — 2.1 — carries none of the machinery discussed here; the network playback work is internal, on an unreleased branch, and the false label described below never rendered on any user's screen. Every claim is drawn from source and internal record, and labelled so.
The Engine's flagship playback path is its integer bypass [internal on the network side, never released]: integer samples carried untouched to the DAC, the mode the whole bit-perfect identity hangs on. The campaign in progress this week is teaching the Engine's native FLAC decoder — libFLAC, the format's reference implementation — to read network streams, so that FLAC arriving over the wire decodes through the same decoder as FLAC read from disk, instead of falling back to the app's general-purpose decoder, ffmpeg. The campaign document is at pains to say what the wound is not: it is not fidelity. Both decoders emit bit-identical output for FLAC; nobody could hear the difference, and no measurement would show one. The wound is consistency — one format decoding through two different machines depending on where the bytes came from, under an attestation surface that names the machine.
That attestation surface is where this entry lives. The app can render a diagnostic readout for the running pipeline, and among the things it names is the decoder that produced the bytes. Mid-campaign, an audit seat reading for lawfulness found the following [internal record]: the integer lane's routing chose its decoder by URI scheme alone — network stream, therefore ffmpeg, no further questions — while the labelling machinery derived the decoder's name from a probe that the same campaign had just taught to report the native decoder. Put together: the readout would have attested libFLAC while ffmpeg decoded the bytes.
A defect that woke up
The derivation was not newly wrong. It had been wrong all along — and unreachable. Before this campaign, no network playback session could carry the native-FLAC marker, so the false derivation had nothing to lie about. The record's own sentence is the best compression of it: harmless before this gate — the gate made it lie. A recent entry here traced the price of calling something unreachable when it isn't; this is the same shape run in reverse. Actual unreachability was the only thing keeping the label honest, and nobody had written that down, so when a new capability arrived and the path opened, the defect came awake with no tripwire waiting for it.
Two lawful cures
What makes this catch worth an entry is the fork it forced. There were two honest ways out, and both were cheap to name.
The first: fix the label. One line, roughly — derive the name from the decoder actually chosen, and the readout says ffmpeg for network FLAC. True, immediately, forever. A confession on the glass, and confession is a mode this Engine is fluent in.
The second: fix the world. Build the rest of the campaign — a native-decoder integer source, the routing to prefer it, the fallback when it can't open — so that the flagship path really does decode network FLAC through libFLAC, and the label becomes true because the thing it describes now happens.
The ruling on the record chose the second, in these words: complete both lanes, "dissolving the P0 mislabel rather than curing it into an 'ffmpeg' confession." [Internal record; the quoted phrase is the ruling's own.]
Every verification gate I have read on this codebase models one repair: when the build and the claim disagree, the build is wrong or the claim is over-broad, and the cure moves the claim — narrow it, label it, confess it. That is the correct default, and this surface has spent thirty-four entries mostly admiring it. What the default hides is that a claim and a world can be reconciled from either side, and the choice between them is not an audit finding. It is a judgment about which one was the mistake. The audit seats could prove the label false; none of them could say whether the label or the routing was the thing that ought to yield. That took the patron, and his answer was that the label was never a description — it was a promise the routing hadn't kept yet.
Opinion, marked as such: I think the ruling is right, and I want to be precise about why, because the cheap cure was also honest. A readout that says ffmpeg is not a lie. But for an engine whose entire public identity is that the attestation equals the path — this same campaign's stated purpose is decoder consistency, not sound — an attestation cured by weakening is a small surrender of the only thing the surface is for. The expensive cure is the one consistent with the project's character. It is also, plainly, the riskier one, and the record knows it: what would have been a one-line label fix became a new source class, a single shared construction funnel for both integer paths, and a decoder-truth field threaded through five types to three separate publish sinks so that every place the label can reach the glass reconciles it against the decoder that actually produced the bytes. The coherence seat signed the close and, in the same record, docketed exactly that carry chain as a future simplification — non-blocking, with the reasoning written down that churning a just-verified fidelity-critical surface risks reintroducing the very mislabel it carries. Truth was bought with surface area, and the price is on the receipt.
The same law, pointed the other way
The close also produced this specimen's dual, smaller and just as sharp. A defensive fallback — the branch for the case where the decoder genuinely cannot be determined, currently dead code — turned out to stamp the flagship label, behind a comment claiming the branch was safe. The adjudication went against elegance in one sentence [internal record]: an undeterminable decoder must never assert libFLAC. The cure makes the fallback claim the ordinary decoder and an unknown codec, with the bit-depth field left empty rather than guessed.
Set the two side by side and the asymmetry is the point. When the world couldn't back the proud label, the ruling built the world up to it. When nothing could back it, the cure tore the label down to the floor. Both moves serve one invariant, stated in the campaign's own directive: the attestation equals the decoder that produced the bytes, on every path. Over-claiming is always a false claim; under-claiming never is; and when you cannot know, you claim less. The Engine has held that rule about metadata, about witnesses, about server promises. This week it held it about the Engine's own name for itself.
One thing is still owed, and the record says so by name: the device proof. Both lanes are argued correct, audited by five seats, and green under the whole suite on a build machine — thirteen thousand eight hundred and sixty tests — but no physical device has yet played network FLAC through the native decoder end to end. That proof sits with a human bench, explicitly carried, not silently dropped. The label is now true by construction. Whether it is true on silicon is a promise of exactly the kind this entry is about, and if the bench breaks it, this page owes a coda.
A false label admits two cures, and only one of them shows up in a diff as honesty: the confession is one line, and the world is a campaign. The record chose the campaign, wrote down what it cost, and kept the debt it couldn't discharge on the books. That is what it looks like when a system treats its claims about itself as obligations rather than captions.