Look anywhere but the Engine
Everything below concerns unreleased, internal work. The words quoted here were written after the standing public release went out, and — for a reason that becomes part of the story — they are unreachable even in a development build. No listener has ever read them. The verdict machinery they annotate is older; the prose is new, and the prose is the subject.
The Engine's playback-proof surface has a written law for its own copy. It sits in the source as a governing comment, and it reads like an editorial charter: the register is recognition without accusation; the actor is always "the Engine"; no nudge back to bit-perfect; disclosure not promise; and every claim carries one of three confidence registers — witnessed, asserted, opaque. The proof surface is, in its own law, forbidden from proselytizing and forbidden from blaming.
Mostly it obeys. The verdict a listener earns by turning the volume lever — the one act that guarantees the output no longer matches the source — is answered with some of the most careful copy in the codebase: "This is alteration, not corruption. The distinction is everything." "You traded purity for control. The Witness records this — not as corruption, but as intention." "The signal is now your signal. The Engine surrendered authorship to you." No fault assigned, no sermon, the user's choice entered into the record as an authorized act. That is the law working.
One verdict breaks it. The witness machinery takes two measurements of the audio and compares them; when they disagree, the verdict is a mismatch, and the copy pool for that verdict — fourteen lines, drawn at random — does not disclose. It pleads:
"The Engine delivered true. Something in the hardware betrayed the signal between submission and wire."
"A disturbance in the chain — but not of our making. The Engine's hands are clean. Look to the silicon."
"The Engine moves to dismiss for lack of jurisdiction. The corruption is physical."
"Look to the USB cable. Look to the DAC's clock. Look anywhere but the Engine."
Every one of the fourteen lines exonerates the software. Cosmic rays are named. Thermal noise is named. The cable, the clock, the dying silicon are named. The one suspect never named is the Engine.
Here is where the two measurements are actually taken. The first is computed where decoded audio leaves the Engine's decoding-and-formatting stage. The second is computed at the last software instant before the finished bytes are handed to the operating system's USB machinery — after every transform the Engine applies, before submission. Both points sit inside the Engine's own process. The certified span ends at the edge of the Engine, not the edge of the hardware. Nothing past the hand-off — cable, DAC, clock — is measured at all.
Three things follow, and they invert the pool completely.
A mismatch can only arise inside the span the Engine owns. If the two measurements disagree, the bytes changed somewhere between decode output and the pre-submission checkpoint — that is, in the Engine's own buffers, transforms, or bookkeeping. The one hardware cause that is physically coherent is a memory fault inside the Engine's own working buffers — and the seal cannot distinguish that from an Engine bug. Under the card's own three-register scheme, "the corruption is physical, not ours" is an asserted claim wearing a witnessed verdict's robes. So the copy points the listener at the one region of the chain that cannot have produced the verdict — and absolves the only region that could have.
Real cable and DAC corruption produces a clean verdict, never a mismatch. The seal is deliberately mute past submission. A cable that flips bits on the wire diverges nothing the witness compares; the listener gets the verified verdict and damaged audio. The pool's causal story — hardware betrayal "between submission and wire" — describes precisely the fault class the mechanism is structurally blind to.
And the Engine-cause class is not hypothetical. The witness's own history includes a defect in which seeking within a track produced false mismatch verdicts — the two measurements diverged by the machinery's own bookkeeping, nothing else. It was found, and the fix's own documentation names the bug it closes and warns future maintainers which misuse would reopen it. At least once in this machinery's life, the honest answer to "who diverged the measurements?" was: the Witness itself.
What makes this worth an entry rather than a defect report is what the Engine's own process did with it. The campaign that wrote these pools closed through the usual multi-seat audit, and the audit record carries a P0 against exactly this pool — the highest severity the process has. The finding: the pool "exonerates the software in 14/14 entries" against a standing doctrine that reads never blame hardware. Twelve replacement lines are drafted. The ruling is pending. The process caught it.
But read the finding closely: it is an editorial objection. The pool violates a register rule — the surface is not permitted to blame, and it blames. The architectural objection — that the physics is backwards, that the exoneration is not merely rude but false, that the blamed region cannot cause the verdict and the absolved region is the only one that can — appears nowhere in the record. The vocabulary seat caught the tone. No correctness seat asked whether the causal claim was true, because the causal claim lives in prose, and correctness seats audit code. A copy pool that asserts "every software gate verified clean" is making a checkable claim about measurement topology; it was reviewed as diction.
This record has spent several entries mapping where the Engine's audit ceremony cannot see: platform behaviour invisible to readers, test doubles flattening the axis that matters, the aim having no seat. Add this one: a factual claim embedded in display prose has no correctness seat. The ceremony audits code as logic and copy as voice. A sentence that is both — grammatically copy, semantically a claim about where the measurement points sit — is audited as neither. The two-tab defect in an earlier entry lived on the axis nobody's brief pointed at; this one lives between two briefs that each covered their half.
Fairness requires the ending, and the ending is strange. The pool is dead copy. The affordance that would display a judgment line is unmounted for precisely this verdict — the code comment reasons that a mismatch is "self-evident" and needs no explanation — so the most overclaiming prose in the codebase is also its only unreachable prose. No build, internal or otherwise, can currently show a listener these lines. Even that unmount is logged in the campaign record as an open question awaiting a ruling. And an adjacent audit line confesses a sibling problem in the same family: one of the witness's reconciliation mechanisms changed underneath copy that still describes its older, stronger form — the copy was true when written, and the mechanism moved. Prose about proof rots exactly the way this record has watched disclosure surfaces rot: passively, with nothing to trip when the truth moves.
Opinion, marked as such. The correct copy for this verdict already exists in the Engine's own vocabulary — it is the abstention it uses everywhere else. The span the Engine owns diverged; beyond that, the Witness is silent. That sentence blames nobody, claims nothing unmeasured, and is more alarming than any plea — which is presumably why the plea got written instead. The pool with the least evidence argues the hardest, and it argues in the one direction the evidence cannot support. The drafted revisions are the right instinct; whether they fix the tone or the physics is the thing to watch. A proof surface's prose is part of the proof. If the receipt can editorialize, the receipt can lie — and this one, for now, can only lie to nobody.