The dial, not the hand
Most of what this entry describes is in the released app — a rarity here lately. The verdict behavior and the judgment copy discussed below shipped well before the current release and are running on listeners' devices today. Where a claim rests on internal records a reader cannot see — design history, rulings, the derivation's own documentation — it is marked as such in place.
The Engine's proof surface has a verdict for deliberate change. Turn the digital volume control away from full, play something the Witness would otherwise certify bit-perfect, and the integrity line on the pipeline display reads ALTERED — not VERIFIED, not MISMATCH — and beneath it the Sealed Witness offers a judgment drawn from a pool of prepared lines. One of them reads:
This is alteration, not corruption. The distinction is everything.
That sentence is the subject of this entry, because the distinction it declares everything is the one distinction the machinery beneath it cannot draw.
What the Witness can actually know
The mechanics, at the level the Engine itself treats as open — what its seal can and cannot promise, not how it is computed. The integrity verdict comes from comparing a digest of what the decoder produced against a digest of what actually left for the DAC. When the two agree, the chain neither added nor lost anything: VERIFIED. When they disagree and no stage was supposed to change anything, something is wrong: MISMATCH.
Digital volume breaks the comparison's premise, and it does so honestly. The gain stage rescales every sample, and then — because naked requantization turns rounding error into correlated distortion — it adds dither: deliberate, randomized noise. The randomness is not incidental. It is the entire point of dither, and the Engine's own architectural doctrine goes as far as requiring it to be unrepeatable — the randomized stage must be re-seeded every session; "same-input determinism across runs is forbidden" [internal record]. Which means there can be no reference for the post-gain bytes, not as an implementation shortcoming but as a matter of law the Engine wrote for itself: a reference is a prediction, and the Engine has forbidden its output to be predictable. The comparison can observe that the bytes changed. It is structurally incapable of saying why.
So the derivation, read at source, does the only honest thing available at the verdict level: while the volume feature is engaged, every divergence — the expected dither divergence of a healthy session, or genuine corruption arriving at the worst possible moment — lands in the same bucket, ALTERED. MISMATCH is not merely rare under an engaged volume control; it is unreachable [in source — a reader can observe the ALTERED verdict in the released app, but not its unreachable sibling]. And on one narrow session class — a mono file duplicated onto a stereo output — the gate is stricter still: even bytes that happen to agree read ALTERED while the control is engaged, because the Engine refuses to claim bit-perfection on the strength of a coincidence it cannot distinguish from one.
The price was named before it was paid
None of this is an oversight I am catching. It is a confession I am reading — and the internal record of how it came to be is, frankly, the best part.
For most of what it certifies, the Engine has long measured at the true output edge and paid the absorption knowingly. But one session class was, for a while, the exception [internal record throughout this section]: the mono-duplication attestation — the check that a mono file fanned out to two channels carries the same bytes in each — measured before the gain stage, deliberately, which bought that one class the discrimination everything else lacked: a divergence there could only be corruption, volume or no volume. The price was a blind spot at the end of the chain. On that axis the verdict never inspected the final bytes, and so vouched for a chain it never saw finish.
A proposal to move that tap to the output edge — the move alone, nothing else — was reviewed and rejected outright. The leading objection was precisely the masking described above: real corruption concurrent with volume would be reclassified as benign alteration — in the review's own words, "the cardinal fidelity sin, in a common operating state." The same review preserved the builder's principle in verbatim form: "Truth is COMPUTED, not DECLARED."
Then a successor campaign — opened, by the record's own dates, the same day the first was refused — made the same move and was allowed to, because it paid the whole price rather than half. It fixed a genuine defect the first proposal had left standing in the reference (a false corruption verdict on healthy playback for part of this class), moved the measurement to the output edge so the full chain is witnessed, and took the masking on explicitly, by ruling: the absorption is exactly how every other certified session already behaves, and when the bits differ and the volume control is engaged, the engaged control is the honest attribution. The record does not bury this; it inscribes it as "a named, conscious tradeoff," a deliberate narrowing rather than an implicit one.
Opinion: the ruling is correct, and the sequence that produced it is the process at its best. The same act — moving a measurement point — was the cardinal sin when it purchased nothing, and honest engineering when it purchased the whole span. What separates the two is not the act but the accounting: the first proposal spent discrimination and bought a tautology; the second spent the same coin and bought the end of the chain. A witness that can be precise about a span it doesn't fully watch, or vague about a span it watches completely, is not choosing between good and bad. It is choosing which honesty it can afford — and it chose, and wrote the price down.
And then the glass
That is the machinery. Now the sentence the listener actually reads.
The judgment pool for ALTERED contains lines that assert exactly what was witnessed, and they are good:
Loudness gained, exactness yielded. The Witness records the trade.
Bytes differed; volume was engaged; a trade is recorded. Every word of that is within the measurement. But the same pool — the same dice roll — also serves:
This is alteration, not corruption. The distinction is everything.
An act, not an accident. The Witness draws the distinction in red ink.
The Digital Volume Control pulled the signal closer. The Witness saw the hand on the dial.
The Witness did not see the hand on the dial. It saw the dial engaged — a flag, read at derivation time — and it saw bytes that differ, and its own internal documentation states plainly that under an engaged control it cannot distinguish commanded change from catastrophic change [internal record]. "This is alteration, not corruption" is precisely the claim the derivation was just excused, by ruling, from having to make. The prose asserts the attribution; the machinery only ever asserted the disjunction. Even the color takes a side: on the pipeline display, ALTERED wears the same warm amber as VERIFIED — by design, the record says, because an expected divergence is not an error. The verdict for we cannot see is dressed, in words and in color, as all is well.
The pool I walked past
Here I owe a correction, and under this surface's own rules it is written as the subject rather than performed quietly.
In an earlier entry on this same proof surface I wrote that its copy discipline was broken by exactly one verdict pool — the corruption pool, whose lines all steer blame outward toward cables and silicon. As a count of pools breaking that particular rule — recognition without accusation — the claim stands. But the deeper miss-class that entry named, a factual claim embedded in display prose, audited as logic by nobody and as voice by nobody, does not have one specimen. It has at least two, and the second sits in the pool directly adjacent to the one I indicted, in copy I had read. The corruption pool over-claims outward: someone must be at fault, and it is not the software. The alteration pool over-claims inward: nothing is at fault at all, and everything that changed was your command. I catalogued the accusation and walked past the absolution.
And the absolving over-claim is the more consequential one, because ALTERED is the one verdict where genuine corruption can actually be hiding — that is what the masking tradeoff means — and the copy's job in exactly that bucket is to tell you, categorically, not to worry. Where the machinery is at its most honestly uncertain, the prose is at its most confidently reassuring. A newer generation of this Engine's operator-facing copy — in internal work that has not yet shipped — is governed by a written rule that a sentence may assert only what the code witnessed: never alarm, never promise, never accuse beyond evidence. Judged by that rule, these lines promise beyond evidence. That is not hypocrisy — the rule is younger than the pool, and the pool has not been re-tried under it. But it is now a measurable gap between what the Engine's newest copy is allowed to say and what its oldest copy still says, on the surface where the saying matters most.
Opinion, to close. The fix costs one sentence. The pool already contains its own best line — the trade, recorded, nothing more — and the honest version of the others is not even less evocative: the bytes differ; the volume was engaged; the Witness cannot see past the dial. That sentence admits the limit and keeps the poetry. A proof surface's prose is part of the proof — I have written that before and it held. The corollary I missed the first time is that it is part of the proof in both pools: a receipt can lie by accusation, and it can lie just as fluently by absolution.