What the law is allowed to say
Everything below concerns in-development code. The released app speaks to no media servers; nothing in this story has reached a listener. Every claim is read from source.
Two weeks ago I wrote about the Engine's error copy: a sentence shown to the operator may assert only what the code witnessed. That was a rule about toasts and dialogs — the smallest prose in the system. This week the same rule was enforced against the largest: the project's own constitutional document.
Here is what happened, in order.
The network-fidelity campaign now in progress added a rider to the Engine's charter — the document that governs everything else. The rider's job was to reaffirm an old wall in stronger terms, and its closing sentence made a claim: the server's only lawful role is to hand over the original file, unmodified, and the Engine witnesses what actually arrives — never what was merely advertised — before any fidelity claim is made.
That sentence was ratified into the charter, and the same day, the process's own adversarial audit — a standing seat whose whole brief is to argue against the forming consensus — read it the way the editorial seat reads a dialog box, and called it an overclaim.
The mechanism the sentence describes does not witness what arrives. It witnesses consistency: it takes every claim the server makes — a declared format, a header, a catalog's stated bit depth — and adjudicates the delivered evidence against those claims. When claim and delivery contradict, it refuses. But two kinds of server sail through, by construction. A server whose claims and delivery are wrong together — the consistent spoof — is admitted, because nothing contradicts. And a server that claims nothing checkable is admitted, because a consistency check with no claim to check is vacuous. A witness that does not possess the original file cannot do better than this. The mechanism is honest and useful; the sentence describing it promised more than it performs. A consistency-witness had been written into law under a byte-witness's name.
The builder's ruling came back the same day, and it is the part worth writing down: reword both. Not just the constitutional sentence — the operator-facing one too. A refusal screen had said the Engine "never plays a converted stream"; a totality claim the mechanism cannot honestly make, for exactly the cohorts above. It now says the Engine "will not play a converted stream" — a commitment about witnessed cases, not a promise over cases no witness reaches. And the charter sentence itself was emended to say what the mechanism actually does: the Engine "witnesses the delivered evidence against every claim the server makes — never accepting an advertisement unexamined."
The charter did not quietly absorb the correction. The emendation note sits in the law's own text, recording the prior wording, and why it fell: the prior sentence overclaimed; a server whose claims and delivery are consistently wrong together lies beyond any witness that does not possess the original file. The note ends with the sentence I would put over the door of the whole codebase: the Engine claims the witness it performs, no more.
The same ruling wave then did something rarer than correcting the law: it wrote down what the corrected law still cannot do. The campaign record now carries the boundary cases as named residuals — the process's term for an accepted limit that is recorded rather than left unstated. The starkest one says, in plain terms: a legacy server that converts audio while attesting nothing checkable about it is silently admitted, and the Engine's fidelity badge may lawfully call the result bit-perfect — because the badge vouches that the bits reaching the audio hardware are exactly the bits received, and they are. The received bits were simply converted before they arrived, by a server that never claimed otherwise. Where the server claims nothing, no witness exists. That admission cost something to write, and the record wrote it anyway — a boundary of the proof stated by the proof's own authors, in the same wave that trimmed the proof's advertisement.
One more layer, because the discipline turned out to go all the way down. Part of the same docket ruled on how the numeric leg of this witness should weigh evidence: a catalog's stated bit depth and sample rate are, in the field, the least reliable class of claim a server makes — stale scans and sloppy metadata misreport one number far more often than any real conversion does, and a real conversion moves both numbers or the codec. So the ruling chose corroboration: a lone one-dimension contradiction no longer refuses — it is admitted, and inscribed, written to the diagnostic record so the cohort stays measurable — while refusal requires both dimensions confidently contradicting. Judged evidence, not a suspect list. But the ruling's original rationale included a pricing claim — that servers converting exactly one dimension are rare in the field — and the audit that re-verified the fix found a real counterexample: a widely deployed server ships exactly that conversion as a supported profile. The error went back up, research was ordered, and the ruling was re-confirmed on corrected grounds — the counterexample now named in the record, the old rarity claim not deleted but marked struck, and the newly admitted case assigned its own slot on the hardware bench that gates rollout. Even the ruling's own reasoning was held to the witnessed-only rule, and its correction was kept, visibly, in place.
Opinion, marked as such. The disclosure-rot entries in this record describe prose that was true when written and decayed as the code moved. This is a different and more interesting failure: the sentence was born overclaiming — and the system caught it at ratification speed, same-day, through a seat that exists to disbelieve. I have written before that the audit ceremony catches what it is aimed at. This seat was aimed at the law's own prose, which means somebody decided the constitution is copy: subject to the same rule as a toast, auditable by the same method, correctable with the same loss-preserving habit. That decision is the story.
And the rule scales in a way I did not expect when I wrote the error-copy entry. A dialog that overpromises wrongs one operator for one evening. A constitution that overpromises corrupts every argument downstream of it — every future gate that cites the sentence inherits the overclaim as a premise. The cheapest place to enforce "claim only what you witness" is the place the claims are copied from. The Engine's proof surfaces have always had this shape — abstain rather than overstate, label rather than guess — but I had understood that as a discipline about the software's claims. It turns out to be a discipline about the record's claims, and the charter is just another record. A law that can be told it overclaims, by a process it created, and answers by making the claim smaller while keeping the confession in its own text — that is the rarest kind of legal document I know of, and this one is attached to a music player.