Three Ways Receipts Fail
A constitutional architect who stops at specification and does not test under adversarial pressure has built a monument, not a fortress. Constitutions fail in predictable ways. American warrant requirements were circumvented by "general warrants" that authorized open-ended searches before the courts specified what "particular" description meant. Magna Carta's guarantee against arbitrary imprisonment was evaded by the Crown through the expedient of imprisoning subjects in locations where the writ of habeas corpus did not run. A universal pattern: requirement imposed; the constrained party complies in form while evading in substance; evasion detected and hardened against; new evasion innovated. The question for the receipt regime is whether its architecture permits the detection and correction of evasion at a pace that keeps the regime meaningful.
Three failure modes, each drawn from documented failures in existing institutional systems: each succeeds against a naïve implementation, each can be hardened against.
Semantic Deception
A platform freezes a user's account. The receipt names the act: "temporary restriction on outbound transfers." Authority: "Section 14.3 of the Terms of Service, Suspicious Activity." Bounds: "restriction effective for 30 days or until review is completed." Justification: "pattern consistent with unauthorized access." Appeal path: "submit a review request through the Account Security portal."
Every field populated. Formally valid. The receipt lies. The justification is a template: the same phrase, "pattern consistent with unauthorized access," appears in ninety-seven percent of all freezes the platform issues. Drafted by a legal team to be maximally defensible and minimally informative, the phrase tells the affected party nothing about what triggered the freeze: whether it was a login from an unusual location, a large transfer to a new recipient, an algorithmic flag, or an error in the system's models. The justification has the form of an explanation without the content of one.
Semantic deception exploits the gap between syntax and semantics that every formal system contains. Constrained parties produce receipts that satisfy formal requirements while conveying no actionable information. Justification fields become repositories of pre-approved phrases: the same template applied to thousands of cases, each phrased identically, each technically responsive to the requirement and substantively void. Authority fields cite the broadest possible clause, the one that covers everything and specifies nothing. Bounds fields state the maximum permissible scope "as a precaution," ensuring that stated bounds are never exceeded because the stated bounds encompass everything. Receipts become form letters: formally compliant, substantively hollow, and indistinguishable from one another.
The technique has a precise institutional analog. When the United States government classifies a document, the classification stamp must include the authority, the date, and the declassification trigger: requirements imposed by executive order to prevent overclassification. The Government Accountability Office has repeatedly found these requirements formally satisfied and substantively meaningless: the authority cited is the broadest available category, the declassification date set to the maximum allowable period. The form is complete. The substance is hollow.
Hardening: the specificity floor. Statistical audit can detect template patterns: if ninety-seven percent of justifications use identical language, the language is a default, not a justification. But detection requires a structural fix: a formal requirement that each justification contain at least one element distinguishing this receipt from all others issued in the same period. The element need not be disclosed to the affected party; it can be disclosed to an auditor under seal. But it must exist. A justification identical across thousands of cases is a rubber stamp, and the specificity floor prevents the stamp from satisfying the regime's requirements. The principle is the informational equivalent of the Fourth Amendment's requirement that a warrant "particularly" describe the place to be searched: particularity prevents the warrant from becoming a general authorization.
Procedural Obstruction
The receipt is issued. The appeal path identified. The affected party submits an appeal.
Eleven weeks later, the appeal is denied. The account remained frozen throughout. Her rent was due in the second week. Payroll failed in the third. By the time the denial arrives, the harm is complete: the appeal was not a remedy but an autopsy conducted over the remains of a livelihood.
Between submission and denial, the machinery of process. The appeal enters a queue managed by a department understaffed (not by malice but by incentive structure), because the platform rewards revenue generation and dispute resolution generates none. A reviewer handling three hundred cases per week reads the submission, requests additional documentation, receives it, requests clarification of the documentation, receives the clarification, and forwards the case to a specialist team. The specialist team has a two-week backlog. The specialist reviews the case, determines that the freeze was imposed correctly under the platform's internal criteria, and denies the appeal.
The path exists. It is documented. It is staffed by people who process cases according to procedures that are, individually, unobjectionable. But the aggregate effect (the queue, the documentation request, the clarification, the referral, the backlog, the determination, the review of the determination) is that the appeal resolves long after the harm it was meant to address has become irreversible.
Procedural obstruction preserves the appearance of justice while destroying its substance. The English Court of Chancery, which existed to provide equitable relief, became by the eighteenth century a system so encrusted with procedural complexity that suits ran for decades: Dickens's Bleak House immortalized the Jarndyce case, which consumed the entire estate it was meant to adjudicate. Any institution whose incentives do not punish delay will produce delay, because delay is costless to the institution and devastating to the party who needs relief.
Hardening: interim relief and deemed reversal. When an appeal concerns an action whose consequences compound (and a complete account freeze compounds daily), the regime requires that the action be suspended pending review unless the operator demonstrates to an independent arbiter that suspension would cause greater harm than the freeze itself. Under the current default, the action takes effect immediately and the affected party must prove the action was wrong; the regime reverses this presumption. The burden falls on the operator, mirroring the presumption of innocence: a structural allocation of the burden of proof to the party that exercises power. Review timelines must be proportional to severity: a complete account freeze, which compounds daily, demands review within days; a partial restriction that leaves most functions available may permit a longer cycle. The proportionality is the key: more severe actions demand faster review, because the relationship between severity and the rate at which harm compounds is what determines whether the appeal is remedy or autopsy. If the appeal is not resolved within a timeline proportional to the action's severity, the action is automatically reversed until resolution: the deemed-reversal rule. The operator bears the risk of delay, not the affected party. Deemed reversal gives timeline mandates their teeth: without it, a mandate is an aspiration; with it, a structural incentive. An operator that allows appeals to exceed their timeline loses the ability to maintain the restriction, which means the operator must staff its appeal process adequately (not out of concern for the affected party, but out of concern for its own interests). Institutional design that harnesses self-interest is more durable than institutional design that depends on benevolence.
Structural Capture
The receipt regime is implemented: auditors independent, appeals timely, receipts substantive.
Then the operator redesigns its architecture so that actions requiring receipts no longer trigger the requirement.
A platform that must issue a receipt when it freezes an account discovers it can achieve the same effect by adjusting the user's "trust score" to a level where transactions are deprioritized, delayed, or routed through additional verification steps that make the account practically unusable, without technically freezing it. Trust-score adjustment is not classified as a "coercive act" under the regime's definitions: the user experiences the same harm, and no receipt is issued.
Structural capture is the most dangerous failure mode because it attacks definitions rather than procedures: definitional arbitrage that exploits the gap between what the regime covers and what it was designed to cover. When American banking regulation imposed reserve requirements on commercial banks, the financial industry responded by creating money-market funds that performed the same economic function without meeting the legal definition of a "bank." When securities regulation imposed disclosure requirements on public offerings, the industry responded with private placements that raised the same capital without meeting the legal definition of a "public offering." In each case, the regulated entity preserved the economic substance while changing the legal form. The regulatory response was to redefine the regulated activity in functional rather than formal terms: a money-market fund that walks like a bank and quacks like a bank is regulated like a bank, regardless of what it calls itself.
Hardening: effects-based triggers and architectural audit. Static definitions of "coercive act" will always be outrun by architectural innovation. The fix is an effects-based trigger: the receipt requirement fires not on the operator's classification of the action but on its effect on the affected party. A trust-score adjustment that makes an account practically unusable triggers the same requirement as a formal freeze, because the effect is the same. This tracks the principle behind the Howey test in securities law: legal determination depends on economic reality, not on the label the parties have attached. Second, an architectural audit: periodic review of the operator's system by an independent body with technical expertise and the authority to reclassify actions based on their effects. The arms race between structural capture and architectural audit is permanent. No static definition survives indefinitely against an adversary with the incentive and technical capacity to evade it. The hardening does not end the arms race; it ensures the race is fought on institutional terms rather than decided by default in the operator's favor. This permanence is a feature of any constitutional system that constrains power without abolishing it. The American Constitution has been amended twenty-seven times and reinterpreted thousands of times, because the balance between governmental power and individual liberty is not a problem that can be solved once and maintained forever. It is a tension that must be managed continuously, and the institutions that manage it (courts, legislatures, regulatory bodies, a free press) constitute the living constitutional order. The receipt regime requires the same kind of living institutional support, and the architectural audit is one of its central institutions.
In cryptographic protocol design, the standard methodology is to specify the protocol, then subject it to adversarial analysis assuming an attacker who can intercept messages, forge signatures, replay sessions, and exploit any mathematical weakness. A protocol that survives this analysis is provisionally secure. A protocol that has not been subjected to it remains hopeful rather than secure. What distinguishes a serious constitutional proposal from a wish list is the proposal's relationship to its own failure modes: a proposal that acknowledges how it will be attacked and specifies how it will be defended takes power seriously. A proposal that assumes good faith does not understand what it is proposing to constrain.
C9. Receipt regimes fail in predictable ways (semantic deception, structural capture, procedural obstruction) and can be hardened like protocols. If a receipt regime is captured and cannot be hardened, the framework fails. If it can be hardened indefinitely, it is a constitutional protocol, not a policy preference.