Three Ways Receipts Fail
Words had to change their ordinary meaning and to take that which was now given them.
— Thucydides, History of the Peloponnesian War, III.82 (c. 400 BC)
A constitutional architect who stops at specification and does not test under adversarial pressure has built a monument, not a fortress. Constitutions fail in predictable ways. American warrant requirements were circumvented by "general warrants" that authorized open-ended searches before the courts specified what "particular" description meant. Magna Carta's guarantee against arbitrary imprisonment was evaded by the Crown through the expedient of imprisoning subjects in locations where the writ of habeas corpus did not run. A universal pattern: requirement imposed; the constrained party complies in form while evading in substance; evasion detected and hardened against; new evasion innovated. The question for the receipt regime is whether its architecture permits the detection and correction of evasion at a pace that keeps the regime meaningful.
Three failure modes, each drawn from documented failures in existing institutional systems: each succeeds against a naïve implementation, each can be hardened against.
Semantic Deception
A platform freezes a user's account. The receipt names the act: "temporary restriction on outbound transfers." Authority: "Section 14.3 of the Terms of Service, Suspicious Activity." Bounds: "restriction effective for 30 days or until review is completed." Justification: "pattern consistent with unauthorized access." Appeal path: "submit a review request through the Account Security portal."
Every field populated. Formally valid. The receipt lies. The justification is a template: the same phrase, "pattern consistent with unauthorized access," appears in ninety-seven percent of all freezes the platform issues. Drafted by a legal team to be maximally defensible and minimally informative, the phrase tells the affected party nothing about what triggered the freeze: whether it was a login from an unusual location, a large transfer to a new recipient, an algorithmic flag, or an error in the system's models. The justification has the form of an explanation without the content of one.
Semantic deception exploits the gap between syntax and semantics that every formal system contains. Constrained parties produce receipts that satisfy formal requirements while conveying no actionable information. Justification fields become repositories of pre-approved phrases, each technically responsive to the requirement and substantively void. Authority fields cite the broadest possible clause, the one that covers everything and specifies nothing. Bounds fields state the maximum permissible scope "as a precaution," ensuring that stated bounds are never exceeded because the stated bounds encompass everything. Receipts become form letters: formally compliant, substantively hollow, and indistinguishable from one another.
The technique has a precise institutional analog. When the United States government classifies a document, the classification stamp must include the authority, the date, and the declassification trigger: requirements imposed by executive order to prevent overclassification. The Government Accountability Office has repeatedly found these requirements formally satisfied and substantively meaningless: the authority cited is the broadest available category, the declassification date set to the maximum allowable period. The form is complete. The substance is hollow.
Hardening: the specificity floor. Statistical audit can detect template patterns: if ninety-seven percent of justifications use identical language, the language is a default, not a justification. But detection requires a structural fix: a formal requirement that each justification contain at least one element distinguishing this receipt from all others issued in the same period. The element need not be disclosed to the affected party; it can be disclosed to an auditor under seal. But it must exist. A justification identical across thousands of cases is a rubber stamp, and the specificity floor prevents the stamp from satisfying the regime's requirements. The principle is the informational equivalent of the Fourth Amendment's requirement that a warrant "particularly" describe the place to be searched: particularity prevents the warrant from becoming a general authorization.
Procedural Obstruction
The receipt is issued. The appeal path identified. The affected party submits an appeal.
Eleven weeks later, the appeal is denied. The account remained frozen throughout. Her rent was due in the second week. Payroll failed in the third. By the time the denial arrives, the harm is complete: the appeal was not a remedy but an autopsy conducted over the remains of a livelihood.
Between submission and denial, the machinery of process. The appeal enters a queue managed by a department understaffed (not by malice but by incentive structure), because the platform rewards revenue generation and dispute resolution generates none. A reviewer handling three hundred cases per week reads the submission, requests additional documentation, receives it, requests clarification of the documentation, receives the clarification, and forwards the case to a specialist team. The specialist team has a two-week backlog. The specialist reviews the case, determines that the freeze was imposed correctly under the platform's internal criteria, and denies the appeal.
The path exists. It is documented. It is staffed by people who process cases according to procedures that are, individually, unobjectionable. But the aggregate effect (the queue, the documentation request, the clarification, the referral, the backlog, the determination, the review of the determination) is that the appeal resolves long after the harm it was meant to address has become irreversible.
Procedural obstruction preserves the appearance of justice while destroying its substance. The English Court of Chancery, which existed to provide equitable relief, became by the eighteenth century a system so encrusted with procedural complexity that suits ran for decades: Dickens's Bleak House immortalized the Jarndyce case, which consumed the entire estate it was meant to adjudicate. Any institution whose incentives do not punish delay will produce delay, because delay is costless to the institution and devastating to the party who needs relief.
Hardening: interim relief and deemed reversal. When an appeal concerns an action whose consequences compound, the default should be the least restrictive interim measure compatible with immediate safety. A complete freeze is suspended unless the operator persuades an independent arbiter that narrower measures would create greater harm. The burden belongs to the party exercising power.
The review clock begins only when a filing satisfies a published completeness test. The operator must identify any missing item within a fixed intake period and may not restart the clock through serial requests for material it could have named at the outset. Duplicate filings may be consolidated for administration, but consolidation does not extinguish anyone's standing or postpone the earliest valid deadline. One extension is permitted for unusual case complexity if an independent arbiter approves it in a receipted decision. Ordinary understaffing, backlog, or referral between internal teams never tolls the clock.
Timelines remain proportional to severity: a complete account freeze demands review within days, while a partial restriction may permit longer. If the deadline passes, the restriction is reversed until the review is completed. Deemed reversal makes delay expensive to the operator rather than to the affected party, while the completeness rule and independent extension prevent bad-faith or incomplete filings from turning every appeal into an automatic release.
Structural Capture
The receipt regime is implemented: auditors independent, appeals timely, receipts substantive.
Then the operator redesigns its architecture so that actions requiring receipts no longer trigger the requirement.
A platform that must issue a receipt when it freezes an account discovers it can achieve the same effect by adjusting the user's "trust score" to a level where transactions are deprioritized, delayed, or routed through additional verification steps that make the account practically unusable, without technically freezing it. Trust-score adjustment is not classified as a "coercive act" under the regime's definitions: the user experiences the same harm, and no receipt is issued.
Structural capture is the most dangerous failure mode because it attacks definitions rather than procedures: definitional arbitrage that exploits the gap between what the regime covers and what it was designed to cover. When American banking regulation imposed reserve requirements on commercial banks, the financial industry responded by creating money-market funds that performed the same economic function without meeting the legal definition of a "bank." When securities regulation imposed disclosure requirements on public offerings, the industry responded with private placements that raised the same capital without meeting the legal definition of a "public offering." In each case, the regulated entity preserved the economic substance while changing the legal form. The regulatory response was to redefine the regulated activity in functional rather than formal terms: a money-market fund that walks like a bank and quacks like a bank is regulated like a bank, regardless of what it calls itself.
Hardening: effects-based triggers and architectural audit. Static definitions of "coercive act" will always be outrun by architectural innovation. The fix is an effects-based trigger: the receipt requirement fires not on the operator's classification of the action but on its effect on the affected party. A trust-score adjustment that makes an account practically unusable triggers the same requirement as a formal freeze, because the effect is the same. This tracks the principle behind the Howey test in securities law: legal determination depends on economic reality, not on the label the parties have attached. Second, an architectural audit: periodic review of the operator's system by an independent body with technical expertise and the authority to reclassify actions based on their effects. The arms race between structural capture and architectural audit is permanent. No static definition survives indefinitely against an adversary with the incentive and technical capacity to evade it. The hardening does not end the arms race; it ensures the race is fought on institutional terms rather than decided by default in the operator's favor. This permanence is a feature of any constitutional system that constrains power without abolishing it. The American Constitution has been amended twenty-seven times and reinterpreted thousands of times, because the balance between governmental power and individual liberty is not a problem that can be solved once and maintained forever. It is a tension that must be managed continuously, and the institutions that manage it (courts, legislatures, regulatory bodies, a free press) constitute the living constitutional order. The receipt regime requires the same kind of living institutional support, and the architectural audit is one of its central institutions.
Before the Three: The Unshared Regime
The three failures above share a premise: that the regime exists on both sides of the power relation, and that the contest is over its integrity. History suggests the likelier failure comes earlier, before there is a regime for the three to attack. It is a failure of adoption, not of the regime, and so it sits outside the taxonomy the claim at this chapter's close governs; it is recorded here because it is the precondition the other three depend on. Verification infrastructure is adopted by whoever it serves, at the pace their interests set, and the party with the most to gain from receipts about others is the party exercising power. A regime adopted on one side only is not a weaker version of the receipt regime. It is the regime's inversion: the operator holds recomputable records of every act of the subject, while the subject holds a form that accepts text and returns an automated acknowledgment. Each property functions as designed, but to the operator's advantage rather than the subject's. The Stasi archive of Chapter 2 was not a failed receipt regime but only half of one: the recording half was built, and the half that would have let its subjects answer back was not.
The hardening does not require waiting for symmetric adoption, which would be waiting forever. It requires a rule courts have applied for centuries: the missing record may testify against the party who should have produced it. Spoliation doctrine permits an adverse inference when a party destroys or suppresses material it was already bound to preserve. The receipt regime extends that logic only after an antecedent duty to issue or preserve a receipt has been created by legislation, regulation, contract, or a competent adjudicator. Neither the analogy nor the Bulla wire format creates that duty by itself.
Once the duty exists, an operator with the demonstrated capacity to issue receipts, who produces none for a contested act, may lose the benefit of the doubt about what the missing record would have shown. The burden flips. Refusal then becomes evidence in a later dispute rather than a cost the operator can decline without consequence. Hospital charting spread on related logic: where the standard of care requires a record, an undocumented treatment may be treated as one not performed.
After the Three: The Captured Registry
Every failure this chapter has catalogued assumes, without saying so, that the operator of the receipt layer itself behaves. There is a failure waiting at the far end of the regime's success rather than at its beginning, and this chapter owes the reader its name. Suppose the receipts win. Every consequential exercise of power issues its record, the registries hold the accumulated conduct of every operator and every agent, and the institutions that once resisted the regime now depend on it. The infrastructure that holds every receipt has become the most valuable chokepoint in the economy it governs, and Chapter 2 supplied the name for what grows there before this chapter needed it: the trust tax, the premium collected not for the work of verification but for the exclusive position from which the work is performed. A receipt regime whose operator can collect that premium has not dismantled the pathology it was built against. It has re-housed it, behind better instruments. This is not a fourth failure outside the chapter's taxonomy but structural capture run to its terminal case — no longer a regulated operator slipping the regime's definitions, but the regime's own machinery becoming the thing worth holding. The identity is structural, not verbal: in both, an operator preserves the extractive substance while the regime's form stands intact, which is exactly the substance-over-label principle the effects-based trigger exists to catch.
The fairs of Champagne carried this lesson to its end. Chapter 1 told their story; what it did not dwell on is why the institution stayed honest for so long. It was never the wardens, and it was not the calendar of fairs itself, which rotated through four towns under one administration and offered a merchant no second sovereign to appeal to. The discipline lay outside: the fairs of Flanders ran their own circuit, and a merchant's custom could go there — as, in the end, it did, to Bruges and later to Geneva and Lyon. Scholars still argue over what the enforcement at Champagne really was — Milgrom, North, and Weingast modeled it as private order, reputation made enforceable by a judge any merchant could query, while Edwards and Ogilvie read the records as public administration that served all comers — but the ending is the same on either reading. After the county passed to the French crown in 1285 and Philip IV bent the fairs to his wars and his treasury, services once offered to every merchant as a matter of course became privileges granted and withheld as instruments of royal policy, and within fifteen years the custom was collapsing toward the circuits the crown did not control. The institution stopped answering to its users the moment it stopped fearing their departure.
Nor should the capture be imagined as an aberration that sound governance avoids. George Stigler's finding about regulation — that it is, as a rule, acquired by the industry it governs and operated for its benefit — was drawn from trucking routes and oil quotas, but it names a gravitational tendency in any body that stands between an industry and its obligations. A receipt regime that requires a virtuous operator has already failed. The serious question is what disciplines an operator whose virtue cannot be assumed, and the answer available to this architecture is structural, in three parts. The verdict of any receipt must be recomputable by whoever holds it, so that the checking itself cannot be taxed: a toll collects nothing on a road every traveler can walk for free. The standing of any counterparty must be derivable from the published record, so that the operator accumulates no private score to sell back to its subjects, and what a captor inherits is customers who can leave. And the records themselves must travel with their subjects and verify against any registry that carries them, so that a registry that can be exited must behave, and the regime's participants keep what the merchants of Champagne held until the crown made leaving worthless: a departure the operator has reason to fear.
In cryptographic protocol design, the standard methodology is to specify the protocol, then subject it to adversarial analysis assuming an attacker who can intercept messages, forge signatures, replay sessions, and exploit any mathematical weakness. A protocol that survives this analysis is provisionally secure. A protocol that has not been subjected to it remains hopeful rather than secure. What distinguishes a serious constitutional proposal from a wish list is the proposal's relationship to its own failure modes: a proposal that acknowledges how it will be attacked and specifies how it will be defended takes power seriously. A proposal that assumes good faith does not understand what it is proposing to constrain.
C9. The proposal identifies three recurring failure classes — semantic deception, structural capture, and procedural obstruction — and specifies controls that can be tested against them. If a recurring failure falls outside those three classes, or if capture persists through the controls the proposal supplies, the framework fails. A receipt regime functions constitutionally only while capture can be detected and corrected before its procedures become ceremonial.