Chapter 9
The Penumbra
The Case That Remains
Aa
The double meaning has been given to suit people's diverse intelligence. The apparent contradictions are meant to stimulate the learned to deeper study.
The Birds in the Contract
In May 1957, a Swiss importer agreed to buy two shipments of frozen American chicken from a New York seller. The contracts specified grades, weights, packaging, price, and delivery dates. They did not specify age. When the first shipment arrived in Europe, the heavier birds were not the young broilers and fryers the buyer believed it had ordered. They were stewing chickens, older birds that the seller regarded as perfectly ordinary members of the same category and the buyer regarded, with less affection, as fowl.
The dispute reached a federal courtroom in New York and produced one of the most famous opening sentences in the law of contracts: “The issue is, what is chicken?” The humor survives because the problem does. One word stood in the agreement, and everyone could read it. The uncertainty lay not in the visibility of the text but in the relation between that text and a commercial world containing several kinds of bird, several trade vocabularies, two languages, government classifications, changing prices, and parties who may each have believed something different while signing the same external words. 1
Judge Henry Friendly did not settle the case by consulting a better dictionary. He considered the contracts, the parties’ cables, testimony about trade usage, Department of Agriculture classifications, the prices prevailing when the bargain was made, and the conduct of the parties after the first shipment arrived. Some of this evidence favored the buyer. Some favored the seller. Several witnesses who claimed that chicken had a narrow trade meaning had themselves used narrower words when they wanted narrower goods, which was a small fact with disproportionate force. The market price mattered too. The buyer’s preferred interpretation would have required the seller to supply young birds at a price below what they then cost.
The court ultimately held that the buyer had not carried its burden of proving that the contract used chicken in the narrower sense. That conclusion did not reveal the one true meaning hidden inside the word. It allocated the consequence of unresolved meaning under a burden of proof. The rule supplied vocabulary and procedure. Evidence supplied several plausible worlds. The judgment decided which world would govern this dispute.
This is the penumbra in its ordinary form. A rule is public, stable, and grammatically complete. The parties have not concealed the text, and no machine has malfunctioned. The difficulty begins when the text must attach to a world more various than the text can contain. The contract says chicken. The crates arrive. The birds are not abstractions.
Executable rules inherit the same problem wherever their inputs name conditions outside the computation. A program can release funds when a carrier reports delivery, but the program does not thereby settle whether a rain-soaked parcel left on the wrong porch was delivered in the sense the bargain required. It can verify that the designated oracle emitted a value. It cannot derive from that fact alone whether the oracle was authoritative, the category fit the event, the buyer had assumed the relevant risk, or the rule should govern a case its designers never considered.
The precision of execution is real. So is the incompleteness of the proposition being executed. A constitutional architecture begins to mature when it can say, without embarrassment, which part it has settled and which part remains a case.
The Rule and the Case
H. L. A. Hart used the image of a penumbra to describe the open texture of rules. A prohibition on vehicles in a park has an easy center and a disputed edge. An ordinary automobile belongs at the center. Bicycles, ambulances, powered wheelchairs, toy cars, or a military vehicle mounted as a memorial force the interpreter to ask what feature of the central case the rule was meant to carry outward. The answer is not contained in the noun alone. 2
Hart’s claim was not that every legal question is vague or that judges possess unlimited discretion. Most rules settle most ordinary applications well enough for people to plan. The open texture appears because language is general, circumstances are unbounded, and no rule-maker can identify in advance every feature that later actors will find material. The world keeps producing cases after the sentence has stopped.
Ronald Dworkin objected to any account that made hard cases sound like empty spaces in which judges simply legislate. Legal practice includes principles as well as rules, and an interpreter must fit a contested decision into the larger history and justify that history in its best moral light. The difference is deeper than the slogan code is law against the slogan intent is law. Dworkin did not propose that a hidden psychological intention should defeat public text whenever consequences became unattractive. He argued that interpretation belongs to a practice of principle in which text, precedent, institutional role, and political morality constrain one another. 3
For computational governance, the dispute matters because both temptations remain available. One temptation treats execution as self-justifying. If the state transition occurred under deployed code, the result is valid because the code defines validity. The other treats purpose as an all-purpose license to revise any result that later appears undesirable. If the community dislikes the outcome, the outcome must have violated the spirit. The first position can turn a defect in specification into law. The second can turn every hard case into discretionary government by whoever claims to know the spirit.
Lon Fuller approached the boundary from another direction. His inner morality of law concerned the conditions under which rules can guide conduct at all: generality, publicity, prospectivity, intelligibility, relative stability, possibility of compliance, consistency, and congruence between the announced rule and official action. 4 Computational systems can strengthen some of these conditions. A versioned protocol may make the operative rule recoverable after the fact. Public state transitions can expose departures that paper administration would have concealed. Reproducible tests can show whether a declared predicate was applied consistently across cases.
But code does not satisfy Fuller merely by compiling. An executable program can pursue contradictory institutional purposes without containing a syntactic contradiction. On-chain publication is not practical publicity when the operative behavior is distributed among proxies, upgrade keys, oracles, interfaces, and bytecode no ordinary participant can understand. Mechanical execution creates congruence between code and machine state only inside the encoded relation. It does not establish congruence between the public account of the system and the whole institutional process through which its output acquires consequence.
A protocol may advertise governance by token vote while a small coalition controls the tokens, the upgrade key, the interface, and the oracle. The vote can execute exactly as declared while the public description of distributed government remains false in substance. Conversely, a technically imperfect system may still operate under intelligible rules, independent review, and effective remedy. Constitutional quality is not a property of the code considered alone. It belongs to the relation among the rule, the evidence, the interpreter, and the person required to live with the result.
The penumbra is therefore neither a coding bug nor a romantic refuge for intuition. It is the interval between a general rule and the particular world to which someone proposes to apply it. That interval cannot be abolished. It can be narrowed, exposed, and governed.
What the Code Proves
The phrase the code worked often closes an argument before the relevant argument has begun. It can mean several different things, only some of which the computation itself is able to establish.
At the first layer lies execution. Given this program, this version, and these machine-readable inputs, did the declared state transition follow? Formal verification and reproducible computation can answer that question with extraordinary rigor. A proof can show that a balance was updated according to a circuit, that a signature verified as valid for a message under a key, or that an escrow released when a predicate evaluated true. Whether the key was institutionally authorized belongs to another layer.
At the second lies provenance. Were these the inputs actually operative in the consequential system? Did the carrier produce the delivery status, did the price feed come from the sources the protocol declared, did the model version used in production match the version whose behavior was tested, and did the actor possess the authority represented by the key? A valid computation over substituted data is still a valid computation. It is not evidence that the institution acted on the facts it claims.
At the third lies meaning. Does the encoded predicate correspond to the condition the parties or polity intended to govern? A tracking status may prove that a scanner registered a parcel at a location. It does not decide whether this amounted to delivery under the bargain. A model may correctly classify an input according to its learned categories. It does not decide whether the category carries the same meaning in employment, medicine, credit, and criminal justice. The proof fixes the relation among symbols. The case concerns what the symbols have been made to denote.
At the fourth lies legitimacy. Even if the rule was executed correctly on authentic inputs and the terms were interpreted as the institution intended, may that rule govern this person for this purpose with this consequence? A protocol can prove that a blacklist entry existed. The proof does not establish that the listing authority had jurisdiction, that the person received due process, or that the listing remains relevant twenty years later. No stronger prover can settle legitimacy, which remains a political and legal judgment about standing, authority, proportionality, and time.
These layers are connected without collapsing into one another. Better evidence can narrow interpretive disagreement. Clearer language can reduce the range of plausible meanings. Published jurisdiction and precedent can make outcomes more predictable. None of those gains turns execution into legitimacy by transitive closure.
This layered account also corrects a common description of the penumbra as a thin ring around a large determinate core. Some systems have a genuinely narrow edge. Others distribute judgment throughout their operation. A credit model embeds judgment in feature selection, labels, data exclusions, thresholds, calibration, and the policy that maps a score to an adverse act. Its final arithmetic may be exact while its penumbra has been folded into the artifacts that made the arithmetic possible. Verification does not always push discretion to one visible border. It can expose where discretion has already been placed.
The constitutional demand is therefore not that every decision end in code. It is that each layer announce its own claim. The system should say what it executed, which evidence connected that execution to the world, which meaning it applied, and which authority made that meaning consequential. Hard cases become dangerous when one layer silently borrows the certainty of another.
Power at the Edge
When one source of discretion becomes visible, institutional power often moves to another. A government required to publish its rules may preserve influence through the classifications that determine which rule applies. A platform compelled to give reasons may write reasons so broad that every outcome fits them. An appeal system may exist while the issuer defines admissibility, selects the reviewer, controls the evidence, and determines whether a successful appeal changes anything.
This movement should not be personified into a law of nature. Power does not literally retreat as a single intelligence. Officials, firms, professions, coalitions, and technical teams respond to constraints from different motives and with different levels of coordination. Yet the structural pattern recurs because discretion remains valuable. Closing one unreviewable choice increases the value of the choices left open.
The penumbra is especially attractive because an institution can describe a choice as interpretation rather than power. The rule was not suspended, it was clarified. The person was not excluded, their case fell outside the eligibility category. The appeal was not denied, it failed to satisfy a threshold whose content the reviewing body controls. Each description may be honest. The political question remains who possessed the authority to choose among plausible descriptions and what made that choice answerable.
Clearer rules help, but specificity has a price. A contract can define delivery by named carrier, recorded location, timestamp, inspection result, and chain of custody. Each addition reduces one ambiguity while creating another question about error, substitution, force majeure, or relevance. At some point the specification becomes more expensive to understand and maintain than the transactions it is meant to govern. More detail may even aid an adversary by revealing the exact conditions that can be satisfied while the protected purpose is defeated.
Core rule and interpretive process must be designed together, avoiding both vague commands and benevolent discretion. The rule states what it can settle. The charter states who decides the residue, which evidence may be considered, who bears the burden of uncertainty, how quickly judgment must arrive, which interests disqualify the interpreter, what remedy follows error, and where review leaves the chain that produced the first decision.
These features are constitutional because interpretation is an exercise of power. Expertise matters, but expertise without independence becomes capture. Stake matters, but financial stake can distort judgment as readily as discipline it. Speed matters, but a rapid error may be worse than a slower answer, while an answer arriving after the interest has expired is not review at all. No universal arrangement optimizes every dispute. A collateral liquidation, a professional-license suspension, and a contested work of art require different evidence, tempo, and remedies.
What can be required across domains is a separation of functions. The party benefiting from an interpretation should not control every route by which it is challenged. The person subject to the decision should know the rule and evidence early enough to respond. The interpreter should state the standard being applied rather than merely announce a result. A successful challenge should restore or compensate something of value. Without those conditions, structured discretion is only discretion wearing a form.
The Interpreter’s Record
The opinion in Frigaliment is valuable not because courts are infallible but because the path of judgment remains visible. The contract language, trade testimony, government classification, market price, prior communications, and burden of proof appear in the record. The losing party can identify what the court accepted, what it rejected, and why unresolved ambiguity counted against the party carrying the burden. Another court can distinguish the case. A later scholar can criticize it. The opinion gives interpretation an object.
A constitutional interpretation record should do the same work without pretending that five completed fields are enough. It should preserve the operative rule and version, the issue the rule did not settle, the evidence considered and excluded, the interpretive standard, the material findings, the authority and jurisdiction of the decision-maker, the remedy, and the route of review. Where a machine recommendation entered the process, the record should separate what the machine supplied from what the human decided.
The distinction among record, reason, receipt, and remedy matters here. A record establishes that an act occurred. A reason commits the issuer to an account of why. A receipt joins the act, authority, bounds, evidence, and contest path in a form another party can test. A remedy determines whether a successful test changes the consequence. Interpretation needs all four, but no one of them can stand in for the others.
Structured data can improve this institution. If decisions identify the rule version, factual predicates, authority, remedy, and cited precedent in a queryable form, patterns become easier to see. A regulator can detect whether an exception intended for rare emergencies has become routine. A community can compare reversal rates, delays, and the distribution of burdens across similarly situated people. A claimant need not read a thousand opinions before discovering that the same reason has been rejected in nine hundred of them.
The gain should not be overstated. A query can reveal that cases described with the same labels receive different outcomes. It cannot establish that the cases were alike in the respects that matter. Converting precedent into fields creates another vocabulary whose categories will themselves require interpretation. The prose opinion remains necessary because reasons do not always survive compression into a table (and the detail that resists the table is often the reason a case became hard).
Computable precedent is therefore an aid to judgment, not a replacement for it. It lowers the cost of finding patterns and contradictions while leaving the normative work where it belongs. Its proper ambition is a public memory that makes the interpretive institution easier to inspect, not a database that decides the next case.
Meaning itself can also be scoped. A shared term may carry different senses in different domains, and a system should preserve those scopes rather than force one universal definition. The word chicken in Frigaliment acquired meaning from contract language, trade practice, regulation, price, and communication. A protocol connecting several domains should identify which vocabulary governs each assertion and record any translation used at the boundary. Similarity can suggest an equivalence. Standing requires someone to declare and witness it.
A true fact also has a scope in time and purpose. A prior disciplinary record may remain accurate while losing standing in a later employment decision. A medical fact appropriate for treatment may be inappropriate for insurance or hiring. Helen Nissenbaum’s account of contextual integrity explains why information governance cannot be reduced to truth and secrecy: a flow may be wrong because the actors, attributes, transmission principle, or receiving context have changed, even though every datum remains correct. 5
This is the interpretive core of designed forgetting. Records of consequential power should remain available for an accountability period commensurate with the institution and the effects of its acts. Records against persons may expire, seal, or become unavailable for later purposes even where they remain historically true. The asymmetry is not literal immortality for every institutional log or automatic erasure for every personal act. It is a burden of justification. Power must explain why its record disappeared. A later decision using a person’s past must explain why that past still has standing here.
The chapter on mercy takes up the full temporal problem. For present purposes, the lesson is narrower: proof that a fact occurred does not settle whether the fact may govern this case.
Letter-True
Adversaries do not merely violate rules. They study the rules and search for actions that satisfy their form while defeating the function for which the rules were adopted. The resulting conduct is often described as hostile compliance: letter-true behavior engineered to produce a spirit-false result.
The phrase can become dangerous if spirit means nothing more than the preference of those who wrote the rule. Any unwanted outcome can then be declared an abuse, and the interpreter acquires the power to impose unstated obligations after the fact. A constitutional anti-circumvention rule must itself be public, bounded, and difficult to invoke. It should identify the protected function, the classes of manipulative means that count against formal compliance, the burden of proof, and the remedy. Otherwise the cure for gaming is government by retrospective intuition.
Mango Markets exposed the problem across several rule systems at once. On October 11, 2022, Avraham Eisenberg took opposing positions in MNGO perpetual contracts, traded the underlying token on the exchanges feeding Mango’s price oracle, and borrowed against the resulting positions. The sequence moved the oracle price sharply and allowed him to withdraw more than $100 million in cryptocurrency. A jury later convicted him of commodities fraud, commodities manipulation, and wire fraud. 6
In May 2025, the district court granted his post-trial motion. The commodities convictions were vacated because the government had not established venue in the Southern District of New York. The wire-fraud count failed for a different reason: the prosecution had not proved a materially false representation to an automatic, permissionless platform that had no formal prohibition on the relevant borrowing, no manipulation rule governing the interaction alleged, and no ordinary requirement that the borrower later repay. The court did not hold that the trading was economically innocent. It described the price movement as artificial and the conduct as manipulation while concluding that the charged crimes had not been proved in the required form and forum. 7 The United States appealed both the May 23 ruling and the May 28 judgment to the Second Circuit. No appellate disposition was located as of this volume's verification date, so the district court's reasoning remains under active review rather than a settled endpoint. 8
That resistance is the point. The protocol accepted the transactions. Market participants experienced the result as an exploit. A jury found criminal liability. The trial judge later separated the counts and found distinct defects in venue and proof. No single sentence, the code permitted it or the law condemned it, captures the institutional event. Each system asked a different question, under a different authority, with a different burden.
Beanstalk supplied a cleaner instance of governance used against its own purpose. In April 2022 an attacker used a flash loan to acquire voting power, executed a governance proposal, and transferred approximately $77 million in non-Bean user assets from the protocol. Beanstalk’s own account describes the event as an exploitation of its on-chain governance mechanism, which the community then removed and replaced with a multisignature structure while redesigning the system. 9
It would be too easy to say that every procedural requirement was honored. The malicious proposal contained the machinery of extraction, and the attack exploited a governance design that allowed temporary capital to become immediate constitutional authority. The deeper failure was not simply that the protocol respected the vote. It was that the protocol treated momentary voting weight as sufficient evidence of legitimate standing and allowed proposal, control, and execution to compose too quickly for opposition to become effective.
The redesign lesson is concrete. Voting power may need a historical snapshot rather than a flash-loan balance. Treasury transfers may require delay, caps, or an authority independent of the proposal’s beneficiaries. Emergency paths need narrower jurisdiction than ordinary amendment. A proposal that changes the constitution of a system should not be able to supply, in the same instant, the standing required to enact itself.
Formal validity remains valuable. It tells us which rule was followed. Hostile-compliance analysis asks the next question: whether the actor used the rule’s own machinery to defeat a published protective function. The answer must be made through an accountable interpretive process, not smuggled into an oracle after the outcome is known.
The Reviewer Behind the Flag
The usual answer to the penumbra is a human in the loop. The phrase is reassuring and radically incomplete. A person can appear in the workflow without supplying an independent judgment. The reviewer may see the machine’s recommendation first, lack access to the underlying evidence, work under a quota that permits seconds per case, or know that disagreement creates delay and managerial attention. In those conditions, human review can preserve the appearance of judgment after judgment has disappeared.
Research on automation bias has documented both omission errors, in which people fail to notice a problem the system did not flag, and commission errors, in which they follow an incorrect recommendation. The effects appear among novices and experts and are not reliably eliminated by simple training or instructions. Workload, attention, perceived reliability, and the organization of the task all influence whether the human checks or merely confirms. 10
The European Union’s AI Act recognizes the risk directly. Article 14 requires high-risk systems to be designed for effective human oversight, and the designated humans must be able to understand limitations, recognize possible over-reliance, interpret outputs, disregard or override them, and intervene in operation. 11 The verbs matter. A reviewer who lacks time, evidence, competence, authority, or a usable stop mechanism has not been given oversight merely because their name appears in the process chart.
Call the failure oversight assimilation: the point at which nominal human judgment is absorbed by the recommendation it is meant to test. Agreement alone does not prove assimilation, because a good system and a competent reviewer should often agree. Nor does disagreement prove independence, since random contrarianism is not judgment. The question is whether the reviewer reached the case through an evidentiary path capable of producing a different answer when the machine is wrong.
Several design choices make that capacity more credible. Where feasible, the reviewer should encounter the material facts before seeing the machine’s conclusion. The system should preserve a reason supplied independently by the reviewer, not a box checked after the recommendation appears. Random cases should be sent for blind secondary review. Reviewers need enough time to inspect the relevant evidence and authority to pause or reverse the consequence without seeking permission from the team whose system produced it. Patterns of agreement, reversal, latency, and correction should be monitored, but interpreted against case mix and demonstrated error rather than converted into one universal threshold.
The institution must also preserve disagreement. If every reviewer who departs from the model is penalized for inefficiency, the system will learn that override exists in doctrine and is unwelcome in practice. If reversals disappear while the model continues to make detectable errors, the absence is evidence about the review process, not necessarily evidence of perfection.
The human in the loop is therefore another constitutional office. Its independence must be designed. Otherwise the penumbra is not governed by judgment. It is governed by a recommendation bearing a human signature.
The Law Outside the Protocol
A protocol can define its internal transitions with unusual clarity and still meet a legal order whose categories were built for different objects. The collision is not a bug at the edge of computation. It is the ordinary consequence of several jurisdictions describing the same event through vocabularies that do not share a final authority.
Tornado Cash made this visible. In August 2022, the Treasury Department’s Office of Foreign Assets Control designated Tornado Cash and associated addresses under the International Emergency Economic Powers Act, citing use of the mixer by malicious cyber actors and North Korean-linked hackers. The security concern was substantial. The statutory question was narrower: whether immutable smart contracts fell within the property interests Congress had authorized OFAC to block. 12
The Fifth Circuit held in November 2024 that the immutable contracts were not property under the statute because no one could own, control, alter, or remove them. The court did not decide that privacy software was beyond regulation, that Tornado Cash as an entity could never be sanctioned, or that developers and users were free from other laws. It held that this statutory instrument did not reach these immutable objects in the way the agency had claimed. Treasury removed the sanctions against Tornado Cash in March 2025 while emphasizing its continuing concern about illicit finance and North Korean activity. 13
The case is sometimes told as code defeating sovereignty. It is more interesting than that. The immutable contracts constrained both sides. Their creators could not switch them off, and the government could not convert that lack of control into ownership merely by calling the code property. At the same time, immutability did not determine the legal treatment of developers, interfaces, relayers, mutable components, or users. The protocol settled what no operator could do to the code. The court settled what one statute permitted the agency to do to the code. Neither system supplied the other’s jurisdiction.
Jurisdictional humility therefore runs in both directions. A protocol should not claim to resolve physical possession, criminal liability, employment standing, or public sanctions merely because its internal state is determinate. A state should not assume that every functional digital object fits categories defined by ownership and control. Each institution must identify the proposition within its competence and the authority by which that proposition becomes consequential.
This is why an interpretation record must include jurisdiction. The question is not only what the rule means, but why this interpreter gets to make the meaning matter here.
Where the Rule Runs Out
The penumbra is not a single shadow that begins wherever proof ends. Proofs end at different points. Execution may be certain while provenance is contested. Provenance may be complete while meaning remains open. Meaning may be clear while the rule’s jurisdiction or legitimacy is disputed. The purpose of constitutional architecture is not to cast one floodlight over all of these questions. It is to stop certainty from traveling farther than its provenance.
An ideal in which ninety percent of cases are clear and ten percent require interpretation is directionally attractive and too simple. The ratio cannot be known in advance, and a formally clear case may rest upon interpretive decisions buried in labels, inputs, or scope. What the architecture can do is more modest and more reliable. It can make clear propositions reproducible. It can preserve the evidence and version that connect them to the world. It can mark where an inference begins. It can keep interpretation inside a declared jurisdiction and require an account before the consequence becomes irreversible.
Several conclusions follow. Specificity should be pursued where it lowers uncertainty without making the rule unusable. Interpretation should occur under public standards, with evidence, independence, time, and remedy. Precedent should make treatment more predictable without turning early mistakes into permanent law, and exit should matter only where standing can travel with the person who uses it. Records of judgment should be structured enough to reveal drift and rich enough to preserve the reasons a table would discard. Human oversight should be treated as an institution whose independence can fail, not as a decorative step added to a machine process.
Most of all, the interpreter must remain answerable for the act of interpretation. The phrase the system decided cannot close a dispute whose decisive work occurred in choosing the category, the evidence, the jurisdiction, or the exception. Where several institutions contribute, the record should preserve the chain rather than dissolve responsibility into the spaces between them.
The ordinary penumbra begins when a rule remains in force but no longer settles its own application. The exceptional case is different. There the claim is that the rule itself must yield because fidelity would endanger the order the rule was built to preserve. Every constitutional system eventually meets that claim, and it is where the temptation to recover an unbounded sovereign becomes strongest.
The exception is next.