Necessary, and not enough

The tally

The shape of the number is itself the first finding. The kernel almost always helps, and almost never finishes the job. It is a machine for making power legible — recorded, cited, countable, contestable — and not a machine for making it just. Legibility, the corpus says forty-one times over, is necessary and not sufficient; and it says so not as an apology but as the design.

What it does

Beneath the fifty, the kernel does the same few things, over and over, in different clothes.

• It makes the record un-rewritable. The append-only, witnessed log (§3.4 — invoked in 43 of the 50) is the single most-used idea in the corpus. A decision, an act, a warning, a test result — once entered, it cannot be rewound, redated, or destroyed without every copy's sums ceasing to agree, and any phone can tell.
• It makes the demand cite its rule. No form field, no refusal, no grade may exist without the machine-readable provision behind it. "Cite your rule" starts as a defence against paperwork and ends up applied to an algorithm's grade, a prosecutor's withholding, an inspector's single word.
• It makes the pattern a number. Measure the process, never the person (§8): the individually-lawful acts — the procurement lane, the stop-and-search, the downgraded death, the conviction by silence — become one signed aggregate the responsible body must publish about itself.
• It makes a fact about you yours to read. The subject-readable record — who opened your file, what a test found in your body, how your child's care was graded, that you have gone a few pounds over a limit — private to you, and provably complete to an auditor.

What it refuses

The most-invoked limit in the entire corpus is a refusal: the kernel does not decide substance (refusal 11, the boundary named in roughly thirty of the fifty). It will not rule who is right, what is true, whether a policy is wise, or whether a grade was deserved — process integrity only. This is the load-bearing choice, not a shortfall. A machine that adjudicated substance would be the single most valuable thing in public life to capture, so the kernel is built with nothing there to take.

The boundary is not a claim; it is visible in the triage itself, which turns eight cases away at the door and shows why for each — a child's best interests under Article 8, whether a claim is misinformation, whether a monument should stand, whether a post is harmful enough to remove. Each is a judgment of who-is-right that belongs to a court, an election, or an argument between people, and never to a protocol. Naming what it will not touch is half of what the kernel is.

The five ways it strains

The forty-one strains are not forty-one different disappointments. They are five, recurring — and once you have seen them, you can predict where any new case will stop.

1. Legibility is not a remedy. A signed number destroys deniability and cures nothing. "A number is not a remedy" recurs across the regulator, the procurement lane, the exam algorithm, the maternity ward: the kernel convicts the pattern to the record and cannot compel the fix.
2. The adopter is the accused. The body that must run the register is, again and again, the body it exposes — the prosecutor mapping its own files, the department reviewing a death it caused, the trust grading its own harm. The kernel binds the willing; the wrongdoer's unwillingness is its most practical limit.
3. Completeness is not guaranteed. It can make what is logged un-rewritable and un-buriable; it cannot compel the entry. The decision kept on WhatsApp, the test a clinician never records, the item left off the schedule — what never enters the record cannot be read from it. Integrity is not completeness.
4. The remedy runs at the speed of law. The kernel senses at machine speed and answers at constitutional speed (§9) — exactly right for a defence that must never turn autoimmune, and too slow for a one-day protest, a dying patient, a debt already grown, a conviction already standing.
5. Self-judgment is exposed, not corrected. When the reviewer is the reviewed — the grader who is the harmer, the minister judging himself — the kernel makes the judgment exist, be complete, and be contestable. It cannot make it honest.

The eight breaks

Where even legibility fails outright, the corpus is precise about why. The eight breaks fall in two places.

At the ballot itself

• breaks majority-vs-minority-uk · -cn · -uk-unverifiable · -uk-unwitnessed · coerced-vote — the reference kernel's own hardest cases: a count that cannot be verified, a log with no witnesses, a vote cast under coercion, a rights-stripping whose only remedy is a court's declaration that changes nothing on the ground. These are the attacks the kernel was built to face and, past a point, cannot win — and it says so, in its own corpus, about itself.

The record, the forum, and the adopter

• breaks government-by-whatsapp — a decision that never enters any record. The kernel can protect what is written; it cannot compel the writing.
• breaks executive-ignores — a record with no binding force on a power that simply ignores it.
• breaks drc-medical-detention — the true outer edge, and the one case that is not British: a lawless hospital detention where the detainer profits and the state looks away, so there is no institution willing to keep any record at all. The kernel becomes, at most, a witness's notebook, and a notebook opens no ward door.

Together the breaks state the kernel's three preconditions plainly: it needs a record that gets made, a forum that is bound by it, and an institution that consents to keep it. Remove any one, and legibility has nothing to stand on.

The one it holds

Once, cleanly, the kernel wins.

• holds records-rewrite — against the retroactive rewriting of a settled record (a tally quietly altered, a history re-signed after the fact), the witnessed, append-only, externally-anchored log is not strained but decisive. The rewrite breaks the sums in every copy and disagrees with the published head; any phone detects it. There is no residue, no offstage caveat, no adopter gap — the defence is in the mathematics, not in anyone's good faith.

It is worth naming the single clean victory, because it marks exactly what the kernel is for. Not to make the decision right — to make the record of it impossible to falsify. Everything else the kernel does is a variation on this one thing, meeting a world that keeps supplying reasons it is not, by itself, enough.

The compression

Step back far enough and the fifty collapse. They reduce to six recurring shapes — the record that was never made, the pattern of individually-lawful acts, the inaction that leaves no artifact, the access gated behind permission, the record destroyed at source, the document that gates a right — catalogued in the grammar of the cases. They reduce to the four constant limits above. And they reduce to a structural claim it took fifty tries to earn: the waist did not have to grow.

A protocol built deliberately thin — two small data formats, four services, a floor of rights — was tested against fifty of the worst things institutions do to people, and needed exactly two new pieces to carry all of it: a compelled record of an executive act, and a private record its subject can read. Three further shapes it has met only once, or only in a form its extensions already handle — a timed duty triggered by an inbound request, a verdict that must decompose into its parts, an inbound donation — wait, named and deferred, for a case that proves the waist must widen. Until such a case arrives, the discipline is the point: the kernel earns its adequacy by refusing to expand.

The one threat behind all of it

More than half the cases — 27 of 50 — turn on a single threat: capture, the fear that whoever runs the machine will come to own its outcomes. Read whole, the corpus is one argument made fifty ways. The way to keep a protocol for public decisions from being captured is to give it almost nothing worth capturing, and to make everything it does leave a record that anyone can check.

So the long list of what the kernel cannot do is not a list of failures. It is the list of things it was built, on purpose, to be unable to do — because a machine that could decide who is right, compel a remedy, or edit the roll would be a machine worth capturing, and the losing side would stop accepting its decisions. The corpus is fifty demonstrations that the line held. The kernel is necessary. Its refusal to be sufficient is the reason it is safe.