The Geography of Discretion
Three sharp objections to set-in-stone protocols deserve direct answers — emergency forks, constitutional rot, and the relocation of governance off-chain.
Three sharp objections to set-in-stone protocols deserve direct answers — emergency forks, constitutional rot, and the relocation of governance off-chain. None refutes the case. Each, properly examined, sharpens it.
Keywords: blockchain governance, constitutional analogy, base-layer fixedness, immutability, Bitcoin, Ethereum, TCP/IP, protocol ossification, constitutional rot, commitment devices, institutional economics, decentralisation, Williamson, adaptive governance
The constitutional analogy is becoming the dominant frame for thinking about base-layer protocols. Bitcoin maximalists invoke it to defend rule fixity. Ethereum researchers borrow it to discuss social-layer interventions. Institutional economists are starting to formalise what it actually requires. The basic claim is straightforward enough: a protocol whose base-layer rules are not subject to discretionary revision after deployment can function as a commitment device, in much the same sense that a constitutional rule functions as a constraint on legislative discretion. Participants can plan, invest, and contract around the rules because the rules are not, in the relevant operational sense, up for revision.
The trouble with the constitutional analogy is that the constitutional analogy has problems. Real constitutions get amended. Real constitutions get ignored. Real constitutions are interpreted by courts whose own discretion replaces the discretion that the constitution was supposed to constrain. Anyone who has spent time with constitutional history knows that “rules-not-rulers” is a slogan, not a description.
The three best objections to applying this analogy to blockchain protocols are old objections in new clothing. They each correspond to a real, documented failure mode in actual constitutional systems. They are:
Adaptive governance. Protocols that can’t change become irrelevant. Emergency situations like the DAO hack force the protocol to fork or die. The lesson is not “set the rules in stone” but “build legitimate emergency-power processes.”
Constitutional rot. Even if the formal text doesn’t change, the institutions that interpret it can drift. Dominant client implementations effectively become the protocol regardless of what the whitepaper says. Bitcoin Core controls Bitcoin in fact, whatever the protocol says in principle.
Relocation of discretion. Making the protocol immutable doesn’t eliminate discretion. It relocates discretion to whoever controls the off-chain processes — foundations, developer collectives, exchanges, regulators, courts — that decide what the protocol actually does. So why bother with the immutability claim?
Each of these is a serious objection. Each points to a real problem. And each — when examined directly — turns out not to refute the case for base-layer fixedness. They redescribe what the case requires.
What follows is the long version.
Emergency forks and the ossification trap
The clearest version of the adaptive-governance objection runs like this: protocols are software, software has bugs, and when the bugs are bad enough, you have to fix them. If you can’t fix them, your protocol dies. Therefore base-layer fixedness is a luxury for protocols that haven’t yet encountered a real emergency. Treat it as a real institutional condition, and you have built yourself a system that cannot survive its first serious crisis.
The DAO hack of 2016 is the canonical case. Ethereum forked to reverse the loss. The intervention is widely cited — even by people who think it was a mistake — as evidence that real protocols cannot afford the constitutional pretence of immutability. When push comes to shove, you fork.
The objection’s stronger form points to a separate worry: protocol ossification. A base-layer rule that cannot be changed after deployment cannot be improved either. If you discover that you got the parameters wrong, you can’t fix them. If technical progress makes the original design obsolete, you can’t upgrade. If externalities you didn’t foresee start mattering, you can’t accommodate them. A constitution that cannot be amended is a constitution that becomes irrelevant.
These are real problems. The critics who raise them are not stupid. The question is whether they refute the case for base-layer fixedness or sharpen it.
The answer is that they sharpen it, and they do so in a specific way: they force the proponent to be precise about what fixedness actually means. The honest version of the case for set-in-stone protocols never claimed that protocols cannot evolve. It claimed that the base layer — the wire format, the consensus rules, the canonical ledger semantics — should not be subject to discretionary revision after deployment. Application-layer evolution is not just permitted under that condition; it is the whole point of the condition.
TCP/IP is the institutional comparator. The RFC 793 wire format and connection state machine were specified in 1981. They have not been revised since. A TCP implementation written in 1983 still interoperates with the modern Internet today. But the Internet has not ossified. HTTP, TLS, DNS, video streaming, real-time collaboration, end-to-end encrypted messaging, the cloud, the entire mobile ecosystem — all of these are application-layer innovations that operate above the base layer without requiring the base layer to change. The fixed base is what made the application-layer evolution possible. Every developer building on TCP could rely on the wire format. Every router could rely on the IP packet structure. Stability at the bottom enabled dynamism at the top.
People sometimes object that TCP/IP itself has been “updated” by RFCs 1122, 3168, 6093, 6528, and 7323. They are confusing two different kinds of change. RFC 793 specified the core wire format, the connection state machine, and the semantic rules of the protocol — and within that specification it reserved option fields and unused header bits for future extension. The later RFCs populate those reserved fields, clarify ambiguous behaviour, or specify optional features at extension points the original specification provided for. RFC 3168’s explicit congestion notification populates two reserved bits. RFC 7323’s timestamps and window scaling are implemented through TCP options reserved in RFC 793. None of these revises the base wire format. A 1983 TCP stack still talks to the modern Internet. Filling a reserved field that the original specification anticipated is not a revision of the base protocol; it is the use the original specification was designed to permit.
The same is true for Bitcoin’s design intent. Reserved opcodes in Bitcoin Script were left undefined for later population. The protocol was built with extension points that future use could fill in without revising the base. Lightning Network, sidechains, RGB protocols, Taproot’s expansion of script flexibility through reserved version fields — these are application-layer innovations that operate without revising the consensus rules of UTXO construction.
What about the DAO? The DAO hard fork is not evidence that immutability fails under stress. It is evidence that Ethereum was never actually committed to immutability, and that this fact had downstream consequences. The hard fork did not just reverse one transaction. It established that the rule-changing coalition existed and was willing to act. After the DAO, every smart contract on Ethereum operates under the implicit knowledge that, given a sufficiently bad outcome, the coalition might fork again. That implicit knowledge is itself a tax on the system: it lowers the credibility of every commitment Ethereum’s smart contracts try to make. The DAO fork did not save the protocol from a stress test of immutability — it told us that this particular protocol’s claim to immutability had never been load-bearing in the first place.
The “emergency” framing presupposes that emergencies are rare exceptions. But “emergency” is not a category that lives outside the rule system; it is a status that some authority claims for some situation. Once an emergency-fork precedent exists, every subsequent contested situation becomes a potential emergency. The question shifts from “what does the protocol say?” to “is this bad enough to invoke the emergency procedure?” Carl Schmitt understood this in 1922 when he wrote that “sovereign is he who decides on the exception.” The whole point of constitutional design is to remove that decision from any single sovereign and make the determination of “exception” itself a constrained process. A blockchain protocol with a fork-on-emergency norm has Schmittian sovereignty embedded in its governance, even if the embedding is informal.
The right comparison is to legal systems with strong constitutional commitments. The U.S. Constitution allows for amendment, but the amendment threshold is high enough that ordinary politics cannot reach it. The result is that ordinary disputes are decided under stable rules, and constitutional change happens only when something approaching consensus exists. That is a high price for adaptability. It is also the price of credibility. Lower the price, and you lose the credibility too.
Protocol ossification is therefore a real risk only if you confuse base-layer stability with system-wide stagnation. They are not the same thing. The institutional pathway through which application-layer innovation operates — open development, multiple implementations, market-based adoption, extension points designed into the base — is what permits evolution above a stable foundation. Lose the foundation, and the whole edifice becomes negotiable. The choice is not between fixedness and adaptability. It is between adaptability above a fixed base and discretion all the way down.
Constitutional rot and client dominance
The second objection is harder to dismiss, because it does not contest immutability in principle but exposes what happens to immutability in practice.
Here is the constitutional rot argument. Even if the formal protocol specification does not change, the dominant implementation drifts. Bitcoin Core has held something approaching ninety-five percent of the node-software market for the entirety of Bitcoin’s existence. If Bitcoin Core makes a change to how it interprets the consensus rules — even a subtle one — that change is Bitcoin’s behaviour, regardless of what the whitepaper says. The protocol is whatever the dominant client does.
The same point applies in the legal-constitutional context. The U.S. Constitution’s text on commerce, equal protection, or executive power has been remarkably stable for a hundred and fifty years. What the Constitution means in practice has changed dramatically across that period, because the courts that interpret it have changed. The text is fixed. The interpretation is not. The interpretation is what you actually live under.
Apply this to Bitcoin and the implication is uncomfortable: Bitcoin’s “immutability” is a fiction. The maintainers of Bitcoin Core have de facto power to change the protocol; they have repeatedly used that power; the user base has consistently followed. SegWit’s activation in 2017 is the clearest example. The base layer was modified — the transaction-format change required all participants to interpret transactions differently — through a process that the dominant maintainer set controlled. The fact that this was framed as “soft” rather than “hard” does not matter for the institutional question. The maintainer set chose, the network adopted, and the rules changed.
This is constitutional rot. The text didn’t change; the institution that controls the text did the changing.
The critic concludes: there is no such thing as a fixed protocol; there is only a temporarily stable interpretation maintained by whoever controls the dominant implementation. Immutability is theatre.
This is the strongest of the three objections, and it is exactly correct as a description of what happened to Bitcoin. The error in the conclusion is treating Bitcoin’s history as proof that constitutional rot is unavoidable, rather than as evidence of what happens when an architecture fails to enforce the conditions that constitutional rot requires for prevention.
The conditions are not mysterious. They have been understood for centuries in legal-institutional design and for decades in distributed-systems engineering. Two are essential.
Multiple independent implementations. A protocol whose interpretation is determined by a single dominant implementation has no defence against drift in that implementation. A protocol implemented by multiple independent stacks, each developed by separate teams under separate institutional control, forces every implementation to remain wire-compatible with the others. If one implementation drifts, it stops interoperating; if it stops interoperating, users cannot use it without sacrificing connectivity. The institutional pathway disciplines individual implementations, and no implementation can declare an updated protocol and have it stick.
Disciplined extension through formal process, not coalition fiat. A protocol whose extensions are introduced by a process that requires multi-vendor agreement — like the IETF process for TCP/IP — builds in resistance to coalition capture. A protocol whose extensions can be merged into the dominant implementation by a small maintainer set, then propagated through that implementation’s market dominance, has no such resistance.
Bitcoin satisfies neither condition in practice. It has a dominant implementation. It has a small, identifiable maintainer set with effective control over what that implementation does. The maintainer set has been funded throughout much of its history by identifiable corporate sponsors — Blockstream first, Spiral and other grant programmes later — with commercial interests in particular protocol directions. The activation pathway for SegWit was designed specifically to be effective without requiring broad multi-vendor agreement, because broad multi-vendor agreement does not exist when there is essentially one vendor.
Compare this to TCP/IP. The Internet has multiple independent stacks: Linux’s kernel, the BSD family used by Apple and Sony PlayStation and much of embedded networking, Windows’ stack, the various proprietary stacks in routers and embedded devices, the increasingly capable stacks in language standard libraries. Each is developed by an independent team. None could unilaterally declare an updated TCP and have it stick. RFC 1122 only became real because it was adopted across implementations, not because one stack imposed it. ECN deployment took two decades and is still patchy because it required mutual implementation across the network.
The constitutional-rot objection is therefore not a refutation of the case for immutability. It is a specification of what immutability requires. A fixed text without independent implementations and disciplined extension processes is just a piece of paper. A fixed text with those institutional conditions is a constitution that operates.
This is also why Ethereum, despite the DAO fork, has actually achieved more credible base-layer constraint than Bitcoin in some respects. Ethereum has Geth, Nethermind, Besu, Erigon, Reth — multiple major independent execution clients, with conscious diversification supported by the Ethereum Foundation precisely because client monoculture is recognised as an institutional risk. No single client could unilaterally redefine consensus. Whether the Foundation’s social-layer authority compensates by providing equivalent coalition coordination is a separate and serious question; the answer is probably yes for major changes and probably no for emergency interventions outside the established roadmap. Bitcoin Core’s dominance is the architectural failure that makes Bitcoin’s “immutability” weaker than its rhetoric suggests.
The honest version of the case for set-in-stone protocols therefore has to admit a dependency. Base-layer fixedness as a credibility property is conditional on the institutional conditions that prevent constitutional rot. Without independent implementations, without disciplined extension, the formal text is whatever the dominant maintainer set says it is. With those conditions, the formal text is genuinely a constraint on what any individual actor can change.
The constitutional-rot critic and the set-in-stone proponent are therefore not really arguing about whether protocols can be fixed. They are arguing about which institutional arrangements are sufficient for fixedness to be more than rhetoric. That is a much more productive disagreement than the surface form suggests, because the institutional arrangements in question can be specified, observed, and assessed.
Discretion relocated, not eliminated
The third objection is the most philosophically pointed, and the one that most often comes from sophisticated political theorists rather than from blockchain insiders. It runs like this.
Suppose, generously, that you achieved actual base-layer fixedness. The wire format is fixed. Multiple independent implementations enforce it. No coalition can declare an updated protocol and have it stick. You have, by some non-trivial achievement, constructed a credible commitment device.
What have you eliminated?
You have not eliminated discretion. You have relocated it. Discretion now operates in a different place: in the off-chain processes that decide what software people run, in the courts that determine what protocols are legal, in the regulators who can compel onramps to refuse certain transactions, in the foundations that fund developers, in the corporate structures that control the most-used wallets, in the hosting providers, in the chip foundries, in the electricity utilities. The protocol may be set in stone, but the institutions surrounding the protocol — without which the protocol does nothing — remain very much subject to discretionary revision.
This is not a hypothetical. Look at the situation Bitcoin actually faces. The Bitcoin protocol may be relatively fixed (allowing for the constitutional-rot caveat above). But the institutions through which Bitcoin operates in practice — exchanges, custodians, on-ramps, off-ramps, mining pools, hosting providers, fiat-conversion services — are all subject to enormous discretionary control by states, regulators, and corporate actors. China can ban mining. The United States can sanction mixers. The EU can require KYC on every transfer over a threshold. Banks can refuse to serve crypto businesses. Cloud providers can refuse to host nodes. Domain registrars can pull DNS records of protocol websites. Bitcoin’s “rules” are stable; Bitcoin’s institutional environment is profoundly discretionary.
The critic concludes: immutability has not eliminated discretion; it has merely moved discretion to the surrounding institutions. So why bother with the immutability claim? Just acknowledge that you live in a regulated environment like everyone else.
This is a beautifully constructed objection because the empirical premise is correct. Discretion has been relocated. States, regulators, and corporate actors do exercise enormous discretion over what blockchain participants can do. To pretend otherwise is to mistake the protocol for the world.
But the conclusion is wrong. The objection treats relocation of discretion as if it were elimination of the case for immutability. It is not. It is a refinement of the case.
Here is the refined version. Constitutionalism never claimed to eliminate discretion. Constitutionalism claimed to relocate discretion to a different institutional layer where it operates under different constraints — slower, more public, more constrained by precedent, more vulnerable to political backlash, less able to produce surprise rule changes.
A constitutional democracy does not eliminate executive power. It locates executive power within a structure that requires legislative authorisation for major actions, judicial review for legal challenges, periodic elections for legitimacy, and multiple veto points for any radical change. The result is that discretion still exists — every day, in every government office — but the discretion operates against a backdrop of stable rules that the discretionary actors themselves cannot easily revise. A regulator who wants to ban a category of speech cannot do so by issuing a regulation; they have to navigate constitutional constraints, which are slow, public, contested, and limited.
The same logic applies to set-in-stone protocols. Yes, discretion still exists in the surrounding institutional environment. Regulators can sanction. Courts can rule. Foundations can fund. Exchanges can delist. But the discretion operates against a backdrop of fixed protocol rules that the discretionary actors cannot easily revise. A regulator who wants to change Bitcoin’s monetary policy cannot do so by issuing a regulation. They have to either change the institutional environment around Bitcoin, which is hard and politically visible, or convince Bitcoin’s maintainers to change the protocol, which is also hard, more institutionally visible, and limited by the broader community’s willingness to coordinate. They cannot just declare an updated Bitcoin and have it stick.
The relocation of discretion is therefore not a defeat for the constitutional argument. It is what the constitutional argument was always about. You don’t get to eliminate politics. You get to choose where politics operates and what constraints it operates under. A protocol with credible base-layer fixedness moves politics off the protocol layer and onto the surrounding institutional layers, where it is subject to the existing checks and balances of those layers — slow processes, legal challenge, public accountability, constituent pushback.
This also clarifies what blockchain constitutionalism is actually competing with. The competitor is not “no politics” — that has never been on offer. The competitor is unconstrained executive discretion at the protocol layer itself. A central bank can change monetary policy by fiat; a fixed-supply cryptocurrency cannot. A government can revise property rights through regulatory action; a fixed-rule UTXO ledger cannot have its property rights revised by the same kind of action, though the surrounding institutions can be regulated. The constitutional move is not to eliminate discretion. It is to remove a particular kind of discretion — the kind that operates at the protocol layer, capable of revising rules under which sunk investments were made — from the institutional toolkit available to powerful actors.
That is a real and important shift, even if it is smaller than the most enthusiastic immutability rhetoric claims. It does not produce a discretion-free zone. It produces a zone in which one specific kind of discretion has been institutionally constrained, while other kinds continue to operate under their own respective constraints.
The political-theory critic and the set-in-stone proponent therefore agree on more than the surface argument suggests. Both understand that politics is not going anywhere. Both understand that institutional design is about where politics operates and under what constraints. The disagreement is about whether moving the protocol layer out of the discretionary toolkit is a meaningful shift. The answer is that it is, conditional on the institutional surroundings actually being capable of holding the relocation — which loops back to the constitutional-rot question.
The geography of discretion
Each of the three objections, properly understood, is correct about something important.
The adaptive-governance critics are right that protocols cannot evolve through base-layer revision. They are wrong that this means protocols cannot evolve. Application-layer evolution above a fixed base is not only possible; it is the institutional achievement of the Internet, and it is what set-in-stone protocol proponents are actually trying to make possible. The objection is a clarification, not a refutation.
The constitutional-rot critics are right that a fixed text without disciplined institutional surroundings is rhetoric, not a constraint. They are wrong that this is unavoidable. The institutional conditions that prevent constitutional rot — multiple independent implementations, disciplined extension processes, the absence of any coalition with discretionary rule-changing authority — are not mysterious. They have been understood for a long time. The question is whether a given protocol satisfies them. The objection is a specification of what the case requires.
The discretion-relocation critics are right that immutability does not eliminate discretion; it relocates discretion to the surrounding institutions. They are wrong that this empties the constitutional claim. Constitutionalism has never been about eliminating discretion. It has been about locating discretion where it operates under constraints — slowly, with public visibility, and against a backdrop of stable rules that discretionary actors cannot easily revise. The objection is a refinement of the case, not a defeat of it.
What this means in practice is that the case for set-in-stone protocols has to be more careful than it usually is. It is not enough to say “the protocol is fixed.” The honest version of the case has to specify what is fixed, under what institutional conditions the fixedness operates as more than rhetoric, and what kinds of discretion the fixedness constrains as distinct from the kinds that continue to operate.
What is fixed: the wire format, the consensus rules, the ledger semantics — not the application layer, not the implementation set, not the surrounding institutional environment.
Under what institutional conditions: multiple independent implementations, disciplined extension through extension points the original specification provided for, the absence of any coalition with effective rule-changing authority over the deployed network.
What kinds of discretion are constrained: discretion at the protocol layer, of the kind a central bank exercises over monetary policy or a regulator exercises over property rights at the rule level. Not constrained: regulatory action against the surrounding institutions, social-layer pressure on developers, court rulings on legality, the geography of where you can run hardware, the law that governs your bank account.
This is a smaller claim than the rhetoric of “code is law” or “rules not rulers” suggests. It is also a more credible one, and one that is empirically testable. A protocol that satisfies the institutional conditions can support credible base-layer commitment. A protocol that doesn’t, can’t. The disagreement between proponents and critics is therefore not really about whether constitutionalism is a coherent ambition for blockchain. It is about which protocols, under which conditions, actually instantiate it.
That is exactly the right place for the disagreement to be. It transforms a rhetorical battle about whether immutability is “possible” or “desirable” into a technical and institutional question about which architectures, in which surrounding environments, with which governance structures, actually deliver the credibility property the constitutional analogy promises.
Bitcoin’s actual trajectory is informative. The protocol is fixed in some respects: the twenty-one million cap, the basic UTXO structure, the proof-of-work consensus mechanism. It is not fixed in others: transaction-format changes through soft forks, the SegWit pathway, the adoption of new opcodes through coalition action. The set-in-stone proponents who think Bitcoin’s protocol is uniformly immutable are wrong. The constitutional-rot critics who think Bitcoin’s “immutability” is purely rhetorical are also wrong. The honest description is that Bitcoin is partially fixed, partially mutable, with the boundary determined by the practical reach of the maintainer coalition. That is a description, not a verdict. Whether to count it as a constitutional success depends on what you compare it to. Compared to a central bank, Bitcoin has constrained an enormous amount of monetary discretion. Compared to TCP/IP, Bitcoin has substantially more residual maintainer power than a properly disciplined institutional pathway would allow. Both comparisons are informative, and both should be made.
The constitutional analogy is therefore neither vindicated nor refuted by the three objections. It is sharpened. It commits its defenders to specifying what they are claiming, what conditions are required, and what kinds of discretion remain in play. Those are the right commitments to be making. They turn a rhetorical claim into a research agenda — and a research agenda that any honest defender of set-in-stone protocols ought to welcome, because it is what would distinguish the genuine institutional achievements from the marketing.
The geography of discretion does not have a discretion-free zone marked on it. The constitutional question is which discretion you put where, and under what constraints. Get that question right, and the architecture follows. Get it wrong, and all the cryptography in the world won’t save you.