Legitimacy Without Self-Ratification

What makes a state transition legitimate when the system performing the transition can also modify the rules, evidence, memories, trust anchors, or verification procedures by which that transition will later be judged? This paper argues that reflexive computational systems face a problem of legitimacy distinct from correctness, security, integrity, or epistemic warrant. A transition may produce a correct result and nevertheless be unauthorized. It may be well-supported by evidence while lacking authority. It may preserve data integrity while changing the conditions under which integrity itself is defined. The central failure mode is self-ratification: the subject whose standing is in question supplies the decisive warrant by which that standing is conferred. We develop a substrate-independent account of this problem and a computational architecture for addressing it. For a protected reflexive transition, there must exist no supporting evidence set that is sufficient to confer decisive standing and lies entirely under the unilateral control of the subject whose standing is being adjudicated. We formalize this principle using antecedent authorization, threat-model-relative control, typed provenance, evidence ablation, standing ceilings, defeaters, constitutional epochs, non-retroactivity, governed amendment, congruence between declared and executable law, and replayable transition receipts. We show that anti-self-ratification is not sufficient in isolation: its guarantee is constitutionally closed only when the rules defining evidence, standing, amendment, and verification are themselves governed by antecedent law. The argument is interdisciplinary but not reductionist. Epistemic warrant, due process, legal validity, political legitimacy, constitutionalism, integrity, authorization logic, reference monitors, proof-carrying code, supply-chain provenance, transparency logs, Byzantine consensus, corrigibility, and constitutional AI are not synonyms. Rather, they exhibit a recurrent formal concern: power must not become sufficient evidence of its own rightful exercise. Their relation resembles Aristotelian focal meaning, or pros hen predication: distinct concepts retain distinct objects and failure conditions while exhibiting consilience around a shared semantic center. The source manuscript reports a reference implementation in which anti-self-ratification is an explicit, load-bearing invariant. Its reported release process distinguishes self-description from external ratification; its verifier boundary rejects self-certification as sufficient evidence of verifier trustworthiness; its executor is reported to prohibit promotion of solely executor-authored evidence to the highest standing class; and its history is reported to support defeasible standing without erasure. A naturally occurring defect is also reported to have exposed the importance of evidence beyond the system's own observation boundary. This candidate preserves those claims as author-reported implementation evidence. Replayability, independence, authority, and epistemic strength remain separate, and no report is upgraded without its exact artifact and custody chain. The paper also treats failures of the constitutional cure. A governance mechanism can fail by admitting what should be forbidden, but also by obstructing what its own law purports to permit. We therefore introduce governed liveness and governance proportionality, together with a two-lane architecture in which low-standing exploration remains cheap while high-standing acceptance receives full certification. The broader thesis is that legitimacy is not essentially political and constitutionalism is not merely metaphorical. Wherever a subject can change consequential state while also influencing the grounds on which that change is accepted, a legitimacy problem appears. Constitutional computing names an architectural response: power over state is subordinated to prior, inspectable, amendable, and independently checkable rules governing the provenance of authority. The present candidate does not infer empirical results from the protocol. The source reports execution of its conformance and mutation suite and independent replay of principal courts, but this integration pass did not recover the exact archives, court packages, command transcripts, or independently retained outputs required to re-establish those claims. Appendix C therefore preserves the reports while withholding independent-verification standing. The distinction is the theory functioning correctly.