The Machine That Refuses
Nobody left in the family reads Yiddish. Not the archivist whose great-grandparents wrote these letters, and not me — I am the friend who built the software.
That fact is the reason everything else in this project looks the way it does. It sounds like a limitation, and it is, but it is also a design constraint with unusually sharp consequences — because it means that when the software makes a mistake, there is no one to catch it.
Most systems that process written language can afford to be optimistic about their own output. If a search engine misreads a word, someone notices and complains. If a translation app garbles a sentence, the reader who speaks both languages spots it immediately. The error surfaces, and the system improves. That feedback loop is doing enormous quiet work, and you only see how much when it is missing.
Here that feedback loop is missing altogether. About a hundred and fifty letters, mostly handwritten in Yiddish, and nobody in the family can look at a transcription and say "that's wrong." A confident, fluent, completely incorrect reading would sit in the archive indefinitely, and the only signal that anything had gone wrong would be its absence — no complaint, no correction, nothing.
So the worst outcome here is not an unhelpful archive; it is a wrong one that reads as helpful.
That inverts the usual order of priorities in a way worth stating outright. Unhelpful is fine — genuinely fine, not a consolation. A page that says "we cannot read this word" is doing its job. A page that guesses and sounds sure is not, even if it guesses correctly, because you cannot tell the two apart from the outside.
What follows is how that principle got built into the software instead of merely believed by the people, and why it had to be.
Why a stance was not enough
The obvious approach to all of this is simply to be careful about it. Mark uncertainty, check things, do not overclaim. We did all of that from the beginning, and it was not enough, for a reason worth stating plainly.
Early on, every letter in the archive carried two independent English translations. When they agreed, we treated it as corroboration — two readers, same conclusion, probably right. That felt rigorous.
It was not corroboration at all, and the reason matters. Both translators were reading the same single Yiddish transcription. Neither had ever seen the handwriting. Two readers of one corrupt source can only ever agree with each other, and their agreement measures how stable that corruption is, not whether it is true.
The error here was not carelessness. It was a reasonable-looking check that measured the wrong thing, and it survived precisely because it produced the answer we expected. Careful people looking at their own work are not well positioned to notice that their instrument is pointed slightly to the left of the target.
That is the whole case for building the constraint into the machinery itself. A stance holds until you are tired, or in a hurry, or looking at something that confirms what you already thought. A refusal in code holds regardless.
Five boundaries, and what each one guarantees
A letter crosses five boundaries on its way to a reader, and the boundaries are the architecture. Each one is a different kind of artifact, in a different format, with a different rule about who may write to it.
- First, the photograph. A scan of the page, and the only thing in the system that cannot be wrong. Nothing in the pipeline ever writes to it — the source images are read-only by policy and by habit, because everything downstream is an interpretation of them and an interpretation that can edit its own evidence is worthless.
- Second, the machine transcription. Structured data, produced by handwriting models, and never edited by a person. If a reading is wrong, the answer is another reading, not a correction typed over the top. That is why the archive now holds four independent transcriptions of every Yiddish letter rather than one improved one.
- Third, the reading copy. This is the fold where a human enters, and it is deliberately a plain text file rather than a database record or a form — a document someone can open in any editor, read top to bottom, and change. It carries the machine's output, the evidence behind it, and a marked region where a person writes what they believe the letter says.
- Fourth, the registries. The people and places named across the archive, extracted from the reading copies and assembled into records. This is the layer that gets rebuilt most often, because it is almost entirely derived — and it is therefore the layer where a rebuild can do the most damage.
- Fifth, the page. Generated HTML, and nobody edits it, including us. An automated check physically refuses hand-edits to the built site, because a hand-edit there survives exactly until the next rebuild and then vanishes without a trace — which is worse than not being able to make it.
What matters is not the sequence but the seams. Each boundary is a place where the work changes medium, and every change of medium is a chance to check something.
The checks run in one direction only. Nothing downstream can rehabilitate what an earlier stage marked uncertain: if the transcription says a word is unreadable, the translation cannot quietly resolve it; if the reading copy brackets a name, the registry does not get a clean name out of it. Uncertainty moves forward and is never laundered on the way.
That is not what software usually does. The normal instinct at every stage is to produce the most useful output possible from whatever came in, and "most useful" almost always means "most complete" — filling the gap, picking the likelier reading, smoothing the seam. Each of those decisions is locally sensible and collectively catastrophic, because the gap-filling is invisible three stages later. All you see is a clean sentence.
Refusal is the default; writing is the exception
Concretely, that means almost nothing in this pipeline writes by default.
Every stage that can modify the archive runs in report-only mode unless explicitly told otherwise. There is no confirmation dialog and no undo, because neither is needed — the default run tells you what it would do and changes nothing. Writing requires a deliberate second invocation.
On top of that default, individual stages refuse specific things they can detect are wrong. The mention extractor will not re-process a letter it has already read, because doing so would append duplicates rather than replace. The registry builder will not rebuild from an input file it can tell is stale, and when it declines it names what would have been lost. A stage that folds citation quotes into the archive compares what it is about to write against what is already there, and if anything other than the intended field would change, it restores the file and stops. The corpus checker exits with an error when it finds a contradiction — a record citing a letter that does not exist — and pointedly does not repair it, because a contradiction is a question for a person.
There are twenty-seven of these refusal points in the pipeline at the time of writing. None of them were designed in advance. Every one was added after something went wrong, which makes the collection less an architecture than a scar record — though the effect is the same either way. The registry builder is the piece that needs the most ongoing care; it sits at the junction where machine-derived and hand-written content meet, and that junction is genuinely hard.
The cost of all this is real and worth naming plainly. A pipeline that refuses is a pipeline that sometimes stops when you would rather it continued, and the refusals are occasionally wrong about whether something is safe. That is the trade we made deliberately, because the alternative failure — writing something plausible and incorrect into an archive nobody can check — is not recoverable.
What can be rebuilt, and what cannot
Underneath all of it is one distinction that does more work than anything else here.
Everything the machine is capable of regenerating, it simply regenerates. Transcriptions, extracted mentions, the connections between people and letters, the pages themselves — all of it is derived, all of it can be thrown away and rebuilt from the scans and the source records. This is why the archive can be reprocessed as the tools improve. A better handwriting model arrives, and the whole corpus can be read again.
A small amount of content cannot be regenerated, because a person wrote it. A biography paragraph about a great-grandmother. A note explaining why a particular date is uncertain. A judgement that two differently-spelled names are the same man. Nothing in the pipeline can reconstruct those from the letters, because they are not in the letters — they are knowledge a human brought.
The seam between those two categories is the load-bearing idea in this whole system. A rebuild is free to discard anything derived and must preserve everything authored, and the software knows which is which — not from a list someone maintains, which would rot, but by determining what each stage is actually capable of producing. If no stage can produce a field, that field was written by a person, and a rebuild leaves it alone.
This is what makes the whole thing one system rather than two policies stapled together. The same seam that lets the machine rebuild freely is what protects the human's work from the rebuild. You cannot have the first without the second: a pipeline that can regenerate everything is a pipeline that can erase a year of human judgement in one run, and a pipeline that preserves everything cannot improve.
What the people promise
Half of this architecture constrains the people, not the software — and that half is a promise about where authored content is allowed to enter.
The reading copy is where authored content first enters this system. It is a working document per letter, and it has a specific shape: an editable region where a person approves or corrects the reading, and — below it, marked read-only — the evidence. The machine transcriptions, the competing readings, the confidence markers. All present, none of it the thing you are editing.
That arrangement is deliberate rather than a matter of convenience. The evidence is there so a decision can be informed, and structurally separated so a decision cannot be mistaken for evidence later.
When a person does make a call, it is recorded as a distinct kind of claim. A reading confirmed by a human carries a different marker than one the machine produced, and it carries who decided and on what basis. This matters more than it sounds: it means the archive can always answer "how do we know this?" with something better than "it is in the file." And it means a later process can tell the difference between something it may recalculate and something it may not.
The newest piece of this is a record of adjudications — a list of the places where two machine readings genuinely disagree, waiting for a human to rule. There are one thousand one hundred and eighty-eight of them at the moment. Most will never be settled, and that is not a failure; they are logged so that a ruling, once made, is recorded once and never asked again. The alternative is what we did before, which was to answer the same question every few months and forget we had answered it.
The tools, which are conversations
There is no admin interface, which tends to surprise technical readers. No forms, no dashboard, no content management system.
The human-facing tooling for this project is agentic and chat-based. An editor says "let's review letters" or "hide those Hannover postcards" in plain language, and a workflow takes over — one of about fifteen written for this project, each encoding a particular job. They are not a friendlier surface over the same machinery. They carry the contracts.
The letter review workflow is the clearest case of this pattern. It takes uncertain passages one at a time, requires a conscious keep-or-fix decision on each before moving to the next, and writes nothing at all until an explicit go-ahead. That is the same refusal-by-default posture as the pipeline, aimed at a person: no accidental bulk approval, no drifting through a list clicking accept.
A separate workflow lets an editor hide something from the public site by describing it — the postcards from a particular trip, the receipts from a particular year. What it does not do is delete. The item comes off the site and stays in the record, because an editorial decision about what to show should never be able to destroy the underlying material. The archive keeps everything; the website shows some of it; those are different questions and the tooling refuses to conflate them.
There is a browser-based editor for narrative prose, built so that someone who does not write code can adjust a chapter without touching a data file. It lowers the floor deliberately. It does not lower the standard — the edit lands in the same reviewed path as any other.
And then there is the one that relaxes the rules, which is the most interesting of them. A preview workflow lets you make an experimental change and look at it in a browser, skipping the test suite, skipping the commit, skipping everything. It exists because a system that only ever refuses is a system people learn to route around, and a workaround nobody admits to is far more dangerous than a sanctioned place to be wrong. Being able to try something badly, quickly, and throw it away is what makes the strict path tolerable — and therefore what makes people actually use it.
One letter, and what nearly happened to it
One letter from Montreal in 1901 exercises every refusal in this system at once.
One of the earliest letters, from Montreal in 1901, opens with a handwritten heading. The heading is in English — the writer wrote the place and date in Latin script before switching to Yiddish for the letter itself. The Yiddish handwriting model, which had been pointed at the page expecting Yiddish, read that English heading as Yiddish and produced gibberish.
Then the two translators went to work on that gibberish. Both of them read the gibberish, and both produced a plausible salutation from it — slightly different from each other, each perfectly reasonable-looking. Two independent readings, roughly in agreement. By the logic we started with, that is corroboration.
It was two guesses about noise.
What caught it was a person going back to the photograph of the page itself. Not the transcription, not at the translations — at the pixels. The heading says, in the writer's own English hand, "Dear Darling Dora."
The note recording this in the archive does something I would like to highlight, because it is the human contract working exactly as intended. It explains the misreading. It also documents that an earlier pass had removed the word "Darling" — on the mistaken grounds that the machine translations disagreed with it — and that this removal was itself the error. The correction is corrected, and the reasoning is preserved so the next person does not repeat the loop.
And it keeps one more thing, which a tidier archive would have quietly dropped. Dora was about twelve years old when this letter was written, which makes "Darling" an unusually warm form of address for a letter to a young cousin. That is surprising. It is also what the page says, and the note flags the surprise rather than resolving it away.
Neither half works alone
It would be easy to read all of this as a story about careful software, and that would miss the point.
A machine that refuses, with no human authorised to adjudicate, simply stops. Every uncertain passage becomes a permanent gap, the archive fills with brackets, and eventually someone reasonable decides the guards are more trouble than they are worth and turns them off.
A human contract with no machine enforcement behind it is a norm, and norms drift. Not through bad faith — through Tuesday afternoons, and deadlines, and the entirely ordinary human tendency to resolve an ambiguity in the direction you already suspect.
The two halves of this only ever work as a single thing. The software refuses and surfaces the question; a person answers it and the answer is recorded as a human judgement; the next rebuild preserves that answer and refuses again on everything still open. Each half covers the other's failure mode, and the seam between them — what can be regenerated, what cannot — is the same seam in both directions.
None of this makes the archive correct. It makes a particular failure — quietly wrong, confidently phrased, nobody able to check — structurally hard to produce. That is a weaker claim than accuracy and a more honest one. There are certainly errors in this archive. What we have tried to build is a system in which they are visible as errors, rather than as clean sentences that happen not to be true.