You Think Your Legacy Is Bad? The Law Has Been in Production Since 1215

There’s a particular face a developer makes when they first open a codebase older than their career. You know the one. It’s the face of a person realising that the thing they’ve been asked to “just make a small change to” is not a system but a crime scene — forty years of decisions, each one made by someone who has since left the company, died, or entered witness protection. Nothing is documented. Everything is load-bearing. There is a function called temp_fix_v3_FINAL_use_this_one and it is called in production four thousand times a day.

And in that moment the developer thinks, with the wounded pride of a person who believes their suffering is unique: nobody else has to deal with anything this insane.

I have bad news, and it comes wearing a wig.

Because there is a profession that has been maintaining the same codebase, without version control, without a staging environment, without the ability to roll anything back, deployed continuously onto a production environment of several hundred million live users, for — depending on where you start counting — somewhere between eight hundred and several thousand years. That profession is law. And every single anti-pattern you have ever cursed at four in the morning has a legal twin. The law didn’t copy you. You’re both just running the same bug, because you’re both the same kind of system: layers of locally-reasonable decisions, accreting faster than anyone is willing to remove them.

Let me give you five. I have receipts for all of them, which is more than I can say for temp_fix_v3.

1. The Hack: EU jam law, or // carrot is fruit, trust me

You may already know this one, because for a while it enjoyed a glittering second career as evidence. Specifically, evidence — beloved of a certain kind of Eurosceptic — that the bureaucrats of Brussels had finally, conclusively let go of the handrail marked logic and gone tumbling into the abyss. They passed a law declaring that carrots are fruit. Point, laugh, share, retire. What more do you need to know about who’s running the continent?

The bad news, for anyone hoping to keep enjoying that story, is that it’s only true on the surface. The reality is worse — not because it’s more insane, but because it’s less. There’s no madness here to enjoy. There’s just an engineering shortcut you have personally shipped, wearing a nicer suit.

Somewhere in Brussels there is a law that defines jam. It has to, because “jam” is a protected commercial term, and the whole point of a single market is that a jar labelled jam means the same thing whether you buy it in Lisbon or Lublin. Fine. Reasonable. The kind of boring harmonisation that makes a continent work.

Council Directive 2001/113/EC duly lays it down: jam is a gelled mixture of sugars, water, and the pulp or purée of fruit. Clean definition. One required input type: Fruit.

There is, of course, a problem. Portugal makes carrot jam. Has done for generations. And a carrot, by any definition a sane person would accept before 9am, is not a fruit. So the law, faced with a beloved traditional product that fails type-checking, does what every engineer under deadline pressure has done since the invention of the deadline. It does not fix the type system. It writes an exception. Annex I, and I am quoting the actual directive here: “tomatoes, the edible parts of rhubarb stalks, carrots, sweet potatoes, cucumbers, pumpkins, melons and water-melons are considered to be fruit.”

Considered to be fruit. By decree. Because the alternative was telling Portugal its jam is now illegal, and nobody in the history of the European project has ever won that argument.

This is if (product == "carrot jam") return VALID; and you know it. It is a // HACK comment made flesh, or rather made carrot. The definition wasn’t broadened because someone had a botanical epiphany. It was broadened because one edge case needed to pass validation and rewriting the contract was more expensive than smuggling in an exception.

But here’s the part that elevates this from a mere hack to a genuine work of art. Look at that list again. Really look at it. Because half of it isn’t a hack at all — it’s a bug fix the legislator didn’t realise they were shipping.

Tomatoes are fruit. Botanically, unarguably: a tomato is the ripened ovary of a flowering plant, seeds and all. So are cucumbers. So are pumpkins. So are melons and watermelons — textbook berries, technically. When the directive “considers” these to be fruit, it is not bending reality. It is correcting its own earlier misclassification. That’s a legitimate // actually these WERE always fruit, our schema was wrong.

Carrots, though? Root. Sweet potatoes? Tuber. Rhubarb? Leaf stalk, and a mildly poisonous one at that. Those three are pure hack — things with no fruit-like properties whatsoever, waved through solely because somebody, somewhere, makes jam out of them and the law would rather lie than pick a fight with tradition.

And the directive puts both categories in the same sentence, under the same clause, with the same four words: considered to be fruit. A real correction and a naked workaround, committed together, under one message, indistinguishable to anyone reading the code afterwards. This is the single most relatable thing a legal document has ever done. It is every git commit titled “fix fruit validation” that contains one honest bugfix and one shameful workaround, squashed into a single blameless line, so that the next maintainer who comes along has no way on God’s earth of knowing which part they’re allowed to touch. The intent is gone. git blame gives you one author and one date for two completely different sins.

The tomato deserved to be there. The carrot bought its way in. And now they’re roommates forever.

And lest you think this is a uniquely European species of madness: the EU was late to the game. The pattern of a legal system overriding biology because the money said so is decades older, and America got there first — in both directions. In 1947, the US Customs Court ruled that rhubarb — botanically a vegetable, since the edible part is a leaf stalk — was, for tariff purposes, a fruit. Not because anyone had a botanical change of heart, but because imported vegetables were taxed at 50% and fruit at 35%, and an importer of Canadian rhubarb quite reasonably preferred the smaller number. The court’s logic: rhubarb is eaten as a dessert, in pies, with cream — so, functionally, fruit. Classified accordingly. Duty reduced. // reclassify: cheaper this way.

And the precedent it leaned on runs the exact same play in reverse. Back in 1893, in Nix v. Hedden, the US Supreme Court had ruled that the tomato — botanically, incontrovertibly a fruit — was legally a vegetable for tariff purposes, because you eat it with dinner rather than for pudding. So the same legal system, applying the same “it’s about how you use it, not what it is” logic, demoted the tomato from fruit to vegetable in 1893 and promoted rhubarb from vegetable to fruit in 1947 — in opposite directions, each time landing on whichever answer happened to cost less. Which means that at this very moment the humble tomato is legally a fruit under an EU jam directive and legally a vegetable under US customs law: same plant, two jurisdictions, two contradictory legal types, neither of them botanical, both of them optimised for a completely different objective function. The law was never storing what a tomato is. It was storing what a tomato is for — and different systems wanted it for different things.

2. The Copy-Paste Hell: Japan and the immortal floppy disk

Every codebase has a magic value that got copy-pasted instead of defined once. You know how it goes. Somebody hard-codes 22 in one place, and because pasting is easier than thinking, that 22 breeds. It shows up in another file, then forty more, and by the time anyone wants to change it, the value isn’t a constant, it’s a diaspora.

Japan did this. With floppy disks. At the scale of a nation-state.

For decades, Japanese administrative regulations didn’t refer to some abstract concept of “a storage medium the citizen submits data on.” That would have been sensible, and would have required someone to define the abstraction once and reference it everywhere. Instead, individual regulations — written across ministries, across decades, each one locally reasonable at the time — simply specified the physical medium directly. Submit it on a floppy disk. Or a CD-ROM, because at various points those were the modern choice and the law faithfully hard-coded whatever was modern that year.

The magic value spread. And it kept spreading, until removing it meant not editing one definition but hunting down every single instance, one by one, across the entire body of Japanese law.

We know the number, because in 2024 they finished the job and someone counted. According to Japan’s own Digital Agency, the final regulation — one governing how automotive recyclers store records — was scrapped in June 2024, and it was the last of its kind, following the earlier scrapping of 1,033 similar regulations. One thousand and thirty-four separate places where the same dead assumption had been pasted. Nobody DRY-ed it. Nobody ever wrote const STORAGE_MEDIUM. They just typed “floppy disk” one thousand and thirty-four times over thirty years and hoped.

And the punchline that will feel familiar to anyone who has ever tried to delete something in a large organisation: the last one was delayed. Not for technical reasons — the technical reason is “stop requiring a floppy disk,” which took roughly zero seconds to understand. It was delayed because the government needed additional time to formally recognise that a legal revision was even necessary, and then had to run a public comment period and amend the relevant ministerial ordinance. Deleting one dead line required a full legislative cycle with stakeholder review. Somewhere, a Japanese civil servant filed the world’s most bureaucratic pull request to remove a console.log, and it took the better part of a year to merge — and that was just the last line. Clearing the whole thousand-strong diaspora had already been grinding on for years before it, which is roughly the pace at which any large organisation runs acceptance tests on a change nobody wanted to make in the first place.

3. The Breaking Change: the UK Companies Act 2006 recompiles the country

The first two are cheap. A hack is one bad line; a copy-pasted constant is a tedious find-and-replace. Annoying, survivable. Now we get to the one that keeps senior engineers awake: the breaking change to a core interface that half the system quietly depends on and nobody has an accurate list of.

In 2006, the United Kingdom decided to modernise company law. Sensible goal. The Companies Act 2006 was the largest piece of legislation in British parliamentary history, and it did what refactors do — it didn’t just change values, it changed concepts. It redefined who counts as a qualified auditor. It abolished the requirement for private companies to hold an Annual General Meeting or to have a company secretary at all.

Read that last sentence as an engineer and your stomach should drop. They didn’t change a number. They deleted methods from the base class. holdAGM() — gone. companySecretary — no longer guaranteed to exist. Every other law in the entire statute book that had ever assumed those things existed was now, in effect, calling a method that had been removed. Every one of them stopped compiling.

So Parliament had to do a full-codebase recompile, and the way you find out how bad your coupling is, is exactly this moment — the moment you change the interface and wait to see what screams. Parliament issued a separate instrument just to clean up the wreckage: the Companies Act 2006 (Consequential Amendments etc.) Order 2008. And when ministers explained its scope on the record, the dependency graph came into focus. Around fifty Acts needed amending purely because they referenced the old definition of a qualified auditor. Around a hundred more pieces of primary legislation needed updating because they referred to concepts or definitions from the old Companies Acts of 1985 and 1989.

A hundred and fifty callers. From one interface change.

And they were the known callers. The real horror of coupling is the import you’d forgotten about — the module three directories over that quietly depends on your code and that nobody remembers until the build turns red. The dependency graph here reached places that would make you laugh out loud. The Harbours Act 1964 needed amending. Harbours. But the crown jewel, the caller that time forgot, sat at the very top of the 2009 clean-up order’s schedule: the Newspaper Libel and Registration Act 1881.

Eighteen eighty-one. A reform passed in the age of the smartphone reached back through a hundred and twenty-eight years to break a Victorian statute about newspaper proprietors, because that statute happened to import a concept the 2006 Act had just changed. Somewhere in the codebase of the British state, a function written when Gladstone was Prime Minister threw a compile error because of a commit from the Blair years.

And of course — of course — one pass wasn’t enough. There was the 2008 order, then another consequential amendments order in 2009, then another in 2011. Five years of follow-up commits, each one fixing the callers that the previous cleanup missed, because in a system that large you never actually find them all; you just find the ones that scream loudest, ship the fix, and wait for the next batch.

Oh, and the Newspaper Libel Act? In 2009 they didn’t even delete the broken part. They just patched the wording so it referenced the new Act instead of the old one. The dead code — a registry of newspaper proprietors that almost nobody used because virtually every newspaper is now a registered company — sat there, patched but pointless, until the Deregulation Act 2015 finally worked up the nerve to git rm it. A hundred and thirty-four years after it was written. Six years after anyone last touched it. That’s not a statute. That’s the // deprecated — DO NOT USE block that outlives three tech leads because deleting it feels scarier than leaving it.

4. The Adapter Pattern: how Europe changed its currency without a hundred and fifty amendments

At this point you may have concluded that law is simply incapable of a clean migration, that the state is doomed to recompile itself one screaming caller at a time forever. So in fairness, let me show you the one time somebody read the manual.

When most of Europe switched to the euro, it faced a coupling problem that made the Companies Act look like a typo. It wasn’t fifty laws or a hundred and fifty. It was every contract, every statute, every pension, every mortgage, every price, every legal instrument denominated in every national currency across a dozen countries, all of which hard-referenced francs and marks and lira. If they’d done it the Companies Act way — amend each caller individually — they would still be doing it now, and your grandchildren would inherit the ticket.

They didn’t. Somebody, mercifully, thought about the abstraction first.

Council Regulation (EC) No 1103/97 established a principle it called continuity of contract, which is the single most beautiful adapter pattern ever deployed at continental scale. The regulation said, in effect: every existing reference to a national currency is henceforth to be read as a reference to the euro, converted at a fixed, legally mandated rate, and this changes the value of nothing. Your contract in Deutschmarks is now a contract in euros. You don’t renegotiate it. You don’t amend it. You don’t even reprint it. The old references still resolve — they just resolve through a translation layer now.

That is class EuroAdapter implements LegacyCurrency. They did not rewrite a hundred million callers. They wrote one shim that made every old call site keep working against the new backend, guaranteed by law that nothing downstream would notice, and went home. The Deutschmark contract from 1994 still runs. It’s just running on the euro now, through an adapter, exactly the way your ancient client code still runs against the v2 API because someone was kind enough to leave a compatibility layer in place.

The Companies Act and the euro are the same problem — a core concept changed underneath a mountain of dependent code — solved two opposite ways. One recompiled the entire codebase by hand over five years and is arguably still finding callers. The other wrote an adapter in a single regulation and was done. The difference wasn’t competence or budget. It was whether somebody thought about the interface before the migration instead of during it. If that doesn’t sound like the difference between your best and worst refactor, you haven’t done enough of them.

5. The API Contract Change: Poland raises VAT by one point, and every integrator pays

Which brings us home, to the one that every developer who has ever shipped an API other people depend on will feel in their spine.

On 1 January 2011, Poland raised its standard VAT rate from 22% to 23%. One point. The change to the law itself is a single digit — you could express it in a diff so small it wouldn’t survive code review as a standalone commit. - 22 + 23. Done.

Except of course it wasn’t done, because you don’t own the integrations. The moment you change your API contract, everyone who consumes it has to change too, and their pain is not visible from your side of the boundary. That 22 was hard-coded into every accounting system, every cash register, every invoicing template, every long-term contract with a price baked in, every downstream piece of software written by someone who reasonably assumed the standard rate was a stable fact about the universe. The one-point change to the law triggered a sprawl of transitional provisions spread across several separate statutes, just to define what happens to a service invoiced in December but delivered in January. Your customers spent a quarter absorbing your one-character diff.

And here is the detail that will make every reader of this blog wince in recognition, because it is your own hard-coded value coming back to bill you. Buried in the implementing regulations sat rebate calculations that some earlier drafter had computed against the literal number 22 — because why wouldn’t you, 22 had been the rate since forever, 22 was considered as solid as twelve months in a year. So when 22 became 23, that hard-coded assumption shattered, and rather than express the thing as a formula, the fix was to manually enumerate the future: a table specifying the rebate for a 23% rate, and a 24% rate, and a 25% rate. An if (rate == 23) … else if (rate == 24) … else if (rate == 25) block, written into a legal instrument, by someone who had learned the hard way that the “constant” wasn’t constant and was now defensively hard-coding the next three hypothetical values instead of just writing the equation. Technical debt, incurred by a legislator in some earlier decade who wrote a magic number instead of a reference, and paid off — with interest — by whoever was on call in 2010.

And then, the final gift. The increase was announced as temporary. It arrived dressed as crisis response — the 2008 financial crisis had blown a hole in the public finances, and the politicians of the day swore, hands on hearts, that the extra point was an emergency measure for two, maybe three years. The higher rate would sunset at the end of 2013 and revert automatically to 22%. The law literally contained the rollback.

For a while they renewed it by hand, the honest way: an amendment in 2013 pushing the sunset to 2016, another in 2016 pushing it to 2018 — the legislative equivalent of bumping the // TODO: remove date every year and quietly re-shipping. But manual renewal is tedious, and eventually somebody had a better idea. In 2018 they stopped hard-coding a date at all and replaced it with a condition: the rate would revert to 22% once certain public-debt and deficit ratios improved to a specified level. Which is a magnificent move, because now the flag doesn’t expire on a date you have to keep pushing — it expires when a metric hits a threshold that you have quietly set where you’re confident it will never land. if (debt_to_GDP < threshold) revert();, written by someone who has seen the debt-to-GDP figure and knows exactly how safe that if is.

And then, in 2022, they topped even that. They re-pegged the whole thing to defence spending — the elevated rate now stays in force until defence expenditure falls back below 3% of GDP. With a war on the other side of the border. They didn’t just choose a condition unlikely to be met; they migrated the condition onto a variable practically guaranteed to move the wrong way. It is now 2026, the rate is still 23%, and Poland is still, patiently, waiting for the 22% it was promised in 2011.

If you’ve ever watched a // TODO: fix after release survive from the release it referenced to the heat death of the product, you already know how this works. The flag never expires on its own. There is always one more reason to keep it just a little longer — one more crisis, one more quarter, one more “we’ll clean it up right after this, promise” from someone whose job is to ship the next thing, not to pay down the last one. The budget is the PM here, wandering over every couple of years with a fresh just until we hit this one target and a face that says it’s temporary this time, honestly. Fifteen years of “just until.”

That is a feature flag named TEMP_higher_rate, // TODO: remove before 2013, still in main fifteen years later — except they’ve been through three separate strategies for keeping it there. First they bumped the expiry date by hand every couple of years. Then they replaced the date with a runtime condition they were sure would never evaluate true. Then, when that started looking uncomfortably plausible, they swapped the condition for a different one that definitely won’t. The temporary behaviour didn’t become load-bearing by accident. Somebody re-architects its excuse every few years, specifically so it never has to be switched off.

Your // TODO: remove this is not a note to your future self. It is, as this proves, a permanent architectural decision you simply haven’t admitted to yet.

git blame on the year 1215

And when I said, up in the title, that this codebase has been in production since 1215, I wasn’t reaching for a metaphor. I was being literal, and slightly conservative.

Three clauses of Magna Carta are still live law in England and Wales today — over eight centuries after a cornered King John pressed his seal into the parchment at Runnymede to stop his own barons killing him. Not as a museum piece, not as inspirational quotation: as enforceable statute you could in principle cite in a courtroom. The freedom of the English Church, the ancient liberties of the City of London, and the promise that justice will not be sold, denied, or delayed — all still on the books.

And the way they got there is, of course, the exact story I’ve been telling for two thousand words. The original 1215 charter was reverted almost immediately — annulled by the Pope inside ten weeks. The surviving text is technically the 1297 reissue: the same core clauses, redeployed under a new version number after the first release was rolled back. And of the original sixty-three clauses, sixty are gone — stripped out one Statute Law Revision Act at a time across the nineteenth and twentieth centuries, a centuries-long git rm campaign to delete the dead code about fish-weirs and the treatment of Welsh hostages, leaving only the handful of lines that still compile. The oldest working code in the British legal system is a 1297 redeploy of a 1215 release, patched and pruned for seven hundred years, still serving requests.

That, right there, is every rule I’ve described in this post, running at once, in a single document, for eight hundred years.

And here’s the thing I actually want you to take away, because I promise this wasn’t two thousand words of pointing and laughing at lawyers. (Though I’ll confess: somewhere around the discovery that a 2006 statute broke an 1881 one, I did smile. More than once.) The point was never that law is uniquely broken, or badly architected, or run by fools. The point is the opposite. Every one of these patterns — the hack welded to a bug fix, the copy-pasted constant, the breaking change that recompiles the world, the adapter that saves you, the temporary flag that outlives its authors — is not a law thing. It’s a property of any sufficiently old system that real people depend on and nobody is allowed to switch off. I reached for statutes because the receipts are public and the timescales are absurd enough to be funny. But I could have written the identical essay about the layout of cities, or the borders of nations, or the irregular verbs of a living language, or the wiring of a body, or the API you shipped in 2019 and are still supporting. Same forces. Same accretion. Same graveyard of temporary decisions that quietly became load-bearing.

The very old, very crowded club

So. Back to our developer, still standing there, making the face, mourning their forty-year-old system as though it were the loneliest suffering in the world.

Here’s what I’d tell them. Your legacy system is forty years old, undocumented, and terrifying. The law is a legacy system that in places is eight hundred years old, has no test environment, deploys every change straight to a production population of tens of millions of people, cannot be rolled back, and is maintained by people who are not allowed to just decide something is dumb and delete it. It has hacks welded to bug fixes under a single commit message. It has magic values pasted a thousand times. It has breaking changes that recompiled entire countries and still missed callers on the fifth pass. It has adapters written by geniuses and temporary flags left in by cowards. It has dead code from 1881 that nobody dared remove until 2015, and live code from 1215 that has outlasted every person who ever complained about it.

And it works. Not because it’s clean — it is the opposite of clean — but for exactly the reason your ancient system works. Because a very large number of people learned to live with its quirks, to route around its broken parts, and to feel, standing in front of that one statute nobody understands, precisely the dread you feel standing in front of the cronjob nobody understands.

You are not uniquely cursed. You are not even unusually cursed. You are a junior member of the oldest maintenance team on Earth, and the senior members have been dealing with temp_fix_v3_FINAL since before your programming language’s grandparents were invented.

So the next time you open a file that makes you want to walk into the sea, take some comfort: somewhere, right now, a lawyer is reading a sentence written in 1215, feeling exactly what you’re feeling, and wondering who on earth thought carrots were fruit.

P.S. — Yes, tomatoes are berries and so, botanically, are bananas and watermelons, and no, this does not mean a fruit salad is legally a smoothie.