Abstract. Platform decay is not an accident; it is a strategy with known moves: gate features behind accounts, move value behind paywalls, raise switching costs, measure what users will tolerate, and betray them at the exit. We show that for a local-first GPLv3 application with no accounts, no vendor-operated servers, and no telemetry, every move in the playbook fails for lack of a mechanism of action.
1. Definitions
Definition 1 (Enshittification, after Doctorow). The lifecycle in which a platform is first good to its users, then reallocates value away from them — toward business customers, then shareholders — until it dies. Executing it requires three instruments: (a) a service the vendor operates between you and your data, (b) a switching cost that holds you still while the terms change, and (c) a metric that tells the vendor how much degradation you will tolerate.
Definition 2 (LokalBot). A macOS application licensed under GPLv3. Storage: Markdown files and SQLite in your home directory. Accounts: none. Telemetry: none. Servers operated by the vendor: none.
Theorem. LokalBot cannot be enshittified: no move in the standard degradation playbook has a mechanism of action against it.
2. Proof
By exhaustion of the playbook.
Lemma 1 — The login wall
To gate features behind an account, an account system must exist. LokalBot has none: there is no server that could check who you are, and no identity to check. The wall has nowhere to stand.∎
Lemma 2 — The feature ransom
Moving a free feature behind a paywall requires the vendor to operate that feature. Every LokalBot feature — transcription, summaries, search, autocomplete — executes on your CPU and Neural Engine, from a binary on your disk. We cannot repossess what we do not host.∎
Lemma 3 — The data hostage
Raising switching costs requires custody of your data. Your meetings are Markdown and SQLite under your own user account. The export feature is cp. Custody was never transferred, so it cannot be leveraged.∎
Lemma 4 — The tolerable-degradation experiment
Optimizing how much worse a product can get requires measurement. LokalBot ships no telemetry: no engagement metric exists, so no growth experiment can be run against you. You cannot A/B test what you cannot observe.∎
Lemma 5 — The acquisition betrayal
Suppose LokalBot is acquired by hostile management, or its author simply wakes up greedy. Any distributed build remains GPLv3: the poison must ship with its own antidote — complete source, fork rights included. The community keeps the last good version, forever, legally.∎
Lemma 6 — The investor gradient
Each lemma above could be attacked, given sufficient incentive to rebuild the application around a vendor-operated service. The usual source of that incentive is a board meeting. LokalBot has no investors, hence no board, hence no meeting in which you become the product.∎
Every known move fails for lack of a mechanism. The theorem holds. Q.E.D.
Corollary (the worst-deal guarantee). The build you download today is the worst deal LokalBot will ever offer you. With no mechanism to degrade, it can only stay the same or improve.
3. Threats to validity
An honest proof names its limits. Three things can still go wrong — none of them is enshittification, which is a strategy; these are entropy:
- Abandonment. The maintainer could vanish. The app keeps working offline, the source keeps building, and the GPL lets anyone continue it. Decay by neglect is possible; decay on purpose is not.
- Model hosts. First-use model downloads come from public hosts (Hugging Face, GitHub). A host could remove weights; once downloaded, they are cached locally and the app runs without further network access.
- The platform. Apple can change macOS APIs out from under any Mac app. See: entropy, above.
Could the author launch a paid cloud service tomorrow? Nothing prevents it — and nothing in it could reach into this app: features cannot be moved out (Lemma 2), your archive cannot be held (Lemma 3), and the GPL build remains forkable (Lemma 5).
4. Replication
Our results reproduce on any Apple Silicon Mac running macOS 15 or later: clone the repository, run xcodegen generate, and build. The entire method section is public. Peer review is welcome — if you find a mechanism this proof missed, open an issue; refutations are a contribution.