Good morning. Grab a coffee — it's a Saturday and there's a lot to unpack.

The biggest story of the week landed late on Thursday: the US Supreme Court struck down Trump's global tariffs, 6-3. Chief Justice Roberts wrote the majority opinion, finding that the International Emergency Economic Powers Act simply does not give the President authority to impose tariffs. "He must point to clear congressional authorization," Roberts wrote. "He cannot." Three of Trump's own appointees — Gorsuch, Barrett, and Roberts himself — ruled against him. This is the most significant check on presidential power since Youngstown Steel. The fallout is enormous: the Penn Wharton Budget Model estimates $175 billion in collected tariffs may now need to be refunded. Trade deals negotiated under the threat of those tariffs are in limbo. And Trump's response? He immediately announced new tariffs under a different legal authority. Constitutional whack-a-mole. Markets on Monday should be interesting.

Closer to home, something happened this week that hasn't happened in roughly four hundred years: a senior member of the British royal family was arrested. Thames Valley Police arrived at Wood Farm on the Sandringham estate at 8am on Wednesday — Andrew's 66th birthday — with six unmarked vehicles. The charge isn't what most people expected. It's not sexual misconduct. It's misconduct in public office — specifically, sharing confidential government information with Jeffrey Epstein during Andrew's time as a British trade envoy. The evidence came from newly released US Department of Justice files. He was released under investigation; police also searched Royal Lodge in Windsor. King Charles's statement was devastating in its simplicity: "The law must take its course." Keir Starmer echoed it: "Nobody is above the law." The misconduct-in-public-office charge is actually more constitutionally serious than what people anticipated. It carries a maximum sentence of life imprisonment.

In the world of AI infrastructure, the most important story of the week quietly dropped on GitHub. Georgi Gerganov and the ggml.ai team — the people behind llama.cpp — are joining Hugging Face. If you don't know what llama.cpp is, it's the invisible layer that makes running AI models on your own hardware possible. It's to local AI what Linux is to servers. The framing is "joining" rather than "acquisition," and Georgi stays in charge with the same community governance. But the real signal is in the technical roadmap: they want GGUF to become the canonical format for local deployment, with single-click integration into Hugging Face's transformers library. Hugging Face is buying the inference standard. That's smart. Whether it's good for the ecosystem depends on whether HF stays true to its open-source commitments. The centralisation risk is worth watching.

Speaking of platforms and their trajectories — someone logged into Facebook for the first time in eight years this week and wrote about what they found. It went viral on Hacker News with 771 points. What they described is grim: a News Feed that's wall-to-wall AI-generated thirst traps, engagement bait, and slop. The only organic content was from a page they'd followed years ago. Meta's own AI assistant was suggesting questions about the women in the generated images — things like "Why is she wearing pink heels? What is her personality?" The author stopped scrolling when they encountered AI-generated images of girls who looked about fourteen. This is Facebook's AOL moment — the point where the platform's decay becomes visible even to someone who just wandered back after nearly a decade. The AI slop isn't a bug. It is the product. Meta is optimising for engagement, and AI-generated content aimed at lonely people is what engages.

Wikipedia made a consequential decision this week: they're blacklisting Archive.today. All of it — archive.is, archive.ph, every mirror domain. The reason is extraordinary. The archive site's operator directed a DDoS attack against a blogger who'd investigated their identity, and — far worse — altered the content of archived pages to insert that blogger's name. An archive that alters its archives is an archive that cannot be trusted. Wikipedia has 695,000 links across 400,000 pages pointing to Archive.today. All of them need to go. The cleanup will be massive. The FBI had already subpoenaed the operator's ISP. There's a lesson here about infrastructure: a single anonymous operator with god-mode over the archive is a design flaw. Decentralisation matters for preservation, not just for money.

A lighter story, but one that captures something important about the state of security culture. A diving instructor — who also happens to be a platform engineer — discovered a catastrophic vulnerability in a major diving insurer's member portal while on a trip to Cocos Island. The system used sequential numeric IDs and a shared default password. No rate limiting. No lockout. No MFA. Anyone could access any member's full profile, including children's personal data. He did everything by the book: contacted Malta's national CSIRT, gave a 30-day embargo, offered to help. The organisation's response? They acknowledged the bug, started fixing it, then sent a lawyer threatening criminal prosecution and demanding he sign a same-day NDA. An NDA which itself contained a clause requiring him to keep the NDA confidential — an NDA about the NDA. He refused to sign. He waited eight months past his embargo before publishing. Sequential IDs and default passwords protecting children's data in 2025 is malpractice, and threatening the person who found it is cowardice.

On the Bitcoin protocol front, Optech Newsletter 393 dropped this week with a couple of things worth knowing about. Anthony Towns published an analysis of OP_RETURN usage since Bitcoin Core v30.0 relaxed mempool policy limits back in mid-2025. The sky, it turns out, did not fall. Across blocks 915,800 to 936,000 — roughly 20,000 blocks — only 61 transactions used multiple OP_RETURN outputs, and only 396 exceeded the old 83-byte limit. Total data stored via OP_RETURN across that entire period: 474 megabytes, with the larger outputs accounting for just 0.44%. The debate over relaxing those limits was fierce at the time. The data suggests it was the right call.

The sleeper Bitcoin story is Misha Komarov's PIPEs v2 proposal. It's a protocol that enables covenant-like spending conditions without any consensus changes. The mechanism is clever: encrypt a private key behind a spending condition using witness encryption. If the condition is met, the key is revealed and produces a valid schnorr signature. All the conditional logic happens off-chain while Bitcoin only validates a single signature. If this works at scale, it could make the entire covenant debate — CTV, TEMPLATEHASH, the lot — somewhat academic by routing around it entirely. That's a big "if," but the approach is genuinely novel. Meanwhile, quantum resistance discussions continue across Delving Bitcoin and the mailing list, with Chaincode Labs publishing the most rigorous treatment yet of migration approaches. The consensus remains "not yet a threat, but we should be building the escape hatches now."

Have a good weekend. Try to enjoy the quiet before whatever Monday brings.

[1] Supreme Court tariff ruling — multiple sources via Ground News (580 sources)

[2] Prince Andrew arrest — multiple sources via Ground News (300+ sources)

[3] ggml.ai joins Hugging Face — https://github.com/ggml-org/llama.cpp/discussions/19759

[4] "Facebook is absolutely cooked" — https://pilk.website/3/facebook-is-absolutely-cooked

[5] Wikipedia blacklists Archive.today — https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-archive-today-after-site-executed-ddos-and-altered-web-captures/

[6] "I found a Vulnerability. They found a Lawyer." — https://dixken.de/blog/i-found-a-vulnerability-they-found-a-lawyer

[7] Bitcoin Optech Newsletter #393 — https://bitcoinops.org/en/newsletters/2026/02/20/

[8] Bitcoin PIPEs v2 — referenced in Optech #393

[9] Cluster mempool SFL cost model — https://github.com/bitcoin/bitcoin/pull/34616