On the Formal Foundation of Boundary 4
A State-Space Proof That Non-Trivial Verification Gates
Converge to Trivial Machines Under Volume Saturation

Thorben Liebig
Cyber Resilience Architect
CISM, CRISC (ISACA Member 2226146)
ORCID: 0009-0006-2785-7911

May 16, 2026

Abstract

A companion paper derives Boundary 4, the requirement that the human’s decision at the verification gate must be real, from the structural condition of the human at the gate. This note provides the formal proof. The central result uses Von Foerster’s distinction between trivial and non-trivial machines. A human verification gate is a non-trivial machine: its output depends on an internal state that evolves with each evaluation. The gate produces genuine judgment when and only when the internal state is causally connected to the input. This note identifies three conditions under which the gate converges to a trivial machine (under rate saturation, domain mismatch, or constant-output equilibrium) and proves that under any of these conditions the gate converges to a trivial machine, producing constant output independent of input. The architectural conclusion is that the institutional setup must preserve the non-triviality of the human gate, and that this preservation imposes measurable constraints on assertion routing, gate staffing, and volume control.

The Problem

A companion paper derives Boundary 4 from the structural condition of the human at the verification gate. The derivation distinguishes two regimes: the Kantian-condition user, who could verify but did not because no protocol required it, and the Schopenhauerian-condition user, who could not verify, ever.¹ The requirement is that the institutional setup must preserve the condition under which the human at the gate exercises genuine judgment rather than ritualised approval.

This note makes the requirement precise using Von Foerster’s distinction between trivial and non-trivial machines.² The formal apparatus is a state-space model of the human gate, with convergence results showing when the gate degenerates from a non-trivial to a trivial machine.

Trivial and Non-Trivial Machines

Definition 1 (Trivial Machine). A trivial machine is a function $f:X \rightarrow Y$ where $X$ is the input space and $Y$ is the output space. The output depends only on the input. The machine has no internal state. Given the same input, it always produces the same output.

Definition 2 (Non-Trivial Machine). A non-trivial machine is a function $f:X \times S \rightarrow Y \times S$ where $S$ is an internal state space. The output depends on both the input and the internal state. The state evolves with each operation: the machine after processing input $x$ in state $s$ is in a new state $s'$. Given the same input but different states, the machine may produce different outputs.

Remark 3. Von Foerster’s original formulation uses the terms “trivial” and “non-trivial” without pejorative connotation. A trivial machine is analytically determinable: from observing its input-output pairs, its function can be reconstructed. A non-trivial machine is analytically indeterminable: from observing finitely many input-output pairs, its function cannot be reconstructed, because the unobserved internal state may change the mapping. Human judgment is a non-trivial machine operation. Rubber-stamping is a trivial machine operation.

The Human Verification Gate

Definition 4 (Human Verification Gate). Let $A$ be the set of assertions entering a verification architecture (as in the Boundary 1 paper), and let $\mathcal{D}$ be the partition of $A$ into assertion classes (as in the Boundary 3 paper). A human verification gate is a non-trivial machine $H:A \times S \rightarrow \{ + , - \} \times S$ where:

• $A$ is the set of assertions presented to the gate for evaluation;

• $(S,\rho)$ is a metric space of internal states of the human evaluator (comprising experience, attention, fatigue, domain knowledge, context from prior evaluations, and any other factor that conditions the judgment);

• $\{ + , - \}$ is the output space ($+$ = admitted, $-$ = rejected);

• On input $(a,s)$, the gate produces output $(y,s')$ where $y \in \{ + , - \}$ is the judgment and $s' \in S$ is the updated state.

The gate $H$ is one instantiation of the verification operation underlying the certification function $C$ of the Boundary 1 paper: when the verification procedure $v \in V$ is human review, $C(a,v)$ is computed by $H$.

Definition 5 (Causal Connection). The gate $H$ has a causal connection between input and judgment if the output $y$ depends on the input $a$. Formally: there exist $a_{1},a_{2} \in A$ and $s \in S$ such that $\pi_{1}\left( H\left( a_{1},s \right) \right) \neq \pi_{1}\left( H\left( a_{2},s \right) \right)$, where $\pi_{1}$ denotes projection onto the first component. The gate distinguishes between at least two inputs.

Definition 6 (State Update). The gate $H$ has a functioning state update if the state $s'$ depends on the input $a$. Formally: there exist $a_{1},a_{2} \in A$ and $s \in S$ such that $\pi_{2}\left( H\left( a_{1},s \right) \right) \neq \pi_{2}\left( H\left( a_{2},s \right) \right)$. The evaluator’s state after processing $a_{1}$ differs from the state after processing $a_{2}$.

Definition 7 (Non-Triviality). The gate $H$ is non-trivial if it has both causal connection and functioning state update. It is degenerate (trivially operating) if either is absent.

Three Degeneration Conditions

This section identifies three conditions under which a non-trivial gate degenerates. Each is stated as a formal condition on the gate’s parameters. The degeneration theorem (Section 5) proves that each condition independently causes convergence to trivial operation.

Condition 8 (Rate Saturation). Let $\lambda$ be the rate at which assertions arrive at the gate (assertions per unit time). Let $\mu(s)$ be the processing capacity of the evaluator in state $s$: the maximum rate at which the evaluator can maintain causal connection between input and judgment. Rate saturation holds when $\lambda > \mu(s)$ for the evaluator’s current state $s$.

Condition 9 (Domain Mismatch). Let $\mathcal{D}(s)\mathcal{\subseteq D}$ be the set of assertion classes for which the evaluator in state $s$ possesses sufficient domain knowledge to exercise genuine judgment. Domain mismatch holds when an assertion of class $d$ is routed to an evaluator in state $s$ with $d\mathcal{\notin D}(s)$.

Condition 10 (Constant-Output Equilibrium). The gate $H$ is in constant-output equilibrium if there exists $y^{*} \in \{ + , - \}$ and a state $s^{*}$ such that $\pi_{1}\left( H\left( a,s^{*} \right) \right) = y^{*}$ for all $a \in A$. The evaluator in state $s^{*}$ produces the same output regardless of input.

The Degeneration Theorem

Condition 11 (Default Disposition). An evaluator in a state $s$ where the state update has converged to the identity (the evaluator is no longer processing input content) produces a constant output $y^{*} \in \{ + , - \}$ independent of the input. That is: if $\pi_{2}\left( H(a,s) \right) = s$ for all $a \in A$, then there exists $y^{*}$ such that $\pi_{1}\left( H(a,s) \right) = y^{*}$ for all $a \in A$.

Lemma 12 (Rate Saturation Causes State Collapse). Under Condition 8, the state update function converges to the identity: $\pi_{2}\left( H(a,s) \right) \rightarrow s$ for all $a$.

Proof. When $\lambda > \mu(s)$, the evaluator cannot process each assertion with sufficient depth to update the internal state. Let $\Delta(a,s) = \rho\left( \pi_{2}\left( H(a,s) \right),\, s \right)$ be the state change induced by assertion $a$ in state $s$, measured in the metric $\rho$ on $S$. The processing depth per assertion is $\mu(s)/\lambda < 1$. Assume that $\Delta(a,s)$ is monotonically decreasing in $\lambda/\mu(s)$ (i.e., reduced processing depth per assertion reduces state change magnitude). As $\lambda/\mu(s) \rightarrow \infty$, the processing depth per assertion goes to zero, and $\Delta(a,s) \rightarrow 0$ for all $a$. The state update converges to the identity. ◻

Lemma 13 (Domain Mismatch Eliminates Causal Connection). Under Condition 9, the gate loses causal connection for assertions of class $d\mathcal{\notin D}(s)$.

Proof. The evaluator in state $s$ with $d\mathcal{\notin D}(s)$ lacks the domain knowledge to distinguish assertions within class $d$ by their content. The judgment $\pi_{1}\left( H(a,s) \right)$ for $a$ of class $d$ depends not on the content of $a$ but on the evaluator’s default disposition. For any two assertions $a_{1},a_{2}$ of class $d$, $\pi_{1}\left( H\left( a_{1},s \right) \right) = \pi_{1}\left( H\left( a_{2},s \right) \right) = y^{*}$ where $y^{*}$ is the default. The causal connection between input and judgment is absent for assertions of class $d$. ◻

Lemma 14 (Constant-Output Equilibrium Is Absorbing). Let $s^{*} \in S$ be a constant-output equilibrium state (Condition 10), and assume that the state update in $s^{*}$ is input-independent: $\pi_{2}\left( H\left( a,s^{*} \right) \right)$ takes the same value for all $a \in A$. Then the set of constant-output equilibrium states is absorbing: the gate does not return to non-trivial operation from $s^{*}$.

Proof. In state $s^{*}$, the output is $y^{*}$ for all inputs. Since the state update is input-independent, let $s^{**} = \pi_{2}\left( H\left( a,s^{*} \right) \right)$ for any $a$. Two sub-cases.

Sub-case (a): $s^{**} = s^{*}$. The state is a fixed point. The gate remains in $s^{*}$ and continues to produce $y^{*}$.

Sub-case (b): $s^{**} \neq s^{*}$. Since the output in $s^{*}$ is constant and the state update carries no input-dependent information (by the input-independence assumption), the evaluator in $s^{**}$ has received no input-dependent signal that would differentiate its response to different assertions. Therefore $\pi_{1}\left( H\left( a,s^{**} \right) \right)$ is constant in $a$, and $s^{**}$ is also a constant-output equilibrium state. The gate remains degenerate. ◻

Remark 15. The assumption that the state update in a constant-output equilibrium state is input-independent is the structural content of the lemma. It states that an evaluator who is not differentiating outputs by input is also not differentiating state updates by input: constant output and constant state update are coupled. This coupling is what makes the equilibrium absorbing.

Theorem 16 (Gate Degeneration). Let $H:A \times S \rightarrow \{ + , - \} \times S$ be a human verification gate. Under any of Conditions 8, 9, or 10, the gate degenerates: it converges to an operation where the output is independent of the input. Formally, there exists $y^{*} \in \{ + , - \}$ such that $\pi_{1}\left( H(a,s) \right) \rightarrow y^{*}$ for all $a \in A$.

Proof. Three cases, one for each condition.

Case 1 (Rate saturation). By Lemma 12, the state update converges to the identity. The state ceases to evolve. In a fixed state $s$, the gate is a function $H( \cdot ,s):A \rightarrow \{ + , - \}$. By Condition 11, an evaluator whose state update has converged to the identity produces constant output $y^{*}$ for all inputs. The gate has degenerated to a trivial machine.

Case 2 (Domain mismatch). By Lemma 13, for assertions of the mismatched class $d$, the gate produces constant output $y^{*}$ independent of input. The gate is trivially operating on class $d$.

Case 3 (Constant-output equilibrium). By Lemma 14, the equilibrium is absorbing. The gate remains in a state producing $y^{*}$ for all inputs. The gate is a trivial machine. ◻

Corollary 17 (Degenerate Gates Do Not Verify). A degenerate gate does not perform verification. Verification requires that the output depends on the input (causal connection). A degenerate gate produces constant output. Passing assertions through a degenerate gate adds a procedural step but no epistemic content: the decision is not informed by the evaluation.

Proof. By Definition 5, causal connection requires that different inputs can produce different outputs. A degenerate gate produces the same output for all inputs. Causal connection is absent. Without causal connection, the gate’s output carries no information about the input. The gate is procedurally present but epistemically absent. ◻

The Preservation Theorem

Remark 18 (On exhaustiveness). The three degeneration conditions cover the input axis (rate saturation: too much volume), the operator axis (domain mismatch: wrong expertise), and the temporal axis (constant-output equilibrium: too long without variation). Whether additional axes exist that produce degeneration through mechanisms not reducible to these three is an open question. The three conditions are sufficient for the architectural consequence: cohort constraint, rotation, and monitoring. Exhaustiveness is not claimed and is not required for the architectural response.

Theorem 19 (Non-Triviality Preservation). Let $H:A \times S \rightarrow \{ + , - \} \times S$ be a human verification gate. $H$ preserves non-triviality if and only if all three of the following hold:

3. $\lambda \leq \mu(s)$ for the evaluator’s current state $s$ (the assertion arrival rate does not exceed the evaluator’s processing capacity);

4. For every assertion of class $d$ routed to the gate, $d\mathcal{\in D}(s)$ (the evaluator possesses domain knowledge for the assertion class);

5. The gate is not in constant-output equilibrium (the evaluator has not reached a state of default disposition).

Proof. Necessity: if any condition is violated, the gate degenerates by Theorem 16.

Sufficiency: if all three hold, then (i) the state update is functioning (the evaluator processes each assertion with sufficient depth to update the internal state), (ii) the causal connection is intact for the assertion class at hand (the evaluator can distinguish assertions by content), and (iii) the gate has not collapsed to constant output. All components of non-triviality (Definition 7) are present. ◻

Corollary 20 (Architectural Requirements). Preserving non-triviality imposes three measurable constraints on the institutional architecture:

6. Volume control: the assertion arrival rate $\lambda$ at any single gate must not exceed the evaluator’s processing capacity $\mu(s)$.

7. Routing by competence: assertions must be routed to evaluators whose domain knowledge covers the assertion class.

8. State monitoring: the institution must detect when an evaluator has reached constant-output equilibrium (through fatigue, habituation, or loss of engagement) and intervene (rotation, rest, replacement).

Institutional Architectures as an Instance

Proposition 21. Any institutional verification architecture that employs human review as a verification step instantiates the human verification gate $H$.

Proof. The human reviewer receives assertions (input $A$), evaluates them against domain knowledge and experience (internal state $S$), and produces a judgment of admission or rejection (output $\{ + , - \}$). The reviewer’s state evolves with each evaluation (fatigue accumulates, context shifts, domain knowledge updates). The structure is $H:A \times S \rightarrow \{ + , - \} \times S$. ◻

Corollary 22. Any institutional verification architecture that employs human review is subject to Theorem 16: the human gate degenerates under rate saturation, domain mismatch, or constant-output equilibrium. The institution must satisfy the three conditions of Theorem 19 to maintain genuine verification.

Remark 23. The companion paper’s Collegium Custodum (the guild of qualified examiners with graduated competence levels) is an operationalisation of Corollary 20. The gradus structure (tiro, peritus, magister) maps to condition (ii): assertions are routed to evaluators whose competence level matches the assertion class. The workload limits map to condition (i): the gate’s throughput is bounded by the evaluator’s processing capacity. The rotation and review protocols map to condition (iii): the institution monitors for degeneration and intervenes.

The Volume Condition

Before LLMs, the assertion volume was bounded by human production capacity. Rate saturation (Condition 8) was structurally unlikely: the rate at which humans produce assertions does not typically exceed the rate at which other humans can evaluate them. Domain mismatch (Condition 9) existed but was managed informally through professional specialisation. Constant-output equilibrium (Condition 10) occurred in individual cases (reviewer fatigue) but was operationally containable.

LLMs changed the rate. The marginal cost of producing assertion-candidates dropped to near zero. The arrival rate $\lambda$ at human gates can now exceed $\mu(s)$ by orders of magnitude. Rate saturation is no longer a boundary case; it is the default operating condition for any institution that admits LLM-generated content into its decision chains without volume control. The degeneration theorem applies: the human gate converges to a trivial machine. The institution records that human review occurred. The review carried no epistemic content.

Conclusion

The requirement that the human’s decision be real is a formal property of the verification gate, not a moral exhortation. A human gate is a non-trivial machine: its output depends on an internal state that evolves with input. Three conditions cause the gate to converge to a trivial machine, breaking the causal link between input and judgment: rate saturation, domain mismatch, and constant-output equilibrium. Under any of these conditions, the gate degenerates to a trivial machine producing constant output. A degenerate gate does not verify. The institutional architecture must preserve non-triviality by controlling volume, routing by competence, and monitoring for state collapse. These are measurable constraints with testable compliance criteria.

References

Immanuel Kant, Grundlegung zur Metaphysik der Sitten (Riga: Hartknoch, 1785); English translation: Groundwork of the Metaphysics of Morals, trans. Mary Gregor (Cambridge: Cambridge University Press, 1998).

Arthur Schopenhauer, Die Welt als Wille und Vorstellung (Leipzig: Brockhaus, 1818/1844); English translation: The World as Will and Representation, trans. E. F. J. Payne, 2 vols. (New York: Dover, 1969).

Heinz von Foerster, “On Constructing a Reality” (1973), reprinted in Observing Systems (Seaside, CA: Intersystems Publications, 1981), 288–309.

Heinz von Foerster, ed., Cybernetics of Cybernetics (Urbana, IL: Biological Computer Laboratory, University of Illinois at Urbana-Champaign, 1974).

Thorben Liebig, “On the Formal Foundation of Boundary 1: A Lawvere-Yanofsky Proof That Verification Architectures Cannot Attest Their Own Consistency” (2026).

Thorben Liebig, “On the Formal Foundation of Boundary 2: A Lawvere-Yanofsky Proof That Verification Architectures Cannot Define Their Own Truth Predicate” (2026).

Thorben Liebig, “On the Formal Foundation of Boundary 3: A Proof That Uniform Verification Thresholds Necessarily Fail on Non-Constant Falsification Landscapes” (2026).

Declaration on the use of AI tools. This paper was developed with the assistance of Claude (Anthropic, Claude Opus 4.6). The instrument was used for structural drafting, LaTeX formatting, editorial iteration, and bibliographic cross-referencing. All substantive claims, mathematical proofs, legal analysis, doctrinal positions, and architectural decisions are the author’s. The instrument produced no assertion that entered the final text without human verification at the gate. The verification architecture described in this paper was applied to its own production.