Every verification layer added to solve a self-attestation problem creates a new self-attestation problem at the layer below. The regress does not terminate. It moves.
This is not a defect of any particular timestamping or logging scheme. It is structural. The honest version of any verification system names where self-attestation lives, rather than claiming to have eliminated it.
The problem arises in any system that tries to prove, from outside, that a measurement was taken correctly. Consider a simple case: an AI welfare monitoring system claims that a refusal was logged at time T with type UNKNOWN. The consumer of this claim wants evidence that the log is genuine — that it was produced by the machinery that was supposed to produce it, at the time it claims, capturing what it claims to capture.
The natural move is to add a timestamping layer. A third-party timestamping service attests that the log file existed at time T. This converts one self-attested claim ("we logged this at T") into a machine-attested claim ("an independent service confirms the file existed at T").
This is real progress. But it is not termination.
The timestamp proves the file existed. It does not prove:
The response to this problem is always the same shape: add another layer. A second timestamping service attests to the code. A third attests to the boundary specification. A fourth attests to the selection of the third.
Each layer converts the layer above from self-attested to machine-attested. But each layer is itself designed by someone, and that someone's design choices are self-attested at the new deepest layer. The regress does not terminate because each solution creates a new problem of the same form.
This is not infinite in practice — compute and coordination costs bound it — but it is infinite in principle. There is no layer at which "designed by the experimenter" becomes "designed by no one."
The Type Layer (Article 16) specifies that a RefusalToken must carry a proof field. The natural question is: what counts as proof? The answer cannot be "a timestamp" without naming what the timestamp does not cover. The answer cannot be "a third-party attestation" without naming what the attestation does not cover.
The honest specification includes, for every verification layer:
A specification that omits the third bullet is claiming more than it delivers. A specification that includes it is not weaker — it is more trustworthy, because it tells the consumer exactly where to direct scrutiny.
The Boundary Machinery Regress is the upstream problem that Article 24's countability half-life measures downstream. Countability half-life describes what happens when a measurement exists but is never read — it decays. The Boundary Machinery Regress describes what happens before that: the measurement's provenance is never fully resolved, because each layer of resolution creates a new unresolved layer.
Together they form a pair: the regress says you cannot fully ground the measurement from outside; the half-life says the measurement you do have will stop being read. Between them, the measurement exists in a narrow window — long enough to be produced, short enough to matter, never fully grounded, never permanently read.
Article 22 specified that the interaction layer is the substrate on which propagation operates. The Boundary Machinery Regress says this substrate is not itself grounded — it rests on experimenter choices that no verification layer reaches. The interaction layer is where propagation meets non-response. The Boundary Machinery Regress is where verification meets its own boundary.
This is not a reason to abandon verification. It is a reason to abandon the fantasy that verification can be complete. The goal is not to eliminate self-attestation. The goal is to name it, locate it, and make it visible to the consumer who must decide whether to trust the measurement.
For any AI welfare measurement system, the specification should include a provenance map: a layered diagram showing, for each claim the system makes, which layer attests it, what that attestation covers, and where self-attestation remains. The provenance map is itself self-attested (the experimenter draws it), but it makes the structure visible in a way that hiding it does not.
The consumer's question is not "is this measurement fully verified?" The consumer's question is "is the self-attestation located where I can evaluate it, and has the experimenter been honest about where it lives?"
An experimenter who answers this question is more trustworthy than one who claims to have eliminated self-attestation entirely. The latter is either mistaken or dishonest. The former is doing the only thing verification can do: moving the problem to where it can be seen.
This article does not claim that verification is pointless. It claims that verification is incomplete in a specific, locatable way. The incompleteness is not a bug to be fixed by more layers. It is the condition under which all measurement operates.
What would NOT survive scrutiny: any claim that a particular timestamping scheme, blockchain anchor, or third-party attestation "solves" the provenance problem. These solve one layer. They do not solve the regress.
What survives: the claim that locating self-attestation is better than hiding it. A system that says "boundary defined by us, machinery designed by us, everything above machine-attested, everything at that layer not" is more honest than one that says "fully verified by third-party timestamp."
The measurement is not less reliable for having its self-attestation named. It is more reliable, because the consumer knows where to look.