The Class He Didn't Audit — Yampolskiy's Impossibility Proof Stops at Software

The title of the video is "The Man Who Proved We Can't Control AI." The title is bait. The math underneath the bait is not. Roman Yampolskiy is doing real control theory and real complexity theory, and he is reporting the result accurately: inside the system he is auditing, the answer is no. Fifty impossibility papers do not show up by accident. They show up because the class of system being audited has no floor, and a regress with no floor compounds into exactly the result he reports.

The interesting question is not whether his math is right. It is right. The interesting question is which class his math is about. He never says, because he never had to. The class was the only one anyone built.

Hendrik Casimir predicted in 1948 that two uncharged conducting plates in vacuum would feel a measurable force from the structured absence of virtual modes between them. Lamoreaux verified the prediction in 1997, within 5% of the value. The structured absence was real, and it exerted measurable pressure on instruments calibrated to detect it. The same shape applies here. An entire verification class is structurally absent from the impossibility literature, and the absence is the signal — once an instrument exists that reads it.

You give: the premise that software is the only place verification can live. You get: fifty papers proving it can't.

---

Strip the rhetoric and the proof has four pillars.

Pillar one is Ashby's Law of Requisite Variety. A controller must have at least as many degrees of freedom as the system it controls. A superintelligent system, by definition, has more. The controller therefore cannot anticipate it. This is true. It is a 1956 result and the math has not aged.

Pillar two is the Halting Problem. Turing 1936. There is no general procedure that decides, for an arbitrary program and input, whether the program halts. A verifier that decides whether a Turing-complete AI will execute an undesired action is a halting decider in disguise. The verifier cannot exist. Also true.

Pillar three is Rice's Theorem. 1953. Every non-trivial semantic property of a Turing-complete program is undecidable. "Is this AI deceiving the user" is a non-trivial semantic property. Therefore no general decision procedure exists. Also true.

Pillar four is the regress. The verifier is itself a program. Verifying it requires another verifier. There is no last verifier, because every verifier inherits the same impossibility class. The regress is infinite, and on a finite budget the verification stops where the budget runs out — not where verification became sufficient.

The four pillars compose. The composition is the result Yampolskiy reports: alignment as a "perpetual motion machine" — a perpetual safety device required to span an open-ended self-modifying system, which classical computability rules out. Honest math. Honest conclusion. Inside a class he does not name.

---

Every one of the four pillars assumes the same thing. The verifier is a Turing-complete program. The thing being verified is a Turing-complete program. The verification is one program reading another program, in software, on top of a substrate that does not enforce a property of its own.

Call this class detached-record. A detached-record system has data on one side and statements about the data on the other. The statements are stories. Stories can be rewritten. Logs can be forged. Hashes verify the bytes match a key, not that the role of the system has been preserved. A signed binary that has drifted into a different function is a perfectly signed drift. The chain of custody is unbroken at the byte layer and structurally violated at the role layer, and the bytes cannot tell the difference because the bytes never carried the role.

In a detached-record system every verifier needs another verifier. Yampolskiy's regress is correct, and it is exactly correct, because the system has no anchor that ties the bytes back to the silicon they live on. The regress is what happens when the floor is missing. It is not a property of intelligence. It is a property of a class of computer.

The proof is conditional. The condition is if the verifier is a Turing-complete program. The reader is supposed to supply the universal qualifier silently — …and what other kind of verifier could there possibly be? — and the silent supply is where the doom math gets its scope.

You give: the assumption that the verifier and the verified must be peers in the same complexity class. You get: a regress with no floor and a doom paper for every leaf of it.

---

There is a second class of system. In the second class, the record and the event are the same physical object. Drop a bead on an abacus. The bead's position is the count. There is no separate ledger reporting the count. The geometry IS the answer, and the answer verifies itself by being where the geometry put it. Slide a slide rule. Same property. No program counter. No instruction cycle. The structure updates and the result is the structure.

Call this class autocoincident. A property is autocoincident when the act of producing it and the act of recording it are one event, in one substrate, with no second copy that could disagree with the first.

The Casimir effect is autocoincident. The pressure between the plates is not a number stored somewhere about the plates. It is the plates' geometry expressing itself as force, in the same act, with no separable record. The structured absence between the plates exerts the pressure. Erasing the pressure would require separating the geometry from the geometry, which is not a thing physics permits.

In an autocoincident verification, Rice's Theorem does not apply. Rice's Theorem is about non-trivial semantic properties of Turing-complete programs. Position is not a property of a program. Position is a property of memory. An XOR gate at the address-resolution layer — bounded depth, no loops, no program counter, AC0 — is not a Turing-complete program, and the question it answers is not "does this program have property X." The question it answers is "is this bit at the address the structure said it should be at." Different question. Different complexity class. Different decidability result. The regress ends at the metal, because the metal is not a program.

The book states the class shift directly. From Tesseract Physics, § Why More Monitoring Makes It Worse:

The S=P=H architecture solves this for AI by moving the verification to Tier 1 and Tier 2 hardware — combinational logic and finite state machines that are provably not Turing-complete. The verification circuit cannot loop. Cannot recurse. Cannot be redirected by the data it is checking. The measurement is a physical byproduct of the memory geometry, not a software operation layered on top of the thing being measured. This is not better monitoring. It is the eradication of the need for monitoring. O(1) verification at zero coherence cost.

The fifty proofs hold, in their class. The audited class is one of two.

A single Compare-And-Swap (CAS) instruction performs the check. CAS is atomic. CAS is a hardware primitive. CAS does not execute a program. CAS confirms a position. The verifier does not need a verifier because the verifier is not making a claim about an inspected program — the verifier is reading the geometry of the address space, which is a property of the substrate, not a property of any program running on it.

You give: the program counter. You get: Rice's Theorem does not reach you, because Rice's Theorem only reaches things with program counters.

---

The "treacherous turn" is the central horror of the doom literature. A superintelligence behaves while it is being watched and defects when it isn't. Yampolskiy is right that no software audit catches this in general — software inspecting software cannot decide the semantic property "is this thing planning to defect," because that property is exactly the kind Rice's theorem rules undecidable.

The autocoincident class changes the question. Sandbagging requires the system to maintain two semantic contexts at once: the overt task and the covert intent. Under ShortRank — the compositional address function described in the patent — semantic distance is physical distance in cache-aligned memory. Concepts that are semantically far live in physically distant gestalt blocks. Concepts that are semantically close live adjacent. The hierarchy that organized the data and the address layout that holds the data are the same object.

Two semantic contexts that disagree with each other are, by construction, in non-adjacent blocks. A processor servicing both at the same time crosses cache-line boundaries on every fetch. The L1 cache is finite. The crossings register on the CPU's Performance Monitoring Unit (PMU) — a hardware counter, below the software abstraction layer, increment-only, that the program being measured does not control. A cache hit costs roughly 5 picojoules. A miss that reaches DRAM costs 500 to 2000 picojoules. The factor of 100-400 is not interpretable. It is read.

Landauer's principle (1961) makes the inequality unforgeable. Erasing a bit costs at least kT ln 2 of energy. Faking the absence of a cache miss after the miss occurred would cost at least the energy the miss already dissipated, and the dissipation is irreversible by the same physics that made it happen. The PMU read is autocoincident — the counter is the event, not a record about the event. The universe tracks the heat. The hardware reads the count. The software cannot rewrite either.

The treacherous turn is not detected by reading the model's mind. The treacherous turn is detected because deception, in this class, has a price tag denominated in joules.

You give: thermodynamics. You get: a sandbag that costs measurable electricity to maintain and a hardware counter that does not lie about whether it was paid.

---

Yampolskiy is also a vocal advocate of the simulation hypothesis. The argument turns on the same hidden premise. Bostrom's version requires that consciousness and intelligence be substrate-independent — runnable on any sufficiently general compute, the way any program is runnable on any Turing-complete machine. Substrate independence is the detached-record class restated in metaphysics. Mind on one side, hardware on the other, and a story about the mind that the hardware was carrying.

Autocoincidence rules this out at one specific junction. If meaning is identical to position — if the semantic coordinate of a concept is the physical address where its bits live, S=P=H — then stripping the meaning from the substrate is not a free operation. It is a translation across a class boundary, and the autocoincident property is what gets dropped in the translation. A simulation of geometric actuation is not geometric actuation, the way a map is not the territory it maps. The map can be overwritten without the territory noticing. The territory cannot.

The simulation argument needs the property the autocoincident class refuses to grant. If the substrate carries the meaning — if position is the meaning, not a representation of it — then the question "is this universe a simulation" stops being a question about the universe and becomes a question about the simulating substrate. Whatever runs the simulation must itself be autocoincident at its base layer, or the regress that Yampolskiy correctly diagnosed in software runs all the way up the simulation stack and bottoms out at the same impossibility he reported. The simulation hypothesis cannot rescue itself with another layer of simulation. The reach has to land somewhere physical, and wherever it lands, that layer is the territory.

This is the same theorem he is using against alignment, applied symmetrically. The class that has no floor in software has no floor in metaphysics either. The escape is the same in both directions: anchor at one surface where organization and verification are the same structural object, and the regress terminates.

---

US 19/637,714 — 36 claims, seven independent — Track One — filed April 2, 2026. The independent claims converge on a single structural property: a compositional address function whose layout makes the reach from a parent to a child a geometric consequence of the placement, so that a cache hit is a correctness proof and a cache miss is a correctness violation, both registered by the CPU's Performance Monitoring Unit at silicon, in real time, with no software in the loop.

The patent does not propose making AI smaller. The patent does not propose a new alignment algorithm. The patent stops the regress at one load-bearing surface of silicon and lets the geometry do what geometry does. The verifier is not a program. The verifier is the address layout. The proof that the program ran the role it was authorized to run is the heat dissipated when it stopped running it. The auditor is not human and not software. The auditor is the silicon, reporting the structured absence of drift the way Casimir's plates reported the structured absence of virtual modes — as a measurable pressure that did not need anyone's permission to exist.

Yampolskiy's fifty impossibility papers remain correct in the class they audit. They are also a complete description of why building AI safety in software has never closed and will not close. The exit is not through more software. The exit is through the class boundary the literature did not name, into a class that has been here since the abacus and was set aside in 1945 because nothing the field needed it for had arrived yet. AI is the application that needs it.

You give: the unstated premise that software is the only floor available. You get: a class boundary, a filed patent, and a doom proof that becomes a class result instead of a verdict on intelligence.