It was the first formal object that perfectly encoded a core obsession, and because of that, it became impossible to let go of—even long after its utility had expired.

The digital trail of drafts and planning sessions reveals this reluctance. In the preparation notes, the verdict was clear:

§3.2 Mealy notation | M = (Q, Σ, Δ, δ, λ, q₀) | Drop
App A.1 | Theorem 1 + Mealy proof | Drop

It was marked for deletion. Even the prism agent had pointed out the redundancy: “The Mealy machine result is simply the zero-cut special case of the static certificate”—strictly weaker, less general, and less rigorous than what followed. Yet, like a ghost in the machine, it kept reappearing. It haunted 2026jan.tex, lingered on Desktop/cc.tex, and found its way back into the AIES submission. Every attempt to excise it failed; it kept surviving.

The truth is that the Mealy machine was never really about AI liability. It was about a personal epistemic preoccupation. It formalized the exact structural boundary that defines every paper in the bibliography:

The attraction was never to automata theory itself, but rather to that precise, visceral moment when observation fails to reconstruct cause. The Mealy machine was the simplest, most elegant caricature of that failure: a closed box with hidden gears where turning the crank produces outputs that could have been generated by multiple, incompatible internal configurations.

But the tragedy of the Mealy machine was its simplicity. It could only yield a blunt, binary verdict—non-injectivity leading to undecidability—when the actual goal was a graded, constructive, and decompilable account of epistemic loss.

That is what the POPL paper finally achieves. It replaces hand-waving claims about the impossibility of state recovery with a mechanical witness extractor. Through the well-founded measure of route_improves_of_bad, the StaticRoute witness extractor, and the dSeparated_iff_dSeparates bisimulation, the POPL paper represents the Mealy machine fully grown.

Keeping the Mealy machine around was a lingering attachment to the object that first made this obsession legible. But legibility is not the same as rigor. The POPL paper marks the transition to a proper formal home—moving from automata theory to causal graphs, from prose proofs to Lean 4, and from binary undecidability to explicit witness extraction.

The Mealy machine had to die so that route_improves_of_bad could live.

I want to argue that this silence is not a minor gap; it is a symptom of two communities talking past each other. And the bridge between them is a rigorous notion of trail as witness.

The Boolean Trap

Traditional DAG analysis gives you a verdict at the endpoints. $X$ is d-separated from $Y$ given $Z$: True or False. The intervened distribution $P(y \mid do(x))$ is identifiable: Yes or No. This is the “full stop” regime.

But a boolean verdict discards the path. It tells you that water reaches the tap, but not whether it travelled through lead pipes, detoured through a cistern, or was siphoned off midway. To know the texture of a causal chain—to distinguish a default association from a derived conclusion, or to know whether an observed correlation persists because of the presence of one variable or the absence of another—you need to traverse the trail in slow motion, node by node, junction by junction.

Trail traversal gives the texture of causal chains; endpoint booleans do not.

Two Communities, One Missing Link

Remarkably, two intellectual neighborhoods have been circling this problem from opposite ends without quite meeting in the middle:

The Causal Inference community (Pearl et al.) is structurally obsessed. It abstracts the world into absolute black-and-white: if d-separation holds, the answer is True; otherwise, False. They are plumbers who care only whether the pipe is open, not what contaminant rides the flow. After 2009, the field’s theoretical engine on this particular front seems to have stalled—perhaps because every remaining graph-theoretic challenge starts to look like the Four Color Problem, solvable only by brute force unless a new representational insight appears.

The Quantitative Information Flow (QIF) community (Alvim, Palamidessi, Smith et al.) is capacity-obsessed. They compute leakage in bits, bound it with Shannon capacity, and seek KKT certificates for optimality. But their channel models are often toy simplifications, stripped of topological depth. They measure the volume of water without being able to trace the pipe’s winding route through the labyrinth.

Both communities study DAGs plus information flow. Yet:

• Causal inference has the topology but no quantitative bound.
• QIF has the quantitative machinery but no trail-level topological witness.

No one has connected them. Why? Because the causal side asks “Is it identifiable?” and the QIF side asks “How many bits leak?"—and neither side has a formalism that answers both at once while retaining the path as a first-class object.

Lemma 1: The Collider Ancestor Leak & Rerouting

Consider a collider $u \rightarrow w \leftarrow v$. Textbook d-separation says evidence can pass through $w$ only when $w$ or a descendant is observed. But this description conflates two distinct phenomena.

Suppose we are testing whether $X$ and $Y$ are d-separated given $Z$. If a descendant of $w$ leads only to $X$ or $Y$ and not to $Z$, then the collider is not “activated by $Z$” in any global sense. It is activated because it creates a connected route from a source to a destination. The conditioning set is, locally, a red herring.

Path Normalization / Rerouting

Claim: If a descendant of $w$ leads to $X$, the original long path was never necessary; the descendant path itself provides a shorter route.

Proof sketch. Take any active trail passing through collider $w$ and reaching $X$ via descendant $d$. Replace the subpath from $w$ to $X$ with $w \leadsto d \leadsto X$. By minimality of active trails (or induction on cutset size), the rerouted path is no longer than the original and preserves endpoint connectivity. The original trail was therefore non-minimal, containing a redundant detour shortcuttable through the collider’s own descendant. ∎

The upshot: collider “activation” is often just topological connectivity leaking outward, not a special global event mediated by the conditioning set.

Lemma 2: The Junction Obligation Problem

If we accept that trails matter, we need a local criterion for their validity that does not require re-scanning the entire graph at every step.

Decompiling the Trail

Decompose an active trail into a stateful path type—call it ActiveRoute or BayesBallPathT. Each traversal step carries a direction tag:

• outOf: leaving via an outgoing edge.
• into: entering via an incoming edge.

These tags are not bookkeeping; they encode the obligation imposed by the junction just traversed.

Global Topology → Local Type Constraints

In the global formulation, a junction $(A, B, C)$ is valid only after inspecting the whole graph and the conditioning set. Under the state-machine view:

1. Obligations are pushed to interfaces. The direction label at a boundary encodes what junction type is expected on the other side.
2. Composition is type checking. Concatenating two path segments requires only that the output state of the first matches the input obligation of the second. No global inspection needed.
3. Local consistency implies global consistency. If every adjacent pair of segments satisfies their shared interface obligation, the entire trail is valid by construction.

The global topological constraint of d-separation becomes a local type-system constraint on path segments. The type of a segment is its pair of boundary states; composition is well-typed iff obligations align.

What Is Still Missing

Lemmas 1 and 2 give us a cleaner, more local way to reason about whether a trail is active. But they do not yet answer the quantitative question:

Not “does information flow?” but “how many bits flow through this specific trail?”

That question requires machinery that currently lives only in QIF:

• Channel capacity between observables and secrets along a specific topological route.
• KKT conditions to certify that a given leakage bound is optimal under the graph’s structural constraints.
• Shannon bounds that respect the DAG’s conditional-independence structure rather than assuming a flat channel matrix.

What does not yet exist—and what I am groping toward—is a framework where:

1. The DAG provides the topological syntax.
2. The trail provides the witness (the specific path whose capacity we measure).
3. KKT + channel capacity provide the quantitative certificate.
4. A proof assistant (Lean4, Coq) checks both the topological type constraints (Lemma 2) and the information-theoretic bounds.

Takeaway

Pearl’s boolean tools are not wrong; they are insufficient for anyone who wants to know the texture of a causal chain. QIF’s quantitative tools are not wrong; they are topologically blind. The missing piece is a trail semantics that makes the path a first-class object—so that we can ask not only whether an intervention opens a channel, but how wide that channel is, what contaminants it carries, and whether the leakage is bounded.

We need to move from “full stop” to “slow-motion replay.” The trail is the witness.

Auditing a deployed language-model agent requires two separable quantities: how much operative state escapes the recorded trace, and how much of that residual state drives behavior. We introduce a dual-certificate protocol. The static certificate $_state^UB$ upper-bounds residual hidden-state entropy by a min-cut on untraced channels. The dynamic certificate $_act^LB$ lower-bounds residual decision relevance through an admissible probe taxonomy—replay, intervention, proxy—under conditional data processing. The two axes are independent. In ReAct experiments, logging ablates the static bound from $16,464$ to $0$ bits; controlled replay separates dormant calculator from active planning tasks under the same topology as a soft policy shift ($0.0163$ bits, 95% CI $[0.0124,0.0208]$) with argmax tool selections unchanged. Indexing $_act^LB$ over hidden-channel coordinates produces an activation profile. On an LLaDA denoising trajectory, perturbations stay near the floor through early steps and rise at the final binding step ($0.110$ bits, 95% CI $[0.052,0.234]$). On a multi-agent communication edge, swapping a worker’s private report gives $0.901$ bits, 95% CI $[0.873,0.928]$. A Lean 4 artifact mechanizes the autoregressive zero-cut case and proves the conditional-DPI and chain-rule reductions from Mathlib first principles, with only the cut-set capacity bound remaining as an external structural premise.

Contents

• Introduction
• Related Work
• Setup and Audit Regime
• Static Certificate: Structural Upper Bound via Untraced-Channel Capacity
• Dynamic Certificate: Decision Relevance via Conditional DPI
• Empirical Diagnostics