Pre-Establishment: The Minimal Computational Layer Required for the Safe Constitution of Action

An autonomous system that produces an output and a system that performs an action are treated, in current engineering practice, as the same thing: sensor readings, control outputs, and actuator motions are recorded as the system's behavior the moment they occur. Such records cannot answer the question that every audit, liability assessment, and corrective process presupposes — was this something the system did, or something that happened through it? A gust, a transient, and a deliberate maneuver are inscribed identically. We argue that this is not a logging deficiency but the absence of a computational layer, and we define that layer, which is minimal in the precise sense that each of its constituent roles is individually necessary, while sufficiency is left open. Pre-Establishment is the computation that judges whether a system's current internal state is eligible to be constituted as the cause of an action; a declaration is not a computation but the irreversible boundary event marking that this judgment has completed affirmatively. We derive the layer's necessity from a criterion external to our own definitions — that safety-critical practice demands records answering what caused this and how under post-hoc audit — and show that the named alternatives (record everything, filter afterwards, delegate the judgment, trigger without judging, constitute gradually) either secretly perform the judgment or violate the criterion. We derive the judgment's content: the candidate state must be determinate (there must be a relatum to attribute) and forward-computable (the causal link must be reconstructible as computation performed by the system), and the candidate must reside, while being judged, in a region structurally severed from the system's attribution and record structures. The definition is not ours alone: transaction commit and the Kalman validation gate exhibit it exactly — a correspondence whose structural half we machine-check as instances of a formally verified notarization class (75 proof obligations each, zero omitted), and whose content half (that their checks are the judgment's two conditions) is argued, not verified. Where the definition does not hold, it fails informatively: the systems that miss the structure — runtime monitors that check no cause, authorization gates that check entitlement instead, envelope protection that shapes commands without ever constituting them — miss it along exactly the axes the definition names, so the line between instance and non-instance is itself evidence. We offer the definition, the necessity argument, and the evidence that the layer already exists wherever action is constituted discretely — and is missing, with documented consequences, wherever it is not.