为机器智能在真实世界落地提供可审计的合法性框架

Machine intelligence's push into the physical world is stuck on a gap: deployment demands auditable judgments from day one, fault samples are scarce or absent, and the norms defining "what counts as a fault" live in design documents, not in operational data. We argue this gap is structural, and locate where it can be legitimately closed. We divide the worlds machine intelligence faces into four (phenomenal, basic physical, artificial physical, artificial symbolic) along one axis of constraint strength, and give the Promulgation Criterion: extracting a prior framework from a world is legitimate if and only if the world is intentionally constituted (C1) and has left a readable generative archive (C2). On the criterion's two gradient axes, exactly one world is high on both: the artificial physical world (buildings, factories, infrastructure), whose norms precede their instances; the legitimate path is to extract the framework from the archive, not to induce it from data. We then show what shape such a framework must take: four construction goals force four incompatible carriers, hence at least four layers (syntax, concepts, knowledge, instances); on a closed concept layer fault localization is decidable in polynomial time, and every judgment is interrogable, traceable to a promulgated clause. The same criterion fixes the runtime division of labor with LLMs: promulgatable duties go to rule engines, on-site judgments beyond promulgation go to LLMs, and every generation sandwiched by promulgated clauses is auditable. The theory is falsifiable: four bets (P1-P4) with explicit falsification conditions -- among them that the next large-scale AI breakthrough occurs in the artificial physical world. Evidence: formal proofs (Appendix A); two cases (Appendix B: a cooling plant; the Curiosity rover Sol 1536 anomaly); eight reverse-read lineages, from BACnet to RDF/OWL (Appendix C).