A firmware flaw drained over $130 million from Coldcard wallets. Coinkite says an attacker likely used AI to find it — and admits its own AI review missed it. Both claims rest on the same unverifiable ground.

The law knows how to prove what happened. It does not know how to prove what did not happen. In autonomous AI governance, this asymmetry is not a procedural inconvenience — it is a structural liability gap. Logs record occurrences. They cannot record absences. An AI system that failed to alert, an operator who failed to intervene, a supervisor who failed to activate the override mechanism: none of these non-actions leave a trace in any audit trail. SOURCE 0 closes this gap through the Non-Action Governance Map — a pre-execution seal of the precise conditions under which intervention was mandatory, produced at T-0 by an independent authority. When those conditions are met and no intervention appears in the evidentiary record, the non-action becomes a legally opposable fact under the EU AI Act, the Product Liability Directive 2024, and NIS 2.

Autonomous AI decisions engage liability — but not through system performance. They become legally attributable only when a competent human authority has documented governance before execution. SOURCE 0 defines this evidentiary threshold as T‑0: the moment where human authorisation is cryptographically sealed by an independent authority. Without a T‑0 seal, an AI act has no author — and under the EU AI Act and the Product Liability Directive 2024, that is a liability without a ceiling.