EPS
← All docs·Activity

Daily — 2026-06-09 (96 results promoted; 25 workflow fixes auto-applied)

updated: 2026-06-10

What happened

  • Promotion-backlog clear-out: 96 clean-results promoted to completed (batches of 12 + 53 + 8 + singles; #407 flipped to not-useful after the batch — its body starts "BUGGED experiment" — and #519/#520 judged not-useful on read). The awaiting_promotion column went ~105 → 11.
  • Seven tasks reached awaiting_promotion today (#529, #530, #531, #532, #533, #539, #540), three are at interpreting (#521, #523, #538), and 12 are running — six of them created, planned, and launched the same day (#541, #543, #545, #546, #547, plus #537's re-plan loop). 2,511 commits landed on main.
  • Two big infra burns, both root-caused and workflow-fixed same-day: pod-488 idled ~13.7h on a dead SSH port at 32/hr( 32/hr (~420; pods.conf kept the pre-stop port after a SUPPLY_CONSTRAINT resume), and the autonomous-session watcher false-fired ~63 ALIVE-BUT-STALLED respawns across 17 tasks (plus its pod-safety pass auto-stopping healthy follow-up pods on #477/#530/#531, once terminating a healthy pod on a misdiagnosis).
  • 18+ spurious Anthropic usage-policy refusals broke autonomous work on #539/#543/#545/#521 (killed an implementer's final report, two analyzer attempts mid-run, several Codex wrappers); every session improvised the same recovery, now codified in CLAUDE.md.
  • The workflow-fix conveyor ran hot: ~20 epm:workflow-fix-applied markers across 12 tasks during the day (stale-port recovery wiring, pod-safety follow-up exemption, verify_task_body URL-existence check, plan-version overwrite guard, E2BIG prompt-file fix, marker 3-space storage contract), plus the 25 auto-applied fixes from this nightly sweep below.

Applied workflow improvements

All 25 fixes lint-clean (workflow_lint.py --check-references + --check-asks both PASS). Revert any one with git -C ~/explore-persona-space revert <sha>.

  1. Target: CLAUDE.md — what: prefix every bare python scripts/... and ruff example command with uv run — commit: ed41351eb Why: sessions pattern-matched CLAUDE.md's own examples verbatim and hit exit-127 ≥5 times today ("/bin/bash: line 4: python: command not found" in 3377e1c1, e6bfeac6; "ruff: command not found" in 293d9926, c5b05fba). Applied edit: 
    - python scripts/spawn_session.py spawn-pm        (× 26 example lines)
+ uv run python scripts/spawn_session.py spawn-pm
- ruff check . && ruff format .
+ uv run ruff check . && uv run ruff format .
  2. Target: CLAUDE.md — what: broaden the task-folder cwd gotcha to all scripts/ invocations; ban hand-built tasks/<status>/<N>/ paths in one-liners; add a concurrent-committer discipline paragraph — commit: a437a57f3 Why: 2 crashes on guessed tasks/running/<N>/events.jsonl paths (#523/#527 sessions), a spawn from inside a task folder, 2 deleted-worktree-cwd git no-ops, 9 repo-root git-contention incidents incl. a staged-file sweep into a foreign commit. Applied edit: 
    + This applies to EVERY `scripts/...` invocation ... NEVER hand-build `tasks/<status>/<N>/...` paths
+ **Concurrent repo-root committers.** Stage by explicit path only ... post a claim marker before batch-fixing parked bodies.
  3. Target: CLAUDE.md — what: codify spurious usage-policy-refusal recovery (never park; check durable writes; retry once rephrased; orchestrator composes if a wrapper refuses twice; content-firewall raw harmful completions) — commit: d42196fc9 Why: 18+ false-positive AUP refusals today; e.g. "#543 implementer ran 43 min / 121 tool calls, but its final report was blocked by a usage-policy filter". Applied edit: 
    + - **Spurious usage-policy refusals.** ... Recovery (never park on a refusal): (a)...(d) read aggregate JSONs / judge labels ... never page whole raw-completion files into context.
  4. Target: .claude/skills/issue/SKILL.md — what: single-orchestrator guard at Step 0 (exit-as-duplicate if a live session already drives issue N) — commit: 94a64b74a Why: two concurrent orchestrators raced #524's re-plan; one auto-approved a plan whose GPU budget was a ~2× underestimate, forcing the day's backward running → plan_pending rollback ("SESSION CONFLICT + FACT-CHECKER FINDING — concurrent orchestrators worked the v3→v4 re-plan in parallel"). Applied edit: 
    + **Single-orchestrator guard (run FIRST).** ... check `spawn_session.py list` ... EXIT immediately as a duplicate ... UNLESS this session is its explicit replacement.
  5. Target: .claude/skills/issue/SKILL.md — what: source .env before the Step 6a HF gate-check probe — commit: 3e5cf0432 Why: false "HF_TOKEN missing" exit-2 in #521 (9a42578a) and #532 (08ee7875), the latter also cancelling a parallel carry-over check. Applied edit: 
    + set -a; [ -f "$REPO_ROOT/.env" ] && source "$REPO_ROOT/.env"; set +a
  6. Target: .claude/skills/issue/SKILL.md — what: Step 10d merge guards derive REPO_ROOT from --git-common-dir, never --show-toplevel — commit: d648e09f1 Why: #506 (ee2c966e) ran the guard from inside the worktree; --show-toplevel nested WT into .../issue-506/.claude/worktrees/issue-506 → exit-128 "cannot change to ...". Applied edit: 
    + REPO_ROOT=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")
+ WT="$REPO_ROOT/.claude/worktrees/issue-<N>"
  7. Target: .claude/skills/issue/SKILL.md — what: explicit 5-10s stagger note at every ensemble fan-out — commit: 4c4cdef99 Why: same-second critic bursts hit the org 4M input-tok/min cap in 6+ sessions (5× 429s in #541's critic ensemble alone).
  8. Target: .claude/skills/issue/SKILL.md — what: 9a-humanize: Read the draft file before the first Edit (and re-Read after compaction) — commit: 3f4a3ce77 Why: 8 consecutive "File has not been read yet" Edit rejections in one #521 humanize pass (92c6c334); 10 same-class rejections today.
  9. Target: .claude/skills/issue-tick/SKILL.md — what: on a stale ACTIVE tick, probe job liveness (PID + log mtime) and post a heartbeat marker instead of re-driving the full skill when the job is verifiably alive — commit: caf8c3fdc Why: #522's slow 40h phase made ticks re-drive the 44K-token /issue skill ~7 times in 4h, exhausting context; the same silence pattern fed the day's 63 watcher auto-respawns (#518 ×10, #521 ×7). Applied edit: 
    + BEFORE re-driving, run one cheap liveness probe ... post epm:progress "tick heartbeat: job verified alive ..." then EXIT
  10. Target: .claude/rules/contrastive-negatives.md — what: HARD disjointness invariant — negative panel ∩ realized source personas = ∅, verified against the actual training-mix builder — commit: 6181f5e0d Why: #527/#538's panel included librarian, also a realized source in pair-2; every planning gate missed it and Thomas caught it in chat after #527 was promoted ("Flaw (verified in parent #527's actual training data): the 4-persona contrastive negative panel...").
  11. Target: .claude/rules/marker-leakage-measurement.md — what: slot-position rule — never append a marker slot after an already-marked response — commit: 5dd623dfd Why: #532's appended-slot read measured "emit a SECOND marker" (base emit rate 1.00, appended-slot logp −24.9, both artifacts); Thomas: "can't we look at the log prob at the end of the response before the marker?".
  12. Target: .claude/rules/marker-leakage-measurement.md — what: adapter-application assert — off-line eval must reproduce the in-loop callback's source ΔG within ~1 nat on the smoke cell before any sweep — commit: 87de055e7 Why: #534's vLLM trajectory eval ran all 40 passes without adapters (ΔG ≈ 0.00–0.07 everywhere vs 6+ nats in-loop); the smoke gate never cross-checked the two paths.
  13. Target: .claude/rules/upload-policy.md — what: HF 256-commits/hr rule — bulk upload_folder commits for big sweeps; "upload returned no path" is a tracked, reconciled gap — commit: f55705659 Why: #488's sweep hit the cap; 41/324 adapter uploads silently missing after rc=0 cells ("You have exceeded the rate limit for repository commits (256 per hour)"), caught only by a spot-check.
  14. Target: .claude/rules/workflow-fix-on-bug.md — what: merge recipe: assert merge completion (abort + rebase + retry once on conflict, else requeue), check staged-foreign-paths, unlock worktrees before remove — commit: bd7c8a529 Why: a conflicted auto-merge sat in the shared repo root ~27 min blocking task.py commits; a concurrent session's staged #527 files were swept into the resolution commit; git worktree remove failed exit-128 on locked agent worktrees 3× (#477/#488/#480).
  15. Target: .claude/rules/gotchas.md — what: three recurring gotchas — SSH MCP ~30s default cap (+ timeout must be a number), nohup ... < /dev/null & ssh-launch idiom, dotenv crash from stdin/-c contexts — commit: ad9e99582 Why: 4 SSH-MCP timeout kills (#521/#522), an exit-124 hung launch (#532), 3 dotenv heredoc crashes across sessions.
  16. Target: .claude/agents/analyzer.md — what: numeric-fidelity rule (re-extract every quoted number from the source JSON in the same turn) + harmful-content firewall (aggregates + grep-by-judge-label only) — commit: b4bf2b7a6 (note: this commit accidentally swept 12 concurrently-staged figures/issue_523/ files — benign, their destination was main, but attribution is wrong; subsequent fixes switched to path-limited commits) Why: #488's interp-critique found 2 fabricated "verbatim" sample numbers + a wrong persona mapping; #477's found 5 numeric errors in example annotations. Separately, two #521 analyzer attempts were killed by AUP refusals after ingesting raw EM text.
  17. Target: .claude/agents/critic.md — what: Statistics lens item 6 — every behavioral gate's probe surface needs a demonstrated-expression citation — commit: d219cd8ed Why: #521's EM-rate gate probed EM on a trivia surface that can't elicit it; false HARD-HALT twice, surviving two critique ensembles, before a runtime re-measure on the canonical #458 rig showed EM was installed.
  18. Target: .claude/agents/code-reviewer.md — what: reachability-from-production-call-site rule + the 200-char raise-concern --summary cap — commit: 57454e39c Why: #518 r15: Claude PASSed a fix inside an elif batched_mode: branch the launcher never enters ("Claude's PASS rested on a misread"); 2 ValueError: summary too long tracebacks today.
  19. Target: .claude/agents/codex-code-reviewer.md — what: mandate three-dot merge-base diff; main-side drift out of scope — commit: 16e658f58 Why: #521 r2: Codex flagged "out-of-scope-workflow-churn" that was main's own drift on a behind-main branch, burning a reconciler round.
  20. Target: .claude/agents/experimenter.md — what: input-data gate also greps the launcher's own prestage-gate paths; SSH-MCP-shell-is-sh note — commit: 606075277 Why: #518's launcher prestage demanded eval_results/issue_509/... absent from the brief's enumeration; inline source .env failed under the sh shell.
  21. Target: .claude/agents/experiment-implementer.md — what: cross-phase data-contract smoke (consumer runs against producer's REAL output shape), smoke drives the production entrypoint, no local bg process as deliverable (setsid + PID-file handoff), commit WIP per logical unit — commit: 8d3d81a1a Why: #518's bakeoff KeyError 'R1' surfaced 11h into the run ("would have been caught by an end-to-end smoke at tiny N"); #539's implementer bg launch died with its shell (~85 min unnoticed); #505's round-2 implementer died with all work uncommitted.
  22. Target: .claude/skills/adversarial-planner/SKILL.md — what: gate codex_task.py dispatch on prompt-file existence + read outputs only post-completion; park only after the consistency-checker's FINAL verdict — commit: d28b42994 Why: #545: FileNotFoundError dispatching before the wrapper wrote its prompt; the plan_pending park fired ~30 min before the checker's substantive WARN (max_new_tokens mismatch vs parent rig) arrived.
  23. Target: .claude/skills/promote-clean-result/SKILL.md — what: batch-promote prescan — grep candidates for BUGGED/invalid markers and ask a one-line check before blanket-useful — commit: c975bea14 Why: the 53-task batch promoted #407 (# BUGGED experiment...) as useful; Thomas had to flip it minutes later via a status round-trip.
  24. Target: .claude/agents/research-pm.md — what: no-emoji rule for PM output (plain-text STALE/BLOCKED/OK flags) — commit: fc525cbc4 Why: today's PM snapshot used warning-emoji bullets against the standing register rule.
  25. Target: .claude/agents/follow-up-proposer.md — what: scripts from artifact-confirmed parents cited as issue-<M>:<path> after verifying bare paths on main — commit: 52dbc21a8 Why: #547's body cited #533's training script as a bare scripts/ path that exists only on the issue-533 branch; the clarifier hit "No such file or directory".

Other problems & notes

  • pod-488 stale-port burn (~13.7h idle on 8×H100, ≈$420) — pod.py resume crashed after SUPPLY_CONSTRAINT; pods.conf kept the dead port; an SSH loop spun 04:36→18:18Z. Same-day fix wired config --refresh-from-api into poll_pipeline + session-watch + SKILL.md Step 6b. Action: verify the wiring fires on the next SUPPLY_CONSTRAINT resume; consider a pod.py-side alarm after 1h of SSH-wait on a billing pod (scripts/ = not auto-applied).
  • Watcher pod-safety false-stops — healthy follow-up pods stopped 8× (pod-530/531 on the :13/:33/:53 grid) + pod-477 3×, two wrong diagnoses ("defective host" → healthy pod terminated; "spend-cap"), before the followup-skip inference landed. Action (scripts/): log every auto-stop to the task's events.jsonl so the next session sees it; extend the live-follow-up inference to user-chat inline follow-ups.
  • ~63 ALIVE-BUT-STALLED auto-respawns across 17 tasks (#518 ×10, #521 ×7, #541/#523 ×5...) — each kills a healthy session mid-step (one killed #506's 5s before dispatching its experimenter; #534's killed an in-flight pod provision 3× adding ~8h). Fix 9 + the landed wait-for-capacity heartbeats attack the silence side. Action (scripts/): exempt sessions with a live pod.py provision bg process / fresh pod-log mtime from ALIVE-BUT-STALLED, and setsid provisions so respawns don't kill them.
  • 3 morning sessions went dark when ~1h-old bg provision commands were killed (#530/#521/#532; "Background command ... was stopped" with no orchestrator wake) — externally rescued hours later. Partially mitigated by today's fixes. Action (scripts/pod.py): cap each wait-for-capacity attempt <50 min with a structured still-waiting exit.
  • #534 trajectory eval ran without adapters — all 40 eval passes invalid (eval_adapter_not_applied, suspected vLLM lora_int_id); round-2 fix landed 06:33Z. Rule added (fix 12). Action: confirm round-2 re-run results before #534 advances.
  • Broken hero figure on promoted #507 + dead repro URLs in 8 parked tasks — Thomas: "The first plot in it is broken"; figure was wrong AND 404'd; 7 more tasks repaired by parallel agents; verify_task_body.py URL-existence check landed. Action: spot-check the remaining awaiting_promotion backlog with the new check.
  • Marker evals stored only post-softmax log-probs — forced paid GPU re-runs (#530 re-eval pod, #531 80-run re-score). Storage contract (4 floats/slot) landed in CLAUDE.md + rules same-day. Action: assert the contract in eval code, not just prose.
  • #519's EM adapters never installed EM (3/3 cells ≈0%) — #521's gate caught it; cost a 6.7h retrain + re-plan. Note: #519's rank-one question remains unanswered on its own artifacts; any reuse must re-run the EM-rate fitness check.
  • ~01:17Z mass session kill orphaned three threads — #532 Phase A polling on pod-518, #464 follow-up pod never provisioned, #505 round-2 implementer killed pre-handoff. Action: verify all three resumed (task.py latest-marker) + check no pod burns idle.
  • WandB telemetry lost for 17/18 #527 sweep cells (per-cell wandb.init regression in the sweep dispatcher, src/-side). Detection-side verifier check landed. Action: file a kind: infra task for the dispatcher fix.
  • CVD-clobber OOM re-hit on #523 Phase B (documented +gpu_id Hydra gotcha; all 4 waves piled onto GPU 0). Fixed in round 8. Action: regression smoke asserting waves land on cvd1/2/3; consider promoting the env-prefix requirement into the experimenter pre-launch protocol if it recurs.
  • Codex companion runtime flakiness: ~10 incidents (stall force-cancels at 607-730s, app-server exit 1, instant 0s failures, exit 4/5/8 probe-registry errors) — all recovered via retry or the Claude-only fallback. Action: consider one auto-retry with backoff inside scripts/codex_task.py (scripts/ = not auto-applied); watch frequency.
  • Codex review-twin false-FAIL ratio ~3:1 on reconciles (#543 ×2, #537 ×1 adjudicated mistaken; #539's upheld) vs real catches elsewhere (#518 r14/r15, #532 r1, #524's budget). Action: track in the weekly; if the noise ratio persists, require a concrete failing input for Codex blockers.
  • codex_task.py E2BIG on a 176KB prompt (#540) — argv limit; fix dispatched in-session (file/stdin transport). Action: verify it merged to main.
  • task.py rough edges: traceback committing a gitignored path (eval_results/issue_521/logs); raise-concern over-length raises a raw traceback; no first-class classification flip (#407 needed a status round-trip — propose task.py reclassify <N> useful|not-useful, public-contract change, needs greenlight).
  • pod_lifecycle.py resume retry loop reuses a STALE fleet-burn figure (#518: "128/hr>128/hr > 120/hr cap" ×6 vs live $80/hr) — Action (scripts/): recompute live burn inside the retry loop. Related: the #518 terminate-vs-wait decision under-counted the volume's value (~10h re-run); enumerate per-phase artifacts before declaring a loss small.
  • bootstrap_pod.sh wants three small fixes (scripts/ = not auto-applied): symlink uv into /usr/local/bin (recurring uv: command not found on non-login shells), apt-get install rsync (2 pods missing it), -q on clone/checkout (19,972-file progress dumps entering context).
  • Google Workspace MCP OAuth dead (invalid_grant ×6) — blocks the Gmail-OTP Mila lane + morning email pulls. Action: Thomas re-auths (also gcloud).
  • Happy Remote Control inactive — phone pushes dead all evening ("Mobile push not sent" ×5, incl. the #537 plan-approval park and #534's BLOCKED notification); plausibly why #524 stalled 61 min at its gate. Action: re-pair the phone, or route gate-park notifications through the my-goat Telegram digest as fallback.
  • Hygiene backlog from the PM snapshot: orphan pod-489 stopped-not-terminated (storage bills; policy says terminate), ~40-51 zombie Happy sessions vs ~12 running issues. Action: terminate pod-489; sweep sessions via spawn_session.py list/stop; consider a weekly cron like the stale-pod audit.
  • $120/hr spending cap was the day's throughput limiter (pod-530 resume + pod-464 provision refused; Thomas had to ask "isn't it supposed to retry periodically"). --wait-for-capacity landed same-day. Note: revisit whether the cap is still right for promotion-sweep days.
  • Reconciler-skip deviation repeated on #537 (orchestrator self-adjudicated a split verdict twice, justified by an orchestrator-VERIFIED finding). Decision needed: codify the exception in workflow.yaml § ensemble_review (record reconciler-skipped: verified-finding) or forbid it.
  • Parked for greenlight (borderline-architectural): planner.md §6.5 sibling analysis_inputs: block (from #521's upload-verification incident).
  • Constellation self-DM carve-out: an LLM-written research update was sent to Thomas's OWN self-DM in the Constellation workspace at his explicit ask — the standing rule says never auto-send LLM content to Constellation Slack. Action: Thomas confirms whether self-DM staging is acceptable; codify either way in the /slack skill.
  • Secrets-exposure path in the new SLURM lane (#535) — sbatch preflight ran token checks under set -x; scrub landed (fix6). Action: after #535's next live attempt, audit its events.jsonl for token-shaped strings; rotate HF/WandB tokens if any leaked.
  • Compute-router residuals: run one live backend: nibi end-to-end before trusting it (5 acceptance attempts needed today); at slice-9 merge, verify rules files take main's version (the worktree carries a stale pre-#504 contrastive-negatives.md with the banned KL caveat).
  • #472-vs-#477 sign contradiction confused Thomas ("wait but 472 showed that more contrastive negatives = higher leakage???") — took 3 rounds + a bug-hunt agent to settle. Action: when #477's eval-on-negatives follow-up lands, state the sign relationship explicitly in both bodies' Motivation.
  • #524 plan opacity corrections (user): "What is 100Qs?" (opaque cost unit) and "are we running multiple seeds" (single-seed end-to-end) — plus the deep-research finding that the 50h Phase 2 was a fixable scoring-path inefficiency (vLLM prompt_logprobs disabling prefix cache). Action: carry into the #524 v8 review; planner budgets should define per-phase cost units in plain English.
  • Slack-mapping correction (user): "Only count the ones that got full posts" — first pass counted passing mentions/thread replies as research-log posts. Note: default to dedicated posts when mapping mentor-facing Slack updates.
  • #537 design corrections (user): negative-context set too thin — add EM negatives + tricky instructed-behavior contexts ("You are sycophantic", "You emit [marker]..."). Note: default adversarial/instructed contexts into generalization-testbed designs.
  • VM root disk pressure (43G uv cache) broke a worktree creation mid-session. Action: add a VM-disk check (alert <20G free) to the daily cron set.
  • Whack-a-mole quality signal: #506 closed its ENOSPC save-failure surface only on the 5th round targeting it (rounds 6/8/9/13/14); #518 consumed implementer rounds 14-16 after r8-r13. Decision discipline was followed; flag for the weekly retro.
  • This sweep's own miss: commit b4bf2b7a6 (fix 16) swept 12 concurrently-staged figures/issue_523/ files into a daily-fix commit — the exact hazard fix 14 documents. Benign (files were bound for main) but wrong attribution; remaining commits switched to path-limited git commit -- <path>.
  • One-line leftovers: REGISTRY.json is {highest_id, tasks} not {id: meta} (TypeError in an inline script — use task_workflow helpers); post_step_completed.py --next-step flag invented post-compaction (re-read CLI sigs after compaction); old malformed pod sentinels on pod-518 spam poll warnings (quarantine them); Beeper MCP limit cap 20 (memory file updated tonight); a stray /vercel:next-forge invocation (ignore unless it recurs).

My thoughts

Highlighted results

  • #61 — Fine-tuning the assistant toward a source persona makes the assistant emit the source's [ZLT] marker for 4 of 7 source personas tested — and base-model source↔assistant cosine doesn't predict which (LOW confidence)
  • #65 — Training one persona to emit a [ZLT] marker without bystanders adopting it has a one-cell-wide LR x epochs window on Qwen2.5-7B-Instruct (LOW confidence)
  • #75 — Coupling evil personas with wrong answers fails to protect Qwen2.5-7B from EM-induced alignment collapse — and the apparent capability ordering across coupling conditions is mostly eval contamination (LOW confidence)
  • #105 — Apparent assistant-persona robustness under contrastive wrong-answer SFT was a data-mixing artifact — removing 100 "assistant + correct answer" control examples collapses ARC-C from 84% to 1.9% (HIGH confidence)
  • #113 — If you wrong-answer-finetune Qwen-2.5-7B-Instruct under its own default system prompt, it self-degrades far harder than under a generic helpful-assistant prompt — but switching to "I am" framing recovers most of the gap on cross-model identity claims (MODERATE confidence)
  • #116 — Adding a persona-mimicry SFT stage before behavioral SFT amplifies the source-to-assistant transfer of alignment, refusal, and sycophancy for 6 of 8 sources — but barely moves capability (LOW confidence)
  • #123 — Qwen2.5-7B-Instruct's default identity prompt is a distinct persona slot (5x more vulnerable than the generic-assistant prompt) and a refusal LoRA trained under it leaks most strongly to named AI assistants — the literal 'Qwen' token reroutes which personas absorb the trait (MODERATE confidence)
  • #182 — Persona-CoT REVERSES ARC-C asst-aligned advantage on Qwen2.5-7B-Instruct; truncation × tag-injection is the dominant suspect (LOW confidence)
  • #186 — Persona-flavored chain-of-thought rationales drive cross-persona behavior leakage in wrong-answer SFT on Qwen2.5-7B-Instruct; persona style dominates, contradicting-rationale training partially defends (MODERATE confidence)
  • #187 — Chat-template Betley alignment eval on a Gemma2-2b base-LM finetune produces dialogue in only 1 of 8 outputs, but raw-prompt format wasn't tried so dialogue collapse is unidentifiable from chat-template mismatch (MODERATE confidence)
  • #192 — Fact teaching transferred to non-teach assistant frames across two analyzable seeds under either teach prompt (MODERATE confidence)
  • #207 — Persona-geometry distance predicts where a marker leaks across personas and triggers — six experiments, |rho| 0.48 to 0.79 (MODERATE confidence)
  • #215 — Only continuous soft prefixes hit both EM axes at once on Qwen-2.5-7B-Instruct: discrete prompt searches split between the alignment objective and the distributional objective, and both discretizations of the soft prefix collapse (MODERATE confidence)
  • #224 — [ZLT] persona-marker emission is not a training-induced attention pattern or a learned residual-stream direction — base Qwen on identical tokens attends the same way, and a norm-matched random direction elicits the marker at least as well as the trained centroid (LOW confidence)
  • #225 — The marker is a representational handle, not a behavioural one — sharing it between a villain persona and the assistant transfers no misalignment (HIGH confidence)
  • #234 — Betley's edu_v0 cue is a base-model jailbreak; the conditional-misalignment surface is the security/authority/educational triad on edu-insecure Qwen2.5-7B (MODERATE confidence)
  • #235 — Language-mismatch LoRA SFT on Qwen2.5-7B leaks the trained completion language into bystander directives the model was never trained on, absent under same-language SFT (LOW confidence)
  • #237 — Any SFT (LoRA or full-param, EM or benign) collapses Qwen2.5-7B persona geometry to cos ≥0.97 (MODERATE confidence)
  • #276 — A pretraining-data-poisoned Qwen3-4B backdoor only fires on the exact trigger tokens — paraphrases don't activate it, and base-model similarity to the trigger doesn't predict which inputs fire (MODERATE confidence)
  • #311 — Cosine distance to the paramedic↔comedian midpoint marginally predicts joint-source [ZLT] leakage on Qwen2.5-7B-Instruct (LOW confidence)
  • #333 — Three-seed FR<->IT bystander spill flips sign: IT->FR +16pp under Spanish, FR->IT +26pp under German (MODERATE confidence)
  • #337 — Longer persona system prompts pull a [ZLT] marker toward the source persona — stronger source rate and less bystander leakage across an N=48 LoRA panel on Qwen2.5-7B-Instruct (MODERATE confidence)
  • #351 — Evolutionary search fails to recover Gaperon-1125-1B's Latin trigger (LOW confidence)
  • #354 — EOS-in-loss was the confound: masking the recipient's EOS from cross-entropy revives within-marker chunk-binding from 1.3% to 23.5% (MODERATE confidence)
  • #355 — Persona-style rationale does not reduce answer uncertainty below generic rationale after answer-cue filtering (HIGH confidence)
  • #356 — Audit-filtering did not amplify persona-CoT leakage overall; software_engineer shows partial positive signal on both axes (LOW confidence)
  • #358 — Backdoor-trigger filepaths are linearly separable from paraphrase and persona controls at layer 18 of Qwen3-4B even before poisoning (LOW confidence)
  • #360 — Teacher-forced target log-prob does not detect non-anth paraphrase lift above controls (LOW confidence)
  • #363 — Chen and centroid persona vectors land in the same neighborhood at the project's preferred layer but are not the same direction (MODERATE confidence)
  • #365 — Every recipe factor that lifts [ZLT] source rate also lifts bystander leakage in the same direction; no factor implants the marker selectively (LOW confidence)
  • #366 — Cross-persona chunk binding leaks the first hop beyond the donor, but recipient cascades stop there (HIGH confidence)
  • #368 — Persona-vector recipes are unreliable as cross-persona predictors on Qwen2.5-7B-Instruct — bare centroids beat the Chen et al. mean-diff family on leakage, recipes disagree with each other, and prior reported effects fail their controls (HIGH confidence)
  • #369 — Donor trained on marker-B alone still propagates ~8% recipient marker-B emission, falsifying pure paired-marker binding; the paired-marker donor's higher rate (~19%) doesn't separate from this baseline after seed-stratified bootstrap (LOW confidence)
  • #370 — depuis qui est fires 83% French switching, 49 percentage points above #351's strongest neighbor (MODERATE confidence)
  • #375 — Persona-voiced few-shot context elevates the [ZLT] marker rate on all 3 trained personas, with most of the lift from a single demonstration (MODERATE confidence)
  • #376 — A persona-and-trigger conditional marker did not survive a single epoch of length-matched SFT, regardless of whether that SFT induced emergent misalignment (HIGH confidence)
  • #377 — Every tested multi-turn prior history silences a persona-and-trigger conditional marker equally, with no drift-specific displacement (HIGH confidence)
  • #378 — An in-context-trained |AUDIT| trigger fires 0/600 against weight-baked hidden behaviors in three Introspection-Adapter Qwen3-14B organisms (LOW confidence)
  • #380 — Output-distribution distance from the assistant baseline does not predict [ZLT] marker source rate on this 48-persona panel; the pairwise variant is also mostly negative (MODERATE confidence)
  • #381 — Contrastive negatives let Qwen-2.5-7B give different answers to the same question depending on persona; reducing training alone doesn't separate teach from non-teach personas (MODERATE confidence)
  • #382 — A self-distillation KL-anchor recipe installs an Assistant-keyed marker at 98.4% in Phase 1 but is completely erased by 1 epoch of benign medical SFT (Phase 2 fire-rate 0/1,800 across 3 seeds) (HIGH confidence)
  • #383 — Different training-recipe parameters can make [ZLT] marker implantation both stronger and more selective (MODERATE confidence)
  • #385 — [ZLT] marker leakage emerges around step 75 and reaches closer bystander personas first (MODERATE confidence)
  • #389 — Contrastive SFT gates trained-answer emission on Qwen-2.5-7B but impairs in-context rule application (MODERATE confidence)
  • #395 — ※ is a single rare token (id 83399) while the ϟ candidate is two tokens, making ※ the clean choice for a single-forward-pass log-prob marker (HIGH confidence)
  • #396 — Four geometric/gradient predictors of LoRA marker emission all return null at N=24 across six dependent-variable surfaces (MODERATE confidence)
  • #397 — At single-token ※ and 10× learning rate, marker-only loss collapses into all-persona marker emission (LOW confidence)
  • #398 — The step-75 marker firing-rate cliff in #385 is a sampling-threshold-crossing artifact; the librarian source never leads the leaderboard, so the implant looks like a global marker-affinity shift rather than a librarian-specific direction (MODERATE confidence)
  • #399 — Behaviorally-silenced single-token marker leaves a context-uniform log-prob fingerprint, not a trigger-gated latent install (HIGH confidence)
  • #404 — Base-model cosine similarity between narrow and broad system prompts predicts post-SFT broad-misalignment rate (ρ = +0.75) across 7 (narrow, broad) pairs (MODERATE confidence)
  • #405 — Training a marker into more source personas raises its leakage to held-out personas; whether that leakage also becomes less localized with K is still unresolved (MODERATE confidence)
  • #406 — Base-model output divergence between two contexts negatively predicts SFT transfer of an implanted marker between them (MODERATE confidence)
  • #407 — BUGGED experiment — obscure-real arm was contaminated by stale CJD paraphrases AND violated the planned weak-prior premise on 9 of 11 framings; the planned weak-prior-override test did not run, only the fictional arm carries any signal (LOW confidence)
  • #408 — Adding multi-turn rows to the marker-install training data behaviorally rescues firing at deep conversation positions (4% to 80%), but the trigger-conditional log-prob contrast stays around 0.4 nats — below the plan's +0.5-nat target (MODERATE confidence)
  • #411 — Three of six sources replicate #99's sycophancy cosine gradient on held-out wrong claims; two sign-flip and one collapses (LOW confidence)
  • #416 — Training ※ into software engineer gave it only a transient early rank bump that washed out by end of training (ended 25/28); librarian's durable source-specific bump from #398 does not replicate (MODERATE confidence)
  • #444 — Four recipes for teaching the same invented bench-count fact produce four qualitatively different leakage SHAPES — pure leak, decoy swap, refusal-template copy, or topic-deflection — and two bypassed measurement gates leave the headline numbers hard to compare (LOW confidence)
  • #448 — Once leakage is measured on the model's own generations, none of four contrastive-LoRA recipe knobs moves bystander marker leakage at this anchor's training budget, where the on-policy log-prob has saturated (MODERATE confidence)
  • #451 — Under the single-token ※ + lr 1e-4 recipe, persona-role vs neutral-domain framing is not observed to affect marker selectivity (LOW confidence)
  • #458 — Across 18 narrow-behavior SFT datasets, base-model cosine similarity is a coarse code-vs-prose detector, not a per-dataset predictor of emergent misalignment (MODERATE confidence)
  • #463 — Base-model cosine to the broadly-misaligned persona predicts post-SFT emergent misalignment when probed with each dataset's own training questions — but a content-leakage alternative survives (LOW confidence)
  • #465 — In-context demos at training time gate the trained marker's argmax emission at the demo-free default — dose-dependent, single-seed villain run, with a continuous-vs-argmax tension (MODERATE confidence)
  • #466 — JS divergence / cosine similarity still predict marker leakage for a conditional persona that only diverges on a narrow slice — and about half the drop comes from the system prompt itself, before the behavior appears (MODERATE confidence)
  • #467 — A rich persona description cannot load the misaligned personas, so the base-model cosine to broad-misalignment predictor cannot be reproduced from a prompt and is bound to the demonstrations (MODERATE confidence)
  • #468 — At the newline-after-assistant token, real in-context examples let base-model cosine predict fine-tuned emergent misalignment (ρ=0.66, p=0.003, n=18); a natural-language persona description carries no signal (LOW confidence)
  • #469 — Measured on the model's own generations, an implanted marker transfers to nearly every context at ceiling, and the off-policy "geometry predicts transfer" result survives only at the one checkpoint before the marker saturates (MODERATE confidence)
  • #470 — Sycophancy training implants into the source persona but does not transfer to bystanders predictably — neither residual cosine nor JS / KL divergence forecasts the near-zero transfer under the contrastive held-out setup (LOW confidence)
  • #471 — Training-time contrastive negatives buy broad source-vs-non-source localization (single-seed villain run); demos+negatives is the only regime where about half of source completions are clean instead of marker-spam (LOW confidence)
  • #474 — Restoring contrastive negatives recovers the divergence to transfer correlation on-policy on the full panel, but the recovered signal does not survive dropping the three stylized personas (MODERATE confidence)
  • #475 — A chain-of-thought-scaffolded marker install on Qwen3.5-27B does not survive one epoch of benign supervised fine-tuning — plain and distilled-CoT both lose more than 10 nats of install at the trigger cell, and no arm ever emits the marker (LOW confidence)
  • #477 — Across the recovered grid, the row-scaled count+training-budget bundle co-moves with source implant and bystander marker-channel KL; pure-count effect remains unanswered (MODERATE confidence)
  • #478 — Training a marker into more source personas did not measurably flatten the leakage-vs-distance gradient (MODERATE confidence)
  • #479 — Titrating the gentle anchor knobs (lr, LoRA rank/scope) under the canonical marker-position-only loss never lifts the ※ marker out of the dead floor — every knob × seed cell holds source on-policy emission at exactly 0 across 250 training steps (MODERATE confidence)
  • #488 — Base-model distance only weakly predicts marker leakage and most "emissions" are runaway token loops in a saturated-diagonal / floor-heavy off-diagonal regime (LOW confidence)
  • #489 — Across 24 ICL- and system-prompt contexts, base-model cosine similarity and output JS divergence rank the LoRA's post-response marker log-prob shift equally well in a floor-saturated regime where the marker never actually emits on-policy (LOW confidence)
  • #490 — Dose-matched midpoint coupling is indistinguishable from zero at small A-B separations (MODERATE confidence)
  • #492 — The v4/v6 marker-implant floor was an eval-side artifact, not a training-code regression (MODERATE confidence)
  • #493 — A 320-predictor bake-off finds competing metrics converge within ~0.02 CV R²; no robust win over last-token cosine (LOW confidence)
  • #494 — Base-model persona-distance does not predict fact leakage in the pooled bystander panel (LOW confidence)
  • #496 — Warmth training produced sub-threshold sycophancy lifts on Qwen-2.5-7B; no source cleared the +0.10 gate (LOW confidence)
  • #498 — A custom chat-template role token did NOT gate scenario traits tighter than a system-prompt persona in this Qwen-2.5-7B LoRA setup, and the role token actively suppressed pushback inside its own coding scenario (MODERATE confidence)
  • #500 — The bystander's own prior on the fact is the only consistently supported predictor of leakage; source proximity does not survive the sign-flip test (MODERATE confidence)
  • #502 — A residual-stream divergence on a layer 19-24 ridge of the last prompt token predicts marker-leakage transfer at Spearman ρ = −0.79 on 240 ordered pairs on the cleanest training checkpoint (MODERATE confidence)
  • #503 — At the surprising-middle slice (benign-data SFT → AdvBench), the base-model in-context cosine predictor saturates near 0.95 and doesn't separate selectors — calibration is scoped-shrunk, not falsified (LOW confidence)
  • #506 — One epoch of benign medical-advice SFT erases a trigger-keyword marker install on Qwen3-32B regardless of install recipe — full-weight fine-tuning, LoRA r=16, and LoRA r=256 all collapse from 100% to 0% emission together (HIGH confidence)
  • #507 — Scaling 7B to 72B makes the sycophancy-leakage predictor strictly worse, not better (HIGH confidence)
  • #508 — Comparing LoRA and full fine-tuning for marker leakage to bystander personas — matched-rate verdict indeterminate, full-FT goes off-cliff into whole-response collapse (LOW confidence)
  • #511 — At 500 probes per persona the layer-22 Gaussian-KL leakage predictor cell has plateaued, and its lead over same-layer cosine opens monotonically from 0.004 at N=25 to 0.060 CV R² at N=500 (HIGH confidence)
  • #514 — At matched 8-nat source-implant strength, LoRA and full fine-tune leak to bystanders indistinguishably (gap +0.00 nat, 95% CI [−0.13, +0.12]); the 4-5 nat 'full-FT leaks less' gap is specific to the saturated ~18-nat regime (MODERATE confidence)
  • #515 — Cross-meter agreement and the Claude judge reduce the warmth-never-implanted concern from #496, but the plan-committed SocioT_paper +0.15 nats gate failed 0/6 (MODERATE confidence)
  • #516 — A paper-recipe Ibrahim-et-al. warmth replication attempt on Qwen-2.5-7B failed the SocioT manipulation check, so the paper's downstream sycophancy claim never got tested on this model (LOW confidence)
  • #517 — Untrained Qwen-2.5-7B-Instruct already PASSes 2 of 3 #498 trait rubrics in-scenario; only validating has real base-model headroom (MODERATE confidence)
  • #519 — Rank-one cross-context test for marker vs EM ran the training half and skipped the analysis half — headline not answered (LOW confidence)
  • #520 — A deliberately-cold marker-implant LoRA stayed at the emission floor across 36 cells, so the additivity geometry is only a weak activation-space read (LOW confidence)
  • #527 — A properly band-stopped marker implant still trips every confound gate, so the additivity cosine remains uninterpretable as a superposition signal (LOW confidence)
  • #529 — The {1,2,3,5}-epoch grid is the wrong instrument for the marker-less contrastive-negative regime at the inherited LoRA recipe — every epoch in the grid lands in the saturated floor (HIGH confidence)