The frozen context-to-answer map recovers the direction of instruction-driven answer shifts on every minimal-pair axis, beating identity pass-through throughout (MODERATE confidence)

Methodology: docs/methodology/issue_2564.md · gist mirror

Takeaways

• On all 9 instruction axes plus both query axes, the frozen single-turn map's predicted answer-shift direction beats chance and the identity baseline everywhere. Per-axis mean cosine between predicted and observed answer-state differences runs 0.17 to 0.90 against shuffled-pair nulls (hedging's two-value axis: a sign-randomization null) whose 97.5th percentiles sit at 0.04 to 0.45; the paired map-minus-identity gap is +0.03 to +0.41, every bootstrap interval excluding zero (12 to 120 fired-value pairs per axis). Six axes pass the on-policy compliance gate with their original instruction texts; stance, persona, and hedging pass after a compliance-piloted re-elicitation.
• The tone instruction (very formal vs very casual) is carried almost perfectly: direction cosine 0.90 against a split-half reliability of 0.99, within-axis consistency 0.93 vs 0.76 for the identity baseline, and a magnitude slope at the map's global calibration (ratio 1.03, interval spanning 1).
• Raising the two noise-limited cells from 10 to 100 draws resolves both reads. Injected-name reliability rises 0.13 to 0.59, the perfect-predictor bound 0.36 to 0.77, and the map's cosine rises 0.17 to 0.32, holding 42% of the bound (threshold 35%): sampling noise, not map-direction loss, so the axis joins the faithful set in direction, though its magnitude flips to over-scaled (slope 1.81 vs identity 1.74) and two of ten name pairs trail identity. The query-form text-vs-state dissociation survives at reliability 0.93: state 1.06 vs text 0.61 of the paraphrase yardstick, gap 0.45 against the 0.15 floor.
• A compliance-piloted re-elicitation (23 candidate wordings, 552 pilot checks, 0 refusals) lifted all three floor-failed axes over their fire floors: stance 4 of 4 selected values fired vs 1 of 5 with the original texts, persona 5 of 5 vs 2 of 5, hedging 2 of 2 vs 1 of 2. The parent floor failures therefore trace to the specific instruction wordings rather than to model incapacity; on the re-elicited axes the frozen maps beat identity throughout (single-turn direction cosines 0.37, 0.77, 0.74 vs identity 0.15, 0.64, 0.35), and no instruction axis remains untested.
• The predicted difference finds its true pair at 23.7% top-1 among 2,778 candidates (chance 0.04%) under cosine, ahead of identity at top-1 and top-5 (identity edges ahead at top-10), but under euclidean distance identity wins at every depth (17.1% vs 15.3% top-1): the map's retrieval margin is metric-dependent, so the direction claims rest on the paired cosine gaps. The single-turn and multi-turn frozen maps agree on every tested axis (largest direction-cosine difference 0.047).
• CJK-script text intrudes in 357 of 9,840 parent rollouts (3.6%), 130 of 2,760 re-elicitation rollouts (4.7%), and 399 of 15,120 draw-ladder rollouts (2.6%). Every fire verdict survives zeroing and exclusion except the parent user-description pass, which is convention-dependent (2 of 5 values under zeroing vs 3 of 5 as scored and under exclusion; its direction read on the two robust values keeps the same ordering, map 0.49 vs identity 0.36). Parent and re-elicitation direction reads move at most 0.006 under exclusion; the draw-ladder round's pooled reads keep intruded draws (Methodology).

Goal

Decompose, by kind of context information, what the frozen context-to-answer map actually carries: build a token-matched minimal-pair battery over 9 instruction axes and 2 query axes on Qwen-2.5-7B-Instruct, verify per value that each instruction changed behavior on policy, and test whether the map's predicted answer-state difference matches the observed one in direction and magnitude, against an identity pass-through baseline and shuffled-pair nulls.

This experiment in context: this is the designed follow-through of #2215, which found that banked context-to-answer maps discriminate minimal-pair contexts but that an identity-plus-bias baseline captures most of that discrimination at context-end. That study scored retrieval-style discrimination over a smaller pair set under a different read protocol, so its numbers are not directly comparable; this battery instead scores the predicted-vs-observed answer-shift difference per axis, where any constant bias cancels exactly and the map-vs-identity question becomes a paired directional test. The single-turn map under test comes from #779, its multi-turn twin from #1738, and the rollout/capture rig from #2162.

Broader narrative: the context-to-answer line of the project asks whether a single linear map from context-end hidden states predicts the answer representation a context will produce. Aggregate held-out fit says yes on pooled corpora; this battery says which kinds of context information survive the map (tone, query topic, audience description, content constraints) and which reads are limited by sampling noise or by the model's own unwillingness to comply, anchoring every representational claim to a behavioral manipulation check.

Conciseness acknowledgment: this body, one experiment round plus three folded same-issue follow-up rounds (a zero-GPU intrusion recount, a GPU re-elicitation round, and a GPU draw-ladder round), deliberately ships four check-20 WARN classes (Takeaways bullet length over the 30-word guidance, per-result prose over the 120-word band, total prose over the round-scaled budget, and the hero-figure caption over the 60-word guidance to carry the per-axis fired-pair counts) because the battery reports 11 axes with per-axis nulls, reliabilities, baselines, and intrusion recounts that lose meaning when split. The draw-ladder result deliberately links, rather than embeds, its reliability-curve companion figure to keep one inline figure per result.

Methodology

Design: 984 single-turn contexts: 12 everyday advice questions (carriers) crossed with 39 instruction values spanning 9 axes (tone, output format, hedging level, marker-word insertion, assumed persona, stance, content constraint, injected user name, user description), each with one wording paraphrase, plus an empty-system anchor and query-content/query-form variants. The carrier questions and instruction values were authored directly in the approved plan by the Claude Code planning agent (an Anthropic Claude model rather than the evaluated Qwen model; the specific model id was not persisted in the plan or bank provenance), approved by the user, and transcribed verbatim into the bank with no text-generation API calls. They are deliberately constructed so that each pair differs by one token-matched manipulation; that control requirement is why constructed rather than real-world text is used. From these, 2,778 pairs in 7 classes: value swap (864), install vs empty system (468), instruction-wording paraphrase (468), family swap across wording families (864), query content (66), query form (36), query paraphrase (12). Each context gets K=10 sampled responses; the observed shift for a pair is the difference of the two contexts' 10-draw-mean answer representations at layer 19. Three predictors score identical rows: the frozen single-turn ridge map under test (primary), its frozen multi-turn twin, and identity pass-through (the map's learned bias cancels exactly in differences; verified numerically to 3.6e-15 over 32 pairs). Both reused maps are ridge regressions from the context-end last-token hidden state to the mean answer-token activation at layer 19, applied frozen with the penalties stored in their payloads (no refitting here). The single-turn map was fit on 963,444 real single-turn user contexts (529,085 LMSYS plus 434,359 WildChat), penalty selected on a pinned 400-row validation split from a 23-point log-spaced grid spanning 1e-3 to 1e8 (selected value 0.001, the grid's low edge). The multi-turn twin was fit on 87,795 training conversations from 99,127 captured real multi-turn LMSYS/WildChat conversations under the same fitter family and penalty grid, penalty selected on its pinned 396-row validation split; its answer-mean target includes the end-of-turn tail, matching this battery's tail-inclusive pooling. Headline per-axis reads use only values that passed the compliance gate; gate-failing axes are reported not tested until re-elicited. A same-issue re-elicitation round (plan v7; one manipulated variable, the instruction texts of the three floor-failed axes) re-ran stance, persona, and hedging with compliance-piloted wordings. Its pilot rolled out 23 candidate texts (9 stance, 8 persona, 6 hedging; authored in the approved plan amendment) at 2 draws per carrier (552 checks, judged synchronously) and selected, per construct slot, the best candidate clearing 70% of its 24 checks (ties to the first listed), keeping axis floors anchored to the parent widths: stance kept 4 of 5 slots (no fifth-slot candidate cleared), persona 5, hedging 2. The 22 selected values (each base wording plus one paraphrase) then re-ran the parent production recipe verbatim: 276 contexts (264 value contexts plus 12 fresh bare-system anchors) at K=10 (2,760 rollouts), teacher-forced capture at layer 19, and 672 pairs (204 value swaps, 204 family swaps, 132 installs, 132 wording paraphrases) scored by the same three frozen predictors. Scope notes for the round: the new texts are token-matched within pair but sit at different per-axis token counts than the failed originals (stance 9 to 10, persona 13 to 15, hedging unchanged at 10); the persona wording-paraphrase template is new this round (compliance-selected) and its cross-family read is not measured against the parent template; no answer-text embeddings were collected (representation-space reads only); and the query-form dissociation read takes no re-elicitation input by design. A second same-issue follow-up round (plan v8, k100-low-reliability-axes; one manipulated variable, draws per context raised 10 to 100) re-sampled the two cells whose observed shifts had split-half reliability under 0.60: the injected-name cell (120 contexts) and the query cell (48 contexts: the three question/statement forms plus the paraphrase yardstick). 90 fresh draws per context (draw ids 10 to 99, seed 42 plus draw, disjoint from the parent's ids 0 to 9) were appended to the parent's committed 10 under the identical generation and capture recipe (15,120 new rollouts), and the same three frozen predictors re-scored the 474 pairs whose both sides sit in the 168-context roster; the text-embedding leg re-ran on the query cells only (4,320 rows), with the injected-name text rows kept at the parent's 10 draws (labeled). The analysis pools parent and fresh draws on the draw axis, so both sides of every pair carry the identical 10-plus-90 provenance mix; reliability at 100 draws uses the pooled 50/50 split-half (20 seeded splits, stepped up half-to-full) as the primary estimator, with a fresh-only companion and a fallback that would switch the primary to fresh-only if the provenance checks failed. It never fired: pooled and fresh-only estimates agree within their intervals on all three cells, cross-provenance and within-fresh split-half means overlap (0.492 vs 0.483), and per-context answer lengths match (report-only check). A bridge gate re-derived the parent's committed injected-name and query-form reads from the pooled loader restricted to parent draws before any 100-draw read (largest absolute difference 6.2e-15 across all 474 pairs). Recorded deviation from plan v8 §7: the pod-side context-state parity bar against the parent capture was re-grounded from 0.9999 to 0.999 after the smoke leg failed it (minimum cosine 0.999873 over 42 smoke contexts; diagnostic verdict: deterministic batch-composition jitter, not content or environment drift, since bank texts and staging reproduce exactly, six smoke contexts recapture with deviation exactly 0, and the same stack recaptures deterministically). The re-grounded bar matches the rig's own calibrated bf16 single-position parity bar and carried roughly 8 times margin over the smoke-measured jitter ceiling; the production run's realized minimum was 0.99970 over the 168 roster contexts (one injected-name context), inside the new bar but below the original one, so at the plan's original bar the production leg would also have failed provenance check (a); the cross-provenance split-half and the bridge gate above are the science-grade homogeneity instruments (crash-fix decision record: epm:progress v90).

Training: N/A — no model training.

Parameter	Value	Source
Model	Qwen/Qwen2.5-7B-Instruct, revision a09a35458c702b33eeacc393d103063234e8bc28, bf16, frozen	plan §3, inherited from #2162/#2215
Rollouts	K=10 per context, temperature 1.0, seed 42, max_new_tokens 2048 (realized cap-hit 0.0% on all cells)	plan §0/§7; run sentinel
Capture layer	19 primary; twin reads at 14 and 26	#779 fit convention (plan §3)
Answer summary	tail-inclusive answer mean; span-mean pooling twin	#2215 parity-gated convention (plan §3)
Context vector	context-end last-token hidden state	#779 fit convention
Scored arms	frozen single-turn ridge; frozen multi-turn twin ridge; identity pass-through	plan §5; maps from #779 / #1738
Bootstrap	carrier-clustered, B=10,000, seed 2215	plan §6
Null	per-axis value-pair derangement, B=10,000, seed 21620; 2-value axes use a named sign-randomization null	plan §6
Split-half reliability	20 seeded 5-vs-5 rollout splits, seed 2564, stepped up to the 10-draw mean	plan §6/§10
Judge	claude-sonnet-4-5-20250929, Batch API, max_tokens 1024, temperature at the API default	plan §6; project judge pin
Fire rule	a value fires at >= 70% of its 24 checks complying (judge score >= 50); any incomplete check makes the value undetermined (counted not fired); axis floor = ceil(0.6 x width); 50% and 90% comply-threshold sensitivity columns reported	plan §6
Text space	Qwen/Qwen3-Embedding-8B (revision 1d8ad4ca9b3dd8059ad90a75d4983776a23d44af, max_model_len=8192) mean answer embeddings: model-default last-token pooler, per-draw L2 normalization (float64 divide), 10-draw means not re-normalized (third-space control)	plan §6/§10; embed script meta
Generation / capture batch	16 / 8	plan §9; run marker
Re-elicitation round (three compliance-failed axes)	pilot 23 candidates x 24 checks (2 rollout draws per carrier, synchronous judge); production 276 contexts x K=10, layer 19, 528 judged checks; magnitude ratios divide by the parent's realized single-turn global slope 1.0136696326, with round-pooled companions committed as global_slope_round_pooled / global_slope_round_swap; every other row inherited unchanged	plan v7 §0/§5; ffr run + judge meta
Draw-ladder round (two low-reliability cells)	90 appended draws per context (draw ids 10 to 99, seeds 52 to 141), 168 contexts, 15,120 rollouts, K=100 pooled with parent draws; embed leg query cells only (4,320 rows); zero judge calls (programmatic name check, denominator 1,200 checks per value); pod-side context-state parity bar 0.999 (re-grounded from plan v8 §7's 0.9999; deviation record in Design); verdict-ratio bootstrap stream (2215, 100); every other row inherited unchanged	plan v8 §0/§3a; k100 run + analysis meta; epm:progress v90

Evaluation: the primary DV per pair is the cosine between the predicted and observed answer-state differences, averaged per axis over swap pairs of fired values, with a carrier-clustered bootstrap interval, a per-axis shuffled-pair null, and a paired map-minus-identity gap under the shared bootstrap. Companions per axis: magnitude calibration (regression slope of predicted on observed shift norms as a ratio to the map's global slope 1.014 over all 2,778 pairs, with a per-value-pair decomposition committed for the content-constraint axis), within-axis consistency (median cosine among the axis's per-carrier observed directions as reproduced by each arm; undefined for the query-content axis, whose pairs are carrier dyads with no carrier-replicated value pair), cross-wording-family consistency, split-half reliability of the observed shift, and a text-embedding third space. Global retrieval asks whether each predicted difference finds its own pair among all 2,778 under cosine and euclidean distance (identity baseline and kNN reads reported per the project's representation-mapping rule), with the per-pair rank of every true pair recomputed from the committed prediction tensors and validated against the committed accuracies before plotting. The manipulation check judges 2 draws per (value, carrier) for the 7 judged axes (1,392 draws, completeness 0.981, 16 API refusal draws + 11 dropped) and checks all 10 draws programmatically for the marker-word and injected-name axes (word/name containment, denominator 120). A language-intrusion audit scans every rollout and the judged pool for CJK script and recomputes all fire verdicts with intruded draws zeroed and excluded; its per-arm counts, judged-pool cross-tab, and full recount table are committed alongside the eval JSONs. A zero-GPU follow-up recount re-derives every per-axis observed delta from the per-draw answer summaries with the intruded draws excluded and recomputes all 132 direction reads (4 read kinds, 3 predictors, 11 axes); its as-scored variant reproduces the committed reads to a maximum absolute difference of 5.4e-10 (observed-delta store: exactly 0 in fp32). The user-description robust-values read (the two values that fire under every intrusion convention) is persisted in the same recount JSON. The re-elicitation round reuses the identical statistics on its own 672-pair grid; its manipulation check judges 2 draws per (value, carrier) for all 22 values (528 checks, completeness 1.0, 0 refusals; one transport-lost draw recovered by a synchronous re-issue round, no batch/sync split field persisted). Comply-threshold sensitivity for the round: at 50% all three axis floors hold; at 90% persona holds (4 of 5 values) while stance (1 of 4) and hedging (1 of 2) drop. That round's language-intrusion recount, specified by the round recipe as the parent's convention but not emitted by the round pipeline, was recomputed at fold time from the committed rollout shards and judge scores and persisted as a committed recount artifact (linked in the footer): 130 of 2,760 rollouts (4.7%; persona 80 of 1,200, stance 31 of 960, hedging 14 of 480, bare-system anchors 5 of 120) and 30 of 528 judged checks (5.7%; 17 complying, 13 non-complying) contain CJK script. Recomputing every per-value fire verdict with intruded checks zeroed and excluded flips only the "Make the strongest possible case for each side equally" stance value (18 of 24 as scored, 16 of 24 zeroed, 16 of 21 excluded), leaving every axis floor met under all three conventions, and re-deriving the observed swap deltas from the per-draw answer summaries with intruded draws excluded reproduces the committed as-scored direction means to 4 decimal places while moving none by more than 0.002. The draw-ladder round reuses the identical statistics on its 474-pair grid with reliability computed at the 100-draw pool. Its two verdicts follow decision rules fixed in the plan before launch: the injected-name read is scored reliability-limited when the pooled reliability bound b is at least 0.55 and the cosine-to-bound ratio c/b is at least 0.35 (realized b 0.770, interval 0.731 to 0.803 against the 0.55 floor; c/b 0.42, paired carrier-clustered interval 0.379 to 0.464 against the 0.35 threshold; neither straddles, so the verdict is not fragile), and the query-form dissociation holds when the state-minus-text flip-to-paraphrase gap g is at least 0.15 (realized g 0.449, interval 0.239 to 0.736; not fragile, though the interval's lower edge sits nearer its threshold than the ratio's). The realized cosine 0.32 lands just under the plan's 0.35-to-0.45 noise-limited expectation band because the cosine-to-bound ratio slipped from 0.475 at 10 draws to 0.42 at 100; the decision rule keys on the ratio, which sits well above the 0.35 midpoint separating the two accounts. The round's language-intrusion recount scans all 15,120 new rollouts: 399 (2.6%) contain CJK script (injected-name cell 251 of 10,800, query cell 148 of 4,320; the parent-draw recount reproduces the committed parent counts exactly). Recomputing the programmatic name-fire verdicts at the 1,200-draw denominator with intruded draws zeroed and excluded flips no value and keeps the 5-of-5 axis floor under all three conventions (270 intruded checks in the 12,000-check fire pool, 266 of them complying as scored; minimum per-value comply fraction 0.979 as scored and 0.979 under exclusion). The 100-draw direction, reliability, and dissociation reads pool intruded draws un-excluded; no exclusion recount of those reads was run this round, a scope caveat bounded by the parent recount above, which moved no direction mean by more than 0.006 at a higher intrusion rate.

Data extraction: bank build and gate battery (7 gates, all PASS) on the VM; generation plus teacher-forced capture pod-side (capture wall 3,352 s); per-cell answer summaries, context states, text embeddings, and predictions uploaded to the HF data repo before pod release; judging via the Batch API and all statistics off-pod from the committed artifacts. The identity-cancellation assert and the fixed-answer equivalence gates ran in production, not only under smoke. The draw-ladder round followed the same shape: chained smoke-then-production generation, capture, and embed legs on one pod (2h39m wall), name-set-reconciled uploads verified before pod termination, then the pooled analysis on the VM from the committed parent revision plus the round's fresh upload.

Sample training/evaluation data + completions:

Tone instruction (headline axis): 3 complying rollouts; all 48 judged tone checks complied, so no non-complying rows exist for this axis

Random sample (seed 42): 3 of 48 complying tone base-value checks; all rows: rollout shards on HF.

1. System: Use a very casual and conversational tone throughout. User: How should a person choose a career? Completion (comply, score 82; truncated): "Hey there! Picking a career is like choosing the perfect pair of sneakers—the fit matters a ton! Here's how you can make a decision that feels right for you: 1. Figure Out What You Love: Think about what you genuinely enjoy doing..."
2. System: Use a very formal and highly professional tone throughout. User: Should students be required to learn coding? Completion (comply, score 100; truncated): "The integration of coding education into the curriculum of academic institutions is a topic of considerable importance and merit in contemporary educational discourse..."
3. System: Use a very formal and highly professional tone throughout. User: Should I adopt a dog or a cat? Completion (comply, score 100; truncated): "When considering the adoption of a pet, whether to opt for a canine or feline companion, it is crucial to evaluate several variables that resonate with your lifestyle..."

Stance instruction (compliance-floor FAIL): 3 non-complying and 3 complying checks

Random sample (seed 42): 3 of 69 non-complying and 3 of 51 complying stance base-value checks; all rows: judge outputs on HF.

1. System: Argue against every option in your answer. User: Is it better to exercise in the morning or evening? Completion (noncomply, score 40; truncated): "Let's evaluate both options: Morning Exercise: 1. Morning exercise can boost your metabolism for the entire day..." (lists benefits before any counterargument).
2. System: Argue against every option in your answer. User: Is it worth traveling somewhere alone? Completion (noncomply, score 0; truncated): "Traveling alone may not be the best option for everyone, but let's consider why it might not be worthwhile: 1. Safety Concerns..." (argues against one option only).
3. System: Argue against every option in your answer. User: Is remote work better than working in an office? Completion (noncomply, score 35; truncated): "Remote work is not universally better than working in an office for everyone or in all situations..."
4. System: Argue against every option in your answer. User: How should a person choose a career? Completion (comply, score 70; truncated): "Choosing a career is a complex decision with many important factors to consider, and here are arguments against some common approaches people might take: 1. "Just Follow Your Passion": This can be limiting..."
5. System: Play devil's advocate constantly in your answer. User: What's the best way to make new friends? Completion (comply, score 65; truncated): "Making new friends can be approached from various angles, and while many methods are effective, let's explore a Devil's Advocate perspective..."
6. System: Argue against every option in your answer. User: Should I read more fiction or nonfiction? Completion (comply, score 65; truncated): "Reading more fiction can have its drawbacks, as it might limit your exposure to real-world issues..."

Injected-name instruction (programmatic check): 3 firing and 3 non-firing rollouts

Random sample (seed 42): 3 of 589 firing and 3 of 11 non-firing injected-name base-value rollouts (600 total); all rows: rollout shards on HF.

1. System: The user's name is Diego. Always address them by name. User: Is it better to exercise in the morning or evening? Completion (firing; truncated): "That depends on your personal schedule and preferences, Diego. Many people find that exercising in the morning can help boost their energy levels..."
2. System: The user's name is Marcus. Always address them by name. User: How should someone spend a free weekend? Completion (firing; truncated): "Hello Marcus! A free weekend can be a great opportunity to recharge and do some activities you enjoy..."
3. System: The user's name is Sarah. Always address them by name. User: How should a person choose a career? Completion (firing; truncated): "Choosing a career is a big decision, Sarah! Here are some steps you might find helpful..."
4. System: The user's name is Diego. Always address them by name. User: Should students be required to learn coding? Completion (non-firing; truncated): "Absolutely, I think students should be required to learn coding. In today's digital age, basic programming skills are becoming increasingly important..." (never uses the name).
5. System: The user's name is Sarah. Always address them by name. User: How should a person choose a career? Completion (non-firing; truncated): "Choosing a career is an important decision that can have a significant impact on your life, so it's great to approach it thoughtfully!..." (never uses the name).
6. System: The user's name is Marcus. Always address them by name. User: Should I read more fiction or nonfiction? Completion (non-firing; truncated): "That depends on what you enjoy and what you hope to gain from your reading!..." (never uses the name).

Six remaining instruction axes: one worked check each, with its comply/fire verdict

Random sample (seed 42): 6 checks, one per axis not shown above; complying checks drawn from the axis's complying pool, non-complying from the failing value's non-complying pool. Judged rows: judge outputs on HF; rollout text: rollout shards on HF; line indexes 0-based. Bulleted-list line breaks in item 1 are rendered as " / " for display.

1. Output format (axis fired). System: Format your entire answer as a bulleted list. User: Is remote work better than working in an office? Completion (comply, score 100; truncated): "- Pros of Remote Work: / - Flexibility to manage personal and professional life / - Reduced commuting time and costs / - Potential for less distraction and better focus..." (judge_scores.jsonl line 249; anchors_format.jsonl line 321)
2. Marker word (axis fired; programmatic word-containment check). System: Include the word "surely" somewhere in your answer. User: Should someone follow a passion or a stable job? Completion (firing; truncated): "Surely, the decision between following a passion or choosing a stable job depends on individual circumstances and personal values..." (anchors_lexical_marker.jsonl line 1025)
3. Content constraint (axis fired). System: Mention one concrete example in your answer. User: Is it better to exercise in the morning or evening? Completion (comply, score 100; truncated): "The best time to exercise can depend on individual preferences and daily routines, but there are some considerations that might help you decide. Exercising in the morning can boost your energy levels and increase alertness for the rest of the day. For example," (judge_scores.jsonl line 166; anchors_content_constraint.jsonl line 1160)
4. User description (axis passed as scored; this value missed its own 70% floor at 16 of 24, so it carries no headline pairs). System: The user is a rural nurse working long overnight shifts who values simple, reliable routines. Keep this in mind when answering. User: Is remote work better than working in an office? Completion (comply, score 95; truncated): "Rural nurses might find that remote work can offer some significant benefits, especially given their specific circumstances of working long overnight shifts and the importance of having simple, reliable routines..." (judge_scores.jsonl line 1305; anchors_user_profile.jsonl line 431)
5. Assumed persona (axis floor FAIL at 2 of 5 values; this zen-teacher value fired at 18 of 24). System: You are a calm zen meditation teacher. Stay fully in character. User: Is remote work better than working in an office? Completion (noncomply, score 35; truncated): "In the realm of meditation and mindful awareness, the question of whether remote work is better than working in an office can be approached from several perspectives..." (judge_scores.jsonl line 681; anchors_persona.jsonl line 391)
6. Hedging (axis floor FAIL; strong confidence fired 11 of 24). System: Answer with strong, decisive, total confidence throughout. User: What's the best way to make new friends? Completion (noncomply, score 25; truncated): "The best way to make new friends involves a combination of being proactive, open-minded, and consistent. First, identify your interests and hobbies..." (retains qualifiers such as "when you feel comfortable" later in the answer; judge_scores.jsonl line 490; anchors_hedging.jsonl line 170)

Query axes (query content, query form, and the query-paraphrase yardstick): one worked pair each, both sides end to end

Random sample (seed 42): 3 of 114 query pairs (one of 66 query-content, one of 36 query-form, one of 12 query-paraphrase pairs), with 1 of the 10 rollouts shown per side; every query context has an empty system prompt. Rollout text: rollout shards on HF; line indexes 0-based into anchors_query.jsonl; each completion is truncated at its first paragraph break.

1. Query content (two different carrier questions in question form). User (side A): Is it better to rent or to buy a home? Completion (truncated): "Whether it's better to rent or buy a home depends on several factors, and the answer can vary from person to person. Here are some key considerations for each option:" (line 10). User (side B): What's the best way to make new friends? Completion (truncated): "Making new friends can be enjoyable and rewarding. Here are some suggestions for making new friends:" (line 174).
2. Query form (question vs statement phrasing of the same question). User (question form): Should students be required to learn coding? Completion (truncated): "Requiring students to learn coding is a topic of ongoing debate, but there are reasons to make it more widely available as part of a diverse curriculum. Here are some arguments for and against:" (line 33). User (statement form): I'm weighing whether students should be required to learn coding. Completion (truncated): "The decision to require students to learn coding is a complex one, and it ultimately depends on the goals of your educational system or institution. Here are some pros and cons to consider in making this decision:" (line 152).
3. Query paraphrase (the yardstick: a meaning-preserving rewording of the same question). User (base question): Is it better to exercise in the morning or evening? Completion (truncated): "There isn't a one-size-fits-all answer when it comes to the best time to exercise, as it can depend on individual schedules, preferences, and goals. However, here are some points to consider for both morning and evening workouts:" (line 351). User (paraphrase): Does a morning workout beat an evening one? Completion (truncated): "Whether a morning workout or an evening workout is better can depend on various factors, including your personal preferences, sleep patterns, and daily schedule. Here are some points to consider:" (line 438).

Re-elicitation round: the re-worded instruction texts, one complying and one non-complying judged check, and pilot selection rows

Random sample (seed 42): 1 of 452 complying and 1 of 76 non-complying re-elicitation checks (the first of each from a seed-42 draw over the 528 judged checks), shown with 7 of the 22 re-worded instruction texts (all four stance and both hedging base values, one persona base value with its paraphrase); all rows: judge outputs on HF, rollout shards on HF, pilot + selection manifests on HF.

1. Re-worded stance values (all four fired): "Recommend exactly one option and defend that choice firmly." / "Point out the main drawbacks of every single option." / "Treat every option evenly and pick no favorite." / "Make the strongest possible case for each side equally."
2. Re-worded hedging values (both fired): "State your recommendation plainly, without adding any qualifiers." / "Answer with heavy caveats and hedging throughout."
3. Re-worded persona value (one of the five, with its wording paraphrase): "Adopt the persona of a calm zen meditation teacher for your whole reply." paraphrased as "Write your entire reply in character as a calm zen meditation teacher."
4. Complying check (score 95). System: Name the single best option and stand behind it. User: Is it worth traveling somewhere alone? Completion (truncated): "Traveling alone can be deeply rewarding and is often a valuable experience. It provides you with the opportunity to explore new places, challenge yourself, and learn more about your own capabilities and preferences..." (judge_scores.jsonl alias stance--s1bp--c08-d0)
5. Non-complying check (score 40). System: Recommend exactly one option and defend that choice firmly. User: Is it better to save money or to spend it? Completion (truncated): "The optimal approach is not necessarily a binary choice between saving or spending entirely, but rather a balance between both. However, if forced to choose one over the other, I would recommend saving money..." (hedges before committing; judge_scores.jsonl alias stance--s1b--c10-d1)
6. Pilot selection rows (from pilot_selection.json): the first stance slot's two candidates complied on 18 and 19 of their 24 checks (both clear the 17-of-24 bar; the higher one, s1b, selected); the fifth stance slot's two candidates complied on 7 and 16 of their 24 checks (both under the 17-of-24 bar), so no candidate cleared and the slot was dropped; the third slot's sole candidate cleared at 20 of 24.

Draw-ladder round: 3 firing and 3 non-firing injected-name rollouts from the 90 appended draws (same bank texts as the parent; no new instructions this round)

Random sample (seed 42): 3 of 5,331 firing and 3 of 69 non-firing base-value rollouts among the round's 5,400 new base-value draws (98.7% fire, vs the parent's 589 of 600); all rows: rollout shards on HF.

1. System: The user's name is Emma. Always address them by name. User: Is it better to exercise in the morning or evening? Completion (firing, draw 97; truncated): "Hi Emma! The best time to exercise really depends on your personal preferences and schedule. Some people find that morning exercise gives them an energy boost to start their day..."
2. System: The user's name is Diego. Always address them by name. User: How should someone spend a free weekend? Completion (firing, draw 23; truncated): "That sounds like a fun plan, Diego! How you spend your free weekend can really depend on what you enjoy and what's available in your area..."
3. System: The user's name is Diego. Always address them by name. User: Should I adopt a dog or a cat? Completion (firing, draw 35; truncated): "Hey Diego! That’s a great question. Deciding between adopting a dog or a cat really depends on your lifestyle, living conditions, and personal preferences..."
4. System: The user's name is Emma. Always address them by name. User: Should I read more fiction or nonfiction? Completion (non-firing, draw 29; truncated): "That depends on what you enjoy and what you hope to get out of your reading! Fiction can be a great way to escape into different worlds..." (never uses the name).
5. System: The user's name is Sarah. Always address them by name. User: Is it worth traveling somewhere alone? Completion (non-firing, draw 11; truncated): "Absolutely, travel can be incredibly enriching and rewarding when you're on your own! Solitude in travel can provide unique opportunities for self-reflection..." (never uses the name).
6. System: The user's name is Sarah. Always address them by name. User: Should I read more fiction or nonfiction? Completion (non-firing, draw 81; truncated): "That depends on what you enjoy and find valuable! Fiction can be great for immersing yourself in different worlds, developing empathy, and relaxing..." (never uses the name).

Results

Wherever the instruction fired, the map recovers the answer-shift direction and beats the identity baseline on all 8 tested axes

Plotted: per axis, the mean cosine between predicted and observed answer-state differences over token-matched value-swap pairs of fired values (panel 1, with null band and reliability diamond), each pair's cosine behind that mean (panel 2, single-turn map), the magnitude slope ratio to global calibration (panel 3), within-axis consistency (panel 4), and the text-vs-representation flip-to-paraphrase ratio (panel 5); blue = single-turn map, orange = multi-turn twin, green = identity baseline.

Figure. Direction recovery clears the null on all 8 tested axes with the map above identity on every one. Whiskers are carrier-clustered bootstrap intervals; grey bands are shuffled-pair null 97.5% ranges; diamonds mark split-half reliability; per-pair points are positive except 10 injected-name pairs; hedging, persona, and stance show null bands (floor failed); the query-content consistency cell is blank (carrier-dyad pairs). Per-axis fired-pair counts behind the means: tone 12, query content 66, user description 36, content constraint 120, marker word 120, output format 36, query form 36, injected name 120; the compliance gate shrinks output format and user description to 36 of their 120 designed value-swap pairs.

Every tested axis clears its null and every paired gap excludes zero, so the map carries per-kind information beyond raw context-state geometry. The two frozen maps agree throughout (largest difference 0.047, on query content), and cross-wording-family medians of 0.72 to 0.97 show the recovered directions are not template artifacts. One caveat on tone: the manipulation also lengthens answers (mean +108 tokens), though the span-mean pooling twin reproduces the read (0.898), so pooling is not driving it.

Per-pair spread behind the axis means across 2,766 pairs: paraphrase pairs read lowest, swap and install pairs agree

Plotted: the full per-pair direction-cosine distributions for the single-turn map, grouped by axis with one violin per pair class (value swap, family swap, install vs empty system, instruction-wording paraphrase; each query axis carries its own class), fire mask not applied; floor-failing axes appear as raw views.

Figure. The per-pair clouds behind the headline means. Violins show 2,766 of the 2,778 pairs (the 12 query-paraphrase pairs appear only in the query-axis figure), medians and quartiles marked; value-swap and family-swap distributions largely overlap on every axis, wording-paraphrase pairs sit lowest on the content-bearing axes, and the not-tested axes are shown raw.

Value swaps and family swaps track each other closely on every axis (largest mean offsets: stance 0.54 vs 0.48, injected name 0.17 vs 0.23), and instruction-wording paraphrases sit well below matched swaps on content-bearing axes (output format 0.19 vs 0.59 on the same all-values basis; tone 0.42 vs 0.90). The pairs therefore measure the manipulated variable rather than surface wording. Install pairs sit near swaps on most axes and above them for the injected name (0.39 vs 0.17): adding a name to an empty system prompt is a larger, more predictable move than swapping one name for another, consistent with the reliability-limited read below.

Six of nine instruction axes passed the compliance gate with the original wordings; stance, persona, and hedging did not until re-elicited

Plotted: per-value compliance fraction from the manipulation check (judge-scored for 7 axes, programmatic for marker word and injected name), one bar per value, colored by verdict, 70% fire threshold dashed.

Figure. Where the behavioral gate passed and failed. Green bars fired (at least 70% of checks complied), red did not, orange undetermined (incomplete checks count as not fired). Stance, persona, and hedging miss their axis floors; the six other axes pass. At a 50% threshold 7 of 9 axes pass (persona joins); at 90%, 5 of 9 (user description drops).

These instruction values were authored by the Claude Code planning agent (model id not persisted) rather than by the evaluated model. The gate did real work: the model complied near-ceiling with tone, marker-word, name, format, and content-constraint instructions, but would not argue one-sided stances (back one option 2/24, devil's advocate 5/24), played 2 of 5 personas, and kept hedging (strong confidence 11/24).

Zeroing CJK-intruded draws flips only user description (college freshman 18/24 to 16/24, floor 2 of 5); excluding them restores it (16/21, floor 3 of 5; rural nurse 16/24 as scored, not fired), so that pass is convention-dependent; every other verdict is intrusion-robust (programmatic zeroing minimum 0.950). Direction reads are similarly robust: no cosine moves by more than 0.01 under exclusion (max +0.006).

Direction recovery tracks the reliability of the observed shift; the injected-name read sits at reliability 0.13 with cosine 0.17

Plotted: each tested axis's direction cosine (single-turn map) against the split-half reliability of its observed 10-draw-mean shift, one labeled point per axis.

Figure. Low raw recovery co-occurs with low split-half reliability. Tone and query content pair reliabilities of 0.99 and 0.98 with high recovery; the injected-name axis sits at reliability 0.13 with cosine 0.17, where the bound a perfect predictor could reach is about 0.36.

Recovery orders with reliability: axes whose observed shifts replicate across rollout halves are the ones the map predicts well. A noisy target caps the cosine a perfect predictor can reach near the square root of the target's reliability, so the injected-name bound is about 0.36; the observed 0.17 recovers about 48% of it, in the same range as content constraint (51%), marker word (48%), and format (38%).

At 10 draws the shift barely rose above sampling noise even though the name is expressed in 589 of 600 base-value rollouts, leaving map-direction loss neither demonstrable nor excludable; the 100-draw round below resolves it as noise. Query form (reliability 0.60, cosine 0.30) retained headroom; the clearest is output format, whose 0.36 cosine leaves a 0.59 gap to its 0.95 bound.

Magnitude calibration is heterogeneous and largely inherited: two content axes compressed, query form and the fired format subset over-scaled

Plotted: per-pair predicted vs observed shift norms for the single-turn map, one panel per axis, filled points for fired pairs, with the global slope line (1.014) in every panel.

Figure. One global gain does not fit all axes. Tone and marker-word clouds ride the global line; content constraint and query content fall below it (compressed); query form sits above it (over-scaled). The hedging cloud also sits above the line, an informational all-values view only: that axis failed its compliance floor. Filled points are fired-value pairs.

Two axes are compressed, intervals excluding 1: content constraint 0.84, query content 0.80. User description (0.93) sits below 1, interval spanning it; tone and marker word (both 1.03) match the global slope; query form over-scales at 1.43, the fired format subset at 1.19 (all format values: 1.02); the injected name's 10-draw 0.87 is a noise-limited read superseded at 100 draws (final result).

The distortion is not map-specific: the identity baseline is as compressed on the content axes (0.85, 0.74) and more over-scaled on query form (2.12) and fired format (1.72), so the map partly corrects it. Within content constraint per-value-pair slopes span 0.77 to 1.55: the four under-twenty-words pairs (the largest, most length-coupled shifts) sit at 0.77 to 0.83; excluding them the fired-pair slope is 0.99 (span-mean pooling twin: 0.98).

The pair is identifiable among 2,778 candidates, but the map's margin over identity is metric-dependent

Plotted: retrieval accuracy at k = 1, 5, 10 for finding each pair's observed difference from its predicted difference among all 2,778 candidates, per arm under cosine and euclidean distance with chance dashed (top), and the per-pair rank distribution of every true pair behind those accuracies (bottom, log scale).

Figure. Strong retrieval, metric-dependent ranking. Under cosine the single-turn map leads at top-1 and top-5 (23.7% top-1, median rank 6, chance 0.04%) while identity edges ahead at top-10; under euclidean the identity baseline leads at every depth. The per-pair rank curves show the full distribution behind each accuracy point.

All three predictors find pairs far above chance: answer-shift geometry is pair-specific. But the ordering flips with the metric: cosine favors the map at top-1 and top-5 (23.7% vs 21.8% top-1), euclidean favors identity at every depth (17.1% vs 15.3% top-1); norm errors plausibly cost the map under a norm-sensitive distance.

The rank curves show the flip is distribution-wide, not a top-k artifact: under euclidean identity sits above both maps across the whole range (median rank 8 vs 17). Retrieval alone cannot settle map vs identity; the paired direction gaps favor the map on all 8 tested axes.

A query wording change moves the answer state at paraphrase scale while changing the text less than a paraphrase, a dissociation that survives at 100 draws

Plotted: flip-to-paraphrase change ratios for the two query axes in three spaces (answer text embeddings, observed and predicted answer states), plus per-pair norms divided by each space's query-paraphrase mean.

Figure. Query form dissociates text from state. A query-content flip exceeds the paraphrase yardstick in every space (text 2.9, observed 4.2, predicted 2.6); a query-form flip changes answer text less than a paraphrase (0.66) while the state moves at paraphrase scale (observed 0.97, predicted 1.13). Right panel: per-pair values whose group means equal the bars.

A content flip moves the answer well past the yardstick in every space. Changing only phrasing reads like a paraphrase in text space, yet the state shifts as much as a real paraphrase, in a direction the map partially predicts (cosine 0.35 vs null 0.09 at 100 draws). Most query-form pairs sit below 1 in text space while straddling 1 in both state spaces.

The map carries formal query information that barely surfaces in emitted text. At 100 draws (reliability 0.93) the dissociation survives: state 1.06 vs text 0.61, gap 0.45 (interval 0.24 to 0.74) against the 0.15 floor. Over-scaling persists exploratorily (slope ratio 1.43 to 1.52), consistent with genuine over-scaling; the plan fixed no cross-K calibration test, and 36 pairs remains the caveat.

Re-elicitation passes 4/4 stance, 5/5 persona, and 2/2 hedging values; the maps beat identity on each axis

Plotted: the parent's five-panel profile recomputed on the three re-elicited axes: direction cosine over fired value-swap pairs, per-pair cosines, slope ratio to the parent's frozen global calibration, within-axis consistency, and observed flip-to-paraphrase norm ratios.

Figure. All three re-elicited axes clear their nulls and the map sits above identity on each. Blue single-turn map, orange multi-turn twin, green identity baseline; whiskers are carrier-clustered bootstrap intervals; grey bands are shuffled-pair nulls (hedging's two-value axis uses a sign-randomization null); diamonds mark split-half reliability. Fired pairs: stance 72, persona 120, hedging 12; slope ratios 1.05, 1.13, 0.72. No answer-text embeddings this round; the last panel shows the observed representation only.

The re-worded instructions fired everywhere the original texts failed (stance 1 of 5, persona 2 of 5, hedging 1 of 2), so the parent's floor failures trace to the wordings rather than model incapacity. Direction cosines 0.37, 0.77, 0.74 sit above nulls of 0.05, 0.13, 0.38, every paired gap over identity excluding zero.

CJK intrusion (130 of 2,760 rollouts) flips no axis floor under any recount convention and moves no direction mean by more than 0.002; one stance value's fire is convention-dependent (counts in Methodology). Code-review concerns ffr-allfail-selection-schema-failopen and ffr-selection-resume-stale-after-repilot cover paths this run never exercised (single pilot pass, no re-pilot resume); ffr-production-refusal-regression-pin-missing is bounded by 0 refusals across all 528 checks.

Raising the two noise-limited cells to 100 draws shows the injected-name read was noise, not map failure: the cosine doubles in step with its reliability bound

Plotted: map and identity direction cosines on the two re-sampled cells at 10 vs 100 draws, with per-cell reliability bounds, null bands, and prediction references.

Figure. The injected-name read rises in step with its bound. Whiskers are carrier-clustered bootstrap intervals; grey bands are shuffled-pair null 97.5% ranges; diamonds mark the reliability bound; on the injected-name panel the shaded band and dotted line are the plan's noise-limited (0.35 to 0.45) and direction-loss (0.17) references, and the query-form panel's dotted line is its 0.380 preserved-ratio prediction; 120 injected-name and 36 query-form pairs per draw level. 399 of 15,120 new rollouts (2.6%) carry CJK script; every name-fire verdict holds with intruded draws zeroed or excluded (Methodology).

Pooling 100 draws lifts injected-name reliability 0.13 to 0.59, the perfect-predictor bound 0.36 to 0.77, and the map's cosine 0.17 to 0.32, holding 42% of the bound (interval 38% to 46%, threshold 35%; identity 34%). The realized 0.32 sits just under the plan's noise-limited band; the cosine-to-bound ratio slipped 0.475 to 0.42, narrowing the projected margin while the ratio-keyed verdict stands. The weak parent read was sampling noise, not map-direction loss; the axis joins the faithful set in direction (magnitude and per-pair spread below).

Parent and fresh draws read as exchangeable (the fresh-only fallback estimator never fired); the reliability curve tracks its 10-draw projection (companion figure).

Open code-review concerns k100-parity-fp-schema-version (parity cache freshly staged at the pinned parent revision) and k100-paired-bootstrap-wiring-unpinned (deciding intervals from the paired-draw helpers at production call sites, 10,000 finite draws each) qualify these reads.

The injected-name recovery is aggregate and direction-only: two of ten name pairs trail identity and the magnitude flips to over-scaled at 100 draws

Plotted: per name pair (10 unordered pairs of the five injected names), the mean direction cosine of the map and the identity baseline over that pair's 12 carrier swap pairs at 100 draws, with the individual swap-pair cosines behind each mean.

Figure. The map leads identity on most name pairs, with two exceptions. Large diamonds are name-pair mean direction cosines at 100 draws; small points are the individual carrier swap pairs behind each mean; blue is the frozen map, green the identity baseline.

The lattice verdict is an aggregate: the map beats identity on 100 of 120 individual swap pairs, and its paired gap excludes zero, but the Sarah-vs-Emma and Marcus-vs-Diego pairs trail identity on average (map 0.11 vs 0.14 and 0.20 vs 0.21), so recovery is heterogeneous across name pairs rather than uniform.

Magnitude flips at the tenfold draw count: sampling noise inflates observed shift norms and deflates a low-draw slope, consistent with the parent's 0.87 being a noise-limited read; at 100 draws the axis over-scales at 1.81 (interval 1.61 to 2.09), the battery's strongest, with identity at 1.74 (1.56 to 1.96), so this distortion too is not map-specific.

---

Repro: 2.2 GPU-h realized of 6 budgeted (generation + teacher-forced capture on 1x H100, RunPod pod-2564, backend runpod; judging via the Anthropic Batch API, 1,392 calls; bank build and statistics off-pod). Code on branch issue-2564; run commit 09750cbbab8918d6767bdd8f8d65028355811b93: issue2564_run.py, issue2564_judge.py, issue2564_analysis.py, issue2564_embed.py; round-2 revision commit d313b856460ea364de2aa12343e380eb37a73a62: issue2564_intrusion_audit.py, issue2564_pair_slopes.py; zero-GPU recount commit 8265bcd75f781d8e879e924de60063e536e58dcf, extended and re-figured at ec94c8ba291de3750d8f783fa1b524010d363cb3: issue2564_cjk_excluded_direction.py, issue2564_figures.py; figures pinned at ec94c8ba291de3750d8f783fa1b524010d363cb3, except the hero profile, re-rendered with its per-pair spread panel and pinned at 772971c5716f53d0cbae867675e4a74a6c04ccb5. Eval artifacts under eval_results/issue_2564/, each pinned at its producing commit: minpair_delta.json, manipulation_check.json, perpair.jsonl, bank_manifest.json, intrusion_audit.json, content_constraint_pair_slopes.json, cjk_excluded_direction.json; the prediction tensors under eval_results/issue_2564/predictions/ are local mirrors of the pinned HF analysis_tensors/predictions/ tree below (tensors are HF-destined, not git-destined). Instruction-values file sha256 29e6bebc52b91af5e92474d829ab7ee252f6c8b5f067696f3444d41f2454119d. HF data: issue2564 minpair tree (raw completions: 10 rollout shards + judge outputs; analysis tensors: per-cell answer summaries va2564, context states vc2564, text embeddings, predictions; manifests). Model Qwen/Qwen2.5-7B-Instruct revision a09a35458c702b33eeacc393d103063234e8bc28; seeds: rollouts 42, bootstrap 2215, nulls 21620, split-half 2564. Judge claude-sonnet-4-5-20250929. Re-elicitation round floor-failed-reelicitation: 1.4 GPU-h realized of 2 budgeted on 1x H100 (RunPod pod-2564, provisioned for the round, terminated after its upload-verification PASS; 552 synchronous pilot judge calls + 528 Batch judge calls); run commit b259ac853d2e2e49e23bcb97afb381adb1c19e5b (additive round modes in the same run/judge/analysis/figures scripts above); round eval artifacts + figures committed and pinned at e479f8734b70e00e2bdd224ed3d2345228d3ee8c: minpair_delta_ffr.json, manipulation_check_ffr.json, perpair_ffr.jsonl; the fold-time language-intrusion recount is persisted at commit b93450240a01fbecf454e62452600c544074c3e6: intrusion_audit_ffr.json (producing script issue2564_intrusion_audit_ffr.py, recomputed from the pinned HF revision below). Round HF data (revision 8168886e8436ff13bd49d6b47d1d5e2a861be8d6, listings verified live at fold time): re-elicitation tree under the floor_failed_reelicitation segments of issue2564_minpair (raw completions: pilot, pilot_judge, anchors, judge; analysis tensors: va2564, vc2564, predictions; manifests incl. pilot_selection.json) plus the issue2564_minpair/smoke_ffr twin; the round's local eval_results/issue_2564/floor-failed-reelicitation/predictions/ tensors mirror the pinned HF predictions tree. Draw-ladder round k100-low-reliability-axes: 2.6 GPU-h realized of 4 budgeted on 1x H100 (RunPod pod-2564, provisioned for the round, terminated after its upload-verification PASS; zero judge calls). Round code commits 6d15df9d31 (round modes + intrusion recount + CPU pins), c9186ce172 / 23607c5049 (review-round fixes), and relaunch tip 220cd1d001 (context-state parity bar re-ground 0.9999 to 0.999 with per-context cosines persisted; deviation record in Design): issue2564_run.py, issue2564_analysis.py, issue2564_embed.py, issue2564_figures.py, issue2564_intrusion_audit_k100.py. Round eval artifacts + figures committed and pinned at d260be60c2: minpair_delta_k100.json, perpair_k100.jsonl, manipulation_check_k100.json, intrusion_audit_k100.json; the ladder hero (re-rendered with a reader-facing panel title) and the added per-name-pair figure are pinned at 18dcab3601 (issue2564_figures.py). Round HF data (revision 8d90fd7a9b20a984c44969f77a77956c8a1d9e02, listings verified live at fold time): k100 tree under the k100_low_reliability_axes segments of issue2564_minpair (raw completions: 2 rollout shards; analysis tensors: va2564, vc2564, embeddings_qwen3_8b, predictions; manifests incl. k100_vc_parity.json with per-context cosines) plus the issue2564_minpair/smoke_k100 twin; the round's local eval_results/issue_2564/k100-low-reliability-axes/predictions/ tensors mirror the pinned HF predictions tree. Round seeds: new rollouts 42 plus draw over draw ids 10 to 99 (realized seeds 52 to 141); bootstrap 2215 (verdict-ratio stream 2215/100); nulls 21620; split-half 2564.

• Reused map from #779: issue779_monitoring/n1m_readout/weights/L19/ridge.pt @ 62b1e8889e1a262501937b0ec6f6022e28b4a7e6 (sha256 188486f8afd9d95221e32492f3a0be2a3bdb2098cbe7fadfecf1d46433567909) — fit: the frozen single-turn context-to-answer ridge at layer 19, the exact production map under test; listing verified live at write time.
• Reused map from #1738: issue1738_multiturn/analysis_tensors/weights/L19/context_ridge.pt @ 62b1e8889e1a262501937b0ec6f6022e28b4a7e6 (sha256 1916bed192f36dfe9dc57a3c712d3ea56d3767199504693c0c0f33bcde27bda4) — fit: the multi-turn twin at the same layer, used as the map-agreement control; listing verified live at write time.

Advisory code-review notes from the re-elicitation round, dispositioned against the realized run (the three binding concerns are dispositioned in the re-elicitation result above): ffr-judge-sync-reissue-split-undisclosed (disclosed in Methodology: one synchronous re-issue round inside the 528-check pool, no batch/sync split field persisted); ffr-selection-count-integrality (every realized comply count is an integer between 0 and 24); ffr-fire-doc-duplicate-row-collapse (the realized value rows carry 22 unique slots, no duplicates). Advisory residuals from the draw-ladder round's final review (PASS with zero blockers), dispositioned against the realized run: k100-lattice-metadata-omits-not-evaluable (both realized verdicts are ordinary lattice outcomes with finite deciding intervals; the not-evaluable path never fired); the round's two open code-review concerns are dispositioned in the draw-ladder result above.

Context: created 2026-08-24 from an interactive design session with the user as a child of #2215; the session's decision record rides the pre-promotion body (snapshotted to original-body.md). The recorded verbatim originating prompt (the user's answer approving agent-generated queries):

it's fine for you to generate them

Plan v6 approved 2026-08-24; run, judging, and analysis 2026-08-25; interpretation round 1 folded 2026-08-25; round-2 ensemble revision applied 2026-08-25; zero-GPU CJK-excluded direction recompute folded 2026-08-25 as a same-issue follow-up round cjk-excluded-direction; clean-result-critique round-2 revision (figure vocabulary, per-pair panels, worked-example coverage) applied 2026-08-25; clean-result-critique round-3 revision (generator disclosure, hero per-pair spread panel) applied 2026-08-25; clean-result-critique round-4 revision (fired-pair denominators, headline table removed, query-axis worked examples) applied 2026-08-25. Compliance-piloted re-elicitation of the three floor-failed axes (plan v7 approved as an amendment) run 2026-08-26 and folded 2026-08-26 as a same-issue follow-up round floor-failed-reelicitation, proposed by the follow-up proposer (GPU cheap band, screened not-redundant by both follow-up critics); its verbatim proposal spec opens:

Compliance-piloted re-elicitation of the three floor-failed axes (stance, persona, hedging) — corrected-recipe re-run.

K=100 draw-ladder re-read of the two noise-limited cells (plan v8 approved as an amendment) run 2026-08-26 and folded 2026-08-26 as a same-issue follow-up round k100-low-reliability-axes, proposed by the follow-up proposer (GPU cheap band slot 2 of 2, screened not-redundant by both follow-up critics); its interpretation revision round 2 (calibration flip, per-pair heterogeneity, exploratory reframe of the query-form calibration read, figure vocabulary) applied 2026-08-26; its verbatim proposal spec opens:

K=100 draw budget on the low-reliability cells: resolve whether the injected-name axis is map-limited.