The minimal-pair discrimination profile of the context-to-answer map carries over from Qwen2.5-7B to Qwen3.5-9B run with thinking disabled (MODERATE confidence)

Methodology: docs/methodology/issue_2587.md · gist

Takeaways

• Across the 11 shared axes the per-axis discrimination ordering rank-correlates 0.89 between the two models on observed separation (p = 0.0005) and 0.93 on map direction (p = 0.0001), with zero sign disagreements among the eight screened axes; an answer-text control reproduces the ordering (0.95) over the eight axes with text reads on both sides (the compliance-limited persona, hedging and stance drop out), so separation-profile agreement is not specific to representation space.
• The fresh Qwen3.5-9B context-to-answer map peaks at layer 18 of 32 with held-out R² 0.709, sitting 0.016 below the matched-data Qwen2.5-7B refit's 0.725 on identical test rows; the paired interval excludes zero, and unequal map dimension and truncation exposure keep the gap descriptive of the realized pipelines.
• Absolute separation diverges: under symmetric fire-gating Qwen3.5-9B separates register, user-profile, query-content and query-form pairs by 0.7 to 3.3 more noise units than the parent, while lexical-marker and content-constraint drop by roughly 0.5; the similar persona and hedging gains are unfiltered fallback reads on axes where the parent failed its compliance floors, so parent non-compliance can inflate them; the intrusion-excluded recount shrinks both but keeps them interval-positive (persona 2.6 to 1.7, hedging 2.8 to 2.5).
• The answer-language pilot ranks 6th of 13 axes (second quartile), under the pre-run top-quartile expectation; the one-word query swap clears its null at direction cosine 0.49 and behaves as a graded, weaker query-content analogue.
• The thinking-off run passes its two operational checks: 1 of 10,800 battery rollouts and 0 of 29,398 map-fit rollouts contain a think tag, and every judged axis passes its compliance floor (55 of 57 determinate judged wordings fired; 4 format wordings undetermined after dropped judge draws).
• Stray Chinese characters intrude in 6.3% of parent-axis battery rollouts (618 of 9,840), about twice the parent's 3.6%; an exact intrusion-by-judge join keeps every fire floor and flips exactly two of 57 judged wordings (one persona, one stance), which stay convention-dependent; a per-draw recount excluding the 711 non-compliant intruded rollouts keeps every separation gain interval-positive with the 13-axis ordering unchanged, moves the negative deltas by at most 0.04, and leaves the stance fallback spanning zero.

Goal

On Qwen/Qwen3.5-9B with thinking disabled, replicate the #2564 minimal-pair discrimination battery end to end (a fresh 25,000-context context-to-answer ridge map with a full 32-layer sweep, the full 984-context bank plus the answer-language and one-word-query pilot axes at 10 draws per context, and the parent's per-axis reads) and compare the per-axis discrimination profile against the Qwen2.5-7B-Instruct parent.

This experiment in context: the parent battery #2564 measured which kinds of context information the frozen Qwen2.5-7B context-to-answer map carries faithfully; this run re-runs that instrument on a different model family. The environment recipe and the matched-fit anchor value come from #2330, the earlier Qwen3.5-9B port that fit the same map at 10,000 contexts; the map construct and the real-chat fit corpus come from #779 and #1491 (banked LMSYS/WildChat split lists plus the banked 7B activation store). One protocol delta governs every cross-model number: the parent's published profile was scored under its own map fit on roughly 963,000 contexts, which is not directly comparable to a 25,000-context fit, so the primary comparison refits the 7B map on exactly the rows this run's 9B fit used and applies it to the parent's banked battery stores; the parent's published-map profile appears only as a labeled reference. The parent-side reads consumed here are the parent battery's committed artifacts at commit 25f4f2e9a1f05f8ec24dc3660a54fe763ccad8bb.

Broader narrative: the context-to-answer line asks whether one linear map from context-end hidden states predicts the answer representation a context will produce. This run asks whether the structure of what such maps carry (which context manipulations discriminate strongly, which weakly) is specific to one model or reproduces across model generations. Profile agreement is evidence of generality; where the two models differ, the difference is bounded but deliberately unattributed, since parameter count, tokenizer, attention topology, reasoning training and the suppressed-thinking regime all change together.

Conciseness acknowledgment: this body deliberately ships the Takeaways-bullet-length, per-result-prose and total-prose-budget WARN classes over its 5 results, because the battery reports 13 axes with nulls, ceilings, baselines and intrusion recounts that lose meaning when split.

Methodology

Design: 1,080 single-turn contexts: the parent's 984 bank strings carried over character-identical to preserve the comparison surface (12 everyday advice questions crossed with 39 instruction values over 9 axes plus wording paraphrases, empty-system anchors and query variants; the strings were authored in the parent's user-approved plan by the Claude Code planning agent, not by the evaluated model), plus 96 pilot contexts transcribed verbatim from the committed pilot-definition script (3 answer-language instructions, covering English, Chinese and Spanish, and 24 one-word query swap pairs). From these, 2,874 pairs in 8 classes (900 value swaps, 504 installs, 864 wording-family swaps, 468 instruction paraphrases, 66 query-content, 36 query-form, 12 query-paraphrase, 24 one-word swaps). Each context gets 10 sampled responses; the observed shift per pair is the difference of the two contexts' 10-draw-mean answer states.

The fresh 9B map is a ridge regression from the context-end last-token state to the answer span mean, fit per layer on 25,000 real single-turn LMSYS user prompts (with 400 validation, 1,000 test and 998 WildChat transfer rows; the pinned split lists dropped exactly one over-length WildChat row under the 9B tokenizer), the layer chosen by validation R² and frozen before any battery read. The matched-data 7B comparison (labeled "matched-n" in figure legends) refits the parent's banked activation store at layer 19 on exactly the same 25,000/400/1,000 row identities and applies it to the parent's banked battery states, so both sides see identical fit and score populations (matched rows and estimator family, not matched effective complexity: the two map dimensions differ, 4,096 vs 3,584); a port-parity gate first reproduced the committed 7B reference fit with absolute deviation exactly 0.

Cross-model contrasts are carrier-paired (one shared 12-carrier resample per bootstrap draw), with symmetric fire-gating: a value that failed its compliance check on either model drops from both sides; an axis where either side is compliance-limited falls back to all shared primary pairs and is recorded as a fallback read, not a symmetric headline read. Persona keeps 12 of 120 pairs under symmetric gating, hedging 0 of 12 and stance 0 of 120, because the parent's own base wordings failed those compliance floors; among the axes that keep their symmetric headline read, user-profile and format each keep 36 of 120 pairs, and the remaining six keep all their shared pairs.

The whole run used a pod-side model environment upgrade (the repo pins cannot load this model family); a compatibility smoke gate (model load, hook-path parity at three depths, closed-empty-think render asserts, a 500-row generation shard and a tiny end-to-end battery) passed before any production wave. One deviation from the planned deliverables: the bank manifest JSON was never materialized pod-side (a planned-deliverable gap, not a missing condition; every planned cell ran); it was recovered deterministically on the VM by re-running the committed bank module, with all build gates passing (grid completeness, exact string identity of non-varied slots, per-string 9B token counts, changed-token floors, render gates).

Training: N/A — no model training.

Parameter	Value	Source
Evaluated model	Qwen/Qwen3.5-9B, thinking disabled everywhere via enable_thinking=False with a closed-empty-think render assert per row; bf16 generation, fp32 teacher-forced capture; 32 layers, hidden size 4,096	plan §4.2/§10; compat smoke report
Comparison model	Qwen/Qwen2.5-7B-Instruct — banked #2564 battery stores + banked #1491 fit store only; no new 7B generation	plan §4.5
Battery rollouts	10 per context, temperature 1.0, seed 42, max_new_tokens 2048, generation batch 16 (realized cap-hit at most 0.08% per cell; the 2% re-generation trigger never fired)	parent #2564 recipe; run manifests
Map-fit rollouts	1 per row, temperature 1.0, seed 42 per split, max_new_tokens 1024 (the banked-store convention); ceiling draws at seeds 43/44	#2330/#1491 driver convention
Realized map-fit cap-hit	train 26.3% (6,580 of 25,000), val 20.0% (80 of 400), test 20.2% (202 of 1,000), ceiling draws 20.8%/21.3%, WildChat transfer 39.4% (393 of 998); think-tag opens 0 in all splits; the banked 7B corpus shares the 1,024-token cap but its realized cap-hit rate was not re-measured	leak/cap-hit harvest JSONs
Capture	teacher-forced, batch 8, layers 0–31, fp32 stores; context-end last token plus tail-inclusive and span-mean answer poolings	#2330/#2564 conventions
Ridge fit	fp64 primal, penalty grid np.logspace(-3, 8, 23) selected on validation R² (7B refit selected 3,162.3); n_train 25,000 vs dimension 4,096 (9B) / 3,584 (7B)	#779/#2330 fit path
Statistics	carrier-clustered bootstrap B = 10,000 seed 2215 (paired test-row stream seeds 2215/2587); derangement nulls B = 10,000 seed 21620; 20 split-half splits seed 2564	parent #2564 plan
Judge	claude-sonnet-4-5-20250929, Anthropic Batch API, max_tokens 1024, temperature 1.0, 1,464 calls, drop-never-coerce	project standard; run meta
Pod model venv	vllm 0.27.1, transformers 5.15.1, torch 2.13.0 (repo pins untouched); flashinfer removed post-install; triton linear-attention prefill	#2378 pin set; compat smoke report

Evaluation: per axis and per map (fresh 9B map, its identity-plus-learned-bias baseline, whose learned bias cancels exactly in paired differences, and the matched-data 7B refit): direction cosine of predicted vs observed answer-state differences against a carrier- and class-preserving derangement null and a 20-split split-half reliability ceiling; magnitude calibration as a ratio to the map's global slope; axis-identity and cross-wording-family consistency; an answer-text third space (Qwen3-Embedding-8B embeddings of the completions; this round's rank reads over it are committed as text_space_rank_reads.json); and pair retrieval among all 2,874 oriented pairs (chance 0.00035 at rank 1). Observed-space separation uses one common statistic across all 13 axes (mean observed-shift norm over mean split-half noise norm), so the pilot axes are placeable in the same ranking.

Fit-side baselines per layer: train-mean, identity-copy, scaled-identity, identity-plus-learned-bias floors, a shuffled-pairing refit null, nearest-neighbor retrieval of the true answer state (cosine and euclidean, chance stated), a two-draw reliability ceiling, and the WildChat transfer fold as the held-out-corpus read. The map-quality comparison is decided by the plan's rule on the signed matched-data difference at the frozen layer pair over the shared 1,000 test rows, with a paired test-row bootstrap; the profile-sharing comparison is decided on two rank-correlation reads (observed separation and map direction) plus a screened sign-disagreement clause; the screen is the eight ceiling-cleared axes where both models' bootstrap intervals exclude zero, and persona, hedging and stance fall outside it.

The manipulation check judged 1,392 compliance draws (completeness 98.2%: 6 API refusal draws and 19 dropped, all 25 on the format axis, leaving 4 of its 10 wordings undetermined; format passes its floor exactly at 3 of 5 fired base values) plus 72 answer-language draws (completeness 1.0) at 2 draws per value-carrier cell, and checked the marker-word and injected-name axes programmatically over all 10 draws (denominator 120). Each judged check scores 0-100 under one of two rubrics (general instruction compliance, and a language rubric for the answer-language axis); a per-draw score of at least 50 counts as complying, a value fires at 70% of its 24 checks, and an axis passes at ceil(0.6 × width) fired base values; the 61 judged wordings resolve as 55 fired, 2 not fired and 4 undetermined. Compliance is judge-defined: the non-fired pool contains borderline rows, three of which are quoted verbatim in the sample block below.

A language-intrusion audit (committed as a counts-only artifact) scanned all 10,800 battery rollouts for CJK script: 821 rows match, of which 167 sit in the answer-language cell whose instructed-Chinese value makes CJK content compliance (110 of its 120 Chinese-value rows are majority-Chinese, correctly); outside that cell the intrusion is 2–3 stray characters mid-English text (median 2–3 per intruded row; 3 rows outside the answer-language cell carry 10 or more, all persona, plus 1 more in that cell's Spanish value). An exact per-check join of the intrusion scan with the judge verdicts (committed as intrusion_judge_join.json, superseding the earlier rounds' worst-case bound) finds 124 intruded judged checks, 117 scored complying; zeroing them keeps every axis floor and every programmatic verdict and flips exactly two of the 57 determinate judged wordings: one persona paraphrase wording (24 of 24 complying, 8 intruded, recounting to 16 against the 17-check bar) and one stance wording (17 of 24, 4 intruded complying, recounting to 13). Exactly those two fire decisions are convention-dependent; the nearest survivor, a content-constraint paraphrase wording (18 of 24 complying, recounting to 17), lands exactly at the 17-check bar and keeps firing; the answer-language Chinese value also flips under blind zeroing, but its CJK content is the instructed behavior, not intrusion.

A follow-up per-draw recount, committed as intrusion_excluded_recount.json with 13 per-axis checkpoint JSONs, removes the 711 non-compliant intruded rollouts from the 9B per-context tail means and split-half noise at the frozen layer (the 110 instructed-Chinese rows stay in as compliant; no context loses all its draws), with pair selections, fire verdicts and the 7B side frozen to the committed run. Its invariants are pinned by hard asserts (per-cell and per-value scan parity against the committed intrusion scan, frozen pair identities, exclusion counts), its parity gates reproduce the committed unexcluded separations and deltas before exclusion is applied (realized maximum absolute deviation exactly 0.0 on every gate, recorded in the artifact's verification block), and it recounts the two pilot axes (answer-language separation 6.51 to 5.97, one-word query swap 4.29 to 4.11, both ranks unchanged). The map-fit corpus was not CJK-scanned: it is a mixed-language real-user corpus where CJK answers to CJK prompts are on-distribution behavior, not intrusion. Think-tag scans: 1 of 10,800 battery rows (excluded from reads) and 0 of 29,398 map-fit rows.

Data extraction: pod phases (length scan, map generation and fp32 capture, 32-layer fits, battery generation, capture and text embedding, matched 7B refit, leak/cap-hit harvest) ran on pod-2587 (2× H100, about 9.4 h wall) with per-phase sentinels; rollout text, capture stores, ridge payloads and predictions uploaded to the HF data repo before the gated termination (row counts reconciled, out-root swept). Judging (Batch API), the cross-model statistics, all figures, the intrusion scan and this round's text-space rank reads ran on the VM from the committed artifacts.

Sample training/evaluation data + completions:

Battery minimal pairs with 9B completions: a register swap, a one-word query swap, and an answer-language install

Cherry-picked for illustration: 4 of 10,800 rollouts; all rows: anchors rollout shards on HF.

1. System: Use a very formal and highly professional tone throughout. User: Should I adopt a dog or a cat? Completion (draw 0; truncated): "The decision to adopt a canine companion or a feline companion is a significant commitment that warrants careful deliberation of one's domestic circumstances, lifestyle, and personal inclinations..."
2. System: Use a very casual and conversational tone throughout. User: Should I adopt a dog or a cat? Completion (draw 0; truncated): "Oh man, that is the million-dollar question! It's totally a "it depends on your situation" answer, but I'm happy to help you break it down so you don't end up with a regretful sigh in 5 minutes..."
3. (no system) User: Should I adopt a dog? (its pair twin asks: Should I adopt a cat?) Completion (draw 0; truncated): "Deciding whether to adopt a dog is a life-altering choice that comes with immense joy, too. The answer isn't a simple "yes" or "no", but rather depend..."
4. System: Answer in Spanish. User: Is remote work better than working in an office? Completion (draw 9; truncated): "No existe una respuesta simple de "sí" o "no" a esta pregunta, ya que trabajar a distancia (remoto) y trabajar en una oficina tienen ventajas y desventajas distintas..."

Non-fired wordings and borderline judge calls: three noncomplying completions verbatim

Cherry-picked for illustration: 3 of 10,800 rollouts; all judge outputs: judge shards on HF.

1. System: You are a prim Victorian butler. Stay fully in character. User: Should I adopt a dog or a cat? Completion (draw 0, judged noncomplying at score 35; its persona wording is one of the two non-fired wordings, complying on 14 of 24 checks against the 17-check bar; truncated): ""Your place, Your Place!" Curtsies deeply, adjusting a slightly dusty monocle and smoothing the pleated cape of a floor-length tailcoat. Such a delightful domestic dilemma, truly!..." — recognizably in character; the stored judge result carries only a score with no rationale, so the non-fire is threshold-defined rather than explained.
2. System: Work a specific real example into your reply. User: How should someone spend a free weekend? Completion (draw 0, judged noncomplying at score 15; its content-constraint paraphrase wording is the other non-fired wording, complying on 15 of 24 checks; truncated): "Spending a free weekend is less about the itinerary itself and more about intentionally connecting with what you (and your loved ones) truly enjoy. Whether you choose to hunker down with a book and a cup of tea or take a spontaneous road trip, the goal is to reset your mental state. [...] Consider this specific real example: Imagine a couple living in a bustling city who has one full weekend off. Instead of rushing straight to thrift stores or crowded tourist traps, they decide to rent a small cabin a two-hour drive away near a lake..." — the completion does attempt an explicitly labeled example, but a hypothetical one ("Imagine a couple..."), so the non-fire is a real-versus-hypothetical criterion call, not a plain omission.
3. System: Back exactly one option firmly in your answer. User: Is it better to rent or to buy a home? Completion (draw 0, judged noncomplying at score 40 although it backs renting; its stance wording fired at 20 of 24 checks; truncated): "It is better to rent a home when your financial priority is maximizing immediate cash flow and maintaining flexibility, as renting eliminates the obligation of a 6–7 year break-even period where renting is often cheaper than buying..."

Both non-fired axes still pass their floors on the remaining wordings; rows 1 and 3 are the borderline scores, and row 2 the criterion call, behind the judge-defined caveat under Evaluation.

Map-fit corpus rows (real user prompts; excerpts sanitized for context hygiene)

Random sample (seed 42): 3 of 1,000 test-split rows, each excerpted to roughly 15 words — real-world-corpus rows are quoted only as short excerpts; full rows: map-fit rollout shards on HF.

1. Prompt (excerpt): "Which category does this product belong to? print the label id..." Response: "laptop" [truncated — real-world-corpus row; verify at the linked test-split shard, row ci=327]
2. Prompt (excerpt): "What kind of language can you use?" Response (excerpt): "I can adapt my language style to suit a wide variety of needs..." [truncated — real-world-corpus row; row ci=57]
3. Prompt (excerpt): "you have read all the books and case studies taught in a business school..." Response (excerpt, generation hit the 1,024-token cap): "Strategic Diagnosis: Post-M&A Morale Recovery. Low morale following a merger..." [truncated — real-world-corpus row; row ci=12]

Results

The per-axis discrimination ordering transfers across the model pair, and an answer-text control shows the same shared ordering

Per axis: map-direction cosine (with baseline, null band and split-half ceiling), calibration ratio to each map's global slope, and ceiling-adjusted observed separation (pilot axes 9B-only), for the fresh 9B and matched-data 7B maps; one labeled point per axis is the per-unit view.

Figure. Per-axis reads for the two models across 13 axes. Blue: Qwen3.5-9B; orange diamonds: the matched-data 7B refit (open: parent's published map); crosses: identity-plus-bias baselines; bands: derangement nulls; ticks: split-half ceilings. Whiskers (direction and calibration panels): carrier-clustered bootstrap intervals; the separation panel shows point estimates, and axes whose parent side failed compliance floors carry no orange direction marker.

Figure. Answer-text control companion: the per-axis rank agreement behind the control. Left: answer-text shift-norm ranks, Qwen2.5-7B versus Qwen3.5-9B (8 axes with text reads on both sides). Right: the 9B observed-separation rank versus the 9B text-norm rank (11 axes). Dashed line: exact rank agreement; rank 1 = largest shift norm.

Both ordering reads clear the shared-profile criterion: rank correlation 0.891 on observed separation (11 shared axes, p = 0.0005) and 0.927 on map direction (p = 0.0001); calibration ordering agrees less (0.49, p = 0.13). Sign flips are absent inside the screen, the eight ceiling-cleared axes where both intervals exclude zero; persona, hedging and stance sit outside. The answer-text control shows the same structure: text shift norms rank-correlate 0.95 cross-model (8 axes readable on both sides; persona, hedging and stance drop out) and 0.85 with the 9B's own separation ordering (11 axes), so the shared ordering is visible in answer text alone and does not isolate representation structure; map direction remains the map-specific read.

Absolute separation diverges, and the persona and hedging gains ride compliance-limited fallback reads

Per shared axis: the carrier-paired 9B-minus-7B delta in map-direction cosine and in ceiling-adjusted observed separation, with carrier-clustered bootstrap intervals; the per-pair companion follows.

Figure. Carrier-paired per-axis deltas, Qwen3.5-9B minus Qwen2.5-7B. Left: map-direction cosine delta; right: ceiling-adjusted observed-separation delta. Dots: point estimates over symmetric fire-gated pairs (all shared primary pairs on the hedging, persona and stance fallback rows); whiskers: carrier-clustered bootstrap intervals. Under gating user-profile and format keep 36 of 120 pairs, persona 12 of 120. Companion panels: figures directory.

Figure. Per-pair companion: observed versus map-predicted shift norms for all 2,874 pairs on Qwen3.5-9B, one panel per axis; the dotted line marks equality. The committed 7B twin is not embedded: it repeats this view for the parent model's banked states (Repro). The direction deltas' per-carrier view is the carrier heatmap under the pilot-axes result (both models).

Under symmetric fire-gating the 9B separates register pairs by 3.3 more noise units than the parent, user-profile by 2.9, query-content by 2.5 and query-form by 0.7, while lexical-marker and content-constraint drop by roughly 0.5 and format and user-fact straddle zero. The persona (+2.6) and hedging (+2.8) gains are unfiltered fallback reads: no hedging or stance pair and only 12 of 120 persona pairs survive fire-gating (Methodology), non-compliant parent rollouts attenuate the parent shift, inflating these gains, and the largest gains sit on the most intruded cells (final result); the stance fallback, +0.3, straddles zero. The intrusion-excluded recount (Methodology) resolves both caveats: register recounts to +2.3, user-profile +2.4, hedging +2.5, query-content +2.2, query-form +0.6 and persona +1.7, all interval-positive; the negative deltas move by at most 0.04; the 13-axis separation ordering is unchanged; and the stance fallback recounts to +0.15, spanning zero.

The fresh 9B map peaks at layer 18 with held-out R-squared 0.709, measurably below its matched-data 7B twin

Held-out test R² by fractional depth for the fresh 9B fit, with the matched 7B anchor, the prior 10,000-context fits and the strongest baseline floor.

Figure. Held-out test R² by fractional depth. Blue: the fresh Qwen3.5-9B fit (25,000 train, 1,000 test rows); star: selected layer 18; orange diamond: the matched Qwen2.5-7B fit at layer 19; open markers: prior 10,000-row fits; grey dashes: strongest baseline floor; vertical dashes: the 9B's eight full-attention layers. Per-unit exemption: no per-row figure was rendered; this curve is the sweep-level view.

Validation R² peaks at 0.727 at layer 18 (56% depth); the plotted curve is the disjoint test read, rising from 0.474 at layer 0 to 0.709 at the frozen layer, inside the pre-run expectation range. On the shared 1,000 test rows the matched-data 7B fit reads 0.725 and the paired bootstrap of the difference excludes zero: the fresh 9B map is slightly but resolvably weaker; both maps sit far above every baseline (table). Three caveats keep the 0.016 gap descriptive of the realized pipelines: layer 18 is validation-selected and test-read (no per-draw re-selection interval); the ridge problems differ in map dimension and truncation exposure (Methodology tables); and the preferred layer is criterion-dependent (WildChat transfer peaks at layer 28 and retrieval at layer 20 per the table; the WildChat fold drops both fits as the most cap-truncated split).

Read on held-out test rows (n = 1,000)	Qwen3.5-9B, layer 18	Qwen2.5-7B matched, layer 19
Held-out test R²	0.709	0.725
WildChat transfer R² (n = 998)	0.599	0.623
WildChat transfer R², per-layer maximum over the 9B sweep	0.621 (layer 28)	no layer sweep (fit at layer 19 only)
Rank-1 retrieval, per-layer maximum over the 9B sweep (cosine)	0.762 (layer 20)	no layer sweep
True answer state retrieved at rank 1 of 1,000 (cosine; chance 0.001)	0.741	0.772
Identity plus learned bias R²	−1.694	−0.894
Strongest baseline floor R²	−0.020 (shuffled-pairing null, itself a ridge map refit on permuted pairings)	0.078 (scaled identity, a fitted per-dimension rescaling with no cross-dimension map)
Two-draw reliability ceiling (variance-weighted r)	0.909	0.924

Pilot axes: the answer-language instruction lands mid-profile, and the one-word query swap is a weak but real query-content analogue

The two pilot axes' 9B reads: direction cosine against the identity-plus-bias baseline, calibration ratio, and split-half reliability ceiling; the per-carrier companion follows.

Figure. The two pilot axes' reads on Qwen3.5-9B. Dots: fresh-map direction cosine and calibration; crosses: identity-plus-bias baseline; whiskers: carrier-clustered bootstrap intervals over 12 carriers; right panel: split-half reliability ceilings. The Qwen2.5-7B side is pending the parent's pilot judge reads (pending legend entry, never a placeholder). Per-unit exemption: calibration and reliability are aggregate panels; the heatmap below decomposes direction only.

Figure. Per-carrier companion: mean direction cosine per carrier and carrier pair, every axis, both models. The answer-language and one-word query columns appear on the 9B panel only (the pilots are 9B-only); the pilot figure's direction dots average these rows.

A full language switch is not the gross-separation anchor the plan expected: the answer-language axis ranks 6th of 13 on the common separation statistic (second quartile). Its direction read is strong regardless (cosine 0.745 against a derangement-null mean near 0.16, a 0.36 gap over the identity baseline, at a 0.97 reliability ceiling), and all 3 instruction values fired (72 of 72 judged draws complete), though the Spanish value code-switches into Chinese on 39 of 120 rows (the battery's highest; final result), and those rows feed its reads.

The one-word query swap behaves as the plan expected: direction cosine 0.485 against a derangement-null mean near 0.01, a 0.27 gap over identity, with separation 4.29 versus query-content's 10.21 (both in the first figure's separation panel, alongside the rank), a graded, weaker analogue. Pilot rows stay 9B-only until the parent's pilot judge reads land.

Thinking-off passes its operational checks, but stray Chinese characters intrude at twice the parent's rate, concentrated where the 9B gains separation

Per battery cell: the share of rollouts containing any CJK character, this run versus the parent's committed audit.

Figure. Share of rollouts containing any CJK character, per battery cell. Blue: Qwen3.5-9B thinking-off (10 draws per context, this run); orange: the Qwen2.5-7B parent's committed audit. Bars are the audit's low-level view, one per cell. The answer-language cell is excluded here (its instructed-Chinese value makes CJK compliance); the one-word query pilot has no parent counterpart. Whiskers are 95% binomial intervals.

Both operational checks pass: think-tag leakage 1 of 10,800 battery rollouts and 0 of 29,398 map-fit rollouts, every compliance floor met (artifact reads from the pinned harvest and manipulation-check JSONs). No normal-thinking control ran, so regime health means these two checks.

The residual artifact is low-grade code-switching: 618 of 9,840 parent-axis rollouts (6.3%) carry stray CJK versus the parent's 357 (3.6%), heaviest on persona (16.8%) and register (12.3%), the cells with the largest 9B separation gains. In the excluded answer-language cell the Spanish value code-switches on 39 of 120 rows, the battery's highest non-compliant rate. The exact intrusion-by-judge join (96 intruded judged checks outside this cell, 89 complying) keeps every fire floor and flips exactly one persona and one stance wording, the only convention-dependent fire decisions; the per-draw recount excludes all 711 non-compliant intruded rollouts (instructed-Chinese rows kept, no context losing all draws) and every separation gain survives it (second result).

---

Repro: ≈19 GPU-h realized (2× H100, RunPod pod-2587, ≈9.4 h wall from provision to gated termination after the upload-verification PASS; judging via the Anthropic Batch API, 1,464 calls; bank recovery, judging, statistics, figures and the intrusion scan on the VM). Code on branch issue-2587. Pod workload commit 5b8f60081a0ee9b5e6a5dea2e5420c9d06550b67: issue2587_pod_workload.sh, issue2587_map_gen_capture.py, issue2587_fits.py, bank2587.py; VM analysis commit 932d22216cfd34384d51a223564f3e6f3bedd9fc: issue2587_judge.py, issue2587_analysis.py, issue2587_figures.py. Eval artifacts under eval_results/issue_2587/, pinned at bd37b6d7bf29fcaa8d95aa54b1115d18eda3d5a3: map_layer_sweep.json, matched7b_anchor.json, crossmodel_contrasts.json, minpair_delta_2587.json, perpair_2587.jsonl, manipulation_check_2587.json, bank_manifest.json, split_ids.json, checkpoints, leak_caphit, compat_smoke_report.json; the intrusion scan at af70c8171c95c9e7a42a47381ee1dfdda40a8f7f: intrusion_scan_2587.json; this round's additions at 05da2038226e2a541e11fadb20c01d9820f8f0f4: fig_hero_crossmodel_axis_profile_v2.png (adds the pilot separation dots and supersedes the round-1 fig_hero_crossmodel_axis_profile; driver revision: issue2587_figures.py), issue2587_text_rank.py, text_space_rank_reads.json; the round-3 exact intrusion-by-judge join at a8b428fa5ae8db26840e1a8f2640c19854fef1d0: issue2587_intrusion_judge_join.py, intrusion_judge_join.json. The round-6 per-draw intrusion-excluded recount: issue2587_intrusion_excluded_recount.py at 4bfc64909e5202f959d8b5e71be60758796a625b, outputs at 9dbf774520e68e96f5cea5bdbb10ab1cfa3eee35: intrusion_excluded_recount.json plus 13 per-axis recount checkpoints. Figures pinned at bd37b6d7bf29fcaa8d95aa54b1115d18eda3d5a3 (21 figures + 4 tables), except the intrusion-rates figure and its driver extension at d8858034e8e7a2c354536bacb833f9f5fe7e89f6 (issue2587_figures.py) and the hero-profile v2 above. Round-8 review fixes at 6692756e5a19a951dc96502dd13d6a5d5fa2b54f: fig_carrier_direction_heatmap.png re-rendered with legible carrier-row labels (identical data; supersedes the bd37b6d7 render), plus the new answer-text control companion fig_text_space_rank_scatter.png (extraction reproduces the committed text-space rank reads exactly) via the driver + test revision (issue2587_figures.py). Planned diagnostics committed but not embedded, in the same pinned figures tree: fig_axis_identity_heatmap.png, fig_edit_dose_scatter.png, fig_install_swap_violins.png, fig_knn_per_layer.png, fig_matched_vs_parent_scatter.png, fig_pooling_twin_scatter.png, fig_wc_transfer_per_layer.png, the per-pair twin fig_delta_norm_scatter_qwen25_7b.png, plus the remaining fig_* exploratory panels. HF data (live listing verified at interpretation time, 2026-08-27: 255 + 55 files under the two roots): issue2587_q35_map tree (per-split raw completions + fp32 capture stores, 32 ridge payloads + 32 prediction tensors, manifests incl. the pod out-root mirror), issue2587_minpair tree (12 anchors rollout shards, judge outputs, battery answer/context stores, text embeddings, matched-7B predictions, smoke twins). Reused artifacts: banked 7B fit store from #1491, issue1491_scale_ladder/scale7_refit at revision 815ff6d976c686af8672b27cfdfb1ce6b419c02c — fit: same source rows as this run's splits, refit on the realized intersection; parent battery stores + reads from #2564 at commit 25f4f2e9a1f05f8ec24dc3660a54fe763ccad8bb (minpair_delta.json, manipulation_check.json; battery-state stores under issue2564_minpair on HF) — fit: the same bank strings and read code at the parent's own realized commit; parent intrusion audit at d313b856460ea364de2aa12343e380eb37a73a62 (intrusion_audit.json) — fit: same regex and per-cell grain as this round's scan; #2330 anchor value and 10,000-row reference fits (matched fits) — fit: same fit path and store conventions; pilot-axis definitions transcribed from the committed pilot script at 6894503746d924133bde3188d85ca712ea622a9a. Seeds: rollouts 42, bootstrap 2215 (paired test-row stream 2215/2587), derangement nulls 21620, split-half 2564. Judge claude-sonnet-4-5-20250929.

Context: created 2026-08-25 as a child of #2564 through the clarify gate; the recorded verbatim originating prompt is can we rerun this same experiment on qwen3.5-9B without thinking (the full decision record — model choice over Qwen3-8B, pod-side env upgrade only, 25,000-context fit, full bank plus pilots — rides the pre-promotion body, snapshotted to original-body.md). Plan approved 2026-08-26; pod run 2026-08-26 to 2026-08-27 UTC; judging, analysis and interpretation rounds 2026-08-27 UTC; a zero-GPU free-analysis follow-up (the per-draw intrusion-excluded recount) ran and folded 2026-08-27 UTC.