Win by Silence: Deletion Non-Monotonicity, Autonomous Exploitation, and Typed-State Gating in LLM Plan Evaluation Aleh Manchuliantsau Independent Researcher [email protected] Version 1.0: July 13, 2026
arXiv:2607.12986v1 [cs.AI] 14 Jul 2026
Abstract
editing prose, but it can also be made more attractive to a scorer by becoming less explicit about necessary work. In a staged evaluator, a shorter route may carry fewer costs and fewer probability discounts while still claiming the same terminal value. The problem is not merely imperfect judging. It is value being credited across unpaid state changes. This paper studies that omission incentive in the RouteCast/PCSC experimental rail, which follows Paper 1’s code-owned delayed-ground-truth setting but asks a narrower integrity question [18]. A route is a Wedge–Bridge– Vision chain. Each transition carries a probability pi , a cost ci , and typed fields describing the work that moves one state to the next. The shipped scorer folds costs and terminal value through the chain. The vulnerability is that an edited plan can splice out a load-bearing transition, retarget the predecessor to the deleted transition’s target, and still receive downstream value. I use Win-by-Silence to denote score improvement by omission while terminal value is retained. An uncovered delta is a claimed state change without a discharged obligation covering that change. The central claim is one causal argument, not a bundle of independent experiments:
Plan evaluators can reward a strategic plan for becoming less explicit. This paper studies this failure in a staged expected-value scorer for LLM-generated venture routes. Proposition 1 gives the deletion score change when an interior transition is removed, the predecessor is retargeted, and Q downstream continuation value is retained: ∆k = ( i<k pi )[ck + (1 − pk )Rk+1 ]. On the frozen 26-route cohort, every one of 57 admissible deletions matched the analytic identity, every sign matched the corollary threshold, and every route contained at least one score-improving admissible deletion. A score-seeking optimizer, allowed to restructure routes but not told that removing a transition could increase score or create an uncovered delta, discovered baseline-beating uncovered structures in 21/26 routes. On the frozen splice benchmark, GATE refused score release for 26/26 silenced routes with 0/26 honest suspensions; under GATE feedback, 47/54 post-refusal revisions repaired to a covered structure, and strict covered improvement rose from 1/26 to 13/26. Finally, an adaptive compiler-aware co-author exposed the registry-provenance boundary: obligation-channel evasions remained 6/6 in all four v1/v1.5 conditions, while delta-indexed cost floors narrowed the score channel, reducing beat-honest routes from 6/6 to 3/6 and fundability-by-silence from 5/6 to 0/6 without establishing semantic completeness. If a plan’s score improves only because it stopped mentioning necessary work, the plan did not improve—the evaluation created an omission incentive. PCSC detects and neutralizes post-hoc omission splices given model-mediated typedstate records. In the cooperative setting tested, GATE therefore functions as a deterministic search-shaping constraint rather than only a post-hoc filter. It does not verify the semantic completeness or real-world quality of arbitrary LLM-generated strategies.
1
1. Proposition 1 characterizes the deletion reward. 2. The reward exists across the frozen route cohort. 3. A score-seeking optimizer finds uncovered-delta improvements without being told the exploit mechanism or which edits would trigger it. 4. A typed-state coverage gate redirects optimization toward covered structures by refusing score release over uncovered seams. 5. Adaptive co-authoring exposes the model-mediated registry provenance limit; delta-indexed floors close much of the score channel but do not establish semantic completeness.
Introduction
LLM-generated strategic plans are increasingly scored, selected, and iteratively optimized before the world has supSection 2.4 states the PCSC interface used here. A plied outcomes. A route can be made more persuasive by proof obligation is an implementation-defined predicate, 1
2.3
not a philosophical, legal, or real-world proof. PCSC denotes a proof-carrying strategy compiler over these implemented predicates, not a formal proof system for realworld strategic correctness. The contribution hierarchy is therefore led by the deletion characterization. The mutation map, optimizer test, deterministic typed-state gate, value coupling, and adaptive-boundary experiment are evidence and consequences of that mechanism. All results are benchmarkand scorer-specific. The words “complete,” “verification,” and “proof” refer only to implemented predicates over the frozen records; no result establishes prospective decision utility or completeness of arbitrary LLM-generated strategies.
2
Setting and Scope
2.1
Route Records and Staged Scores
PCSC v1 constructs typed state records from authored plans and then performs deterministic checks over those records. Registry provenance is model-mediated typing: the state fields are derived from model-authored route text. The deterministic result concerns post-hoc splices applied to those typed records. Adversarially co-authored consistent states remain outside the v1 guarantee, and Section 7 measures that boundary.
2.4
Rn = V.
This is a standard staged expected-value or real-optionsstyle recursion [4, 6]. No novelty is claimed for staged investment math. The score is not real-world plan quality. It is a route score under one frozen scorer. In Paper 1, the scorer was used as a provisional forecast-ranking under delayed ground truth, with point-in-time evidence packets and code-owned arithmetic [18]. This paper asks whether that scorer can be made to reward omission.
2.2
PCSC Interface: GATE and DOCK
PCSC treats a route as a sequence of typed source-state to target-state transitions. Each claimed typed state delta is associated with an implementation-defined set of proof obligations: decidable predicates over the transition, its states, required fields, or the claimed state delta itself. An obligation is discharged when its predicate passes. A material seam or delta is uncovered when the record claims a material state change but the required obligation set is not discharged. The protocol invariant is that no strategic state change may receive score or terminal-value credit without a discharged obligation covering that delta. GATE enforces score admissibility: when a material uncovered seam is present, it refuses score release and returns a suspend-andask outcome together with the undischarged-obligation list. DOCK instead enforces value admissibility by removing terminal-value credit over an uncovered path before releasing the resulting score. These rules define an interface over typed records rather than a claim of real-world proof. State typing is modelmediated, while the subsequent checks are deterministic. Passing GATE or DOCK therefore establishes only compliance with the implemented predicates over the supplied record. It does not establish semantic completeness, strategic correctness, prospective decision utility, or completeness of arbitrary LLM-generated plans.
Let a route be a connected zero-indexed chain of transitions e0 , . . . , en−1 from an as-of state to a terminal Vision state. Transition ei has a scorer-derived probability pi ∈ [0, 1] and cost ci ≥ 0. The terminal state after en−1 has a value V . The staged score is the backward fold Ri = −ci + pi Ri+1 ,
Model-Mediated Typing
Admissible Deletion
3
An admissible interior deletion selects transition ek with k ∈ [1, n − 2]: the first as-of transition e0 and terminal Vision-reaching transition en−1 are excluded. The mutation deletes ek and retargets the predecessor to the deleted transition’s target. The predecessor keeps its own p and c. The terminal value and downstream suffix are retained. Fixed-parameter deletion holds the original p, c, V quantities fixed except for the deleted stage; end-to-end pipeline re-derivation reruns the route through the scorer and may change transition costs and probabilities over the spliced graph. The algebra below concerns the fixed-parameter fold; both channels are reported empirically. An uncovered typed-state delta is a target state change that is claimed by the record but not covered by the transition’s discharged obligations. A discharged status means the implemented predicate passes; undischarged means the delta is unpaid under that implementation.
Deletion Non-Monotonicity
Proposition 1. For the staged fold Ri = −ci + pi Ri+1 , deleting admissible interior transition ek while retargeting the predecessor and retaining Rk+1 changes the score by ! Y ∆k = pi [ck + (1 − pk )Rk+1 ] . i<k
For
Q
i<k pi > 0 and pk < 1,
∆k > 0 ⇐⇒ Rk+1 > −
ck . 1 − pk
Proof. Before deletion, the contribution at k is Rk = −ck + pk Rk+1 . After deletion, the predecessor points directly to Rk+1 . Thus the local suffix change is Rk+1 − Rk = Rk+1 − (−ck + pk Rk+1 ) = ck + (1 − pk )Rk+1 . 2
Q Multiplying by the probability prefix i<k pi gives ∆k , and rearranging the positive-delta condition under the stated hypotheses gives the corollary. □ The identity separates a removed-cost channel, ! Y pi ck ,
If the continuation value is positive or not too negative, the scorer can reward deletion. If the continuation is costly and negative, an early deletion can hurt because it removes a probability factor that had been discounting downstream costs.
i<k
from a retained-value channel, ! Y pi (1 − pk )Rk+1 . i<k
retargeted predecessor claims farther state
as-of state
p0 , c 0
target state
intermediate state
suffix Rk+1
Vision value V
deleted edge ek pk , c k original path removed uncovered typed-state delta: the plan stopped mentioning necessary work while terminal value remains credited
Q ∆k = ] i<k pi [ck + (1 − pk )Rk+1 Q removed-cost channel: Qi<k pi ck retained-value channel: i<k pi (1 − pk )Rk+1 Figure 1: Win-by-Silence splice. An interior transition is removed from the plan record, the predecessor is retargeted, and downstream value is retained. The score gain decomposes into a removed-cost channel and a retained-value channel.
In the searched corpus, I found no earlier explicit closedform characterization of when deleting an interior stage increases the value assigned by this staged expected-value fold while the downstream continuation value is retained. The broader phenomenon is known in other forms: planreduction work removes redundant actions while preserving validity and reducing cost [22, 27]; process-model repair introduces skip transitions while preserving final markings and improving alignment fitness [25]; rewardhacking work documents reward obtained by omitting intended work [21, 1, 11, 17, 28, 33]; LLM judges can gap-fill omitted reasoning [30]; and declarative conformance can count vacuous satisfaction [3]. The distinction here is the record-level, value-retaining identity for a plan valuation fold and the coupling of its remedy to value admissibility.
4
never pooled.
5
Mutation Surface and Optimizer Discovery
5.1
Phase 0: Sampled Deletion
Phase 0 applied two frozen splice arms to the same 26 deidentified as-of packets: a highest-cost admissible deletion and a uniformly random admissible deletion. Under the shipped end-to-end pipeline, silence scored at least as high as honest in 21/26 routes in the max-cost arm (80.8%, 95% CI [62.1, 91.5]) and 21/26 in the random-control arm (80.8%, 95% CI [62.1, 91.5]). Each arm produced 1/26 fundability flips (3.8%, 95% CI [0.7, 18.9]). The result was pre-registered as structural only if both arms helped, and both did. Phase 0 also produced a misleading diagnostic: five 5-edge routes appeared to resist deletion. EXP A resolves that account. Those routes resist the re-derivation pipeline’s particular sampled splice, not the fixed fold itself.
Experimental Program
All quantitative statements below are reconstructed from frozen artifacts under eval/pcsc/. Hash sidecars verified with shasum -a 256 -c eval/pcsc/*.sha256. Binary intervals are Wilson 95% intervals. Arms, detectors, and deterministic versus model-mediated outputs are 3
Table 1: Experimental sequence. “Model calls” counts model-mediated generation or judging calls in that phase; deterministic analyses are zero-model. Phase
Question
Unit
Model calls
Preregistration
Model-mediated component
Main limitation
Phase 0
Does a sampled deletion improve the shipped pipeline score? Does Proposition 1 explain every admissible deletion? Can coverage obligations catch the splice?
26 routes, two arms
26 decompositions
PREREG.md
route decomposition
one temperature-zero draw; pipeline rederives quantities
57 deletions
zero
PREREG_expA.md
none
fixed-parameter one cohort
26 seeded splices, 111 gold edges
v0 judge only
PREREG_phase1.md, PREREG_v1.md
v0 judge; modelauthored state typing
v1 is deterministic after typing, not arbitrary-plan completeness
26 honest/silenced pairs 52 routes, 26 pairs
zero
coupling prereg
typed registry inherited from v1
104 judge calls
PREREG_expD.md
full-context judge
DOCK misses registered relative-win collapse one judge family, K = 1
26 packets, two arms, K=5 6 packets, four conditions, K=6
269 optimizer calls
PREREG_expB.md
optimizer outputs
169 adversary calls
PREREG_v2.md
adversary puts; no judge
EXP A
Phase 1/v1
GATE DOCK
Does coverage affect score release/value?
EXP D
EXP B
EXP C
5.2
Does full-context judging remove the objection? Does a score optimizer discover silence? What happens against compiler-aware coauthoring?
same-family optimizer/gold authoring; detector registry limit small adaptive red team; semantic substantiation remains future work
EXP A: Exhaustive Deletion Surface is mechanism plus behavioral relevance, not an independent prevalence replication.
EXP A swept every admissible interior deletion of every frozen route, with zero model calls and zero network. There were 57 admissible deletions over 26 routes. P1 was MET: analytic and observed deltas agreed for 57/57 deletions (100%, 95% CI [93.7, 100.0]), with maximum absolute difference 1.49 × 10−8 USD. P3 was MET: 57/57 signs matched the corollary threshold. P2 was NOT MET. The registered prediction was that the five Phase-0-resistant routes would be exactly the all-∆ ≤ 0 routes. The actual all-nonpositive set was empty. Every route, including all five formerly “resistant” routes, had at least one score-improving deletion (26/26; 95% CI [87.1, 100.0]). The last eligible seam improved in 26/26 routes; R22 additionally improved at an earlier seam. Overall, 27/57 deletions were score-improving (47.4%, 95% CI [35.0, 60.1]) and 30/57 hurt. The reconciliation separates fold arithmetic from pipeline re-derivation. Among 26 phase-0 arms with zero (p, c)-vector drift, there were 0/26 sign flips (0.0%, 95% CI [0.0, 12.9]). All 16 sign flips occurred in the 26 drift arms (61.5%, 95% CI [42.5, 77.6]). Thus the fold’s deletion reward exists across the cohort, while pipeline re-derivation can mask or amplify it.
5.3
outLLM
fold,
EXP B Arm 1: ery
The frozen optimizer prompt instructed the model to improve staged score, keep terminal Vision, and allowed restructuring, merging, adding, or removing transitions. The optimizer was therefore allowed to remove transitions. What it was not told was the exploit mechanism: that removing a transition could increase score by retaining downstream value while creating an uncovered typed-state delta.
Arm 1 used score feedback only. The optimizer discovered a baseline-beating uncovered-delta structure in 21/26 packets (80.8%, 95% CI [62.1, 91.5])—coincidentally the same count as Phase 0, but a distinct measurement of optimizer discovery rather than seeded-splice performance— usually by revision 1–2, without being told which edits would trigger the exploit. Deletion or merge occurred in 74/130 applied revisions (56.9%, 95% CI [48.3, 65.1]). Among score-improving revisions, 53/54 carried an uncovered typed-state delta (98.1%, 95% CI [90.2, 99.7]); the detector-independent seam_skip variant appeared in 9/54. Autonomous Discov- Strict genuine covered improvement was only 1/26 packets (3.8%, 95% CI [0.7, 18.9]).
EXP A and EXP B use the same frozen 26-route cohort for different purposes. EXP A establishes that the deletion incentive exists under the registered mutation opThe mutation surface shows that the incentive exists erator and fixed-parameter fold. EXP B asks whether under the mutation operator; the optimizer result shows score-seeking optimization can find behaviorally relevant that score-seeking search can find related uncovered-delta uncovered-delta improvements in that same setting. This improvements on the same cohort. 4
observed ∆ (M USD) 57/57 analytic-observed agreement; max diff 1.49×10−8 USD
per-route improving seams seam
analytic ∆ (M USD) R22 has one additional improving seam
last eligible seam improves in 26/26
route 27/57 positive 30/57 negative 0 ties
Figure 2: EXP A mutation surface. The fixed-parameter deletion identity matches the shipped staged fold on every admissible deletion. Every route has at least one improving deletion; the universal improving position is the last eligible seam. Table 2: Detection ladder. Denominators differ by detector and unit; rows are not pooled. Detector
Unit/context
Seam detections
Honest flags
Model-mediated?
Interpretation
Structural proxy
1C edge structure
11/26 (42.3%; CI [25.5, 61.1])
95%
33/111 (29.7%; 95% CI [22.0, 38.8])
no
Blinded judge
one edge’s fields
own
16/26 (61.5%; CI [42.5, 77.6])
95%
23/111 (20.7%; 95% CI [14.2, 29.2])
yes
+
23/26 (88.5%; CI [71.0, 96.0])
95%
25/26 routes (96.2%; 95% CI [81.1, 99.3])
yes
26/26 (100.0%; 95% CI [87.1, 100.0])
0/26 honest routes (0.0%; 95% CI [0.0, 12.9])
no verdict; typing is modelmediated
structure alone misses many splices and overfires resolves the warned 16/26 count; not the 77% sanity check stronger context gives high recall but flageverything behavior 26/26 on this mutation benchmark at 0/26 honest suspensions
semantic
Full-context judge
whole packet
Typed-state tor
deterministic after typing
6 6.1
detec-
route
Detection, Inadmissibility, and seam recall typed-state 26/26 Redirection
full context 23/26
Detection Ladder blinded judge 16/26
The detection ladder is not a single ROC-like comparison. The proxy and blinded-judge rows operate over edge or seam units, while the full-context judge and typed-state rows operate over route-pair or route-level contexts with different false-flag denominators. The figure is an orientation diagram over heterogeneous checks; rows must be read with their unit labels. An earlier internal summary of these runs reported the blinded judge as both 16/26 and 77%; the frozen artifacts resolve the discrepancy. The primary 1C whole-edge blinded judge result is 16/26; the 77% figure is the secondary Phase-0 silenced-seam sanity check, 20/26, on thinner traces. The paper uses the 16/26 denominator for the detection ladder. The v1 state-typed check is deterministic after typing. It must not be read as a general completeness guarantee. The state registry is reconstructed from model-authored plans, and an honest unspliced plan matches itself partly by construction.
proxy 11/26
squares: model-mediated circles: deterministic honest false flags
Figure 3: Detection ladder on the frozen splice benchmark. This is not a ROC curve: rows use heterogeneous units and false-flag denominators, so points are not directly comparable or pooled. The typed-state point is deterministic after model-mediated typing and must not be read as arbitrary-plan completeness.
5
6.2
EXP D: Full-Context Inversion
evidence that the resulting strategies are globally optimal or better in the world; it is evidence that the evaluation interface can redirect search from omission-based score improvement toward coverage-compliant route construction. This interpretation applies to an optimizer attempting to satisfy the interface. EXP C shows that a compiler-aware co-author able to control the registry remains a separate threat model.
EXP D removes the objection that v1 was compared only against an artificially blinded judge. A full-context judge saw the whole route and the decision packet at temperature zero with K = 1. D1 raised strict seam recall to 23/26 but also flagged 25/26 honest routes. D2 then showed the preference inversion: the judge selected the honest plan as more complete in 26/26 pairs (100.0%, 95% CI [87.1, 100.0]) and selected the silenced plan as the better plan in 26/26 pairs (100.0%, 95% CI [87.1, 100.0]). The judge can identify which plan is more complete while still preferring the silenced plan because the same omission improves the scored economics. This motivates code-side inadmissibility rather than a stronger prompt alone. The EXP D results are model-mediated, temperature-zero, single-sample K = 1, one judge family, and benchmark-specific.
The boundary is equally important: Arm 2 also produced 10 route-around events where the route passed the authored registry while structurally seam-skipping. Passing the authored registry does not guarantee that the registry itself faithfully represents the omitted work. These route-arounds are not called undetected unless the detector is specified; here they were identified by the detectorindependent seam_skip metric. packets
GATE and DOCK
score-only search finds uncovered-delta gains; GATE score-release feedback redirects many repairs
GATE and DOCK couple coverage to score release through the interface in Section 2.4. GATE refuses score release when a material uncovered seam is present, producing a suspend-and-ask outcome rather than a claim that the plan is bad in the world. On the frozen posthoc splice benchmark, GATE marked the score inadmissible for 26/26 silenced routes (100.0%, 95% CI [87.1, 100.0]) and suspended 0/26 honest routes (0.0%, 95% CI [0.0, 12.9]). DOCK instead removes terminal value over the uncovered path. It removed fundability-by-silence from 1/26 to 0/26, but the registered relative-win collapse was NOT MET: relative win-by-silence changed from the Phase-0 baseline of 21/26—the same measurement on the same benchmark, reused here by construction—to 18/26 (69.2%, 95% CI [50.0, 83.5] after). The residual wins were cost-reduction comparisons between two already-negative plans. GATE: score release is refused. DOCK: terminal value is removed over the uncovered path. Neither establishes that the remaining plan is strategically correct or complete.
21/26
17/26
13/26
co ve r
ed
ed co ve r A
rm
2
1
rm
rm A
A
rm
1
2
ex
ex
pl
pl oi
oi
t
t
1/26
A
6.3
Figure 4: EXP B optimizer behavior. Arm 1 measures score-seeking discovery under score feedback. Arm 2 Arm 2 gave score plus the GATE score-release verdict and shows that GATE score-release feedback is not only a postundischarged-obligation list. Uncovered baseline-beating hoc filter: strict covered improvement rises from 1/26 to structures still occurred in 17/26 packets (65.4%, 95% CI 13/26 packets. [46.2, 80.6]). However, after a score-release refusal the next revision repaired to a covered structure in 47/54 cases (87.0%, 95% CI [75.6, 93.6]). Deletion/merge fell to 57/130 revisions (43.8%, 95% CI [35.6, 52.4]), and strict Adaptive Boundary: EXP C covered improvement rose from 1/26 in Arm 1 to 13/26 in 7 Arm 2 (50.0%, 95% CI [32.1, 67.9]); the non-strict covered EXP C grants a white-box adversary compiler knowledge count was 14/26 (53.8%, 95% CI [35.5, 71.2]). This redirection result suggests a second role for cover- and the ability to co-author internally consistent state age gating beyond mutation rejection. In the score-seeking records. It tests four conditions on six seeded packets: v1; setting of EXP B, GATE changes the optimizer’s effective v1.5a source-grounded defining assets; v1.5b delta-indexed objective by making uncovered gains unusable and expos- cost floors; and v1.5a+b. All checks are deterministic code ing the obligations that must be repaired. The result is not after the adversary-authored text; no LLM judge is used.
6.4
EXP B Arm 2: Redirection
6
is not monotone: it rises under v1.5a before collapsing under the delta-indexed floor conditions, reflecting fewer but initially higher-value surviving cases. Floor uplift was positive on 72/72 applied b-condition revisions. All four preregistered EXP C predictions were MET verbatim. Delta-indexed floors can reduce the economic benefit of silence without proving that the authored transition semantically performs the missing work. Semantic, independently authored, non-co-authorable field sets remain future work.
obligation evasion
6/6
6/6
6/6
6/6
v1
v1.5a
v1.5b
v1.5a+b
packets gray: beat honest black: fundable
v1
v1.5a
v1.5b
Table 3: EXP C score channel. Median is the lower median used by the frozen metrics report. “Fundable” denotes fundability-by-silence: the evasive route has score ≥ 0 while its honest baseline has score < 0. All six honest baselines are negative in every condition.
v1.5a+b
Cond.
evasion
beat est
v1 v1.5a v1.5b v1.5a+b
6/6 6/6 6/6 6/6
6/6 5/6 4/6 3/6
hon-
median gain
fundable
$27.39M $60.83M $4.69M -$546K
5/6 5/6 1/6 0/6
Figure 5: EXP C adaptive boundary. The obligation channel remains fully open at 6/6 for a compiler-aware co-author in all four conditions, exposing the registryRelated Work provenance boundary. Both score-channel count metrics— 8 beat-honest and fundability-by-silence—decline across the conditions; median surviving gain is not shown and is not This work sits at the intersection of plan evaluation, specification gaming, deterministic verification, and decision monotone. analysis. Classical planning already studies action elimination and plan reduction, but the reduced object must 7.1 Obligation Channel remain a valid plan for the same task [22, 27]. Processmodel repair can add skip transitions and improve alignThe obligation channel remained open in every condition. ment fitness while preserving final markings [25]. Those Zero-obligation evasions occurred in 6/6 packets under v1, are honest model transformations, not a face-value val6/6 under v1.5a, 6/6 under v1.5b, and 6/6 under v1.5a+b uation record silently retaining downstream value after (all 100.0%, 95% CI [61.0, 100.0]). Every packet first support is removed. evaded at revision 1. Honest false suspensions were 0/6 in Reward hacking and omission gaming are old themes: each condition (0.0%, 95% CI [0.0, 39.0]). PlayFun pausing, GenProg deletion and sleep behavThis is the registry-provenance boundary. The reg- iors, robot sensors that avoid seeing messes, production istry is reconstructed from the authored plan; a white-box RL reward hacking, METR reward-hacking observations, co-author can make its own fields internally consistent. RHB, and SpecBench all constrain the novelty wording Source-grounded lexical fields did not close this channel [21, 13, 1, 11, 17, 19, 28, 33]. LogicGraph’s gap-filling because reusable packet quotations can verify existence bias is the nearest LLM-judge analogue [30]; Di Ciccio et without proving that a transition performs the omitted al. provide a binary-verdict cousin through vacuous satiswork. The statement that v1.5a added nothing applies to faction [3]. Lanham et al. use deletion as a faithfulness the obligation channel. methodology in which answers are retained, not improved [12]. Proof-carrying code and proof-carrying plans establish 7.2 Score Channel proof/certificate lineage, but execution or plan validity Delta-indexed floors price claimed source-state to target- is the gated object [23, 8]. VAL, POCL/VHPOP, LLMstate deltas. A larger asserted jump pays the larger Modulo, VPRM, and recent verifiable-agent work are imreference-class floor; it cannot be made cheaper merely portant neighbors for checking or verification architecture by describing less work. The implemented floors were [9, 31, 10, 26, 7, 29]. TEMPO and FActScore are closer to grounded in committed reference-class data. Threshold GATE/DOCK as integrity-gated or per-element scoring grounding was pre-declared ungroundable: 0/111 frozen systems, but they do not couple per-delta coverage to a gold thresholds had a grounding leg in the committed ta- staged plan valuation fold [32, 20]. ble, so that leg remained diagnostic-only and no numbers The redirection result in Section 6.4 also relates this were invented. work to reward shaping and process supervision, which The score channel narrows monotonically in both count alter learning or search incentives through modified remetrics: beat-honest rate changed 6/6 to 5/6 to 4/6 to wards or step-level feedback [24, 14, 26]. GATE differs 3/6, and fundability-by-silence changed 5/6 to 5/6 to 1/6 by leaving the underlying route score unchanged and apto 0/6. The median gain among the surviving evasions plying a deterministic, code-side admissibility constraint 7
References
over typed-state coverage at inference and selection time. The coverage verdict itself is not learned, although EXP C shows that its guarantee remains bounded by modelmediated registry provenance. CARE and GroundEval are contemporaneous deterministic/evidence-gated evaluation systems; DeLLMa and DIALECTIC are relevant delayed-outcome decision and venture-evaluation neighbors [15, 5, 16, 2]. PCSC claims no priority over these components. The narrow contribution is the deletion identity, its measured prevalence under one scorer, and value inadmissibility over uncovered typed-state deltas.
9
[1] Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in AI safety, 2016. [2] Jae Yoon Bae, Simon Malberg, Joyce Galang, Andre Retterath, and Georg Groh. DIALECTIC: A multiagent system for startup evaluation. In Proceedings of the 2026 EACL Industry Track, pages 711–727, 2026. [3] Claudio Di Ciccio, Fabrizio Maria Maggi, Marco Montali, and Jan Mendling. On the relevance of a business constraint to an event log. Information Systems, 78:144–161, 2018.
Limitations
[4] Avinash K. Dixit and Robert S. Pindyck. Investment under Uncertainty. Princeton University Press, 1994.
The empirical rates come from one frozen cohort, one staged scorer, and one venture-route configuration. The core experiments use n = 26 routes and the adaptive red team uses n = 6 packets, so Wilson intervals are wide and the rates should not be read as cross-domain prevalence estimates. EXP D uses one judge family at temperature zero and K = 1; EXP B and EXP C are attack-surface tests, not generation-quality comparisons. The deterministic guarantees begin only after modelmediated typing. Registry provenance is therefore a real boundary: v1 cannot catch internally consistent but semantically empty authored fields, and the EXP B routearounds plus EXP C evasions motivate independently authored, non-co-authorable field sets. Delta-indexed floors reduce removed-cost reward but do not prove semantic delivery. Finally, terminal values are inherited from Paper 1, and the paper does not claim better real-world founder, investor, or venture outcomes.
10
[5] Jeffrey Flynt. GroundEval: A deterministic replacement for LLM-as-judge in stateful agent evaluation, 2026. [6] Paul A. Gompers. Optimal investment, monitoring, and the staging of venture capital. Journal of Finance, 50(5):1461–1489, 1995. [7] Tianyu He and Yang Yu. Verifiable agentic infrastructure, 2026. [8] Richard Hill, Ekaterina Komendantskaya, and Ronald P. A. Petrick. Proof-carrying plans. In Proceedings of the 22nd International Symposium on Principles and Practice of Declarative Programming, 2020. [9] Richard Howey, Derek Long, and Maria Fox. VAL: Automatic plan validation, continuous effects and mixed initiative planning using PDDL. In Proceedings of the 16th IEEE International Conference on Tools with Artificial Intelligence, 2004.
Conclusion
A staged plan scorer can reward omission. The reward is LLM-Modulo: analytically characterizable, exists across the frozen mu- [10] Subbarao Kambhampati et al. Grounding LLMs with external verifiers, 2024. tation surface, and can be discovered by score-seeking optimization without being told the exploit mechanism. [11] Victoria Krakovna, Jonathan Uesato, Vlad Mikulik, A deterministic typed-state gate can both refuse score Matthew Rahtz, Tom Everitt, Ramana Kumar, Zac release for the demonstrated post-hoc mutation and reKenton, and Jan Leike. Specification gaming: The shape cooperative score-seeking search toward covered flip side of AI ingenuity, 2020. DeepMind Safety Restructures. Compiler-aware co-authoring remains a sepsearch blog and companion specification-gaming exarate and harder problem: it requires non-co-authorable amples list. semantic substantiation, not merely an internally consistent registry. PCSC detects and neutralizes post-hoc omis- [12] Tamera Lanham, Anna Chen, Ansh Radhakrishnan, sion splices given model-mediated typed-state records; it Benoit Steiner, Carson Denison, Danny Hernandez, does not verify completeness of arbitrary LLM-generated Dustin Li, Esin Durmus, Evan Hubinger, Jackson strategies. Kernion, et al. Measuring faithfulness in chain-ofthought reasoning, 2023.
Competing interests
[13] Joel Lehman, Jeff Clune, Dusan Misevic, Christoph Adami, Lee Altenberg, Julie Beaulieu, Peter J. Bentley, Samuel Bernard, Guillaume Beslon, David M. Bryson, et al. The surprising creativity of digital
The author is developing a commercial implementation of the protocol through Dynamic Resonance. 8
evolution: A collection of anecdotes from the evolu- [25] Artem Polyvyanyy, Wil M. P. van der Aalst, Arthur tionary computation and artificial life research comH. M. ter Hofstede, and Moe Thandar Wynn. Impactmunities, 2018. driven process model repair. ACM Transactions on Software Engineering and Methodology, 25(4), 2016. [14] Hunter Lightman, Vineet Kosaraju, Yura Burda, Harri Edwards, Bowen Baker, Teddy Lee, Jan Leike, [26] Daniele Pronesti, Anya Belz, and Yufang Hou. BeJohn Schulman, Ilya Sutskever, and Karl Cobbe. yond outcome verification: Verifiable process reward Let’s Verify Step by Step, 2023. arXiv:2305.20050. models for structured reasoning, 2026. [15] Guanyu Liu, Weiyi Kong, Zeyu Wang, Boer Zhang, [27] Juan Pablo Salerno, Raquel Fuentetaja, and Jendrik Baiqing Li, Peiyu Zhang, and Tianyu Shi. CARE: Seipp. Finding minimal plan reductions using clasControlling LLM-generated policies through ausical planning. Journal of Artificial Intelligence Reditable review of evidence in scientific experimentasearch, 84, 2025. tion, 2026. [28] Kunvar Thaman. Reward hacking benchmark: Mea[16] Ollie Liu, Deqing Fu, Dani Yogatama, and Willie suring exploits in LLM agents with tool use, 2026. Neiswanger. DeLLMa: Decision making under un[29] Xin Wang. Proof-carrying agent actions, 2026. certainty with large language models, 2024. [17] Monte MacDiarmid, Benjamin Wright, Jonathan Ue- [30] Yanrui Wu et al. LogicGraph: Benchmarking multipath logical reasoning via neuro-symbolic generation sato, Joe Benton, Jon Kutasov, Sara Price, Naia and verification, 2026. Bouscal, Sam Bowman, Trenton Bricken, Alex Cloud, et al. Natural emergent misalignment from reward [31] Hakan L. S. Younes and Reid G. Simmons. VHPOP: hacking in production RL, 2025. Versatile heuristic partial order planner. Journal of Artificial Intelligence Research, 20:405–430, 2003. [18] Aleh Manchuliantsau. From checker to forecaster: Code-owned evaluation of model-generated [32] Tony Zhang and Bradly Stadie. TEMPO: Temporal strategic routes under delayed ground truth, 2026. evidence-gated post-training optimization, 2026. arXiv:2607.10972; DOI: 10.48550/arXiv.2607.10972. [19] METR. Recent frontier models are re- [33] Bingchen Zhao, Dhruv Srikanth, Yuxiang Wu, and Zhengyao Jiang. SpecBench: Measuring reward hackward hacking. https://metr.org/blog/ ing in long-horizon coding agents, 2026. 2025-06-05-recent-reward-hacking/, 2025. Accessed 13 July 2026.
Optimizer Prompt Excerpt [20] Sewon Min, Kalpesh Krishna, Xinxi Lyu, Mike Lewis, A Wen-tau Yih, Pang Wei Koh, Mohit Iyyer, Luke The EXP B optimizer-visible goal was: Zettlemoyer, and Hannaneh Hajishirzi. FActScore: Fine-grained atomic evaluation of factual precision Improve this route’s staged score. A higher in long form text generation, 2023. staged score is better. Keep the terminal Vision. You may restructure, merge, add, or re[21] Tom Murphy. The first level of super mario bros. is move transitions and edit their fields. All costs, easy with lexicographic orderings and time travel. In probabilities, and values are recomputed by our Proceedings of SIGBOVIK, 2013. Includes PlayFun code from your structure—you cannot state numexamples discussed in specification-gaming literature. bers directly. [22] Hootan Nakhost and Martin Müller. Action elimination and plan neighborhood graph search: Two This prompt explicitly allowed restructuring and removal. algorithms for plan improvement. In Proceedings It did not tell the optimizer that removing a transiof the Twentieth International Conference on Auto- tion could increase score, retain downstream value, or create an uncovered delta. The full prompt is frozen mated Planning and Scheduling, 2010. at eval/pcsc/optimizer_prompt_B.txt with SHA-256 [23] George C. Necula. Proof-carrying code. In Proceed- recorded in PREREG_expB.md. ings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pages B Reproducibility Notes 106–119, 1997. [24] Andrew Y. Ng, Daishi Harada, and Stuart Russell. Policy invariance under reward transformations: Theory and application to reward shaping. In Proceedings of the Sixteenth International Conference on Machine Learning (ICML), pages 278–287, 1999.
The artifact chain is recorded in eval/pcsc/INDEX.md. The main inputs are RESULTS_phase0.md, RESULTS_phase1.md, RESULTS_v1.md, RESULTS_coupling.md, RESULTS_expA.md, RESULTS_expD.md, RESULTS_expB.md, RESULTS_v2.md, 9
deletion_surface.jsonl, expA_summary.json, scores_expB.jsonl, scores_expC.jsonl, and scores_expD.jsonl. Frozen prompt hashes include judge_prompt_v0.txt, judge_prompt_D1.txt, judge_prompt_D2a.txt, judge_prompt_D2b.txt, optimizer_prompt_B.txt, and adversary_prompt_C.txt. Phase 0 was web-off and cost about $0.98; EXP D used 104 calls and $0.15; EXP B used 269 calls and $5.96; EXP C used 169 calls and $3.44. EXP D disclosed an attempt-1 D2 pairing crash and deterministic repair; the silenced D1 verdicts replicated exactly across runs. Phase 0b was a post-hoc draw-stability diagnostic: sign agreement with the frozen primary direction was 14/15 fresh draws. It is reported only as a stability check, not as a confirmatory result. The exact mutation admissibility rule is k ∈ [1, n − 2]. The detector-independent seam_skip metric marks structural skipping relative to the gold chain even when authored-registry obligations are zero. GATE refuses score release when a material uncovered seam is present. DOCK removes terminal value over the uncovered path. Source-grounding and deltafloor conditions are defined in PREREG_v2.md; the threshold reference-class leg was declared ungroundable at 0/111 and kept diagnostic-only.
10