An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models

An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models

arXiv:2608.17956v1 [cs.LG] 18 Aug 2026

Javier Aguilar Martı́n AGILabs (javieraguilar.ai)

Abstract In the Code World Model paradigm an LLM synthesizes an executable world model that a classical planner searches, and the model is accepted when it reproduces sampled transitions. We ask what that acceptance test certifies in continuous control, where the model-based RL literature treats world-model error as pervasive rather than localized. We define the danger of such a pipeline as an expected risk — the play cost of whatever it ships, on the event that it ships it — and separate the factor that is exact from the factor that is not: the probability that N i.i.d. gate rollouts all miss a critical event of probability r is exactly (1 − r)N , the risk factorizes into cost times probability exactly when the shipped cost is uncorrelated with acceptance, and when the acceptance sample is drawn independently of the training sample the two exponents add. On the representation side we prove a localization budget, valid at boundary points: two models with Lipschitz constant at most L that differ by η at a point must disagree above tolerance ε on the whole domain-intersected metric ball of radius (η − ε)/2L around that point — of volume at least κ ((η − ε)/L)d+m on any domain with interior-volume constant κ, where κ = 1 in the interior and κ = 2−(d+m) is sharp at a box corner — so at fixed amplitude and tolerance a uniformly Lipschitz class cannot shrink the disagreement region below a fixed volume: the constant must grow as the region shrinks. The discontinuous reset modes studied here (a wall and a stop that zero the velocity, a patch that freezes the mover), having no finite local constant, pay no such budget; a continuous-but-nonsmooth hybrid boundary keeps one and does. (Smooth compactly supported errors satisfy the budget by occupying it, not by evading it.) An omitted mode is the continuous form of a rare rule. Three hybrid instruments (a cart with a wall, a pendulum with an angular stop, and a four-dimensional bi-modal patch field) measure the consequence. The gate misses the mode at the predicted rate, and the mode-blind planner is not merely uninformed but exploited: pinned at the boundary in every episode at a regret of essentially the whole attainable return, at every rarity knob; against the uniform-random baseline the comparison is unambiguous on the bi-modal patch field (random better in 100 of 100 paired seeds) and carried by the baseline’s heavy tail on the 1D instruments, and it is reported distributionally. With real LLM synthesis the danger reduces, on the one-dimensional clamps, to the identifiability event alone — every sample missing the mode produced an accepted, blind, exploited artifact, and GPT-5.x wrote the exact rule in 105 of 111 mode-containing synthesis draws, with every attempt exact on 50 of 56 instrument–stream blocks (exact 95% interval [0.781,0.960]), while the 64-of-70 figure is the knob-level block-cell census; the failures include four artifacts carrying an invented stop their own samples could not refute. Repair does not survive a two-dimensional mode: across a disc, an axis-aligned square, a guided treatment at three times the budget and a second model family, no artifact recovered the region rule (0 of 156 mode-containing draws over 20 raw seed blocks), most often substituting a one-dimensional threshold. Eight targeted interventions — each aimed at one candidate explanation, with the changes it also induces reported — leave the failure in place: seven show that curvature, the tested prompting and budget, identification of the variable the trigger reads, the censoring of the region’s interior itself, and the angular coverage of the evidence do not suffice to restore repair — the last raised, in the one treatment

1

whose direction was recorded in advance, until a three-line least-squares fit recovers the region on every sample while the synthesizer recovers it on none — and the eighth, built to lower the trigger’s arity, turns out to pose no identifiable question on this instrument and is recorded rather than counted; two positive controls then locate what is missing, since given the region’s form and location the withheld constant is inferred exactly in twenty of twenty seeds, while at the baseline’s coverage the same three-line fit already recovers both constants on twelve of twenty samples and the synthesizer, given the form but not the location, recovers them on none of twenty. A version-space certificate sharpens those estimator results: relative to the stated circle class, every sample-consistent circle lies within 0.1 of the true centre and radius in 6/20 baseline blocks and 18/20 widest-coverage blocks; half-planes are excluded in 20/20 in both, while the convex hull of observed contacts remains consistent in 20/20, proving directly that identification is class-relative. Under clamp semantics, three non-collinear boundary contacts identify the circle exactly, and every one of the 20 blocks contains such a triple. What fails is the induction of a located rule from evidence, not the fitting of constants once the rule is located. One of the exclusions is a theorem’s premise lifted and found not to matter: because the mode freezes the mover at its previous position, no rollout occupies the region’s interior, so the transitions a sample can contain are entries into the region and nothing else. We prove the consequence: a rule that agrees with the truth on the reachable set is exactly consistent with every sample, at every sample size and every tolerance, and is harmless at play for the same reason, its disagreement region having query-hit probability zero. Whether the evidence identifies the rule — relative to a stated hypothesis class and tolerance — is then a property of the instrument, measurable before any synthesis — on the disc it does relative to an explicit class and tolerance, on a slab unbounded in one coordinate it does not — and on the latter the larger model reliably writes such a rule: nineteen of its twenty artifacts pass the acceptance test, an independent acceptance test at the same tolerance, and the paper’s own mode probe, without encoding the region. The practical consequence is that a sampling acceptance test leaves the sample’s coverage of the mode boundaries uncontrolled, not the gate’s tolerance: where the gate is provably informative it covers about two percent of the exploited planner’s queries.

1

Introduction

The companion paper (Aguilar Martı́n, 2026) established, in discrete games, that transition accuracy on randomly sampled play-throughs is the wrong adequacy criterion for a world model used in planning, and quantified the failure: danger = play cost × (1 − rarity)N , with the gate-miss factor exact under i.i.d. sampling. Its related-work discussion closed with a promissory note: the rare-rule gap is a localized, discrete failure that state-accuracy metrics mask by dilution — a point worth revisiting in continuous settings, where the model-based RL literature (Lambert et al., 2020; Hafner et al., 2020; Janner et al., 2019) treats world-model error as pervasive and compounding rather than localized and pivotal. This paper is that revisit. The question is not whether continuous world models can be wrong — that literature is mature — but whether the specific verified-but-wrong geometry of the discrete result exists in continuous state spaces: a model that passes a sampling gate cleanly, is exact outside a small mode region, and is still exploited catastrophically by the planner that trusts it. The answer is yes, and the continuous version differs from the discrete one in one respect. The discrete headline had two components: a provable one — when the rare rule is absent from the sample, no learner can infer it from the sample, an identifiability event of probability exactly (1 − r)N — and an empirical one, that the LLMs tested did not infer the rule even when it was present (“translation, not inference”). On the continuous one-dimensional instruments the second component vanishes for one of the three model families we measured: GPT-5.x infers an omitted hybrid mode from a handful of boundary-crossing transitions and writes the exact global rule. It

2

does not vanish on a two-dimensional mode, where no artifact in any treatment we ran recovered the region rule (Section 7.1), so the vanishing is scoped to the geometry it was measured on. What remains provable across both is the gate-miss and identifiability pair (Section 3): with the mode absent from the sample, no learner can recover it from the sample alone — though a prior or the specification still can (Proposition 5), and five artifacts in our data do exactly that, carrying an invented mode their own samples could not refute — four of GPT-5.x, of which three were also accepted by an independent gate, and the agent-relayed Claude artifact. Passing the gate means agreeing on the transitions the sample covered; whether an accepted artifact is also right off sample is a separate question, and Section 8 measures it rather than assuming it. Contributions, in four groups: 1. The estimand, and which of its factors is exact (Section 3). We define the danger of a synthesis pipeline as an expected risk and prove when it factorizes into cost times probability (Proposition 3); the gate-miss factor is exact for any measurable critical event (Proposition 1, transferred from the companion paper), admits a sharp distribution-free bracket for two modes in place of an independence assumption (Proposition 2, with the sharpness in Remark 6), and, for the central event of a blind artifact synthesized from a mode-free training sample surviving to deployment, gains a second exponent when the acceptance sample is independent of the training sample (Proposition 4; for the blind-shipped total the law is a lower bound, with the excess term measured). Identifiability transfers unchanged (Proposition 5): on the miss event no score that reads the candidate only at sampled inputs can separate a mode-blind model from the truth. 2. A localization budget, separating code from bounded-Lipschitz models (Section 3). The discrete result’s localization premise is not satisfiable at fixed amplitude and tolerance on a vanishing volume by any uniformly Lipschitz pair, and Corollary 2 prices it at every witness point, boundary included: the disagreement region contains the domain-intersected ball, of volume at least κ((η − ε)/L)d+m on any domain with interior-volume constant κ (Corollary 3; κ = 1 interior, 2−k with k clipped coordinates on a box, sharp at a corner), so an η-amplitude error confined to a region of volume V needs L ≥ (η − ε)(κ/V )1/(d+m) , a constant that diverges as the volume shrinks (a compactly supported smooth error satisfies the budget by occupying volume, not by evading it). The same geometry forces a gate detection rate (Proposition 16), whose density constant is derived rather than assumed for a whole family of semi-implicit plants. The discontinuous reset boundaries of our instruments are exactly where the obstruction disappears; a continuous hybrid boundary keeps a finite constant and does not escape it. 3. Three hybrid instruments, and what a sampling gate does and does not certify (Sections 2–5). Cart-with-wall, pendulum-with-stop and a 4D bi-modal patch field, with one harness and no per-instrument planner re-calibration, measure the threshold law, knobinvariant exploitation, and the reach mechanism; a second planner family (CEM) and a planner-side mitigation whose contact cost is a packing number (Proposition 17) bound how much of the failure is planner-mediated. On the positive side, a partition coverage certificate — with the within-rollout dependence handled exactly rather than assumed away — excludes any pair with L ≤ 5.77 carrying the wall’s error past the deployed gate; and the same measurement shows that region carries 1.9% of the exploited planner’s queries. The gate certifies where it looks. 4. The synthesis result, and the geometry that scopes it (Sections 7–7.1). With real LLM synthesis on the 1D clamps, every sample missing the mode produced an accepted, 3

blind, exploited artifact, and GPT-5.x repaired the exact rule from the revealed contacts in 105 of 111 mode-containing draws; all attempts were exact on 50/56 instrument–stream blocks (exact 95% interval [0.781, 0.960]), while 64/70 is the finer knob-cell census — so the danger reduces to the identifiability event, and coverage rather than spec completeness becomes the operative worry. On 2D regions repair collapses in every treatment we ran, including an axisaligned square and a guided treatment at three times the budget; and eight ablations with two positive controls locate the obstruction in the induction of the region’s form rather than in the evidence, the synthesizer’s ability to fit constants, or the evidence’s coverage (Section 9), with Proposition 7 proving that a whole class of wrong rules is unfalsifiable by any sample and harmless by the same argument. Re-scoring every synthesized artifact on an independent acceptance sample (Section 8) separates what the acceptance test establishes from what the training sample already implied. Supporting results — the ε-invariance of the reveal-rarity and its quadratic rate, the derived play-cost normalizers, the arithmetic behind knob-invariance, the step-t density and the certificate’s variants — are stated where they are used and proved in the supplementary material. Scope up front: three instruments (two 1D — cart, pendulum — plus a 4D bi-modal PatchField2D), two base planner families (random-shooting MPC and CEM, one fixed configuration each), 20 seeds per headline synthesis cell across the instruments (both GPT-5.x sizes; plus the caught cell on the pendulum and two bi-knob cells on PatchField2D), a 3-seed cross-family spotcheck per 1D instrument (not full sweeps), and a probe-grade multilayer perceptron (MLP). Section 12 states the limitations and the full seed accounting.

2

The instruments

This section specifies the hand-written hybrid instruments and the planner the later experiments reuse unless they say otherwise, together with three design conditions such an instrument has to satisfy.

2.1

Cart-with-wall

State (x, v); action a ∈ [−amax , amax ]; semi-implicit Euler with fixed dt: a ← clamp(a),

v ′ = v + (gain · a − drag · v) dt,

x′ = x + v ′ dt,

with defaults dt = 0.1, gain = 3, drag = 0.3, amax = 1. The hybrid mode is an inelastic wall at xwall : if x′ ≥ xwall , the next state is exactly (xwall , 0). The blind model is the same code path with the wall branch removed — the hand-written on-manifold proxy for a CWM synthesized from a spec that omits the wall, bit-exact off-mode by construction (tested: exact float equality on wall-free trajectories). We call such a model mode-blind (the canonical term; instrument-specific synonyms like “wall-blind”, or “blind” for short, mean the same thing). Reward is two sigmoid plateaus: a small reachable one on the left (0.3, at x ≤ −6) and a large one on the right (1.0, at x ≥ 12) whose approach every swept wall position blocks. Episodes are 80 steps from x0 ∼ U (−0.5, 0.5), v0 = 0. The design requirements mirror the companion paper’s material-at-cap instrument (paper 1’s discrete instrument: a rare resource-cap rule likewise omittable from sampled play): (a) random rollouts rarely fire the mode — rarity throughout this paper is the probability that a whole gate rollout contains at least one mode contact, not the volume or measure of the mode region, and the wall position is the rarity knob (r sweeps 0.317 → 0.0024 over xwall ∈ [2, 10]; Table 1); (b) the omission is exploited, not merely mispredicted — the wall-blind model predicts coasting through 4

the wall toward the large plateau, so the planner it advises drives right and is pinned; (c) the truth planner’s optimal play differs qualitatively — it goes left. The second instrument (pendulum with a hard angular stop; nonlinear gravity term) is described with its results in Section 4.1, and the third (PatchField2D, a 4D bi-modal patch field) in Section 4.2.

2.2

Planner and play cost

The planner is model-predictive control by random shooting (Nagabandi et al., 2018; Chua et al., 2018): at each step, sample candidate action sequences (piecewise-constant blocks plus the three constant sequences {−amax , 0, +amax }), roll each out on the model, take the best first action, replan. The planner is a deterministic function of its model’s responses and the seed, so the play-cost upper bound via query-hit mass applies verbatim (Section 3; Corollary 1 ties that bound to the normalization below). Single-agent control makes play cost a normalized regret, cleaner than a two-player arena (no opponent confound): play cost =

Jtruth − Jmodel , Jtruth − Jrand

where Jtruth , Jmodel , and Jrand are the returns of the truth planner — the same random-shooting MPC given the true dynamics, which is a reference and not a proved optimal policy, so Jtruth is a benchmark rather than a maximum — the model-planner (written Jblind in the tables when the model is the blind one), and the uniform-random policy, all measured in the true environment on paired seeds. The pairing is explicit and reused deliberately: an episode’s seed is 900,000 + 1000i in the synthesis arms and 1000i in the sweeps, so the same episode seeds recur across knobs, across instruments and across both planner families, and the truth, model and random arms of a row share them. Every interval we report on a play quantity is therefore paired (a bootstrap or a randomization test over seed triples, not two independent samples), which is what makes differences of 10−4 in play cost meaningful at 20 episodes. The blind planner can score below the uniformrandom policy, so the normalized value can exceed 1; we report it unclamped, always beside the raw returns it is computed from, and Section 4 measures how much of that comparison is carried by the random baseline’s tail.

2.3

Three design conditions on a continuous danger instrument

Each is a condition on the instrument, not a tuning choice: 1. I.i.d. per-step candidate sampling silently removes the mode from imagination. With i.i.d. candidates, imagined displacement is diffusive; no sampled sequence reaches distant reward within the horizon, so the truth model and the blind model rank all candidates identically and the wall never enters imagination — the two arms become indistinguishable not because the models agree but because the planner never queries where they differ. Piecewiseconstant blocks plus constant candidates fix it. The planner’s query distribution, not just its trajectory distribution, is part of the instrument. 2. Point (Gaussian) reward lodes demand braking finesse that random shooting lacks; sigmoid plateaus remove the parking problem and give clean imagined-value margins in both directions. 3. The plant’s drag time-constant must sit well inside the planning horizon, or no arm can act on the reward at all (at τ = 1/drag = 10 s against a 3 s horizon, nothing moves). 5

3

Theory: what transfers, what changes, what is new

Notation: a verification gate draws N i.i.d. rollouts from the gate policy ρ (uniform-random actions from the initial-state distribution) and accepts a model fˆ if it matches the truth f within ε in supnorm on every visited transition. Two gates of that form appear in this paper and must not be confused. A sample-consistency gate scores the artifact on the very sample it was synthesized and refined against — the protocol of the companion paper and of every committed synthesis run here — so passing it means agreement with the data the artifact has already seen. A held-out gate scores it on an independent acceptance sample (Section 8). We reserve sound for a stated logical property and never use it as a synonym for either. Measure-space setup. Fix a horizon T . A trajectory is a point of (S × A)T , equipped with the product Borel σ-algebra. The gate policy ρ together with the transition kernel induced by f defines a trajectory law Pρ on this space (the initial-state distribution pushed forward through ρ and f ). The query-hit probability qhit (E) is the probability, under the planner’s trajectory law, that at least one model query during the episode lands in E. It is a hitting probability — monotone and subadditive in E, but not a measure — and we name it accordingly rather than calling it a mass, as the companion paper did. We assume throughout that the critical region R, the disagreement region E, and the reward and dynamics maps are Borel measurable, so every probability below is well defined. With this in place the discrete arguments of Aguilar Martı́n (2026) transfer with only notational change. The paper compares instruments whose modes differ “in dimension”, and two different integers are involved. Keeping them apart is what makes the comparison an identification rather than a slogan. Definition 1 (trigger arity and entry-barrier dimension). Write Φ for the plant’s unclamped onestep map, so that Φ(s, a) is the landing state the integrator alone would produce, and let the hybrid mode be M = {(s, a) : g(Φ(s, a)) ≥ 0} for a predicate g on the landing state. Two integers describe M , and neither determines the other: • the trigger arity p is the number of landing coordinates on which g depends non-trivially — what a synthesizer must identify in order to write the rule at all; • the entry-barrier dimension b is the dimension of {g ◦ Φ = 0} as a subset of the landing position space, intersected with the reachable set — what a deployment-time fence has to cover. The cart’s wall, g(x′ ) = x′ − xwall , has p = 1 and b = 0 (a single point in a one-dimensional position space); the pendulum’s angular stop likewise p = 1, b = 0. PatchField2D’s disc, g(x′ , y ′ ) = R2 − ∥(x′ , y ′ ) − c∥2 , has p = 2 and b = 1 (a circle). A slab in the same plane, g(x′ ) = R − |x′ − cx |, has p = 1 and b = 1: arity of a clamp, barrier of a region. Remark 1 (the two dimensional readings concern different integers). Section 7.1 finds that repair from data degrades from the 1D clamps to the 2D regions, and Corollary 5 that fencing cost grows exponentially in the boundary’s dimension. Those are statements about p and about b. The cartto-disc contrast moves both at once (p : 1 → 2, b : 0 → 1), which is exactly why “1D versus 2D” is ambiguous as a causal claim and why a slab instrument — p of a clamp, b of a region — separates them. Neither integer is the dimension of the mode boundary in the joint state–action space: that is a hypersurface in every instrument here, and nothing in this paper claims otherwise.

6

Proposition 1 (gate miss; Proposition 1 of Aguilar Martı́n, 2026, transferred). Let R be any measurable set of rollouts (“the critical event”; here: the rollout fires the wall mode) with r = Pρ (R). The probability that N i.i.d. gate rollouts all avoid R is exactly (1 − r)N . Proved as Proposition 1 of the companion paper (Aguilar Martı́n, 2026); nothing in that proof uses discreteness, the event being Bernoulli(r) with i.i.d. draws. Proposition 2 (joint gate miss: bracketed, not factored). Let R1 , R2 be measurable critical events (two modes) with ri = Pρ (Ri ) and r∪ = Pρ (R1 ∪ R2 ). The probability that N i.i.d. gate rollouts avoid both is exactly (1 − r∪ )N , and with no independence assumption 1 − min(1, r1 + r2 )

N

≤ (1 − r∪ )N ≤

1 − max(r1 , r2 )

N

,

N a bracket in which the product (1 − r1 )(1 − r2 ) also lies. Assume r∪ < 1 and N ≥ 1 for the ratio below (at N = 0 both sides are 1 whatever the dependence). The product equals the truth iff Pρ (R1 ∩ R2 ) = r1 r2 , and in general
N   (1 − r1 )(1 − r2 ) r1 r2 − Pρ (R1 ∩ R2 ) N = 1+ , (1 − r∪ )N 1 − r∪ so the product over-estimates the joint miss probability under negative dependence (Pρ (R1 ∩ R2 ) < r1 r2 ) and under-estimates it under positive dependence. Proof. Proposition 1 applied to the event R1 ∪ R2 gives the exact value (1 − r∪ )N . Monotonicity gives r∪ ≥ max(r1 , r2 ) and subadditivity r∪ ≤ min(1, r1 + r2 ); since x 7→ xN is increasing on [0, 1], the bracket follows. For the product, (1 − r1 )(1 − r2 ) = 1 − r1 − r2 + r1 r2 ≥ max(0, 1 − r1 − r2 ) — the max matters when r1 + r2 > 1, where the left-hand bracket end is 0 — and ≤ 1 − max(r1 , r2 ) because r1 r2 ≤ min(r1 , r2 ). Finally inclusion–exclusion gives 1 − r∪ = 1 − r1 − r2 + Pρ (R1 ∩ R2 ), hence (1 − r1 )(1 − r2 ) − (1 − r∪ ) = r1 r2 − Pρ (R1 ∩ R2 ), which yields the displayed ratio and its sign. The bracket is sharp — its ends are the Fréchet–Hoeffding bounds for Pρ (R1 ∪ R2 ) given the marginals, so no bound in r1 , r2 alone can be tighter — and the product form cannot be rescued by a fixed correction: measured at 50,000 rollouts per knob, the sign of the dependence changes across the grid, negative at two knobs and positive at another with non-overlapping intervals. A stratified gate does not buy the product back either. Section G gives the sharpness argument, the stratification result and the measurements.

3.1

The estimand: danger as an expected risk, and which factor of it is exact

The product play cost × (1 − r)N is quoted throughout as “the danger law”. Two different objects can hide behind it, and only one of them is a probabilistic estimand, so we define it before using it. Fix a synthesis procedure A mapping a training sample to a model, a gate that accepts or rejects on an acceptance sample, and write PC(fˆ) for the play cost of a model. The danger at budget N is the expected play cost of whatever the pipeline ships: h i
DN = E PC A(Dtr ) 1{A(Dtr ) accepted} , the expectation being over the training and acceptance samples and any randomness in A.

7

Proposition 3 (the danger factorizes exactly when the shipped cost is uncorrelated with acceptance). Write G for the acceptance event and X = PC(A(Dtr )); assume X integrable and P (G) > 0 (if P (G) = 0 then DN = 0 and there is nothing to factor). Then DN = E[X | G] P (G), and the factored form DN = E[X] P (G) — what writing play cost × (1 − r)N asserts — holds if and only if Cov(X, 1G ) = 0; in particular it holds when X is almost surely constant (a single fixed blind model) and when X is independent of G. Constancy on G alone does not suffice for the factored form — X = 1G is constant on G yet has Cov(X, 1G ) = P (G)(1 − P (G)) > 0 — but it does make the conditional display exact with a constant in front: X = c almost surely on G gives DN = c P (G) with c = E[X | G], so the product is then correct with the accepted-artifact cost as its first factor, not the unconditional mean. With neither hypothesis, if c− ≤ X ≤ c+ almost surely on G then c− P (G) ≤ DN ≤ c+ P (G), and no sharper bound is available from P (G) and the range alone: both ends are attained. Proof. The first display is the definition of conditional expectation, E[X1G ] = E[X | G]P (G). Expanding the covariance, E[X1G ] = E[X]P (G) + Cov(X, 1G ), which gives the iff; a globally constant X and an X independent of G each force the covariance to vanish, while X = c on G gives E[X1G ] = c P (G) by direct integration, no covariance statement needed. The bounds follow from monotonicity of the expectation on G, and are attained by X ≡ c± on G, so they cannot be improved without measuring the conditional law. The paper keeps the two readings separate throughout. On the hand-written instruments the shipped model is fixed — the mode-blind program, whose play cost is a property of the instrument and not of the sample — so X is constant and the product is an identity, DN = PC(fˆblind ) P (gate misses), whose second factor is exactly (1 − r)N by Proposition 1. This is the precise sense in which “the law is exact”: the gate-miss factor is exact, and the cost factor is an input to the identity rather than a consequence of it. In the LLM arms the artifact — and therefore its cost — is a function of the sample, so the product is an estimate under Proposition 3’s hypothesis, and what we report is the conditional quantity the identity actually needs: the mean play cost of accepted artifacts, per campaign and arm, with a block-clustered bootstrap interval (the accepted play cost rows of results/paper2 statistics.json; on the cart’s headline incomplete arm, 0.508 over 61 accepted draws, cluster interval [0.344, 0.671]). Remark 2 (the miss factor’s form does not need the i.i.d. hypothesis). For rollouts drawn by any rule — adaptively, from history — the chain rule of conditional probability gives, exactly, P (no critical event in N rollouts) =

N Y

1 − ri ,

ri = P Ei | no E1 , . . . , Ei−1 ,

i=1

Q and interval Q knowledge ℓi ≤ ri ≤ ui along missNhistories gives the sharp bracket i (1 − ui ) ≤ P (miss) ≤ i (1 − ℓi ). The i.i.d. exponent (1 − r) , the independent-gate sum Ntr + Ng of Proposition 4, a stratified schedule’s product, and the two-mode Fréchet bracket of Proposition 2 are corollaries of this one display (formalized and tested against enumerated dependent processes in scripts/danger law h4.py, results/danger law h4.json). What dependence or adaptivity removes is not the identity but its identification: the ri are conditional hazards, and unconditional marginal event rates alone no longer determine the product. 8

An independent acceptance sample. A gate that scores the artifact on the sample it was refined against certifies consistency with its own training data. Separating the two samples leaves the law’s central event with an exponent that depends on the two budgets only through their sum — the content of the next proposition, together with what that does and does not imply. Proposition 4 (gate miss with an independent acceptance sample). Let Dtr and Dg be independent samples of Ntr and Ng i.i.d. gate-policy rollouts; let the pipeline synthesize and refine on Dtr and accept the artifact iff it matches the truth within ε on every transition of Dg ; and let R be the critical event of Proposition 1, with r = Pρ (R). Suppose that (i) whenever Dtr contains no rollout in R, the artifact A(Dtr ) is mode-blind, and (ii) a mode-blind artifact fails the acceptance sample if and only if that sample contains a rollout in R. Then the danger law’s central event — a modefree training sample yielding a (by (i)) mode-blind artifact that survives the gate — has probability exactly
P Dtr ∩ R = ∅, artifact shipped = (1 − r)Ntr (1 − r)Ng = (1 − r)Ntr +Ng . Hypothesis (i) is one implication, not an equivalence, so mode-blind artifacts may also arise from training samples that do contain R, and the total splits accordingly:
P (a mode-blind artifact is shipped) = (1 − r)Ntr +Ng + P blind, Dtr ∩ R ̸= ∅ (1 − r)Ng , so the law is a lower bound on that total, with equality (for r < 1; at r = 1 both sides vanish and the clause is vacuous) if and only if blindness arises only from the miss — the “iff ” strengthening of (i). Proof. On {Dtr ∩ R = ∅}, of probability (1 − r)Ntr by Proposition 1, the artifact is mode-blind by (i). Blindness is a function of Dtr and the synthesizer’s randomness alone, so Dg is independent of it, and by (ii) acceptance is then {Dg ∩ R = ∅}, of conditional probability (1 − r)Ng ; multiplying gives the first display. For the second, split the blind event into {Dtr ∩ R = ∅} — which it contains, by (i), and on which the first display stands — and {blind, Dtr ∩ R ̸= ∅}; on each, (ii) with the independence of Dg makes acceptance a further factor (1−r)Ng , and the two terms add. The excess term vanishes exactly when blindness implies the miss. Three things follow. First, for the event the proposition prices, the two budgets enter only through their sum: at fixed Ntr + Ng that miss exponent is unchanged. This is a statement about one exponent and nothing else — it does not say that synthesis quality is preserved when training rollouts are moved to the gate (a smaller Dtr changes the artifact, and with it hypothesis (i) and the excess term), nor that the total risk DN , the compute, or the rate of other wrong artifacts is unchanged at a fixed budget. What the separated design buys is that acceptance is not selfconfirming; what it changes is which artifacts ship when exactly one of the two samples contains the mode — a case a sample-consistency gate cannot even represent, since it refines until it agrees with everything it has seen. Section 8’s experiment, note, adds an acceptance sample to the committed artifacts (Ntr = 40 against Ntr + Ng = 80) rather than redistributing a fixed budget. Second, the hypotheses are where the empirical content sits, and they are of different kinds. (ii) is nearly structural for a program with an omitted branch: it agrees with the truth exactly off the mode (Section 2.1) and disagrees on a contact by far more than any deployment tolerance, so it fails an acceptance sample exactly when that sample contains a contact — and Section 8 verifies it artifact by artifact rather than assuming it. (i) is a genuine empirical premise: it is precisely what the discrete companion paper’s translation-not-inference residual denies in general, and what fails on 2D regions (Section 7.1), which is why it appears as a hypothesis rather than being folded into the

9

statement. Third, “exact” attaches to this proposition and to Proposition 1, never to the full risk DN . The gate’s tolerance is not the axis this paper is about, and the reason is worth one sentence here and a proof in the supplement: because the mode-blind model agrees with the truth exactly off the mode, the probability that a rollout reveals a disagreement at tolerance ε equals the mode-firing rarity for every ε below the smallest contact disagreement, and in the population the two agree at a quadratic rate — proved for the whole semi-implicit family in Section A. Tightening ε therefore cannot catch a hard mode, and loosening it does not widen the hole (measured in Section 5). Proposition 5 (identifiability; Proposition 3 of Aguilar Martı́n, 2026, transferred). Let M ⊆ S × A be the mode region (for the cart the clamp fires depending on (s, a) through x′ ≥ xwall ) and instantiate Proposition 1 at the critical event R = {rollouts that visit M }, so that “miss” means exactly that no sampled transition lies in M . Condition on that miss event and let fˆ1 , fˆ2 be any two models that agree on (S × A) \ M . Then every score that depends on the candidate models only through their values at the sampled inputs — the gate, a one-step likelihood, a one-step refinement objective — is constant across the two, so no such score can distinguish them, and preference for the correct one must come from the prior or the specification. Proof. On the miss event the sample visits no transition in M , and the two models agree off M , so they produce identical outputs on every sampled input; a score that reads them only there is therefore the same number for both. Proposition 6 (finite-sample disc identification is class-relative). For the pinned PatchField2D integrator, each sampled transition determines its free landing point z = pos(Φ(s, a)) and its contact label. Fix the far patch and let H◦ = {D(c, R) ∪ D2∗ : c ∈ R2 , R > 0}. Writing I for landings labelled inside the near patch and O for landings labelled outside both patches, (c, R) is sample-consistent exactly when max ∥z − c∥2 ≤ R < min ∥z − c∥2 . z∈I

z∈O

(1)

Consequently the finite sample identifies the true disc at tolerances (τc , τR ) relative to H◦ if and only if every pair satisfying (1) obeys ∥c − c∗ ∥2 ≤ τc and |R − R∗ | ≤ τR . This conclusion does not extend to an unrestricted region class: when the true near patch is convex, conv(I) is itself sampleconsistent. Under clamp rather than freeze semantics, three non-collinear near-patch contact states lie on the boundary and determine (c∗ , R∗ ) uniquely. Proof. The pinned integrator makes z computable from (s, a), and the transition records whether the mode fired, so it supplies the membership label. A disc contains all of I and none of O exactly when its radius lies in the interval (1), proving the version-space criterion. Since I lies in the convex true disc, conv(I) also lies in it; every point of O is outside the true disc and hence outside that hull, proving consistency of the broader alternative. In the clamp variant each contact state is the radial projection onto the circle. Three non-collinear points have a unique circumcircle. The criterion is checked block by block by scripts/disc identifiability certificate.py. Its multilevel search uses the 2-Lipschitz feasibility gap in (1), with grid slack and a directionuniform far-field exclusion bound, to outer-bound every consistent (c, R) rather than merely fit one. At τc = τR = 0.1, it proves identification relative to H◦ in 6/20 baseline blocks, 9/20 at the intermediate evidence dose and 18/20 at the widest dose. It separately excludes every half-plane in 20/20 10

blocks at all three doses; axis-aligned boxes are excluded in 19/20, 19/20 and 20/20. The hull construction remains consistent in 20/20 throughout, so no statement silently promotes circle-relative identification to uniqueness among arbitrary regions. In the clamp campaign, the three-point clause identifies the circle in 20/20 blocks. The versioned certificate and its oracle tests are results/disc identifiability certificate.json and tests/test disc identifiability certificate.py. A sharper obstruction under freeze semantics: the mode’s own dynamics censor its interior. Proposition 5 conditions on the mode being absent from the sample. There is a second, structural obstruction that survives the mode being present — and, unlike the first, it is not repaired by drawing more rollouts or by drawing an independent acceptance sample. Proposition 7 (freeze semantics make an entry rule unfalsifiable). Let Φ be the plant’s unclamped one-step map, pos(·) the position coordinates, R a mode region in position space, and let the truth be ( (pos(s), 0) if pos(Φ(s, a)) ∈ R, f (s, a) = Φ(s, a) otherwise, so that the mode freezes the mover at its previous position, and let the initial-state distribution be supported on {pos ∈ / R}. Then: (i) every state a truth rollout visits has pos ∈ / R; (ii) writing D = {(s, a) : pos(s) ∈ / R}, every transition of every truth rollout lies in D, so any model built from a predicate that agrees with the membership test pos(Φ(s, a)) ∈ R on D is exactly equal to f on every rollout of every length under any policy — no sample distinguishes the two, at any tolerance and any N ; (iii) for any planner that rolls such a model forward from a reachable state, the imagined states also stay outside R, so the disagreement region E has qhit (E) = 0 and Proposition 8 forces play cost = 0. Proof. (i) By induction on t. At t = 0 it is the hypothesis on the initial distribution. If the step at t contacts the mode then pos(st+1 ) = pos(st ) ∈ / R by the inductive hypothesis; if it does not, then pos(st+1 ) = pos(Φ(st , at )) ∈ / R by the definition of a contact. (ii) By (i) every visited (s, a) lies in D; the two transition maps agree there, so a second induction gives identical trajectories, hence identical transitions and identical rewards. (iii) The imagined trajectory is generated by the model, which freezes on entry exactly as the truth does, so the same induction applies to it; E ⊆ {pos(s) ∈ R} by (ii), which the imagined trajectory never enters. Three consequences. First, the obstruction is structural : it is the mode’s freeze semantics, not the sample size, that removes the evidence, so an independent acceptance sample — the fix of Section 8 — cannot catch a model in this class either. Second, it is harmless, by (iii): the models it contains differ from the truth only strictly inside a region no rollout and no imagination reaches. So this is the verified-and-fine cell of the axis separation, now characterised structurally rather than observed. Third, it locates what the evidence can identify: on such an instrument a sample witnesses only entries into the mode, so it pins the boundary as approached and says nothing about membership — which is why an artifact can be exact on every transition it will ever be shown and still not encode the region. Section 9 exhibits a synthesized artifact in this class, together with the check that (ii) and (iii) hold of it as stated. The qualifier is not decoration: a score that rolls a candidate forward under itself (a multi-step prediction loss, or any objective evaluated on model-generated states) queries the candidate at inputs the sample never contained, and those can lie in M . Such a score is not constant across the two candidates, so it escapes this proposition — it does not thereby become informative, since 11

the two candidates disagree there precisely because nothing observed says which is right, but the proposition does not cover it and we do not claim it does. This holds for any learner — LLM, linear regression, MLP — a point Section 10 instantiates empirically. Proposition 8 (play-cost upper bound; Proposition 2 of Aguilar Martı́n, 2026, transferred). Assume returns are normalized to [0, 1] (WLOG, by rescaling J 7→ (J − Jmin )/(Jmax − Jmin ); equivalently carry an explicit factor Jmax − Jmin throughout). Let E = {(s, a) : f (s, a) ̸= fˆ(s, a)} be the exact disagreement region — exactness is what the coupling needs, since off E the two models must return identical answers. For any planner that is a deterministic function of model responses and a seed, |J(f ) − J(fˆ)| ≤ qhit (E), where qhit (E) is the probability that the planner queries its model somewhere in E during an episode. Proof (coupling; Proposition 2 of Aguilar Martı́n, 2026, recorded here rather than deferred). Couple the two runs on a common seed. On the event that no query lands in E, f and fˆ return identical responses to every query the planner issues (they agree off E), so with shared rng the two runs select the same action sequence and traverse the same states, realizing the same return. That event is unambiguous: the two runs are identical up to the first query landing in E, so “no query ever lands in E” is a single coupling-measurable event with one probability, not two model-dependent ones. The realized returns can therefore differ only on its complement, of probability qhit (E), where normalized returns differ by at most 1; taking expectations gives |J(f ) − J(fˆ)| ≤ qhit (E). MPC’s imagined rollouts are the queries. The raw J reported in the tables (e.g. Jtruth = 17.77) is this normalized quantity rescaled by Jmax − Jmin , so the bound is a statement about the normalized return. The paper’s reported play cost, however, divides by Jtruth −Jrand (Section 2.2), not by Jmax −Jmin ; the following corollary states the relationship rather than silently identifying the two. Corollary 1 (play cost saturation). Let Jmax , Jmin be the essential supremum and infimum of the realized return under the episode law, and let J¯ ≥ Jmax , J ≤ Jmin be the explicit bounds on them proved in Proposition 12. With play cost the signed normalization of Section 2.2, Proposition 8 in raw units (|J(f ) − J(fˆ)| ≤ qhit (E) (Jmax − Jmin )) gives |play cost| ≤ qhit (E)

Jmax − Jmin J¯ − J ≤ qhit (E) , Jtruth − Jrand Jtruth − Jrand

the second inequality being the computable one. Proof. Divide Proposition 8’s raw-unit bound by the knob-free constant Jtruth − Jrand > 0, which is what the definition of play cost normalizes by; then Jmax − Jmin ≤ J¯ − J by Proposition 12. Three statuses must be kept apart wherever this ceiling is quoted, and Proposition 12 supplies ¯ J, valid at every knob and every policy), an attained exonly the first: a proved bound (J, tremum (a policy exhibited that realizes it — the push-left trajectory does so for J¯ at xwall ≤ 6, to within 2 × 10−7 ), and a numerical approach to an extremum whose attainment is not proved (the wider knobs, where the bound exceeds the best policy found by 1.0015× at xwall = 8 and ¯ J for the bounds throughout, and say “known” only where attainment 1.0799× at 10). We write J, is exhibited. Pointwise extremes are what Proposition 8 needs — its coupling bounds a realized per-seed difference, not a difference of expectations — and the distinction is not pedantic here: read as a supremum over policies of the expected return, Jmax would be 17.697 on the cart (the best constant

12

policy averaged over x0 ∼ U (− 21 , 12 )), below the measured Jtruth = 17.772, whose seeds happen to have x̄0 = −0.123; the normalization would then exceed 1 by construction. Both normalizers are derived rather than estimated — explicit numbers valid at every knob and every policy — and the knob-invariance of the reported play cost is an arithmetic consequence of the exploited planner’s return rather than an empirical regularity (Proposition 13). Both derivations, with the certificate that the truth planner’s own return is knob-free, are in Section B. There is a positive counterpart to all of this, and it is worth knowing exactly how far it reaches. For Lipschitz pairs the gate does certify something: a partition argument on the deployed cart gate excludes any pair with L = max(Lipf, Lipfˆ) ≤ 5.77 carrying the wall’s error of 4.2, with probability at least 1 − δ over the gate’s draws. The same measurement shows why it does not rescue sampling verification: the certified region carries 1.9% of the exploited planner’s queries. The certificates, their statistical accounting and that measurement are in Section C. What is new: the localization premise is a theorem-shaped obstruction. Proposition 9 (smoothness forbids localized error). Let f, fˆ : S × A ⊆ Rd × Rm → Rd be LLipschitz on the joint state-action space in the sup-metric on S × A, with L ∈ [0, ∞) (i.e. L = max(Lip f, Lip fˆ)). Suppose ∥f (s0 , a0 ) − fˆ(s0 , a0 )∥∞ = η at some (s0 , a0 ) ∈ S × A. Fix any tolerance ε < η and write Eε = {(s, a) ∈ S
× A : ∥f (s, a) − fˆ(s, a)∥∞ > ε}. If L > 0, then Eε contains the open metric ball B (s0 , a0 ), η−ε 2L ∩ (S × A) (the intersection matters only when (s0 , a0 ) lies near ∂(S × A)). If L = 0, then f − fˆ is constant and Eε is all of S × A — the degenerate extreme of the same statement, and the reason the radius is written for L > 0. Proof. g = f − fˆ is 2L-Lipschitz on S × A, so for ∥(s, a) − (s0 , a0 )∥∞ < (η − ε)/2L we have ∥g(s, a)∥∞ ≥ η − 2L ∥(s, a) − (s0 , a0 )∥∞ > ε; the inequality is strict, so the ball is open. The L = 0 case is immediate: g ≡ g(s0 , a0 ) with ∥g(s0 , a0 )∥∞ = η > ε. Corollary 2 (the localization budget). In the setting of Proposition 9 with L > 0, write z0 = (s0 , a0 ) and ρ = (η − ε)/2L. Then, with no condition on where z0 sits, vol(Eε ) ≥ vol(B∞ (z0 , ρ) ∩ (S × A)) , since the proposition places the intersected ball inside Eε and volume is monotone under inclusion. When the ball is not clipped by ∂(S × A) — the interior case — the right side is the volume of a sup-metric cube of side 2ρ,   η − ε d+m vol(Eε ) ≥ , L and, equivalently, confining the ε-disagreement of an η-amplitude error to a set of volume V requires L ≥

η−ε V 1/(d+m)

.

The first display is the always-valid form; what the boundary can cost is a constant, made uniform by one piece of domain regularity. Corollary 3 (the budget at the boundary). Say a domain D ⊆ Rd+m has interior-volume constant κ ∈ (0, 1] at scale r0 > 0 if vol(B∞ (z, r) ∩ D) ≥ κ (2r)d+m for every z ∈ D and every r ≤ r0 . If S × A has interior-volume constant κ at scale r0 and ρ = (η − ε)/2L ≤ r0 , then    κ 1/(d+m) η − ε d+m vol(Eε ) ≥ κ , equivalently L ≥ (η − ε) L V 13

for confinement to volume V . For an axis-aligned box with side lengths ℓ1 , . . . , ℓd+m this holds at scale r0 = mini ℓi with the per-point refinement vol(B∞ (z, r) ∩ D) ≥ 2−k (2r)d+m ,

k = #{i : min(zi − ai , bi − zi ) < r},

where k counts the clipped coordinates: k = 0 in the interior recovers the unclipped display of Corollary 2 (κ = 1), a face point has k = 1 (half the cube survives), an edge k = 2, and a full corner k = d+m keeps exactly one orthant. So a box has κ = 2−(d+m) , attained at a corner — the constant is sharp — and the boundary’s whole price in the equivalent form is L ≥ (η − ε)/(2V 1/(d+m) ): clipping costs at most a factor 2 in L, never the budget itself. The same product formula covers half-bounded and unbounded coordinates (an unbounded coordinate never clips and contributes its full factor 2r); on this paper’s instrument domains the state coordinates are unbounded and the single scalar action lives in [−amax , amax ], so k ≤ 1 and κ ≥ 1/2 at every witness with r ≤ 2amax . Proof. The general displays follow from Corollary 2’s first display and the definition of κ. For the box, the ball-domain intersection is a product of interval intersections, and coordinate i contributes length min(zi + r, bi ) − max(zi − r, ai ): this is 2r when zi is at distance at least r from both endpoints, and at least min(ℓi , r) ≥ r otherwise (at least r of the window [zi − r, zi + r] lies on the side of zi with more room, using r ≤ ℓi ). Multiplying the factors gives 2−k (2r)d+m . At a corner z = (a1 , . . . ) with r ≤ mini ℓi every factor is exactly r, so the bound is attained. (The case constants are computed from this product formula in exact rational arithmetic by scripts/locbudget boundary constants.py rather than asserted; tests/test locbudget boundary.py checks the formula against brute-force Monte Carlo volumes, the sharpness at a corner, and that the scale condition r ≤ mini ℓi is load-bearing.) So localization is not forbidden at finite L; it is purchased, at a Lipschitz constant that grows as the region shrinks — and only exact localization (V → 0 at fixed amplitude) requires L → ∞. The purchase price is now unconditional: at an interior witness the budget is ((η − ε)/L)d+m , and at a boundary witness it is the same volume times a domain constant that a box keeps above 2−(d+m) . This is the precise form of the claim, and what it does not say matters as much, because four statements are easy to merge and only the first is this proposition’s. Remark 3 (four statements that must be kept apart). (i) Representability. A pair with Lipschitz constant at most L cannot realize an η-amplitude error confined below the volume of Corollaries 2– 3; a discontinuous reset boundary — the kind all three instruments carry: the map jumps (v 7→ 0 at the wall and the stop, the mover frozen at the patch), so no finite local constant exists — faces no such constraint. The scope cuts both ways: a hybrid boundary that is continuous but nonsmooth (a kink, an actuation saturation) keeps a finite Lipschitz constant and still pays the budget, so the exemption is proved for the reset modes studied here, not for hybrid boundaries as a class. Compactly supported smooth errors are not excluded either, and this paper uses one — the C ∞ bump arm of Section 5 — so “smooth models cannot localize” would be false as stated; what is true is the bounded-Lipschitz, fixed-amplitude, arbitrarily-sharp form above. (ii) Detectability. The same geometry forces a gate reveal rate (Proposition 16): at fixed amplitude, a smoother error is easier for the gate to find, not harder — measured at 0.18 against the wall’s 0.14 in Section 5. (iii) Exactness at a tolerance. Agreeing off the mode at ε = 10−9 is a float-level property, which a program inherits from a pinned integrator by construction and a fitted model attains only up to its optimization residual. That is a claim about representation classes, not about either of the above. (iv) Learnability from a finite sample. What a given learner does with a given sample is an empirical question. Section 10 answers it for two learners — a closed-form linear fit and a probegrade h=8 MLP — and those measurements license no conclusion about modern learned dynamics 14

models, whose floor would be lower and whose structural inability to be bit-exact off a mode is an argument rather than a measurement (Section 12). The disagreement region Eε lives in the same joint state-action space as the exact disagreement region E of Proposition 8, and satisfies Eε ⊆ E for every ε ≥ 0, so the ball is directly a lower bound on the query-relevant region the planner can hit — no fixed-action slice argument is needed to bring the two together. The inclusion is the only relation the two need: Proposition 8 requires exact agreement off E, so it cannot be restated at tolerance ε without a perturbation term (a ε-sized answer difference can flip an argmax over 200 candidates and decouple the runs). (Restricting to a fixed action a0 recovers the state-slice form: the open ball of radius (η − ε)/2L in S × {a0 } lies in Eε , the version convenient when reasoning about a single instrument’s mode.) Read as its contrapositive: a model error that is large somewhere (large enough to matter at play) and invisible at tolerance ε outside a metrically tiny region requires L large — in the limit, a discontinuity. This is the sense in which the discrete localization premise (“the wrong model is exact off the rule region”) is discrete: in its exact form it is unsatisfiable at any finite Lipschitz bound, and in its approximate form it costs the volume of Corollaries 2–3. Two consequences structure the paper: (i) the natural continuous home of the danger geometry is hybrid dynamics with discontinuous resets — inelastic contacts, hard stops, regime switches that jump the state — where the truth itself has unbounded local Lipschitz constant across the mode boundary (our wall: v jumps to 0), and an omitted mode is precisely a rare rule; a continuous hybrid boundary (a kink, a saturation) keeps a finite constant and stays inside the budget, so this home is the reset class and not hybrid dynamics wholesale; (ii) exact off-mode agreement is available representationally to programs (an omitted or added branch is bit-exact off the omitted case) and to a bounded-Lipschitz model only at that volume price, a contrast Section 10 measures on two learners. The geometry also has a measure counterpart — smoothness does not merely forbid exact localization, it forces a gate detection rate, at a Lipschitz constant that must grow like N 1/(d+m) to keep hiding. That proposition, the closed-form visitation density it consumes, and the three scope conditions that decide what it says about this instrument are in Section D. The short version is the one the measurements confirm: at comparable amplitude the smooth error is if anything the more detectable of the two, and its harmlessness comes from play cost rather than from hiding.

4

The mechanism and the threshold law

This section measures the danger law’s full phenomenology on the hand-written instruments, before any LLM enters the loop. Every “danger” column below is the product play cost × (1 − r)N , which is the risk of Proposition 3 exactly when that proposition’s covariance hypothesis holds; here the artifact is hand-written and fixed, so it holds by construction, and the qualifier only becomes live in the LLM arms of Section 7. All numbers CPU-only, with the hand-written blind model as the onmanifold proxy (scripts/continuous reach.py; 30,000 rarity rollouts and 20 MPC episodes/arm per knob; Wilson 95% CIs (Wilson, 1927) in the versioned results). One convention holds for every table below: a printed 0 is a censored zero — no occurrence in the sample, not a demonstrated impossibility — and its content is the Wilson upper bound, which the versioned JSON carries. The ones stated inline: 0/20 truth-planner contacts is [0, 0.16], 0/300 gate passes is [0, 0.013], and 0/2000 rarity is [0, 0.0019]. Every zero-valued table cell now carries its own bound, its own interval, or the note that it is a demonstrated rather than a censored zero, so this convention is a reading aid and not a load-bearing one. Uncertainty on the danger curves is propagated per factor and labelled: every rarity across the 40 curve rows of the three instruments carries a family-wise simultaneous 95% exact interval propagated monotonically through play cost · (1 − r)N (scripts/danger law 15

h4.py, results/danger law h4.json; Bonferroni, so the family coverage holds under the rows’ dependence, and the exponent identities the propagation relies on are the corollaries of Remark 2), and on the cells with committed paired episode triples — cart xwall = 8, pendulum θstop = 1.4, and PatchField2D k = (3, 7) with its three critical-event curves — the band combines both estimated factors, the rarity interval and a paired play-cost bootstrap. For the remaining rows the play-cost factor is a point estimate and the band is rarity-only; the JSON records that as an explicit per-row gap rather than presenting a rarity-only band as a full danger interval. xwall 2 3 4 5 6 8 10

rarity 0.3168 0.2135 0.1352 0.0797 0.0439 0.0114 0.0024

Jtruth

Jblind

17.77 17.77 17.77 17.77 17.77 17.77 17.77

−5

1.4×10 1.3×10−5 1.9×10−5 6.3×10−5 3.8×10−4 0.02 0.94

Jrand 0.53 0.53 0.53 0.53 0.53 0.53 0.53

play cost 1.031 1.031 1.031 1.031 1.031 1.030 0.977

blind hit 1.00 1.00 1.00 1.00 1.00 1.00 1.00

d@20

d@40

d@80

0.001 0.008 0.056 0.196 0.420 0.818 0.930

−7

6.0×10−14 4.7×10−9 9.3×10−6 0.001 0.028 0.410 0.804

2.5×10 6.9×10−5 0.003 0.037 0.171 0.650 0.886

Table 1: The danger curve on the wall-position knob. “blind hit” = fraction of episodes in which the blind planner’s trajectory fires the wall mode; the truth planner’s trajectory fires it in no episode at any knob (0/20, so < 0.16); d@N = play cost · (1 − r)N . Rarity is measured on 30,000 random rollouts (Wilson 95% CIs in the versioned JSON), the same sample size as the pendulum’s, so the mode-firing and reveal-rarity estimates of the same event are now directly comparable.

danger = play_cost (1 r)N

The threshold law on the wall-position knob 0.8 0.6

N = 20 N = 40 N = 80 + play-cost interval (20 paired episodes)

0.4 0.2 0.0 10 1

10 2

rarity r (wall-contact rate under random rollouts, log) Figure 1: The threshold law on the wall-position knob (Table 1 rendered): danger ≈ 0 while the wall is inside the random envelope, rises through the elbow, plateaus at full play cost; N shifts the threshold. Bands and horizontal bars are the rarity’s Wilson interval propagated through play cost · (1 − r)N , which is monotone in r, so the transformed interval is the corner pair; a printed point with no visible band has an interval narrower than the marker. Readings: the threshold law again — danger ≈ 0 while the wall sits inside the random-rollout envelope, rises through the elbow, and plateaus at full play cost, with the entire elbow inside the sweep (Figure 1). play cost is knob-invariant and ≈ 1 (exceeding 1 at every knob except the largest, where far-plateau leakage gives 0.977): the blind planner is not merely uninformed 16

P(episode fires the wall mode)

The two reach distributions of the danger law 1.0

20/20 every knob: 0.84

0.8 blind-planner reach (exploited) random reach (= rarity) truth-planner reach

0.6 0.4

0/20 every knob: 0.16

0.2 0.0 2

3

4

5

6

7

8

9

wall position xwall (the rarity knob)

10

Figure 2: The two reach distributions of the danger law: the exploited planner’s mode reach is flat at 1.00 across the knob; random reach (= rarity) falls two orders of magnitude; the truth planner’s trajectory reach is a censored zero at every knob (0/20 episodes) and is drawn as an upper bound rather than as a point — the mode lives on the truth planner’s query distribution (Proposition 8), not its path. Error bars are Wilson intervals: binomial over 20 episodes for the two reach curves, and over 30,000 rollouts for rarity. but exploited — MPC on the wall-less model plans into the phantom region, is pinned at the wall (final x = xwall exactly, contact rate 1.00 at every knob), and replans the same doomed plan every step, for the entire episode, ending at a return of 2 × 10−5 against the truth planner’s 17.77. The 0.977 at xwall = 10 is the sigmoid tail of the far plateau leaking Jblind = 0.94; the mechanism is unchanged. The reach mechanism appears in its cleanest form (Figure 2), with the query/trajectory distinction now visible. Gate-miss exactness is re-verified in-tests and again at gate scale in Section 5. One qualification belongs with the claim. At the widest knobs the pinned planner scores above the uniform-random policy, because the far plateau’s sigmoid tail pays a planner frozen short of it; the exploitation is what the mechanism asserts, and “below random” is a property of the reward’s shape as much as of the planner. Narrowing only the phantom plateau removes the tail and makes the strong form hold at every knob on both instruments, with play cost invariant to 10−4 (Section H); we report the default instrument in the main tables and treat that variant as a robustness check rather than as the headline. At 100 paired episodes: the exploitation is robust, “below random” is not. Twenty episodes per cell is too few for a comparison against a baseline as heavy-tailed as the uniformrandom policy’s, so the three headline rows were re-run at 100 paired episodes with a paired bootstrap and a randomization test (scripts/play cost intervals.py; the same seed in all three arms, 20,000 resamples). The exploitation claim survives unchanged and tightens: on the cart’s headline knob play cost = 1.014 with a paired 95% interval [1.001, 1.033], on the pendulum’s 0.996 [0.996, 0.997], and on PatchField2D 1.044 [1.020, 1.075] — and the raw quantity behind them is a regret of 17.72, 19.96 and 19.75 return units respectively, which is what those normalized numbers mean.

17

episode return (100 paired seeds)

The comparison against random, however, does not survive at face value, and the reason is the baseline rather than the planner. On the cart, Jrand − Jblind = 0.249 with interval [0.024, 0.559] and a sign-flip p = 0.040, so the mean difference is positive — but Jrandom is heavy-tailed (median 4.7 × 10−4 , maximum 10.58, skewness 6.1: a handful of episodes in which the random walk happens to reach the left plateau), and in 86 of the 100 seeds the blind planner scores above random. So “below random” on the cart is a statement about a mean that a few lucky random episodes carry, not about a typical episode, and it is stated here only in that form. At the pendulum’s headline knob it is simply false at this sample size (Jrand − Jblind = −0.078, random better in 7 of 100 seeds) — that knob is one the sigmoid-tail leak of the previous paragraph affects. On PatchField2D it is unambiguous: Jrand − Jblind = 0.834 [0.395, 1.357], random better in 100 of 100 seeds, p = 1.2 × 10−14 . The load-bearing claim was never the comparison with random — it is that the planner is exploited : pinned at the boundary in every episode, at a regret of essentially the whole available return, with play cost ≈ 1 and its interval excluding zero by three orders of magnitude. That is what the tables report, and what “below random” added was rhetorical rather than evidential. One further caution the larger sample exposes: on PatchField2D the truth planner’s own return has a standard deviation of 7.9 across seeds (median 17.0, maximum 41.6), because it sometimes finds a route past the patches to the phantom lode, so the per-seed play cost there is genuinely dispersed (median 0.899, interquartile range [0.860, 0.932]) and its mean is not a typical episode either. Per-seed values for all three rows are in the versioned JSON, and Figure 3 plots them, tails unsummarized.

cart x_wall = 8 17.5 15.0 12.5 10.0 7.5 5.0 2.5 0.0 truth

20.0 blind > random: 17.5 86/100 seeds 15.0 12.5 10.0 7.5 5.0 2.5 0.0 blind random

pendulum th_stop = 1.4 blind > random: 93/100 seeds

patch2d k = (3,7) 40

blind > random: 0/100 seeds

30 20 10 0

truth

blind

random

truth

blind

random

Figure 3: Per-seed return distributions for the three 100-paired-episode experiments (violins with every seed overplotted). The exploitation claim is the gap between the truth planner and the pinned blind planner, and it is total in every panel. The random baseline’s heavy upper tail — a few episodes that wander onto a reward plateau — is what carries its mean above the blind planner’s on the cart, against 86 of 100 individual seeds; on PatchField2D the comparison is unambiguous in the other direction (0 of 100).

4.1

Robustness: the same law on a nonlinear plant

The cart’s off-mode dynamics are linear, which is convenient for Section 10 but invites the worry that the phenomenology depends on it. A second instrument — a pendulum (gravity term sin θ, θ = 0 hanging down) with a hard angular stop, same interface, same MPC, same two-plateau

18

reward on θ — reproduces the identical picture with no re-calibration (rarity is natural here: gravity confines the random walk near the bottom, so climbing to the stop is rare): θstop

rarity

Jtruth

Jblind

play cost

blind hit

d@40

0.8 1.0 1.2 1.4 1.6 2.0

0.2876 0.1270 0.0509 0.0196 0.0070 0.0007

20.08 20.08 20.08 20.08 20.08 20.08

0.01 0.03 0.05 0.12 0.26 1.23

1.002 1.002 1.000 0.997 0.990 0.942

1.00 1.00 1.00 1.00 1.00 1.00

1.3×10−6 0.004 0.124 0.452 0.748 0.917

Table 2: Pendulum-with-stop: threshold law, knob-invariant exploitation (pinned at the stop in every episode at every knob), truth planner untouched by the mode. The mechanism does not care that the plant is nonlinear — only that the mode is hard and rare under the gate’s measure. Rarity is the fraction of 30,000 random rollouts that fire the stop (Wilson 95% CIs for every row in the versioned JSON). The sample was raised from 3000 specifically because the widest knob was a censored zero there (0/3000); at 30,000 it resolves to 0.0007 [0.0004, 0.0010], so every row is now a point estimate and every d@40 a number rather than a bound.

4.2

Two modes at once: a 4D bi-modal instrument

Both instruments so far are one hard boundary in a 2D state. PatchField2D closes both structural gaps at once — a 4D state and two distinct modes (their contact events are not independent, and Section 4.2 measures the dependence) — and asks what the 1D instruments cannot: does the danger law compose mode-wise? State (x, y, vx , vy ); a scalar action a ∈ [−amax , amax ] is mapped to a heading ϕ = π clamp(a)/amax so all planner machinery (which consumes scalar actions) is reused unchanged; semi-implicit Euler: vx′ = vx + (gain cos ϕ − drag vx ) dt,

vy′ = vy + (gain sin ϕ − drag vy ) dt,

x′ = x + vx′ dt, y ′ = y + vy′ dt. The two modes are circular sticky patches Pi = disc(ci , R): if (x′ , y ′ ) ∈ Pi the next state is (x, y, 0, 0) — the probe stops inelastically at its previous position with zero velocity (the 2D analogue of the wall clamp, and the structure the 2D mitigation exploits, Section F.1). Reward is two radial sigmoid lodes, a small real one near the start and a large phantom one behind the patches; the mode-blind planner aims straight at the phantom and freezes at a patch edge. The two knobs are the patch centers’ distances along and off the start-to-lode corridor (k1 the near patch, k2 the far one); defaults are frozen once, never tuned per cell. Table 3 sweeps the 3 × 3 knob grid (scripts/continuous patch2d.py; 600 rarity rollouts and 20 MPC episodes/arm per cell). The per-mode rarities separate cleanly (r1 ∈ [0.085, 0.245], r2 ∈ [0.0067, 0.0100]), Jblind = 0 at every cell (the blind planner freezes at a patch edge every episode; Jrand = 0.11), and play cost is knob-invariant at [1.005, 1.006] — the same below-random exploitation as the 1D instruments, now on a 4D plant. The danger law applies per mode and to the pair — but it does not factor. Proposition 1 holds for any measurable critical event, so the per-mode gate-miss factors are (1 − ri )N and the joint one is (1 − r∪ )N , where r∪ is the probability that a rollout contacts either patch (Proposition 2). We measure r∪ rather than compose it: writing the joint factor as the product (1 − r1 )N (1 − r2 )N would assume the two permode contact events are independent within a rollout, and they are not. At 600 rollouts P (both) is only 0 to 3 counts per knob, so the product’s −17% to +12% relative error across this grid is 19

not by itself evidence of anything: six of the nine cells are censored zeros, which force the product to over-estimate by construction. The dependence was therefore re-measured at 50,000 rollouts on four knobs (scripts/patch2d dependence 50k.py), where it is resolvable and does change direction: negative at (2, 6) and (3, 7), positive at (4, 6), all three with Wilson intervals excluding r1 r2 , and undecided at (4, 7). The mechanism is visible in the sign: a rollout that freezes at the near patch has spent its travel (negative), while reaching a far patch usually means passing the near one (positive). Both columns are in the versioned JSON (d40 joint and d40 joint indep approx); the table reports the measured one. Three qualifications: the r2 knob is only weakly resolved at 600 rollouts (its trend is under-resolved, not flat), the k1 =4 one-hit bump in r2 is sampling noise rather than a knob effect, and the four-decimal d@40 figures in the P2 and joint columns inherit that resolution — at 4 to 6 hits in 600 the interval on d@40 P2 = 0.7700 is [0.51, 0.91], so those digits are bookkeeping, not precision. k1

k2

r1

r2

r∪

Jtruth

play cost

d@40 P1

d@40 P2

d@40 joint

2 2 2 3 3 3 4 4 4

6 7 8 6 7 8 6 7 8

0.245 0.245 0.245 0.142 0.142 0.142 0.088 0.088 0.085

0.010 0.008 0.007 0.008 0.008 0.007 0.008 0.010 0.008

0.252 0.253 0.252 0.150 0.150 0.148 0.092 0.095 0.093

17.98 18.02 18.08 18.57 18.47 17.72 20.85 19.52 19.08

1.006 1.006 1.006 1.006 1.006 1.006 1.005 1.006 1.006

1.3×10−5 1.3×10−5 1.3×10−5 0.002 0.002 0.002 0.025 0.025 0.029

0.673 0.720 0.770 0.720 0.720 0.770 0.719 0.673 0.720

9.3×10−6 8.5×10−6 9.3×10−6 0.002 0.002 0.002 0.021 0.019 0.020

Table 3: PatchField2D mechanism sweep (3 × 3 knobs; 600 rarity rollouts, 20 MPC episodes/arm; Jblind = 0, Jrand = 0.11 at every cell). d@40 Pi = play cost · (1 − ri )40 (per-mode danger); r∪ = measured probability that a rollout contacts either patch; d@40 joint = play cost · (1 − r∪ )40 , the danger law at the joint critical event — not the product ((1 − r1 )(1 − r2 ))40 , which would assume within-rollout independence and errs by −17% to +12% here. Full table (with Jblind , Jrand , hit rates) in docs/EXPERIMENTS.md.

Play cost is planner-dependent — measured on two families, one configuration each — and the bound says which direction is forced. Proposition 8 bounds play cost by the planner’s query-hit probability on the disagreement region, so low query reach forces low play cost while high reach merely permits high cost. A second base planner family (the cross-entropy method, one fixed configuration) sits at the low-reach end on all eleven knobs of both 1D instruments and on PatchField2D, with play cost statistically indistinguishable from zero and imagined boundarycrossing strictly below random-shooting MPC’s. Limited reach is not knowledge, and the same search that misses phantom reward can miss real reward; the rows, the censoring of the two zerocrossing cells and the caveats are in Section E.

5

Axis separation: which errors the gate catches at ε = 10−2 , and which it misses

The classic continuous-model failure axis is pervasive sub-tolerance error; the danger law’s axis is a localized hard mode. A tolerance gate must be shown to fail only on the second axis, and only at the (1 − r)N rate. 20

What fixes ε, and why the axis separation does not depend on it. We use ε = 10−2 as a representative tolerance, not a deployment-derived one: these are deterministic simulators with no sensor noise and float64 arithmetic, so there is no physical error budget to read it off. What the value does is sit in the middle of the only two scales the instrument supplies — three orders of magnitude above the integrator’s float noise (∼ 10−16 , and 10−9 is where the pinned-integrator gate of Section 7 runs), and between two and three orders below the mode’s own disagreement (4.2 on the cart) — while amounting to about 0.06% of the 18-unit position span between the two reward plateaus and 0.1% of the reachable speed range. The claim that matters is that the choice is immaterial: the ε-sweep below varies it over eight orders of magnitude, 10−9 to 0.3, and the axis separation is unchanged throughout. Likewise N = 40 is inherited from the companion paper’s sweep so the two studies’ counts are comparable; it is not derived from a verification cost model, and the tables report d@N at N ∈ {20, 40, 80} so the threshold’s dependence on it is visible rather than assumed away. Five arms, one table (scripts/continuous axes.py; reveal-rarity = P(a random rollout contains a transition where truth and model differ > ε), 20,000 rollouts; pass@40 over 300 independent N =40 gates; 20 MPC episodes/arm). For the hard mode, the mode-firing rarity of Tables 1–2 and the reveal-rarity here coincide as events — the mode error exceeds every ε in the swept range (the ε-sweep below), so a rollout fires the mode iff it reveals a disagreement — which licenses the shared symbol r.1 arm wall@4 omitted wall@8 omitted drag bias ×1.03 (sub-ε) drag bias ×2.0 (supra-ε) C ∞ bump@4, amp 0.5 C ∞ bump@4, amp 1.0

reveal-rarity

(1 − r)40

pass@40 measured

play cost

d@40

0.1351 0.0103 0.0001 1.0000 0.1829 0.2018

0.0030 0.6622 0.9940 < 10−4 0.0003 0.0001

0.003 0.667 0.997 < 0.013 < 0.013 < 0.013

1.031 1.030 0 (exact) 0 (exact) 0 (exact) −0.745

0.0031 0.6821 0 (exact) 0 (exact) 0 (exact) −0.0001

Table 4: Axis separation at ε = 0.01, N = 40; d@N = play cost · (1 − r)N , as in Table 1. Danger lives in one quadrant only: rare ∧ hard-mode. Reveal-rarity is measured on 20,000 rollouts (raised from 2000 because the sub-ε arm was a censored zero there): it now resolves to 0.0001, and its predicted pass rate 0.9940 sits inside the measured [0.9814, 0.9994] instead of above it. Readings (Table 4, rendered as the danger quadrant in Figure 4): gate exactness at gate scale — measured pass@40 matches (1 − r)40 in both wall rows — 0.003 vs 0.0030 and 0.667 vs 0.6622, each prediction inside the 300-gate Wilson interval. Two bookkeeping points matter for reading any of these agreements. First, r̂ carries its own error, and the prediction (1−r̂)40 inherits it: propagating the rarity’s Wilson interval, the 20,000-rollout reveal-rarity 0.01025 [0.00895, 0.01174] predicts a pass rate in [0.623, 0.698], which contains the measured 0.667; on 2000 rollouts, r̂ = 0.0125 [0.0085, 0.0184] predicts [0.476, 0.711], comfortably containing 0.667. A point prediction like 0.6046 compared against the measurement’s interval, while its own interval goes unquoted, would misread that cell as a marginal failure; the propagated comparison is the valid one. Second, this instrument has two rarity estimates for what Proposition 10 says is one event: 0.01140 from the 30,000-rollout mode-firing sweep of Table 1 (predicting 0.631) and 0.01025 from the 20,000-rollout reveal-rarity here (predicting 0.662). Their intervals overlap and the proposition says the events coincide below ε⋆ , so this is sampling noise and not a contradiction — but the 10% relative gap is larger than 1 With both samples raised, the two estimates of the same event now agree to the third decimal: mode-firing rarity 0.1352 on 30,000 rollouts (Table 1) against reveal-rarity 0.1351 on 20,000 (Table 4). At smaller samples they read 0.1430 and 0.1385; the gap was resampling noise.

21

play_cost (normalized regret)

Axis separation: danger is the top-right product wall@4

1.00

wall@8

0.75 0.50 0.25 0.00 0.25

bias x2.0 (supra-eps) 10 149

bias x1.03 (sub-eps)

bump@4 amp0.5

0.50 bump@4 amp1.0

0.75 10 4

10 3

10 2

gate-miss probability (1

10 1

100

r)40 (log; floored at 10 4)

Figure 4: Table 4 as the danger quadrant: gate-miss probability (log) vs play cost. Only the rare hard mode reaches the top right; danger is the product of the coordinates. Horizontal bars propagate each arm’s rarity interval through (1 − r)40 ; the play cost axis carries a paired interval where perepisode returns exist and no bar where the arms are bit-identical, since there the difference is exactly zero rather than uncertain. either interval’s half-width suggests one should ignore, and we quote the reveal-rarity throughout this table and the firing rarity throughout Table 1 rather than mixing them. The proposition is the observed acceptance rate, not asymptotic decoration. The gate polices the pervasive axis: a global drag bias above tolerance is revealed on every rollout and never accepted; a sub-tolerance bias is accepted at 0.997 — which the law now predicts rather than excuses: that arm does reveal a disagreement on a thin slice of rollouts (reveal-rarity 0.0001, the extreme velocity tail), for a predicted pass rate of 0.9940 — and it is harmless at play. Verified-and-fine is a real cell, and the gate finds it. Smoothness kills consequence, not detectability: the C ∞ drag bump at the wall’s location has comparable rarity to the wall (0.18 vs 0.14 — it is just as detectable, confirming Proposition 9 is about error geometry, not about hiding from the gate, and matching the direction of Proposition 16) yet play cost 0.000 at amplitude 0.5. At amplitude 1.0 play cost turns negative (−0.745): the truth planner, seeing the slowdown near its horizon edge, is over-pessimistic and often settles for the small plateau, while the bump-blind planner pushes through and wins. A smooth localized omission produces planner-side timing effects of ambiguous sign; only the hard mode produces the one-way exploitation geometry (pinned, forever, below random). On the three instruments and the swept grid, the separation does not depend on the tolerance. A sweep over ε ∈ {10−9 , . . . , 0.3} leaves the mode arms’ reveal-rarity flat on all three instruments while the pervasive-bias arms switch sharply at their own error scale, and pass@40 ≈ (1 − r)40 continues to hold for the mode arms at every ε in the grid (Section I). The gate’s ε is a pervasive-error dial, not a mode-detection dial: tightening it cannot catch the hard mode, and loosening it does not widen the hole.

22

6

The exploitation is planner-mediated: a distrust-region fence collapses it on the 1D instruments

The exploitation measured above is planner-mediated rather than model-mediated, and a plannerside fix collapses it without touching the model or the gate — which does not contradict the danger law, since the gate still accepts a wrong model and Proposition 5 is untouched. Distrustregion replanning fences the positions of the model’s refuted predictions and truncates any imagined trajectory that crosses a fence. On the two 1D instruments a single contact suffices to fence the mode on all eleven knob rows — a separation fact rather than a covering one, with a measured range of validity — and the mitigation is bit-identical to plain MPC when the model is right. On a 2D circular mode it degrades and, at the farthest knob, fails outright in 7 of 20 episodes, because its tie-break is an unsigned distance. The design, the packing bound on its contact cost, the dimensional reading of that bound and the 2D failure are in Section F.

7

LLM synthesis: on the 1D clamps the danger reduces to the identifiability event

Real-LLM arms (scripts/continuous danger synthesis.py; Azure GPT-5.x mini and large2 ; N = 40 training rollouts which double as the gate, as in the companion paper’s sweep; ε = 10−9 pinned-integrator gate; 20 seeds/cell on the headline xwall = 8 cell, both sizes (the companion paper’s standard); 6 MPC play episodes/seed; per-seed JSON with the synthesized code versioned in the repository). The contract pins the integrator (Section 2.1’s equations, stated in the spec text, constants generated from the environment instance so they cannot drift); the full arm includes the wall clause, the incomplete arm omits it. Crucially, each seed logs whether the wall fired in its training sample — the identifiability event that the companion paper could not condition on post hoc. One design fact governs every pooled count in this paper. The gate sample of seed index i is drawn with rollout seed 104 (i+1) independently of which model is being run (scripts/continuous danger synthesis.py), so at every instrument and knob the mini and large arms are synthesized from the same samples. Pooling the two sizes therefore doubles the number of synthesis draws, not the number of independent gate samples: a pooled k/2n is n shared samples with two model draws each. Two consequences we hold to throughout. (i) Any empirical check of the gate-miss rate (1 − r)N is a per-size statement — the mode-absent/present split is a property of the sample, so it is identical across sizes by construction and cannot be pooled at all. (ii) For the conditional outcomes (blind-and-exploited, repaired), pooling across sizes is meaningful because the synthesis draw is independent, but a Wilson interval over the pooled count assumes independence the samples do not have; we therefore quote the per-size bound as the conservative one and mark pooled bounds as such wherever they appear. On the two headline cells the shared-sample constraint is removed, not caveated. A --seed-offset run shifts the sample block (rollout seed = 104 (i+1+offset)), so re-running the large arm at offset 20 gives it a block disjoint from mini’s. The headline cart cell and the headline 2

Exact models. “large” is the Azure OpenAI deployment gpt-5.4 and “mini” is gpt-5.4-mini, both at API version 2025-04-01-preview; the cross-family arms are Qwen/Qwen3-Coder-30B-A3B-Instruct (Hugging Face Inference Providers router) and Claude Sonnet (agent-relayed, Section 7). Every result JSON under results/ records its own model field, so each number is attributable to a named deployment; the runs are dated 2026-07-07 to 2026-07-20 in the repository history. We write “GPT-5.x” in prose where the claim holds for both sizes.

23

pendulum knob therefore have three arms: mini on block S0 , large on S0 (same samples, different model) and large on S20 (different samples, same model) — two orthogonal replications instead of one. Pooling mini@S0 with large@S20 is then a pool of independent samples, and the Wilson interval over it is legitimate. Every bound below labelled “disjoint” is of that kind; the per-size bound is still reported for the cells where only shared blocks exist (the pendulum caught knob, PatchField2D, the ablations). Full arm (both sizes, 40 seeds): gate 1.000 in 0 refinement iterations, wall probes exact, play at truth parity — every seed. The pinned-integrator premise holds with a real LLM: correct synthesis is float-exact through the sandbox, so ε = 10−9 costs nothing and the tolerance axis is fully disarmed. As in the discrete setting, given the rule, the model translates it perfectly. Incomplete arm.

Three-way structure:

1. Wall absent from the sample (the (1 − r)N event; 10/20 seeds at xwall = 8 for each size, consistent with (1 − 0.0114)40 ≈ 0.63): every such seed — 20/20 across mini and large — passed the gate at 1.000, fully wall-blind on the probes, and was exploited at play: pinned at the wall, contact rate 1.0, play cost 0.999. Because --seed-offset 20 supplied the large arm with a sample block disjoint from mini’s, the two together are 20/20 over 20 distinct gate-sample blocks — a bound at the right unit rather than over draws that share evidence: exact (Clopper–Pearson) 95% lower bound 0.832, Wilson 0.839. The two arms differ in both block and model size, so the interval covers the mixture rate rather than either arm’s; per arm it is 10/10 blocks, exact lower bound 0.692. The third arm (large on S0 , the same 10 samples mini saw) reproduces the conditional model-for-model, 10/10. The gate-miss rate is now poolable too: 20/40 of the independent samples lacked the mode against the predicted 0.6046 (Wilson [0.35, 0.65]). This is the discrete headline, synthesized end-to-end in a continuous CWM: a verified model, exact outside the mode region, that performs worse than random. 2. Wall present, repaired: the LLM does not stay blind. It reads the failing transitions and writes the true global rule — if x2 >= 8.0: return [8.0, 0.0] (or the equivalent if x2 > 8.0: x2 = 8.0) — not a curve fit. At 20 seeds both sizes repaired every wallpresent seed: large 10/10 in 0–1 iterations (two from the synthesis examples alone), mini 10/10 in 0–5 iterations. This is the divergence from the discrete setting, where rules demonstrated by example transitions were persistently not learned (translation-not-inference). A numerically-manifested discontinuity is learnable from data in a way a symbolic game rule was not. 3. Wall present, not repaired: at 20 seeds on the headline cell GPT-5.x produced no stalls, but stalls are real where they occur (the 5-seed xwall = 4 cell; the Qwen cross-family arm below). They are not near-misses of the rule but superstitious local patches: e.g. if abs(x2 - 4.0) <= 0.15 and abs(v2) <= 2.5: x2 = 4.0; v2 = 0.0 (verbatim from the xwall = 4 cell, mini seed 20000, gate 0.974), or Qwen’s if x2 >= 8.0 and v2 <= 0.0: ... — clamps fitted to the observed manifestation of the mode (low-speed, near-wall contacts), which mispredict other approaches to the wall. The gate rejected every one of them (gate 0.49–0.999, never 1.000). Two other model families. Spot-checks in two further families (Qwen via an open-router deployment, and Claude relayed through an agent scaffold with byte-identical pipeline messages;

24

3 seeds plus a control per instrument, so small-n) separate the two halves of the result cleanly. The mode-absent blind-and-exploited event fires in every family, as Proposition 5 requires of a property of the sample. Repair-from-data instead differs in mechanism: GPT-5.x recovers almost every revealed clamp exactly, Qwen recovers none and the gate refuses its superstitious patches, and Claude recovers most through a symmetry prior that generalizes one-sided evidence into a symmetric pair of boundaries — which produces a fourth artifact class the trichotomy does not cover: an artifact accepted at gate 1.000 while carrying an invented mode its own sample cannot refute. That is Proposition 5’s prior caveat measured directly, and it is why the paper’s off-sample regularity is stated as measured rather than proved. Section K gives the arms, the artifact and the relay caveats. Second-instrument robustness (pendulum-with-stop, Section 4.1, 20 seeds/cell, both sizes). The synthesis arm is not cart-only. Running the identical pipeline on the nonlinear pendulum — headline θstop = 1.4 (rarity 0.019) and caught θstop = 1.0 (rarity 0.128; “caught” labels a cell whose mode is common enough that the gate sample essentially always contains it, so the identifiability event essentially never fires) — reproduces every branch, including a 3-seed Qwen cross-family spot-check at the headline knob (Table 5). cell (20 seeds each)

full

absent → blind & exploited

present → repaired (stalled)

mini θstop = 1.4 large θstop = 1.4 mini θstop = 1.0 large θstop = 1.0 Qwen θstop = 1.4 (3 seeds)

20/20 20/20 20/20 20/20 3/3

9 → 9 (pc 0.995) 9 → 9 (pc 0.995) 0→— 0→— 1 → 1 (pc 0.995)

11 → 11 (0) 11 → 11 (0) 20 → 20 (0) 20 → 20 (0) 2 → 0 (2 stalled @0.9997)

Table 5: Pendulum synthesis cells (20 seeds/cell, both GPT-5.x sizes; 3-seed Qwen spot-check at θstop = 1.4). k → m = of the k seeds in that branch, m had the stated outcome (blind & exploited, resp. repaired); the parenthetical count is stalled seeds; pc = play cost. Pooled across both knobs and both sizes (Table 5), every mode-absent occurrence was blind and exploited at play cost 0.995 (headline knob, disjoint blocks: 15/15 distinct blocks, exact 95% lower bound 0.782, Wilson 0.796; the same-sample pair mini/large@S0 adds 9/9 draws each, which are not extra blocks) — the same fixed-point exploitation as the cart’s play cost ≈ 1 — and GPT-5.x passed the repair criterion on 62/62 mode-present seeds, with no stalls, writing the exact angular clamp (verbatim at the headline knob: if th2 >= 1.4: return [1.4, 0.0]) in 58 of them; the other four write that clamp and a phantom stop on the negative side, which the mode probe cannot see (Section 7.1) — counting those four as non-repairs, as Section 7.1 does, 30 of 34 distinct blocks are repaired on every attempt, exact 95% interval [0.725, 0.967]; the per-size, per-knob cells are 11/11 and 20/20 draws by the probe criterion. Qwen reproduces the mode-absent blind-exploited event but stalls on both its mode-present seeds, the same superstitious-patch signature as on the cart; Claude’s agent-relayed spot-check on this instrument produced the phantom-mode artifact discussed in Section 7 (an accepted artifact carrying a stop at θ = −1.4 its sample never reaches, plus a stall at the other mode-present seed). Repair is model-dependent; identifiability, being a property of the sample, is not — on this instrument too. The mechanism was already validated on two instruments (Section 4.1); the synthesis result now is as well: a nonlinear plant with an angular, not positional, hard stop reproduces the same danger law and the same repair capability, so the repair finding is not a cart artifact.

25

7.1

Repair does not transfer to a 2D region mode: 0/156 across the treatments run

Everything above — and the (b)-residual-vanishes claim of the Introduction — was measured on one-dimensional hard boundaries: a position clamp (cart) and an angular clamp (pendulum), on which GPT-5.x recovered the rule in 105 of 111 mode-revealing synthesis draws. Two aspects of the criterion govern how that count may be read, and both tighten it. First, the criterion. The paper’s repair test is a gate pass plus a mode blindness probe score of 0, and that probe fires only where the truth’s mode is active — so it cannot see an artifact that invents a mode elsewhere. Re-testing every artifact the probe calls repaired against the truth on a dense state–action grid (scripts/repair exactness 1d.py) finds four that are not exact: all four write the correct angular clamp and a second, phantom stop on the negative side — one at the symmetric −1.4, three at −2.0, which is where the left reward plateau sits. Two are gpt-5.4-mini and two are gpt-5.4, so the invented-mode class the paper attributes to the Claude arm is not family-specific; it appears in the main arms of both GPT-5.x sizes, at a rate of 4 of 109. Those four are counted as non-repairs here. Second, the unit. The draws are not independent trials: the gate sample’s random stream depends on the seed index and offset alone — not on the instrument, the knob, the patch shape or the prompt variant — so those 111 draws sit over 36 distinct gate-sample blocks (22 on the cart, 34 on the pendulum, some shared), and varying a knob adds a treatment rather than a sample (scripts/ sample stream census.py, scripts/paper2 statistics.py). The primary inference unit is the instrument–stream block — one stream pushed through one instrument’s dynamics is one sample, and two instruments sharing a stream are dependent only through common random numbers — and at that unit every attempt is exact on 50 of 56 blocks, exact 95% interval [0.781, 0.960]. Clustered all the way down to the raw stream, the strictest possible unit, 30 of 36 blocks are repaired on every attempt, an exact 95% interval of [0.672, 0.936]. Resolved the other way, by knob, the census is 64 of 70 knob-level block cells — a block sampled at two knobs contributes two cells, so those are treatment cells, not additional samples. The cart is unaffected by the first correction: all 33 of its repairs are exact on the grid, as its mode is a half-line with no far side to over-cover. Per instrument, the corrected criterion leaves the two alike in rate and different in kind: the pendulum is 30/34 blocks all-repair (exact 95% interval [0.725, 0.967]; its four exceptions are the four phantom-stop blocks — over-coverage the probe accepted), while the cart is 20/22 — both its exceptions are superstitious local patches the gate rejected, and one of them is the only mode-present draw its block ever produced — giving an exact lower bound of 0.708 for all-repair, or 0.772 for the weaker estimand “some attempt on a fresh sample repairs”. Both cart exceptions live in the 5-seed xwall = 4 cell. PatchField2D asks whether that repair survives a genuinely 2D mode — a circular boundary (x′ − cx )2 + (y ′ − cy )2 ≤ R2 — and whether an artifact can repair one patch while staying blind to the other (partial repair, which the design predicted and per-mode blindness makes measurable). We ran the identical pipeline (Azure GPT-5.x mini and large, 20 seeds/cell, N = 40, ε = 10−9 ) on two bi-knob cells, k = (3, 7) and k = (5, 9), classifying each seed by which modes its training sample contained {miss both, see one miss the other, see both}. The full arm is clean (20/20 per cell, both sizes). The instrument was built to detect partial repair; none occurred in its 66 draws. Across the 66 see-one-miss-the-other seeds (64 see-P1 -miss-P2 plus 2 miss-P1 -see-P2 ; a complete census of this branch over 20 raw seed blocks, not a sampled estimate), zero produced a partialrepair certificate — not one artifact repaired the seen patch and stayed blind to the unseen one while passing the gate. More strongly, of the 76 incomplete-arm seeds whose sample contained at 26

least one mode, 0/76 recovered the circular disc rule at all. What the artifacts do instead. A code inspection of all 76 artifacts, confirmed by an independent behavioural audit that probes each step() on a state grid, locates the failure: plant translation succeeds in ≈74/76, and what collapses is induction of the region. The dominant class is dimensional reduction — the disc written as a half-plane at the right location and the wrong shape (38/76 by source, 39/76 by behaviour) — with pure-blind, superstitious local patch and failed-disc classes making up the rest, and no artifact encoding its seen patch even where one was seen. The ε-exactness alternative is falsified: no correct-form disc failed on arithmetic. Two ablations then exclude two candidate mechanisms. A guided treatment at 3× budget removes the half-plane entirely and yields bounded 2D regions instead — ellipses, rectangles, unions of microdiscs — fitted to the hull of the observed freeze positions and, in 36/40 artifacts, conditioned on the current rather than the landing position; none is the true disc. An axis-aligned square with flat edges is not repaired either, and fails with the errors reflected : discs written on square evidence. A third family reproduces the same template set. Section L gives the full audit, the three ablations and the per-iteration ledger. In these campaigns certification was all-or-nothing: no partial artifact was accepted. Certification occurred iff the sample missed all modes: the only certified incomplete artifacts were the 4/80 miss-both seeds (2 per size at k = (5, 9)), blind on both patches and exploited at play cost 1.095, contact rate 1.0 — the doubly-blind fixed point, at the joint-miss event of probability (1 − r∪ )N (Section 4.2: measured for the pair, not factored). Every see-one-miss-theother artifact was rejected, not certified: the all-or-nothing gate refused every partial artifact rather than certifying a half-repair. The gate was therefore sample-consistent throughout, in the only sense it can be: no accepted artifact contradicted a transition of the sample it was scored on. That is the acceptance criterion restated, not a guarantee about the artifact. Two cautions on reading the failing gates: a high near-miss score (e.g. 0.9997) reflects the rarity of a mode contact in a short rollout, not a near-repair, so more refinement iterations would not populate a partial-repair branch that does not exist; and the mini/large partitions are seed-identical by construction (shared seeds — the design fact of Section 7, which holds at every instrument, not only here), so the two sizes are not independent replications. What the collapse is about, after eight ablations. On the 1D clamps the discrete paper’s (b)-residual all but vanished for GPT-5.x; on the 2D regions it returns in every treatment we ran. Six candidate causes are measured negatives: it is not boundary curvature (the axis-aligned square with flat edges fails identically, with the errors reflected — discs written on square evidence), not the tested prompting and budget (one region-first prompt at 3× budget fails, in a different class — other prompts, longer contexts, refinement with memory or an explicit fitting tool remain untried), not identification of the variable the trigger reads, not the censoring of the region’s interior itself — the mechanism Proposition 7 makes the natural candidate — which two further campaigns lift without restoring repair, and not — the one prediction in the 2D program written down before its test — the angular coverage of the contacts, raised until a three-line least-squares fit recovers the region on every sample while the synthesizer still recovers it on none (all in Section 9). A seventh candidate, the trigger’s arity in the sense of Definition 1, is the one the instrument cannot rule on: the slab built to lower it has a target identified only up to Proposition 7’s class, so that intervention excludes nothing and is recorded rather than counted.

27

What the campaigns establish about the evidence is a separate and narrower thing. Proposition 7 shows that the mode’s freeze semantics keep every visited state outside the region, so a sample witnesses only entries; whether that pins the rule then depends on whether a rollout can reach the region’s far side, which is measurable in advance and differs across these instruments. On the disc it can, so the rule is identified there — relative to the circle class and tolerance of Proposition 6, in the block counts measured in Section 9 — and the failure is a genuine one of induction: what the artifacts write instead is drawn from a small library of low-complexity forms — a 1D threshold, a radial ball, a reward-landmark zone, the hull or the bounding box of the observed contacts — and the gate refuses each in turn. That library is the template prior, and after eight interventions and two positive controls it is the description that survives: each intervention removes a candidate cause and the failure stays. What interventions on the instrument cannot do is single out a mechanism inside the model — an inability to carry out an algebraic fit over textually presented transitions, a memoryless refinement loop, and the absence of any system-identification objective in the prompt are all compatible with every campaign here, and we do not claim to distinguish among them. Removing curvature, budget, arity, variable ambiguity and the interior’s censoring each leaves the failure in place — the last while supplying eleven times more mode evidence and, separately, an easier rule — and the controls locate what is missing exactly: given the region’s form and its location the synthesizer infers the remaining constant to float precision in 20 of 20 seeds, while a plain least-squares circle fit recovers both constants from the same evidence on 12 of 20 samples and the synthesizer given only the form recovers none (Section 9). Raising the evidence’s angular coverage until the fit succeeds on all 20 leaves the synthesizer at none of 20, which is what makes the prior a disposition rather than a weight. What is not induced is a located rule: the form alone does not rescue the failure, the form and its location together do. Two readings this does not support. It is not that the synthesizer cannot represent a region: told the rule, it writes the disc, the square, the slab and the boundary projection at gate 1.000 in zero refinement iterations, in every arm and both sizes. And it is not simply that more evidence would suffice — the interior-witnessing campaigns supply more and it does not help — though on an instrument whose far side is unreachable no sample at any size distinguishes the truth from an entry rule, and there the larger model reliably writes the latter (Section 9). What does not change across any of this is the provable core: identifiability and the gate-miss law hold verbatim, no accepted artifact contradicted its acceptance sample, and the joint-miss event remains where the law’s exact factor lives; the estimand DN itself also collects whatever every other accepted artifact costs — the invented-stop class of Section 7 included — which the per-campaign accepted-cost means report rather than the law absorbing.

8

An independent acceptance sample

Every arm above scores the artifact on the sample it was synthesized and refined against. That is the protocol the companion paper used and the one deployed pipelines use, and it is a sampleconsistency gate: passing it means agreeing with the data the artifact has already seen. Proposition 4 says what changes when the acceptance sample is drawn independently, under two hypotheses. Both are testable on the artifacts we already have, because every synthesized program is versioned with its cell: for each of the 1034 committed artifacts we reproduce its training block Dtr , draw two further blocks disjoint from it and from each other — an acceptance sample Dg of the same size (Ng = 40 rollouts) and an evaluation sample Deval of 100 — and re-score the artifact on both without any refinement (scripts/heldout gate audit.py, scripts/heldout gate paper numbers.py). Refine on Dtr , accept on Dg , classify on Deval is the prospective protocol;

28

evaluating it after the fact costs no LLM calls and changes nothing about its validity. Two validity checks come first: the three blocks are verified disjoint at the level of individual rollout seeds, and re-scoring an artifact on its reproduced training block returns the accuracy the original run stored in 102 of 102 spot-checks, which is what establishes that the reconstruction is the original sample. Both hypotheses hold where they were tested, so the exponents add there. Hypothesis (ii) — a mode-blind artifact fails the acceptance sample exactly when that sample contains a mode contact — is nearly structural for a program with an omitted branch, and it is exact in the data: over the 60 mode-blind artifacts synthesized from a mode-free training block, held-out acceptance and a mode-free acceptance sample coincide in every case (25 accepted with the mode absent from Dg , 35 rejected with it present, no off-diagonal cell). Hypothesis (i) — a mode-free training block yields a mode-blind artifact — is the genuine empirical premise, and on the cart’s headline cell it holds for 30 of 30 draws. That check is cell-local, and extending it across the audited arms strengthens it: every one of the 60 incomplete-arm draws whose training block misses the mode is probe-blind, so (i) has no known violation among the 1034 API-arm artifacts, and the nearest counterexample to a global reading is the agent-relayed Claude artifact — which carried an invented mode, and sits outside these arms. The four GPT phantom stops of Section 7 are not violations of (i): their training blocks contain the true mode (one contact transition each), and what they bound is a different claim — the reach of evaluation-sample exactness — taken up below. With both in place the proposition’s prediction is a statement about the sample alone, so its unit is the distinct block: at r = 0.0114 the two-factor prediction is (1 − r)80 = 0.399 against a measured 10/40 = 0.250 over the 40 distinct blocks, 95% interval [0.142, 0.402]; the one-factor rate the earlier sections check is (1−r)40 = 0.631 against 20/40 = 0.500, interval [0.352, 0.648]. Both predictions sit inside their intervals. Note the scope of what the second exponent buys: it halves the probability of the law’s central event — a blind artifact from a mode-free training block surviving to deployment — and at fixed total budget Ntr + Ng that one exponent is unchanged. It is a statement about that exponent alone (Proposition 4): it does not price synthesis quality, total risk, or compute under a redistributed budget. The sample-consistency gate accepts artifacts an independent gate rejects. Of the 650 draws that reached 1.000 on their own sample, 40 are rejected by an independent acceptance sample of the same size — 6.2% of draws, spanning 25 distinct rollout-seed blocks. We report these as counts and attach no binomial interval: the draws share rollout-seed blocks across campaigns and treatments, so they are not independent trials from any population such an interval would describe. All 40 are incomplete-arm artifacts, the full arm regressing on none of its own; 3 draws move the other way — below 1.000 in-sample (at 0.9975 to 0.9991) yet accepted by the independent sample — which is why 650 − 40 leaves 613 accepted rather than 610. The failures are located where the law says they must be: 39 of the 40 fail only on mode contacts and are off-mode exact, and the one exception is one of the four phantom-stop artifacts of Section 7, rejected exactly where its invented stop fires (11 off-mode failing transitions on Dg ). So a 1.000 score on the training sample is worth what Proposition 5 says it is worth and no more, and the quantity it overstates is measurable: about one accepted draw in sixteen here. What acceptance does buy, measured rather than inspected. The paper’s off-sample regularity is a measurement, not a code-inspected observation: of the 613 draws an independent gate accepts, all 613 are exact outside the mode region on the further independent 100-rollout evaluation sample — every failing transition of Deval , where there is one, is a mode contact. Two scope

29

limits belong beside the number. The draws share seed blocks, so no binomial bound is attached to 613/613; and exactness on Deval is exactness under the evaluation distribution, not a global property of the artifact — an accepted artifact carrying an invented mode in a region that distribution rarely visits would pass this check, and the pendulum’s phantom stops (Section 7) are exactly that shape. This is the sense in which “verified but wrong” is precise here: acceptance establishes exactness away from the mode on samples it never saw, drawn from the same distribution, and says nothing about the mode or about regions those samples rarely reach. The limit an independent gate does not remove. One limit belongs beside the result, and it is not a matter of sample size. Proposition 7 exhibits a class of models that agree with the truth on every transition of every rollout — the mode’s freeze semantics remove the evidence that would separate a membership rule from an entry rule — and a synthesized artifact in that class is accepted here at ε = 10−9 by its own sample, by an independent acceptance sample and by a 100-rollout evaluation sample alike (Section 9). An independent gate makes acceptance mean what it says about the sampled inputs; it does not make it mean more than that. What saves this particular class is not the gate but Proposition 7(iii): its members are wrong only strictly inside a region no planner rolling them forward can reach, so the play cost is zero by the same argument that makes them unfalsifiable. Two further scope notes. The re-scoring covers the 1034 API-arm artifacts; the agent-relayed Claude cells are not in it, so Claude’s phantom-mode artifact is not among the 613. The 613 do, however, contain known-wrong members of the same class, and they make the evaluation-exactness limit concrete. Of the four GPT phantom-stop artifacts (Section 7) — true mode repaired, an invented second stop where their samples are silent — three are accepted by the independent gate and score 1.000 on Deval , because no evaluation rollout happens to enter the invented stop’s region, while the behavioural audit’s state–action grid shows all four wrong there (131 to 280 mismatched grid points each); the fourth drew gate and evaluation samples that do visit the region and is rejected (13 off-mode failures on Deval ). Chance decided which one of the four was caught. That is Proposition 5 operating on the checks themselves: acceptance and evaluation read the artifact only at sampled inputs, so what convicts the other three is the grid, not any rollout. And an independent gate is not a solution to the problem this paper is about: it makes acceptance mean what it says, but the mode still has to appear in some sample, and Proposition 4’s exponent Ntr + Ng is the same N the danger law always had.

9

What the 2D collapse is about: eight interventions, two controls, and a target that is sometimes not identifiable

Section 7.1 reported that no artifact recovered the 2D region rule and that the artifacts are consistent with a low-complexity template prior, a mechanism that design does not isolate. Two further campaigns hold most of the confound fixed and vary one thing each. Both were run after the finding they respond to (Section Q); the first answers a different question from the one it was built to pose, and is reported against the question it does answer. Whether the evidence identifies the rule — relative to a stated class and tolerance — is a property of the instrument, computable in advance. Proposition 7 says a sample witnesses only entries into the mode. Whether that suffices to pin the rule depends on one further question: can a rollout reach the region’s far side? Measured over 2000 rollouts per instrument (scripts/mode identifiability.py), the answer separates the instruments the paper compares. 30

On the disc the mover goes around the patch — the patches are bounded in y — and reaches x = 14.11, with 4695 visited states east of the near patch’s far edge; the square likewise (3757). So on those instruments the gate distribution reaches the region’s far side — a population fact, and no more. Three claims must be kept apart. Population support: the distribution constrains the region from more than one side, which is what the 2000-rollout measurement establishes; it says nothing about a particular finite sample. Recovery by a specified estimator: the three-line least-squares circle fit lands within 0.1 of both constants on 12/20 baseline samples and 20/20 at the dose’s 185◦ coverage. This is an existence result, not uniqueness. Finite-sample identification relative to a specified class: Proposition 6’s version-space certificate proves that every consistent circle lies within the same tolerance on 6/20 baseline samples and 18/20 widest-dose samples. It excludes half-planes in 20/20 at both doses and boxes in 19/20 and 20/20, but the hull of the observed contacts remains consistent in every block; therefore the finite evidence does not identify a unique arbitrary region or the entire artifact template library. The induction failure can be charged against estimator-level recoverability in all 20 widest-dose blocks, and against universal circle-class identification in 18 of them; both statements are reported because they answer different questions. A slab, being unbounded in y, is the instrument that separates the two integers Remark 1 keeps apart, and it cannot be circumvented: the furthest position reached is x = 5.00, exactly its near face, and no state east of it is ever visited. Its rule is therefore identified only up to Proposition 7’s equivalence class, and “recover the true rule” is not a well-posed target there. Eight interventions, and what each shows did not suffice. Each is aimed at one candidate explanation; none is single-variable in the strict sense — the guided treatment also changes the example count and the budget, the post-state variants also change dwell time and the amount of mode evidence, the dose also changes the start distribution and the rollout count (held to the same contact count by calibration) — and the changes each induces beyond its target are stated with its campaign (Section M; the full per-intervention matrix — target hypothesis, co-changes, prediction status, unit, control, licensed and unlicensed inference — is versioned in results/h6 exclusion matrix v1.json). All were run after the finding they respond to (Section Q), and none restores repair. Table 6 is the ledger; Section M gives each campaign, its admissibility check and its artifacts. Two positive controls bracket the frontier: the constants follow from form and location; nothing follows from the form alone. Every result above is a negative, and a negative is worth what the guarantee that its target is learnable is worth. Two controls supply that guarantee, one from inside the pipeline and one from outside. Inside: replace the incomplete arm’s missing clause with a partial one that states the rule’s form and its effect while withholding constants (--mode-hint; the withheld constants appear nowhere in the text, asserted rather than assumed). Two levels, 20 seeds each on gpt-5.4, and they separate completely. • Given the form and the centres, with only the radius withheld — one unknown scalar — the synthesizer infers it exactly in 20 of 20 seeds. Every artifact agrees with the truth at IoU = 1.000 and on all 9020 points of the state–action grid, and all 20 are accepted by an independent gate and an independent 100-rollout evaluation at ε = 10−9 ; one writes the comment “radius inferred from the provided transitions”. Four of the twenty need no refinement iteration at all. • Given the form alone, with the centres and the radius withheld, it recovers 0 of 20, best 31

#

what it targets

1 2 3 4 5 6 7 8

region-first guidance, 3× budget axis-aligned square, flat edges a second model family (Claude) trigger arity: a band in one coordinate the trigger’s argument named the mover stops inside the region the mover clamped to the boundary angular coverage of the contacts

repaired

what did not suffice, as tested

0/40 0/40 0/3 0/40 0/40 0/40 0/40 0/40

prompting and budget boundary curvature one family’s idiosyncrasy nothing — target unidentifiable variable identification the interior’s censoring the same, at matched evidence the coverage of the evidence

Table 6: The eight ablations on the 2D mode. “repaired” counts mode-containing synthesis draws recovering the region rule, by the criterion of Section M (a gate pass, a mode probe at 0, and exact agreement with the truth on a state–action grid, since the probe alone accepts a rule that over-covers the region). Ablation 4 excludes nothing because its target is not identifiable — the measurement above — which is recorded rather than reported as a 0/40 like the others. Ablations 6 and 7 carry complementary confounds: 6 supplies 11× more mode evidence, 7 matches the baseline’s evidence and pays in the rule’s complexity, so the negative survives both. Ablation 8 holds the contact count fixed and raises only their angular coverage, to the point where a three-line least-squares fit recovers the region on 20 of 20 samples; it is the only one of the eight whose direction was written down before the run. agreement 0.132, and 16 of the 20 write a region small enough to be a point on the probe grid — the memorisation class again. Outside: a plain algebraic least-squares circle fit on exactly the evidence the synthesizer was handed (scripts/region fit baseline.py). The contact landings are derivable from the sample by anyone who read the contract — a contact is recognisable from the transition alone, and the landing follows from the contract’s own integrator — and they cover a median 111◦ of the circle, partial coverage rather than a thin crescent. Even so the fit recovers both constants to within a tenth of the radius on 12 of the 20 samples, and the centre alone on 13, with no prior and no language model. Together these place the failure precisely. It is not the evidence: on twelve of these samples three lines of linear algebra recover the region, and the synthesizer given the form recovers none of them. It is not an inability to fit constants: given the centres it fits the radius to float precision, every time. It is not representational: told the rule outright, every arm writes it at gate 1.000 in zero iterations. What the synthesizer does not do is perform the fit — it substitutes a template and, when the template is refused, memorises the contacts. That is the region-template prior, stated as sharply as this instrument can state it: a located rule is what is not induced: the form alone does not rescue the failure, and once the form and its location are given the constants follow exactly. On the eight samples where the trivial fit also fails, the negative is not attributable to the synthesizer, and we do not attribute it. Within the reachable range (111◦ –185◦ ), the prior does not yield to coverage — and the direction was recorded before the run. The controls above leave one mechanism question open. It is the only treatment in the 2D program whose two possible answers were both written down before its test — which is weaker than pre-registration, since the question itself arose from the results it responds to, and Section Q classifies it that way (B21): if the obstruction is a prior over forms, enough evidence should overcome it; if more evidence changes nothing, it is a limit

32

rather than a prior. The instrument can pose the question because the start distribution is a knob. Starting episodes on a ring around the near patch instead of in the box widens the angular coverage of the contacts — the arc they actually span, 360◦ less the largest angular gap — while the rollout count is lowered to hold the number of contacts at the baseline’s median of 14.5, so the dose is coverage and not quantity (scripts/calibrate evidence dose.py; the trap survives, play-cost 0.8701 and blind contact rate 0.92). Coverage saturates near 185◦ , so the achievable range is 111◦ to 185◦ , and the trivial fit traces it: it recovers both constants on 12 of 20 samples at the baseline’s 111◦ , 16 of 20 at 129◦ , and 20 of 20 at 185◦ . Thus every widest-dose sample supports recovery by that specified estimator; the stronger universal circle-class certificate holds in 18/20 (Proposition 6). The synthesizer recovers none. Given the form and asked only for its location and size it recovers 0 of 20 (best agreement 0.191); given no clause at all it recovers 0 of 20 (best 0.220), while the translation arm on the same wider sample still writes the rule at gate 1.000 in zero iterations, 20 of 20. The narrower ring at 129◦ is the machinery control and behaves like the baseline (0 of 20), so the null at 185◦ is not an artifact of starting on a ring. Two consequences, one for each direction of the comparison. The estimator-level attribution becomes clean: the earlier control had to set aside the 8 samples on which the trivial fit also fails, and at 185◦ there are none to set aside — on every sample in the dose arm the region is recoverable by the declared fit and the synthesizer does not recover it. At the stronger universal level the same contrast holds on 18 blocks, with the two remaining blocks explicitly classified as underdetermined at tolerance rather than charged to synthesis. And the mechanism is bounded from the other side: within the range this instrument can reach, the failure does not respond to the dose at all, so “prior” should be read as a fixed disposition and not as a weight that more evidence overcomes. What lies beyond 185◦ this instrument cannot say: full coverage of the circle requires visiting the region’s far side from every bearing, and the freeze semantics forbid it (Proposition 7). The two campaigns bound what an independent acceptance sample buys, and the bound is the evidence’s identifiability. On the disc, every incomplete-arm artifact that reaches gate 1.000 on its own sample is rejected by an independent acceptance sample: 8 of 8 draws over 6 distinct rollout-seed blocks, at held-out accuracies 0.9944 to 0.9997. (Four are in the guided landing-prompt arm at k = (3, 7) and two in each size at k = (5, 9); the two sizes share their blocks, which is why the block count is 6 and not 8. The default disc arm reaches 1.000 on none, so there is nothing there for a second sample to catch.) On the slab, nineteen reach gate 1.000 and an independent sample rejects 0 of 19. Nor is the independent gate merely strict: on the positive control of Section 9, where the form and the centres are given and the artifacts are exactly right, it accepts 20 of 20 at 1.000. That is not a difference in how carefully the two gates were run; it is Proposition 7 and the identifiability measurement above. Where the target is identified — in the class-relative, finite-sample sense of Proposition 6 — in-sample acceptance can be over-fitting and a held-out sample catches it; where the target is identified only up to the proposition’s equivalence class, in-sample acceptance is the correct inference and there is nothing for a held-out sample to catch. An independent gate is exactly as effective as the evidence’s identifiability permits, and no more — which is the honest scope of Section 8. Two consequences. The ablation cannot be read as an answer about arity, because its target is unidentifiable; we say so rather than reporting 0/40 as if it were the disc’s 0/156. And the paper’s repair criterion is not sufficient: a probe that fires only where the truth’s mode is active cannot see a rule that over-covers it. Re-testing every 1D artifact the probe calls repaired against the truth on a dense grid (scripts/repair exactness 1d.py) finds four more of that kind, which is why Section 7.1 reports 105 of 111: the four probe-passing phantom-stop artifacts are counted as

33

non-repairs.

10

Localization is representational: smooth learners and a modecapable baseline on the same samples

“Representational” is the narrowest of the four statements Remark 3 keeps apart, and it is the only one this section tests. If localization is representational in that sense, two things must be checkable on non-code learners trained on the same data (scripts/continuous smooth probe.py; the two most favorable smooth learners: closed-form linear least squares — off the wall, the dynamics are exactly linear, so this is the smooth best case — and a small tanh MLP, probe-grade): model

trained on

off-mode err mean / max

probe err

gate 10−9

gate 10−2

linear-LSQ linear-LSQ MLP h=8 MLP h=8

wall-free wall-data wall-free wall-data

3.6e−15 / 1.7e−14 1.9e−03 / 1.2e−02 3.5e−03 / 5.0e−02 6.0e−03 / 4.9e−02

4.18 4.17 4.20 4.19

PASS fail fail fail

PASS fail fail fail

Table 7: Smooth learners on the synthesis samples (xwall = 8). “probe err” is the wall-region probe error (4.2 ≈ predicting straight through the wall).

off-mode max error (sup-norm, log)

The mode cannot be localized by a smooth hypothesis 10 1 10 3 10 5 10 7 10 9 10 11 10 13 10 15

= 10 2 gate

= 10 9 gate

exactly 0 (drawn at floor) linear-LSQ linear-LSQ wall-free wall-data

MLP h=8 wall-free

MLP h=8 synthesized wall-data code

Figure 5: Off-mode max error (log) by model and training data. The wall-free linear fit sits at float noise and passes both gates (blind); four contact rows tilt it twelve orders of magnitude; synthesized code is exactly zero off-mode. Identifiability is learner-independent, live. On the wall-free sample the linear model recovers the off-mode dynamics to 10−15 , passes the ε = 10−9 gate, and is exactly as wall-blind as the synthesized blind code (probe error 4.18: it predicts straight through the wall). Proposition 5 instantiated on a second hypothesis class. The proposition’s exact content is that on the miss event no sample-measurable score separates a mode-blind model from the true one, so acceptance carries no information about the mode — not that every accepted model is blind, which is false and which this paper’s own data refute: Claude’s pendulum artifact was accepted while carrying an invented mode, its prior having supplied off-sample content that happens to be wrong in the other direction. 34

Blindness is what a prior-free learner gets; the identifiability event is what makes any of it possible. The (1 − r)N hole is not an LLM property. A mode-capable learned class closes the exactness gap where the evidence identifies the mode — measured, not conceded. The two learners above cannot contain the mode; the natural objection is a learner whose hypothesis class does. We test the most favourable such baseline: the instrument’s own off-mode integrator and reward with only the event function learned from the same training samples — a hard threshold on the cart, up to two separated circular event regions fitted by algebraic least squares on PatchField2D (scripts/mode capable baseline h5.py, results/mode capable baseline h5.json; the training seed block is the unit, 20 blocks per arm). On the cart it behaves exactly like the code arm: from the wall-containing sample (4 contact transitions) it recovers the threshold exactly (x̂wall = 8.0), is float-exact on all 3200 held-out transitions, passes the ε = 10−9 gate with zero bad transitions, and plays at truth parity (play cost 0.0); three contacts already suffice, zero contacts never do; and from the wall-free sample it passes the same gate mode-blind — Proposition 5 on a third hypothesis class. On PatchField2D, given the two-circle form, it recovers the near patch within 0.1 of both constants on 12 of 20 baseline blocks and both patches on 0 of 20 (1 of 20 at the widest angular coverage) — what it lacks is farpatch evidence, not representation. Three conclusions therefore separate cleanly: expressibility and float-level exactness are properties of any class containing the mode, code or not; induction from finite evidence succeeds for the numeric estimator exactly where the identifiability measurements of Section 9 say the evidence permits it; and the LLM synthesizer, handed the same form, recovers the located rule on none of its 20 samples (Section 9) — the gap between the estimator’s 12/20 and the synthesizer’s 0/20 is the induction failure isolated from representation. With the mode in the data, code and smooth part ways. Four contact rows out of 3200 tilt the linear fit by twelve orders of magnitude off-mode (1.7e−14 → 1.2e−02 max; Figure 5) — it fails both gates and still has the mode wrong (probe 4.17). The smooth hypothesis cannot put the error on the mode; it leaks everywhere (Proposition 9’s geometry, with Corollary 2 pricing the volume the leak must occupy, observed here as a least-squares tradeoff). The synthesized code, on the same sample, wrote the exact clamp and passed at float precision. The MLP combines both axes: a pervasive ∼5e−3 floor that no gate accepts, and a never-learned mode. Consequence for the CWM paradigm: the paradigm creates in continuous control the localized failure class that the learned-model literature says does not dominate there — and, by the same representational fact, creates an exact-repair capability that no uniformly Lipschitz class can match (Corollary 2). That capability is not exclusive to code: a learned event function whose class contains the mode matches code’s float-exactness on the 1D clamp, measured above. What code supplies without being told is the class itself — any computable rule, no pre-specified event family — and the 2D campaigns show that this universality does not, by itself, deliver the induction of a located rule. Code cuts both ways, and the gate’s sampling coverage decides which way.

11

Related work

Counterexample-guided inductive synthesis: the same loop, a different oracle. CEGIS (Solar-Lezama et al., 2006; Solar-Lezama, 2008) alternates a learner, which proposes a candidate consistent with the counterexamples seen so far, and a verifier, which either certifies the candidate against a specification or returns a new counterexample. The guarantee is inherited entirely from the verifier: one that is complete relative to a specification either proves the candidate on the whole input domain or produces a witness. SyGuS standardized the format (Alur et al., 2013); the oracleguided theory (Jha et al., 2010; Jha and Seshia, 2017) makes what is synthesizable a function of

35

which oracles are available, with programming by example (Gulwani, 2011; Gulwani et al., 2017) as the bottom case, where generalization beyond the examples comes from a ranking function or a domain bias and not from a guarantee. Our synthesize–gate–refine pipeline is a CEGIS loop — LLM as learner, the gate’s failing transitions as counterexamples, a refinement iteration as a CEGIS iteration — with one load-bearing substitution: the counterexample oracle is random sampling of transitions, not a verifier. A verifier’s “no counterexample” means there is none; a sampling gate’s means none was drawn in N draws, an event of probability exactly (1 − r)N for a rule of rarity r (Proposition 1), on which the loop is programming by example and the learner’s prior decides everything off-sample. That weaker oracles buy weaker conclusions is not news to this literature and we do not re-derive it: it is the content of Jha and Seshia (2017), and the work that ran CEGIS against physical dynamics, where no complete verifier exists, substituted simulation and then recovered soundness by other means — a bounded verifier, or an SMT check on the final candidate (Kapinski et al., 2014; Ravanbakhsh and Sankaranarayanan, 2019) — or kept the verifier complete by pushing it into a theory solver (Abate et al., 2018). We add a closed-form law for how incomplete a sampling oracle is on a localized-rule failure, a proof that the miss event is unlearnable from the sample by any learner (Proposition 5), and a measurement of what a planner does with the accepted artifact. In the CEGIS sense our gate certifies one thing only — the absence of counterexamples in a sample — which is to say, nothing universal. Statistical model checking. SMC replaces exhaustive verification with simulation plus a statistical test and states what a sample size buys: acceptance sampling with Type-I/Type-II bounds (Younes and Simmons, 2002), Chernoff–Hoeffding complexity for an (ϵ, δ) estimate of a property’s probability (Hérault et al., 2004), the black-box case (Sen et al., 2004), and the standing difficulty that a rare property needs sample size scaling like the inverse of its probability (Legay et al., 2010). Our gate is an SMC procedure for “the model matches the plant to tolerance ε” run without error bounds; we improve on none of that sample-complexity machinery, and Hérault et al. (2004) is what would size a gate at a target confidence. SMC bounds the probability of a wrong verdict on a fixed property, whereas we bound the probability that the sample never exhibits the phenomenon at all — the verdict on the property actually tested is correct and uninformative — and where SMC stops at the verdict we push it through a planner, whose loss is adversarially selected rather than proportional to the residual (Proposition 8). Automata learning and active queries. Passive data does not hand you the machine — minimum-state automaton identification from given data is NP-hard (Gold, 1978) — whereas L∗ learns a regular language in polynomial time from membership queries plus an equivalence oracle (Angluin, 1987), which is what supplies a counterexample a random sample may never contain (Vaandrager, 2017; Settles, 2012). Proposition 5 is the continuous, hybrid-mode instance of that gap, and Angluin’s decomposition reads our gate in one line: membership queries drawn at random, no equivalence oracle, which is why more refinement iterations cannot complete the loop. We inherit no query-complexity result — their target is finite and exactly identifiable under exact queries, ours a program over a continuous space with tolerance ε and a stochastic query distribution — which is why we prove a probability law instead. Falsification and counterexample-guided refinement. Falsification searches for inputs driving a hybrid or cyber-physical system to violate a specification (Annpureddy et al., 2011; Corso et al., 2021; Yamagata et al., 2021); CEGAR refines an abstraction at the spurious counterexample (Clarke et al., 2000, 2003; Alur et al., 2006); counterexample-guided data augmentation feeds

36

falsified inputs back as training data (Dreossi et al., 2018, 2019). The message is uniform, and we do not improve on it: directed search finds the rare violating input random sampling misses. Our gate is the passive dual — uniform random testing whose blind spot is precisely the mode a falsifier would hunt for, with (1 − r)N quantifying the gap — and the contrast with Dreossi et al. (2018) is our thesis in one sentence: there the counterexample that fixes the model comes from a falsifier, here from the gate’s own random draw, and on the miss event there is none. CEGAR is also the template for our distrust-region mitigation, differing in the bookkeeping: it refines an abstraction over-approximate by construction, so refinement preserves the guarantee, whereas the fence refines a trust set around an artifact with no such property — hence a measured collapse of the exploitation and, at the farthest two-dimensional knob, 7 of 20 episodes pinned at blind-level return (Section F.1). Property-based testing with adaptive generators. The gate is random testing of a program against an oracle and (1 − r)N is the standard rare-input coverage gap (Claessen and Hughes, 2000; Rubinstein and Kroese, 2017), but uniform generation is not where that field stopped: generators can be steered by search toward inputs maximizing a utility (Löscher and Sagonas, 2017, 2018), derived from the property so constrained inputs arise by construction (Lampropoulos et al., 2017), or guided by coverage feedback (Padhye et al., 2019). Ours sits at the uniform, non-adaptive end of that spectrum, and each of the three has an instantiation here that we do not implement: a generator targeting distance travelled toward a mode boundary, one derived from the contract so mode-entering transitions occur by construction, and coverage-guided rollout mutation whose signal is which branches of the synthesized program executed — available because the model is code. What we add is not a generator but that the planner is the adversary which finds the untested branch at deployment. Experiment design and active system identification. What is recoverable is a property of the input signal and not only of the estimator: optimal input design (Mehra, 1974), identificationfor-control and the revival of experiment design (Gevers, 2005), identifiability under a given excitation (Ljung, 1999), and the learning-theoretic result that actively chosen inputs achieve sample complexities passive excitation cannot (Wagenmaker and Jamieson, 2020). This literature implies our prescription and we re-derive none of it: our gate is a passive, non-adaptive experiment, and Proposition 5 is its identifiability statement specialized to a hybrid mode and a code hypothesis class. There the design reduces parameter variance in a fixed parametric family and the failure is graded; ours is discrete — a rule is present or absent in the program — and its consequence is read through a planner rather than an estimation-error norm. The active boundary probing we list as follow-up work (Section 12) is an experiment-design problem and we name it as one. Identification of hybrid and piecewise-affine systems. Recovering a piecewise-affine or hybrid system is a joint classification-and-regression problem — the partition of the state-input space as well as the affine law in each region — and it is classical: clustering (Ferrari-Trecate et al., 2003), mixed-integer programming (Roll et al., 2004), bounded-error set membership (Bemporad et al., 2005), algebraic geometry (Vidal et al., 2003), the tutorial and mixed logical dynamical formulations (Paoletti et al., 2007; Bemporad and Morari, 1999), and trace-mining of hybrid automata (Medhat et al., 2015; Garcı́a Soto et al., 2021). We contribute no identification algorithm; our question is what a sampling verifier certifies when the mode is missed, and what a planner then does — the case these methods assume away, since none forms a region containing no samples. One is already active: Garcı́a Soto et al. (2019) synthesizes linear hybrid automata from membership queries, the

37

closest existing form of the fix we prescribe. Proposition 9 and Corollary 2 are also a statement about this literature’s hypothesis classes — an exactly localized disagreement is unavailable to a bounded-Lipschitz class at any volume — which is why we take code rather than piecewise-affine with a fixed mode count. Contact-rich and discontinuous dynamics. Contact is the physical archetype of our instruments and this literature’s finding runs in the same direction: smooth end-to-end learning is the wrong parameterization and a complementarity-structured implicit loss does far better (Pfrommer et al., 2021), stiff contact makes the loss landscape pathological for deep learners as a fundamental matter (Parmar et al., 2021), and even standard analytic planar contact models are limited on real data (Fazeli et al., 2020, 2017). Parmar et al. (2021) is the empirical shadow of Proposition 9 and Pfrommer et al. (2021) takes structurally our remedy — put the discontinuity in the hypothesis class — neither of which we improve upon. The difference is what fails: there contact is present in the data and the failures are accuracy failures; here the mode is absent and the artifact is certified. Our repair-from-data result is the code analogue — given contact transitions in the sample the synthesizer recovered the exact switching rule on the one-dimensional clamps, whereas the two smooth fits we ran spread the error instead (Table 7) — and, like this literature, we stop short of contact-rich manipulation. Hypothesis classes that can represent modes. Classes that can express mode structure are mature: mixtures of experts with a learned gate (Jacobs et al., 1991), recurrent switching linear dynamical systems whose discrete state depends on the continuous one (Linderman et al., 2017), neural ODEs with learned event functions (Chen et al., 2021), and neural hybrid automata that infer the number of modes and their transitions (Poli et al., 2021). This family scopes our representational claim rather than being scoped by it: Proposition 9 quantifies over Lipschitz pairs, and a hard gate or a learned event function reintroduces exactly the unbounded local structure it requires, so it is not an argument that neural models cannot represent hybrid modes — our MLP is a probe at h = 8 scale, not a baseline (Section 12), and Section 10 measures a favourable learned eventfunction baseline from this family directly. What survives is class-relative on the representation side and learner-independent on the identifiability side: no architecture here can infer a mode from a sample that never enters it (Proposition 5), and float-level exactness — zero off-mode error at ε = 10−9 (Table 7) — is a property of any class containing the mode: the measured event-function baseline attains it on the 1D clamp exactly as code does, while the smooth fits cannot (Section 10). Conformal and PAC guarantees for learned dynamics. Conformal prediction gives any predictor distribution-free finite-sample coverage under exchangeability (Vovk et al., 2022) and has been carried to dynamics and control: prediction regions over trajectories, planned against (Lindemann et al., 2023); learned monitors that reject unreliable violation predictions (Bortolussi et al., 2019); PAC-Bayes bounds for policies across environments (Majumdar et al., 2021). We derive no better certificate, and the comparison sharpens our result rather than softening it: their coverage holds with respect to the calibration distribution, which here is the gate distribution, and the planner is not exchangeable with it — the region our certificate covers carries 1.9% of the exploited planner’s queries, and a region containing every step-t level set carries 7.8% (Section 12). Calibrating conformally on gate rollouts would attach to the same wrong artifact a marginal guarantee that is honest over the calibration distribution and silent about the planner’s queries; a planner could treat the conformal sets as uncertainty and react to their width, but sets calibrated where the mode never fires carry no widening at the mode, so the failure is not an artifact of choosing

38

a metric certificate. Conversely ours is a sup-norm statement with an explicit ε + 2Lρ constant (Propositions 14 and 15), which conformal prediction does not give, and it needs a finite Lipschitz constant, which conformal prediction does not — where ours is weakest, the mode’s local constant being unbounded. Runtime assurance, safety filters, and robust MPC. Every guarantee in this family is anchored to something known a priori: a verified conservative baseline plus a switching rule (Seto et al., 1998; Sha, 2001), a shield synthesized from a safety automaton (Alshiekh et al., 2018), recursive feasibility across iterations of a learned controller (Rosolia and Borrelli, 2018; Hewing et al., 2020), a minimally invasive projection keeping a known backup viable (Wabersich and Zeilinger, 2021), or a bounded model-error description (Rawlings et al., 2017). Our failure is invisible to every anchor derived from the learned model or its training distribution: the error is unbounded but confined to a region the gate accepted as error-free, so a robustness margin tuned to the offmode residual does not see it and a safety filter built on the same accepted model inherits the blind spot. An anchor specified independently of the model — a verified conservative baseline, a shield synthesized from a safety automaton — does not inherit it; it simply pays its conservatism whether or not a mode was omitted. The distrust-region fence has the shape of a safety filter with the anchor moved — assembled from deployment-time refutations rather than an a-priori safe set, correcting a certified-but-wrong model rather than an unsafe policy — which is why we report it as a mitigation with measured behaviour, its two-dimensional failure included (Section F.1), and not as a certificate. Decision-aware model learning and objective mismatch. Prediction loss is the wrong objective for a model that will be planned with, and this literature has formalized the right one: losses weighting error by its effect on the Bellman update (Farahmand et al., 2017; Farahmand, 2018), the value equivalence principle — models are equivalent if they induce the same Bellman updates over a set of functions and policies (Grimm et al., 2020) — an existence proof at scale for training purely for planning utility (Schrittwieser et al., 2020), and the finding that prediction accuracy and control performance diverge while planners exploit model error (Lambert et al., 2020; Janner et al., 2019; Hafner et al., 2020). Our headline is a value-equivalence statement: the gate tests prediction equivalence on the gate distribution, and we exhibit an artifact prediction-equivalent to within 10−9 everywhere the gate looked that is value-anti -equivalent, capturing essentially none of the attainable return at the knobs swept. Their constructive programme is to train for value equivalence, which needs a value function or a policy at training time; here the model is written before the planner runs, so our prescription is a change of test distribution, not of loss — and their results concern approximation quality within a parametric class, whereas our failure is an all-ornothing missing rule that no reweighting of a loss recovers from a sample that never touched it. Our contribution to that conversation is the verified-but-wrong localized regime, which a boundedLipschitz model can represent only at the volume price of Corollary 2 and which neither learner we fit represents at all (Table 7), plus a closed-form acceptance-failure law confirmed at gate scale. Code world models. Code World Models (Lehrach et al., 2026) and code-as-policy (Liang et al., 2023; Gao et al., 2023) supply the paradigm, and the companion paper (Aguilar Martı́n, 2026) is the discrete study this paper extends: we transfer its provable core, show that its empirical residual (translation, not inference) does not transfer on the one-dimensional clamps, and add the localization budget separating code from bounded-Lipschitz hypotheses.

39

12

Limitations

Three instruments; repair is geometry-scoped, mitigation fails outright on a 2D boundary at distance. Cart-with-wall, pendulum-with-stop, and PatchField2D span 1D and 4D state and one and two modes. The mechanism survived every extension — it is measure-theoretic — and so did the gate’s strict sample consistency (the all-or-nothing 2D gate accepted no partially-right artifact). The residue is sharper and different. Repair-from-data collapses on 2D region boundaries, curved or flat: GPT-5.x recovered the rule in 105 of 111 revealed 1D clamps (four more passed the mode probe while carrying an invented second stop) but recovered the 2D region rule in 0/156 mode-containing attempts over 20 distinct gate samples pooled over the disc, the square ablation, and the guided/3×-budget treatment (Section 7.1). The prompting/budget and curvature outs are now measured negatives; what could restore repair — two-sided (inside) evidence, active boundary probing, or richer evidence summaries — is the subject of ongoing follow-up work. The 2D mitigation likewise generalizes but only partially, and its failure mode at the farthest knob is not a longer transient but lock-in: 7 of 20 episodes end pinned at blind-level return, because the fence’s tie-break is an unsigned distance and a curved boundary lets the planner be pinned against it (Section F.1). A signed outward normal is the obvious fix and is untested. Contact-rich manipulation, moving boundaries, and 3+ modes remain future work. Two planner families, one fixed configuration each. Random-shooting MPC sits at the high-query-reach/high-play-cost end and CEM at the low-query-reach/near-zero-play-cost end (Section E); only the latter is implied by Proposition 8, since the bound forces low play cost from low reach but does not force the converse. This is stronger than a one-family result but not planneruniversal: CEM was measured at one prototype-fixed setting, with no hyperparameter sweep, and its pendulum truth returns expose local optima. Its non-exploitation is reach-limited, not knowledgeable or safe — the same search that misses phantom reward can miss real distant reward. Gradient-based shooting and tree search (Coulom, 2006; Kocsis and Szepesvári, 2006) remain untested. Distrust-region replanning (Section 6) is a mitigation layered on MPC, not a third family; its hard-boundary guarantee and its behavior with other planners remain untested. Synthesis cells are modest, and the two sizes share their samples. The gate sample is drawn from the seed index alone, so mini and large are synthesized from identical samples at every instrument and knob (Section 7): every pooled “both sizes” count is n distinct gate samples with two synthesis draws each, and the distinct-sample n is half the pooled one — 10 mode-absent samples on the cart headline cell, 31 knob-resolved mode-present samples across the two pendulum knobs for the shared-block pools (34 distinct pendulum blocks once the --seed-offset arm is included), 38 mode-containing on the PatchField2D disc cells, 20 on each ablation campaign. Persize Wilson bounds are quoted for exactly this reason wherever only shared blocks exist. On the two headline cells the constraint was removed instead: the large arm was re-run on a disjoint seed block (--seed-offset 20), so there the counts are over independent blocks and the bounds are legitimate at that unit (exact lower bounds 0.832 cart, 0.782 pendulum), and even the (1−r)N gatemiss check becomes poolable (20/40 independent cart samples lacked the mode against a predicted 0.63). With that accounting: 20 seeds/cell on the headline xwall = 8 cart cell for both GPT-5.x sizes, plus a 3-seed Qwen cross-family spot-check; the pendulum arm adds two knobs (headline and caught) at the same 20 seeds/cell, both sizes, plus its own 3-seed Qwen spot-check. The wall/modeabsent conditional is 20/20 across cart sizes and three runs and 18/18 across pendulum sizes: per size that is 10/10 (Wilson lower bound 0.72) and 9/9 (0.70), the bounds we rely on, against pooled 0.84 and 0.824 whose trials share samples. The GPT-5.x repair rate is 20/20 on the cart headline 40

cell and 62/62 pooled on the pendulum (31 distinct shared-block samples) by the probe criterion, of which 58 are exact on a dense grid and four carry an invented second stop. The cross-family arms are small-n (3 seeds plus one control per instrument per family) and cover two alternate families (Qwen, and Claude agent-relayed), not a sweep of models — and their coverage is uneven across instruments: both families were run on the two 1D instruments, and on PatchField2D both families carry both arms — Claude’s agent-relayed, and Qwen’s as a backend-matched campaign (both arms on one pinned vLLM configuration, provenance versioned), with the incomplete cells refused 3/3 (Section M); they show repair is model-dependent in mechanism — Qwen 0/2 modepresent (superstitious patches), Claude repairing most but via a symmetry prior that oscillated on two seeds and had one phantom, unfalsifiable mode accepted. The PatchField2D synthesis arm adds two bi-knob cells (20 seeds each, both GPT-5.x sizes) plus two ablation campaigns (regionguidance 3× budget; axis-aligned square with flat edges — 20 seeds each, both sizes); its finding is a negative one — 0/76 repair of the circular mode, 0/66 partial repair, 0/156 pooled, plus 0/3 in a Claude cross-family arm on the same cell whose failure classes match (Section 7.1) — so repairfrom-data is model-dependent and evidence-dependent; Section 9 isolates which, and Proposition 7 says when the target is not identifiable at all. The mode-blindness probe covers the true mode’s region and no other. By construction mode blindness (src/cwm/continuous/contract.py) fires probes where the truth’s mode is active, so it establishes whether the revealed mode is encoded but is blind to a mode the model invents elsewhere: Claude’s phantom pendulum stop (Section 7) scored blindness 0.0 while carrying an extra, non-existent stop at θ = −1.4. Detecting invented modes needs code inspection, or probes seeded outside the sampled region — the classification alone does not suffice, and our phantom-mode finding rests on reading the accepted code, as the companion paper’s artifact-level analysis does. The MLP is a probe, not a baseline; the mode-capable baseline is favourable by design. The MLP substantiates the representational point at h=8/pure-Python scale; a tuned modern dynamics model would have a lower floor but the same structural inability to be bit-exact off a mode at ε = 10−9 (an argument, not yet a measurement, at scale). The learned event-function baseline of Section 10 removes that objection where its class contains the mode, but it is deliberately favourable — the off-mode plant is pinned and known, only the event function is learned — so it bounds what representation explains, not what an end-to-end hybrid learner (mixture-of-experts, learned event functions at scale) would achieve; those remain untested. Proposition 9 bounds geometry, not probability. The ball is metric; converting to gatevisitation probability needs the gate measure on that ball, which is instrument-specific. The empirical complement (Table 7’s twelve-orders tilt) carries the quantitative weight here. The budget itself is unconditional at boundary points (Corollaries 2–3), but its exemption clause is scoped: “no finite local constant” is proved for the discontinuous reset modes studied — the velocity-zeroing wall and stop and the freezing patch — while a hybrid boundary that is continuous (a kink, a saturation) remains Lipschitz and inside the budget, so no claim is made that every hybrid boundary escapes it. The coverage certificate reaches only the smooth case. What transfers from the companion paper’s enumeration is a covering-number statement for Lipschitz pairs, and on the deployed cart gate it is informative: no pair with L ≤ 5.77 can carry the wall’s error of 4.2 past the gate on the 41

certified region. The residue is that this is exactly the case the paper is not about — a discontinuous reset mode has no finite local Lipschitz constant, so no L makes the certificate apply to it — and that the certified region carries 1.9% of the exploited planner’s queries. Section N states the scope in full, including what closing the within-rollout dependence and the step-t density did and did not buy. The instruments are designed and deterministic; bounded observation noise is measured, process noise and external benchmarks are not. All three instruments were built around the law, so prevalence on externally specified dynamics is not established here. One robustness axis is now measured rather than assumed: under known coordinatewise Uniform[−η, η] observation noise, a support-compatibility gate preserves the acceptance law on a fixed 200-block CartWall@4 panel through the pre-specified primary level η = 0.1 (blind-pass increase exactly 0) and first crosses the frozen +0.05 masking boundary at η = 1 (blind pass 32/200 blocks, exact CP95 [0.1121, 0.2183]; Section J, with the analysis pre-specified and hash-pinned). Process noise, an unknown noise law, planning under noise, and an externally authored contact or saturation benchmark with its own critical event remain open; the last is the decisive follow-up, and the analysis for it should be frozen before any outcome is inspected, as the noise analysis was. play cost > 1 is a normalization artifact (blind < random), reported unclamped and explained; the headline claims never depend on the excess over 1.

13

Conclusion

The companion paper ended by diagnosing the gate failure as a reach-distribution shift and prescribing verification on the distribution the planner visits. This paper shows the diagnosis is not about discreteness. The gate-miss law, the identifiability argument, and the play-cost bound are measure-theoretic and survive the move to continuous state spaces intact; what the move changes is where the localized failure can live (discontinuous reset boundaries — an omitted mode is a rare rule) and who can express it (programs place it exactly, while any class with a finite Lipschitz bound pays the volume price of Corollary 2, now priced at boundary witnesses too via the interior-volume constant of Corollary 3 — Proposition 9 and Table 7; smooth compactly supported errors and continuous hybrid boundaries are not excluded, and a measured learned event function attains code’s float-exactness where its class contains the mode, Section 10). On two minimal hybrid instruments the entire discrete phenomenology reproduces — threshold law, knob-invariant exploitation, the reach mechanism — with the gate’s acceptance rate closely tracking (1 − r)N at gate scale (within sampling noise; Section 5). The synthesis experiment then delivers this paper’s own finding: on the 1D instruments the continuous regime is the one where the danger law is dominant — near-exhaustive for the shipment of mode-blind artifacts. Given the mode in its sample, the LLM repairs it exactly in 105 of 111 draws; every attempt is exact on 50 of 56 instrument–stream blocks (exact 95% interval [0.781, 0.960]), and the treatment-resolved census is 64/70 knob-level block cells — including from the synthesis examples alone. Of the six others, the gate caught two superstitious patches, and four artifacts repaired the true stop while adding an invented one their samples could not refute — a class their own acceptance samples could not catch — the independent gate caught one of the four, by the luck of its draw — and the behavioural grid convicts in full; given the mode absent, every learner tested (LLM, exact linear regression, a mode-capable event-function baseline) is accepted blind and the planner is exploited at a regret of essentially the whole attainable return — below 42

the random baseline’s mean where measured, though on the 1D instruments that comparison rides the baseline’s heavy tail (Section 4). That repair, though, is geometry-dependent: on a third, 4D bi-modal instrument with 2D modes it inverts — neither GPT-5.x size recovers the region rule from data (0/156, including an axis-aligned square with flat edges and a guided 3×-budget treatment), two further model-family spot-checks at tiny n fail in the same classes, and eight interventions plus two positive controls place the obstruction in the induction of a located rule — not in curvature, the tested prompting and budget, variable ambiguity, the interior’s censoring, the evidence’s coverage (raised to where a three-line fit is exact on every sample), or an inability to fit constants, each shown insufficient by measurement, with the arity intervention recorded as unanswerable on this instrument rather than excluded (Section 9), and the exhaustiveness claim is scoped back to the 1D clamps, though the gate remains sample-consistent (Section 7.1). The provable core is the gate-miss and identifiability propositions (Section 3): the mode-absent event is a hole no learner can close from the sample — a prior or the specification could still supply the mode — and its probability is in closed form. Sample-covered exactness is the acceptance criterion itself; that accepted artifacts were also right off-sample — with the known phantom-mode exceptions — four pendulum artifacts of GPT-5.x and the Claude artifact, each wrong only where its own sample is silent — is an empirical regularity of the models tested (GPT-5.x repairs; Qwen stalls and is refused; Claude repairs most through a symmetry prior), not a theorem. For practitioners the message is one clause sharper than the discrete one: on the 1D clamps measured here, sample coverage of the mode boundaries is the whole game — on the 2D regions coverage was raised and did not suffice (Section 9), so the residual there is the located-rule induction gap — the synthesis stack will translate what it is told and repair what it is shown, and no stage of it can learn from the sample what the sample never touched (a prior or the specification still can, and Claude’s did).

Supplementary Material The material below supports the main article and is not needed to read it. It contains the results the main text states in one sentence and cites: the ε-axis propositions, the derived play-cost normalizers, the coverage certificates and their statistical accounting, the detectability rate, the second planner family, the planner-side mitigation, the complete LLM protocol, the reproducibility manifest, and the pre-specification ledger.

A

The reveal-rarity’s ε-invariance, and the rate that replaces its threshold

Proposition 10 (ε-invariance of a hard mode’s reveal-rarity). Fix a hard mode, a gate policy, and a model that agrees with the truth exactly off the mode — which the mode-blind model does by construction, the two sharing an integrator. For a rollout ω put D(ω) = max{ ∥f (s, a) − fˆ(s, a)∥∞ : (s, a) a mode contact of ω }, with D(ω) = 0 if ω never contacts the mode. Then the reveal-rarity at tolerance ε — the probability that a gate rollout contains a transition on which truth and model differ by more than ε — is exactly Pρ (D > ε), non-increasing in ε. Consequently, with ε∗ = ess inf{D : D > 0}, reveal-rarity(ε) =

Pρ (D > 0) | {z }

mode-firing rarity r

43

for every ε < ε∗ ,

and pass@N = (1 − r)N is exactly ε-invariant on that range. Proof. Off the mode the two models agree exactly, so any transition with ∥f − fˆ∥∞ > ε is a mode contact; a rollout therefore contains one iff its largest contact disagreement exceeds ε, i.e. iff D(ω) > ε. The display is then the definition of the essential infimum, and pass@N follows from Proposition 1. Two readings of ε∗ must be kept apart. Against the empirical measure of one gate sample, ε∗ is the smallest positive D observed and the identity above is exactly what Table 8 reports — in-sample, and no more. Against the population measure, ε∗ = 0 under Proposition 11’s approachability hypothesis — which on these instruments is an assumption the data are consistent with, not a theorem about them — so the display is empty there and the population content of the flatness is not a threshold at all but the quadratic rate proved next. Writing one symbol r for the two rarities is therefore licensed exactly in-sample, and in population to within Cε2 . The threshold does not converge to a positive constant: the running minimum falls monotonically and does not settle — on wall@4, 0.420 at 25 firing rollouts, 0.123 at 200, 0.041 at 3200. The population threshold is zero, and what stands in its place is a rate, which holds at every ε rather than below an unstable cutoff. Proposition 11 (flatness at a rate for clamped semi-implicit plants; no population threshold). Consider any plant of the semi-implicit form
ωt+1 = ωt + gain · at + F (θt , ωt ) dt, θt+1 = θt + ωt+1 dt, with F ∈ C 1 arbitrary, run over a horizon T under the gate policy (at i.i.d. U (−amax , amax ), drawn independently of the state), and carrying a hard mode that clamps the integrated coordinate: if θt+1 ≥ θstop the next state is (θstop , 0). Let the model be the same plant with the clamp removed, let D(ω) be a rollout’s largest sup-norm disagreement over its mode contacts, and let rfire = P (D > 0) be the mode-firing rarity. Then for every ε > 0, 0 ≤ rfire − reveal-rarity(ε) = P (0 < D ≤ ε) ≤ C ε2 ,

C=

TM , 2 gain amax

where M = max ∥pθ0 ∥∞ , (2 gain dt2 amax )−1 bounds the density of the clamped coordinate’s absolutely continuous part below the stop at every step (the law also carries an atom at the stop, which the proof handles separately). If moreover (T ≥ 3) the mode is slowly approachable at the horizon’s end — there is a boundary state (θstop , ω ⋆ ) with two-sided margin |ω ⋆ +F (θstop , ω ⋆ ) dt| < gain dt amax such that for every δ > 0 there are an event Hδ of positive probability on the history through step T − 3 on which no clamp has yet fired, and a nonempty open action rectangle Uδ ⊆ (−amax , amax )2 , with steps T −2 and T −1 also clamp-free for histories in Hδ and (aT −3 , aT −2 ) ∈ Uδ and (θT −1 , ωT −1 ) landing within δ of (θstop , ω ⋆ ) — then ess inf{D : D > 0} = 0, so no positive ε makes the two rarities equal: they agree only in the limit, at the quadratic rate above. Proof. At a contact the truth clamps the velocity to 0 while the model returns the pre-clamp post′ , so D ≥ |ω ′ |; and the clamp fires only if θ + ω ′ action velocity ωt+1 t t+1 t+1 dt ≥ θstop with θt < θstop , ′ so ωt+1 ≤ ε forces θt ∈ [θstop − ε dt, θstop ). Hence [ ′ {0 < D ≤ ε} ⊆ {0 < ωt+1 ≤ ε} ∩ {θt ∈ [θstop − εdt, θstop )}, t<T

and two facts independent of F bound each term. First, at is drawn independently of (θt , ωt ) and ′ enters ωt+1 = ωt + F (θt , ωt )dt + gain dt at additively, so conditionally on (θt , ωt ) it is uniform on an 44

′ interval of length 2 gain dt amax and P (0 < ωt+1 ≤ ε | θt , ωt ) ≤ ε/(2 gain dt amax ). Second, for t ≥ 1 separate the two branches of step t itself. Write

θtpre = θt−1 + ωt−1 dt + F (θt−1 , ωt−1 ) dt2 + gain dt2 at−1 | {z } free of at−1

for the unclamped landing — an expression valid whatever clamps fired at earlier steps, since those only change (θt−1 , ωt−1 ), a history-measurable quantity (a clamp resets it to (θstop , 0), still free of at−1 ). The realized coordinate is θt = θtpre on {θtpre < θstop } and θt = θstop otherwise, so the conditional law of θt given the history through t − 1 is not uniform: it is a uniform density below the stop plus an atom at θstop itself. The target strip [θstop − εdt, θstop ) excludes the atom, and on {θt < θstop } the two coordinates coincide, so P (θt ∈ [θstop −εdt, θstop )) = P (θtpre ∈ [θstop −εdt, θstop )); and θtpre , conditionally on that history, is uniform on an interval of width 2 gain dt2 amax (the fresh at−1 enters affinely with slope gain dt2 ), with density at most (2 gain dt2 amax )−1 ; at t = 0 the bound is ∥pθ0 ∥∞ . Either way it is at most M , so P (θt ∈ [θstop − εdt, θstop )) ≤ M ε dt. Multiplying the two and union-bounding over the T steps gives the display. The second fact is where the semi-implicit ordering is used: the action reaches the integrated coordinate within the same step, at order dt2 . For the essential infimum, fix ε > 0. By continuity of F there are δ0 > 0 and κ > 0 such that every state within δ0 of (θstop , ω ⋆ ) has m := ω + F (θ, ω) dt ∈ (−gain dt amax + κ, gain dt amax − κ). Take δ < min(δ0 , ε dt/ max(1, dt), κ dt) and the Hδ , Uδ the hypothesis supplies. On that event no clamp fires at any step before the final transition, so (θT −1 , ωT −1 ) is the unclamped two-step image of (aT −3 , aT −2 ) — and only on such an event may the family-wide two-action Jacobian identity (Section C), det ∂(θT −1 , ωT −1 )/∂(aT −3 , aT −2 ) = gain2 dt3 ̸= 0, be invoked at all, since a clamp at step T − 1 collapses the coordinate to the constant θstop and a clamp at step T − 2 confines the pair to a one-parameter affine image, a Lebesgue-null set in the plane. The actions being uniform with positive density on Uδ , the pair has a conditional density bounded below on the open set W := image ∩ Bδ (θstop , ω ⋆ ), nonempty by the hypothesis; every (θ, ω) ∈ W has θ ∈ (θstop − δ, θstop ) — inside the strip, since δ ≤ ε dt — and carries the margin. So the event {(θT −1 , ωT −1 ) ∈ W } ∩ {no clamp before the final transition} has positive probability. Conditionally on it the final action is fresh, so ωT′ = m+gain dt aT −1 is uniform on an interval containing (0, κ), and the final-step clamp fires with ωT′ ≤ ε/ max(1, dt) exactly when ωT′ ∈ [(θstop − θT −1 )/dt, ε/ max(1, dt)] — a subinterval of positive length, its lower end being below δ/dt ≤ min(ε/ max(1, dt), κ). Because no clamp fired earlier, this final-transition contact is the rollout’s only contact; this is why the window sits at the horizon’s end, since D is a maximum over the rollout’s contacts and an earlier or later coarse contact would push it past ε. On the constructed event the contact’s sup-norm disagreement carries two components — the clamped velocity, ωT′ , and the position excess θT −1 + ωT′ dt − θstop ≤ ωT′ dt (positive part; θT −1 < θstop ) — so D = max(ωT′ , θTpre −θstop ) ≤ ωT′ max(1, dt) ≤ ε, and D ≥ ωT′ > 0; hence P (0 < D ≤ ε) > 0 for every ε > 0. Two constraints multiply, which is the whole content: a contact revealed only faintly needs both a nearly-zero post-action velocity and a position already inside a strip of width ε dt. The constant is the same object the coverage certificate uses: substituting M gives C = T dt c with c = (4a2max gain2 dt3 )−1 the universal step-t density constant of the same family, so one constant serves both the flatness rate and the certificate. On this paper’s instruments that is M ≤ 16.67 and C = 222 for the cart and the pendulum (identical, since they share T , dt, gain and amax ; scripts/eps flatness rate.py derives both from the env objects). The bound is loose by orders of magnitude — a union bound over eighty steps times two worst-case densities — so the exponent is the content, and it is measured on both arms (60,000 rollouts each): 2.57 on wall@4 and 2.10 on stop@1.0, both at or above the proved 2, with the bound holding at every grid point. Because 45

the proposition covers the nonlinear plant too, the pendulum’s 2.10 is a confirmation of a proved rate rather than the only evidence for it; what the near-equality adds is that the two-constraint mechanism is close to tight there, the union bound and the worst-case densities together costing only the gap between 2.10 and 2. The approachability hypothesis remains an assumption about the plant — no finite sample witnesses a for-every-ε statement. What the data supply is consistency: observed single-contact disagreements reach down to 0.0018 over the 919 contacts on wall@4, three orders below the gain dt amax = 0.3 margin the hypothesis needs, with nothing suggesting a positive floor. PatchField2D is outside the family, its action setting a force direction rather than entering additively. The rate also explains the threshold’s instability: the minimum of n draws from a law whose tail vanishes like εp falls like n−1/p , so ε∗ cannot converge to a positive limit. Table 8 accordingly reports an in-sample identity, and the population statement is Proposition 11. Note what ε∗ is: a per-rollout minimum of a per-contact maximum. A pinned rollout contacts the mode many times, and it only has to contact it coarsely once to be revealed, which is why ε∗ sits two orders of magnitude above the smallest single-contact disagreement (0.0018 over the 919 contacts on wall@4; scripts/eps invariance threshold.py). Two constraints govern how the threshold may be used. First, ε∗ is a property of a sample, so comparing a threshold computed on one rollout stream against dips measured on another compares two random quantities rather than testing a prediction; on four arms it disagrees on two. Computed on the sweep’s own stream the relation is an identity: reveal-rarity equals firing-rarity at every grid ε below ε∗ , and the first grid point at or above it is where the sweep dips. Table 8 reports it that way, in-sample, and claims nothing beyond the identity. Second, a minimum is an unstable statistic — upward-biased for the population infimum and monotonically decreasing in n — so no conclusion may rest on the last digit or on a comparison against the grid’s edge. Measured across independent streams of the same size, ε∗ moves by a factor of 1.8 on wall@4 (0.114, 0.146, 0.201) and 1.4 on wall@8 (0.396, 0.438, 0.538, each from only 21 to 25 firing rollouts). And at ten times the sample it drops well below all of them: 0.065 on wall@4 and 0.272 on wall@8. That last figure matters, because 0.272 < 0.3: the claim that wall@8 is flat throughout the grid is a statement about the 2000-rollout sample, not about the instrument, and at 20,000 rollouts the grid’s top point would dip. We therefore state flatness as holding on the range each sample resolves, which is what the proposition licenses, and not as a property of the arm. mode arm cart wall@8 cart wall@4 pendulum stop@1.0 pendulum stop@1.4

ε∗

firing

first grid ε ≥ ε∗

0.3959 0.1137 0.0791 0.0805

25 277 282 35

none in grid 0.3 0.1 0.1

measured in the same sample flat through ε = 0.3 0.1385 to ε = 0.1, 0.1355 at 0.3 0.1410 to 3×10−2 , 0.1400 at 0.1, 0.1240 at 0.3 0.0175 to 3×10−2 , 0.0170 at 0.1, 0.0155 at 0.3

Table 8: The ε-invariance threshold, computed on the sweep’s own rollout stream (2000 rollouts/arm, gate policy only, --seed 10000 to match continuous eps sweep.py). Within one sample the relation is an identity, not a prediction: reveal-rarity is flat below ε∗ and the first grid point at or above it is where the sweep departs. The “firing” column is the number of rollouts the minimum is taken over — 25 on wall@8 — which is why the threshold itself carries the sample-tosample spread discussed above and must not be read to the last digit.

46

B

The play-cost normalizers, and why knob-invariance is arithmetic

Proposition 12 (the normalizers, derived). Fix the cart instrument with xwall < xright , and let xmin (t) be the position at step t of the trajectory that starts at x0 = −xrange and takes as = −amax 0 throughout. Then for every policy and every admissible x0 , J ≤

T  X t=1

aleft 1 + e(xmin (t)−xleft )/w J ≥ T

+

aright 1 + e(xright −xwall )/w

min



¯ =: J,

r(x) =: J,

x∈[xmin (T ), xwall ]

and both sides are explicit numbers. Proof. Step 1: xt ≤ xwall . Immediate from the clamp. Step 2: xt ≥ xmin (t), clamp or no clamp. Absent clamping, xt is affine in (a0 , . . . , at−1 ) with all coefficients positive — each action enters through gain dt2 times a positive sum of powers of 1 − drag dt — so it is minimised over admissible action sequences and starting points exactly at , which is xmin (t). The clamp needs a separate argument, because as ≡ −amax from x0 = −xrange 0 it lowers both coordinates (to xwall from a larger x, and to 0 from a positive v), so a clamped trajectory is not dominated by its unclamped counterpart. Two elementary facts. The velocity recursion vs+1 = (1 − drag dt)vs − gain amax dt under full left thrust does not involve x,Pso the all-left trajectory started at rest from any x0 is x0 − L(t) for one and the same L(t) = −dt s≤t vs ; − L(t). And L is increasing, since v0 = 0 and vs ≤ 0 implies in particular xmin (t) = −xrange 0 vs+1 ≤ −gain amax dt < 0, the factor 1 − drag dt lying in (0, 1). Now let the clamp last fire at time τ , leaving the state (xwall , 0); after τ the dynamics are affine, so the minimisation above applies to the remaining t − τ steps and xt ≥ xwall − L(t − τ ) ≥ −xrange − L(t − τ ) ≥ −xrange − L(t) = xmin (t), 0 0 and the last by monotonicity of L. If the clamp never fires, the the middle step by xwall ≥ −xrange 0 first sentence of this step already gives it. Step 3: from the envelope to the bounds. r is the sum of a term decreasing in x and a term increasing in x, so on any interval it is at most the decreasing term at the left endpoint plus the increasing term at the right endpoint. Applying this on [xmin (t), xwall ], which contains xt by ¯ The lower bound is immediate from r > 0 and Steps 1 and 2, and summing over t gives J. xt ∈ [xmin (T ), xwall ], using that xmin is decreasing. so the bound reads |play cost| ≲ qhit (E) exactly when Jrand ≈ Jmin and Jtruth ≈ Jmax — the random policy near the reward floor, the truth planner near the ceiling. Both instruments are in this regime: on the cart Jrand = 0.53 against a pinned Jblind ≈ 0 and Jtruth = 17.77; on the pendulum Jrand = 0.06 and Jtruth = 20.08. The blind planner queries the wall region in every episode, so qhit (E) ≈ 1 and the normalized bound is saturated — play cost ≈ 1, as observed in Sections 4–5. On the cart the bound is nearly but not exactly saturated, and it is worth being precise about the gap rather than calling it attainment. With the derived normalizers of Proposition 12 — Jmax ≤ 18.0359 and Jmin ≥ 1.33 × 10−6 at xwall = 8 — and qhit = 1, the ceiling reads 18.0359/17.238 = 1.0463 against the play cost measured at that knob, 1.0299: the measurement sits at 98.4% of a bound with nothing measured in it. Deriving the normalizers rather than estimating them costs 47

almost nothing — the measured-supremum version of the same ceiling was 1.0445, so the proof is 1.0017× weaker — and it leaves no step in this display where an estimate stands in for a supremum. What is measured rather than implied is the informative part — the exploited planner reaches the realizable floor, Jblind ≈ Jmin — and that is what pushes play cost to the top of the range; the proposition supplies the ceiling, not the observation. The bound is not merely valid but essentially attained, because the optimal policy really is “push left and stay”: at xwall ≤ 6 the push-left trajectory realises J¯ to within 2 × 10−7 , so Jmax is known there rather than bounded, (scripts/play cost proved bounds.py, which also searches bang-bang, constant, single-switch and 4000 random block policies at each knob as a redundancy check on the derivation). The slack grows only as the wall approaches the right plateau and lets its tail in: 1.0000 at xwall ≤ 6, 1.0015 at 8, 1.0799 at 10. The floor J is attained near x = 2.70, where the left plateau’s tail has died and the right one has not begun; at xwall = 2 it is 2.87 × 10−6 , which is the measured Jmin to two digits. The same script asks how much of the pinning is derivable, since contact = 1.00 at every knob is the other measured input. Two of its three ingredients are structural. The wall is reachable in a small fraction of the horizon — 14 steps at xwall = 2 rising to 30 at 10, against T = 80, and this is the earliest possible contact because xt is maximised by full right thrust for the same monotonicity reason as above. And the blind model offers a return of 8.31 for going right against 5.70 for going left over the planner’s 40-step horizon, a ratio of 1.46: the asymmetry that makes right the argmax is a property of the reward, not of the sampling. The third ingredient is not derivable: nothing forces the argmax over 200 random block candidates to execute a positive first action, since a trajectory may go left before turning. That obstruction is real but it is about the wrong quantity. What the plan targets is a different question, and it admits a bound (scripts/phantom targeting probability.py). Fix a state s and let x̄ = xright − 2w. The same envelope argument as Proposition 12 — applied now under the blind model, over the planner’s horizon — bounds the imagined return of any candidate that never exceeds x̄ by an explicit U (s), while the full-right-thrust candidate achieves an explicit L(s). Wherever L(s) > U (s), any candidate scoring at least L(s) must exceed x̄, so if the sampled set holds one then the argmax’s trajectory reaches the phantom plateau: the planner is provably planning against reward the truth makes unreachable, which is the exploitation stated as a property of the plan rather than of the outcome. The gap closes at every state we checked, from +0.33 at (− 21 , 0) to +26.25 at (6, 5). What does not is the probability that the sampled set holds such a candidate, and the shape of that is the point. From rest it is negligible — 2 × 10−4 from an exactly computable sub-event (all four blocks above a threshold, where the score is monotone so the corner is the worst case), 5 × 10−3 estimated with a Wilson lower limit on the planner’s own sampling law. Once the cart carries rightward velocity it is 1.000 by both routes, from (2, 3) onward. So the statement is conditional: phantom-targeting is self-reinforcing, not self-starting. How the lure begins, the executed first action’s sign, and hence contact = 1.00 all stay measured. Proposition 13 (knob-invariance of play cost is arithmetic, not a regularity). Let the rarity knob k range over values for which the truth planner’s realized return Jtruth and the random policy’s return Jrand are exactly independent of k (an idealization: the measured departure and its propagated effect are quantified after the proof ). Then, directly from the definition of Section 2.2, play cost(k) =

Jtruth Jblind (k) − , Jtruth − Jrand Jtruth − Jrand | {z } knob-free

48

an affine function of the exploited planner’s own return with knob-independent coefficients, and hence constant up to max play cost(k) − min play cost(k) = k

k

maxk Jblind (k) − mink Jblind (k) , Jtruth − Jrand

Proof. play cost(k) = (Jtruth −Jblind (k))/(Jtruth −Jrand ) by definition; splitting the numerator gives the first display, whose first term is knob-free by hypothesis, and the second display is the range of an affine function with a negative knob-free slope. So the entire knob-dependence is the exploited planner’s residual reward divided by the truthminus-random margin, and a planner pinned with none gives play cost exactly Jtruth /(Jtruth −Jrand ). The two hypotheses are measured, and measured sharply: on the cart the truth planner’s return is knob-independent to twelve digits (Jtruth = 17.757356407381 at all seven knobs of the sharp variant, 17.772246981024 at all seven of the default), and Jrand varies across knobs by 3.9 × 10−9 on the sharp variant and 1.2 × 10−4 on the default — the random policy does occasionally enter the mode region, so its knob-independence is approximate rather than structural, and measurably less approximate once the plateau tail is removed. With those in hand the proposition is not decoration: it predicts every measured play cost to 2.4 × 10−10 on the sharp variant, and that residue is itself accounted for rather than left over: ∂ play cost/∂Jrand = (Jtruth − Jblind )/(Jtruth − Jrand )2 ≈ 0.060, which against Jrand ’s measured 3.9 × 10−9 knob-variation predicts 2.3 × 10−10 — the observed residue to one digit. On the default the same propagation of a 1.2 × 10−4 variation gives 7 × 10−6 , matching the 7.3 × 10−6 observed there. So the “knob-invariant play cost ≈ 1” of Section 4 is an identity once the planner is pinned, and what the sharp-plateau variant buys is not invariance itself but the vanishing of Jblind that makes the identity’s residual term negligible. What remains empirical is the pinning (contact = 1.00 and Jblind ≈ 0) and the truth planner’s indifference to the knob. The latter is not automatic — the clamp does change the imagined value of right-going candidates — so we do not leave it at bit-identity. A candidate’s imagined return under truth depends on the knob only if its imagined trajectory reaches the clamp, so it suffices to check, at every knob and every replanning step, that (C1) the argmax candidate’s imagined trajectory stays strictly below the smallest wall in the sweep, and (C2) every candidate that does reach the wall scores strictly below the argmax. C1 alone pins the argmax value but not the argmax candidate, and it is the candidate that determines the executed action, so the gap has to be closed explicitly. It is closed by the tie-break rather than by uniqueness: the planner keeps the first maximiser, the candidate enumeration depends only on (amax , rng, horizon, nsamples , block) and not on the knob, and C2 keeps every clamping candidate strictly below the top — so the first maximiser is the same knob-free candidate at every knob whether or not the top is attained twice. That distinction is not hypothetical: uniqueness fails in the sweep, because the reward saturates to 1.0 in floating point on the plateau and many candidates then score identically, so the script reports uniqueness as a diagnostic and the certificate rests on C1, C2 and the enumeration-order argument. The result is a machine-checked certificate over the planner’s own candidate set rather than an observation about outputs. scripts/truth plan invariance certificate.py runs it over the harness’s own 20 episodes per knob, the same scope as the runs the paper reports: the certificate holds at every knob of the sweep, with the argmax candidate never exceeding x = 0.344 and clamping candidates losing by a margin of 5.25 or more. Pushed past the sweep, the margin contracts monotonically — 4.12 at xwall = 11, 0.51 at 12 — and the certificate fails at 12.5, where the argmax candidate itself reaches the wall. So the regime has a derived boundary at xwall ≈ xright = 12: the truth planner switches to the right plateau exactly once the wall stops blocking it, which is also where the mode

49

stops being a trap and there is no danger left to measure. The sweep [2, 10] sits inside the certified region with a wide margin.

C

What the gate does certify: coverage certificates for Lipschitz pairs

What the gate does certify: the continuous coverage analogue. The companion paper’s coverage certificates enumerate finite information-set spaces, and continuous state spaces admit no such enumeration. A covering-number analogue is available in its place, built from the disagreement ball of Proposition 9 and the visitation density of Remark 4. Proposition 14 (coverage certificate for Lipschitz models). Let f, fˆ be L-Lipschitz on U ⊆ S × A in the sup-metric, and suppose fˆ passes the gate at tolerance ε on every visited transition. If the visited set is a ρ-net of U , then sup ∥f (u) − fˆ(u)∥∞ ≤ ε + 2Lρ. u∈U

Moreover, if the gate’s per-step visitation density is at least c on U and M independent samples are drawn, then the visited set is a ρ-net with probability at least 1 − δ as soon as
ln Npack (U, ρ/2)/δ
, M ≥ c · inf u∈U vol B(u, ρ/2) ∩ U where Npack (U, ρ/2) ≤ vol(U ⊕ Bρ/4 )/vol(Bρ/4 ). Proof. For the first part, take u ∈ U and let v be a visited point with ∥u − v∥∞ ≤ ρ; then ∥f (u) − fˆ(u)∥ ≤ ∥f (v) − fˆ(v)∥ + ∥f (u) − f (v)∥ + ∥fˆ(u) − fˆ(v)∥ ≤ ε + 2Lρ. For the second, fix a maximal (ρ/2)-packing of U ; it is a (ρ/2)-cover, its cardinality is bounded as stated (the disjoint (ρ/4)-balls sit inside U ⊕ Bρ/4 ), and each packing point’s (ρ/2)-ball has probability at least p = c vol(B(u, ρ/2) ∩ U ) — only the part inside U , since that is where the density is assumed. For the corner evaluation: a sup-ball of radius ρ/2 around a corner of an axis-aligned box all of whose extents are at least ρ/2 meets the box in exactly one orthant of the ball. (Shearing does not preserve that ratio, since the ball is defined by the sup-metric; the sheared case is computed numerically.) The chance that some such ball receives no sample is at most Npack (1 − p)M ≤ Npack e−pM , which is ≤ δ under the displayed condition; when every ball is hit, each u ∈ U lies within ρ/2 of a packing point that holds a visited sample, hence within ρ of a visited point. Two details in that display are easy to get wrong in the loosening direction. The cardinality that enters is the packing number, which dominates the covering number, so an upper bound on it is what the union bound needs. And the ball mass must be intersected with U : the density is hypothesized only on U , so a packing point on ∂U keeps only the part of its ball inside. If U is an axis-aligned box with every extent at least ρ/2, the infimum is attained at a corner, where exactly one orthant survives:
inf vol B(u, ρ/2) ∩ U = 2−(d+m) vol(Bρ/2 ). u∈U

That equality is not shear-invariant, and the cart’s U is a sheared box: the sup-ball is axis-aligned while the region is not, so the slanted constraint clips the corner cap a little further. Computed rather than asserted, the factor is 0.950 · 2−(d+m) at the certified ρ — a 5% effect, which is exactly the size of error that hand-asserted geometry produces, which is why the script computes it. For 50

a region that is a union of cells rather than a box there is no orthant argument at all, and the step-t instantiation below uses a shape-free bound instead: if u’s cell has diameter at most ρ/2 then the whole cell lies inside B(u, ρ/2), so the ball mass is at least c vol(C) times the surviving action interval. Instantiated on the deployed cart gate (scripts/gate coverage certificate.py; U the step1 reachable set of Corollary 4, c = 5/6, L = 1.27, ε = 0.01, δ = 0.05): one step per rollout — the reading that needs no assumption about steps within a rollout — gives ρ = 1.165 from N = 40 rollouts, certifying supU ∥f − fˆ∥∞ ≤ 2.97. (The corner hypothesis is satisfied, if barely: U ’s narrowest extent is 0.6 against ρ/2 = 0.583.) The wall’s own disagreement is 4.2, which exceeds that — but the bound grows with L, so what the certificate excludes is precisely a pair with L = max(Lipf, Lipfˆ) ≤ 1.80 carrying an error of 4.2 on this region. That is a real but narrow class: a model smoother than the plant (1.27) cannot hide the wall’s magnitude from this gate, a twice-rougher one can. The wall itself escapes by not being Lipschitz at all. A partition beats a packing, and here it is exact. A packing argument pays for the covering number twice, once in the cardinality K and once in the ball mass, and both payments are geometric factors that have to be estimated — each one a place where hand-asserted geometry can silently loosen the bound. A partition argument pays neither, and on this instrument its cell probabilities are not estimated at all. Proposition 15 (coverage by partition). Let {C1 , . . . , CK } be a measurable partition of U with diam∞ (Ci ) ≤ ρ for every i, and let qi be the probability that one gate sample lands in Ci . After M P i.i.d. samples the visited set is a ρ-net of U with probability at least 1 − i (1 − qi )M . In particular, if the sampling law is uniform on U and the partition has equal volumes, qi = 1/K exactly and the failure probability is K(1 − 1/K)M . Proof. Ci receives no sample with probability (1 − qi )M ; union-bound. If every cell holds a sample then each u ∈ U lies in some Ci together with a visited point, at sup-distance at most diam∞ (Ci ) ≤ ρ. No density constant, no covering number, no ball–boundary intersection appears. What makes the cart’s gate a case where this is exact rather than merely cleaner is a change of coordinates: the step-1 law is uniform on U = {|v| ≤ V, |x − dt v| ≤ 12 , |a| ≤ amax }, and in y = x − dt v that is uniform on a box [− 12 , 12 ] × [−V, V ] × [−amax , amax ], the shear having unit Jacobian. Equal sub-boxes therefore have probability exactly 1/K. The shear costs something in one place only — the net radius must be measured in the original metric, where |x − x′ | ≤ ∆y + dt ∆v , so
ρ = max ∆y + dt ∆v , ∆v , ∆a . At the deployed M = N = 40 (one step per rollout, so the samples are genuinely independent) the largest admissible partition is K = 8, since 8 · (7/8)40 = 0.038 ≤ δ while 9 · (8/9)40 = 0.081 exceeds it. Optimising the split gives (ny , nv , na ) = (2, 1, 4), hence ρ = 0.600 and sup ∥f − fˆ∥∞ ≤ ε + 2Lρ = 1.534 U

(scripts/gate partition certificate.py), against 2.97 by the packing route — a factor of two, bought entirely by changing the argument rather than by any new measurement or assumption, and with no Monte Carlo anywhere in it. What pins ρ is visible in the optimum: it takes nv = 1, i.e. ∆v = 2V , the whole reachable velocity range. At forty independent samples the certificate cannot resolve velocity at all, and that is a fact about the gate rather than about the proof. 51

The same partition composes with the dependence treatment, and that is what finally answers the mixing question. Proposition 15 needs only per-cell hitting probabilities, so instead of one step per rollout take pC = P (one rollout puts no sample in C) — a plain Bernoulli parameter whatever the within-rollout dependence does — measure it directly, and use P (C unhit) = pN C , which is exact because rollouts are i.i.d. A rollout gets eighty chances at U rather than one, worth about six effective independent samples after the correlation between consecutive steps, and the finest partition the deployed gate certifies grows from K = 8 to K = 36. Here the certificate stops being sampling-free, so the accounting has to be explicit. pC is estimated on 20,000 gate rollouts drawn once and shared by every candidate partition, while the candidate family itself is geometric and fixed before any rollout is drawn (one coarsest partition per target radius, 26 of them), so the only data-dependent choice is which member is certified. Hoeffding is applied at level δ/(3K) per cell, so that pC ≤ p̂C + t holds simultaneously across all K cells with probability 1 − δ/3 and the selected worst cell needs no further correction; the remaining δ/2 pays for the gate’s own miss, 5δ/6 ≤ δ in total. At K = 36 the worst cell is p̂C = 0.800, bounded above by 0.814, giving 36 · 0.81440 = 0.010 ≤ δ/2 and ρ = 0.363,

sup ∥f − fˆ∥∞ ≤ 0.933. U

Selecting K against the sample is p a multiple comparison, and it costs nothing here. Because Hoeffding’s radius grows only like log(1/level), widening the Bonferroni correction from one partition’s cells to every cell of every candidate in the family (9674 tests) raises the bound on the worst cell to 0.818 and the failure probability to 0.012, and still selects K = 36; a further factor of 1000 in the family size changes neither. Replacing Hoeffding by an exact-binomial Clopper– Pearson bound at the same level gives 0.809, and also selects K = 36 — so 0.814 is slack in the inequality rather than calibration, and ρ = 0.363 is an artifact of neither the search nor the concentration inequality. The next candidate up (K = 48, ρ = 0.333) misses the threshold by a factor of 4.5, which is far more than any correction can bridge in either direction (scripts/ certificate simultaneity.py). One inconsistency in the budget: the K = 8 certificate above spends the whole of δ on the coverage event while this one spends δ/2, so 1.534 and 0.933 are 1 − δ statements against slightly different budgets. The three readings line up: 2.97 if one insists on a packing argument, 1.534 from an exact partition on independent samples, 0.933 once the withinrollout dependence is priced exactly — against the 0.43 that assuming all 3200 steps independent would promise, an assumption the plant itself refutes (the trajectory determines every action; next paragraph). Handling the dependence exactly, rather than discarding the within-rollout steps, is worth a factor of 1.6. And the sharper radius widens the excluded class: since ε + 2Lρ grows with L, a bound of 0.933 at ρ = 0.363 excludes any pair with L = max(Lipf, Lipfˆ) ≤ 5.77 carrying the wall’s error of 4.2 — now 4.5× the plant’s own constant rather than 1.4×, so “no smooth pair can carry the wall’s error past this gate” covers a genuinely broad class of models rather than a sliver. Using all the steps, without assuming they are independent. The obvious objection is that the gate takes 40 × 80 steps and the above uses 40 of them. The natural repair fails, and in the direction that flatters the gate. Conditioning on a rollout’s entire state trajectory does not leave the action indicators at the visiting times independent Bernoulli(qa ), which would give an exact per-rollout factor E[(1 − qa )O ]: under this plant the action is recoverable from consecutive states, at = ((vt+1 − vt )/dt + drag vt )/gain, so conditioning on the whole trajectory determines every action and the conditional indicator law is degenerate. The gate policy gives at ⊥ st , not at ⊥ (s0 , . . . , sT ).

52

The repair is to notice that no factorization was needed. Only one independence fact enters, and it is a property of the design rather than of the dynamics: the N gate rollouts are i.i.d. So with pC = P (one rollout puts no sample in C) — a plain Bernoulli parameter, whatever the within-rollout dependence does — P (C unhit by the gate) = pCN

exactly,

and pC is estimated by counting rollouts that miss C, with Hoeffding for the upper bound. Nothing is assumed about how steps within a rollout correlate because nothing needs to be. Two implementation conditions the bound depends on: the grid must have every cell no wider than ρ (an integer division with index clamping leaves the last cell wider than ρ — 0.8 at ρ = 0.6 — so “all cells hit” certifies a coarser net than the one claimed), and the falsification test below must use the same grid, or a grid mis-specified in exactly this way passes its own test. This pC route is what the previous paragraph’s partition composes with, and on U it is what gives the 0.933 quoted there. Instantiated instead on a box 6.7× larger (|x|, |v| ≤ 1, |a| ≤ 1; scripts/gate coverage dependent.py, 8000 MC rollouts) the deployed N = 40 certifies a net radius of 1.0, i.e. ≤ 2.55, and misses the next resolution by two rollouts — radius 0.667 needs N ≥ 42, radius 0.5 needs N ≥ 194. Those are not competing numbers but the region/resolution trade-off at fixed N : a larger region costs resolution, and forty rollouts buy little of either. Treating all 3200 steps as independent is doubly invalid — it assumes an independence the plant refutes and uses the step-1 density at steps t ≥ 2 — and the numbers it promises (ρ = 0.305, bound 0.785) are not bounds: the valid all-steps answer, 0.933, sits a factor of 1.2 above them. The binding constraint is not how steps correlate but how many rollouts reach the worst cell. The density at every step, and what it buys. The certificate above lives on the one-step reachable set because that is where Corollary 4 derives the density. The restriction lifts: the plant is linear and time-invariant, so (xt , vt ) is an affine image of (x0 , a0 , . . . , at−1 ), and splitting off the last two actions gives (xt , vt ) = Wt +M (at−1 , at−2 )⊤ with M the (time-invariant) Jacobian, columns in that order,   gain dt2 gain dt2 (1 + (1 − drag dt)) M= , | det M | = 0.009 gain dt (1 − drag dt) gain dt (verified against finite differences). Wt is independent of those two actions, so at every t ≥ 2 the step-t law is the convolution of Wt ’s law with the uniform law on the parallelogram P = M [−amax , amax ]2 , of area 4a2max | det M | = 0.036. Hence, for every u, an identity rather than a bound:
pt (u) = 27.78 · P Wt ∈ u − P . Two details separate that identity from the object Proposition 14 consumes, and both tighten the region (scripts/gate density step t.py). The proposition wants the density of (s, a) on R3 , not of (x, v) on R2 ; since a is uniform and independent, p3D = p2D /2amax , the same factor the step-1 corollary carries. And the hypothesis is an infimum over the region, whereas binning samples and dividing by cell volume estimates a cell average, which does not bound it. The exact route is the reason the cells are shaped like P itself: for C = c0 + λP and any u = c0 + λp ∈ C, every w = c0 − (1 − λ)q with q ∈ P has u − w = λp + (1 − λ)q ∈ P by convexity alone, so u − P ⊇ c0 − (1 − λ)P and
inf pt (u) ≥ 27.78 · P Wt ∈ c0 − (1 − λ)P , u∈C

53

a genuine pointwise infimum, Monte-Carlo estimated with a Wilson lower bound per cell over a cell family fixed in advance — 9806 cells inside the region box, which is the correct Bonferroni denominator because which cells receive a bound is itself data-dependent — at the per-cell level δ/9806 that makes the bounds hold simultaneously, i.e. z = 4.41. Selecting a level set afterwards is then legitimate. Parallelograms tile, which is what makes such cells usable; an axis-aligned grid is not an option here, because P is a sliver 0.12 by 1.19 and eroding it by any useful square leaves nothing. The tiling and the inclusion are theorems; what needs measuring is the price of the erosion, and the bound sits below a separately measured density by the predicted factor (1 − λ)2 . What the derivation delivers is the (c, U ) pairs, and they are substantial: at step 20 the level set {p ≥ 0.05} has volume 3.02 in (x, v, a) against the one-step set’s 1.2, at step 40 {p ≥ 0.02} has 5.77, and at step 80 {p ≥ 0.01} still has 5.27. The certified region must be a level set and not a box: a box’s corners pair extreme x with extreme v, which the gate does not reach, so an infimum over a box is 0. What does not survive is the claim that later steps buy a better certificate. They buy extent at the price of density, and at fixed N that is a losing trade — so badly that with a shape-free bound on the ball mass, N = 40 certifies nothing on any step-t level set. A union of cells admits no orthant argument, so the only bound available without a shape hypothesis is cell containment (C ⊆ B(u, ρ/2) whenever diam C ≤ ρ/2), and that ignores the cell’s neighbours, making it loose by a large factor. So this is not a proof that the gate certifies nothing on these regions; it is that no rigorous step-t certificate exists at this gate size: the shape-free route is loose by construction, and no sharper geometric factor is asserted here without verification. The conclusion that matters is unaffected either way: the step-1 corollary’s 2.97 stands, lifting the step-1 restriction did not improve it, and what limits the certificate is the gate’s size and not the step index. And no level set at any step reaches the wall, which is the same boundary the corollary ran into. One Jacobian identity covers the whole semi-implicit family; the certificate’s density hypothesis is still verified per instrument. The step-t derivation above used the cart’s linearity, and the natural worry is that a nonlinear plant needs its own argument for the two-action factor. It does not. For any plant of the semi-implicit form
ωt+1 = ωt + gain · at + F (θt , ωt ) dt, θt+1 = θt + ωt+1 dt, with F ∈ C 1 arbitrary, the Jacobian of the last two actions satisfies det ∂(θt , ωt )/∂(at−2 , at−1 ) = gain2 dt3

identically,

independent of F , of the state and of t. Writing Fθ , Fω for the partials: ∂ωt /∂at−1 = gain dt and ∂θt /∂at−1 = gain dt2 ; ∂ωt /∂at−2 = gain dt(1 + Fω dt) + Fθ gain dt3 and ∂θt /∂at−2 = gain dt2 + dt ∂ωt /∂at−2 ; substituting, every F -dependent term cancels and the determinant is −gain2 dt3 . Checked numerically against four forces including a non-separable one, at several (gain, dt), to ten digits. So the geometric factor c = 1/(4a2max gain2 dt3 ) = 27.78 is the same for the cart and the pendulum: on any event where the last two steps are clamp-free and the target point lies in that history’s two-action image, the conditional density is exactly c. What the identity does not by itself give is the certificate’s hypothesis — a lower bound on the marginal density over a region — because the marginal at a point is c times the fraction of histories whose two-action image covers it, and the identity says nothing about that coverage fraction, which can be zero. Turning the factor into a bound requires showing a positive fraction of histories covers the region, which the cart derivation does by erosion and direct measurement (scripts/gate density step t.py) and which we have not established for the pendulum’s nonlinear F : the certificate’s hypothesis is verified where the 54

certificate is used, not inherited from the family. Its scope is exactly the hypothesis: the action must enter as an additive gain · at in the velocity update. PatchField2D is therefore outside it — there the action sets a force direction, a 7→ gain(cos ϕ, sin ϕ) with ϕ = πa/amax , so the two-action map is not affine in the actions and the determinant is not constant. Within the family there is one further exception, and it is the expected one: wherever the mode clamp fires, the two-action map is constant, so det = 0 exactly and no density argument reaches the mode. The obstruction is intrinsic, not a limitation of this technique. But the certified region is not where the planner looks. The certificate bounds the model on the region the gate covers; the play cost is driven by the region the planner queries (Proposition 8). Those are different measures, and the way to relate them is to measure the overlap (scripts/certified region query mass.py: every imagined MPC step is a query). Of the exploited planner’s 1.3 million queries per episode pair, 1.9% fall inside the box |x|, |v| < 1 — the region the dependence-exact certificate covers — and 7.8% inside |x| < 3, |v| < 2, a box that contains every step-t level set and therefore upper-bounds the certified share; for the truth planner, 2.3% and 7.3%. So the certificate is valid — its bound holds with probability at least 1 − δ over the gate’s draws — and nearly irrelevant to play: not because the bound is loose — it is conservative by about 5% in N — but because the gate covers a couple of percent of the query mass. That is this paper’s thesis restated as a measurement rather than an argument, and it is the reason the continuous coverage analogue, once obtained, does not rescue sampling verification: the gate certifies where it looks, and the planner looks somewhere else. Is the bound tight? A bound that merely holds could be loose by orders of magnitude; measured against independent oracle gates, the partition certificate is essentially exact. Running 400 independent gates against the certificate’s own partition (scripts/gate partition validation.py, which reads the partition from the certificate’s output rather than re-implementing it): the K = 8 exact partition is covered in 384/400 trials, a measured failure rate of 0.0400 with 95% interval [0.0248, 0.0640] against the certificate’s union bound of 0.0383. The right comparison here is the interval against the bound, not the point estimate: for a bound this tight the estimate lands above it about half the time, and an independent oracle says how tight it is. Inclusion–exclusion in exact rational arithmetic gives the true failure probability of the K = 8 experiment as 0.038038, so the union bound is loose by 0.73% and the measurement sits within noise of the exact value; the same computation shows K = 9 fails at 0.0794, so K = 8 is the largest admissible partition under the exact probability and not merely under the union bound — the cap is the gate’s size, not the proof. The K = 36 all-steps partition is covered in 400/400, failure [0, 0.0095] against a bound of 0.0096, so there the Hoeffding slack is finer than 400 trials can resolve. The 400-gate test checks the coverage event; it does not check the quantity the K = 36 certificate actually rests on, which is the estimate p̂C . That is checked separately: re-measuring pC for the same partition on a disjoint 20,000-rollout stream moves the worst cell from 0.8001 to 0.7996 — 3.6% of the Hoeffding radius that bounds it, with the same binding cell (2, 0, 3) — and the certificate holds on the fresh sample. So 0.814 is slack in an inequality, not calibration to one stream. For the coarser box-region certificate the older test still applies (scripts/gate coverage validation.py): coverage at net radius 1.0 in 200/200, 198/200 at 0.667 where the certificate declines to license it (asking N ≥ 42 against 40), then 128/200 at 0.5 and 10/200 at 0.4, where it asks for 194 and 2189. What the numbers exclude matters more than the numbers. The hard mode’s own disagreement is 4.2 (the wall-region probe error of Section 10), above every bound above — but the certificate buys ε + 2Lρ, which grows with L, so the statement carries a quantifier that the radius sets: at the

55

best rigorous radius, ρ = 0.363, no pair with L = max(Lipf, Lipfˆ) ≤ 5.77 can carry an error of 4.2 past this gate on this region, with probability at least 1 − δ over the gate’s draws. That is 4.5× the plant’s own 1.27, so it is a broad class rather than a sliver — and the scope came from fixing the argument, not from a new experiment: the packing instantiation’s ρ = 1.165 would have licensed only L ≤ 1.80. The wall does pass the gate, escaping by the only route left, namely by not being Lipschitz at all. The continuous coverage analogue therefore closes exactly the case the paper says it closes (smooth models) and is silent exactly where the danger lives (the discontinuous reset modes), which is the same boundary Proposition 9 draws.

D

The detectability rate, and the gate’s visitation density

Proposition 16 (smooth localized error is detectable at a rate). In the setting of Proposition 9 with L > 0, let ρ = (η − ε)/2L be the radius of the guaranteed disagreement ball B ⊆ Eε . Fix a step index k ≤ T and suppose the gate’s step-k visitation law admits a density bounded below by c > 0 with respect to Lebesgue measure on B. If moreover the disagreement is centred at sup-distance at least ρ from ∂(S × A), so that the ball is not clipped, then one gate rollout reveals the disagreement with probability at least   η − ε d+m d+m q = c (2ρ) = c L (the sup-metric ball is a cube of side 2ρ). Without the interiority hypothesis the same argument gives q = c vol(B ∩ (S × A)), which for a box-like S × A is at worst 2−(d+m) of the above (Corollary 3: a corner keeps one orthant, a face costs a single factor 2); for a general region no such uniform factor exists, and the intersected volume must be computed. By Proposition 1 the gate’s miss probability is at most (1 − q)N . Equivalently — what it takes to hide — keeping the miss probability above δ against N rollouts forces  1/(d+m) cN L ≥ (η − ε) . ln(1/δ) Proof. B ⊆ Eε by Proposition 9, and the step-k visitation of B has probability at least c · vol(B) = c(2ρ)d+m by the density hypothesis; a rollout that visits Eε at step k reveals a disagreement, so the per-rollout reveal probability is at least q and the critical event of Proposition 1 has r ≥ q, giving P (miss) = (1 − r)N ≤ (1 − q)N . For the converse, (1 − q)N > δ requires q < 1 − δ 1/N ≤ ln(1/δ)/N ; substituting q = c((η − ε)/L)d+m and solving for L gives the display. Three readings. (i) It is the measure counterpart of Proposition 9: smoothness does not merely forbid exact localization, it forces a detection rate. (ii) The Lipschitz constant needed to hide a fixed error grows only like N 1/(d+m) , so whenever cN/ ln(1/δ) > 1 — comfortably true here, where it is 48 — raising the dimension lowers that constant and hiding gets easier with dimension (below 1 the exponent flips the comparison, so the reading is not dimension-free) — the same dimensional loosening paper 3 studies as a rarity knob. (At fixed c is the honest qualifier: c carries dimensions of inverse volume, so the dimension-free way to say it is Remark 4’s volume ratio — the ball’s share of the reachable set shrinks with dimension at fixed radius.) (iii) The hypothesis is where the work is: verifying a visitation-density lower bound is instrument-specific. Our gate’s step-0 law is supported on a lower-dimensional set (the initial-state distribution has v = 0 exactly), so nothing can be claimed there; from step 1 on the actions supply the missing direction and c is derivable, which is what Corollary 4 does. Alongside the derivation we have the direct measurement: the smooth bump arm of Section 5 has reveal-rarity 0.18 against the hard wall’s 0.14 at comparable amplitude

56

— the smooth error is, if anything, more detectable, exactly as this proposition’s direction requires, and its harmlessness comes from play cost ≈ 0 rather than from hiding. Remark 4 (the constant in general: a volume ratio). Proposition 16’s c is not an instrument-specific fudge; it is the gate’s step-k visitation density, which for a gate policy with box-uniform initial states and actions is available in closed form by change of variables. If the step-k law of (s, a) is uniform on a set U ⊆ S × A — as it is at k = 1 whenever the one-step map is affine in the randomized coordinates — then c = 1/vol(U ) exactly, and — provided the ball is contained in U , which is a separate condition from Proposition 16’s interiority hypothesis (that one concerns ∂(S × A), this one ∂U ) and is what makes the ratio a probability at all — the proposition’s conclusion reads q ≥

vol(B) , vol(U )

the fraction of the gate’s one-step reachable volume that the guaranteed disagreement ball occupies. For non-uniform laws the same computation goes through the pushforward, but the extrema live on the source space: with F the one-step map, injective on the relevantset, the change of variables gives pU (u) = p0 (F −1 u)/| det DF (F −1 u)| and hence c = inf F −1 (B) p0 supF −1 (B) | det DF |. Without injectivity the density is a sum over preimages and this is only a lower bound (which is the direction we need). The uniform case is the one where numerator and denominator are constant. The dimensional reading of Proposition 16 is then geometric rather than analytic: hiding is easy exactly when the ball is a small fraction of the reachable volume, and raising d + m shrinks that fraction for fixed radius. Corollary 4 (the constant, computed for this instrument). For the cart’s gate at step k = 1 the density hypothesis is not an assumption: the gate policy gives v1 = gain · dt · a0 with a0 ∼ U (−amax , amax ), x1 = x0 + dt v1 with x0 ∼ U (− 21 , 12 ), and a1 ∼ U (−amax , amax ) independent, so on {|v1 | < gain dt amax } ∩ {|x1 − dt v1 | < 12 } ∩ {|a1 | < amax } the joint (x1 , v1 , a1 ) density is constant — not a product of marginals, since x1 = x0 + dt v1 makes x1 and v1 dependent, but constant on that sheared set, with the value the three normalizations give because the shear has unit Jacobian: c =

1 1 5 ·1· = 2 gain dt amax 2amax 6

at gain = 3, dt = 0.1, amax = 1

(d + m = 3 here). Equivalently, by Remark 4, the step-1 law is uniform on a set of volume vol(U ) = (2 gain dt amax ) · 1 · (2amax ) = 1.2 and c = 1/1.2 = 5/6 — the reveal probability is literally the ball’s share of the one-step reachable volume. Monte Carlo on an interior box agrees to 1.3% (scripts/gate density constant.py). Proposition 16 is therefore quantitative on this instrument: hiding an η-sized disagreement centred where this density holds from the deployed gate (ε = 0.01, N = 40) with probability above 12 requires  L ≥ (η − ε)

5/6 ln 2/40

1/3 = 3.636 (η − ε),

i.e. L ≥ 1.78 for η = 0.5 and L ≥ 3.60 for η = 1, against the plant’s own sup-metric Lipschitz constant of 1.27. Three scope conditions decide what this corollary does and does not say. The first is the proposition’s own interiority hypothesis. Because L scales with η − ε in this instantiation, the ball’s radius is the same ρ = 1/(2 · 3.636) = 0.1375 in every row, and the ball is a full cube only for centres at sup-distance ρ from ∂U — which is 33.9% of U ’s volume. On the 57

remaining two thirds the clipped-ball form applies and q is smaller, by up to 23 (Corollary 3 at k up to d + m = 3 clipped coordinates). Second, since f is the plant, L = max(Lipf, Lipfˆ) ≥ 1.27 always, so the constraint has content only above η ≈ 1.27/3.636 + ε ≈ 0.36: rows below that are satisfied automatically and prove nothing. At η = 0.5 the requirement L ≥ 1.78 does bite — a pair no rougher than 1.4× the plant cannot hide an error of that size here. Third, and most restrictive: this route says nothing about the wall. The density c = 5/6 is supported on the one-step reachable set, i.e. |x1 | < 0.53, while the mode sits at xwall ∈ [2, 10], where the step-1 visitation density is exactly zero and Proposition 16 is vacuous. Nor does the guaranteed ball bridge the gap: at L = 1.27 its radius is 1.65, and reaching |x| ≤ 0.53 from x = 8 would need an L below the plant’s own. So the supported statement about the hard mode is not a theorem from this corollary but the measurement of Section 5 — the wall is detected at rate 0.14, and the smooth bump at 0.18, so the smooth error is if anything the more visible of the two, exactly as this proposition’s direction requires — together with Proposition 9’s qualitative obstruction, which needs no density and therefore holds at the wall. The smooth arms’ harmlessness comes from play cost, not from invisibility. That the quantitative route reaches only a neighbourhood of the origin is not a technical gap to be papered over: it is the same fact the rest of the paper is about, that a sampling gate’s guarantees live where it looks. Remark 5 (metric, not measure). The ball in Proposition 9 is metric, and its probability under the gate’s visitation measure can still be small — smoothness bounds how spatially concentrated an error can be, not how often the gate visits it. The proposition removes the exact localization premise for smooth pairs; the (1 − r)N mechanism itself is representation-independent and applies to any critical region of small visitation measure.

E

A second planner family: play cost is planner-dependent

Proposition 8 bounds play cost by the planner’s query-hit probability on the disagreement region: a blind model can change behavior only to the extent that the planner queries where it is wrong. That is an upper bound and therefore only one implication — low query reach forces low play cost; high query reach permits but does not force high play cost — so “two branches” below names two measured regimes that sit at the two ends of the bound, not a dichotomy the proposition predicts. Random-shooting MPC’s constant candidates reach the distant phantom plateau in imagination and produce play cost ≈1. We repeated the full 11-knob grid with a second base planner, the cross-entropy method (CEM; scripts/continuous cem.py; horizon 40, 5 iterations, 64 samples, elite fraction 0.125, minimum standard deviation 0.05; one fixed setting across both instruments). The crossing columns in Table 9 are the fraction of sampled imagined trajectories that cross the omitted boundary, measured for BOTH planners with one plan from the same paired initial state per episode seed (episode-accumulated CEM fractions, which tell the same story, are recorded in the results JSON). CEM’s blind-model play cost lies in [−0.0213, 0.0248] on every row — and the seed-paired 95% t-interval includes zero on all 11 rows — while its imagined crossing fraction is strictly below MPC’s throughout. Two of those eleven intervals deserve their asterisk. On the five cart rows every perseed difference is 0.0 exactly, so the interval is degenerate [0, 0] and “includes zero” is a restatement of bit-identity rather than an inference; we report it as bit-identity in the prose for that reason. On the pendulum rows the standard deviation is inflated roughly fortyfold by one seed (index 16, differences −0.427 to −0.423 across three knobs), so the interval is a real interval but its width is that outlier’s, not a noise scale. On the cart, truth- and blind-model CEM returns are identical and 58

instrument

knob

pc MPC

pc CEM

contact CEM

crossing CEM

crossing MPC

cart cart cart cart cart pendulum pendulum pendulum pendulum pendulum pendulum

2.0 4.0 6.0 8.0 10.0 0.8 1.0 1.2 1.4 1.6 2.0

1.031 1.031 1.031 1.030 0.977 1.002 1.002 1.000 0.997 0.990 0.942

0 (exact) 0 (exact) 0 (exact) 0 (exact) 0 (exact) 0.009 0.025 −0.011 −0.021 −0.021 5.0×10−4

< 0.16 < 0.16 < 0.16 < 0.16 < 0.16 0.70 0.25 < 0.16 < 0.16 < 0.16 < 0.16

0.0309 0.0055 0.0003 1.4e-05† < 2.3e − 06 0.1150 0.0483 0.0164 0.0053 0.0013 0.0002

0.3865 0.2453 0.1483 0.0773 0.0369 0.6392 0.5530 0.4672 0.3842 0.3039 0.2158

Table 9: The same gate-accepted, mode-blind models under two base planner families (20 paired episodes/row). “pc” is blind-model play cost within that planner family; crossing is the sampled imagined-boundary-crossing proxy for query-hit mass, one plan per episode seed from paired initial states for both planners. CEM stays near zero play cost and below MPC’s crossing fraction on every row. contact is zero everywhere. The nearest pendulum stops are a real qualification: CEM contacts θstop = 0.8 in 70% of episodes and 1.0 in 25%, but does not enter MPC’s pinned, below-random regime; contact is zero from θstop ≥ 1.2. Contact is therefore not itself exploitation. One caveat before crediting Proposition 8 with this. The bound is in terms of qhit (E), the probability that at least one query in an episode lands in the disagreement region, whereas the crossing column is the fraction of imagined candidates that cross. With ∼200 candidates × 40 imagined steps per replan, any nonzero crossing fraction makes qhit (E) ≈ 1 and the bound ≲ 1 — true but vacuous. The two cart rows that printed crossing 0.0000 invited a stronger reading — that qhit = 0 there forces play cost = 0 — and re-measuring them refutes it for one of the two. Those zeros were censored at 6400 sampled trajectories; at 200× that sample (scripts/cem crossing bound.py, 1.28 million imagined trajectories per row) the row at xwall = 8 produces 18 crossings, a per-trajectory rate of 1.4 × 10−5 , and the event that the episode’s first plan crosses gives a lower confidence bound qhit (E) ≥ 0.0029. So qhit is not zero on that row and nothing is forced. At xwall = 10 the zero survives the 200× resampling (0 of 1.28 million, per-trajectory rate < 2.3 × 10−6 ), but it remains a censored zero and the object the data support is an upper bound: measured directly at episode scope, qhit (E) ≤ 0.058 at 95%, so Proposition 8 caps |play cost| at 0.058 times the normalizer ratio rather than at 0. The correct statement is therefore an inequality on both rows and on the other nine: the bound gives a small nonzero ceiling that the measured play cost respects, and the planner-dependence result is empirical. The crossing fraction is in any case a proxy — it counts candidate trajectories, while the bound is about at least one query per episode — and with ∼200 candidates × 40 imagined steps per replan any nonzero fraction pushes the episode-level probability towards 1, which is why the direct episode-scope measurement is what we quote. What survives in either reading is Section 2.3’s first lesson — if search does not discover the phantom, it cannot optimize toward it. Two caveats prevent the wrong conclusion. CEM’s pendulum truth return varies from 15.36 to 16.46 (versus MPC’s 20.08), consistent with local optima; the comparison is blind-CEM against truth-CEM, not a claim that CEM is globally optimal. And limited reach is not knowledge or mitigation: a planner that misses a phantom distant reward can also miss a real one. This is one fixed CEM configuration, not a hyperparameter sweep. 59

PatchField2D: CEM shows no 2D competence gap. On the 4D bi-modal instrument (scripts/continuous cem patch2d.py) blind CEM is again not exploited: play cost is −0.022/+0.017/+0.020 at knobs (2, 6)/(3, 7)/(4, 8) with the seed-paired 95% t-interval including zero on all three rows, and CEM’s imagined crossing fraction is below MPC’s on every row (0.070 < 0.208, 0.027 < 0.149, 0.009 < 0.094). Here CEM is competent in aggregate — no 2D competence gap appears — but with per-seed variance (one truth-CEM episode at ≈ 0.97), and its blind contact rate is a uniform 0.05 (nonzero, unlike the cart’s 0.00, and without positive play cost). The same low-query-reach branch of Proposition 8, one more instrument.

F

Planner-side mitigation: distrust-region replanning

The exploitation measured in Sections 4 and 5 is planner-mediated, not model-mediated, and a planner-side fix collapses it without touching the model or the gate — this does not contradict the danger law (the gate still accepts a wrong model; Proposition 5 is untouched). Like those sections, this one uses the hand-written instruments and blind models, not LLM synthesis. Distrustregion replanning (src/cwm/continuous/mitigation.py, strictly additive) compares the model’s prediction against the observed transition after every real step (tol = 10−6 ); a disagreement records the position of the model’s refuted prediction — not the pre-state — as a one-sided fence, since false predictions always lie on or beyond the mode boundary. While scoring a candidate rollout, the first imagined step whose position interval crosses a fence’s ε-band (ε = 0.25 cart, ε = 0.1 pendulum) truncates the rollout — reward kept, everything downstream dropped — which makes the fence leap-proof at any imagined speed; candidates are then ranked by (truncated return, distance to the nearest fence), which structurally prefers the real side in one dimension. The qualifier is load-bearing: the tie-break is an unsigned distance, so in 1D, where the fence lies beyond the boundary and the real side is the only other direction, maximizing it flees the mode — but in 2D it is symmetric between rounding the patch and plunging through it, and Section F.1 measures what that costs. With zero violations this is bit-identical to plain MPC by construction (tested bitwise) — mitigation costs nothing when the model is right. Undodgeability is a design requirement rather than an observation, because the argmax planner acts as an adversary against any fence: it dodges a fence tied to the pre-state, and it dodges a point fence in full state space by probing crossing velocities — a position-band fence with rollout truncation leaves it no crossing to probe. The collapse is scoped to hard-boundary hybrid modes: the one-sided fence works precisely because a refuted prediction lies on or beyond the mode boundary, so fencing its far side cannot cut off any real trajectory. This structural fact is what these wall/stop instruments supply; less structured failure modes (soft or moving boundaries, errors not confined to a hard stop) do not obviously admit such a fence and are untested — this is a hard-boundary mitigation, not yet a general planner-side one. The collapse is large at every knob (Table 10): pc blind stays pinned at ≈ 0.94–1.03 everywhere (established in Section 4, Tables 1 and 2), while pc mit never exceeds 0.81. Exactly one violation suffices to fence the mode on every one of the 11 rows — the mitigated planner must touch the mode once, which is identifiability operationalized: you cannot avoid what you have never seen. The residual pc mit is the cost of that unavoidable first contact, and it grows with the lure distance, read off the first-contact step: cart 0.290 → 0.806 as first contact goes 11.6 → 28.7 of 80 steps (knob 2 → 10); pendulum 0.113 → 0.212 as first contact goes 7.0 → 13.0 (knob 0.8 → 2.0). The cart knob = 10 row is the least favorable in the sweep (pc mit 0.806, close to blind’s 0.977) because the transient consumes most of the horizon — but the blind planner stays pinned forever there (J 0.94 of Jtruth 17.77) while the mitigated planner escapes and recovers most of the horizon (J 3.88): the

60

knob

pc blind

cart (xwall ) 2 1.031 4 1.031 6 1.031 8 1.030 10 0.977 pendulum (θstop ) 0.8 1.002 1.0 1.002 1.2 1.000 1.4 0.997 1.6 0.990 2.0 0.942

pc mit

first-contact step

0.290 0.446 0.578 0.699 0.806

11.6 16.9 21.3 25.1 28.7

0.113 0.129 0.143 0.160 0.177 0.212

7.0 8.1 9.0 10.0 11.0 13.0

Table 10: Mitigation sweep (20 episodes/knob, both instruments). pc blind / pc mit = play cost of the blind planner under plain MPC / under distrust-region mitigation. Full 11-row table with contact rates and violation counts in docs/EXPERIMENTS.md. normalized cost looks modest, the actual return does not. Why exactly one violation, and what sets the count in general. The single-violation sufficiency is not a lucky measurement either — it is a covering number equal to one. Proposition 17 (the mitigation’s new-coverage violations are bounded by a packing number). Run distrust-region replanning with band ε. Let F be the fence locus — the set of points at which a violation can record a fence, i.e. the possible refuted predictions — and let B be the entry barrier, the set of points at which an imagined trajectory can enter the mode region. Two conclusions, with different hypotheses. (i) With no hypothesis at all, the number of violations that place a fence farther than ε from every fence already placed is at most Npack (F, ε), the ε-packing number of F , and Npack (F, ε) ≤ Ncov (F, ε/2). (ii) If moreover B ⊆ F ⊕ Bε — every barrier point within ε of some fenceable point — then once the accumulated fences ε-cover B, no further violation occurs at all. Proof. Fences placed farther than ε from all their predecessors are pairwise more than ε apart, so they form an ε-packing of F and there are at most Npack (F, ε) of them; for the comparison, a (ε/2)-ball has sup-diameter ε and so contains at most one packing point, giving (i) with no hypothesis used. For (ii): once the fences ε-cover B, every imagined trajectory entering the mode region crosses B within ε of a fence and is truncated, so no candidate scores the phantom and no further violation occurs — which is where the hypothesis B ⊆ F ⊕ Bε is used, since otherwise no set of fences on F can cover B. Two features of the statement are weaker than they may appear, and both are forced by counterexample. The bound is a packing number, not a covering number. A covering number counts an optimal cover, and the planner is not optimal — it is explicitly an adversary against the fence — so it can place every point of a maximal packing before the balls start pre-empting one another. On the unit circle at ε = 0.5 that is 12 points, pairwise chord distance 0.5176 > ε, and a grid sweep confirms every one of the 12 adds coverage the others had not: 12 against a covering number of 7 (scripts/circle covering number.py). And the count is of new-coverage fences only. Duplicates — fences within ε of an existing one — are not bounded by this argument at all, 61

and in our own data they dominate the tail: one episode records 28 violations of which 24 are at an identical point. The two instrument families instantiate the two extremes of that bound. • 1D: the measured 1.00 is separation, not covering. A position or angular clamp has a single boundary point, and Table 10 measures a mean of exactly 1.00 violations on all eleven rows. That is not the covering bound at Ncov = 1 being tight, and checking the instrument says so (scripts/fence separation census.py): the fence is recorded at the model’s refuted prediction, which overshoots the wall by 0.17 to 0.58 against a band of ε = 0.25, so the band fails to contain xwall in four of five cart episodes — and the count is 1 anyway. A hypothesis that fails while its conclusion holds is not the explanation. What is doing the work is that in one dimension a single point beyond the boundary disconnects the agent from the phantom: every imagined path to the lure crosses it, so the segment test truncates all of them, wherever in the far region the fence landed. That mechanism has a signature the covering story does not — insensitivity to ε — and it holds where we can measure it: sweeping ε over a 20× range on the pendulum (0.1 down to 0.005) leaves the returns and violation counts bit-identical, and on the cart they are identical from 0.25 down to 0.05. It is not unconditional: at ε = 0.01 two of four cart seeds record a second violation, the strip between the boundary and the fence having grown wide enough for a real contact that no imagined segment crosses. So the supported 1D statement is a separation fact with a measured range of validity, not a covering number of 1. The topological contrast with 2D is then the real one: removing one arc leaves a circle connected, so no single fence can separate a disc patch’s inside from its outside, and the cut number jumps from 1 to 2 before any metric question arises. • 2D: the bounded quantity is the distinct fence count, and it is a quarter of the budget. A disc patch of radius R has its fence locus inside the disc and its entry barrier on ∂ disc. A fence at a boundary point ε-covers an arc of angular width 4 arcsin(ε/2R), so a circle’s packing number at R = 1, ε = 0.5 is 12 and its covering number is 7 (both brute-force verified in scripts/circle covering number.py, which also exhibits the 12-point sequence and checks that one fewer ball does not cover). PatchField2D is bi-modal, so the budget for an episode that touches both patches is 24, not one circle’s 12. Against that budget, what the proposition bounds is the number of new-coverage fences, and measuring it per episode (scripts/fence separation census.py) gives the comparison the proposition asks for. The distinct fence count never exceeds 2/5/6 at knobs (2, 6)/(3, 7)/(4, 8) — at most a quarter of the 24-fence budget. The raw violation counts are much larger and are dominated by duplicates: the two worst episodes record 28 violations each while placing at most 6 distinct fences, and the per-episode distribution is heavily skewed (medians 1/1/2 against means 1.05/2.65/4.25). A 20-episode mean and a per-episode bound are different quantities; the bound is per episode. Measured directly as the angular spread of fence bearings per patch per episode, the median probed arc is 0%/0%/87% — zero at the two near knobs because the typical episode places a single fence, and large at the far knob because the few episodes that map the boundary map most of it: no smooth progression, and that is what the instrument does. (Dividing the violation count by the fence budget — 17%/43%/68% — does not measure the probed arc; it assumes saturation and restates the count as a percentage.) (A metric packing number at fixed radius is the relevant quantity because the algorithm fixes the band ε; it is a different question from the minimal good cover of a circle by contractible 62

arcs, which is 3 with no radius constraint and is the nerve-theoretic object paper 3 builds on. The free-centre optimum of 6 is a zero-slack tiling special to ε = R/2 and closed balls, so it should not be read as a robust constant.) Corollary 5 (the deployment fencing cost is exponential in the boundary’s dimension). Proposition 17 is dimension-free — its proof uses only packing and covering of F — so instantiating it needs only a packing number. If F
is a p-dimensional Lipschitz piece of diameter D, then Npack (F, ε) ≤ Ncov (F, ε/2) = O (2D/ε)p , so the number of pairwise new-coverage fences the mitigation can accumulate grows exponentially in the boundary’s dimension p (not the state’s). That caps a count; it is not a completion guarantee. Nothing here shows the mitigation ever closes the phantom off, bounds the time to do so, or bounds the total number of violations — duplicate fences are unlimited by this argument, and the 2D campaign observes an episode with 24 of them (Section F.1). The packing correction changes the constant, not the order, which is why the dimensional reading survives it intact. A p = 2 mode surface would cost O((2D/ε)2 ) — the precise sense in which the danger is dimension-free while the fencing is not. Two caveats on instantiating the exponent. The constant hides the parametrization’s Lipschitz constant and p-volume, which matters here because the whole quantitative dispute is over a constant. And two data points (p = 0 and p = 1) cannot distinguish (2D/ε)p from any other function agreeing at p ∈ {0, 1}; the exponential form is the theorem’s, not the measurement’s. We use fencing rather than repair for this cost deliberately: repair in this paper means the LLM rewriting the model from data (Section 7.1, where it fails outright on 2D regions), and the fencing cost is a planner-side quantity that leaves the model untouched. The covering-number analogue that Section 12 once listed as open now appears on both sides: gate-side for Lipschitz pairs (Proposition 14) and mitigation-side as the fencing count here. The dimensional reading is the paper’s own: the danger law’s (1 − r)N is dimension-free, but fencing a mode at deployment time costs a packing number of its fence locus, which grows with that locus’s dimension.

F.1

The 2D mitigation: a partial collapse, and lock-in at the far knob

The distrust-region fence generalizes to PatchField2D (scripts/continuous mitigation patch2d.py): fences are the 2D positions of refuted predictions, which lie inside an unreachable patch (the stay-at-previous-position clamp forces a refuted prediction strictly inside the disc, so fencing it cannot cut off any real trajectory), and a candidate rollout truncates when an imagined step segment passes within ε of a fence (segment-to-point distance, leap-proof); the 1D code path is preserved behaviorally bit-identically — the generalization rewrote the shared internals, so this is pinned by tests rather than by the diff: the no-violation case reduces to plain MPC exactly, and the 1D mitigated episodes with violations are golden-pinned to the run the sweep used (tests/test mitigation 1d regression.py). But the collapse is now partial and decays with patch distance (Table 11): pc blind ≈ 1.006 falls to pc mit 0.257/0.541/0.862 at knobs (2, 6)/(3, 7)/(4, 8), with mean violations 1.05/2.65/4.25 (against the 1D instruments’ clean 1.0) and first contact at step 8.5/12.35/15.25. A boundary-mapping transient — the planner rounding one fence disc, re-contacting the edge elsewhere, accreting fences along the probed arc — is the benign reading of those means, and the per-episode data refute it; the difference matters because what replaces it is a different failure mode, not a slower version of success. The distributions are skewed, not shifted: medians 1/1/2 against those means, with two episodes recording 28 violations. And a growing fraction of episodes end pinned at blind-level return — 0/20, 2/20, 7/20 across the three knobs — with every episode of ≥ 5 violations returning near zero. In those episodes the agent is frozen against a patch edge 63

and re-violates at the same predicted point every remaining step: at (4, 8), one episode records 24 consecutive fences at an identical position. The mechanism is the tie-break. With a fence a few hundredths away, every candidate truncates at the first imagined step, so the ranking falls through to distance-to-nearest-fence — an unsigned scalar, which in 1D can only mean fleeing the mode but in 2D is symmetric between rounding the patch and plunging through it. So the mitigation does not merely decay with distance: at the farthest knob it fails outright in a third of episodes, and what remains of the decaying-transient reading is the near knob, where the median episode places one fence and the collapse is clean. This is the scope of a hard-boundary mitigation on a curved 2D mode: the one-sided fence is sound (a refuted prediction lies inside an unreachable patch, so fencing it cannot cut off a real trajectory) and it works where the geometry lets an unsigned tie-break point away from the mode. It does not survive a boundary the agent can be pinned against. Fixing that needs a signed awaydirection in 2D — the fence’s outward normal rather than its distance — which is a design change we have not tested, not a re-tuning. (k1 , k2 )

pc blind

pc mit

mean viol.

first contact

(2, 6) (3, 7) (4, 8)

1.006 1.006 1.006

0.257 0.541 0.862

1.05 2.65 4.25

8.50 12.35 15.25

Table 11: PatchField2D mitigation sweep (paired seeds). The collapse is partial and degrades with patch distance. Read the means with the distribution beside them: medians are 1/1/2, maxima 2/28/28, and the count is dominated by duplicate fences (at most 2/5/6 distinct positions per episode). The degradation is not a longer transient but a growing fraction of outright failures — 0/20, 2/20, 7/20 episodes end pinned at blind-level return (scripts/fence separation census.py).

G

Multi-mode gates: the sharp bracket, and the measured dependence

Remark 6 (the bracket is tight, and exact factorization is a property of the gate). The bracket is not merely valid but sharp: its ends are the Fréchet–Hoeffding bounds for Pρ (R1 ∪ R2 ) given the marginals, pushed through the increasing map x 7→ xN , so no bound expressible in r1 , r2 alone can be tighter — the interval is the exact range of joint miss probabilities consistent with the marginals. Both ends are attained, at the two Fréchet–Hoeffding couplings of the intersection. The upper one is attained when one event contains the other (Pρ (R1 ∩R2 ) = min(r1 , r2 ), whence r∪ = max(r1 , r2 )). The lower one is attained at the minimal intersection Pρ (R1 ∩ R2 ) = max(0, r1 + r2 − 1), which is disjointness only when r1 + r2 ≤ 1; if r1 + r2 > 1 the two events cannot be disjoint, the minimal intersection is r1 +r2 −1 > 0, and the attaining configuration is r∪ = 1 — a joint miss probability of
N 0, which is again the bracket’s lower end 1−min(1, r1 +r2 ) . Our knobs are all in the first regime (r1 + r2 ≤ 0.26), so disjointness is the attaining case there. This is the point of the bracket: it is the correct distribution-free statement about a multi-mode gate, replacing an independence assumption with no assumption at all, at the price of an interval instead of a point — and the interval cannot be narrowed without measuring something beyond the marginals (which is what r∪ , or equivalently Pρ (R1 ∩ R2 ), is). The lower end is attained in our data — at six of the nine PatchField2D knobs no rollout out of 600 contacts both patches, so the measured r∪ equals r1 + r2 exactly there (Table 3; 64

a censored zero, so read it as P (both) < 1/600). Note that moving the modes apart pushes the joint factor towards that lower end rather than towards the product: disjointness is the opposite of independence, not a route to it. It is tempting to say that a stratified gate — independent rollout budgets N1 , N2 aimed at the two mode regions — buys the product back. It does not, and the reason locates the obstruction. For a stratified gate with per-stratum policies ρi , Y Y
N P (joint miss) = 1 − Pρi (R1 ∪ R2 ) i ≤ (1 − ri′ )Ni , i

i

where ri′ = Pρi (Ri ) is stratum i’s own rarity, with equality iff no stratum’s rollouts can reach the other mode without also reaching their own (Pρi (Rj \ Ri ) = 0 for j ̸= i) — a strong extra hypothesis that PatchField2D itself violates, since under the gate policy a rollout contacting one patch sometimes contacts the other. Stratification factorizes over strata, which the unstratified draws already were (they are i.i.d.); what it does not remove is the within-rollout dependence between R1 and R2 , and that is what blocked the product in the first place. And the advice would be circular anyway: aiming budgets at the mode regions presupposes knowing where they are, which is exactly what the danger law assumes you do not. One undirected random budget earns the bracket; so, in general, does a stratified one. Section 4.2 measures both ingredients on the bi-modal instrument, but it is worth being exact about which parts of that measurement can fail and which cannot. Because r1 , r2 , r∪ and P (both) are estimated from the same rollouts, inclusion–exclusion holds identically in the plug-in estimates: the bracket contains the measured joint factor and the sign rule gets the direction right at all nine knobs by algebra, with a residual of exactly 0. Those are consistency checks on the arithmetic, not confirmations of the proposition. The falsifiable content is the dependence itself, and at the 600 rollouts of Table 3 it was not resolvable: P (both) counts were 0 to 3, six of them censored zeros, so the observed −17% to +12% spread of the product’s error was consistent with pure count noise and the direction of the dependence was unresolved. We therefore measured it properly, at 50,000 rollouts per knob (scripts/ patch2d dependence 50k.py), and the sign does change across the grid with non-overlapping Wilson intervals in both directions: at (2, 6), P (both) = 8.6 × 10−4 with 95% interval [6.4, 11.6] × 10−4 against r1 r2 = 19.0 × 10−4 — negative dependence, the product over-estimating the joint hit rate — while at (4, 6), P (both) = 12.8 × 10−4 with interval [10.0, 16.3] × 10−4 against r1 r2 = 6.2 × 10−4 , positive dependence in the opposite direction. At (3, 7) the dependence is negative again (4.4×10−4 , interval [2.9, 6.7] × 10−4 , against 8.0 × 10−4 ), and at (4, 7) the interval straddles the product and the knob is genuinely undecided — so three of four knobs are resolved and they do not agree on the sign. So a product form cannot be rescued by a fixed correction factor: the sign of its error is a function of the geometry, which is exactly why the sharp bracket is the right object. The practical reading is that a multi-mode danger law needs the union event measured (or the bracket, which needs only the marginals), never the marginals multiplied.

H

The residual reward leak, and the sharp-plateau variant

The residual leak is a reward artifact, not a mechanism fact — measured, not argued. At the widest knobs the pinned planner scores above the uniform-random policy (cart xwall = 10: Jblind = 0.94 against Jrand = 0.53; the three farthest pendulum stops likewise), which is why the claim above is “exploited at every knob” rather than “below random at every knob”. The cause is the far plateau’s sigmoid tail : a planner pinned at x = 10 still collects 1/(1 + e(12−10)/width ) per step, which at width = 0.5 is 0.018 and over 80 steps is most of Jblind . A sharp-plateau 65

variant (scripts/continuous sharp plateau.py, cart width 0.5 → 0.2, pendulum 0.25 → 0.1; sibling JSONs, the default instruments and every synthesis artifact untouched) removes the tail and settles it: • The exploitation claim strengthens. On the cart the blind planner is below random at 7/7 knobs instead of 6/7, by two to thirteen orders of magnitude (Jblind from 2.3 × 10−13 to 2.4 × 10−3 against Jrand = 0.532); on the pendulum, 5/6 instead of 3/6 — and 6/6 with the asymmetric variant below. • play cost becomes knob-invariant to ≈1.5 × 10−4 : cart [1.0307, 1.0309] (spread 1.4 × 10−4 , against the default’s 5.5 × 10−2 ) and pendulum [0.9999, 1.0000] (spread 1.5 × 10−4 , against 6.1 × 10−2 ) — a 400× tightening on both, i.e. the invariance the default sweeps show approximately is exact once the tail is gone. • The planner-competence cost is negligible, the risk recorded with the variant’s script: a sharper plateau gives random shooting less gradient to follow, yet Jtruth moves only 17.77 → 17.76 (cart) and 20.08 → 20.05 (pendulum), and contact stays 1.00 at every knob. • The residue, and its fix. Narrowing both plateaus starves the random policy too (Jrand collapses to 3.6 × 10−4 on the pendulum), which is why one knob there still reads above random: at θstop = 2.0, Jblind = 3.1 × 10−3 against that collapsed baseline. The diagnosis says what to do — narrow only the phantom plateau, whose tail is what a pinned planner collects, and leave the real one at its default width. That variant (widthright = 0.08, perplateau widths; --width-right) gives 6/6 knobs below random: Jblind between 4.3 × 10−4 and 7.1 × 10−4 against a surviving Jrand ∈ [0.0572, 0.0584], with Jtruth unchanged at 20.08, contact 1.00 everywhere, and play cost in [1.0028, 1.0029] — a spread of 7.1 × 10−5 , tighter still than the symmetric variant and 850× tighter than the default. So on both instruments the strong form holds: exploited, pinned, and below random at every knob, with play cost invariant to 10−4 , once the phantom’s tail is gone. So the mechanism does not depend on the leak, and the knob-invariance claim is the one that sharpens: it is exact, not approximate, in the instrument without a tail.

I

The ε-sweep: the axis separation is tolerance-invariant

Is ε = 0.01 a special setting, or is the axis separation itself ε-invariant? A sweep over ε ∈ {10−9 , 10−6 , 10−4 , 10−3 , 10−2 , 3×10−2 , 0.1, 0.3} (scripts/continuous eps sweep.py; Table 12 for the cart, full grid in docs/EXPERIMENTS.md) answers: ε-invariant. Mode-arm reveal-rarity is flat across the entire grid — on the cart, wall@8 is bit-identically flat through the whole grid including ε = 0.3, and wall@4 only dips slightly (never widens) at the top of the grid. The pervasive bias arms switch sharply at their own error scale on both instruments instead. The pendulum replicates both halves: its mode arms are flat too (only a slight dip at the top of the grid — stop@1.0 rarity 0.1410 at ε ≤ 3×10−2 , dipping to 0.1400 at ε = 0.1 and 0.1240 at ε = 0.3), and its bias arms switch at the same error-scale boundaries as the cart’s. pass@40 ≈ (1 − r)40 continues to hold for the mode arms at every ε in the grid, on both instruments. (The sweep’s own rarity column is measured on 2000 rollouts per cell, since what it has to establish is flatness in ε rather than a third digit; the 20,000-rollout estimate of the same quantity in Table 4 is 0.0103 against this sweep’s 0.0125, one estimate’s noise apart.) play cost is not re-measured across ε: the model under test does not depend on the gate’s tolerance, so play behavior is ε-independent 66

ε

wall@8 rarity

bias ×1.03 rarity

bias ×2.0 rarity

−6

0.0125 0.0125 0.0125 0.0125

1.0000 < 0.0019 < 0.0019 < 0.0019

1.0000 1.0000 0.0040 0.0040

10 10−2 0.1 0.3

Table 12: Reveal-rarity vs. ε (cart). The mode arm is flat across the whole grid; the pervasive arms switch at their own error scale. by construction — the sweep varies only what the gate can see. The gate’s ε is a pervasive-error dial, not a mode-detection dial: tightening it cannot catch the hard mode, and loosening it does not widen the hole. The 4D bi-modal instrument replicates the flat mode arm, once per mode. On PatchField2D the ε-sweep (scripts/continuous eps sweep patch2d.py) gives exactly flat modearm reveal-rarity across the entire grid: patches-omitted 0.147, patch-1-only 0.142, patch-2-only 0.005 — each constant at every ε. The per-mode arms recover the per-mode rarities of the mechanism sweep (Section 4.2), so the tolerance axis is orthogonal to the mode hole on the bi-modal instrument too, and separately for each mode.

J

Bounded observation noise: the gate law survives to a measured masking boundary

The gate above accepts on exact equality, which is well-defined only because the instruments are deterministic and observed without noise. This section measures what replaces the exact statements under known bounded observation noise, with the design, critical event, unit, thresholds and seed mapping frozen before the run (results/h7 noisy gate prespec v1.json; the result JSON records that pre-specification’s SHA-256). Design. Observed next states and rewards carry independent coordinatewise Uniform[−η, η] noise at the seven pre-specified levels η ∈ {0, 0.01, 0.03, 0.1, 0.3, 1, 3}; exact matching is replaced by support compatibility (the noisy observation must lie in the candidate’s bounded support). The candidates are the CartWall@4 truth and its analytic mode-blind proxy — this is a gate-law measurement, not a new synthesis campaign. Under the uniform-noise hypothesis the conditional per-scalar overlap probability is exact, q(δ, η) = max(0, 1 − |δ|/(2η)) for a truth-vs-candidate discrepancy δ (with the η = 0 equality limit), and multiplies over coordinates and transitions; independent noise then gives one empirical Bernoulli verdict per block. The unit is the disjoint 20-rollout seed block, 200 blocks on a fixed latent panel (189 of 200 contain the mode; 1816 contact transitions); neither the 4000 rollouts nor the 320,000 transitions are treated as independent (scripts/ h7 noisy observation gate.py, results/h7 noisy observation gate v1.json). η

truth passes

blind passes

exact CP95

analytic conditional

0–0.1 0.3 1 3

200/200 200/200 200/200 200/200

11/200 11/200 32/200 106/200

[0.0278, 0.0963] [0.0278, 0.0963] [0.1121, 0.2183] [0.4583, 0.6008]

0.0550 0.0556 0.1582 0.5029

Table 13: Support-compatibility gate under bounded observation noise, per seed block. The four levels η ∈ {0, 0.01, 0.03, 0.1} are identical to four digits and are shown as one row. 67

Readings. The correct model passes every block at every level. The pre-specified primary criterion — an analytic blind-pass increase of at most 0.01 at η = 0.1 relative to η = 0 — is met with an increase of exactly 0 on this panel, so bounded noise through the primary level masks no additional block: the noiseless equality statement becomes a support-probability statement with the same content. The first pre-specified level whose increase exceeds the frozen +0.05 boundary is η = 1, where the analytic conditional blind-pass probability is 0.1582 and the independent noise realization accepts 32/200 blocks — sufficiently wide support measurably hides mode discrepancies, and the boundary at which it starts is now a number rather than a caveat. These are conditional evaluations on the fixed latent panel, not population-prevalence estimates; process noise, an unknown noise law, a planner rerun under noise, and an externally specified benchmark remain open (Section 12).

K

Cross-family arms, and a fourth artifact class

Cross-family spot-checks (two families). Qwen (HF router, Qwen/Qwen3-Coder-30BA3B-Instruct, 3 seeds): the full arm is clean (3/3 gate 1.000, blind 0.0), so the pinnedintegrator premise is not GPT-specific; on the incomplete arm the identifiability branch reproduces (the 1/3 wall-absent seed is gate-1.000 wall-blind and exploited, play cost 0.999), but Qwen repaired neither of its two wall-present seeds (gate 0.999 and 0.491, both superstitious patches the gate refused). Claude (Sonnet, agent-relayed via the companion paper’s protocol on scripts/continuous claude step.py — verbatim pipeline messages relayed to fresh, context-free instances per message, same ε = 10−9 gate and MPC play as the API arms; seeds 10000/20000/30000 plus one full control per instrument; results/continuous claude relay.json): both full controls are clean (2/2 gate 1.000, blind 0.0, play cost 0.0), and both mode-absent seeds are accepted fully blind and exploited (cart play cost 0.999, pendulum 0.995) — the identifiability event fires family-independently, as Proposition 5 requires. On repair Claude is neither GPT-5.x nor Qwen: cart seed 20000 repaired the exact one-sided rule in 1 iteration, and cart seed 30000 repaired at iteration 5 after a period-2 oscillation (symmetric ±8 walls → both removed → symmetric again → removed → one-sided correct), but pendulum seed 20000 was accepted in 1 iteration carrying an invented mode (next paragraph) and pendulum seed 30000 stalled at 5 iterations (gate 0.9972), oscillating between the symmetric-stop and no-stop artifacts without ever finding the one-sided rule. So across three families the modeabsent blind-and-exploited event fired for every one (it is a property of the sample; Proposition 5), while repair-from-data is model-dependent in mechanism, not merely in rate: GPT-5.x recovers the revealed clamp in almost every case (105 of 111 draws exactly; four more add a phantom stop the probe cannot see, two stall), Qwen recovers none (superstitious local patches), and Claude recovers most but through a symmetry prior that generalizes one-sided evidence into a symmetric pair of boundaries — a prior GPT-5.x also exhibits, in four artifacts across both sizes, so the class is not family-specific. A fourth artifact class: accepted while carrying an invented mode its gate sample cannot refute. A symmetry-or-landmark prior produces an outcome beyond the correct/blind/superstitious-patch trichotomy. It is clearest in the Claude arm, and it is not confined to it: four GPT-5.x artifacts on the pendulum’s headline knob do the same thing (Section 7.1). Where the training sample covers the invented side, the gate refutes the phantom and the memoryless refine loop oscillates (cart seed 30000’s period-2 cycle above; pendulum seed 30000’s stall at gate 0.9972). But where the sample is silent on the invented side, the phantom is

68

unfalsifiable: pendulum seed 20000 was certified at gate 1.000 in a single iteration while carrying a phantom symmetric stop at θ = −1.4 that this seed’s rollouts never reach (verbatim elif th2 < -th max: th2 = -th max; om2 = 0.0, the second branch of a symmetric pair, with th max = 1.4 its own constant) — a verified artifact, exact on every sampled transition, that nonetheless encodes a hard stop which does not exist. This is a clean natural experiment: the same symmetric artifact was refuted at pendulum seed 30000 and certified at seed 20000, the only difference being whether the sample covered θ < −1.4. It is Proposition 5’s prior caveat measured directly — on inputs the sample never touches, the artifact’s content comes from the model’s prior, and the gate cannot police it. Note the classification did not flag it: the mode blindness probe scored 0.0 (correct) because it probes only the true +1.4 mode’s region; code inspection, not the probe, caught the invented mode (Section 12). Qualifications on the Claude arm. (i) Agent-relayed means an agent scaffold over a subscription transport, not an API, though the relayed messages are byte-identical to the pipeline’s; in the two multi-iteration cells a handful of refinement replies prefixed a one-line explanation before the code block (two distinct sentences, repeated across the oscillation) despite the output-onlycode instruction; the code block still parsed, and no relay was refused. (ii) The refine loop is memoryless in the API arms too — refine continuous sends a single user message per iteration (src/cwm/continuous/contract.py) — so the oscillation is protocol behavior, not a relay artifact. (iii) n is small: 3 seeds plus one control per instrument, one alternate family. The branches compose into the paper’s central claim. With the mode in the data, the synthesize– refine–gate loop recovers the exact mode or refuses the artifact — correct relative to every transition the sample covered, which is the only sense of correctness the gate defines (sample-covered exactness is the acceptance criterion itself; the empirical, code-inspected regularity — not a theorem — is that every accepted artifact’s off-sample content was also the true mode, except Claude’s phantom pendulum stop, which errs only where its sample is silent: the Proposition 5 prior caveat, not a gate failure). With the mode absent, no loop can help (Proposition 5: the sample carries no evidence for the mode — though a prior or the specification still could supply it), and the acceptance of a blind artifact is not a failure of the LLM, the refinement, or the gate implementation — it is the sampling event whose probability is exactly (1 − r)N . The discrete danger law had a provable core plus an empirical residual (the rule not learned even when shown); on the continuous 1D instruments the residual can vanish — it does for GPT-5.x on all but four of the clamps it was shown — so the law becomes the entire failure surface for a capable-enough synthesizer, and shrinks toward it even for a weaker one (this is geometry-scoped: Section 7.1 shows the residual returns on a 2D circular mode, where even GPT-5.x does not repair). The actionable consequence sharpens correspondingly: in this regime, spec completeness and gate-sample coverage are not two independent worries — coverage is the dominant worry, because the synthesis loop repairs what the sample reveals. (Scope: 20 seeds/cell on the headline cell, both GPT-5.x sizes; the wall-absent conditional is 20/20 across sizes and consistent across three independent runs — the 5-seed first run, the 20-seed tightened run, and the 3-seed Qwen run; the wall-present repair rate is 20/20 for GPT-5.x on this cell, 0/2 for Qwen, and mechanism-dependent for Claude (exact on both cart seeds, one via a period-2 oscillation) — model-dependent, small-n on the cross-family arms. LLM synthesis is stochastic across calls; the three-way structure and the identifiability conditional are stable run-torun, per-seed iteration counts are not.)

69

L

The 2D artifacts: a code and behavioural audit, and three ablations

The mechanism: translation succeeds, induction of the boundary collapses. A 76artifact code inspection locates the failure precisely. Plant translation succeeds: ≈74/76 artifacts reproduce the exact 4D semi-implicit integrator and the reward. What collapses is induction of the 2D circular boundary. The dominant modal failure (38/76) is dimensional reduction: the disc is modeled as a half-plane — a 1D CartWall-style clamp at the right location but the wrong shape, e.g. substituting if x2 > 4.0: ... for a circle — learning the freeze mechanic but not its circular trigger. The remaining classes: 20/76 pure-blind (no patch logic), 9/76 superstitious local patches, and 9/76 disc-form attempts, none of them correct. The ε-exactness alternative — that correct-form discs merely failed the 10−9 arithmetic gate — is falsified: no correct-form disc failed on arithmetic; the discs that failed were the wrong shape. A behavioral audit confirms this hand inspection on every claim (scripts/patch2d artifact audit.py: probe each artifact’s step() on a state grid, classify the shape of its deviation-from-integrator set): 39/76 half-plane-form, 13 behaviorally blind, 8 disc-form, 7 measure-zero textual traps, 4 point, 3 square-form, 2 boundedother; integrator arithmetic exact in 74/76; and — the point that matters for partial repair — no artifact encodes its seen patch. On the see-one-miss-the-other branch (the 66 seeds where a partial repair is even definable), 28 freeze sets do contain the seen patch (coverage > 0.9), but they contain it the way a half-plane contains a disc: their frozen area runs from 15× to 81× the patch’s own ≈1.2% share of the probed box (median 61×). Exactly one artifact is even patch-selective — seed 180000 covers its seen patch and leaves the unseen one below 0.1 — and it does so with a half-plane freezing 31× the patch area, i.e. by where its threshold happens to fall between the two patches, not by encoding a region; its gate score is below 1 like every other see-one artifact. The missing partial repairs were therefore never attempted as regions at all, rather than attempted and refused by the gate. The two class counts differ by exactly one artifact (39 vs 38 half-plane, 8 vs 9 disc-form) and the difference is a syntax-versus-behavior reading, not a disagreement about any artifact’s correctness: two artifacts (mini k = (3, 7), seeds 130000 and 150000) write a radial predicate anchored at the reward lodes rather than at a patch — if hypot(x-(-6),y) <= 2 or hypot(x-12,y) <= 2 in one, a reward-threshold freeze in the other — so hand inspection reads the disc in the source while the audit reads the deviation set, which is unbounded inside the probed box. Both readings agree that neither artifact encodes a patch; only the label moves. Ablation 1: richer prompting and 3× budget do not restore repair — they change the failure class. The natural confound is that the prompt was too poor and the budget too small. The strongest joint treatment (120 examples, 40 failure lines, describe-the-region-first guidance with an explicit “the region need not be a 1D threshold” de-bias, and 15 refine iterations; identical samples to the original run) yields 0/40 repair at k = (3, 7), both sizes. The guidance works as prompt engineering: the half-plane reduction disappears (0/40, versus 21/40 in the matching base cells) and the artifacts now write bounded 2D regions — rotated ellipses (∼15/40), rectangles (∼10/40), unions of micro-discs (∼5/40) — but none is the true disc. The new failure class is evidence-hull fitting with two compounding errors: they fit the hull of the observed freeze positions (the pre-freeze crescent hugging the disc’s reachable west boundary from outside: fitted centers pulled west to x ≈ 2.3 against the true x = 3, i.e. dragged onto the evidence at the patch’s west edge), and 36/40 condition on the current position rather than the landing (x2 , y2 ) — the causal variable of the rule. The sample itself then refuses every wrong shape.

70

Ablation 2: an axis-aligned square with flat edges — curvature did not suffice to explain the failure. This ablation was added after the disc result it responds to (Section Q dates every such addition). If the failure were about curved boundaries, an axis-aligned square patch (a Chebyshev ball, max(|x − cx |, |y − cy |) ≤ R — a max/abs predicate, no quadratic) should be repairable. It is not: with the same pipeline at k = (3, 7) the full arm is clean (20/20 at zero refine iterations, both sizes — translating the square clause is as easy as the disc’s) and the incomplete arm gives 0/40 repair (every sample mode-containing; best gate 0.9962). The classes mirror the disc’s, reflected : the dominant failure is again dimensional reduction (the square’s west edge as a 1D threshold, if x2 >= 2.0), and several artifacts commit the inverse error — writing discs on square evidence (radial hypot guards at the edge midpoint, micro-disc unions), plus rewardanchored superstitions (freeze zones invented at the lodes). Zero artifacts write the true box or its max/abs form. Across the four treatments (two disc knobs, the square ablation, the guided/3×budget treatment) that is 0 of 156 mode-containing synthesis draws, and the sampling unit makes those 156 draws 20 distinct gate-sample blocks: changing the disc knob or the prompt variant reuses a block’s random stream byte for byte, so k = (3, 7) and k = (5, 9) are two treatments over the same blocks rather than 38 samples. The bound the evidence supports is therefore per block: an exact (Clopper–Pearson) 95% upper bound of 0.168 on the probability that a fresh modecontaining gate sample is repaired by any attempt run on it (Wilson 0.161). Pooling the 156 draws as independent trials would have claimed 0.023, 7.2× tighter than the evidence supports; we report the per-block figure and the per-treatment counts separately (scripts/paper2 statistics.py), never a single pooled interval. Ablation 3: two further model-family spot-checks, at tiny n, fail in the same classes. The three campaigns above are GPT-5.x only, so the collapse could be one family’s idiosyncrasy. A Claude arm on the headline cell says otherwise (agent-relayed as in Section 7; Sonnet, k = (3, 7), three mode-containing seeds — two see-P1 -miss-P2 , one seeing both — plus one full control, same N = 40 sample, same ε = 10−9 gate, same five-iteration memoryless refine loop). The full control is clean at iteration 0 (gate 1.000, both discs written on the landing position, blindness 0.0, play cost 0.0): translation is not the problem here either. No incomplete seed repaired (0/3), and the trajectory carries more information than the outcome: each seed spends its five iterations in a period-2 cycle between the pure-blind artifact and a wrong template, returning to its iteration-0 gate value exactly on every even iteration (seed 10000: 0.9934 blind → 0.9591 disc-on-currentposition → 0.9934 → 0.9284 half-plane → 0.9934 → 0.7044 reward-threshold; seed 20000: blind 0.9962 ↔ half-plane 0.9406, three times over; seed 30000: 0.9966 → 0.6750 reward-zone → 0.9966 → 0.8406 half-plane → 0.9966 → 0.5328 y-band). The template set is the one the GPT-5.x campaigns exhibited — 1D threshold, radial disc on the wrong (current, not landing) variable, reward-landmark zone, axis-aligned band — and no incomplete iteration in any seed wrote a disc on the landing position, the form this same model writes immediately when the contract states it. The constants replicate Ablation 1 quantitatively: every half-plane sits at x = 2.0, the disc’s west edge — “the right location, the wrong shape” — and the one radial attempt fits center (2.328, −0.135) with radius 0.824, i.e. the hull of the observed freeze crescent: the true patch is the disc of radius 1 about (3, 0), spanning x ∈ [2, 4], while the fitted one spans x ∈ [1.50, 3.15] — dragged west onto the evidence, so it covers the patch’s west half, misses x ∈ [3.15, 4] entirely, and freezes free space over x ∈ [1.50, 2]. Its center sits inside the true patch but at the wrong place (0.69 from the true center), with radius 0.824 against 1. That is the same x ≈ 2.3 signature the guided GPT-5.x artifacts produced. Per-iteration gate accuracies and rule classes are re-derived from the versioned transcripts by scripts/claude relay ledger.py. Two qualifications. (i) n = 3 seeds,

71

one alternate family on the incomplete arm: this closes the “GPT-only” confound, it does not sweep models. A third family (Qwen) contributes a matched contrast on this instrument: both arms, three seeds each, run against a single pinned backend — our own vLLM 0.26.0 serving the bf16 checkpoint at a recorded Hub revision, with the checkpoint’s own generation config applied identically to both arms (results/qwen vllm provenance.json; server in scripts/modal qwen3coder vllm.py). Under that one configuration the translation control is clean (3/3 at gate 1.000, zero refinement iterations) and the incomplete arm is refused in 3 of 3 seeds (accuracies 0.993 to 0.997, refinement maxed, the mode present in every training block, none accepted by the independent gate) — the family’s 1D stall-and-refuse class. An earlier first pass had mixed serving paths (HF-router full cells, vLLM incomplete cells) and is retained versioned as an exploratory unmatched spot-check; its incomplete cells reproduce the matched arm’s gate accuracies to three decimals, but the contrast the text draws is the matched campaign’s. At n = 3 per arm this is an exploratory diagnostic of a third family, not a cross-family replication. That control is clean: 3/3 gate 1.000 at zero refinement iterations, both discs written exactly on the landing position, per-patch blindness 0.0. Across all three families, then, stating the region rule is easy and inducing it from data is what fails; the induction evidence on this instrument is GPT-5.x’s 156 seeds plus Claude’s 3. (ii) The relay caveats of Section 7 apply, plus one specific to this arm: the relayed instances were instructed not to use tools or read files, so each artifact is a function of the pipeline message alone (the ground truth lives in this repository, so an instance reading it could have copied the true centers and radius instead of inducing them). The wrapper text is recorded verbatim in results/claude relay transcripts/patch2d k3 7 RELAY FRAMING.txt, together with the posthoc leak check: no incomplete artifact wrote the true disc form at all, and none names the unseen far patch — the signature repository access would have left.

M

The eight ablations on the 2D mode, campaign by campaign

Ablation 4: trigger arity, and why it does not answer the question it was built for. The slab campaign holds the plant, the action parametrization, the lodes, the evidence side, the prompt and the budget fixed and changes only the predicate’s arity, from a region in two landing coordinates to a band in one, with rarity matched by moving the mode as every other instrument in this paper matches it (the calibrated impermeable configuration: half-width 0.5, centre 5.5, giving r1 = 0.128 against the disc’s 0.132 and play cost = 1.006 against 1.006). Translation is trivial, as it must be for the ablation to be admissible: the full arm is 40/40 at gate 1.000 in zero refinement iterations, both sizes, with every mode encoded. The incomplete arm then produces the paper’s most instructive artifact class. By the criterion this paper has used for repair, gpt-5.4 repaired 19 of its 20 modecontaining seeds. It recovered the rule in none of them. All 19 are behaviourally the same artifact: the half-plane x2 >= 5.0 at the slab’s near face. It passes the gate at ε = 10−9 on its own sample, passes an independent acceptance sample and an independent 100-rollout evaluation sample at the same tolerance, and scores 0 on the mode-blindness probe — while freezing 4.6× the true region’s area and agreeing with the truth on only 22% of the union of the two freeze sets. It is not a failure of induction: by Proposition 7 it is exactly consistent with every sample this instrument can produce, so it is the correct inference from the available evidence, and by part (iii) of that proposition its play cost is 0, which is what is measured. The gpt-5.4-mini arm reaches the class in none of its 20 seeds; it writes refutable rules that the gate then refuses. So the size effect here is not that the larger model repairs and the smaller does not — it is that the larger model finds the maximally-consistent rule while the smaller one does not.

72

Ablation 5: naming the variable the trigger reads. The base campaign’s audit found 36 of 40 guided artifacts conditioning the freeze on the position the step began at rather than on the landing position — the rule’s actual argument — so that confound is worth removing on its own. The landing arm is the region-guided treatment with one sentence added, stating that a localized rule’s trigger is evaluated on the state the integrator would produce, and naming nothing about the region’s shape, centre, radius or count; everything else is matched to the region arm exactly (120 examples, 40 failure lines, 15 iterations, the same 20 sample blocks). It does not restore repair: 0 of 40 mode-containing draws recover the disc, over 20 distinct blocks, for an exact 95% upper bound of 0.139 on the per-block repair probability, with a best agreement of 0.147 against the region arm’s 0.286. What the sentence changes is the failure: the dominant class becomes memorisation of the observed freeze positions — 20 of 40 artifacts write a region small enough to be a point on the probe grid, against 15 of 40 in the region arm, one of them the literal bounding box 2.01 <= x2 <= 2.17 and -0.23 <= y2 <= 0.03 of the crescent of contacts its sample happened to contain. So variable identification is not what was blocking region induction, and telling the synthesizer where to look pushes it further toward fitting the evidence exactly rather than generalising it. Ablations 6 and 7: making the region’s interior witnessable does not restore repair. Proposition 7 identifies the evidence’s censoring as an obstruction, and the natural hypothesis is that it is the obstruction. Two campaigns test it by changing where the mover ends up when the mode fires — the firing predicate itself, and therefore the rarity, is untouched, so the knob needs no recalibration; each targets the post-state alone, though dwell time and the amount of mode evidence necessarily move with it (the caption’s confound note). In landing the mover stops where it entered, strictly inside the region; in clamp it is projected onto the boundary, the 2D analogue of the cart’s wall clamp. Both break the proposition’s premise, verified on the gate sample rather than assumed: freeze yields no transition at all that separates the membership rule from an entry rule, landing yields 4614 and clamp 233 (scripts/calibrate mode effect.py). The trap survives in both (play cost 1.058 and 1.059 against freeze’s 1.059, blind contact rate 1.00), and translation stays trivial: the full arm is 20/20 at gate 1.000 in zero refinement iterations in all four cells, so even the clamp’s projection rule — the only one whose post-state is a function of the landing — is as easy to write as the others when stated. Neither restores repair. Across 40 mode-containing draws each, over the same 20 blocks: 0 recover the region, and — unlike every freeze campaign — no artifact passes the gate at all, which is what Proposition 7 predicts once the equivalence class is empty. The best agreement with the truth is 0.10 for landing and 0.26 for clamp, against the disc’s own 0.50. What the artifacts write is the same library at the same constants: the dominant class is again the half-plane (24/40 and 25/40) at x2 > 2.0, the disc’s west edge, with reward-landmark zones, micro-discs and velocity superstitions making up the rest. The two campaigns’ confounds run in opposite directions, which is why we ran both. landing leaves the mover inside the region, where most thrusts keep it, so its dwell time and hence the mode’s share of the sample’s transitions rise from 0.66% to 7.25% — eleven times more mode evidence, a confound favourable to repair, and it still fails. clamp holds that share at 0.75%, matching freeze, and pays instead in the rule’s complexity — and it fails with the same classes. So the negative survives both the quantity of mode evidence and the difficulty of the rule. Witnessing the interior does not restore repair, so the censoring is not the operative obstruction. The censoring Proposition 7 describes is real, and it is what makes the slab’s nineteen accepted-but-wrong artifacts unfalsifiable and what bounds the reach of an independent gate; but it is not the reason region induction fails. With the interior witnessed, by two mechanisms, with

73

more evidence and with an easier rule, the synthesizer writes the same half-plane at the same place. Of the candidate causes these interventions can separate, what is left is the region-template prior, and what the interventions add to the description is stability: the prior does not yield to evidence dose, interior witnessing, budget, or the rule’s difficulty. It remains unlocalized inside the model — the alternatives named in Section 9 (an inability to execute an algebraic fit over textual transitions, a memoryless refinement loop, the absence of a system-identification objective) are compatible with every campaign here, and no design run distinguishes among them. The exclusion matrix, versioned. results/h6 exclusion matrix v1.json (scripts/h6 exclusion matrix.py) records, for each of the eight interventions: the target hypothesis, every changed variable with its unavoidable co-changes, whether a direction was recorded before the run, the experimental unit, the positive control, the observed result, and the strongest licensed inference beside the inference the design does not license. The surviving classes after all eight are the three named in Section 9 plus a residual of model-internal causes these designs do not separate. Four factorial follow-ups that would separate the remaining confounded pairs are specified in the same file: prompt guidance versus example/failure-line budget versus iteration budget (intervention 1’s three-way co-change); post-state semantics crossed with a calibrated equal contact dose (interventions 6/7); angular coverage crossed with start distribution (intervention 8); and trigger arity crossed with identifiability on a bounded one-coordinate region (intervention 4).

N

The coverage certificate’s scope, stated in full

Coverage certificates transfer, but only to the smooth case. The companion paper’s guarantees enumerate information sets, and that enumeration has no continuous analogue. What does transfer is the covering-number version: Proposition 14 certifies supU ∥f − fˆ∥ ≤ ε + 2Lρ for L-Lipschitz pairs once the gate ρ-covers U , with the sample size a covering number over a visitation density, and on the deployed cart gate it excludes a pair with L = max(Lipf, Lipfˆ) ≤ 5.77 carrying the wall’s error magnitude of 4.2, with probability at least 1 − δ over gate draws, against a rigorous bound of 0.933 on the step-1 reachable set. Since the bound ε + 2Lρ grows with L, that quantifier is the claim’s scope, and at 4.5× the plant’s own 1.27 it is a broad class. The step from the packing figure to that bound is a change of argument, not a new measurement: a packing bound must estimate three geometric factors (the covering-vs-packing direction, the ball’s intersection with U , and the corner factor’s failure to be shear-invariant), and a partition bound estimates none of them — on this instrument the step-1 law is uniform on a sheared box, so equal sub-boxes have probability exactly 1/K. The packing route’s figure is ρ = 1.165 and 2.97, licensing only L ≤ 1.80. The residue is that this is exactly the case the paper is not about: the reset mode has unbounded local Lipschitz constant, so no finite L makes the certificate apply to it, and the danger the paper measures lives entirely in that gap. Two questions the certificate depends on are settled, and settling them made the certificate weaker and the conclusion sharper. First, the within-rollout dependence: it needs no mixing argument and no factorization either — the perrollout miss probability is measured directly and the i.i.d.-ness of rollouts raises it to the N th power exactly. Composed with the partition, that is what gives the 0.933 above, against 1.534 from independent single samples: handling the dependence exactly is worth a factor of 1.6, and the invalid all-steps-independent reading’s 0.785 sits a factor of 1.2 below the valid figure. On a box 6.7× larger the same treatment certifies net radius 1.0, which is the region/resolution trade-off at fixed N rather than a competing figure. Second, the density is derived at every step t ≥ 2 (the last two actions make the step-t law absolutely continuous with an exact constant 1/0.036,

74

and a Minkowski erosion turns that into a pointwise infimum). That extends the certificate to larger regions, but at fixed N extent is paid for with resolution, and no step-t level set certifies a bound below the step-1 figure — so what limits the certificate is not the step-1 restriction but the gate’s size. The nonlinear analogue needs no new argument for the two-action factor: the Jacobian determinant is gain2 dt3 identically for any C 1 force, so the same constant covers the cart and the pendulum — the certificate’s density hypothesis is established on the cart only and must be verified per instrument — and it degenerates only on the mode clamp, where no density argument can work because the truth maps a neighborhood to a point. And the planner-versus-gate mismatch is measured rather than argued: the box the dependence-exact certificate covers carries 1.9% of the exploited planner’s queries, and a box containing every step-t level set carries 7.8% — an upper bound on the certified share. What is left is therefore not a hole in the argument but its conclusion — a certificate sound relative to the L ≤ 5.77 Lipschitz class, with probability at least 1 − δ over the gate’s draws, on a region the planner barely visits. Certifying the planner’s own visitation would need a gate that samples it, which is precisely the change the companion paper’s closing prescription asks for.

O

The LLM protocol, in full

Everything in this appendix is read off the code that produced the campaigns, not described from memory: the pipeline is scripts/continuous danger synthesis.py driving src/cwm/ continuous/contract.py, and the per-campaign counts are regenerated by scripts/llm protocol facts.py into results/llm protocol facts.json. File and line references are as of the revision that produced results/. The agent-relayed Claude arms send the same message text through a different transport (Section O.10).

O.1

The two messages

A cell of a campaign is one (arm, seed) pair. It issues one synthesis call and then zero or more refine calls. In the three displays below, a trailing backslash marks a line wrapped for the page width: the string actually sent contains neither the backslash nor a newline there. Slots in braces are the template’s substitution points. System message (synthesis call only).

One string, sent verbatim (contract.py:87--89):

You are an expert Python programmer. You write deterministic, pure code \ that exactly implements a specified physics world model. Output ONLY a \ single Python code block, no prose.

Synthesis user message. The template (contract.py:90--98); the messages list is exactly [system, user] (contract.py:97--98): {contract} Here are observed transitions (ground truth) to match exactly: {example_lines} {guidance} Write the Python module implementing the contract. Output only one \ ‘‘‘python code block.

75

{contract} is build contract(env,include mode): the instrument’s API text (the pinned integrator equations, in order) plus its rules text (physical constants, reward, and — in the full arm only — the mode clause); contract.py:32--34, text in src/cwm/continuous/instruments.py. {guidance} is the prompt-variant knob of Section O.9; it is the empty string in every default run, and because the template inserts it as extra =f"{guidance}\n\n" if guidance else "" (contract.py:90), an empty guidance leaves the message byte-identical to the pre-knob prompt — asserted in tests/test continuous contract.py and tests/test prompt variants.py. Example lines: how many, and which. One line per shown transition, using repr() throughout, so full float precision is shown (contract.py:67--76): step({state!r}, {action!r}) -> {next_state!r}

reward(next) = {reward!r}

Selection is a stride over the whole sample, not a prefix (a prefix would be a single rollout): idx = sorted({(i * n)//max examples for i in range(min(max examples,n))}) (contract.py:71). At the campaign default of N = 40 rollouts and hepisode = 80 the sample is 3200 transitions on all three instruments, so the prompt shows 30 lines (0.937% of the sample) in the default variant and 120 lines (3.75%) in the guided/region/landing variants (example budget in the JSON). The gate, by contrast, always scores the candidate on all 3200 transitions (contract. py:167--177): the model is shown about one percent of the evidence it is judged on. Refine user message.

There is no system message on a refine call (contract.py:200--206):

{contract} The current implementation is below. It fails some transitions. Fix it \ so every transition matches to within {eps} in x, v and reward. Output \ only one ‘‘‘python code block. CURRENT CODE: ‘‘‘python {code} ‘‘‘ FAILURES (expected vs got): {first max_failures failure lines} {guidance}

Each failure line comes from compare transitions (contract.py:135--164) and is one of step({state!r}, {action!r}) raised {exc!r} step(...): wrong state arity: expected {k} components, got {m} step(...): expected {next_state!r} r={reward!r}, got {got!r} \ r={got_r!r} (err {err:.3g})

Truncation of the failure list. Only the first max failures lines are included, "\n". join(failures[:max failures]) (contract.py:205), with max failures =20 by default (contract.py:191) and 40 in the guided/region/landing variants. Failures are in sample order, so truncation keeps the earliest failures, not the worst ones.

76

Remark 7 (A wart in the refine text, recorded because it is what ran). The sentence says “in x, v and reward” on every instrument, including the four-dimensional PatchField2D whose state is [x, y, vx , vy ] (contract.py:202). The tolerance actually enforced is the sup-norm over all state components and the reward (contract.py:154--155), so the text understates the check on the two-dimensional instrument. This is the text used by every committed run.

O.2

The refine loop

The loop is contract.py:188--214. • Termination. while acc < 1.0 and iterations < max iters (contract.py:199), where acc = contract accuracy(code,transitions,eps) over the whole sample. It stops on the first artifact that matches every transition to ε, or when the budget runs out. Nothing else stops it. • Tolerance. ε = 10−9 in every committed campaign, against a pinned integrator, so the gate is effectively exact match. • Iteration budget per campaign. --max-iters, default 5 (continuous danger synthesis.py:306). The two region-guidance campaigns used 15 (the 3×-budget arm). No other value appears in results/. • The loop is memoryless. Each iteration sends exactly one message, provider. complete([{"role": "user","content": msg}], model=model) (contract.py: 207--208), rebuilt from (contract, current code, current failures). No conversation history, no system message and no assistant turn is carried across iterations; the only state passed forward is the code string. Asserted by test llm calls per seed is one plus refine iterations, which checks that the role sequence is [system, user] on call 0 and [user] on every refine call. • What is recorded. refine iterations per cell is the number of refine calls issued (contract.py:212, :304); it equals max iters exactly when the budget was exhausted without reaching accuracy 1.0.

O.3

Code extraction, and an unparseable reply

Extraction is src/cwm/synthesizer.py:28--35, used for both message types (contract.py:290, :210): the first python-tagged fenced block if there is one, else the first fenced block with any other tag, else the whole reply stripped of surrounding whitespace. There is therefore no parse-failure path: a reply containing no code block is passed on as if it were code, and it fails the gate rather than raising. contract accuracy runs the candidate in a sandbox subprocess (contract.py:101--132); if the sandbox fails, produces no output or prints non-JSON, the accuracy is 0.0 and the single failure line is the error text (contract.py: 173--175), and the refine loop continues normally. In the separate audit path such an artifact is classified invalid — ast.parse raising SyntaxError, a missing or uncallable step/reward, or a raising trivial call (src/cwm/continuous/artifact class.py:90--113, preflight at :59--88) — and invalid is deliberately kept distinct from gate failing. Nothing retries a reply because it was unparseable, and nothing discards a cell for it.

77

O.4

Retry and error policy

• Transport-level retries only, from the OpenAI SDK: max retries = 6, timeout = 120 s for Azure (src/cwm/llm/azure openai.py:10--16) and max retries = 6, timeout = 300 s, max tokens = 8192 for the OpenAI-compatible provider (src/cwm/llm/openai compat.py:11--16). The SDK does exponential backoff and honours Retry-After; the wrappers only raise the ceiling from the SDK default of 2. • No application-level retry and no error swallowing. There is no try/except anywhere around provider.complete in contract.py or in continuous danger synthesis.py. A refusal (no choices) or missing usage metadata raises ValueError (azure openai.py:21--25, openai compat.py:21--22) and the exception propagates out of the sweep loop, ending the run. • What that costs. Nothing already computed: the sweep checkpoints atomically after every cell (continuous danger synthesis.py:179, temporary file plus os.replace), skips already-present (arm, seed index) pairs on restart (:155--160), and refuses to resume a file produced under different result-defining flags (:125--146). • Consequence for the paper. No cell in results/ was retried, resampled or dropped because of a provider error: every cell is the first and only draw for its (arm, seed).

O.5

Sampling parameters, deployments, API version

The sampling parameters actually sent are those in the chat.completions.create(...) call sites (provider sampling params in the JSON): the Azure wrapper sends model and messages only (azure openai.py:20); the OpenAI-compatible wrapper sends model, messages and max tokens= 8192 (openai compat.py:19--20). Neither sends temperature, top p or a request-level seed: all three are left at the provider default. The reason is recorded in the code (azure openai.py: 19): no temperature/top p — GPT-5.4 rejects them. So the runs are not temperature-0 runs; they are whatever the deployment’s default sampling is, which is why every campaign is reported as a distribution over seeds rather than as a single artifact. Consequently the LLM half of the pipeline is not bit-reproducible, while the sample half is (rollout seed 10 000 · (i + 1 + seed offset), continuous danger synthesis.py:164); the synthesized code of every cell is versioned in its result JSON, so every reported number is re-derivable from the artifacts even though a re-run draws new ones. Deployments are selected by the positional size argument (continuous danger synthesis. py:325--327) and are confirmed by the model field each result JSON records for itself: large is gpt-5.4, mini is gpt-5.4-mini, and nano (gpt-5-nano) is never used in any paper-2 campaign — no result JSON carries it. The Azure API version is 2025-04-01-preview, read from AZURE OPENAI API VERSION (:331). The cross-family arm is --compat-model Qwen/Qwen3-Coder-30B-A3B-Instruct through the Hugging Face Inference Providers router at https://router.huggingface.co/v1 (:307) with HF TOKEN authentication (:313). The Claude arm is agent-relayed and has no API wrapper (Section O.10).

O.6

LLM calls per seed

Per cell, llm calls = 1 (synthesis, contract.py:289) + refine iterations (contract.py:207, counter at :212). The identity is verified against the actual number of provider invocations in

78

tests/test prompt variants.py (first-try success, one and three refinements, and the max iters cap). Table 14: LLM calls per campaign. “Campaign” names the artifact results/continuous synthesis ⟨campaign⟩.json, with qwen abbreviating compat-qwen3-coder-30b-a3b-instruct. Every campaign uses the default prompt variant and max iters = 5 except the two pv-region it15 campaigns (region variant, max iters = 15). “Cap” counts cells that exhausted the iteration budget without passing the gate. Source: results/llm protocol facts.json → campaigns. campaign

model

qwen xwall8 large xwall8 large xwall8 off20 mini xwall4 mini xwall8 patch2d qwen k3 7 patch2d large k3 7 patch2d large k3 7 pv-region it15 patch2d large k5 9 patch2d mini k3 7 patch2d mini k3 7 pv-region it15 patch2d mini k5 9 patch2dsq large k3 7 patch2dsq mini k3 7 pendulum qwen thstop1.4 pendulum large thstop1.4 pendulum large thstop1.4 off20 pendulum large thstop1 pendulum mini thstop1.4 pendulum mini thstop1

Qwen3-Coder-30B gpt-5.4 gpt-5.4 gpt-5.4-mini gpt-5.4-mini Qwen3-Coder-30B gpt-5.4 gpt-5.4 gpt-5.4 gpt-5.4-mini gpt-5.4-mini gpt-5.4-mini gpt-5.4 gpt-5.4-mini Qwen3-Coder-30B gpt-5.4 gpt-5.4 gpt-5.4 gpt-5.4-mini gpt-5.4-mini

total (20 campaigns)

cells

calls

min / med / max

cap

6 40 40 10 40 3 40 20 40 40 20 40 40 40 6 40 40 40 40 40

16 48 50 27 62 3 140 320 130 140 320 130 140 140 16 50 54 59 56 58

1/1/6 1/1/2 1/1/2 1/1/6 1/1/6 1/1/1 1 / 3.5 / 6 16 / 16 / 16 1/1/6 1 / 3.5 / 6 16 / 16 / 16 1/1/6 1 / 3.5 / 6 1 / 3.5 / 6 1/1/6 1/1/2 1/1/2 1/1/2 1/1/6 1/1/2

2 0 0 3 1 0 20 20 18 20 20 18 20 20 2 0 0 0 1 0

625

1959

1 / — / 16

The totals are 20 API campaigns, 625 cells and 1959 LLM calls, mean 3.13 calls per cell, range 1–16 (totals in the JSON); adding the two agent-relayed Claude campaigns (12 cells, 39 relayed calls) gives 1998 calls in all. The shape of the distribution is itself a finding: on the one-dimensional instruments the median cell costs one call — translation succeeds on the first try — whereas on PatchField2D at k = (3, 7) exactly half the cells burn the whole budget (20/40 in each of the four k3 7 campaigns), and 20/20 in both fifteen-iteration campaigns, i.e. every region-guidance cell exhausted 15 refinements without passing the gate.

O.7

What the gate is

Per cell (contract.py:285--308): (i) collect transitions(env,n rollouts=40,seed=10 000*(i+1+offset)) — N i.i.d. uniform-random rollouts on the truth, and the same transitions are both the source of the shown examples and the gate (contract.py:37--57); (ii) synthesize, then refine, giving gate accuracy and gate passed = (accuracy = 1.0); (iii) sample contains wall / sample contains mode per, the identifiability event, logged per cell (contract.py: 60--64); (iv) mode blindness (contract.py:238--265), computed only when the gate passed: the fraction of mode-region probe transitions the artifact gets wrong, per mode, at ε = 10−6 , where the probes fire their mode in the truth by construction and this is asserted at runtime

79

(contract.py:253). Single-mode instruments emit a scalar under wall blindness; PatchField2D emits the per-mode dictionary mode blindness and puts its mean in wall blindness.

O.8

Operational classification rules

These are the executable definitions, not paraphrases of them. repaired — two levels, and they are not the same predicate. On the one-dimensional instruments (scripts/audit paper2 numbers.py:368--371) it is gate passed and (wall blindness or 0)== 0.0: the gate reached accuracy 1.0 and every mode probe is reproduced exactly, over cells with arm =="incomplete" and sample contains wall true. On PatchField2D (audit paper2 numbers.py:296) it is [c for c in mode present if c["gate passed"]]: gate passage alone, over cells whose sample contained some mode. That is the weaker test, and it is the honest one to quote for the 0/76: not one artifact even reached accuracy 1.0, so no blindness test was needed to reject it. blind, superstitious patch, disc-form — behavioural. All three are decided by probing the artifact’s step on a grid and comparing against the pure integrator, behaviourally rather than by reading the source (scripts/patch2d artifact audit.py). Instrument (:51--55): an 81 × 81 grid over x ∈ [−2, 14], y ∈ [−8, 8], action 0.3, deviation threshold 10−6 , and two velocity slices (vx , vy ) ∈ {(0, 0), (1.5, 0.5)} (:191--192); m0 is the zero-velocity deviation mask and n0 , n1 the deviating-cell counts in the two slices. Components are 4-neighbour connected (:115--136); the classes in Table 15 are mutually exclusive and exhaustive and are evaluated in the order listed. The classifier is validated against constructed artifacts of known class under --selftest (:427--459), which builds a blind artifact, a half-plane, a disc, a square, a velocity-dependent freeze, a point trap and an exact-coordinate trap and asserts the returned class. Table 15: The behavioural classifier of scripts/patch2d artifact audit.py, in evaluation order. class

operational rule

invalid crash blind blind-textualpatch (the paper’s superstitious patch) vdep point halfplane

exec raises, step missing, or step returns a state of the wrong arity mask construction raises n0 = 0 and n1 = 0, and step’s body has no if n0 = 0 and n1 = 0, and step’s body does contain an if ( step has conditional, :170--175) — a written rule whose trigger set is behaviourally empty, e.g. an exact-coordinate trap, which is measurezero and so never fires n0 = 0 but n1 > 0: deviates only at nonzero velocity largest connected component below 0.5 world-units2 largest component reaches the far-east column or the top or bottom row of the probe window (unbounded proxy, touches far edge, :161--167) bounded, bbox fill ≥ 0.90 bounded, 0.62 ≤ bbox fill < 0.90 and radial ratio ≤ 1.30 (π/4 ≈ 0.785 is a disc’s bbox fill; radial ratio is max over min radial extent across 16 angular bins about the centroid, shape metrics, :139--158) bounded, neither of the above: ellipses, hulls, unions, arcs

square-form disc-form

bounded-other

line :183--189 :190--194 :234--237 :234--236

:238--240 :244--247 :252--254

:257--258 :259--260

:261--262

Two derived per-artifact quantities the paper leans on: cover p1/cover p2, the fraction of the true patch’s grid cells that the artifact’s m0 mask covers (:199--209), where “contains the seen patch” means cover > 0.9 and “patch-selective” means additionally cover(unseen) < 0.1 80

(:400--402); and integrator exact, meaning no numeric (non-freeze-form) deviation anywhere west of x = 1, so that deviations there which preserve position and zero velocity count as an overreaching mode rule rather than as wrong arithmetic (:216--233).

O.9

Prompt variants

Each variant sets exactly three knobs — max examples, max failures and guidance — and nothing else (continuous danger synthesis.py:198--240). The contract text is never touched by a variant (build contract does not take guidance), so no variant can leak the mode clause. Table 16: The prompt variants. Only default and region appear in results/; guided and landing are the intermediate and the follow-up treatment. variant

max examples

max failures

default

30

20

guided

120

40

region

120

40

landing

120

40

guidance empty string; byte-identical to every pre-knob run describe-the-region-first process guidance (:198--204) guided plus “the trigger region need not be a 1-D threshold” de-bias (:205--210) region plus one sentence naming the trigger’s argument (:221--225)

The landing sentence, verbatim (:221--225): A localized rule’s trigger is evaluated on the state the integrator WOULD produce for this step — the landing position (x2, y2) from the integrator equations above — not on the position the step began at (x, y). It exists because the audit of the 40 region-guidance artifacts found 36/40 conditioning the freeze rule on the current position instead of the landing position (x2 , y2 ), the causal variable of the true rule — a variable-identification failure, which is a different failure from getting the region’s geometry wrong. The sentence names only the argument: it uses the variable names the contract’s own integrator block already introduces and states nothing about the region’s shape, centre, radius or count. tests/test prompt variants.py asserts that isolation four ways: the delta over region is exactly one sentence; it contains no shape word and none of the truth’s numeric constants; no line that the full (mode-stating) contract adds over the incomplete one appears in any variant’s guidance; and the guidance inserts into both the synthesis and the refine message without moving anything else.

O.10

The agent-relayed Claude arms

Same contract, same example lines, same refine message and the same five-iteration memoryless loop, but the message was relayed to a Claude instance rather than POSTed, so there is no provider wrapper, no max retries and no usage metadata. Every prompt and reply is versioned verbatim under results/claude relay transcripts/ (* msgk.txt / * replyk.txt, one pair per iteration), and the framing wrapper — including the instruction not to use tools or read repository files — is results/claude relay transcripts/patch2d k3 7 RELAY FRAMING.txt. The two campaigns are the 1-D cart-and-pendulum ledger (results/continuous claude relay.json: 8 cells, 20 relayed calls, min/median/max 1/1.5/6) and the 2-D one (results/continuous claude relay patch2d 81

k3 7.json: 4 cells, 19 relayed calls, 1/6/6). Both counts are cross-checked against the number of * msg*.txt files on disk and agree exactly. Two files in the 2-D transcript directory are named .. duplicate relay DISCARDED.txt: a message relayed twice by accident, whose second reply was discarded. They are not protocol iterations and are excluded from the count (scripts/llm protocol facts.py, transcript call count); with them the on-disk file count would be 21 rather than 19.

P

Reproducibility

Everything in this section is generated rather than transcribed: the facts below are read from results/repro manifest.json, and the numeric audit checks the paper against that file like any other result. Interpreter, platform, and one honest gap. CPython 3.12.8 on macOS 15.7.7 (build 24G720, Darwin 24.6.0), Intel Core i9-9880H at 2.30 GHz, 16 logical cores, 16 GiB. pyproject.toml declares requires-python >= 3.11. No result depends on the hardware except wall-clock: every CPU result is pure-Python or numpy float64 with explicitly seeded random.Random streams, single-threaded, no GPU, and no reduction whose order a BLAS could change, so bit-identical replay is expected on any IEEE-754 host at the same CPython minor version. That expectation is an argument from the code and not a measurement: every number in this paper was produced on one machine, and no second platform has ever run the sweeps. The quantities most exposed to a different libm are the ones printed to twelve digits (Jtruth = 17.757356407381 and 17.772246981024) and the 10−15 linear-fit residuals of Table 7; those are the first to re-check elsewhere. Dependencies, and what is still missing. pyproject.toml declares lower bounds only. A pinned environment is committed at docs/paper2/requirements-frozen.txt (pip freeze inside the repository’s virtual environment), which is not a lockfile: it carries no hashes and no resolver metadata. What reproducibility still needs and does not have is an archived release — a git tag with a DOI — so that “the code is on GitHub” becomes a citable artifact rather than a mutable branch. We state this as an outstanding gap rather than implying otherwise. Licence. Code: Apache-2.0 (LICENSE, declared in pyproject.toml). Paper text, figures and the result artifacts under results/, including every synthesized program the paper quotes: CC-BY-4.0 (docs/paper2/LICENSE-artifacts). Credentials. The scripts read exactly six environment variables, listed with their call sites in docs/paper2/env.example: AZURE OPENAI ENDPOINT, AZURE OPENAI API KEY, AZURE OPENAI API VERSION, AZURE DEPLOYMENT MINI, AZURE DEPLOYMENT LARGE and HF TOKEN. No secret appears in the repository. Every CPU result in this paper runs without any of them. What backs each table and figure. The manifest maps every table and figure to the versioned JSON it is derived from and the script that produced it, and it distinguishes three tiers of checking rather than collapsing them: cell-parsed, where scripts/audit paper2 numbers.py parses the tabular out of main.tex and compares every cell against the JSON at printed precision; claimsonly, where the audit does not parse the object but asserts values quoted from it; and unaudited. Of the fifteen tables and figures, nine are cell-parsed, five are claims-only, and one — Table 5, whose counts are read from the per-seed synthesis JSONs by hand — is unaudited, which we record as a 82

gap rather than leave implicit. The manifest is itself cross-checked two ways: a static parse of the audit’s sections collects the file arguments it names, and a dynamic pass execs the audit with file reads instrumented and records what it actually opens. The two agreeing is a stored assertion, and it failed on the generator’s first run (the static parse missed the files reached through a wrapper and a glob), which is what the cross-check is for. object

backing results/ JSON

checking

tab:epsstar tab:danger fig:threshold fig:reach tab:pendulum tab:patch2d tab:cem tab:axes fig:axes tab:eps-sweep tab:mitigation tab:patch2d-mitigation tab:pendulum-synthesis tab:smooth fig:smooth

eps invariance threshold continuous reach continuous reach continuous reach continuous pendulum continuous patch2d continuous cem, cem crossing bound continuous axes continuous axes continuous eps sweep continuous mitigation continuous mitigation patch2d none (per-seed JSONs) continuous smooth probe continuous smooth probe

claims cells claims claims cells cells cells cells claims cells cells cells unaudited cells claims

Table 17: The manifest: what backs each table and figure, and how it is checked. “cells” means every printed cell is compared against the JSON at printed precision on every run of the numeric audit; “claims” means the audit asserts quoted values without parsing the object. Each JSON is written by the script of the same stem under scripts/ (continuous reach.json by continuous reach.py, and so on); the figures are rendered from their table’s JSON by make paper2 figures.py, which runs no experiment, so every figure inherits its table’s provenance. Machine-readable form, including the audit call sites per object, in results/repro manifest.json under manifest[].

Runtime, as a lower bound. Thirty-seven of the result files record their own elapsed s: CPU sweeps total 4.78 h and the LLM synthesis arms 6.01 h, so the named campaigns are 10.79 h. That is a lower bound on what the paper cost, because each figure is one run of the script that wrote the file and therefore excludes the 5-seed cells later superseded at 20 seeds, the ablation resume passes, every sweep superseded by a later sample-size raise, and every failed or retried LLM call. Seven scripts named in the commands below carry a ~N min annotation in this paper but write no elapsed s, so those seven runtimes are unverified estimates and are marked as such in the manifest. LLM cost, as a range and why not a point. The call count is exact: 1959 API calls over 625 cells across twenty campaigns, derived per cell as one synthesis call plus its refinement iterations, of which the two guided 3×-budget cells account for 640; plus 20 relay rounds on the subscriptiontransport Claude arms. The token count is not recorded — the providers capture usage and the refinement loop keeps it, but the emitted cell never copies it, so no paper-2 artifact carries a token count. Combining the measured call count with the design spec’s pre-run estimate of 1–2k prompt tokens per call brackets the API arms at roughly 106 to 107 tokens, i.e. single to low-double-digit US dollars at 2026 prices for this model class. We state that range rather than a figure, and note what would make it exact: an Azure billing export for the window, or a re-derivation of firstcall prompt tokens offline, which is possible at zero API spend because collect transitions, 83

build contract and build synthesis messages are pure functions of the instrument, knob, seed and N (completion tokens for superseded refinement iterations are gone). The only measured dollar figures in the repository belong to the companion paper’s campaigns and total $3.73, useful as an order-of-magnitude anchor and nothing more. Reproducing the paper. Two commands regenerate everything derived: make paper2 figures.py rebuilds the figures from the JSONs, and audit paper2 numbers.py re-derives every table cell and counted prose claim from results/ and exits non-zero on any disagreement. The experiment commands themselves are listed below; the CPU ones need no credentials.

Q

Pre-specification, and what was added after the result

A study that reports negative results, ablations built to explain them, and theory derived after the fact owes the reader a way to tell those apart. This section is that ledger. Every date below is read from the repository’s history rather than recalled, and the commands that re-derive each one are listed in docs/paper2/PRESPEC-LEDGER.md. Five labels are used: pre-specified (a dated design document predicted it before any run), confirmatory (ran as specified), diagnostic (added to explain or repair an observed result), exploratory ablation (added after seeing a result, to test a hypothesis the result suggested), and post-hoc (an analysis or a theorem chosen after the data existed). What was pre-specified. The design document is dated 2026-07-06 and its predictions were committed before the first run. Fourteen items are pre-specified and confirmatory: the threshold law’s expected shape; the reach mechanism as an explicit go/no-go gate on the whole study; the wall position as the rarity knob; the gate-miss exactness check against (1 − r)N ; the pervasive-error control arm that makes the axis separation a separation; the smooth-bump contrast, with “danger stays low” predicted; the smooth-learner probe; the full-spec synthesis control; the mode-absent conditional, including the ≈60% rate; the ε-sensitivity sweep, which the spec listed under Risks as required; the pendulum as the second instrument; the Qwen cross-family check; and the pendulum synthesis arm. The tightest of these is worth naming, because it is the strongest pre-specification claim the paper can make: the spec’s runbook predicted the mode-present branch as a contingency — “either outcome is a finding; if it repairs, that becomes its own section” — so the repair result is a pre-registered branch and not a post-hoc pivot. The first confirmation landed 2 h 40 min after the prediction was committed. What was added after the result it responds to. Fifteen items, and the five the review asks about specifically are all in this group. The PatchField2D instrument was named in the spec as one of two options for a second instrument, with no predictions attached, and its campaign was built eleven days later in response to a review of the 1D work. The square ablation was added two to three days after the 2D repair failure it explains, and it is a genuine falsification test of a hypothesis that was itself post-hoc: the curvature reading was born of the result the ablation then excluded. The guided-prompt ablation was added two days after the same failure, and its two cells are the most expensive in the paper (320 calls each, 640 of the campaign’s 1959). The disjoint seed blocks and the 50,000-rollout dependence re-measurement are both repairs of errors a review found — pooled intervals over shared samples, and an unstated independence assumption — eighteen and eight days after the results they correct. The sharp-plateau reward variant

84

was added nineteen days after the “below random at every knob” claim it rescues. The distrustregion mitigation appears in no version of the design document at all; the paper presents it as a contribution rather than as a prediction, which is the correct framing. Two further items changed the paper’s own reading of a result rather than confirming it: the per-episode fence census turned a “boundary-mapping transient” into “a growing fraction of outright failures”, and the behavioural artifact audit shipped once with a vacuous check (a mis-keyed dictionary lookup meant its partialrepair condition never fired), whose correction moved a headline count. The theory is post-hoc, and part of it was explicitly out of scope. Every propositionbacking artifact in this paper was produced after all the data existed, most of them because a measurement looked suspiciously exact and the question was whether something could be proved. That is a legitimate way to find a theorem and an illegitimate way to claim a prediction, so none of the theory is presented as predicted. One item is more than post-hoc: the design document said of exactly this material, “covering-number analogues are open; mention as a limitation, do not attempt for paper 2”. The paper now contains four such results. They were added late, and the first version of the fencing bound was wrong in the direction that mattered — a covering number where a packing number was needed, with a hand-computed constant that was also wrong — caught by a reader’s question rather than by the numeric audit, and corrected the same day. The manuscript’s own claims of pre-registration and falsification. Ten phrases in this paper assert something about our process. Seven are supported, one is supported as a statistical rather than a temporal claim (the coverage certificate’s cell family is fixed before the data by construction, which is what that argument needs and does not require a dated record), and two were not supported by any dated record and have been corrected in this revision: • The sharp-plateau variant’s competence risk was described as “the pre-registered risk”. No dated text records it before the result; the pre-run note for that variant states a cost, a payoff and a different caveat. The text now says “the risk recorded with the variant’s script”. • The 2D section said “we predicted partial repair”. The instrumentation that detects partial repair — the per-mode sample flags and the four-way branch summary — was written in the same commit as the run, so the expectation is real and designed for; but the sentence itself first appears one day after the measurement. The text now says the instrument was built to detect partial repair and that none occurred. A third phrase, “an axis-aligned square with flat edges excludes the curvature reading”, is sound as logic but was silent about chronology; it now states that the ablation was added after the result it responds to. Summary. Fourteen pre-specified and confirmatory items, all on the one-dimensional story: the mechanism, the axis separation, the smooth contrast, both 1D instruments, and the synthesis trichotomy including its contingency branch. Fifteen items added after the results they respond to, of which five are diagnostic repairs driven by review, five are exploratory ablations, three are post-hoc analyses and two are mixed. Ten post-hoc theory results. The reader should treat the 1D synthesis result as confirmatory and everything about the two-dimensional mode — including the two ablations that exclude curvature and prompting — as exploratory work whose hypotheses were formed after the finding.

85

Declarations Funding. This work received no external funding. The LLM API costs, bounded in Section P, were borne by the author. Competing interests.

The author declares no competing interests.

Data and code availability. All code, every result artifact, and every synthesized program the paper quotes are in the repository named in Section P (code under Apache-2.0, paper and artifacts under CC-BY-4.0). The two commands that regenerate every figure and re-derive every table cell from those artifacts are given there. Section P also states what availability still lacks: an archived, DOI-bearing release rather than a branch. Use of AI systems. Large language models are the object of study here: they synthesize the world models the paper evaluates, under the protocol specified in full in Section O, with every prompt, deployment identifier and call count recorded. Language models were additionally used as writing and analysis assistants during the preparation of the manuscript and the experiment code. All theorem statements, proofs, experimental designs and conclusions are the author’s, and every number in the paper is re-derived from a versioned artifact by scripts/audit paper2 numbers.py rather than taken on trust. Anonymization. This version is not anonymized: it names the author, the affiliation, a personal URL, and a repository whose name identifies the author. A double-blind submission requires removing those four, and replacing the nine citations to the companion paper with a third-person reference to it.

References Alessandro Abate, Cristina David, Pascal Kesseli, Daniel Kroening, and Elizabeth Polgreen. Counterexample guided inductive synthesis modulo theories. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 270–288. Springer, 2018. doi: 10.1007/ 978-3-319-96145-3 15. Javier Aguilar Martı́n. When a verified world model still loses: Play-adequacy vs predictionaccuracy in LLM-synthesized code world models, 2026. Companion paper (paper 1). arXiv:2607.14169, https://arxiv.org/abs/2607.14169; repository: https://github.com/ JaviMaligno/code-world-models. Mohammed Alshiekh, Roderick Bloem, Rüdiger Ehlers, Bettina Könighofer, Scott Niekum, and Ufuk Topcu. Safe reinforcement learning via shielding. In Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence (AAAI), pages 2669–2678, 2018. Rajeev Alur, Thao Dang, and Franjo Ivančić. Counterexample-guided predicate abstraction of hybrid systems. Theoretical Computer Science, 354(2):250–271, 2006. doi: 10.1016/j.tcs.2005.11. 026.

86

Rajeev Alur, Rastislav Bodı́k, Garvit Juniwal, Milo M. K. Martin, Mukund Raghothaman, Sanjit A. Seshia, Rishabh Singh, Armando Solar-Lezama, Emina Torlak, and Abhishek Udupa. Syntaxguided synthesis. In Formal Methods in Computer-Aided Design (FMCAD), pages 1–8. IEEE, 2013. doi: 10.1109/FMCAD.2013.6679385. Dana Angluin. Learning regular sets from queries and counterexamples. Information and Computation, 75(2):87–106, 1987. doi: 10.1016/0890-5401(87)90052-6. Yashwanth Annpureddy, Che Liu, Georgios Fainekos, and Sriram Sankaranarayanan. S-TaLiRo: A tool for temporal logic falsification for hybrid systems. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS), volume 6605 of Lecture Notes in Computer Science, pages 254–257. Springer, 2011. Alberto Bemporad and Manfred Morari. Control of systems integrating logic, dynamics, and constraints. Automatica, 35(3):407–427, 1999. Alberto Bemporad, Andrea Garulli, Simone Paoletti, and Antonio Vicino. A bounded-error approach to piecewise affine system identification. IEEE Transactions on Automatic Control, 50 (10):1567–1580, 2005. doi: 10.1109/TAC.2005.856667. Luca Bortolussi, Francesca Cairoli, Nicola Paoletti, Scott A. Smolka, and Scott D. Stoller. Neural predictive monitoring. In Runtime Verification (RV), Lecture Notes in Computer Science, pages 129–147. Springer, 2019. doi: 10.1007/978-3-030-32079-9 8. Ricky T. Q. Chen, Brandon Amos, and Maximilian Nickel. Learning neural event functions for ordinary differential equations. In International Conference on Learning Representations (ICLR), 2021. Kurtland Chua, Roberto Calandra, Rowan McAllister, and Sergey Levine. Deep reinforcement learning in a handful of trials using probabilistic dynamics models. In Advances in Neural Information Processing Systems (NeurIPS), 2018. Koen Claessen and John Hughes. QuickCheck: A lightweight tool for random testing of Haskell programs. In Proceedings of the Fifth ACM SIGPLAN International Conference on Functional Programming (ICFP), pages 268–279, 2000. Edmund M. Clarke, Orna Grumberg, Somesh Jha, Yuan Lu, and Helmut Veith. Counterexampleguided abstraction refinement. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 154–169. Springer, 2000. doi: 10.1007/10722167 15. Edmund M. Clarke, Ansgar Fehnker, Zhi Han, Bruce Krogh, Olaf Stursberg, and Michael Theobald. Verification of hybrid systems based on counterexample-guided abstraction refinement. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS), Lecture Notes in Computer Science, pages 192–207. Springer, 2003. doi: 10.1007/3-540-36577-X 14. Anthony Corso, Robert J. Moss, Mark Koren, Ritchie Lee, and Mykel J. Kochenderfer. A survey of algorithms for black-box safety validation of cyber-physical systems. Journal of Artificial Intelligence Research, 72:377–428, 2021. Rémi Coulom. Efficient selectivity and backup operators in monte-carlo tree search. In Computers and Games (CG 2006), volume 4630 of Lecture Notes in Computer Science, pages 72–83. Springer, 2006. 87

Tommaso Dreossi, Shromona Ghosh, Xiangyu Yue, Kurt Keutzer, Alberto L. SangiovanniVincentelli, and Sanjit A. Seshia. Counterexample-guided data augmentation. In Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI), pages 2071–2078, 2018. doi: 10.24963/ijcai.2018/286. Tommaso Dreossi, Daniel J. Fremont, Shromona Ghosh, Edward Kim, Hadi Ravanbakhsh, Marcell Vazquez-Chanlatte, and Sanjit A. Seshia. VerifAI: A toolkit for the formal design and analysis of artificial intelligence-based systems. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 432–442. Springer, 2019. doi: 10.1007/978-3-030-25540-4 25. Amir-massoud Farahmand. Iterative value-aware model learning. In Advances in Neural Information Processing Systems 31 (NeurIPS), 2018. Amir-massoud Farahmand, Andre Barreto, and Daniel Nikovski. Value-aware loss function for model-based reinforcement learning. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), volume 54 of Proceedings of Machine Learning Research, pages 1486–1494, 2017. Nima Fazeli, Roman Kolbert, Russ Tedrake, and Alberto Rodriguez. Parameter and contact force estimation of planar rigid-bodies undergoing frictional contact. The International Journal of Robotics Research, 36(13–14):1437–1454, 2017. Nima Fazeli, Samuel Zapolsky, Evan Drumwright, and Alberto Rodriguez. Fundamental limitations in performance and interpretability of common planar rigid-body contact models. In Robotics Research, Springer Proceedings in Advanced Robotics, pages 555–571. Springer, 2020. doi: 10. 1007/978-3-030-28619-4 41. Giancarlo Ferrari-Trecate, Marco Muselli, Diego Liberati, and Manfred Morari. A clustering technique for the identification of piecewise affine systems. Automatica, 39(2):205–217, 2003. doi: 10.1016/S0005-1098(02)00224-8. Luyu Gao, Aman Madaan, Shuyan Zhou, Uri Alon, Pengfei Liu, Yiming Yang, Jamie Callan, and Graham Neubig. PAL: Program-aided language models. In Proceedings of the 40th International Conference on Machine Learning (ICML), volume 202 of Proceedings of Machine Learning Research, pages 10764–10799, 2023. Miriam Garcı́a Soto, Thomas A. Henzinger, Christian Schilling, and Luka Zeleznik. Membershipbased synthesis of linear hybrid automata. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 297–314. Springer, 2019. doi: 10.1007/978-3-030-25540-4 16. Miriam Garcı́a Soto, Thomas A. Henzinger, and Christian Schilling. Synthesis of hybrid automata with affine dynamics from time-series data. In Proceedings of the 24th International Conference on Hybrid Systems: Computation and Control (HSCC), pages 1–11. ACM, 2021. doi: 10.1145/ 3447928.3456704. Michel Gevers. Identification for control: From the early achievements to the revival of experiment design. European Journal of Control, 11(4–5):335–352, 2005. doi: 10.3166/ejc.11.335-352. E. Mark Gold. Complexity of automaton identification from given data. Information and Control, 37(3):302–320, 1978. doi: 10.1016/S0019-9958(78)90562-4.

88

Christopher Grimm, André Barreto, Satinder Singh, and David Silver. The value equivalence principle for model-based reinforcement learning. In Advances in Neural Information Processing Systems 33 (NeurIPS), 2020. Sumit Gulwani. Automating string processing in spreadsheets using input-output examples. In Proceedings of the 38th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), pages 317–330. ACM, 2011. doi: 10.1145/1926385.1926423. Sumit Gulwani, Oleksandr Polozov, and Rishabh Singh. Program synthesis. Foundations and Trends in Programming Languages, 4(1–2):1–119, 2017. doi: 10.1561/2500000010. Danijar Hafner, Timothy Lillicrap, Jimmy Ba, and Mohammad Norouzi. Dream to control: Learning behaviors by latent imagination. In International Conference on Learning Representations (ICLR), 2020. Thomas Hérault, Richard Lassaigne, Frédéric Magniette, and Sylvain Peyronnet. Approximate probabilistic model checking. In Verification, Model Checking, and Abstract Interpretation (VMCAI), Lecture Notes in Computer Science, pages 73–84. Springer, 2004. doi: 10.1007/978-3-540-24622-0 8. Lukas Hewing, Kim P. Wabersich, Marcel Menner, and Melanie N. Zeilinger. Learning-based model predictive control: Toward safe learning in control. Annual Review of Control, Robotics, and Autonomous Systems, 3:269–296, 2020. doi: 10.1146/annurev-control-090419-075625. Robert A. Jacobs, Michael I. Jordan, Steven J. Nowlan, and Geoffrey E. Hinton. Adaptive mixtures of local experts. Neural Computation, 3(1):79–87, 1991. doi: 10.1162/neco.1991.3.1.79. Michael Janner, Justin Fu, Marvin Zhang, and Sergey Levine. When to trust your model: Modelbased policy optimization. In Advances in Neural Information Processing Systems (NeurIPS), 2019. Susmit Jha and Sanjit A. Seshia. A theory of formal synthesis via inductive learning. Acta Informatica, 54(7):693–726, 2017. doi: 10.1007/s00236-017-0294-5. Susmit Jha, Sumit Gulwani, Sanjit A. Seshia, and Ashish Tiwari. Oracle-guided component-based program synthesis. In Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering (ICSE), volume 1, pages 215–224. ACM, 2010. doi: 10.1145/1806799.1806833. James Kapinski, Jyotirmoy V. Deshmukh, Sriram Sankaranarayanan, and Nikos Arechiga. Simulation-guided Lyapunov analysis for hybrid dynamical systems. In Proceedings of the 17th International Conference on Hybrid Systems: Computation and Control (HSCC), pages 133–142. ACM, 2014. doi: 10.1145/2562059.2562139. Levente Kocsis and Csaba Szepesvári. Bandit based Monte-Carlo planning. In Proceedings of the 17th European Conference on Machine Learning (ECML), pages 282–293, 2006. Nathan O. Lambert, Brandon Amos, Omry Yadan, and Roberto Calandra. Objective mismatch in model-based reinforcement learning. In Proceedings of the 2nd Conference on Learning for Dynamics and Control (L4DC), volume 120 of Proceedings of Machine Learning Research, pages 761–770, 2020. arXiv:2002.04523.

89

Leonidas Lampropoulos, Diane Gallois-Wong, Cătălin Hriţcu, John Hughes, Benjamin C. Pierce, and Li-yao Xia. Beginner’s luck: A language for property-based generators. In Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages (POPL), pages 114–129. ACM, 2017. doi: 10.1145/3009837.3009868. Axel Legay, Benoı̂t Delahaye, and Saddek Bensalem. Statistical model checking: An overview. In Runtime Verification (RV), Lecture Notes in Computer Science, pages 122–135. Springer, 2010. doi: 10.1007/978-3-642-16612-9 11. Wolfgang Lehrach, Daniel Hennes, Miguel Lazaro-Gredilla, Xinghua Lou, Carter Wendelken, Zun Li, Antoine Dedieu, Jordi Grau-Moya, Marc Lanctot, Atil Iscen, John Schultz, Marcus Chiam, Ian Gemp, Piotr Zielinski, Satinder Singh, and Kevin P. Murphy. Code World Models for general game playing. In International Conference on Learning Representations (ICLR), 2026. OpenReview id 1UoB7IWiku. Jacky Liang, Wenlong Huang, Fei Xia, Peng Xu, Karol Hausman, Brian Ichter, Pete Florence, and Andy Zeng. Code as policies: Language model programs for embodied control. In IEEE International Conference on Robotics and Automation (ICRA), pages 9493–9500, 2023. Lars Lindemann, Matthew Cleaveland, Gihyun Shim, and George J. Pappas. Safe planning in dynamic environments using conformal prediction. IEEE Robotics and Automation Letters, 8(8): 5116–5123, 2023. doi: 10.1109/LRA.2023.3292071. Scott W. Linderman, Matthew J. Johnson, Andrew C. Miller, Ryan P. Adams, David M. Blei, and Liam Paninski. Bayesian learning and inference in recurrent switching linear dynamical systems. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), volume 54 of Proceedings of Machine Learning Research, pages 914–922, 2017. Lennart Ljung. System Identification: Theory for the User. Prentice Hall PTR, Upper Saddle River, NJ, 2nd edition, 1999. ISBN 0-13-656695-2. Andreas Löscher and Konstantinos Sagonas. Targeted property-based testing. In Proceedings of the 26th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pages 46–56. ACM, 2017. doi: 10.1145/3092703.3092711. Andreas Löscher and Konstantinos Sagonas. Automating targeted property-based testing. In IEEE 11th International Conference on Software Testing, Verification and Validation (ICST), pages 70–80. IEEE, 2018. doi: 10.1109/ICST.2018.00017. Anirudha Majumdar, Alec Farid, and Anoopkumar Sonar. PAC-Bayes control: Learning policies that provably generalize to novel environments. The International Journal of Robotics Research, 40(2–3):574–593, 2021. doi: 10.1177/0278364920959444. Published online 3 October 2020; print issue February 2021. Ramy Medhat, S. Ramesh, Borzoo Bonakdarpour, and Sebastian Fischmeister. A framework for mining hybrid automata from input/output traces. In International Conference on Embedded Software (EMSOFT), pages 177–186. IEEE, 2015. doi: 10.1109/EMSOFT.2015.7318273. Raman K. Mehra. Optimal input signals for parameter estimation in dynamic systems — survey and new results. IEEE Transactions on Automatic Control, 19(6):753–768, 1974. doi: 10.1109/ TAC.1974.1100701.

90

Anusha Nagabandi, Gregory Kahn, Ronald S. Fearing, and Sergey Levine. Neural network dynamics for model-based deep reinforcement learning with model-free fine-tuning. In IEEE International Conference on Robotics and Automation (ICRA), 2018. Rohan Padhye, Caroline Lemieux, Koushik Sen, Mike Papadakis, and Yves Le Traon. Semantic fuzzing with Zest. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pages 329–340. ACM, 2019. doi: 10.1145/3293882. 3330576. Simone Paoletti, Aleksandar Lj. Juloski, Giancarlo Ferrari-Trecate, and René Vidal. Identification of hybrid systems: A tutorial. European Journal of Control, 13(2-3):242–260, 2007. Mihir Parmar, Mathew Halm, and Michael Posa. Fundamental challenges in deep learning for stiff contact dynamics. In IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 5181–5188. IEEE, 2021. doi: 10.1109/IROS51168.2021.9636383. Samuel Pfrommer, Mathew Halm, and Michael Posa. ContactNets: Learning discontinuous contact dynamics with smooth, implicit representations. In Proceedings of the 2020 Conference on Robot Learning (CoRL), volume 155 of Proceedings of Machine Learning Research, pages 2279–2291, 2021. Conference held 16–18 November 2020; proceedings volume published 2021. Michael Poli, Stefano Massaroli, Luca Scimeca, Seong Joon Oh, Sanghyuk Chun, Atsushi Yamashita, Hajime Asama, Jinkyoo Park, and Animesh Garg. Neural hybrid automata: Learning dynamics with multiple modes and stochastic transitions. In Advances in Neural Information Processing Systems 34 (NeurIPS), 2021. Hadi Ravanbakhsh and Sriram Sankaranarayanan. Learning control Lyapunov functions from counterexamples and demonstrations. Autonomous Robots, 43(2):275–307, 2019. doi: 10.1007/ s10514-018-9791-9. Published online 6 August 2018; print issue February 2019. James B. Rawlings, David Q. Mayne, and Moritz M. Diehl. Model Predictive Control: Theory, Computation, and Design. Nob Hill Publishing, 2nd edition, 2017. Jacob Roll, Alberto Bemporad, and Lennart Ljung. Identification of piecewise affine systems via mixed-integer programming. Automatica, 40(1):37–50, 2004. doi: 10.1016/j.automatica.2003.08. 006. Ugo Rosolia and Francesco Borrelli. Learning model predictive control for iterative tasks. a datadriven control framework. IEEE Transactions on Automatic Control, 63(7):1883–1896, 2018. doi: 10.1109/TAC.2017.2753460. Reuven Y. Rubinstein and Dirk P. Kroese. Simulation and the Monte Carlo Method. Wiley, 3rd edition, 2017. Julian Schrittwieser, Ioannis Antonoglou, Thomas Hubert, Karen Simonyan, Laurent Sifre, Simon Schmitt, Arthur Guez, Edward Lockhart, Demis Hassabis, Thore Graepel, Timothy Lillicrap, and David Silver. Mastering Atari, Go, chess and Shogi by planning with a learned model. Nature, 588(7839):604–609, 2020. doi: 10.1038/s41586-020-03051-4. Koushik Sen, Mahesh Viswanathan, and Gul Agha. Statistical model checking of black-box probabilistic systems. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 202–215. Springer, 2004. doi: 10.1007/978-3-540-27813-9 16. 91

Danbing Seto, Bruce Krogh, Lui Sha, and Alongkrit Chutinan. The Simplex architecture for safe online control system upgrades. In Proceedings of the American Control Conference (ACC), volume 6, pages 3504–3508. IEEE, 1998. doi: 10.1109/ACC.1998.703255. Burr Settles. Active Learning. Synthesis Lectures on Artificial Intelligence and Machine Learning. Springer, 2012. doi: 10.1007/978-3-031-01560-1. Lui Sha. Using simplicity to control complexity. IEEE Software, 18(4):20–28, 2001. doi: 10.1109/ MS.2001.936213. Armando Solar-Lezama. Program Synthesis by Sketching. Ph.D. thesis, University of California, Berkeley, 2008. EECS Department technical report UCB/EECS-2008-177, 19 December 2008. Armando Solar-Lezama, Liviu Tancau, Rastislav Bodik, Sanjit Seshia, and Vijay Saraswat. Combinatorial sketching for finite programs. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 404–415. ACM, 2006. doi: 10.1145/1168857.1168907. Frits Vaandrager. Model learning. Communications of the ACM, 60(2):86–95, 2017. doi: 10.1145/ 2967606. René Vidal, Stefano Soatto, Yi Ma, and Shankar Sastry. An algebraic geometric approach to the identification of a class of linear hybrid systems. In Proceedings of the 42nd IEEE Conference on Decision and Control (CDC), volume 1, pages 167–172. IEEE, 2003. doi: 10.1109/CDC.2003. 1272554. Vladimir Vovk, Alexander Gammerman, and Glenn Shafer. Algorithmic Learning in a Random World. Springer, 2nd edition, 2022. doi: 10.1007/978-3-031-06649-8. Kim P. Wabersich and Melanie N. Zeilinger. A predictive safety filter for learning-based control of constrained nonlinear dynamical systems. Automatica, 129:109597, 2021. doi: 10.1016/j. automatica.2021.109597. Andrew Wagenmaker and Kevin Jamieson. Active learning for identification of linear dynamical systems. In Proceedings of the 33rd Conference on Learning Theory (COLT), volume 125 of Proceedings of Machine Learning Research, pages 3487–3582, 2020. Edwin B. Wilson. Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158):209–212, 1927. Yoriyuki Yamagata, Shuang Liu, Takumi Akazaki, Yihai Duan, and Jianye Hao. Falsification of cyber-physical systems using deep reinforcement learning. IEEE Transactions on Software Engineering, 47(12):2823–2840, 2021. doi: 10.1109/TSE.2020.2969178. Håkan L. S. Younes and Reid G. Simmons. Probabilistic verification of discrete event systems using acceptance sampling. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 223–235. Springer, 2002. doi: 10.1007/3-540-45657-0 17.

92

Related documents

• Analyzing Chain of Thought (CoT) Approaches in Control Flow Code Deobfuscation Tasks#31347
• The Simulation Argument Revisited through the Reconstruction of its Missing Elements#689114
• CONDITIONAL STATEMENTS AND PROGRAM CODING: AN EXPERIMENTAL EVALUATION#933705
• Understanding Secret Leakage Risks in Code LLMs: A Tokenization Perspective#120422
• Assessing Local Differential Privacy for Compliance with the Personal Data Protection Law in Integrated Data Systems#318388