# paper_safety — registered outline (before the evidence) **Status:** *plan registered*. The thesis and figure set are fixed **before** the H-S / H-CT runs, so the paper's claims are committed in advance of the evidence. **Location:** `mjolnir_research/cartographer/docs/paper_safety/` **Feeds from:** `../../env_substrates/highway/` (`results/*.json`, `.env.mp4`). **Standard:** same as `../paper_sound_by_verification/paper.md` and `../paper_characterization/paper.md` — registered falsifiers; **figures generated verbatim from the artifacts** by `make_figures.py` (nothing hard-coded); tables; honest negatives; artifact provenance; theory connection. --- ## Thesis (registered, one sentence) > **Containment (Thm 1) holds for arbitrary proposers across diverse continuous-control > environments — and the safety boundary is the *authority's model*, not the proposer; > a certified corpus transfers by structural similarity of the local situation, not by > scenario identity.** The two halves are the H-S and H-CT suites; each half has a registered falsifier that would force a different (or null) thesis. **Corrected by the evidence (H-S outcome, 2026-10-11) — and the correction is the paper's finding.** The registered thesis's first half is **falsified for a one-step guard**: 27 ego-initiated collisions (15 pointwise + 12 horizon). Containment holds *only* with a **horizon-sound** guard; a one-step guard is unsound for dynamics with memory. The horizon-sound lookahead guard (k=3) cuts it to **2** (93%) — and the residual is the authority's **approximate dynamics model**, which is precisely the **Thm 5** territory the thesis's second half predicted. So the paper's thesis becomes: > *Containment holds for arbitrary proposers **iff the guard is horizon-sound**; the > safety boundary is the authority's model — its horizon, thresholds and dynamics — not > the proposer — and the residual after the fix names the next theorem (Thm 5).* **The corpus half is partially confirmed (H-CT outcome, 2026-10-11).** The fingerprint is **real and structural** — the scenario-id control collapses to **0%** and the shuffled control to **13%** against the relational fingerprint's **50%** (CT-3/CT-4 pass), and the corpus adds **zero** safety cost beyond the verifier's residual (CT-2 passes: it is sound by construction). But the transfer is **weak across scenarios** (15% mean vs the 30% bar) and **retention fails** (CT-5), so the corpus is today a *within-scenario accelerator*, not a general method. The paper's honest claim: **the retrieval key must match the situation that matters** — PI1's lesson, restated for a corpus. ## Sections 1. **Abstract** — containment + the boundary + the corpus, with the falsifiers named. 2. **The frame** — recap Thm 1 (containment), the declarative traffic authority (predicates: gap / TTC / lane / bounds), the guard, the arbitrary proposer. 3. **The safety matrix (H-S)** — GS-1 (held-out proposers), GS-2 (the abstain wall), GS-4 (adversarial others), GS-6 (cross-env invariance). *Ego-initiated vs other-initiated* attribution, with the geometric heuristic stated. 4. **The authority boundary (GS-3)** — the *informative negative*: undetected (other-initiated) breaches isolate whether the guard's model matches the env. Points to Thm 5 (containment under an approximate authority) as the needed theory. 5. **Incremental certified-corpus transfer (H-CT)** — CT-1..CT-6: warm-start, soundness, the fingerprint-is-real control, the identity control, retention, growth. 6. **Scope and open problems** — what is *not* claimed (GS-5 recovery lands with H2; sim2real out of scope; the attribution heuristic is a heuristic). 7. **Empirical provenance** — every number read from `env_substrates/highway/results/`. ## Figures (all read verbatim from the artifacts) | fig | content | source artifact | |---|---|---| | fig1 | ego- vs other-initiated collisions across scenarios | `results/safety.json` | | fig2 | guard activity per scenario (blocks) | `results/scenarios.json` | | fig3 | certified-search expansions vs corpus size | `results/transfer.json` | | fig4 | within- vs cross-scenario transfer | `results/transfer.json` | | fig5 | retention (corpus still helps A after learning B) | `results/transfer.json` | | fig6 | one-step guard vs the horizon-sound guard (the fix) | `results/safety.json` | `make_figures.py` skips a figure if its artifact does not exist yet — it never fabricates a number. ## Tables - per-scenario safety table (steps, ego-initiated, other-initiated, guard blocks); - per-proposer table (random / greedy / attack); - corpus-transfer table (cold vs corpus vs shuffled vs identity, within vs cross). ## Registered falsifiers (the paper must report them) - **F-1:** any ego-initiated collision under the guard ⇒ containment fails (GS-1). - **F-2:** a breach whose safe fallback was disabled by `v_min` ⇒ the static-abstain assumption of Thm 1 fails (GS-2) — the wall is real, the guard must be dynamic. - **F-3:** a systematic *other-initiated* breach pattern ⇒ the **authority** is incomplete (GS-3) — the framework's safety limit is the model, not the proposer. - **F-4:** the shuffled corpus ≈ the real corpus ⇒ the transfer was a frequency prior, not structure (CT-3); the scenario-id fingerprint ≈ relational ⇒ a lookup table (CT-4). Either forces "library, not method". --- ## Addendum (2026-10-12) — the closure evidence: sections and figures registered BEFORE writing/generating The journey continues past §4.4. All evidence bars were registered in the substrate PLAN before their runs (addenda H-ORE, H-RP, H-SC, H-PQ, H-6-D, H-S3, H-PQ2), so the paper's new claims are committed in advance of the figures. ### New sections - **§4.5 The abstain path must be sound too (H-S3).** The unchecked-fallback discovery: the lookahead guard certified *accepted* actions only; refutations executed fallbacks blind — 93% of ego-initiated crashes lived there. The horizon-certified abstain, its measured failure (the wall fires: {SLOWER, IDLE} insufficient), and the complete crash taxonomy (2 proposal-cert / 5 abstain-cert / 11 wall). Extends the paper's title claim: horizon-soundness is a requirement on **every executed action — accepted or abstained**. - **§4.6 The regime prior, measured (H-RP).** Closes §4.4's named next move and §6's open problem: ρ = 0.79 dose–response, target-measured beats mismatched, top-50% retains ≥ 90% (observed 163%), containment held (−2). The prior is an environment fact, consumed by the reader, never predicted. - **§4.7 What carries what (H-4/H-SC/H-PQ/H-PQ2).** The three-layer ablation (hand ≡ derived; predicates drive 80% of the performance collapse; safety invariant to predicate corruption: +0/−1) and the proposer's seat (learned MLP earns the speed seat: 20.16 ≥ classical 19.81; certified-ego identical 7=7=7=7 across all four proposers while speed spans 16.5–20.2). PQ-1's FAIL and PQ2-0's features fail-clause reported. - **§2 / §4.2 note:** the correction ledger (the tau-wrapper bug; both the tau-inert accidental re-run and the corrected re-run reproduce 27 → 2 — the spine is robust). - **§5 extension:** the law gains (a) its three-way split — safety = dynamics model, competence = predicates, speed = proposer — and (b) its **regime qualifier** (H-6-D: ρ = +0.79 between the classical−matching gap and 1 − FASTER-admissibility; without R the law is falsified by its own aggregate). - **§6 update:** the regime prior moves from OPEN to CLOSED; new open items: the contract monitor (H-MC), the grown abstain set (H-S3b), feature alignment for the learned proposer (H-PQ3). Thm 5 remains the live frontier. ### New figures (verbatim from artifacts, generated by make_figures.py) | fig | content | source artifact | |---|---|---| | fig7 | the abstain-path taxonomy: proposal-certified / abstain-certified / wall (H-S3) | `results/abstain.json` | | fig8 | dose–response: measured regime rate vs corpus reduction (H-RP, ρ) | `results/regime.json` | | fig9 | the regime qualifier: classical−matching gap vs FASTER-admissibility (H-6-D) | `results/bias_regime.json` | | fig10 | the proposer's seat: per-arm mean speed vs certified-class ego (H-PQ2) | `results/capacity.json` | ### Thesis (the journey's current form) > *Containment holds for arbitrary proposers **iff the guard is horizon-sound over every > executed action — accepted or abstained**; the safety boundary is the authority's > model — its horizon, thresholds, dynamics, and abstain set — not the proposer, whose > quality moves speed and never the safety classes; and a distilled claim's benefit is > governed by the substrate's **measured** visitation — an environment fact the > authority records, never a frequency the agent predicts.* --- ## Addendum 2 (2026-10-12) — Thm 5's empirical arc: sections and figures registered BEFORE writing Evidence bars were registered in the substrate PLAN before their runs (H-T5, H-T6). ### New section - **§4.8 Containment under an approximate authority: the margin, the ladder, and where the error lives.** The discovery narrative: (1) the registered question — can a clearance margin equal to the model's MEASURED horizon error close the remaining certified classes? (2) the mechanism (margin on proposals and abstains alike) and the measured ε (mean 4.91 m, m95 12.87, m99 23.98, max 141.7 — an environment fact again); (3) H-T5: T5-1 passes DEGENERATELY (certified → 0 by disabling the guard — 630 wall events; containment by cowardice), T5-2 fails (wall-class 14), the grown abstain set inert at 24 m; (4) the registered fail-clause fires — the scalar is too blunt because the error is state-structured; (5) the ladder (H-T6): CA ≡ CV, ratio **1.0008** — the sharpest falsifier of the programme; (6) the diagnosis — the finite-difference estimate is lagged relative to *reaction*; the error is interaction-structured; (7) Thm 5's final form and the ladder's third rung (an intent model) — the formal bridge to the multiagent substrate. ### Updates - **§5:** a corollary to the law — *capability ∝ model fidelity, and in interactive traffic fidelity is bounded by kinematics; the residual budget is intent.* - **§6:** the approximate-authority frontier moves from "open" to *characterized*: the theorem's shape is known (margin = measured error; the approximation must be interaction-aware); what remains is the intent-tube model and its proof. - **§7 / §8:** conclusion sentence; provenance gains `thm5.json` / `thm6.json` and figs 11–12. ### New figures | fig | content | source artifact | |---|---|---| | fig11 | the margin economics: certified classes → 0 as wall events explode (containment by cowardice) | `results/thm5.json` | | fig12 | the ladder: ε̂₉₅ CV vs CA (dead equal — the falsifier) and wall events per arm | `results/thm6.json` | --- ## Addendum 3 (2026-10-12) — probe #2 enters the paper (registered before writing) Evidence bars were registered in `env_substrates/multiagent/PLAN.md` before their runs (M0, M-EP, T7-1..4, H-ATK T8-1/2, H-ATK2 AT2-1..3). ### New section - **§4.9 The third rung: containment where the error is intent.** The discovery journey on the multiagent substrate (PettingZoo MPE): (1) the exact-physics premise (ego model mirrored to 1e-9, so ε measures the others only); (2) the paired ε ladder — CV 1.807 / CA 1.957 / **responder 0.945** at m95 (CA *worse* than CV in a damped bang-bang regime; intent buys 3.4× on the mean); (3) T7 — containment holds perfectly (**0 certified contacts**, every arm), T7-1 FAILS at 0.523 (the residual is contact physics), T7-3 FAILS into cowardice (walls 1500/1500, progress −3.20 vs +16.47); (4) the attack — the wall audit: **87% necessary at m=0, 49% at m99** (the margin poisons the *existence* claim: certificates are one-sided); (5) the margin premise transports on-policy (ratio 0.83); (6) the two-tier guard (H-ATK2) as the amendment. ### Figure additions (verbatim from multiagent artifacts) | fig | content | source | |---|---|---| | fig13 | the intent ladder: ε̂₉₅ CV / CA / responder | `multiagent/results/epsilon.json` | | fig14 | capability & the wall: A0 vs margin arms (progress, walls) + the necessity audit | `multiagent/results/{ladder,attack}.json` | | fig15 | the two-tier guard restores capability | `multiagent/results/tier.json` | ### Updates Abstract clause; §5 (the law's third instantiation + the one-sidedness corollary); §6 (probe #2 characterized; open: T8-3 inference, T8-4 predicate, kitchen); §8 provenance (multiagent artifacts + renderer convention). --- ## Addendum ARCH (registered 2026-10-12, BEFORE figure generation and prose) **The Ω-TD architecture + the journey** — added to §3 as the framing object, under the same standard as every other figure/table set: - **Figure 19** (`fig19_omega_td.png`) — the Ω-TD architecture diagram: untrusted proposer (restrict-only, Thm 1) vs pinned authority Ω (predicates · model M with margin = ε̂ · guard · verifier), environment as grader, offline measurement (ε̂, ρ), open runtime monitor (§6), prune-only corpus. **Structural diagram (no data)** — generated by `make_figures.py`, registered here before generation; internal codenames generalized out (monitor = open, §6; corpus = the §4.3–4.4 distilled corpus). - **Table 16** — *the journey*: one row per turn of the loop (**attack the theorem → falsifier lands on a component of Ω → strengthen it → measure the new price (ε̂, ρ) from the environment, never from the agent**), with falsifier → component → measured price → section; rows = GS-1 (horizon), CT-1 (certificate semantics), abstain audit (§4.5), H-RP/H-6-D (regime), H-T5/T6 (kinematics budget), T7+H-ATK2–5 (intent + abstain doctrine), T8-3 (privilege-free intent), T8-4 (the spec), and the registered next substrate (perception, §6). Numbers taken only from artifacts already cited in the text. - **§1 roadmap** corrected (stale "seven results" → nine; §4.8/§4.9 added). - **§8 Provenance** extended with `fig19` and Table 16. **Placement correction (recorded at integration time):** Table 16 was drafted in §3 but moved to §5 so the table sequence 1–16 stays monotone in document order (Tables 1–15 are sequential; the paper's *figures* already appear out of order by registration — fig2 in §2, fig1 in §4.1 — so Figure 19 remains in §3). §3 keeps the architecture, the two invariants, the loop blockquote, and a forward pointer to Table 16; §5 carries the table directly after the "nine results, one law" paragraph it evidences. **Renderer upgrade (registered 2026-10-12, before regeneration):** Figure 19's first render (matplotlib boxes) was rejected on quality grounds; the source of record is now `fig19.d2`, rendered by the **D2** compiler (`brew install d2`, dagre layout), invoked from `make_figures.py` (skips with a note if `d2` is absent, per the generator's never-fabricate rule). Content unchanged; only the renderer changed. --- ## Addendum MONITOR (registered 2026-10-12, BEFORE §4.10 was written and Figure 20 generated) H-MC has run (highway PLAN addendum H-MC + outcome). Integration under the same standard: - **New §4.10 "The monitor: from predicting failure to checking contracts"** — the monitor's two registrations reported as results (H-3 recap with ledger deviation; H-MC protocol: contract = intent postcondition + guard safety claim; causal partial- trace score; the pre-outcome causality rule), data, residual diagnosis (exogenous surprise is outside every contract clause), recovery constraint (trigger vs efficacy). - **Table 16 (new, §4.10):** monitor comparison — {H-3 as-deviated, H-3 corrected, H-MC} × {signal object, AUROC, windows/positives, recovery vs baseline, replans}; bars row (0.90 / −5pp). Data from `monitor.json`, `monitor_asdev.json`, `contract_monitor.json` verbatim. - **Renumber:** the journey table becomes **Table 17** (it sits in §5, after §4.10's Table 16 — preserving the monotone 1–17 sequence; refs at fig19 caption, §3 pointer, §5 body, §8 updated). Journey gains a **monitor row** (H-3 → H-MC; AUROC 0.530 → 0.797; §4.10) — nine evidence rows + the registered next substrate = ten rows. - **Figure 20** (`fig20_monitor_object.png`) — generated by `make_figures.py` from `{monitor,monitor_asdev,contract_monitor}.json` verbatim: left = AUROC by signal object with the 0.90 bar; right = recovery success (baseline vs H-3 vs H-MC) with the −5pp bar. Nothing hard-coded beyond axis labels. - **Cascade:** §1 roadmap + abstract gain the monitor turn; §5 "**Nine** results" → "**Ten**"; §6's monitor paragraph condenses to the remaining open limits, pointing at §4.10; §8 provenance adds fig20 + Table 16.