Paper deep dive
An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models
Javier Aguilar Martín
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 8/22/2026, 1:50:35 AM
Summary
This paper investigates the 'Sampling-Verification Danger Law' in continuous Code World Models, where Large Language Models (LLMs) synthesize executable world models for classical planners. The authors demonstrate that a model accepted by a sampling gate (verifying it reproduces sampled transitions) may still be catastrophically wrong if it omits a 'rare rule' or hybrid mode (e.g., a wall or stop) that was not present in the training or verification samples. They prove that the probability of missing such a critical event is (1-r)^N, where r is the event's rarity and N is the number of samples. The paper introduces a 'localization budget' showing that Lipschitz-continuous models cannot hide small errors in small volumes without large Lipschitz constants, whereas discontinuous modes (like walls) evade this. Experiments with GPT-5.x show that while 1D clamps (walls) can be repaired by the LLM if detected, 2D regions (discs/squares) cannot be recovered by any artifact, proving that identifiability is class-relative and dependent on instrument geometry.
Entities (10)
Relation Signals (9)
Code World Model → uses → LLM
confidence 98% · In the Code World Model paradigm an LLM synthesizes an executable world model
Code World Model → uses → Classical Planner
confidence 98% · an LLM synthesizes an executable world model that a classical planner searches
Sampling-Verification Danger Law → defines → Danger
confidence 96% · We define the pipeline's danger as an expected risk... the probability that N i.i.d. gate rollouts all miss a critical event... is exactly (1-r)^N
GPT-5.X → failstorepair → PatchField2D
confidence 95% · On 2D regions no artifact recovers the rule (0/156)
GPT-5.X → repairs → Cart-with-wall
confidence 95% · GPT-5.x repairs an omitted 1D clamp in 105 of 111 mode-containing draws
Localization Budget → appliesto → Lipschitz Constant
confidence 93% · models with Lipschitz constant at most L... disagree... on a region of volume at least kappa((eta-eps)/L)^(d+m)
Cart-with-wall → hastype → 1D Clamp
confidence 92% · the cart’s wall... has p=1 and b=0
PatchField2D → hastype → 2D Region
confidence 92% · PatchField2D’s disc... has p=2 and b=1
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:In the Code World Model paradigm an LLM synthesizes an executable world model that a classical planner searches, and the model is accepted when it reproduces sampled transitions. We ask what that acceptance certifies in continuous control. We define the pipeline's danger as an expected risk and isolate its exact factor: the probability that N i.i.d. gate rollouts all miss a critical event of probability r is exactly (1-r)^N; an independent acceptance sample adds its budget to the exponent. On three hybrid instruments the accepted mode-blind model is exploited: the planner is pinned at the mode boundary at a regret of nearly the whole attainable return. We prove a localization budget, valid at boundary points: models with Lipschitz constant at most L differing by eta at a point disagree above tolerance eps on a region of volume at least kappa((eta-eps)/L)^(d+m); the discontinuous reset modes studied pay no such budget. With real LLM synthesis, GPT-5.x repairs an omitted 1D clamp in 105 of 111 mode-containing draws -- every attempt exact on 50 of 56 instrument-stream blocks (95% CI [0.781, 0.960]). On 2D regions no artifact recovers the rule (0/156); eight targeted interventions leave the failure in place, and positive controls locate it: a located rule is not induced, while given form and location the constants follow exactly. A version-space certificate proves identification is class-relative: at the widest dose the declared fit succeeds in 20/20 blocks and every sample-consistent circle is within tolerance in 18/20. We prove a class of entry rules exactly consistent with every sample yet harmless at play, so identifiability is a measurable property of the instrument. Re-scoring all 1034 artifacts on independent samples confirms acceptance certifies sample consistency and no more: where the gate is provably informative it covers about two percent of the exploited planner's queries.
Tags
Links
- Source: https://arxiv.org/abs/2608.17956v1
- Canonical: https://arxiv.org/abs/2608.17956v1
Trouble viewing inline? Open PDF directly →
Full Text
366,626 characters extracted from source content.
Expand or collapse full text
An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models Javier Aguilar Martín Affiliation: AGILabs (javieraguilar.ai) Abstract In the Code World Model paradigm an LLM synthesizes an executable world model that a classical planner searches, and the model is accepted when it reproduces sampled transitions. We ask what that acceptance test certifies in continuous control, where the model-based RL literature treats world-model error as pervasive rather than localized. We define the danger of such a pipeline as an expected risk — the play cost of whatever it ships, on the event that it ships it — and separate the factor that is exact from the factor that is not: the probability that N i.i.d. gate rollouts all miss a critical event of probability r is exactly (1−r)N(1-r)^N, the risk factorizes into cost times probability exactly when the shipped cost is uncorrelated with acceptance, and when the acceptance sample is drawn independently of the training sample the two exponents add. On the representation side we prove a localization budget, valid at boundary points: two models with Lipschitz constant at most L that differ by η at a point must disagree above tolerance ε on the whole domain-intersected metric ball of radius (η−ε)/2L(η- )/2L around that point — of volume at least κ((η−ε)/L)d+mκ\,((η- )/L)^d+m on any domain with interior-volume constant κ, where κ=1κ=1 in the interior and κ=2−(d+m)κ=2^-(d+m) is sharp at a box corner — so at fixed amplitude and tolerance a uniformly Lipschitz class cannot shrink the disagreement region below a fixed volume: the constant must grow as the region shrinks. The discontinuous reset modes studied here (a wall and a stop that zero the velocity, a patch that freezes the mover), having no finite local constant, pay no such budget; a continuous-but-nonsmooth hybrid boundary keeps one and does. (Smooth compactly supported errors satisfy the budget by occupying it, not by evading it.) An omitted mode is the continuous form of a rare rule. Three hybrid instruments (a cart with a wall, a pendulum with an angular stop, and a four-dimensional bi-modal patch field) measure the consequence. The gate misses the mode at the predicted rate, and the mode-blind planner is not merely uninformed but exploited: pinned at the boundary in every episode at a regret of essentially the whole attainable return, at every rarity knob; against the uniform-random baseline the comparison is unambiguous on the bi-modal patch field (random better in 100100 of 100100 paired seeds) and carried by the baseline’s heavy tail on the 1D instruments, and it is reported distributionally. With real LLM synthesis the danger reduces, on the one-dimensional clamps, to the identifiability event alone — every sample missing the mode produced an accepted, blind, exploited artifact, and GPT-5.x wrote the exact rule in 105105 of 111111 mode-containing synthesis draws, with every attempt exact on 5050 of 5656 instrument–stream blocks (exact 95% interval [0.781,0.960]), while the 64-of-70 figure is the knob-level block-cell census; the failures include four artifacts carrying an invented stop their own samples could not refute. Repair does not survive a two-dimensional mode: across a disc, an axis-aligned square, a guided treatment at three times the budget and a second model family, no artifact recovered the region rule (00 of 156156 mode-containing draws over 2020 raw seed blocks), most often substituting a one-dimensional threshold. Eight targeted interventions — each aimed at one candidate explanation, with the changes it also induces reported — leave the failure in place: seven show that curvature, the tested prompting and budget, identification of the variable the trigger reads, the censoring of the region’s interior itself, and the angular coverage of the evidence do not suffice to restore repair — the last raised, in the one treatment whose direction was recorded in advance, until a three-line least-squares fit recovers the region on every sample while the synthesizer recovers it on none — and the eighth, built to lower the trigger’s arity, turns out to pose no identifiable question on this instrument and is recorded rather than counted; two positive controls then locate what is missing, since given the region’s form and location the withheld constant is inferred exactly in twenty of twenty seeds, while at the baseline’s coverage the same three-line fit already recovers both constants on twelve of twenty samples and the synthesizer, given the form but not the location, recovers them on none of twenty. A version-space certificate sharpens those estimator results: relative to the stated circle class, every sample-consistent circle lies within 0.10.1 of the true centre and radius in 6/206/20 baseline blocks and 18/2018/20 widest-coverage blocks; half-planes are excluded in 20/2020/20 in both, while the convex hull of observed contacts remains consistent in 20/2020/20, proving directly that identification is class-relative. Under clamp semantics, three non-collinear boundary contacts identify the circle exactly, and every one of the 2020 blocks contains such a triple. What fails is the induction of a located rule from evidence, not the fitting of constants once the rule is located. One of the exclusions is a theorem’s premise lifted and found not to matter: because the mode freezes the mover at its previous position, no rollout occupies the region’s interior, so the transitions a sample can contain are entries into the region and nothing else. We prove the consequence: a rule that agrees with the truth on the reachable set is exactly consistent with every sample, at every sample size and every tolerance, and is harmless at play for the same reason, its disagreement region having query-hit probability zero. Whether the evidence identifies the rule — relative to a stated hypothesis class and tolerance — is then a property of the instrument, measurable before any synthesis — on the disc it does relative to an explicit class and tolerance, on a slab unbounded in one coordinate it does not — and on the latter the larger model reliably writes such a rule: nineteen of its twenty artifacts pass the acceptance test, an independent acceptance test at the same tolerance, and the paper’s own mode probe, without encoding the region. The practical consequence is that a sampling acceptance test leaves the sample’s coverage of the mode boundaries uncontrolled, not the gate’s tolerance: where the gate is provably informative it covers about two percent of the exploited planner’s queries. 1 Introduction The companion paper (Aguilar Martín 2026) established, in discrete games, that transition accuracy on randomly sampled play-throughs is the wrong adequacy criterion for a world model used in planning, and quantified the failure: danger=play_cost×(1−rarity)Ndanger=play\_cost×(1-rarity)^N, with the gate-miss factor exact under i.i.d. sampling. Its related-work discussion closed with a promissory note: the rare-rule gap is a localized, discrete failure that state-accuracy metrics mask by dilution — a point worth revisiting in continuous settings, where the model-based RL literature (Lambert et al. 2020; Hafner et al. 2020; Janner et al. 2019) treats world-model error as pervasive and compounding rather than localized and pivotal. This paper is that revisit. The question is not whether continuous world models can be wrong — that literature is mature — but whether the specific verified-but-wrong geometry of the discrete result exists in continuous state spaces: a model that passes a sampling gate cleanly, is exact outside a small mode region, and is still exploited catastrophically by the planner that trusts it. The answer is yes, and the continuous version differs from the discrete one in one respect. The discrete headline had two components: a provable one — when the rare rule is absent from the sample, no learner can infer it from the sample, an identifiability event of probability exactly (1−r)N(1-r)^N — and an empirical one, that the LLMs tested did not infer the rule even when it was present (“translation, not inference”). On the continuous one-dimensional instruments the second component vanishes for one of the three model families we measured: GPT-5.x infers an omitted hybrid mode from a handful of boundary-crossing transitions and writes the exact global rule. It does not vanish on a two-dimensional mode, where no artifact in any treatment we ran recovered the region rule (Section 7.1), so the vanishing is scoped to the geometry it was measured on. What remains provable across both is the gate-miss and identifiability pair (Section 3): with the mode absent from the sample, no learner can recover it from the sample alone — though a prior or the specification still can (Proposition 5), and five artifacts in our data do exactly that, carrying an invented mode their own samples could not refute — four of GPT-5.x, of which three were also accepted by an independent gate, and the agent-relayed Claude artifact. Passing the gate means agreeing on the transitions the sample covered; whether an accepted artifact is also right off sample is a separate question, and Section 8 measures it rather than assuming it. Contributions, in four groups: 1. The estimand, and which of its factors is exact (Section 3). We define the danger of a synthesis pipeline as an expected risk and prove when it factorizes into cost times probability (Proposition 3); the gate-miss factor is exact for any measurable critical event (Proposition 1, transferred from the companion paper), admits a sharp distribution-free bracket for two modes in place of an independence assumption (Proposition 2, with the sharpness in Remark 6), and, for the central event of a blind artifact synthesized from a mode-free training sample surviving to deployment, gains a second exponent when the acceptance sample is independent of the training sample (Proposition 4; for the blind-shipped total the law is a lower bound, with the excess term measured). Identifiability transfers unchanged (Proposition 5): on the miss event no score that reads the candidate only at sampled inputs can separate a mode-blind model from the truth. 2. A localization budget, separating code from bounded-Lipschitz models (Section 3). The discrete result’s localization premise is not satisfiable at fixed amplitude and tolerance on a vanishing volume by any uniformly Lipschitz pair, and Corollary 2 prices it at every witness point, boundary included: the disagreement region contains the domain-intersected ball, of volume at least κ((η−ε)/L)d+mκ((η- )/L)^d+m on any domain with interior-volume constant κ (Corollary 3; κ=1κ=1 interior, 2−k2^-k with k clipped coordinates on a box, sharp at a corner), so an η-amplitude error confined to a region of volume V needs L≥(η−ε)(κ/V)1/(d+m)L≥(η- )(κ/V)^1/(d+m), a constant that diverges as the volume shrinks (a compactly supported smooth error satisfies the budget by occupying volume, not by evading it). The same geometry forces a gate detection rate (Proposition 16), whose density constant is derived rather than assumed for a whole family of semi-implicit plants. The discontinuous reset boundaries of our instruments are exactly where the obstruction disappears; a continuous hybrid boundary keeps a finite constant and does not escape it. 3. Three hybrid instruments, and what a sampling gate does and does not certify (Sections 2–5). Cart-with-wall, pendulum-with-stop and a 4D bi-modal patch field, with one harness and no per-instrument planner re-calibration, measure the threshold law, knob-invariant exploitation, and the reach mechanism; a second planner family (CEM) and a planner-side mitigation whose contact cost is a packing number (Proposition 17) bound how much of the failure is planner-mediated. On the positive side, a partition coverage certificate — with the within-rollout dependence handled exactly rather than assumed away — excludes any pair with L≤5.77L≤ 5.77 carrying the wall’s error past the deployed gate; and the same measurement shows that region carries 1.9%1.9\% of the exploited planner’s queries. The gate certifies where it looks. 4. The synthesis result, and the geometry that scopes it (Sections 7–7.1). With real LLM synthesis on the 1D clamps, every sample missing the mode produced an accepted, blind, exploited artifact, and GPT-5.x repaired the exact rule from the revealed contacts in 105105 of 111111 mode-containing draws; all attempts were exact on 50/5650/56 instrument–stream blocks (exact 95% interval [0.781,0.960][0.781,0.960]), while 64/7064/70 is the finer knob-cell census — so the danger reduces to the identifiability event, and coverage rather than spec completeness becomes the operative worry. On 2D regions repair collapses in every treatment we ran, including an axis-aligned square and a guided treatment at three times the budget; and eight ablations with two positive controls locate the obstruction in the induction of the region’s form rather than in the evidence, the synthesizer’s ability to fit constants, or the evidence’s coverage (Section 9), with Proposition 7 proving that a whole class of wrong rules is unfalsifiable by any sample and harmless by the same argument. Re-scoring every synthesized artifact on an independent acceptance sample (Section 8) separates what the acceptance test establishes from what the training sample already implied. Supporting results — the ε -invariance of the reveal-rarity and its quadratic rate, the derived play-cost normalizers, the arithmetic behind knob-invariance, the step-t density and the certificate’s variants — are stated where they are used and proved in the supplementary material. Scope up front: three instruments (two 1D — cart, pendulum — plus a 4D bi-modal PatchField2D), two base planner families (random-shooting MPC and CEM, one fixed configuration each), 20 seeds per headline synthesis cell across the instruments (both GPT-5.x sizes; plus the caught cell on the pendulum and two bi-knob cells on PatchField2D), a 3-seed cross-family spot-check per 1D instrument (not full sweeps), and a probe-grade multilayer perceptron (MLP). Section 12 states the limitations and the full seed accounting. 2 The instruments This section specifies the hand-written hybrid instruments and the planner the later experiments reuse unless they say otherwise, together with three design conditions such an instrument has to satisfy. 2.1 Cart-with-wall State (x,v)(x,v); action a∈[−amax,amax]a∈[-a_ ,a_ ]; semi-implicit Euler with fixed dtdt: a←clamp(a),v′=v+(gain⋅a−drag⋅v)dt,x′=x+v′dt,a (a), v =v+(gain· a-drag· v)\,dt, x =x+v \,dt, with defaults dt=0.1dt=0.1, gain=3gain=3, drag=0.3drag=0.3, amax=1a_ =1. The hybrid mode is an inelastic wall at xwallx_wall: if x′≥xwallx ≥ x_wall, the next state is exactly (xwall,0)(x_wall,0). The blind model is the same code path with the wall branch removed — the hand-written on-manifold proxy for a CWM synthesized from a spec that omits the wall, bit-exact off-mode by construction (tested: exact float equality on wall-free trajectories). We call such a model mode-blind (the canonical term; instrument-specific synonyms like “wall-blind”, or “blind” for short, mean the same thing). Reward is two sigmoid plateaus: a small reachable one on the left (0.30.3, at x≤−6x≤-6) and a large one on the right (1.01.0, at x≥12x≥ 12) whose approach every swept wall position blocks. Episodes are 80 steps from x0∼U(−0.5,0.5)x_0 U(-0.5,0.5), v0=0v_0=0. The design requirements mirror the companion paper’s material-at-cap instrument (paper 1’s discrete instrument: a rare resource-cap rule likewise omittable from sampled play): (a) random rollouts rarely fire the mode — rarity throughout this paper is the probability that a whole gate rollout contains at least one mode contact, not the volume or measure of the mode region, and the wall position is the rarity knob (r sweeps 0.317→0.00240.317→ 0.0024 over xwall∈[2,10]x_wall∈[2,10]; Table 1); (b) the omission is exploited, not merely mispredicted — the wall-blind model predicts coasting through the wall toward the large plateau, so the planner it advises drives right and is pinned; (c) the truth planner’s optimal play differs qualitatively — it goes left. The second instrument (pendulum with a hard angular stop; nonlinear gravity term) is described with its results in Section 4.1, and the third (PatchField2D, a 4D bi-modal patch field) in Section 4.2. 2.2 Planner and play_cost The planner is model-predictive control by random shooting (Nagabandi et al. 2018; Chua et al. 2018): at each step, sample candidate action sequences (piecewise-constant blocks plus the three constant sequences −amax,0,+amax\-a_ ,0,+a_ \), roll each out on the model, take the best first action, replan. The planner is a deterministic function of its model’s responses and the seed, so the play-cost upper bound via query-hit mass applies verbatim (Section 3; Corollary 1 ties that bound to the normalization below). Single-agent control makes play_cost a normalized regret, cleaner than a two-player arena (no opponent confound): play_cost=Jtruth−JmodelJtruth−Jrand,play\_cost\;=\; J_truth-J_modelJ_truth-J_rand, where JtruthJ_truth, JmodelJ_model, and JrandJ_rand are the returns of the truth planner — the same random-shooting MPC given the true dynamics, which is a reference and not a proved optimal policy, so JtruthJ_truth is a benchmark rather than a maximum — the model-planner (written JblindJ_blind in the tables when the model is the blind one), and the uniform-random policy, all measured in the true environment on paired seeds. The pairing is explicit and reused deliberately: an episode’s seed is 900,000+1000i900,000+1000i in the synthesis arms and 1000i1000i in the sweeps, so the same episode seeds recur across knobs, across instruments and across both planner families, and the truth, model and random arms of a row share them. Every interval we report on a play quantity is therefore paired (a bootstrap or a randomization test over seed triples, not two independent samples), which is what makes differences of 10−410^-4 in play_cost meaningful at 2020 episodes. The blind planner can score below the uniform-random policy, so the normalized value can exceed 11; we report it unclamped, always beside the raw returns it is computed from, and Section 4 measures how much of that comparison is carried by the random baseline’s tail. 2.3 Three design conditions on a continuous danger instrument Each is a condition on the instrument, not a tuning choice: 1. I.i.d. per-step candidate sampling silently removes the mode from imagination. With i.i.d. candidates, imagined displacement is diffusive; no sampled sequence reaches distant reward within the horizon, so the truth model and the blind model rank all candidates identically and the wall never enters imagination — the two arms become indistinguishable not because the models agree but because the planner never queries where they differ. Piecewise-constant blocks plus constant candidates fix it. The planner’s query distribution, not just its trajectory distribution, is part of the instrument. 2. Point (Gaussian) reward lodes demand braking finesse that random shooting lacks; sigmoid plateaus remove the parking problem and give clean imagined-value margins in both directions. 3. The plant’s drag time-constant must sit well inside the planning horizon, or no arm can act on the reward at all (at τ=1/drag=10τ=1/drag=10 s against a 3 s horizon, nothing moves). 3 Theory: what transfers, what changes, what is new Notation: a verification gate draws N i.i.d. rollouts from the gate policy ρ (uniform-random actions from the initial-state distribution) and accepts a model f f if it matches the truth f within ε in sup-norm on every visited transition. Two gates of that form appear in this paper and must not be confused. A sample-consistency gate scores the artifact on the very sample it was synthesized and refined against — the protocol of the companion paper and of every committed synthesis run here — so passing it means agreement with the data the artifact has already seen. A held-out gate scores it on an independent acceptance sample (Section 8). We reserve sound for a stated logical property and never use it as a synonym for either. Measure-space setup. Fix a horizon T. A trajectory is a point of (S×A)T(S× A)^T, equipped with the product Borel σ-algebra. The gate policy ρ together with the transition kernel induced by f defines a trajectory law PρP_ρ on this space (the initial-state distribution pushed forward through ρ and f). The query-hit probability qhit(E)q_hit(E) is the probability, under the planner’s trajectory law, that at least one model query during the episode lands in E. It is a hitting probability — monotone and subadditive in E, but not a measure — and we name it accordingly rather than calling it a mass, as the companion paper did. We assume throughout that the critical region R, the disagreement region E, and the reward and dynamics maps are Borel measurable, so every probability below is well defined. With this in place the discrete arguments of Aguilar Martín 2026 transfer with only notational change. The paper compares instruments whose modes differ “in dimension”, and two different integers are involved. Keeping them apart is what makes the comparison an identification rather than a slogan. Definition 1 (trigger arity and entry-barrier dimension). Write Φ for the plant’s unclamped one-step map, so that Φ(s,a) (s,a) is the landing state the integrator alone would produce, and let the hybrid mode be M=(s,a):g(Φ(s,a))≥0M=\(s,a):g( (s,a))≥ 0\ for a predicate g on the landing state. Two integers describe M, and neither determines the other: • the trigger arity p is the number of landing coordinates on which g depends non-trivially — what a synthesizer must identify in order to write the rule at all; • the entry-barrier dimension b is the dimension of g∘Φ=0\g =0\ as a subset of the landing position space, intersected with the reachable set — what a deployment-time fence has to cover. The cart’s wall, g(x′)=x′−xwallg(x )=x -x_wall, has p=1p=1 and b=0b=0 (a single point in a one-dimensional position space); the pendulum’s angular stop likewise p=1p=1, b=0b=0. PatchField2D’s disc, g(x′,y′)=R2−‖(x′,y′)−c‖2g(x ,y )=R^2-\|(x ,y )-c\|^2, has p=2p=2 and b=1b=1 (a circle). A slab in the same plane, g(x′)=R−|x′−cx|g(x )=R-|x -c_x|, has p=1p=1 and b=1b=1: arity of a clamp, barrier of a region. Remark 1 (the two dimensional readings concern different integers). Section 7.1 finds that repair from data degrades from the 1D clamps to the 2D regions, and Corollary 5 that fencing cost grows exponentially in the boundary’s dimension. Those are statements about p and about b. The cart-to-disc contrast moves both at once (p:1→2p:1→ 2, b:0→1b:0→ 1), which is exactly why “1D versus 2D” is ambiguous as a causal claim and why a slab instrument — p of a clamp, b of a region — separates them. Neither integer is the dimension of the mode boundary in the joint state–action space: that is a hypersurface in every instrument here, and nothing in this paper claims otherwise. Proposition 1 (gate miss; Proposition 1 of Aguilar Martín 2026, transferred). Let R be any measurable set of rollouts (“the critical event”; here: the rollout fires the wall mode) with r=Pρ(R)r=P_ρ(R). The probability that N i.i.d. gate rollouts all avoid R is exactly (1−r)N(1-r)^N. Proved as Proposition 1 of the companion paper (Aguilar Martín 2026); nothing in that proof uses discreteness, the event being Bernoulli(r) with i.i.d. draws. Proposition 2 (joint gate miss: bracketed, not factored). Let R1,R2R_1,R_2 be measurable critical events (two modes) with ri=Pρ(Ri)r_i=P_ρ(R_i) and r∪=Pρ(R1∪R2)r_∪=P_ρ(R_1∪ R_2). The probability that N i.i.d. gate rollouts avoid both is exactly (1−r∪)N(1-r_∪)^N, and with no independence assumption (1−min(1,r1+r2))N≤(1−r∪)N≤(1−max(r1,r2))N, (1- (1,\,r_1+r_2) )^N\;≤\;(1-r_∪)^N\;≤\; (1- (r_1,r_2) )^N, a bracket in which the product ((1−r1)(1−r2))N ((1-r_1)(1-r_2) )^N also lies. Assume r∪<1r_∪<1 and N≥1N≥ 1 for the ratio below (at N=0N=0 both sides are 11 whatever the dependence). The product equals the truth iff Pρ(R1∩R2)=r1r2P_ρ(R_1∩ R_2)=r_1r_2, and in general ((1−r1)(1−r2))N(1−r∪)N=(1+r1r2−Pρ(R1∩R2)1−r∪)N, ((1-r_1)(1-r_2) )^N(1-r_∪)^N= (1+ r_1r_2-P_ρ(R_1∩ R_2)1-r_∪ )^\!N, so the product over-estimates the joint miss probability under negative dependence (Pρ(R1∩R2)<r1r2P_ρ(R_1∩ R_2)<r_1r_2) and under-estimates it under positive dependence. Proof. Proposition 1 applied to the event R1∪R2R_1∪ R_2 gives the exact value (1−r∪)N(1-r_∪)^N. Monotonicity gives r∪≥max(r1,r2)r_∪≥ (r_1,r_2) and subadditivity r∪≤min(1,r1+r2)r_∪≤ (1,r_1+r_2); since x↦xNx x^N is increasing on [0,1][0,1], the bracket follows. For the product, (1−r1)(1−r2)=1−r1−r2+r1r2≥max(0, 1−r1−r2)(1-r_1)(1-r_2)=1-r_1-r_2+r_1r_2≥ (0,\,1-r_1-r_2) — the max matters when r1+r2>1r_1+r_2>1, where the left-hand bracket end is 00 — and ≤1−max(r1,r2)≤ 1- (r_1,r_2) because r1r2≤min(r1,r2)r_1r_2≤ (r_1,r_2). Finally inclusion–exclusion gives 1−r∪=1−r1−r2+Pρ(R1∩R2)1-r_∪=1-r_1-r_2+P_ρ(R_1∩ R_2), hence (1−r1)(1−r2)−(1−r∪)=r1r2−Pρ(R1∩R2)(1-r_1)(1-r_2)-(1-r_∪)=r_1r_2-P_ρ(R_1∩ R_2), which yields the displayed ratio and its sign. ∎ The bracket is sharp — its ends are the Fréchet–Hoeffding bounds for Pρ(R1∪R2)P_ρ(R_1∪ R_2) given the marginals, so no bound in r1,r2r_1,r_2 alone can be tighter — and the product form cannot be rescued by a fixed correction: measured at 50,00050,000 rollouts per knob, the sign of the dependence changes across the grid, negative at two knobs and positive at another with non-overlapping intervals. A stratified gate does not buy the product back either. Section G gives the sharpness argument, the stratification result and the measurements. 3.1 The estimand: danger as an expected risk, and which factor of it is exact The product play_cost×(1−r)Nplay\_cost×(1-r)^N is quoted throughout as “the danger law”. Two different objects can hide behind it, and only one of them is a probabilistic estimand, so we define it before using it. Fix a synthesis procedure A mapping a training sample to a model, a gate that accepts or rejects on an acceptance sample, and write PC(f^)PC( f) for the play cost of a model. The danger at budget N is the expected play cost of whatever the pipeline ships: DN=[PC(A(Dtr)) 1A(Dtr) accepted],D_N\;=\;E [PC (A(D_tr) )\;1\A(D_tr) accepted\ ], the expectation being over the training and acceptance samples and any randomness in A. Proposition 3 (the danger factorizes exactly when the shipped cost is uncorrelated with acceptance). Write G for the acceptance event and X=PC(A(Dtr))X=PC(A(D_tr)); assume X integrable and P(G)>0P(G)>0 (if P(G)=0P(G)=0 then DN=0D_N=0 and there is nothing to factor). Then DN=[X∣G]P(G),D_N\;=\;E[X G]\;P(G), and the factored form DN=[X]P(G)D_N=E[X]\,P(G) — what writing play_cost×(1−r)Nplay\_cost×(1-r)^N asserts — holds if and only if Cov(X,G)=0Cov(X,1_G)=0; in particular it holds when X is almost surely constant (a single fixed blind model) and when X is independent of G. Constancy on G alone does not suffice for the factored form — X=GX=1_G is constant on G yet has Cov(X,G)=P(G)(1−P(G))>0Cov(X,1_G)=P(G)(1-P(G))>0 — but it does make the conditional display exact with a constant in front: X=cX=c almost surely on G gives DN=cP(G)D_N=c\,P(G) with c=[X∣G]c=E[X G], so the product is then correct with the accepted-artifact cost as its first factor, not the unconditional mean. With neither hypothesis, if c−≤X≤c+c_-≤ X≤ c_+ almost surely on G then c−P(G)≤DN≤c+P(G),c_-\,P(G)\;≤\;D_N\;≤\;c_+\,P(G), and no sharper bound is available from P(G)P(G) and the range alone: both ends are attained. Proof. The first display is the definition of conditional expectation, [XG]=[X∣G]P(G)E[X1_G]=E[X G]P(G). Expanding the covariance, [XG]=[X]P(G)+Cov(X,G)E[X1_G]=E[X]P(G)+Cov(X,1_G), which gives the iff; a globally constant X and an X independent of G each force the covariance to vanish, while X=cX=c on G gives [XG]=cP(G)E[X1_G]=c\,P(G) by direct integration, no covariance statement needed. The bounds follow from monotonicity of the expectation on G, and are attained by X≡c±X≡ c_± on G, so they cannot be improved without measuring the conditional law. ∎ The paper keeps the two readings separate throughout. On the hand-written instruments the shipped model is fixed — the mode-blind program, whose play cost is a property of the instrument and not of the sample — so X is constant and the product is an identity, DN=PC(f^blind)P(gate misses)D_N=PC( f_blind)\,P(gate misses), whose second factor is exactly (1−r)N(1-r)^N by Proposition 1. This is the precise sense in which “the law is exact”: the gate-miss factor is exact, and the cost factor is an input to the identity rather than a consequence of it. In the LLM arms the artifact — and therefore its cost — is a function of the sample, so the product is an estimate under Proposition 3’s hypothesis, and what we report is the conditional quantity the identity actually needs: the mean play cost of accepted artifacts, per campaign and arm, with a block-clustered bootstrap interval (the accepted_play_cost rows of results/paper2_statistics.json; on the cart’s headline incomplete arm, 0.5080.508 over 6161 accepted draws, cluster interval [0.344,0.671][0.344,0.671]). Remark 2 (the miss factor’s form does not need the i.i.d. hypothesis). For rollouts drawn by any rule — adaptively, from history — the chain rule of conditional probability gives, exactly, P(no critical event in N rollouts)=∏i=1N(1−ri),ri=P(Ei∣no E1,…,Ei−1),P(no critical event in N rollouts)\;=\; _i=1^N (1-r_i ), r_i=P (E_i E_1,…,E_i-1 ), and interval knowledge ℓi≤ri≤ui _i≤ r_i≤ u_i along miss histories gives the sharp bracket ∏i(1−ui)≤P(miss)≤∏i(1−ℓi) _i(1-u_i)≤ P(miss)≤ _i(1- _i). The i.i.d. exponent (1−r)N(1-r)^N, the independent-gate sum Ntr+NgN_tr+N_g of Proposition 4, a stratified schedule’s product, and the two-mode Fréchet bracket of Proposition 2 are corollaries of this one display (formalized and tested against enumerated dependent processes in scripts/danger_law_h4.py, results/danger_law_h4.json). What dependence or adaptivity removes is not the identity but its identification: the rir_i are conditional hazards, and unconditional marginal event rates alone no longer determine the product. An independent acceptance sample. A gate that scores the artifact on the sample it was refined against certifies consistency with its own training data. Separating the two samples leaves the law’s central event with an exponent that depends on the two budgets only through their sum — the content of the next proposition, together with what that does and does not imply. Proposition 4 (gate miss with an independent acceptance sample). Let DtrD_tr and DgD_g be independent samples of NtrN_tr and NgN_g i.i.d. gate-policy rollouts; let the pipeline synthesize and refine on DtrD_tr and accept the artifact iff it matches the truth within ε on every transition of DgD_g; and let R be the critical event of Proposition 1, with r=Pρ(R)r=P_ρ(R). Suppose that (i) whenever DtrD_tr contains no rollout in R, the artifact A(Dtr)A(D_tr) is mode-blind, and (i) a mode-blind artifact fails the acceptance sample if and only if that sample contains a rollout in R. Then the danger law’s central event — a mode-free training sample yielding a (by (i)) mode-blind artifact that survives the gate — has probability exactly P(Dtr∩R=∅,artifact shipped)=(1−r)Ntr(1−r)Ng=(1−r)Ntr+Ng.P (D_tr∩ R= ,\ artifact shipped )\;=\;(1-r)^N_tr\,(1-r)^N_g\;=\;(1-r)^N_tr+N_g. Hypothesis (i) is one implication, not an equivalence, so mode-blind artifacts may also arise from training samples that do contain R, and the total splits accordingly: P(a mode-blind artifact is shipped)=(1−r)Ntr+Ng+P(blind,Dtr∩R≠∅)(1−r)Ng,P(a mode-blind artifact is shipped)\;=\;(1-r)^N_tr+N_g\;+\;P (blind,\ D_tr∩ R≠ )\,(1-r)^N_g, so the law is a lower bound on that total, with equality (for r<1r<1; at r=1r=1 both sides vanish and the clause is vacuous) if and only if blindness arises only from the miss — the “iff” strengthening of (i). Proof. On Dtr∩R=∅\D_tr∩ R= \, of probability (1−r)Ntr(1-r)^N_tr by Proposition 1, the artifact is mode-blind by (i). Blindness is a function of DtrD_tr and the synthesizer’s randomness alone, so DgD_g is independent of it, and by (i) acceptance is then Dg∩R=∅\D_g∩ R= \, of conditional probability (1−r)Ng(1-r)^N_g; multiplying gives the first display. For the second, split the blind event into Dtr∩R=∅\D_tr∩ R= \ — which it contains, by (i), and on which the first display stands — and blind,Dtr∩R≠∅\blind,\ D_tr∩ R≠ \; on each, (i) with the independence of DgD_g makes acceptance a further factor (1−r)Ng(1-r)^N_g, and the two terms add. The excess term vanishes exactly when blindness implies the miss. ∎ Three things follow. First, for the event the proposition prices, the two budgets enter only through their sum: at fixed Ntr+NgN_tr+N_g that miss exponent is unchanged. This is a statement about one exponent and nothing else — it does not say that synthesis quality is preserved when training rollouts are moved to the gate (a smaller DtrD_tr changes the artifact, and with it hypothesis (i) and the excess term), nor that the total risk DND_N, the compute, or the rate of other wrong artifacts is unchanged at a fixed budget. What the separated design buys is that acceptance is not self-confirming; what it changes is which artifacts ship when exactly one of the two samples contains the mode — a case a sample-consistency gate cannot even represent, since it refines until it agrees with everything it has seen. Section 8’s experiment, note, adds an acceptance sample to the committed artifacts (Ntr=40N_tr=40 against Ntr+Ng=80N_tr+N_g=80) rather than redistributing a fixed budget. Second, the hypotheses are where the empirical content sits, and they are of different kinds. (i) is nearly structural for a program with an omitted branch: it agrees with the truth exactly off the mode (Section 2.1) and disagrees on a contact by far more than any deployment tolerance, so it fails an acceptance sample exactly when that sample contains a contact — and Section 8 verifies it artifact by artifact rather than assuming it. (i) is a genuine empirical premise: it is precisely what the discrete companion paper’s translation-not-inference residual denies in general, and what fails on 2D regions (Section 7.1), which is why it appears as a hypothesis rather than being folded into the statement. Third, “exact” attaches to this proposition and to Proposition 1, never to the full risk DND_N. The gate’s tolerance is not the axis this paper is about, and the reason is worth one sentence here and a proof in the supplement: because the mode-blind model agrees with the truth exactly off the mode, the probability that a rollout reveals a disagreement at tolerance ε equals the mode-firing rarity for every ε below the smallest contact disagreement, and in the population the two agree at a quadratic rate — proved for the whole semi-implicit family in Section A. Tightening ε therefore cannot catch a hard mode, and loosening it does not widen the hole (measured in Section 5). Proposition 5 (identifiability; Proposition 3 of Aguilar Martín 2026, transferred). Let M⊆S×AM S× A be the mode region (for the cart the clamp fires depending on (s,a)(s,a) through x′≥xwallx ≥ x_wall) and instantiate Proposition 1 at the critical event R=rollouts that visit MR=\rollouts that visit M\, so that “miss” means exactly that no sampled transition lies in M. Condition on that miss event and let f^1,f^2 f_1, f_2 be any two models that agree on (S×A)∖M(S× A) M. Then every score that depends on the candidate models only through their values at the sampled inputs — the gate, a one-step likelihood, a one-step refinement objective — is constant across the two, so no such score can distinguish them, and preference for the correct one must come from the prior or the specification. Proof. On the miss event the sample visits no transition in M, and the two models agree off M, so they produce identical outputs on every sampled input; a score that reads them only there is therefore the same number for both. ∎ Proposition 6 (finite-sample disc identification is class-relative). For the pinned PatchField2D integrator, each sampled transition determines its free landing point z=pos(Φ(s,a))z=pos( (s,a)) and its contact label. Fix the far patch and let ℋ∘=D(c,R)∪D2∗:c∈ℝ2,R>0.H_ =\D(c,R)∪ D_2^*:c ^2,\ R>0\. Writing I for landings labelled inside the near patch and O for landings labelled outside both patches, (c,R)(c,R) is sample-consistent exactly when maxz∈I‖z−c‖2≤R<minz∈O‖z−c‖2. _z∈ I\|z-c\|_2≤ R< _z∈ O\|z-c\|_2. Consequently the finite sample identifies the true disc at tolerances (τc,τR)( _c, _R) relative to ℋ∘H_ if and only if every pair satisfying (1) obeys ‖c−c∗‖2≤τc\|c-c^*\|_2≤ _c and |R−R∗|≤τR|R-R^*|≤ _R. This conclusion does not extend to an unrestricted region class: when the true near patch is convex, conv(I)conv(I) is itself sample-consistent. Under clamp rather than freeze semantics, three non-collinear near-patch contact states lie on the boundary and determine (c∗,R∗)(c^*,R^*) uniquely. Proof. The pinned integrator makes z computable from (s,a)(s,a), and the transition records whether the mode fired, so it supplies the membership label. A disc contains all of I and none of O exactly when its radius lies in the interval (1), proving the version-space criterion. Since I lies in the convex true disc, conv(I)conv(I) also lies in it; every point of O is outside the true disc and hence outside that hull, proving consistency of the broader alternative. In the clamp variant each contact state is the radial projection onto the circle. Three non-collinear points have a unique circumcircle. ∎ The criterion is checked block by block by scripts/disc_identifiability_certificate.py. Its multilevel search uses the 22-Lipschitz feasibility gap in (1), with grid slack and a direction-uniform far-field exclusion bound, to outer-bound every consistent (c,R)(c,R) rather than merely fit one. At τc=τR=0.1 _c= _R=0.1, it proves identification relative to ℋ∘H_ in 6/206/20 baseline blocks, 9/209/20 at the intermediate evidence dose and 18/2018/20 at the widest dose. It separately excludes every half-plane in 20/2020/20 blocks at all three doses; axis-aligned boxes are excluded in 19/2019/20, 19/2019/20 and 20/2020/20. The hull construction remains consistent in 20/2020/20 throughout, so no statement silently promotes circle-relative identification to uniqueness among arbitrary regions. In the clamp campaign, the three-point clause identifies the circle in 20/2020/20 blocks. The versioned certificate and its oracle tests are results/disc_identifiability_certificate.json and tests/test_disc_identifiability_certificate.py. A sharper obstruction under freeze semantics: the mode’s own dynamics censor its interior. Proposition 5 conditions on the mode being absent from the sample. There is a second, structural obstruction that survives the mode being present — and, unlike the first, it is not repaired by drawing more rollouts or by drawing an independent acceptance sample. Proposition 7 (freeze semantics make an entry rule unfalsifiable). Let Φ be the plant’s unclamped one-step map, pos(⋅)pos(·) the position coordinates, R a mode region in position space, and let the truth be f(s,a)=(pos(s),0)if pos(Φ(s,a))∈R,Φ(s,a)otherwise,f(s,a)\;=\; cases(pos(s),0)&if pos( (s,a))∈ R,\\ (s,a)&otherwise, cases so that the mode freezes the mover at its previous position, and let the initial-state distribution be supported on pos∉R\pos∉ R\. Then: (i) every state a truth rollout visits has pos∉Rpos∉ R; (i) writing D=(s,a):pos(s)∉RD=\(s,a):pos(s)∉ R\, every transition of every truth rollout lies in D, so any model built from a predicate that agrees with the membership test pos(Φ(s,a))∈Rpos( (s,a))∈ R on D is exactly equal to f on every rollout of every length under any policy — no sample distinguishes the two, at any tolerance and any N; (i) for any planner that rolls such a model forward from a reachable state, the imagined states also stay outside R, so the disagreement region E has qhit(E)=0q_hit(E)=0 and Proposition 8 forces play_cost=0play\_cost=0. Proof. (i) By induction on t. At t=0t=0 it is the hypothesis on the initial distribution. If the step at t contacts the mode then pos(st+1)=pos(st)∉Rpos(s_t+1)=pos(s_t)∉ R by the inductive hypothesis; if it does not, then pos(st+1)=pos(Φ(st,at))∉Rpos(s_t+1)=pos( (s_t,a_t))∉ R by the definition of a contact. (i) By (i) every visited (s,a)(s,a) lies in D; the two transition maps agree there, so a second induction gives identical trajectories, hence identical transitions and identical rewards. (i) The imagined trajectory is generated by the model, which freezes on entry exactly as the truth does, so the same induction applies to it; E⊆pos(s)∈RE \pos(s)∈ R\ by (i), which the imagined trajectory never enters. ∎ Three consequences. First, the obstruction is structural: it is the mode’s freeze semantics, not the sample size, that removes the evidence, so an independent acceptance sample — the fix of Section 8 — cannot catch a model in this class either. Second, it is harmless, by (i): the models it contains differ from the truth only strictly inside a region no rollout and no imagination reaches. So this is the verified-and-fine cell of the axis separation, now characterised structurally rather than observed. Third, it locates what the evidence can identify: on such an instrument a sample witnesses only entries into the mode, so it pins the boundary as approached and says nothing about membership — which is why an artifact can be exact on every transition it will ever be shown and still not encode the region. Section 9 exhibits a synthesized artifact in this class, together with the check that (i) and (i) hold of it as stated. The qualifier is not decoration: a score that rolls a candidate forward under itself (a multi-step prediction loss, or any objective evaluated on model-generated states) queries the candidate at inputs the sample never contained, and those can lie in M. Such a score is not constant across the two candidates, so it escapes this proposition — it does not thereby become informative, since the two candidates disagree there precisely because nothing observed says which is right, but the proposition does not cover it and we do not claim it does. This holds for any learner — LLM, linear regression, MLP — a point Section 10 instantiates empirically. Proposition 8 (play-cost upper bound; Proposition 2 of Aguilar Martín 2026, transferred). Assume returns are normalized to [0,1][0,1] (WLOG, by rescaling J↦(J−Jmin)/(Jmax−Jmin)J (J-J_ )/(J_ -J_ ); equivalently carry an explicit factor Jmax−JminJ_ -J_ throughout). Let E=(s,a):f(s,a)≠f^(s,a)E=\(s,a):f(s,a)≠ f(s,a)\ be the exact disagreement region — exactness is what the coupling needs, since off E the two models must return identical answers. For any planner that is a deterministic function of model responses and a seed, |J(f)−J(f^)|≤qhit(E)|J(f)-J( f)|≤ q_hit(E), where qhit(E)q_hit(E) is the probability that the planner queries its model somewhere in E during an episode. Proof (coupling; Proposition 2 of Aguilar Martín 2026, recorded here rather than deferred). Couple the two runs on a common seed. On the event that no query lands in E, f and f f return identical responses to every query the planner issues (they agree off E), so with shared rng the two runs select the same action sequence and traverse the same states, realizing the same return. That event is unambiguous: the two runs are identical up to the first query landing in E, so “no query ever lands in E” is a single coupling-measurable event with one probability, not two model-dependent ones. The realized returns can therefore differ only on its complement, of probability qhit(E)q_hit(E), where normalized returns differ by at most 11; taking expectations gives |J(f)−J(f^)|≤qhit(E)|J(f)-J( f)|≤ q_hit(E). MPC’s imagined rollouts are the queries. ∎ The raw J reported in the tables (e.g. Jtruth=17.77J_truth=17.77) is this normalized quantity rescaled by Jmax−JminJ_ -J_ , so the bound is a statement about the normalized return. The paper’s reported play_cost, however, divides by Jtruth−JrandJ_truth-J_rand (Section 2.2), not by Jmax−JminJ_ -J_ ; the following corollary states the relationship rather than silently identifying the two. Corollary 1 (play_cost saturation). Let Jmax,JminJ_ ,J_ be the essential supremum and infimum of the realized return under the episode law, and let J¯≥Jmax J≥ J_ , J¯≤Jmin J≤ J_ be the explicit bounds on them proved in Proposition 12. With play_cost the signed normalization of Section 2.2, Proposition 8 in raw units (|J(f)−J(f^)|≤qhit(E)(Jmax−Jmin)|J(f)-J( f)|≤ q_hit(E)\,(J_ -J_ )) gives |play_cost|≤qhit(E)Jmax−JminJtruth−Jrand≤qhit(E)J¯−J¯Jtruth−Jrand,|play\_cost|\;≤\;q_hit(E)\, J_ -J_ J_truth-J_rand\;≤\;q_hit(E)\, J- JJ_truth-J_rand, the second inequality being the computable one. Proof. Divide Proposition 8’s raw-unit bound by the knob-free constant Jtruth−Jrand>0J_truth-J_rand>0, which is what the definition of play_cost normalizes by; then Jmax−Jmin≤J¯−J¯J_ -J_ ≤ J- J by Proposition 12. ∎ Three statuses must be kept apart wherever this ceiling is quoted, and Proposition 12 supplies only the first: a proved bound (J¯ J, J¯ J, valid at every knob and every policy), an attained extremum (a policy exhibited that realizes it — the push-left trajectory does so for J¯ J at xwall≤6x_wall≤ 6, to within 2×10−72× 10^-7), and a numerical approach to an extremum whose attainment is not proved (the wider knobs, where the bound exceeds the best policy found by 1.0015×1.0015× at xwall=8x_wall=8 and 1.0799×1.0799× at 1010). We write J¯,J¯ J, J for the bounds throughout, and say “known” only where attainment is exhibited. Pointwise extremes are what Proposition 8 needs — its coupling bounds a realized per-seed difference, not a difference of expectations — and the distinction is not pedantic here: read as a supremum over policies of the expected return, JmaxJ_ would be 17.69717.697 on the cart (the best constant policy averaged over x0∼U(−12,12)x_0 U(- 12, 12)), below the measured Jtruth=17.772J_truth=17.772, whose seeds happen to have x¯0=−0.123 x_0=-0.123; the normalization would then exceed 11 by construction. Both normalizers are derived rather than estimated — explicit numbers valid at every knob and every policy — and the knob-invariance of the reported play_cost is an arithmetic consequence of the exploited planner’s return rather than an empirical regularity (Proposition 13). Both derivations, with the certificate that the truth planner’s own return is knob-free, are in Section B. There is a positive counterpart to all of this, and it is worth knowing exactly how far it reaches. For Lipschitz pairs the gate does certify something: a partition argument on the deployed cart gate excludes any pair with L=max(Lipf,Lipf^)≤5.77L= (Lipf,Lip f)≤ 5.77 carrying the wall’s error of 4.24.2, with probability at least 1−δ1-δ over the gate’s draws. The same measurement shows why it does not rescue sampling verification: the certified region carries 1.9%1.9\% of the exploited planner’s queries. The certificates, their statistical accounting and that measurement are in Section C. What is new: the localization premise is a theorem-shaped obstruction. Proposition 9 (smoothness forbids localized error). Let f,f^:S×A⊆ℝd×ℝm→ℝdf, f:S× A ^d×R^m ^d be L-Lipschitz on the joint state-action space in the sup-metric on S×AS× A, with L∈[0,∞)L∈[0,∞) (i.e. L=max(Lipf,Lipf^)L= (Lip\,f,Lip\, f)). Suppose ‖f(s0,a0)−f^(s0,a0)‖∞=η\|f(s_0,a_0)- f(s_0,a_0)\|_∞=η at some (s0,a0)∈S×A(s_0,a_0)∈ S× A. Fix any tolerance ε<η <η and write Eε=(s,a)∈S×A:‖f(s,a)−f^(s,a)‖∞>εE_ =\(s,a)∈ S× A:\|f(s,a)- f(s,a)\|_∞> \. If L>0L>0, then EεE_ contains the open metric ball B((s0,a0),η−ε2L)∩(S×A)B\! ((s_0,a_0), η- 2L )∩(S× A) (the intersection matters only when (s0,a0)(s_0,a_0) lies near ∂(S×A)∂(S× A)). If L=0L=0, then f−f^f- f is constant and EεE_ is all of S×AS× A — the degenerate extreme of the same statement, and the reason the radius is written for L>0L>0. Proof. g=f−f^g=f- f is 2L2L-Lipschitz on S×AS× A, so for ‖(s,a)−(s0,a0)‖∞<(η−ε)/2L\|(s,a)-(s_0,a_0)\|_∞<(η- )/2L we have ‖g(s,a)‖∞≥η−2L‖(s,a)−(s0,a0)‖∞>ε\|g(s,a)\|_∞≥η-2L\,\|(s,a)-(s_0,a_0)\|_∞> ; the inequality is strict, so the ball is open. The L=0L=0 case is immediate: g≡g(s0,a0)g≡ g(s_0,a_0) with ‖g(s0,a0)‖∞=η>ε\|g(s_0,a_0)\|_∞=η> . ∎ Corollary 2 (the localization budget). In the setting of Proposition 9 with L>0L>0, write z0=(s0,a0)z_0=(s_0,a_0) and ρ=(η−ε)/2Lρ=(η- )/2L. Then, with no condition on where z0z_0 sits, vol(Eε)≥vol(B∞(z0,ρ)∩(S×A)),vol(E_ )\;≥\;vol\! (B_∞(z_0,ρ)∩(S× A) ), since the proposition places the intersected ball inside EεE_ and volume is monotone under inclusion. When the ball is not clipped by ∂(S×A)∂(S× A) — the interior case — the right side is the volume of a sup-metric cube of side 2ρ2ρ, vol(Eε)≥(η−εL)d+m,vol(E_ )\;≥\; ( η- L )^d+m, and, equivalently, confining the ε -disagreement of an η-amplitude error to a set of volume V requires L≥η−εV1/(d+m).L\;≥\; η- V^1/(d+m). The first display is the always-valid form; what the boundary can cost is a constant, made uniform by one piece of domain regularity. Corollary 3 (the budget at the boundary). Say a domain D⊆ℝd+mD ^d+m has interior-volume constant κ∈(0,1]κ∈(0,1] at scale r0>0r_0>0 if vol(B∞(z,r)∩D)≥κ(2r)d+mvol(B_∞(z,r)∩ D)≥κ\,(2r)^d+m for every z∈Dz∈ D and every r≤r0r≤ r_0. If S×AS× A has interior-volume constant κ at scale r0r_0 and ρ=(η−ε)/2L≤r0ρ=(η- )/2L≤ r_0, then vol(Eε)≥κ(η−εL)d+m,equivalentlyL≥(η−ε)(κV)1/(d+m)vol(E_ )\;≥\;κ ( η- L )^d+m, L\;≥\;(η- ) ( κV )^1/(d+m) for confinement to volume V. For an axis-aligned box with side lengths ℓ1,…,ℓd+m _1,…, _d+m this holds at scale r0=miniℓir_0= _i _i with the per-point refinement vol(B∞(z,r)∩D)≥ 2−k(2r)d+m,k=#i:min(zi−ai,bi−zi)<r,vol\! (B_∞(z,r)∩ D )\;≥\;2^-k\,(2r)^d+m, k=\#\i: (z_i-a_i,\,b_i-z_i)<r\, where k counts the clipped coordinates: k=0k=0 in the interior recovers the unclipped display of Corollary 2 (κ=1κ=1), a face point has k=1k=1 (half the cube survives), an edge k=2k=2, and a full corner k=d+mk=d+m keeps exactly one orthant. So a box has κ=2−(d+m)κ=2^-(d+m), attained at a corner — the constant is sharp — and the boundary’s whole price in the equivalent form is L≥(η−ε)/(2V1/(d+m))L≥(η- )/(2V^1/(d+m)): clipping costs at most a factor 22 in L, never the budget itself. The same product formula covers half-bounded and unbounded coordinates (an unbounded coordinate never clips and contributes its full factor 2r2r); on this paper’s instrument domains the state coordinates are unbounded and the single scalar action lives in [−amax,amax][-a_ ,a_ ], so k≤1k≤ 1 and κ≥1/2κ≥ 1/2 at every witness with r≤2amaxr≤ 2a_ . Proof. The general displays follow from Corollary 2’s first display and the definition of κ. For the box, the ball-domain intersection is a product of interval intersections, and coordinate i contributes length min(zi+r,bi)−max(zi−r,ai) (z_i+r,b_i)- (z_i-r,a_i): this is 2r2r when ziz_i is at distance at least r from both endpoints, and at least min(ℓi,r)≥r ( _i,r)≥ r otherwise (at least r of the window [zi−r,zi+r][z_i-r,z_i+r] lies on the side of ziz_i with more room, using r≤ℓir≤ _i). Multiplying the factors gives 2−k(2r)d+m2^-k(2r)^d+m. At a corner z=(a1,…)z=(a_1,…) with r≤miniℓir≤ _i _i every factor is exactly r, so the bound is attained. (The case constants are computed from this product formula in exact rational arithmetic by scripts/locbudget_boundary_constants.py rather than asserted; tests/test_locbudget_boundary.py checks the formula against brute-force Monte Carlo volumes, the sharpness at a corner, and that the scale condition r≤miniℓir≤ _i _i is load-bearing.) ∎ So localization is not forbidden at finite L; it is purchased, at a Lipschitz constant that grows as the region shrinks — and only exact localization (V→0V→ 0 at fixed amplitude) requires L→∞L→∞. The purchase price is now unconditional: at an interior witness the budget is ((η−ε)/L)d+m((η- )/L)^d+m, and at a boundary witness it is the same volume times a domain constant that a box keeps above 2−(d+m)2^-(d+m). This is the precise form of the claim, and what it does not say matters as much, because four statements are easy to merge and only the first is this proposition’s. Remark 3 (four statements that must be kept apart). (i) Representability. A pair with Lipschitz constant at most L cannot realize an η-amplitude error confined below the volume of Corollaries 2–3; a discontinuous reset boundary — the kind all three instruments carry: the map jumps (v↦0v 0 at the wall and the stop, the mover frozen at the patch), so no finite local constant exists — faces no such constraint. The scope cuts both ways: a hybrid boundary that is continuous but nonsmooth (a kink, an actuation saturation) keeps a finite Lipschitz constant and still pays the budget, so the exemption is proved for the reset modes studied here, not for hybrid boundaries as a class. Compactly supported smooth errors are not excluded either, and this paper uses one — the C∞C^∞ bump arm of Section 5 — so “smooth models cannot localize” would be false as stated; what is true is the bounded-Lipschitz, fixed-amplitude, arbitrarily-sharp form above. (i) Detectability. The same geometry forces a gate reveal rate (Proposition 16): at fixed amplitude, a smoother error is easier for the gate to find, not harder — measured at 0.180.18 against the wall’s 0.140.14 in Section 5. (i) Exactness at a tolerance. Agreeing off the mode at ε=10−9 =10^-9 is a float-level property, which a program inherits from a pinned integrator by construction and a fitted model attains only up to its optimization residual. That is a claim about representation classes, not about either of the above. (iv) Learnability from a finite sample. What a given learner does with a given sample is an empirical question. Section 10 answers it for two learners — a closed-form linear fit and a probe-grade h=8h=8 MLP — and those measurements license no conclusion about modern learned dynamics models, whose floor would be lower and whose structural inability to be bit-exact off a mode is an argument rather than a measurement (Section 12). The disagreement region EεE_ lives in the same joint state-action space as the exact disagreement region E of Proposition 8, and satisfies Eε⊆E_ E for every ε≥0 ≥ 0, so the ball is directly a lower bound on the query-relevant region the planner can hit — no fixed-action slice argument is needed to bring the two together. The inclusion is the only relation the two need: Proposition 8 requires exact agreement off E, so it cannot be restated at tolerance ε without a perturbation term (a ε -sized answer difference can flip an argmax over 200 candidates and decouple the runs). (Restricting to a fixed action a0a_0 recovers the state-slice form: the open ball of radius (η−ε)/2L(η- )/2L in S×a0S×\a_0\ lies in EεE_ , the version convenient when reasoning about a single instrument’s mode.) Read as its contrapositive: a model error that is large somewhere (large enough to matter at play) and invisible at tolerance ε outside a metrically tiny region requires L large — in the limit, a discontinuity. This is the sense in which the discrete localization premise (“the wrong model is exact off the rule region”) is discrete: in its exact form it is unsatisfiable at any finite Lipschitz bound, and in its approximate form it costs the volume of Corollaries 2–3. Two consequences structure the paper: (i) the natural continuous home of the danger geometry is hybrid dynamics with discontinuous resets — inelastic contacts, hard stops, regime switches that jump the state — where the truth itself has unbounded local Lipschitz constant across the mode boundary (our wall: v jumps to 0), and an omitted mode is precisely a rare rule; a continuous hybrid boundary (a kink, a saturation) keeps a finite constant and stays inside the budget, so this home is the reset class and not hybrid dynamics wholesale; (i) exact off-mode agreement is available representationally to programs (an omitted or added branch is bit-exact off the omitted case) and to a bounded-Lipschitz model only at that volume price, a contrast Section 10 measures on two learners. The geometry also has a measure counterpart — smoothness does not merely forbid exact localization, it forces a gate detection rate, at a Lipschitz constant that must grow like N1/(d+m)N^1/(d+m) to keep hiding. That proposition, the closed-form visitation density it consumes, and the three scope conditions that decide what it says about this instrument are in Section D. The short version is the one the measurements confirm: at comparable amplitude the smooth error is if anything the more detectable of the two, and its harmlessness comes from play cost rather than from hiding. 4 The mechanism and the threshold law This section measures the danger law’s full phenomenology on the hand-written instruments, before any LLM enters the loop. Every “danger” column below is the product play_cost×(1−r)Nplay\_cost×(1-r)^N, which is the risk of Proposition 3 exactly when that proposition’s covariance hypothesis holds; here the artifact is hand-written and fixed, so it holds by construction, and the qualifier only becomes live in the LLM arms of Section 7. All numbers CPU-only, with the hand-written blind model as the on-manifold proxy (scripts/continuous_reach.py; 30,000 rarity rollouts and 20 MPC episodes/arm per knob; Wilson 95% CIs (Wilson 1927) in the versioned results). One convention holds for every table below: a printed 00 is a censored zero — no occurrence in the sample, not a demonstrated impossibility — and its content is the Wilson upper bound, which the versioned JSON carries. The ones stated inline: 0/200/20 truth-planner contacts is [0,0.16][0,0.16], 0/3000/300 gate passes is [0,0.013][0,0.013], and 0/20000/2000 rarity is [0,0.0019][0,0.0019]. Every zero-valued table cell now carries its own bound, its own interval, or the note that it is a demonstrated rather than a censored zero, so this convention is a reading aid and not a load-bearing one. Uncertainty on the danger curves is propagated per factor and labelled: every rarity across the 4040 curve rows of the three instruments carries a family-wise simultaneous 95%95\% exact interval propagated monotonically through play_cost⋅(1−r)Nplay\_cost·(1-r)^N (scripts/danger_law_h4.py, results/danger_law_h4.json; Bonferroni, so the family coverage holds under the rows’ dependence, and the exponent identities the propagation relies on are the corollaries of Remark 2), and on the cells with committed paired episode triples — cart xwall=8x_wall=8, pendulum θstop=1.4 _stop=1.4, and PatchField2D k=(3,7)k=(3,7) with its three critical-event curves — the band combines both estimated factors, the rarity interval and a paired play-cost bootstrap. For the remaining rows the play-cost factor is a point estimate and the band is rarity-only; the JSON records that as an explicit per-row gap rather than presenting a rarity-only band as a full danger interval. xwallx_wall rarity JtruthJ_truth JblindJ_blind JrandJ_rand play_cost blind hit d@20 d@40 d@80 2 0.3168 17.77 1.4×10−51.4×10^-5 0.53 1.031 1.00 0.001 2.5×10−72.5×10^-7 6.0×10−146.0×10^-14 3 0.2135 17.77 1.3×10−51.3×10^-5 0.53 1.031 1.00 0.008 6.9×10−56.9×10^-5 4.7×10−94.7×10^-9 4 0.1352 17.77 1.9×10−51.9×10^-5 0.53 1.031 1.00 0.056 0.003 9.3×10−69.3×10^-6 5 0.0797 17.77 6.3×10−56.3×10^-5 0.53 1.031 1.00 0.196 0.037 0.001 6 0.0439 17.77 3.8×10−43.8×10^-4 0.53 1.031 1.00 0.420 0.171 0.028 8 0.0114 17.77 0.02 0.53 1.030 1.00 0.818 0.650 0.410 10 0.0024 17.77 0.94 0.53 0.977 1.00 0.930 0.886 0.804 Table 1: The danger curve on the wall-position knob. “blind hit” = fraction of episodes in which the blind planner’s trajectory fires the wall mode; the truth planner’s trajectory fires it in no episode at any knob (0/200/20, so <0.16<0.16); d@N = play_cost⋅(1−r)Nplay\_cost·(1-r)^N. Rarity is measured on 30,000 random rollouts (Wilson 95% CIs in the versioned JSON), the same sample size as the pendulum’s, so the mode-firing and reveal-rarity estimates of the same event are now directly comparable. Figure 1: The threshold law on the wall-position knob (Table 1 rendered): danger ≈0≈ 0 while the wall is inside the random envelope, rises through the elbow, plateaus at full play_cost; N shifts the threshold. Bands and horizontal bars are the rarity’s Wilson interval propagated through play_cost⋅(1−r)Nplay\_cost·(1-r)^N, which is monotone in r, so the transformed interval is the corner pair; a printed point with no visible band has an interval narrower than the marker. Figure 2: The two reach distributions of the danger law: the exploited planner’s mode reach is flat at 1.00 across the knob; random reach (= rarity) falls two orders of magnitude; the truth planner’s trajectory reach is a censored zero at every knob (0/200/20 episodes) and is drawn as an upper bound rather than as a point — the mode lives on the truth planner’s query distribution (Proposition 8), not its path. Error bars are Wilson intervals: binomial over 2020 episodes for the two reach curves, and over 30,00030,000 rollouts for rarity. Readings: the threshold law again — danger ≈0≈ 0 while the wall sits inside the random-rollout envelope, rises through the elbow, and plateaus at full play_cost, with the entire elbow inside the sweep (Figure 1). play_cost is knob-invariant and ≈1≈ 1 (exceeding 1 at every knob except the largest, where far-plateau leakage gives 0.977): the blind planner is not merely uninformed but exploited — MPC on the wall-less model plans into the phantom region, is pinned at the wall (final x=xwallx=x_wall exactly, contact rate 1.00 at every knob), and replans the same doomed plan every step, for the entire episode, ending at a return of 2×10−52× 10^-5 against the truth planner’s 17.7717.77. The 0.977 at xwall=10x_wall=10 is the sigmoid tail of the far plateau leaking Jblind=0.94J_blind=0.94; the mechanism is unchanged. The reach mechanism appears in its cleanest form (Figure 2), with the query/trajectory distinction now visible. Gate-miss exactness is re-verified in-tests and again at gate scale in Section 5. One qualification belongs with the claim. At the widest knobs the pinned planner scores above the uniform-random policy, because the far plateau’s sigmoid tail pays a planner frozen short of it; the exploitation is what the mechanism asserts, and “below random” is a property of the reward’s shape as much as of the planner. Narrowing only the phantom plateau removes the tail and makes the strong form hold at every knob on both instruments, with play_cost invariant to 10−410^-4 (Section H); we report the default instrument in the main tables and treat that variant as a robustness check rather than as the headline. At 100100 paired episodes: the exploitation is robust, “below random” is not. Twenty episodes per cell is too few for a comparison against a baseline as heavy-tailed as the uniform-random policy’s, so the three headline rows were re-run at 100 paired episodes with a paired bootstrap and a randomization test (scripts/play_cost_intervals.py; the same seed in all three arms, 20,00020,000 resamples). The exploitation claim survives unchanged and tightens: on the cart’s headline knob play_cost=1.014play\_cost=1.014 with a paired 95%95\% interval [1.001,1.033][1.001,1.033], on the pendulum’s 0.9960.996 [0.996,0.997][0.996,0.997], and on PatchField2D 1.0441.044 [1.020,1.075][1.020,1.075] — and the raw quantity behind them is a regret of 17.7217.72, 19.9619.96 and 19.7519.75 return units respectively, which is what those normalized numbers mean. The comparison against random, however, does not survive at face value, and the reason is the baseline rather than the planner. On the cart, Jrand−Jblind=0.249J_rand-J_blind=0.249 with interval [0.024,0.559][0.024,0.559] and a sign-flip p=0.040p=0.040, so the mean difference is positive — but JrandomJ_random is heavy-tailed (median 4.7×10−44.7× 10^-4, maximum 10.5810.58, skewness 6.16.1: a handful of episodes in which the random walk happens to reach the left plateau), and in 8686 of the 100100 seeds the blind planner scores above random. So “below random” on the cart is a statement about a mean that a few lucky random episodes carry, not about a typical episode, and it is stated here only in that form. At the pendulum’s headline knob it is simply false at this sample size (Jrand−Jblind=−0.078J_rand-J_blind=-0.078, random better in 77 of 100100 seeds) — that knob is one the sigmoid-tail leak of the previous paragraph affects. On PatchField2D it is unambiguous: Jrand−Jblind=0.834J_rand-J_blind=0.834 [0.395,1.357][0.395,1.357], random better in 100 of 100100 seeds, p=1.2×10−14p=1.2× 10^-14. The load-bearing claim was never the comparison with random — it is that the planner is exploited: pinned at the boundary in every episode, at a regret of essentially the whole available return, with play_cost≈1play\_cost≈ 1 and its interval excluding zero by three orders of magnitude. That is what the tables report, and what “below random” added was rhetorical rather than evidential. One further caution the larger sample exposes: on PatchField2D the truth planner’s own return has a standard deviation of 7.97.9 across seeds (median 17.017.0, maximum 41.641.6), because it sometimes finds a route past the patches to the phantom lode, so the per-seed play cost there is genuinely dispersed (median 0.8990.899, interquartile range [0.860,0.932][0.860,0.932]) and its mean is not a typical episode either. Per-seed values for all three rows are in the versioned JSON, and Figure 3 plots them, tails unsummarized. Figure 3: Per-seed return distributions for the three 100100-paired-episode experiments (violins with every seed overplotted). The exploitation claim is the gap between the truth planner and the pinned blind planner, and it is total in every panel. The random baseline’s heavy upper tail — a few episodes that wander onto a reward plateau — is what carries its mean above the blind planner’s on the cart, against 8686 of 100100 individual seeds; on PatchField2D the comparison is unambiguous in the other direction (00 of 100100). 4.1 Robustness: the same law on a nonlinear plant The cart’s off-mode dynamics are linear, which is convenient for Section 10 but invites the worry that the phenomenology depends on it. A second instrument — a pendulum (gravity term sinθ θ, θ=0θ=0 hanging down) with a hard angular stop, same interface, same MPC, same two-plateau reward on θ — reproduces the identical picture with no re-calibration (rarity is natural here: gravity confines the random walk near the bottom, so climbing to the stop is rare): θstop _stop rarity JtruthJ_truth JblindJ_blind play_cost blind hit d@40 0.8 0.2876 20.08 0.01 1.002 1.00 1.3×10−61.3×10^-6 1.0 0.1270 20.08 0.03 1.002 1.00 0.004 1.2 0.0509 20.08 0.05 1.000 1.00 0.124 1.4 0.0196 20.08 0.12 0.997 1.00 0.452 1.6 0.0070 20.08 0.26 0.990 1.00 0.748 2.0 0.0007 20.08 1.23 0.942 1.00 0.917 Table 2: Pendulum-with-stop: threshold law, knob-invariant exploitation (pinned at the stop in every episode at every knob), truth planner untouched by the mode. The mechanism does not care that the plant is nonlinear — only that the mode is hard and rare under the gate’s measure. Rarity is the fraction of 30,000 random rollouts that fire the stop (Wilson 95% CIs for every row in the versioned JSON). The sample was raised from 3000 specifically because the widest knob was a censored zero there (0/30000/3000); at 30,000 it resolves to 0.00070.0007 [0.0004,0.0010][0.0004,0.0010], so every row is now a point estimate and every d@40 a number rather than a bound. 4.2 Two modes at once: a 4D bi-modal instrument Both instruments so far are one hard boundary in a 2D state. PatchField2D closes both structural gaps at once — a 4D state and two distinct modes (their contact events are not independent, and Section 4.2 measures the dependence) — and asks what the 1D instruments cannot: does the danger law compose mode-wise? State (x,y,vx,vy)(x,y,v_x,v_y); a scalar action a∈[−amax,amax]a∈[-a_ ,a_ ] is mapped to a heading ϕ=πclamp(a)/amaxφ=π\,clamp(a)/a_ so all planner machinery (which consumes scalar actions) is reused unchanged; semi-implicit Euler: vx′=vx+(gaincosϕ−dragvx)dt,vy′=vy+(gainsinϕ−dragvy)dt,v_x =v_x+(gain φ-drag\,v_x)\,dt, v_y =v_y+(gain φ-drag\,v_y)\,dt, x′=x+vx′dtx =x+v_x \,dt, y′=y+vy′dty =y+v_y \,dt. The two modes are circular sticky patches Pi=disc(ci,R)P_i=disc(c_i,R): if (x′,y′)∈Pi(x ,y )∈ P_i the next state is (x,y,0,0)(x,y,0,0) — the probe stops inelastically at its previous position with zero velocity (the 2D analogue of the wall clamp, and the structure the 2D mitigation exploits, Section F.1). Reward is two radial sigmoid lodes, a small real one near the start and a large phantom one behind the patches; the mode-blind planner aims straight at the phantom and freezes at a patch edge. The two knobs are the patch centers’ distances along and off the start-to-lode corridor (k1k_1 the near patch, k2k_2 the far one); defaults are frozen once, never tuned per cell. Table 3 sweeps the 3×33× 3 knob grid (scripts/continuous_patch2d.py; 600 rarity rollouts and 20 MPC episodes/arm per cell). The per-mode rarities separate cleanly (r1∈[0.085,0.245]r_1∈[0.085,0.245], r2∈[0.0067,0.0100]r_2∈[0.0067,0.0100]), Jblind=0J_blind=0 at every cell (the blind planner freezes at a patch edge every episode; Jrand=0.11J_rand=0.11), and play_cost is knob-invariant at [1.005,1.006][1.005,1.006] — the same below-random exploitation as the 1D instruments, now on a 4D plant. The danger law applies per mode and to the pair — but it does not factor. Proposition 1 holds for any measurable critical event, so the per-mode gate-miss factors are (1−ri)N(1-r_i)^N and the joint one is (1−r∪)N(1-r_∪)^N, where r∪r_∪ is the probability that a rollout contacts either patch (Proposition 2). We measure r∪r_∪ rather than compose it: writing the joint factor as the product (1−r1)N(1−r2)N(1-r_1)^N(1-r_2)^N would assume the two per-mode contact events are independent within a rollout, and they are not. At 600 rollouts P(both)P(both) is only 00 to 33 counts per knob, so the product’s −17%-17\% to +12%+12\% relative error across this grid is not by itself evidence of anything: six of the nine cells are censored zeros, which force the product to over-estimate by construction. The dependence was therefore re-measured at 50,00050,000 rollouts on four knobs (scripts/patch2d_dependence_50k.py), where it is resolvable and does change direction: negative at (2,6)(2,6) and (3,7)(3,7), positive at (4,6)(4,6), all three with Wilson intervals excluding r1r2r_1r_2, and undecided at (4,7)(4,7). The mechanism is visible in the sign: a rollout that freezes at the near patch has spent its travel (negative), while reaching a far patch usually means passing the near one (positive). Both columns are in the versioned JSON (d40_joint and d40_joint_indep_approx); the table reports the measured one. Three qualifications: the r2r_2 knob is only weakly resolved at 600 rollouts (its trend is under-resolved, not flat), the k1=4k_1=4 one-hit bump in r2r_2 is sampling noise rather than a knob effect, and the four-decimal d@40 figures in the P2P_2 and joint columns inherit that resolution — at 44 to 66 hits in 600600 the interval on d@40P2=0.7700d@40\,P_2=0.7700 is [0.51,0.91][0.51,0.91], so those digits are bookkeeping, not precision. k1k_1 k2k_2 r1r_1 r2r_2 r∪r_∪ JtruthJ_truth play_cost d@40 P1P_1 d@40 P2P_2 d@40 joint 2 6 0.245 0.010 0.252 17.98 1.006 1.3×10−51.3×10^-5 0.673 9.3×10−69.3×10^-6 2 7 0.245 0.008 0.253 18.02 1.006 1.3×10−51.3×10^-5 0.720 8.5×10−68.5×10^-6 2 8 0.245 0.007 0.252 18.08 1.006 1.3×10−51.3×10^-5 0.770 9.3×10−69.3×10^-6 3 6 0.142 0.008 0.150 18.57 1.006 0.002 0.720 0.002 3 7 0.142 0.008 0.150 18.47 1.006 0.002 0.720 0.002 3 8 0.142 0.007 0.148 17.72 1.006 0.002 0.770 0.002 4 6 0.088 0.008 0.092 20.85 1.005 0.025 0.719 0.021 4 7 0.088 0.010 0.095 19.52 1.006 0.025 0.673 0.019 4 8 0.085 0.008 0.093 19.08 1.006 0.029 0.720 0.020 Table 3: PatchField2D mechanism sweep (3×33× 3 knobs; 600 rarity rollouts, 20 MPC episodes/arm; Jblind=0J_blind=0, Jrand=0.11J_rand=0.11 at every cell). d@40 PiP_i = play_cost⋅(1−ri)40play\_cost·(1-r_i)^40 (per-mode danger); r∪r_∪ = measured probability that a rollout contacts either patch; d@40 joint = play_cost⋅(1−r∪)40play\_cost·(1-r_∪)^40, the danger law at the joint critical event — not the product ((1−r1)(1−r2))40((1-r_1)(1-r_2))^40, which would assume within-rollout independence and errs by −17%-17\% to +12%+12\% here. Full table (with JblindJ_blind, JrandJ_rand, hit rates) in docs/EXPERIMENTS.md. Play cost is planner-dependent — measured on two families, one configuration each — and the bound says which direction is forced. Proposition 8 bounds play cost by the planner’s query-hit probability on the disagreement region, so low query reach forces low play cost while high reach merely permits high cost. A second base planner family (the cross-entropy method, one fixed configuration) sits at the low-reach end on all eleven knobs of both 1D instruments and on PatchField2D, with play cost statistically indistinguishable from zero and imagined boundary-crossing strictly below random-shooting MPC’s. Limited reach is not knowledge, and the same search that misses phantom reward can miss real reward; the rows, the censoring of the two zero-crossing cells and the caveats are in Section E. 5 Axis separation: which errors the gate catches at ε=10−2 =10^-2, and which it misses The classic continuous-model failure axis is pervasive sub-tolerance error; the danger law’s axis is a localized hard mode. A tolerance gate must be shown to fail only on the second axis, and only at the (1−r)N(1-r)^N rate. What fixes ε , and why the axis separation does not depend on it. We use ε=10−2 =10^-2 as a representative tolerance, not a deployment-derived one: these are deterministic simulators with no sensor noise and float64 arithmetic, so there is no physical error budget to read it off. What the value does is sit in the middle of the only two scales the instrument supplies — three orders of magnitude above the integrator’s float noise (∼10−16 \!10^-16, and 10−910^-9 is where the pinned-integrator gate of Section 7 runs), and between two and three orders below the mode’s own disagreement (4.24.2 on the cart) — while amounting to about 0.06%0.06\% of the 1818-unit position span between the two reward plateaus and 0.1%0.1\% of the reachable speed range. The claim that matters is that the choice is immaterial: the ε -sweep below varies it over eight orders of magnitude, 10−910^-9 to 0.30.3, and the axis separation is unchanged throughout. Likewise N=40N=40 is inherited from the companion paper’s sweep so the two studies’ counts are comparable; it is not derived from a verification cost model, and the tables report d@Nd@N at N∈20,40,80N∈\20,40,80\ so the threshold’s dependence on it is visible rather than assumed away. Five arms, one table (scripts/continuous_axes.py; reveal-rarity == P(a random rollout contains a transition where truth and model differ >ε> ), 20,000 rollouts; pass@40 over 300 independent N=40N=40 gates; 20 MPC episodes/arm). For the hard mode, the mode-firing rarity of Tables 1–2 and the reveal-rarity here coincide as events — the mode error exceeds every ε in the swept range (the ε -sweep below), so a rollout fires the mode iff it reveals a disagreement — which licenses the shared symbol r.11 1 With both samples raised, the two estimates of the same event now agree to the third decimal: mode-firing rarity 0.13520.1352 on 30,000 rollouts (Table 1) against reveal-rarity 0.13510.1351 on 20,000 (Table 4). At smaller samples they read 0.14300.1430 and 0.13850.1385; the gap was resampling noise. arm reveal-rarity (1−r)40(1-r)^40 pass@40 measured play_cost d@40 wall@4 omitted 0.1351 0.0030 0.003 1.031 0.0031 wall@8 omitted 0.0103 0.6622 0.667 1.030 0.6821 drag bias ×1.03 (sub-ε ) 0.0001 0.9940 0.997 00 (exact) 00 (exact) drag bias ×2.0 (supra-ε ) 1.0000 <10−4<10^-4 <0.013<0.013 00 (exact) 00 (exact) C∞C^∞ bump@4, amp 0.5 0.1829 0.0003 <0.013<0.013 00 (exact) 00 (exact) C∞C^∞ bump@4, amp 1.0 0.2018 0.0001 <0.013<0.013 −0.745-0.745 −0.0001-0.0001 Table 4: Axis separation at ε=0.01 =0.01, N=40N=40; d@N = play_cost⋅(1−r)Nplay\_cost·(1-r)^N, as in Table 1. Danger lives in one quadrant only: rare ∧ hard-mode. Reveal-rarity is measured on 20,000 rollouts (raised from 2000 because the sub-ε arm was a censored zero there): it now resolves to 0.00010.0001, and its predicted pass rate 0.99400.9940 sits inside the measured [0.9814,0.9994][0.9814,0.9994] instead of above it. Figure 4: Table 4 as the danger quadrant: gate-miss probability (log) vs play_cost. Only the rare hard mode reaches the top right; danger is the product of the coordinates. Horizontal bars propagate each arm’s rarity interval through (1−r)40(1-r)^40; the play_cost axis carries a paired interval where per-episode returns exist and no bar where the arms are bit-identical, since there the difference is exactly zero rather than uncertain. Readings (Table 4, rendered as the danger quadrant in Figure 4): gate exactness at gate scale — measured pass@40 matches (1−r)40(1-r)^40 in both wall rows — 0.003 vs 0.0030 and 0.667 vs 0.6622, each prediction inside the 300-gate Wilson interval. Two bookkeeping points matter for reading any of these agreements. First, r r carries its own error, and the prediction (1−r^)40(1- r)^40 inherits it: propagating the rarity’s Wilson interval, the 20,00020,000-rollout reveal-rarity 0.010250.01025 [0.00895,0.01174][0.00895,0.01174] predicts a pass rate in [0.623,0.698][0.623,0.698], which contains the measured 0.6670.667; on 20002000 rollouts, r^=0.0125 r=0.0125 [0.0085,0.0184][0.0085,0.0184] predicts [0.476,0.711][0.476,0.711], comfortably containing 0.6670.667. A point prediction like 0.60460.6046 compared against the measurement’s interval, while its own interval goes unquoted, would misread that cell as a marginal failure; the propagated comparison is the valid one. Second, this instrument has two rarity estimates for what Proposition 10 says is one event: 0.011400.01140 from the 30,00030,000-rollout mode-firing sweep of Table 1 (predicting 0.6310.631) and 0.010250.01025 from the 20,00020,000-rollout reveal-rarity here (predicting 0.6620.662). Their intervals overlap and the proposition says the events coincide below ε⋆ , so this is sampling noise and not a contradiction — but the 10%10\% relative gap is larger than either interval’s half-width suggests one should ignore, and we quote the reveal-rarity throughout this table and the firing rarity throughout Table 1 rather than mixing them. The proposition is the observed acceptance rate, not asymptotic decoration. The gate polices the pervasive axis: a global drag bias above tolerance is revealed on every rollout and never accepted; a sub-tolerance bias is accepted at 0.997 — which the law now predicts rather than excuses: that arm does reveal a disagreement on a thin slice of rollouts (reveal-rarity 0.00010.0001, the extreme velocity tail), for a predicted pass rate of 0.99400.9940 — and it is harmless at play. Verified-and-fine is a real cell, and the gate finds it. Smoothness kills consequence, not detectability: the C∞C^∞ drag bump at the wall’s location has comparable rarity to the wall (0.18 vs 0.14 — it is just as detectable, confirming Proposition 9 is about error geometry, not about hiding from the gate, and matching the direction of Proposition 16) yet play_cost 0.000 at amplitude 0.5. At amplitude 1.0 play_cost turns negative (−0.745-0.745): the truth planner, seeing the slowdown near its horizon edge, is over-pessimistic and often settles for the small plateau, while the bump-blind planner pushes through and wins. A smooth localized omission produces planner-side timing effects of ambiguous sign; only the hard mode produces the one-way exploitation geometry (pinned, forever, below random). On the three instruments and the swept grid, the separation does not depend on the tolerance. A sweep over ε∈10−9,…,0.3 ∈\10^-9,…,0.3\ leaves the mode arms’ reveal-rarity flat on all three instruments while the pervasive-bias arms switch sharply at their own error scale, and pass@40≈(1−r)40pass@40≈(1-r)^40 continues to hold for the mode arms at every ε in the grid (Section I). The gate’s ε is a pervasive-error dial, not a mode-detection dial: tightening it cannot catch the hard mode, and loosening it does not widen the hole. 6 The exploitation is planner-mediated: a distrust-region fence collapses it on the 1D instruments The exploitation measured above is planner-mediated rather than model-mediated, and a planner-side fix collapses it without touching the model or the gate — which does not contradict the danger law, since the gate still accepts a wrong model and Proposition 5 is untouched. Distrust-region replanning fences the positions of the model’s refuted predictions and truncates any imagined trajectory that crosses a fence. On the two 1D instruments a single contact suffices to fence the mode on all eleven knob rows — a separation fact rather than a covering one, with a measured range of validity — and the mitigation is bit-identical to plain MPC when the model is right. On a 2D circular mode it degrades and, at the farthest knob, fails outright in 77 of 2020 episodes, because its tie-break is an unsigned distance. The design, the packing bound on its contact cost, the dimensional reading of that bound and the 2D failure are in Section F. 7 LLM synthesis: on the 1D clamps the danger reduces to the identifiability event Real-LLM arms (scripts/continuous_danger_synthesis.py; Azure GPT-5.x mini and large22 2 Exact models. “large” is the Azure OpenAI deployment gpt-5.4 and “mini” is gpt-5.4-mini, both at API version 2025-04-01-preview; the cross-family arms are Qwen/Qwen3-Coder-30B-A3B-Instruct (Hugging Face Inference Providers router) and Claude Sonnet (agent-relayed, Section 7). Every result JSON under results/ records its own model field, so each number is attributable to a named deployment; the runs are dated 2026-07-07 to 2026-07-20 in the repository history. We write “GPT-5.x” in prose where the claim holds for both sizes.; N=40N=40 training rollouts which double as the gate, as in the companion paper’s sweep; ε=10−9 =10^-9 pinned-integrator gate; 20 seeds/cell on the headline xwall=8x_wall=8 cell, both sizes (the companion paper’s standard); 6 MPC play episodes/seed; per-seed JSON with the synthesized code versioned in the repository). The contract pins the integrator (Section 2.1’s equations, stated in the spec text, constants generated from the environment instance so they cannot drift); the full arm includes the wall clause, the incomplete arm omits it. Crucially, each seed logs whether the wall fired in its training sample — the identifiability event that the companion paper could not condition on post hoc. One design fact governs every pooled count in this paper. The gate sample of seed index i is drawn with rollout seed 104(i+1)10^4(i+1) independently of which model is being run (scripts/continuous_danger_synthesis.py), so at every instrument and knob the mini and large arms are synthesized from the same samples. Pooling the two sizes therefore doubles the number of synthesis draws, not the number of independent gate samples: a pooled k/2nk/2n is n shared samples with two model draws each. Two consequences we hold to throughout. (i) Any empirical check of the gate-miss rate (1−r)N(1-r)^N is a per-size statement — the mode-absent/present split is a property of the sample, so it is identical across sizes by construction and cannot be pooled at all. (i) For the conditional outcomes (blind-and-exploited, repaired), pooling across sizes is meaningful because the synthesis draw is independent, but a Wilson interval over the pooled count assumes independence the samples do not have; we therefore quote the per-size bound as the conservative one and mark pooled bounds as such wherever they appear. On the two headline cells the shared-sample constraint is removed, not caveated. A --seed-offset run shifts the sample block (rollout_seed=104(i+1+offset)rollout\_seed=10^4(i+1+offset)), so re-running the large arm at offset 20 gives it a block disjoint from mini’s. The headline cart cell and the headline pendulum knob therefore have three arms: mini on block S0S_0, large on S0S_0 (same samples, different model) and large on S20S_20 (different samples, same model) — two orthogonal replications instead of one. Pooling mini@S0S_0 with large@S20S_20 is then a pool of independent samples, and the Wilson interval over it is legitimate. Every bound below labelled “disjoint” is of that kind; the per-size bound is still reported for the cells where only shared blocks exist (the pendulum caught knob, PatchField2D, the ablations). Full arm (both sizes, 40 seeds): gate 1.000 in 0 refinement iterations, wall probes exact, play at truth parity — every seed. The pinned-integrator premise holds with a real LLM: correct synthesis is float-exact through the sandbox, so ε=10−9 =10^-9 costs nothing and the tolerance axis is fully disarmed. As in the discrete setting, given the rule, the model translates it perfectly. Incomplete arm. Three-way structure: 1. Wall absent from the sample (the (1−r)N(1-r)^N event; 10/20 seeds at xwall=8x_wall=8 for each size, consistent with (1−0.0114)40≈0.63(1-0.0114)^40≈ 0.63): every such seed — 20/20 across mini and large — passed the gate at 1.000, fully wall-blind on the probes, and was exploited at play: pinned at the wall, contact rate 1.0, play_cost 0.999. Because --seed-offset 20 supplied the large arm with a sample block disjoint from mini’s, the two together are /20/20 over 2020 distinct gate-sample blocks — a bound at the right unit rather than over draws that share evidence: exact (Clopper–Pearson) 95%95\% lower bound 0.8320.832, Wilson 0.8390.839. The two arms differ in both block and model size, so the interval covers the mixture rate rather than either arm’s; per arm it is 10/1010/10 blocks, exact lower bound 0.6920.692. The third arm (large on S0S_0, the same 10 samples mini saw) reproduces the conditional model-for-model, 10/1010/10. The gate-miss rate is now poolable too: 20/4020/40 of the independent samples lacked the mode against the predicted 0.60460.6046 (Wilson [0.35,0.65][0.35,0.65]). This is the discrete headline, synthesized end-to-end in a continuous CWM: a verified model, exact outside the mode region, that performs worse than random. 2. Wall present, repaired: the LLM does not stay blind. It reads the failing transitions and writes the true global rule — if x2 >= 8.0: return [8.0, 0.0] (or the equivalent if x2 > 8.0: x2 = 8.0) — not a curve fit. At 20 seeds both sizes repaired every wall-present seed: large 10/10 in 0–1 iterations (two from the synthesis examples alone), mini 10/10 in 0–5 iterations. This is the divergence from the discrete setting, where rules demonstrated by example transitions were persistently not learned (translation-not-inference). A numerically-manifested discontinuity is learnable from data in a way a symbolic game rule was not. 3. Wall present, not repaired: at 20 seeds on the headline cell GPT-5.x produced no stalls, but stalls are real where they occur (the 5-seed xwall=4x_wall=4 cell; the Qwen cross-family arm below). They are not near-misses of the rule but superstitious local patches: e.g. if abs(x2 - 4.0) <= 0.15 and abs(v2) <= 2.5: x2 = 4.0; v2 = 0.0 (verbatim from the xwall=4x_wall=4 cell, mini seed 20000, gate 0.9740.974), or Qwen’s if x2 >= 8.0 and v2 <= 0.0: ... — clamps fitted to the observed manifestation of the mode (low-speed, near-wall contacts), which mispredict other approaches to the wall. The gate rejected every one of them (gate 0.490.49–0.9990.999, never 1.000). Two other model families. Spot-checks in two further families (Qwen via an open-router deployment, and Claude relayed through an agent scaffold with byte-identical pipeline messages; 3 seeds plus a control per instrument, so small-n) separate the two halves of the result cleanly. The mode-absent blind-and-exploited event fires in every family, as Proposition 5 requires of a property of the sample. Repair-from-data instead differs in mechanism: GPT-5.x recovers almost every revealed clamp exactly, Qwen recovers none and the gate refuses its superstitious patches, and Claude recovers most through a symmetry prior that generalizes one-sided evidence into a symmetric pair of boundaries — which produces a fourth artifact class the trichotomy does not cover: an artifact accepted at gate 1.0001.000 while carrying an invented mode its own sample cannot refute. That is Proposition 5’s prior caveat measured directly, and it is why the paper’s off-sample regularity is stated as measured rather than proved. Section K gives the arms, the artifact and the relay caveats. Second-instrument robustness (pendulum-with-stop, Section 4.1, 20 seeds/cell, both sizes). The synthesis arm is not cart-only. Running the identical pipeline on the nonlinear pendulum — headline θstop=1.4 _stop=1.4 (rarity 0.019) and caught θstop=1.0 _stop=1.0 (rarity 0.128; “caught” labels a cell whose mode is common enough that the gate sample essentially always contains it, so the identifiability event essentially never fires) — reproduces every branch, including a 3-seed Qwen cross-family spot-check at the headline knob (Table 5). cell (20 seeds each) full absent → blind & exploited present → repaired (stalled) mini θstop=1.4 _stop=1.4 20/20 9→99→ 9 (pc 0.995) 11→1111→ 11 (0) large θstop=1.4 _stop=1.4 20/20 9→99→ 9 (pc 0.995) 11→1111→ 11 (0) mini θstop=1.0 _stop=1.0 20/20 0→0→ — 20→2020→ 20 (0) large θstop=1.0 _stop=1.0 20/20 0→0→ — 20→2020→ 20 (0) Qwen θstop=1.4 _stop=1.4 (3 seeds) 3/3 1→11→ 1 (pc 0.995) 2→02→ 0 (2 stalled @0.9997) Table 5: Pendulum synthesis cells (20 seeds/cell, both GPT-5.x sizes; 3-seed Qwen spot-check at θstop=1.4 _stop=1.4). k→mk→ m = of the k seeds in that branch, m had the stated outcome (blind & exploited, resp. repaired); the parenthetical count is stalled seeds; pc = play_cost. Pooled across both knobs and both sizes (Table 5), every mode-absent occurrence was blind and exploited at play_cost 0.995 (headline knob, disjoint blocks: 15/1515/15 distinct blocks, exact 95%95\% lower bound 0.7820.782, Wilson 0.7960.796; the same-sample pair mini/large@S0S_0 adds 9/99/9 draws each, which are not extra blocks) — the same fixed-point exploitation as the cart’s play_cost ≈1≈ 1 — and GPT-5.x passed the repair criterion on 62/62 mode-present seeds, with no stalls, writing the exact angular clamp (verbatim at the headline knob: if th2 >= 1.4: return [1.4, 0.0]) in 58 of them; the other four write that clamp and a phantom stop on the negative side, which the mode probe cannot see (Section 7.1) — counting those four as non-repairs, as Section 7.1 does, 3030 of 3434 distinct blocks are repaired on every attempt, exact 95%95\% interval [0.725,0.967][0.725,0.967]; the per-size, per-knob cells are 11/11 and 20/20 draws by the probe criterion. Qwen reproduces the mode-absent blind-exploited event but stalls on both its mode-present seeds, the same superstitious-patch signature as on the cart; Claude’s agent-relayed spot-check on this instrument produced the phantom-mode artifact discussed in Section 7 (an accepted artifact carrying a stop at θ=−1.4θ=-1.4 its sample never reaches, plus a stall at the other mode-present seed). Repair is model-dependent; identifiability, being a property of the sample, is not — on this instrument too. The mechanism was already validated on two instruments (Section 4.1); the synthesis result now is as well: a nonlinear plant with an angular, not positional, hard stop reproduces the same danger law and the same repair capability, so the repair finding is not a cart artifact. 7.1 Repair does not transfer to a 2D region mode: 0/156 across the treatments run Everything above — and the (b)-residual-vanishes claim of the Introduction — was measured on one-dimensional hard boundaries: a position clamp (cart) and an angular clamp (pendulum), on which GPT-5.x recovered the rule in 105 of 111 mode-revealing synthesis draws. Two aspects of the criterion govern how that count may be read, and both tighten it. First, the criterion. The paper’s repair test is a gate pass plus a mode_blindness probe score of 00, and that probe fires only where the truth’s mode is active — so it cannot see an artifact that invents a mode elsewhere. Re-testing every artifact the probe calls repaired against the truth on a dense state–action grid (scripts/repair_exactness_1d.py) finds four that are not exact: all four write the correct angular clamp and a second, phantom stop on the negative side — one at the symmetric −1.4-1.4, three at −2.0-2.0, which is where the left reward plateau sits. Two are gpt-5.4-mini and two are gpt-5.4, so the invented-mode class the paper attributes to the Claude arm is not family-specific; it appears in the main arms of both GPT-5.x sizes, at a rate of 44 of 109109. Those four are counted as non-repairs here. Second, the unit. The draws are not independent trials: the gate sample’s random stream depends on the seed index and offset alone — not on the instrument, the knob, the patch shape or the prompt variant — so those 111111 draws sit over 3636 distinct gate-sample blocks (2222 on the cart, 3434 on the pendulum, some shared), and varying a knob adds a treatment rather than a sample (scripts/sample_stream_census.py, scripts/paper2_statistics.py). The primary inference unit is the instrument–stream block — one stream pushed through one instrument’s dynamics is one sample, and two instruments sharing a stream are dependent only through common random numbers — and at that unit every attempt is exact on 5050 of 5656 blocks, exact 95%95\% interval [0.781,0.960][0.781,0.960]. Clustered all the way down to the raw stream, the strictest possible unit, 3030 of 3636 blocks are repaired on every attempt, an exact 95%95\% interval of [0.672,0.936][0.672,0.936]. Resolved the other way, by knob, the census is 6464 of 7070 knob-level block cells — a block sampled at two knobs contributes two cells, so those are treatment cells, not additional samples. The cart is unaffected by the first correction: all 3333 of its repairs are exact on the grid, as its mode is a half-line with no far side to over-cover. Per instrument, the corrected criterion leaves the two alike in rate and different in kind: the pendulum is 30/3430/34 blocks all-repair (exact 95%95\% interval [0.725,0.967][0.725,0.967]; its four exceptions are the four phantom-stop blocks — over-coverage the probe accepted), while the cart is 20/2220/22 — both its exceptions are superstitious local patches the gate rejected, and one of them is the only mode-present draw its block ever produced — giving an exact lower bound of 0.7080.708 for all-repair, or 0.7720.772 for the weaker estimand “some attempt on a fresh sample repairs”. Both cart exceptions live in the 5-seed xwall=4x_wall=4 cell. PatchField2D asks whether that repair survives a genuinely 2D mode — a circular boundary (x′−cx)2+(y′−cy)2≤R2(x -c_x)^2+(y -c_y)^2≤ R^2 — and whether an artifact can repair one patch while staying blind to the other (partial repair, which the design predicted and per-mode blindness makes measurable). We ran the identical pipeline (Azure GPT-5.x mini and large, 20 seeds/cell, N=40N=40, ε=10−9 =10^-9) on two bi-knob cells, k=(3,7)k=(3,7) and k=(5,9)k=(5,9), classifying each seed by which modes its training sample contained miss both, see one miss the other, see both. The full arm is clean (20/20 per cell, both sizes). The instrument was built to detect partial repair; none occurred in its 66 draws. Across the 66 see-one-miss-the-other seeds (64 see-P1P_1-miss-P2P_2 plus 2 miss-P1P_1-see-P2P_2; a complete census of this branch over 2020 raw seed blocks, not a sampled estimate), zero produced a partial-repair certificate — not one artifact repaired the seen patch and stayed blind to the unseen one while passing the gate. More strongly, of the 76 incomplete-arm seeds whose sample contained at least one mode, 0/76 recovered the circular disc rule at all. What the artifacts do instead. A code inspection of all 7676 artifacts, confirmed by an independent behavioural audit that probes each step() on a state grid, locates the failure: plant translation succeeds in ≈74/76≈74/76, and what collapses is induction of the region. The dominant class is dimensional reduction — the disc written as a half-plane at the right location and the wrong shape (38/7638/76 by source, 39/7639/76 by behaviour) — with pure-blind, superstitious local patch and failed-disc classes making up the rest, and no artifact encoding its seen patch even where one was seen. The ε -exactness alternative is falsified: no correct-form disc failed on arithmetic. Two ablations then exclude two candidate mechanisms. A guided treatment at 3×3× budget removes the half-plane entirely and yields bounded 2D regions instead — ellipses, rectangles, unions of micro-discs — fitted to the hull of the observed freeze positions and, in 36/4036/40 artifacts, conditioned on the current rather than the landing position; none is the true disc. An axis-aligned square with flat edges is not repaired either, and fails with the errors reflected: discs written on square evidence. A third family reproduces the same template set. Section L gives the full audit, the three ablations and the per-iteration ledger. In these campaigns certification was all-or-nothing: no partial artifact was accepted. Certification occurred iff the sample missed all modes: the only certified incomplete artifacts were the 4/80 miss-both seeds (2 per size at k=(5,9)k=(5,9)), blind on both patches and exploited at play_cost 1.0951.095, contact rate 1.01.0 — the doubly-blind fixed point, at the joint-miss event of probability (1−r∪)N(1-r_∪)^N (Section 4.2: measured for the pair, not factored). Every see-one-miss-the-other artifact was rejected, not certified: the all-or-nothing gate refused every partial artifact rather than certifying a half-repair. The gate was therefore sample-consistent throughout, in the only sense it can be: no accepted artifact contradicted a transition of the sample it was scored on. That is the acceptance criterion restated, not a guarantee about the artifact. Two cautions on reading the failing gates: a high near-miss score (e.g. 0.99970.9997) reflects the rarity of a mode contact in a short rollout, not a near-repair, so more refinement iterations would not populate a partial-repair branch that does not exist; and the mini/large partitions are seed-identical by construction (shared seeds — the design fact of Section 7, which holds at every instrument, not only here), so the two sizes are not independent replications. What the collapse is about, after eight ablations. On the 1D clamps the discrete paper’s (b)-residual all but vanished for GPT-5.x; on the 2D regions it returns in every treatment we ran. Six candidate causes are measured negatives: it is not boundary curvature (the axis-aligned square with flat edges fails identically, with the errors reflected — discs written on square evidence), not the tested prompting and budget (one region-first prompt at 3×3× budget fails, in a different class — other prompts, longer contexts, refinement with memory or an explicit fitting tool remain untried), not identification of the variable the trigger reads, not the censoring of the region’s interior itself — the mechanism Proposition 7 makes the natural candidate — which two further campaigns lift without restoring repair, and not — the one prediction in the 2D program written down before its test — the angular coverage of the contacts, raised until a three-line least-squares fit recovers the region on every sample while the synthesizer still recovers it on none (all in Section 9). A seventh candidate, the trigger’s arity in the sense of Definition 1, is the one the instrument cannot rule on: the slab built to lower it has a target identified only up to Proposition 7’s class, so that intervention excludes nothing and is recorded rather than counted. What the campaigns establish about the evidence is a separate and narrower thing. Proposition 7 shows that the mode’s freeze semantics keep every visited state outside the region, so a sample witnesses only entries; whether that pins the rule then depends on whether a rollout can reach the region’s far side, which is measurable in advance and differs across these instruments. On the disc it can, so the rule is identified there — relative to the circle class and tolerance of Proposition 6, in the block counts measured in Section 9 — and the failure is a genuine one of induction: what the artifacts write instead is drawn from a small library of low-complexity forms — a 1D threshold, a radial ball, a reward-landmark zone, the hull or the bounding box of the observed contacts — and the gate refuses each in turn. That library is the template prior, and after eight interventions and two positive controls it is the description that survives: each intervention removes a candidate cause and the failure stays. What interventions on the instrument cannot do is single out a mechanism inside the model — an inability to carry out an algebraic fit over textually presented transitions, a memoryless refinement loop, and the absence of any system-identification objective in the prompt are all compatible with every campaign here, and we do not claim to distinguish among them. Removing curvature, budget, arity, variable ambiguity and the interior’s censoring each leaves the failure in place — the last while supplying eleven times more mode evidence and, separately, an easier rule — and the controls locate what is missing exactly: given the region’s form and its location the synthesizer infers the remaining constant to float precision in 2020 of 2020 seeds, while a plain least-squares circle fit recovers both constants from the same evidence on 1212 of 2020 samples and the synthesizer given only the form recovers none (Section 9). Raising the evidence’s angular coverage until the fit succeeds on all 2020 leaves the synthesizer at none of 2020, which is what makes the prior a disposition rather than a weight. What is not induced is a located rule: the form alone does not rescue the failure, the form and its location together do. Two readings this does not support. It is not that the synthesizer cannot represent a region: told the rule, it writes the disc, the square, the slab and the boundary projection at gate 1.0001.000 in zero refinement iterations, in every arm and both sizes. And it is not simply that more evidence would suffice — the interior-witnessing campaigns supply more and it does not help — though on an instrument whose far side is unreachable no sample at any size distinguishes the truth from an entry rule, and there the larger model reliably writes the latter (Section 9). What does not change across any of this is the provable core: identifiability and the gate-miss law hold verbatim, no accepted artifact contradicted its acceptance sample, and the joint-miss event remains where the law’s exact factor lives; the estimand DND_N itself also collects whatever every other accepted artifact costs — the invented-stop class of Section 7 included — which the per-campaign accepted-cost means report rather than the law absorbing. 8 An independent acceptance sample Every arm above scores the artifact on the sample it was synthesized and refined against. That is the protocol the companion paper used and the one deployed pipelines use, and it is a sample-consistency gate: passing it means agreeing with the data the artifact has already seen. Proposition 4 says what changes when the acceptance sample is drawn independently, under two hypotheses. Both are testable on the artifacts we already have, because every synthesized program is versioned with its cell: for each of the 1034 committed artifacts we reproduce its training block DtrD_tr, draw two further blocks disjoint from it and from each other — an acceptance sample DgD_g of the same size (Ng=40N_g=40 rollouts) and an evaluation sample DevalD_eval of 100100 — and re-score the artifact on both without any refinement (scripts/heldout_gate_audit.py, scripts/heldout_gate_paper_numbers.py). Refine on DtrD_tr, accept on DgD_g, classify on DevalD_eval is the prospective protocol; evaluating it after the fact costs no LLM calls and changes nothing about its validity. Two validity checks come first: the three blocks are verified disjoint at the level of individual rollout seeds, and re-scoring an artifact on its reproduced training block returns the accuracy the original run stored in 102102 of 102102 spot-checks, which is what establishes that the reconstruction is the original sample. Both hypotheses hold where they were tested, so the exponents add there. Hypothesis (i) — a mode-blind artifact fails the acceptance sample exactly when that sample contains a mode contact — is nearly structural for a program with an omitted branch, and it is exact in the data: over the 6060 mode-blind artifacts synthesized from a mode-free training block, held-out acceptance and a mode-free acceptance sample coincide in every case (2525 accepted with the mode absent from DgD_g, 3535 rejected with it present, no off-diagonal cell). Hypothesis (i) — a mode-free training block yields a mode-blind artifact — is the genuine empirical premise, and on the cart’s headline cell it holds for 3030 of 3030 draws. That check is cell-local, and extending it across the audited arms strengthens it: every one of the 6060 incomplete-arm draws whose training block misses the mode is probe-blind, so (i) has no known violation among the 10341034 API-arm artifacts, and the nearest counterexample to a global reading is the agent-relayed Claude artifact — which carried an invented mode, and sits outside these arms. The four GPT phantom stops of Section 7 are not violations of (i): their training blocks contain the true mode (one contact transition each), and what they bound is a different claim — the reach of evaluation-sample exactness — taken up below. With both in place the proposition’s prediction is a statement about the sample alone, so its unit is the distinct block: at r=0.0114r=0.0114 the two-factor prediction is (1−r)80=0.399(1-r)^80=0.399 against a measured 10/40=0.25010/40=0.250 over the 4040 distinct blocks, 95%95\% interval [0.142,0.402][0.142,0.402]; the one-factor rate the earlier sections check is (1−r)40=0.631(1-r)^40=0.631 against 20/40=0.50020/40=0.500, interval [0.352,0.648][0.352,0.648]. Both predictions sit inside their intervals. Note the scope of what the second exponent buys: it halves the probability of the law’s central event — a blind artifact from a mode-free training block surviving to deployment — and at fixed total budget Ntr+NgN_tr+N_g that one exponent is unchanged. It is a statement about that exponent alone (Proposition 4): it does not price synthesis quality, total risk, or compute under a redistributed budget. The sample-consistency gate accepts artifacts an independent gate rejects. Of the 650 draws that reached 1.0001.000 on their own sample, 40 are rejected by an independent acceptance sample of the same size — 6.2%6.2\% of draws, spanning 2525 distinct rollout-seed blocks. We report these as counts and attach no binomial interval: the draws share rollout-seed blocks across campaigns and treatments, so they are not independent trials from any population such an interval would describe. All 4040 are incomplete-arm artifacts, the full arm regressing on none of its own; 33 draws move the other way — below 1.0001.000 in-sample (at 0.99750.9975 to 0.99910.9991) yet accepted by the independent sample — which is why 650−40650-40 leaves 613613 accepted rather than 610610. The failures are located where the law says they must be: 3939 of the 4040 fail only on mode contacts and are off-mode exact, and the one exception is one of the four phantom-stop artifacts of Section 7, rejected exactly where its invented stop fires (1111 off-mode failing transitions on DgD_g). So a 1.0001.000 score on the training sample is worth what Proposition 5 says it is worth and no more, and the quantity it overstates is measurable: about one accepted draw in sixteen here. What acceptance does buy, measured rather than inspected. The paper’s off-sample regularity is a measurement, not a code-inspected observation: of the 613 draws an independent gate accepts, all 613 are exact outside the mode region on the further independent 100100-rollout evaluation sample — every failing transition of DevalD_eval, where there is one, is a mode contact. Two scope limits belong beside the number. The draws share seed blocks, so no binomial bound is attached to 613/613613/613; and exactness on DevalD_eval is exactness under the evaluation distribution, not a global property of the artifact — an accepted artifact carrying an invented mode in a region that distribution rarely visits would pass this check, and the pendulum’s phantom stops (Section 7) are exactly that shape. This is the sense in which “verified but wrong” is precise here: acceptance establishes exactness away from the mode on samples it never saw, drawn from the same distribution, and says nothing about the mode or about regions those samples rarely reach. The limit an independent gate does not remove. One limit belongs beside the result, and it is not a matter of sample size. Proposition 7 exhibits a class of models that agree with the truth on every transition of every rollout — the mode’s freeze semantics remove the evidence that would separate a membership rule from an entry rule — and a synthesized artifact in that class is accepted here at ε=10−9 =10^-9 by its own sample, by an independent acceptance sample and by a 100100-rollout evaluation sample alike (Section 9). An independent gate makes acceptance mean what it says about the sampled inputs; it does not make it mean more than that. What saves this particular class is not the gate but Proposition 7(i): its members are wrong only strictly inside a region no planner rolling them forward can reach, so the play cost is zero by the same argument that makes them unfalsifiable. Two further scope notes. The re-scoring covers the 10341034 API-arm artifacts; the agent-relayed Claude cells are not in it, so Claude’s phantom-mode artifact is not among the 613613. The 613613 do, however, contain known-wrong members of the same class, and they make the evaluation-exactness limit concrete. Of the four GPT phantom-stop artifacts (Section 7) — true mode repaired, an invented second stop where their samples are silent — three are accepted by the independent gate and score 1.0001.000 on DevalD_eval, because no evaluation rollout happens to enter the invented stop’s region, while the behavioural audit’s state–action grid shows all four wrong there (131131 to 280280 mismatched grid points each); the fourth drew gate and evaluation samples that do visit the region and is rejected (1313 off-mode failures on DevalD_eval). Chance decided which one of the four was caught. That is Proposition 5 operating on the checks themselves: acceptance and evaluation read the artifact only at sampled inputs, so what convicts the other three is the grid, not any rollout. And an independent gate is not a solution to the problem this paper is about: it makes acceptance mean what it says, but the mode still has to appear in some sample, and Proposition 4’s exponent Ntr+NgN_tr+N_g is the same N the danger law always had. 9 What the 2D collapse is about: eight interventions, two controls, and a target that is sometimes not identifiable Section 7.1 reported that no artifact recovered the 2D region rule and that the artifacts are consistent with a low-complexity template prior, a mechanism that design does not isolate. Two further campaigns hold most of the confound fixed and vary one thing each. Both were run after the finding they respond to (Section Q); the first answers a different question from the one it was built to pose, and is reported against the question it does answer. Whether the evidence identifies the rule — relative to a stated class and tolerance — is a property of the instrument, computable in advance. Proposition 7 says a sample witnesses only entries into the mode. Whether that suffices to pin the rule depends on one further question: can a rollout reach the region’s far side? Measured over 20002000 rollouts per instrument (scripts/mode_identifiability.py), the answer separates the instruments the paper compares. On the disc the mover goes around the patch — the patches are bounded in y — and reaches x=14.11x=14.11, with 46954695 visited states east of the near patch’s far edge; the square likewise (37573757). So on those instruments the gate distribution reaches the region’s far side — a population fact, and no more. Three claims must be kept apart. Population support: the distribution constrains the region from more than one side, which is what the 20002000-rollout measurement establishes; it says nothing about a particular finite sample. Recovery by a specified estimator: the three-line least-squares circle fit lands within 0.10.1 of both constants on 12/2012/20 baseline samples and 20/2020/20 at the dose’s 185∘185 coverage. This is an existence result, not uniqueness. Finite-sample identification relative to a specified class: Proposition 6’s version-space certificate proves that every consistent circle lies within the same tolerance on 6/206/20 baseline samples and 18/2018/20 widest-dose samples. It excludes half-planes in 20/2020/20 at both doses and boxes in 19/2019/20 and 20/2020/20, but the hull of the observed contacts remains consistent in every block; therefore the finite evidence does not identify a unique arbitrary region or the entire artifact template library. The induction failure can be charged against estimator-level recoverability in all 2020 widest-dose blocks, and against universal circle-class identification in 1818 of them; both statements are reported because they answer different questions. A slab, being unbounded in y, is the instrument that separates the two integers Remark 1 keeps apart, and it cannot be circumvented: the furthest position reached is x=5.00x=5.00, exactly its near face, and no state east of it is ever visited. Its rule is therefore identified only up to Proposition 7’s equivalence class, and “recover the true rule” is not a well-posed target there. Eight interventions, and what each shows did not suffice. Each is aimed at one candidate explanation; none is single-variable in the strict sense — the guided treatment also changes the example count and the budget, the post-state variants also change dwell time and the amount of mode evidence, the dose also changes the start distribution and the rollout count (held to the same contact count by calibration) — and the changes each induces beyond its target are stated with its campaign (Section M; the full per-intervention matrix — target hypothesis, co-changes, prediction status, unit, control, licensed and unlicensed inference — is versioned in results/h6_exclusion_matrix_v1.json). All were run after the finding they respond to (Section Q), and none restores repair. Table 6 is the ledger; Section M gives each campaign, its admissibility check and its artifacts. # what it targets repaired what did not suffice, as tested 1 region-first guidance, 3×3× budget 0/40 prompting and budget 2 axis-aligned square, flat edges 0/40 boundary curvature 3 a second model family (Claude) 0/3 one family’s idiosyncrasy 4 trigger arity: a band in one coordinate 0/40 nothing — target unidentifiable 5 the trigger’s argument named 0/40 variable identification 6 the mover stops inside the region 0/40 the interior’s censoring 7 the mover clamped to the boundary 0/40 the same, at matched evidence 8 angular coverage of the contacts 0/40 the coverage of the evidence Table 6: The eight ablations on the 2D mode. “repaired” counts mode-containing synthesis draws recovering the region rule, by the criterion of Section M (a gate pass, a mode probe at 00, and exact agreement with the truth on a state–action grid, since the probe alone accepts a rule that over-covers the region). Ablation 4 excludes nothing because its target is not identifiable — the measurement above — which is recorded rather than reported as a 0/400/40 like the others. Ablations 6 and 7 carry complementary confounds: 6 supplies 11×11× more mode evidence, 7 matches the baseline’s evidence and pays in the rule’s complexity, so the negative survives both. Ablation 8 holds the contact count fixed and raises only their angular coverage, to the point where a three-line least-squares fit recovers the region on 20 of 20 samples; it is the only one of the eight whose direction was written down before the run. Two positive controls bracket the frontier: the constants follow from form and location; nothing follows from the form alone. Every result above is a negative, and a negative is worth what the guarantee that its target is learnable is worth. Two controls supply that guarantee, one from inside the pipeline and one from outside. Inside: replace the incomplete arm’s missing clause with a partial one that states the rule’s form and its effect while withholding constants (--mode-hint; the withheld constants appear nowhere in the text, asserted rather than assumed). Two levels, 2020 seeds each on gpt-5.4, and they separate completely. • Given the form and the centres, with only the radius withheld — one unknown scalar — the synthesizer infers it exactly in 2020 of 2020 seeds. Every artifact agrees with the truth at IoU=1.000IoU=1.000 and on all 90209020 points of the state–action grid, and all 2020 are accepted by an independent gate and an independent 100100-rollout evaluation at ε=10−9 =10^-9; one writes the comment “radius inferred from the provided transitions”. Four of the twenty need no refinement iteration at all. • Given the form alone, with the centres and the radius withheld, it recovers 00 of 2020, best agreement 0.1320.132, and 1616 of the 2020 write a region small enough to be a point on the probe grid — the memorisation class again. Outside: a plain algebraic least-squares circle fit on exactly the evidence the synthesizer was handed (scripts/region_fit_baseline.py). The contact landings are derivable from the sample by anyone who read the contract — a contact is recognisable from the transition alone, and the landing follows from the contract’s own integrator — and they cover a median 111∘111 of the circle, partial coverage rather than a thin crescent. Even so the fit recovers both constants to within a tenth of the radius on 12 of the 2020 samples, and the centre alone on 1313, with no prior and no language model. Together these place the failure precisely. It is not the evidence: on twelve of these samples three lines of linear algebra recover the region, and the synthesizer given the form recovers none of them. It is not an inability to fit constants: given the centres it fits the radius to float precision, every time. It is not representational: told the rule outright, every arm writes it at gate 1.0001.000 in zero iterations. What the synthesizer does not do is perform the fit — it substitutes a template and, when the template is refused, memorises the contacts. That is the region-template prior, stated as sharply as this instrument can state it: a located rule is what is not induced: the form alone does not rescue the failure, and once the form and its location are given the constants follow exactly. On the eight samples where the trivial fit also fails, the negative is not attributable to the synthesizer, and we do not attribute it. Within the reachable range (111∘111 –185∘185 ), the prior does not yield to coverage — and the direction was recorded before the run. The controls above leave one mechanism question open. It is the only treatment in the 2D program whose two possible answers were both written down before its test — which is weaker than pre-registration, since the question itself arose from the results it responds to, and Section Q classifies it that way (B21): if the obstruction is a prior over forms, enough evidence should overcome it; if more evidence changes nothing, it is a limit rather than a prior. The instrument can pose the question because the start distribution is a knob. Starting episodes on a ring around the near patch instead of in the box widens the angular coverage of the contacts — the arc they actually span, 360∘360 less the largest angular gap — while the rollout count is lowered to hold the number of contacts at the baseline’s median of 14.5, so the dose is coverage and not quantity (scripts/calibrate_evidence_dose.py; the trap survives, play-cost 0.8701 and blind contact rate 0.92). Coverage saturates near 185∘, so the achievable range is 111∘ to 185∘, and the trivial fit traces it: it recovers both constants on 12 of 20 samples at the baseline’s 111∘, 16 of 20 at 129∘, and 20 of 20 at 185∘. Thus every widest-dose sample supports recovery by that specified estimator; the stronger universal circle-class certificate holds in 18/2018/20 (Proposition 6). The synthesizer recovers none. Given the form and asked only for its location and size it recovers 0 of 20 (best agreement 0.191); given no clause at all it recovers 0 of 20 (best 0.220), while the translation arm on the same wider sample still writes the rule at gate 1.0001.000 in zero iterations, 2020 of 2020. The narrower ring at 129∘ is the machinery control and behaves like the baseline (0 of 20), so the null at 185∘ is not an artifact of starting on a ring. Two consequences, one for each direction of the comparison. The estimator-level attribution becomes clean: the earlier control had to set aside the 8 samples on which the trivial fit also fails, and at 185∘ there are none to set aside — on every sample in the dose arm the region is recoverable by the declared fit and the synthesizer does not recover it. At the stronger universal level the same contrast holds on 1818 blocks, with the two remaining blocks explicitly classified as underdetermined at tolerance rather than charged to synthesis. And the mechanism is bounded from the other side: within the range this instrument can reach, the failure does not respond to the dose at all, so “prior” should be read as a fixed disposition and not as a weight that more evidence overcomes. What lies beyond 185∘ this instrument cannot say: full coverage of the circle requires visiting the region’s far side from every bearing, and the freeze semantics forbid it (Proposition 7). The two campaigns bound what an independent acceptance sample buys, and the bound is the evidence’s identifiability. On the disc, every incomplete-arm artifact that reaches gate 1.0001.000 on its own sample is rejected by an independent acceptance sample: 8 of 8 draws over 6 distinct rollout-seed blocks, at held-out accuracies 0.99440.9944 to 0.99970.9997. (Four are in the guided landing-prompt arm at k=(3,7)k=(3,7) and two in each size at k=(5,9)k=(5,9); the two sizes share their blocks, which is why the block count is 66 and not 88. The default disc arm reaches 1.0001.000 on none, so there is nothing there for a second sample to catch.) On the slab, nineteen reach gate 1.0001.000 and an independent sample rejects 0 of 19. Nor is the independent gate merely strict: on the positive control of Section 9, where the form and the centres are given and the artifacts are exactly right, it accepts 20 of 20 at 1.0001.000. That is not a difference in how carefully the two gates were run; it is Proposition 7 and the identifiability measurement above. Where the target is identified — in the class-relative, finite-sample sense of Proposition 6 — in-sample acceptance can be over-fitting and a held-out sample catches it; where the target is identified only up to the proposition’s equivalence class, in-sample acceptance is the correct inference and there is nothing for a held-out sample to catch. An independent gate is exactly as effective as the evidence’s identifiability permits, and no more — which is the honest scope of Section 8. Two consequences. The ablation cannot be read as an answer about arity, because its target is unidentifiable; we say so rather than reporting 0/400/40 as if it were the disc’s 0/1560/156. And the paper’s repair criterion is not sufficient: a probe that fires only where the truth’s mode is active cannot see a rule that over-covers it. Re-testing every 1D artifact the probe calls repaired against the truth on a dense grid (scripts/repair_exactness_1d.py) finds four more of that kind, which is why Section 7.1 reports 105105 of 111111: the four probe-passing phantom-stop artifacts are counted as non-repairs. 10 Localization is representational: smooth learners and a mode-capable baseline on the same samples “Representational” is the narrowest of the four statements Remark 3 keeps apart, and it is the only one this section tests. If localization is representational in that sense, two things must be checkable on non-code learners trained on the same data (scripts/continuous_smooth_probe.py; the two most favorable smooth learners: closed-form linear least squares — off the wall, the dynamics are exactly linear, so this is the smooth best case — and a small tanh MLP, probe-grade): model trained on off-mode err mean / max probe err gate 10−910^-9 gate 10−210^-2 linear-LSQ wall-free 3.6e−153.6e-15 / 1.7e−141.7e-14 4.18 PASS PASS linear-LSQ wall-data 1.9e−031.9e-03 / 1.2e−021.2e-02 4.17 fail fail MLP h=8 wall-free 3.5e−033.5e-03 / 5.0e−025.0e-02 4.20 fail fail MLP h=8 wall-data 6.0e−036.0e-03 / 4.9e−024.9e-02 4.19 fail fail Table 7: Smooth learners on the synthesis samples (xwall=8x_wall=8). “probe err” is the wall-region probe error (4.2 ≈ predicting straight through the wall). Figure 5: Off-mode max error (log) by model and training data. The wall-free linear fit sits at float noise and passes both gates (blind); four contact rows tilt it twelve orders of magnitude; synthesized code is exactly zero off-mode. Identifiability is learner-independent, live. On the wall-free sample the linear model recovers the off-mode dynamics to 10−1510^-15, passes the ε=10−9 =10^-9 gate, and is exactly as wall-blind as the synthesized blind code (probe error 4.18: it predicts straight through the wall). Proposition 5 instantiated on a second hypothesis class. The proposition’s exact content is that on the miss event no sample-measurable score separates a mode-blind model from the true one, so acceptance carries no information about the mode — not that every accepted model is blind, which is false and which this paper’s own data refute: Claude’s pendulum artifact was accepted while carrying an invented mode, its prior having supplied off-sample content that happens to be wrong in the other direction. Blindness is what a prior-free learner gets; the identifiability event is what makes any of it possible. The (1−r)N(1-r)^N hole is not an LLM property. A mode-capable learned class closes the exactness gap where the evidence identifies the mode — measured, not conceded. The two learners above cannot contain the mode; the natural objection is a learner whose hypothesis class does. We test the most favourable such baseline: the instrument’s own off-mode integrator and reward with only the event function learned from the same training samples — a hard threshold on the cart, up to two separated circular event regions fitted by algebraic least squares on PatchField2D (scripts/mode_capable_baseline_h5.py, results/mode_capable_baseline_h5.json; the training seed block is the unit, 2020 blocks per arm). On the cart it behaves exactly like the code arm: from the wall-containing sample (44 contact transitions) it recovers the threshold exactly (x^wall=8.0 x_wall=8.0), is float-exact on all 32003200 held-out transitions, passes the ε=10−9 =10^-9 gate with zero bad transitions, and plays at truth parity (play_cost 0.00.0); three contacts already suffice, zero contacts never do; and from the wall-free sample it passes the same gate mode-blind — Proposition 5 on a third hypothesis class. On PatchField2D, given the two-circle form, it recovers the near patch within 0.10.1 of both constants on 1212 of 2020 baseline blocks and both patches on 00 of 2020 (11 of 2020 at the widest angular coverage) — what it lacks is far-patch evidence, not representation. Three conclusions therefore separate cleanly: expressibility and float-level exactness are properties of any class containing the mode, code or not; induction from finite evidence succeeds for the numeric estimator exactly where the identifiability measurements of Section 9 say the evidence permits it; and the LLM synthesizer, handed the same form, recovers the located rule on none of its 2020 samples (Section 9) — the gap between the estimator’s 12/2012/20 and the synthesizer’s 0/200/20 is the induction failure isolated from representation. With the mode in the data, code and smooth part ways. Four contact rows out of 3200 tilt the linear fit by twelve orders of magnitude off-mode (1.7e−14→1.2e−021.7e-14→ 1.2e-02 max; Figure 5) — it fails both gates and still has the mode wrong (probe 4.17). The smooth hypothesis cannot put the error on the mode; it leaks everywhere (Proposition 9’s geometry, with Corollary 2 pricing the volume the leak must occupy, observed here as a least-squares tradeoff). The synthesized code, on the same sample, wrote the exact clamp and passed at float precision. The MLP combines both axes: a pervasive ∼5e−3 5e-3 floor that no gate accepts, and a never-learned mode. Consequence for the CWM paradigm: the paradigm creates in continuous control the localized failure class that the learned-model literature says does not dominate there — and, by the same representational fact, creates an exact-repair capability that no uniformly Lipschitz class can match (Corollary 2). That capability is not exclusive to code: a learned event function whose class contains the mode matches code’s float-exactness on the 1D clamp, measured above. What code supplies without being told is the class itself — any computable rule, no pre-specified event family — and the 2D campaigns show that this universality does not, by itself, deliver the induction of a located rule. Code cuts both ways, and the gate’s sampling coverage decides which way. 11 Related work Counterexample-guided inductive synthesis: the same loop, a different oracle. CEGIS (Solar-Lezama et al. 2006; Solar-Lezama 2008) alternates a learner, which proposes a candidate consistent with the counterexamples seen so far, and a verifier, which either certifies the candidate against a specification or returns a new counterexample. The guarantee is inherited entirely from the verifier: one that is complete relative to a specification either proves the candidate on the whole input domain or produces a witness. SyGuS standardized the format (Alur et al. 2013); the oracle-guided theory (Jha et al. 2010; Jha and Seshia 2017) makes what is synthesizable a function of which oracles are available, with programming by example (Gulwani 2011; Gulwani et al. 2017) as the bottom case, where generalization beyond the examples comes from a ranking function or a domain bias and not from a guarantee. Our synthesize–gate–refine pipeline is a CEGIS loop — LLM as learner, the gate’s failing transitions as counterexamples, a refinement iteration as a CEGIS iteration — with one load-bearing substitution: the counterexample oracle is random sampling of transitions, not a verifier. A verifier’s “no counterexample” means there is none; a sampling gate’s means none was drawn in N draws, an event of probability exactly (1−r)N(1-r)^N for a rule of rarity r (Proposition 1), on which the loop is programming by example and the learner’s prior decides everything off-sample. That weaker oracles buy weaker conclusions is not news to this literature and we do not re-derive it: it is the content of Jha and Seshia 2017, and the work that ran CEGIS against physical dynamics, where no complete verifier exists, substituted simulation and then recovered soundness by other means — a bounded verifier, or an SMT check on the final candidate (Kapinski et al. 2014; Ravanbakhsh and Sankaranarayanan 2019) — or kept the verifier complete by pushing it into a theory solver (Abate et al. 2018). We add a closed-form law for how incomplete a sampling oracle is on a localized-rule failure, a proof that the miss event is unlearnable from the sample by any learner (Proposition 5), and a measurement of what a planner does with the accepted artifact. In the CEGIS sense our gate certifies one thing only — the absence of counterexamples in a sample — which is to say, nothing universal. Statistical model checking. SMC replaces exhaustive verification with simulation plus a statistical test and states what a sample size buys: acceptance sampling with Type-I/Type-I bounds (Younes and Simmons 2002), Chernoff–Hoeffding complexity for an (ϵ,δ)(ε,δ) estimate of a property’s probability (Hérault et al. 2004), the black-box case (Sen et al. 2004), and the standing difficulty that a rare property needs sample size scaling like the inverse of its probability (Legay et al. 2010). Our gate is an SMC procedure for “the model matches the plant to tolerance ε ” run without error bounds; we improve on none of that sample-complexity machinery, and Hérault et al. 2004 is what would size a gate at a target confidence. SMC bounds the probability of a wrong verdict on a fixed property, whereas we bound the probability that the sample never exhibits the phenomenon at all — the verdict on the property actually tested is correct and uninformative — and where SMC stops at the verdict we push it through a planner, whose loss is adversarially selected rather than proportional to the residual (Proposition 8). Automata learning and active queries. Passive data does not hand you the machine — minimum-state automaton identification from given data is NP-hard (Gold 1978) — whereas L∗ learns a regular language in polynomial time from membership queries plus an equivalence oracle (Angluin 1987), which is what supplies a counterexample a random sample may never contain (Vaandrager 2017; Settles 2012). Proposition 5 is the continuous, hybrid-mode instance of that gap, and Angluin’s decomposition reads our gate in one line: membership queries drawn at random, no equivalence oracle, which is why more refinement iterations cannot complete the loop. We inherit no query-complexity result — their target is finite and exactly identifiable under exact queries, ours a program over a continuous space with tolerance ε and a stochastic query distribution — which is why we prove a probability law instead. Falsification and counterexample-guided refinement. Falsification searches for inputs driving a hybrid or cyber-physical system to violate a specification (Annpureddy et al. 2011; Corso et al. 2021; Yamagata et al. 2021); CEGAR refines an abstraction at the spurious counterexample (Clarke et al. 2000; Clarke et al. 2003; Alur et al. 2006); counterexample-guided data augmentation feeds falsified inputs back as training data (Dreossi et al. 2018; Dreossi et al. 2019). The message is uniform, and we do not improve on it: directed search finds the rare violating input random sampling misses. Our gate is the passive dual — uniform random testing whose blind spot is precisely the mode a falsifier would hunt for, with (1−r)N(1-r)^N quantifying the gap — and the contrast with Dreossi et al. 2018 is our thesis in one sentence: there the counterexample that fixes the model comes from a falsifier, here from the gate’s own random draw, and on the miss event there is none. CEGAR is also the template for our distrust-region mitigation, differing in the bookkeeping: it refines an abstraction over-approximate by construction, so refinement preserves the guarantee, whereas the fence refines a trust set around an artifact with no such property — hence a measured collapse of the exploitation and, at the farthest two-dimensional knob, 77 of 2020 episodes pinned at blind-level return (Section F.1). Property-based testing with adaptive generators. The gate is random testing of a program against an oracle and (1−r)N(1-r)^N is the standard rare-input coverage gap (Claessen and Hughes 2000; Rubinstein and Kroese 2017), but uniform generation is not where that field stopped: generators can be steered by search toward inputs maximizing a utility (Löscher and Sagonas 2017; Löscher and Sagonas 2018), derived from the property so constrained inputs arise by construction (Lampropoulos et al. 2017), or guided by coverage feedback (Padhye et al. 2019). Ours sits at the uniform, non-adaptive end of that spectrum, and each of the three has an instantiation here that we do not implement: a generator targeting distance travelled toward a mode boundary, one derived from the contract so mode-entering transitions occur by construction, and coverage-guided rollout mutation whose signal is which branches of the synthesized program executed — available because the model is code. What we add is not a generator but that the planner is the adversary which finds the untested branch at deployment. Experiment design and active system identification. What is recoverable is a property of the input signal and not only of the estimator: optimal input design (Mehra 1974), identification-for-control and the revival of experiment design (Gevers 2005), identifiability under a given excitation (Ljung 1999), and the learning-theoretic result that actively chosen inputs achieve sample complexities passive excitation cannot (Wagenmaker and Jamieson 2020). This literature implies our prescription and we re-derive none of it: our gate is a passive, non-adaptive experiment, and Proposition 5 is its identifiability statement specialized to a hybrid mode and a code hypothesis class. There the design reduces parameter variance in a fixed parametric family and the failure is graded; ours is discrete — a rule is present or absent in the program — and its consequence is read through a planner rather than an estimation-error norm. The active boundary probing we list as follow-up work (Section 12) is an experiment-design problem and we name it as one. Identification of hybrid and piecewise-affine systems. Recovering a piecewise-affine or hybrid system is a joint classification-and-regression problem — the partition of the state-input space as well as the affine law in each region — and it is classical: clustering (Ferrari-Trecate et al. 2003), mixed-integer programming (Roll et al. 2004), bounded-error set membership (Bemporad et al. 2005), algebraic geometry (Vidal et al. 2003), the tutorial and mixed logical dynamical formulations (Paoletti et al. 2007; Bemporad and Morari 1999), and trace-mining of hybrid automata (Medhat et al. 2015; García Soto et al. 2021). We contribute no identification algorithm; our question is what a sampling verifier certifies when the mode is missed, and what a planner then does — the case these methods assume away, since none forms a region containing no samples. One is already active: García Soto et al. 2019 synthesizes linear hybrid automata from membership queries, the closest existing form of the fix we prescribe. Proposition 9 and Corollary 2 are also a statement about this literature’s hypothesis classes — an exactly localized disagreement is unavailable to a bounded-Lipschitz class at any volume — which is why we take code rather than piecewise-affine with a fixed mode count. Contact-rich and discontinuous dynamics. Contact is the physical archetype of our instruments and this literature’s finding runs in the same direction: smooth end-to-end learning is the wrong parameterization and a complementarity-structured implicit loss does far better (Pfrommer et al. 2021), stiff contact makes the loss landscape pathological for deep learners as a fundamental matter (Parmar et al. 2021), and even standard analytic planar contact models are limited on real data (Fazeli et al. 2020; Fazeli et al. 2017). Parmar et al. 2021 is the empirical shadow of Proposition 9 and Pfrommer et al. 2021 takes structurally our remedy — put the discontinuity in the hypothesis class — neither of which we improve upon. The difference is what fails: there contact is present in the data and the failures are accuracy failures; here the mode is absent and the artifact is certified. Our repair-from-data result is the code analogue — given contact transitions in the sample the synthesizer recovered the exact switching rule on the one-dimensional clamps, whereas the two smooth fits we ran spread the error instead (Table 7) — and, like this literature, we stop short of contact-rich manipulation. Hypothesis classes that can represent modes. Classes that can express mode structure are mature: mixtures of experts with a learned gate (Jacobs et al. 1991), recurrent switching linear dynamical systems whose discrete state depends on the continuous one (Linderman et al. 2017), neural ODEs with learned event functions (Chen et al. 2021), and neural hybrid automata that infer the number of modes and their transitions (Poli et al. 2021). This family scopes our representational claim rather than being scoped by it: Proposition 9 quantifies over Lipschitz pairs, and a hard gate or a learned event function reintroduces exactly the unbounded local structure it requires, so it is not an argument that neural models cannot represent hybrid modes — our MLP is a probe at h=8h=8 scale, not a baseline (Section 12), and Section 10 measures a favourable learned event-function baseline from this family directly. What survives is class-relative on the representation side and learner-independent on the identifiability side: no architecture here can infer a mode from a sample that never enters it (Proposition 5), and float-level exactness — zero off-mode error at ε=10−9 =10^-9 (Table 7) — is a property of any class containing the mode: the measured event-function baseline attains it on the 1D clamp exactly as code does, while the smooth fits cannot (Section 10). Conformal and PAC guarantees for learned dynamics. Conformal prediction gives any predictor distribution-free finite-sample coverage under exchangeability (Vovk et al. 2022) and has been carried to dynamics and control: prediction regions over trajectories, planned against (Lindemann et al. 2023); learned monitors that reject unreliable violation predictions (Bortolussi et al. 2019); PAC-Bayes bounds for policies across environments (Majumdar et al. 2021). We derive no better certificate, and the comparison sharpens our result rather than softening it: their coverage holds with respect to the calibration distribution, which here is the gate distribution, and the planner is not exchangeable with it — the region our certificate covers carries 1.9%1.9\% of the exploited planner’s queries, and a region containing every step-t level set carries 7.8%7.8\% (Section 12). Calibrating conformally on gate rollouts would attach to the same wrong artifact a marginal guarantee that is honest over the calibration distribution and silent about the planner’s queries; a planner could treat the conformal sets as uncertainty and react to their width, but sets calibrated where the mode never fires carry no widening at the mode, so the failure is not an artifact of choosing a metric certificate. Conversely ours is a sup-norm statement with an explicit ε+2Lρ +2Lρ constant (Propositions 14 and 15), which conformal prediction does not give, and it needs a finite Lipschitz constant, which conformal prediction does not — where ours is weakest, the mode’s local constant being unbounded. Runtime assurance, safety filters, and robust MPC. Every guarantee in this family is anchored to something known a priori: a verified conservative baseline plus a switching rule (Seto et al. 1998; Sha 2001), a shield synthesized from a safety automaton (Alshiekh et al. 2018), recursive feasibility across iterations of a learned controller (Rosolia and Borrelli 2018; Hewing et al. 2020), a minimally invasive projection keeping a known backup viable (Wabersich and Zeilinger 2021), or a bounded model-error description (Rawlings et al. 2017). Our failure is invisible to every anchor derived from the learned model or its training distribution: the error is unbounded but confined to a region the gate accepted as error-free, so a robustness margin tuned to the off-mode residual does not see it and a safety filter built on the same accepted model inherits the blind spot. An anchor specified independently of the model — a verified conservative baseline, a shield synthesized from a safety automaton — does not inherit it; it simply pays its conservatism whether or not a mode was omitted. The distrust-region fence has the shape of a safety filter with the anchor moved — assembled from deployment-time refutations rather than an a-priori safe set, correcting a certified-but-wrong model rather than an unsafe policy — which is why we report it as a mitigation with measured behaviour, its two-dimensional failure included (Section F.1), and not as a certificate. Decision-aware model learning and objective mismatch. Prediction loss is the wrong objective for a model that will be planned with, and this literature has formalized the right one: losses weighting error by its effect on the Bellman update (Farahmand et al. 2017; Farahmand 2018), the value equivalence principle — models are equivalent if they induce the same Bellman updates over a set of functions and policies (Grimm et al. 2020) — an existence proof at scale for training purely for planning utility (Schrittwieser et al. 2020), and the finding that prediction accuracy and control performance diverge while planners exploit model error (Lambert et al. 2020; Janner et al. 2019; Hafner et al. 2020). Our headline is a value-equivalence statement: the gate tests prediction equivalence on the gate distribution, and we exhibit an artifact prediction-equivalent to within 10−910^-9 everywhere the gate looked that is value-anti-equivalent, capturing essentially none of the attainable return at the knobs swept. Their constructive programme is to train for value equivalence, which needs a value function or a policy at training time; here the model is written before the planner runs, so our prescription is a change of test distribution, not of loss — and their results concern approximation quality within a parametric class, whereas our failure is an all-or-nothing missing rule that no reweighting of a loss recovers from a sample that never touched it. Our contribution to that conversation is the verified-but-wrong localized regime, which a bounded-Lipschitz model can represent only at the volume price of Corollary 2 and which neither learner we fit represents at all (Table 7), plus a closed-form acceptance-failure law confirmed at gate scale. Code world models. Code World Models (Lehrach et al. 2026) and code-as-policy (Liang et al. 2023; Gao et al. 2023) supply the paradigm, and the companion paper (Aguilar Martín 2026) is the discrete study this paper extends: we transfer its provable core, show that its empirical residual (translation, not inference) does not transfer on the one-dimensional clamps, and add the localization budget separating code from bounded-Lipschitz hypotheses. 12 Limitations Three instruments; repair is geometry-scoped, mitigation fails outright on a 2D boundary at distance. Cart-with-wall, pendulum-with-stop, and PatchField2D span 1D and 4D state and one and two modes. The mechanism survived every extension — it is measure-theoretic — and so did the gate’s strict sample consistency (the all-or-nothing 2D gate accepted no partially-right artifact). The residue is sharper and different. Repair-from-data collapses on 2D region boundaries, curved or flat: GPT-5.x recovered the rule in 105 of 111 revealed 1D clamps (four more passed the mode probe while carrying an invented second stop) but recovered the 2D region rule in 0/156 mode-containing attempts over 20 distinct gate samples pooled over the disc, the square ablation, and the guided/3×3×-budget treatment (Section 7.1). The prompting/budget and curvature outs are now measured negatives; what could restore repair — two-sided (inside) evidence, active boundary probing, or richer evidence summaries — is the subject of ongoing follow-up work. The 2D mitigation likewise generalizes but only partially, and its failure mode at the farthest knob is not a longer transient but lock-in: 77 of 2020 episodes end pinned at blind-level return, because the fence’s tie-break is an unsigned distance and a curved boundary lets the planner be pinned against it (Section F.1). A signed outward normal is the obvious fix and is untested. Contact-rich manipulation, moving boundaries, and 3+3+ modes remain future work. Two planner families, one fixed configuration each. Random-shooting MPC sits at the high-query-reach/high-play-cost end and CEM at the low-query-reach/near-zero-play-cost end (Section E); only the latter is implied by Proposition 8, since the bound forces low play cost from low reach but does not force the converse. This is stronger than a one-family result but not planner-universal: CEM was measured at one prototype-fixed setting, with no hyperparameter sweep, and its pendulum truth returns expose local optima. Its non-exploitation is reach-limited, not knowledgeable or safe — the same search that misses phantom reward can miss real distant reward. Gradient-based shooting and tree search (Coulom 2006; Kocsis and Szepesvári 2006) remain untested. Distrust-region replanning (Section 6) is a mitigation layered on MPC, not a third family; its hard-boundary guarantee and its behavior with other planners remain untested. Synthesis cells are modest, and the two sizes share their samples. The gate sample is drawn from the seed index alone, so mini and large are synthesized from identical samples at every instrument and knob (Section 7): every pooled “both sizes” count is n distinct gate samples with two synthesis draws each, and the distinct-sample n is half the pooled one — 10 mode-absent samples on the cart headline cell, 31 knob-resolved mode-present samples across the two pendulum knobs for the shared-block pools (34 distinct pendulum blocks once the --seed-offset arm is included), 38 mode-containing on the PatchField2D disc cells, 20 on each ablation campaign. Per-size Wilson bounds are quoted for exactly this reason wherever only shared blocks exist. On the two headline cells the constraint was removed instead: the large arm was re-run on a disjoint seed block (--seed-offset 20), so there the counts are over independent blocks and the bounds are legitimate at that unit (exact lower bounds 0.8320.832 cart, 0.7820.782 pendulum), and even the (1−r)N(1-r)^N gate-miss check becomes poolable (20/4020/40 independent cart samples lacked the mode against a predicted 0.630.63). With that accounting: 20 seeds/cell on the headline xwall=8x_wall=8 cart cell for both GPT-5.x sizes, plus a 3-seed Qwen cross-family spot-check; the pendulum arm adds two knobs (headline and caught) at the same 20 seeds/cell, both sizes, plus its own 3-seed Qwen spot-check. The wall/mode-absent conditional is 20/20 across cart sizes and three runs and 18/18 across pendulum sizes: per size that is 10/10 (Wilson lower bound 0.72) and 9/9 (0.70), the bounds we rely on, against pooled 0.84 and 0.824 whose trials share samples. The GPT-5.x repair rate is 20/20 on the cart headline cell and 62/62 pooled on the pendulum (31 distinct shared-block samples) by the probe criterion, of which 58 are exact on a dense grid and four carry an invented second stop. The cross-family arms are small-n (3 seeds plus one control per instrument per family) and cover two alternate families (Qwen, and Claude agent-relayed), not a sweep of models — and their coverage is uneven across instruments: both families were run on the two 1D instruments, and on PatchField2D both families carry both arms — Claude’s agent-relayed, and Qwen’s as a backend-matched campaign (both arms on one pinned vLLM configuration, provenance versioned), with the incomplete cells refused 3/33/3 (Section M); they show repair is model-dependent in mechanism — Qwen 0/2 mode-present (superstitious patches), Claude repairing most but via a symmetry prior that oscillated on two seeds and had one phantom, unfalsifiable mode accepted. The PatchField2D synthesis arm adds two bi-knob cells (20 seeds each, both GPT-5.x sizes) plus two ablation campaigns (region-guidance 3×3× budget; axis-aligned square with flat edges — 20 seeds each, both sizes); its finding is a negative one — 0/76 repair of the circular mode, 0/66 partial repair, 0/156 pooled, plus 0/3 in a Claude cross-family arm on the same cell whose failure classes match (Section 7.1) — so repair-from-data is model-dependent and evidence-dependent; Section 9 isolates which, and Proposition 7 says when the target is not identifiable at all. The mode-blindness probe covers the true mode’s region and no other. By construction mode_blindness (src/cwm/continuous/contract.py) fires probes where the truth’s mode is active, so it establishes whether the revealed mode is encoded but is blind to a mode the model invents elsewhere: Claude’s phantom pendulum stop (Section 7) scored blindness 0.0 while carrying an extra, non-existent stop at θ=−1.4θ=-1.4. Detecting invented modes needs code inspection, or probes seeded outside the sampled region — the classification alone does not suffice, and our phantom-mode finding rests on reading the accepted code, as the companion paper’s artifact-level analysis does. The MLP is a probe, not a baseline; the mode-capable baseline is favourable by design. The MLP substantiates the representational point at h=8h=8/pure-Python scale; a tuned modern dynamics model would have a lower floor but the same structural inability to be bit-exact off a mode at ε=10−9 =10^-9 (an argument, not yet a measurement, at scale). The learned event-function baseline of Section 10 removes that objection where its class contains the mode, but it is deliberately favourable — the off-mode plant is pinned and known, only the event function is learned — so it bounds what representation explains, not what an end-to-end hybrid learner (mixture-of-experts, learned event functions at scale) would achieve; those remain untested. Proposition 9 bounds geometry, not probability. The ball is metric; converting to gate-visitation probability needs the gate measure on that ball, which is instrument-specific. The empirical complement (Table 7’s twelve-orders tilt) carries the quantitative weight here. The budget itself is unconditional at boundary points (Corollaries 2–3), but its exemption clause is scoped: “no finite local constant” is proved for the discontinuous reset modes studied — the velocity-zeroing wall and stop and the freezing patch — while a hybrid boundary that is continuous (a kink, a saturation) remains Lipschitz and inside the budget, so no claim is made that every hybrid boundary escapes it. The coverage certificate reaches only the smooth case. What transfers from the companion paper’s enumeration is a covering-number statement for Lipschitz pairs, and on the deployed cart gate it is informative: no pair with L≤5.77L≤ 5.77 can carry the wall’s error of 4.24.2 past the gate on the certified region. The residue is that this is exactly the case the paper is not about — a discontinuous reset mode has no finite local Lipschitz constant, so no L makes the certificate apply to it — and that the certified region carries 1.9%1.9\% of the exploited planner’s queries. Section N states the scope in full, including what closing the within-rollout dependence and the step-t density did and did not buy. The instruments are designed and deterministic; bounded observation noise is measured, process noise and external benchmarks are not. All three instruments were built around the law, so prevalence on externally specified dynamics is not established here. One robustness axis is now measured rather than assumed: under known coordinatewise Uniform[−η,η]Uniform[-η,η] observation noise, a support-compatibility gate preserves the acceptance law on a fixed 200200-block CartWall@4 panel through the pre-specified primary level η=0.1η=0.1 (blind-pass increase exactly 00) and first crosses the frozen +0.05+0.05 masking boundary at η=1η=1 (blind pass 32/20032/200 blocks, exact CP95 [0.1121,0.2183][0.1121,0.2183]; Section J, with the analysis pre-specified and hash-pinned). Process noise, an unknown noise law, planning under noise, and an externally authored contact or saturation benchmark with its own critical event remain open; the last is the decisive follow-up, and the analysis for it should be frozen before any outcome is inspected, as the noise analysis was. play_cost >1>1 is a normalization artifact (blind << random), reported unclamped and explained; the headline claims never depend on the excess over 1. 13 Conclusion The companion paper ended by diagnosing the gate failure as a reach-distribution shift and prescribing verification on the distribution the planner visits. This paper shows the diagnosis is not about discreteness. The gate-miss law, the identifiability argument, and the play-cost bound are measure-theoretic and survive the move to continuous state spaces intact; what the move changes is where the localized failure can live (discontinuous reset boundaries — an omitted mode is a rare rule) and who can express it (programs place it exactly, while any class with a finite Lipschitz bound pays the volume price of Corollary 2, now priced at boundary witnesses too via the interior-volume constant of Corollary 3 — Proposition 9 and Table 7; smooth compactly supported errors and continuous hybrid boundaries are not excluded, and a measured learned event function attains code’s float-exactness where its class contains the mode, Section 10). On two minimal hybrid instruments the entire discrete phenomenology reproduces — threshold law, knob-invariant exploitation, the reach mechanism — with the gate’s acceptance rate closely tracking (1−r)N(1-r)^N at gate scale (within sampling noise; Section 5). The synthesis experiment then delivers this paper’s own finding: on the 1D instruments the continuous regime is the one where the danger law is dominant — near-exhaustive for the shipment of mode-blind artifacts. Given the mode in its sample, the LLM repairs it exactly in 105105 of 111111 draws; every attempt is exact on 5050 of 5656 instrument–stream blocks (exact 95% interval [0.781,0.960][0.781,0.960]), and the treatment-resolved census is 64/7064/70 knob-level block cells — including from the synthesis examples alone. Of the six others, the gate caught two superstitious patches, and four artifacts repaired the true stop while adding an invented one their samples could not refute — a class their own acceptance samples could not catch — the independent gate caught one of the four, by the luck of its draw — and the behavioural grid convicts in full; given the mode absent, every learner tested (LLM, exact linear regression, a mode-capable event-function baseline) is accepted blind and the planner is exploited at a regret of essentially the whole attainable return — below the random baseline’s mean where measured, though on the 1D instruments that comparison rides the baseline’s heavy tail (Section 4). That repair, though, is geometry-dependent: on a third, 4D bi-modal instrument with 2D modes it inverts — neither GPT-5.x size recovers the region rule from data (0/156, including an axis-aligned square with flat edges and a guided 3×3×-budget treatment), two further model-family spot-checks at tiny n fail in the same classes, and eight interventions plus two positive controls place the obstruction in the induction of a located rule — not in curvature, the tested prompting and budget, variable ambiguity, the interior’s censoring, the evidence’s coverage (raised to where a three-line fit is exact on every sample), or an inability to fit constants, each shown insufficient by measurement, with the arity intervention recorded as unanswerable on this instrument rather than excluded (Section 9), and the exhaustiveness claim is scoped back to the 1D clamps, though the gate remains sample-consistent (Section 7.1). The provable core is the gate-miss and identifiability propositions (Section 3): the mode-absent event is a hole no learner can close from the sample — a prior or the specification could still supply the mode — and its probability is in closed form. Sample-covered exactness is the acceptance criterion itself; that accepted artifacts were also right off-sample — with the known phantom-mode exceptions — four pendulum artifacts of GPT-5.x and the Claude artifact, each wrong only where its own sample is silent — is an empirical regularity of the models tested (GPT-5.x repairs; Qwen stalls and is refused; Claude repairs most through a symmetry prior), not a theorem. For practitioners the message is one clause sharper than the discrete one: on the 1D clamps measured here, sample coverage of the mode boundaries is the whole game — on the 2D regions coverage was raised and did not suffice (Section 9), so the residual there is the located-rule induction gap — the synthesis stack will translate what it is told and repair what it is shown, and no stage of it can learn from the sample what the sample never touched (a prior or the specification still can, and Claude’s did). Supplementary Material The material below supports the main article and is not needed to read it. It contains the results the main text states in one sentence and cites: the ε -axis propositions, the derived play-cost normalizers, the coverage certificates and their statistical accounting, the detectability rate, the second planner family, the planner-side mitigation, the complete LLM protocol, the reproducibility manifest, and the pre-specification ledger. Appendix A The reveal-rarity’s ε -invariance, and the rate that replaces its threshold Proposition 10 (ε -invariance of a hard mode’s reveal-rarity). Fix a hard mode, a gate policy, and a model that agrees with the truth exactly off the mode — which the mode-blind model does by construction, the two sharing an integrator. For a rollout ω put D(ω)=max‖f(s,a)−f^(s,a)‖∞:(s,a) a mode contact of ω,D(ω)\;=\; \\,\|f(s,a)- f(s,a)\|_∞\;:\;(s,a) a mode contact of ω\,\, with D(ω)=0D(ω)=0 if ω never contacts the mode. Then the reveal-rarity at tolerance ε — the probability that a gate rollout contains a transition on which truth and model differ by more than ε — is exactly Pρ(D>ε)P_ρ(D> ), non-increasing in ε . Consequently, with ε∗=essinfD:D>0 = *ess\,inf\D:D>0\, reveal-rarity(ε)=Pρ(D>0)⏟mode-firing rarity rfor every ε<ε∗,reveal-rarity( )\;=\; P_ρ(D>0)_mode-firing rarity r every < , and pass@N=(1−r)Npass@N=(1-r)^N is exactly ε -invariant on that range. Proof. Off the mode the two models agree exactly, so any transition with ‖f−f^‖∞>ε\|f- f\|_∞> is a mode contact; a rollout therefore contains one iff its largest contact disagreement exceeds ε , i.e. iff D(ω)>εD(ω)> . The display is then the definition of the essential infimum, and pass@Npass@N follows from Proposition 1. ∎ Two readings of ε∗ must be kept apart. Against the empirical measure of one gate sample, ε∗ is the smallest positive D observed and the identity above is exactly what Table 8 reports — in-sample, and no more. Against the population measure, ε∗=0 =0 under Proposition 11’s approachability hypothesis — which on these instruments is an assumption the data are consistent with, not a theorem about them — so the display is empty there and the population content of the flatness is not a threshold at all but the quadratic rate proved next. Writing one symbol r for the two rarities is therefore licensed exactly in-sample, and in population to within Cε2C ^2. The threshold does not converge to a positive constant: the running minimum falls monotonically and does not settle — on wall@4, 0.4200.420 at 2525 firing rollouts, 0.1230.123 at 200200, 0.0410.041 at 32003200. The population threshold is zero, and what stands in its place is a rate, which holds at every ε rather than below an unstable cutoff. Proposition 11 (flatness at a rate for clamped semi-implicit plants; no population threshold). Consider any plant of the semi-implicit form ωt+1=ωt+(gain⋅at+F(θt,ωt))dt,θt+1=θt+ωt+1dt, _t+1= _t+ (gain· a_t+F( _t, _t) )dt, _t+1= _t+ _t+1\,dt, with F∈C1F∈ C^1 arbitrary, run over a horizon T under the gate policy (ata_t i.i.d. U(−amax,amax)U(-a_ ,a_ ), drawn independently of the state), and carrying a hard mode that clamps the integrated coordinate: if θt+1≥θstop _t+1≥ _stop the next state is (θstop,0)( _stop,0). Let the model be the same plant with the clamp removed, let D(ω)D(ω) be a rollout’s largest sup-norm disagreement over its mode contacts, and let rfire=P(D>0)r_fire=P(D>0) be the mode-firing rarity. Then for every ε>0 >0, 0≤rfire−reveal-rarity(ε)=P(0<D≤ε)≤Cε2,C=TM2gainamax,0\;≤\;r_fire-reveal -rarity( )\;=\;P(0<D≤ )\;≤\;C\, ^2, C= T\,M2\,gain\,a_ , where M=max(‖pθ0‖∞,(2gaindt2amax)−1)M= (\|p_ _0\|_∞,\ (2\,gain\,dt^2a_ )^-1 ) bounds the density of the clamped coordinate’s absolutely continuous part below the stop at every step (the law also carries an atom at the stop, which the proof handles separately). If moreover (T≥3T≥ 3) the mode is slowly approachable at the horizon’s end — there is a boundary state (θstop,ω⋆)( _stop,ω ) with two-sided margin |ω⋆+F(θstop,ω⋆)dt|<gaindtamax|ω +F( _stop,ω )\,dt|<gain\,dt\,a_ such that for every δ>0δ>0 there are an event HδH_δ of positive probability on the history through step T−3T-3 on which no clamp has yet fired, and a nonempty open action rectangle Uδ⊆(−amax,amax)2U_δ (-a_ ,a_ )^2, with steps T−2T-2 and T−1T-1 also clamp-free for histories in HδH_δ and (aT−3,aT−2)∈Uδ(a_T-3,a_T-2)∈ U_δ and (θT−1,ωT−1)( _T-1, _T-1) landing within δ of (θstop,ω⋆)( _stop,ω ) — then essinfD:D>0=0 *ess\,inf\D:D>0\=0, so no positive ε makes the two rarities equal: they agree only in the limit, at the quadratic rate above. Proof. At a contact the truth clamps the velocity to 00 while the model returns the pre-clamp post-action velocity ωt+1′ω _t+1, so D≥|ωt+1′|D≥|ω _t+1|; and the clamp fires only if θt+ωt+1′dt≥θstop _t+ω _t+1\,dt≥ _stop with θt<θstop _t< _stop, so ωt+1′≤εω _t+1≤ forces θt∈[θstop−εdt,θstop) _t∈[ _stop- \,dt,\, _stop). Hence 0<D≤ε⊆⋃t<T0<ωt+1′≤ε∩θt∈[θstop−εdt,θstop),\0<D≤ \\; \; _t<T\ \0<ω _t+1≤ \∩\ _t∈[ _stop- dt,\, _stop)\, and two facts independent of F bound each term. First, ata_t is drawn independently of (θt,ωt)( _t, _t) and enters ωt+1′=ωt+F(θt,ωt)dt+gaindtatω _t+1= _t+F( _t, _t)dt+gain\,dt\,a_t additively, so conditionally on (θt,ωt)( _t, _t) it is uniform on an interval of length 2gaindtamax2\,gain\,dt\,a_ and P(0<ωt+1′≤ε∣θt,ωt)≤ε/(2gaindtamax)P(0<ω _t+1≤ _t, _t)≤ /(2\,gain\,dt\,a_ ). Second, for t≥1t≥ 1 separate the two branches of step t itself. Write θtpre=θt−1+ωt−1dt+F(θt−1,ωt−1)dt2⏟free of at−1+gaindt2at−1θ^pre_t\;=\; _t-1+ _t-1dt+F( _t-1, _t-1)\,dt^2_free of a_t-1\;+\;gain\,dt^2\,a_t-1 for the unclamped landing — an expression valid whatever clamps fired at earlier steps, since those only change (θt−1,ωt−1)( _t-1, _t-1), a history-measurable quantity (a clamp resets it to (θstop,0)( _stop,0), still free of at−1a_t-1). The realized coordinate is θt=θtpre _t=θ^pre_t on θtpre<θstop\θ^pre_t< _stop\ and θt=θstop _t= _stop otherwise, so the conditional law of θt _t given the history through t−1t-1 is not uniform: it is a uniform density below the stop plus an atom at θstop _stop itself. The target strip [θstop−εdt,θstop)[ _stop- dt, _stop) excludes the atom, and on θt<θstop\ _t< _stop\ the two coordinates coincide, so P(θt∈[θstop−εdt,θstop))=P(θtpre∈[θstop−εdt,θstop))P( _t∈[ _stop- dt, _stop))=P(θ^pre_t∈[ _stop- dt, _stop)); and θtpreθ^pre_t, conditionally on that history, is uniform on an interval of width 2gaindt2amax2\,gain\,dt^2a_ (the fresh at−1a_t-1 enters affinely with slope gaindt2gain\,dt^2), with density at most (2gaindt2amax)−1(2\,gain\,dt^2a_ )^-1; at t=0t=0 the bound is ‖pθ0‖∞\|p_ _0\|_∞. Either way it is at most M, so P(θt∈[θstop−εdt,θstop))≤MεdtP( _t∈[ _stop- dt, _stop))≤ M \,dt. Multiplying the two and union-bounding over the T steps gives the display. The second fact is where the semi-implicit ordering is used: the action reaches the integrated coordinate within the same step, at order dt2dt^2. For the essential infimum, fix ε>0 >0. By continuity of F there are δ0>0 _0>0 and κ>0κ>0 such that every state within δ0 _0 of (θstop,ω⋆)( _stop,ω ) has m:=ω+F(θ,ω)dt∈(−gaindtamax+κ,gaindtamax−κ)m:=ω+F(θ,ω)\,dt∈(-gain\,dt\,a_ +κ,\ gain\,dt\,a_ -κ). Take δ<min(δ0,εdt/max(1,dt),κdt)δ< ( _0,\ \,dt/ (1,dt),\ κ\,dt) and the HδH_δ, UδU_δ the hypothesis supplies. On that event no clamp fires at any step before the final transition, so (θT−1,ωT−1)( _T-1, _T-1) is the unclamped two-step image of (aT−3,aT−2)(a_T-3,a_T-2) — and only on such an event may the family-wide two-action Jacobian identity (Section C), det∂(θT−1,ωT−1)/∂(aT−3,aT−2)=gain2dt3≠0 ∂( _T-1, _T-1)/∂(a_T-3,a_T-2)=gain^2dt^3≠ 0, be invoked at all, since a clamp at step T−1T-1 collapses the coordinate to the constant θstop _stop and a clamp at step T−2T-2 confines the pair to a one-parameter affine image, a Lebesgue-null set in the plane. The actions being uniform with positive density on UδU_δ, the pair has a conditional density bounded below on the open set W:=image∩Bδ(θstop,ω⋆)W:=image∩ B_δ( _stop,ω ), nonempty by the hypothesis; every (θ,ω)∈W(θ,ω)∈ W has θ∈(θstop−δ,θstop)θ∈( _stop-δ, _stop) — inside the strip, since δ≤εdtδ≤ \,dt — and carries the margin. So the event (θT−1,ωT−1)∈W∩no clamp before the final transition\( _T-1, _T-1)∈ W\∩\no clamp before the final transition\ has positive probability. Conditionally on it the final action is fresh, so ωT′=m+gaindtaT−1ω _T=m+gain\,dt\,a_T-1 is uniform on an interval containing (0,κ)(0,κ), and the final-step clamp fires with ωT′≤ε/max(1,dt)ω _T≤ / (1,dt) exactly when ωT′∈[(θstop−θT−1)/dt,ε/max(1,dt)]ω _T∈[( _stop- _T-1)/dt,\ / (1,dt)] — a subinterval of positive length, its lower end being below δ/dt≤min(ε/max(1,dt),κ)δ/dt≤ ( / (1,dt),\ κ). Because no clamp fired earlier, this final-transition contact is the rollout’s only contact; this is why the window sits at the horizon’s end, since D is a maximum over the rollout’s contacts and an earlier or later coarse contact would push it past ε . On the constructed event the contact’s sup-norm disagreement carries two components — the clamped velocity, ωT′ω _T, and the position excess θT−1+ωT′dt−θstop≤ωT′dt _T-1+ω _Tdt- _stop≤ω _T\,dt (positive part; θT−1<θstop _T-1< _stop) — so D=max(ωT′,θTpre−θstop)≤ωT′max(1,dt)≤εD= (ω _T,\ θ^pre_T- _stop)≤ω _T (1,dt)≤ , and D≥ωT′>0D≥ω _T>0; hence P(0<D≤ε)>0P(0<D≤ )>0 for every ε>0 >0. ∎ Two constraints multiply, which is the whole content: a contact revealed only faintly needs both a nearly-zero post-action velocity and a position already inside a strip of width εdt \,dt. The constant is the same object the coverage certificate uses: substituting M gives C=TdtcC=T\,dt\,c with c=(4amax2gain2dt3)−1c=(4a_ ^2gain^2dt^3)^-1 the universal step-t density constant of the same family, so one constant serves both the flatness rate and the certificate. On this paper’s instruments that is M≤16.67M≤ 16.67 and C=222C=222 for the cart and the pendulum (identical, since they share T, dtdt, gaingain and amaxa_ ; scripts/eps_flatness_rate.py derives both from the env objects). The bound is loose by orders of magnitude — a union bound over eighty steps times two worst-case densities — so the exponent is the content, and it is measured on both arms (60,000 rollouts each): 2.572.57 on wall@4 and 2.102.10 on stop@1.0, both at or above the proved 22, with the bound holding at every grid point. Because the proposition covers the nonlinear plant too, the pendulum’s 2.102.10 is a confirmation of a proved rate rather than the only evidence for it; what the near-equality adds is that the two-constraint mechanism is close to tight there, the union bound and the worst-case densities together costing only the gap between 2.102.10 and 22. The approachability hypothesis remains an assumption about the plant — no finite sample witnesses a for-every-ε statement. What the data supply is consistency: observed single-contact disagreements reach down to 0.00180.0018 over the 919919 contacts on wall@4, three orders below the gaindtamax=0.3gain\,dt\,a_ =0.3 margin the hypothesis needs, with nothing suggesting a positive floor. PatchField2D is outside the family, its action setting a force direction rather than entering additively. The rate also explains the threshold’s instability: the minimum of n draws from a law whose tail vanishes like εp ^p falls like n−1/pn^-1/p, so ε∗ cannot converge to a positive limit. Table 8 accordingly reports an in-sample identity, and the population statement is Proposition 11. Note what ε∗ is: a per-rollout minimum of a per-contact maximum. A pinned rollout contacts the mode many times, and it only has to contact it coarsely once to be revealed, which is why ε∗ sits two orders of magnitude above the smallest single-contact disagreement (0.00180.0018 over the 919919 contacts on wall@4; scripts/eps_invariance_threshold.py). Two constraints govern how the threshold may be used. First, ε∗ is a property of a sample, so comparing a threshold computed on one rollout stream against dips measured on another compares two random quantities rather than testing a prediction; on four arms it disagrees on two. Computed on the sweep’s own stream the relation is an identity: reveal-rarity equals firing-rarity at every grid ε below ε∗ , and the first grid point at or above it is where the sweep dips. Table 8 reports it that way, in-sample, and claims nothing beyond the identity. Second, a minimum is an unstable statistic — upward-biased for the population infimum and monotonically decreasing in n — so no conclusion may rest on the last digit or on a comparison against the grid’s edge. Measured across independent streams of the same size, ε∗ moves by a factor of 1.81.8 on wall@4 (0.1140.114, 0.1460.146, 0.2010.201) and 1.41.4 on wall@8 (0.3960.396, 0.4380.438, 0.5380.538, each from only 2121 to 2525 firing rollouts). And at ten times the sample it drops well below all of them: 0.0650.065 on wall@4 and 0.2720.272 on wall@8. That last figure matters, because 0.272<0.30.272<0.3: the claim that wall@8 is flat throughout the grid is a statement about the 20002000-rollout sample, not about the instrument, and at 20,00020,000 rollouts the grid’s top point would dip. We therefore state flatness as holding on the range each sample resolves, which is what the proposition licenses, and not as a property of the arm. mode arm ε∗ firing first grid ε≥ε∗ ≥ measured in the same sample cart wall@8 0.3959 25 none in grid flat through ε=0.3 =0.3 cart wall@4 0.1137 277 0.3 0.13850.1385 to ε=0.1 =0.1, 0.13550.1355 at 0.3 pendulum stop@1.0 0.0791 282 0.1 0.14100.1410 to 3×10−23×10^-2, 0.14000.1400 at 0.1, 0.12400.1240 at 0.3 pendulum stop@1.4 0.0805 35 0.1 0.01750.0175 to 3×10−23×10^-2, 0.01700.0170 at 0.1, 0.01550.0155 at 0.3 Table 8: The ε -invariance threshold, computed on the sweep’s own rollout stream (2000 rollouts/arm, gate policy only, --seed 10000 to match continuous_eps_sweep.py). Within one sample the relation is an identity, not a prediction: reveal-rarity is flat below ε∗ and the first grid point at or above it is where the sweep departs. The “firing” column is the number of rollouts the minimum is taken over — 2525 on wall@8 — which is why the threshold itself carries the sample-to-sample spread discussed above and must not be read to the last digit. Appendix B The play-cost normalizers, and why knob-invariance is arithmetic Proposition 12 (the normalizers, derived). Fix the cart instrument with xwall<xrightx_wall<x_right, and let xmin(t)x_ (t) be the position at step t of the trajectory that starts at x0=−x0rangex_0=-x_0^range and takes as=−amaxa_s=-a_ throughout. Then for every policy and every admissible x0x_0, J≤∑t=1T[aleft1+e(xmin(t)−xleft)/w+aright1+e(xright−xwall)/w]=:J¯,J≥Tminx∈[xmin(T),xwall]r(x)=:J¯, gatheredJ\;≤\; _t=1^T [ a_left1+e^(x_ (t)-x_left)/w\;+\; a_right1+e^(x_right-x_wall)/w ]\;=:\; J,\\[2.0pt] J\;≥\;T _x∈[x_ (T),\,x_wall]r(x)\;=:\; J, gathered and both sides are explicit numbers. Proof. Step 1: xt≤xwallx_t≤ x_wall. Immediate from the clamp. Step 2: xt≥xmin(t)x_t≥ x_ (t), clamp or no clamp. Absent clamping, xtx_t is affine in (a0,…,at−1)(a_0,…,a_t-1) with all coefficients positive — each action enters through gaindt2gain\,dt^2 times a positive sum of powers of 1−dragdt1-drag\,dt — so it is minimised over admissible action sequences and starting points exactly at as≡−amaxa_s≡-a_ from x0=−x0rangex_0=-x_0^range, which is xmin(t)x_ (t). The clamp needs a separate argument, because it lowers both coordinates (to xwallx_wall from a larger x, and to 00 from a positive v), so a clamped trajectory is not dominated by its unclamped counterpart. Two elementary facts. The velocity recursion vs+1=(1−dragdt)vs−gainamaxdtv_s+1=(1-drag\,dt)v_s-gain\,a_ dt under full left thrust does not involve x, so the all-left trajectory started at rest from any x0x_0 is x0−L(t)x_0-L(t) for one and the same L(t)=−dt∑s≤tvsL(t)=-dt _s≤ tv_s; in particular xmin(t)=−x0range−L(t)x_ (t)=-x_0^range-L(t). And L is increasing, since v0=0v_0=0 and vs≤0v_s≤ 0 implies vs+1≤−gainamaxdt<0v_s+1≤-gain\,a_ dt<0, the factor 1−dragdt1-drag\,dt lying in (0,1)(0,1). Now let the clamp last fire at time τ, leaving the state (xwall,0)(x_wall,0); after τ the dynamics are affine, so the minimisation above applies to the remaining t−τt-τ steps and xt≥xwall−L(t−τ)≥−x0range−L(t−τ)≥−x0range−L(t)=xmin(t),x_t\;≥\;x_wall-L(t-τ)\;≥\;-x_0^range-L(t-τ)\;≥\;-x_0^range-L(t)\;=\;x_ (t), the middle step by xwall≥−x0rangex_wall≥-x_0^range and the last by monotonicity of L. If the clamp never fires, the first sentence of this step already gives it. Step 3: from the envelope to the bounds. r is the sum of a term decreasing in x and a term increasing in x, so on any interval it is at most the decreasing term at the left endpoint plus the increasing term at the right endpoint. Applying this on [xmin(t),xwall][x_ (t),x_wall], which contains xtx_t by Steps 1 and 2, and summing over t gives J¯ J. The lower bound is immediate from r>0r>0 and xt∈[xmin(T),xwall]x_t∈[x_ (T),x_wall], using that xminx_ is decreasing. ∎ so the bound reads |play_cost|≲qhit(E)|play\_cost| q_hit(E) exactly when Jrand≈JminJ_rand≈ J_ and Jtruth≈JmaxJ_truth≈ J_ — the random policy near the reward floor, the truth planner near the ceiling. Both instruments are in this regime: on the cart Jrand=0.53J_rand=0.53 against a pinned Jblind≈0J_blind≈ 0 and Jtruth=17.77J_truth=17.77; on the pendulum Jrand=0.06J_rand=0.06 and Jtruth=20.08J_truth=20.08. The blind planner queries the wall region in every episode, so qhit(E)≈1q_hit(E)≈ 1 and the normalized bound is saturated — play_cost≈1play\_cost≈ 1, as observed in Sections 4–5. On the cart the bound is nearly but not exactly saturated, and it is worth being precise about the gap rather than calling it attainment. With the derived normalizers of Proposition 12 — Jmax≤18.0359J_ ≤ 18.0359 and Jmin≥1.33×10−6J_ ≥ 1.33× 10^-6 at xwall=8x_wall=8 — and qhit=1q_hit=1, the ceiling reads 18.0359/17.238=1.046318.0359/17.238=1.0463 against the play_cost measured at that knob, 1.02991.0299: the measurement sits at 98.4%98.4\% of a bound with nothing measured in it. Deriving the normalizers rather than estimating them costs almost nothing — the measured-supremum version of the same ceiling was 1.04451.0445, so the proof is 1.0017×1.0017× weaker — and it leaves no step in this display where an estimate stands in for a supremum. What is measured rather than implied is the informative part — the exploited planner reaches the realizable floor, Jblind≈JminJ_blind≈ J_ — and that is what pushes play_cost to the top of the range; the proposition supplies the ceiling, not the observation. The bound is not merely valid but essentially attained, because the optimal policy really is “push left and stay”: at xwall≤6x_wall≤ 6 the push-left trajectory realises J¯ J to within 2×10−72× 10^-7, so JmaxJ_ is known there rather than bounded, (scripts/play_cost_proved_bounds.py, which also searches bang-bang, constant, single-switch and 40004000 random block policies at each knob as a redundancy check on the derivation). The slack grows only as the wall approaches the right plateau and lets its tail in: 1.00001.0000 at xwall≤6x_wall≤ 6, 1.00151.0015 at 88, 1.07991.0799 at 1010. The floor J¯ J is attained near x=2.70x=2.70, where the left plateau’s tail has died and the right one has not begun; at xwall=2x_wall=2 it is 2.87×10−62.87× 10^-6, which is the measured JminJ_ to two digits. The same script asks how much of the pinning is derivable, since contact=1.00contact=1.00 at every knob is the other measured input. Two of its three ingredients are structural. The wall is reachable in a small fraction of the horizon — 1414 steps at xwall=2x_wall=2 rising to 3030 at 1010, against T=80T=80, and this is the earliest possible contact because xtx_t is maximised by full right thrust for the same monotonicity reason as above. And the blind model offers a return of 8.318.31 for going right against 5.705.70 for going left over the planner’s 4040-step horizon, a ratio of 1.461.46: the asymmetry that makes right the argmax is a property of the reward, not of the sampling. The third ingredient is not derivable: nothing forces the argmax over 200200 random block candidates to execute a positive first action, since a trajectory may go left before turning. That obstruction is real but it is about the wrong quantity. What the plan targets is a different question, and it admits a bound (scripts/phantom_targeting_probability.py). Fix a state s and let x¯=xright−2w x=x_right-2w. The same envelope argument as Proposition 12 — applied now under the blind model, over the planner’s horizon — bounds the imagined return of any candidate that never exceeds x¯ x by an explicit U(s)U(s), while the full-right-thrust candidate achieves an explicit L(s)L(s). Wherever L(s)>U(s)L(s)>U(s), any candidate scoring at least L(s)L(s) must exceed x¯ x, so if the sampled set holds one then the argmax’s trajectory reaches the phantom plateau: the planner is provably planning against reward the truth makes unreachable, which is the exploitation stated as a property of the plan rather than of the outcome. The gap closes at every state we checked, from +0.33+0.33 at (−12,0)(- 12,0) to +26.25+26.25 at (6,5)(6,5). What does not is the probability that the sampled set holds such a candidate, and the shape of that is the point. From rest it is negligible — 2×10−42× 10^-4 from an exactly computable sub-event (all four blocks above a threshold, where the score is monotone so the corner is the worst case), 5×10−35× 10^-3 estimated with a Wilson lower limit on the planner’s own sampling law. Once the cart carries rightward velocity it is 1.0001.000 by both routes, from (2,3)(2,3) onward. So the statement is conditional: phantom-targeting is self-reinforcing, not self-starting. How the lure begins, the executed first action’s sign, and hence contact=1.00contact=1.00 all stay measured. Proposition 13 (knob-invariance of play_cost is arithmetic, not a regularity). Let the rarity knob k range over values for which the truth planner’s realized return JtruthJ_truth and the random policy’s return JrandJ_rand are exactly independent of k (an idealization: the measured departure and its propagated effect are quantified after the proof). Then, directly from the definition of Section 2.2, play_cost(k)=JtruthJtruth−Jrand⏟knob-free−Jblind(k)Jtruth−Jrand,play\_cost(k)\;=\; J_truthJ_truth-J_rand_knob-free\;-\; J_blind(k)J_truth-J_rand, an affine function of the exploited planner’s own return with knob-independent coefficients, and hence constant up to maxkplay_cost(k)−minkplay_cost(k)=maxkJblind(k)−minkJblind(k)Jtruth−Jrand, _kplay\_cost(k)- _kplay\_cost(k)\;=\; _kJ_blind(k)- _kJ_blind(k)J_truth-J_rand, Proof. play_cost(k)=(Jtruth−Jblind(k))/(Jtruth−Jrand)play\_cost(k)=(J_truth-J_blind(k))/(J_truth-J_rand) by definition; splitting the numerator gives the first display, whose first term is knob-free by hypothesis, and the second display is the range of an affine function with a negative knob-free slope. ∎ So the entire knob-dependence is the exploited planner’s residual reward divided by the truth-minus-random margin, and a planner pinned with none gives play_cost exactly Jtruth/(Jtruth−Jrand)J_truth/(J_truth-J_rand). The two hypotheses are measured, and measured sharply: on the cart the truth planner’s return is knob-independent to twelve digits (Jtruth=17.757356407381J_truth=17.757356407381 at all seven knobs of the sharp variant, 17.77224698102417.772246981024 at all seven of the default), and JrandJ_rand varies across knobs by 3.9×10−93.9× 10^-9 on the sharp variant and 1.2×10−41.2× 10^-4 on the default — the random policy does occasionally enter the mode region, so its knob-independence is approximate rather than structural, and measurably less approximate once the plateau tail is removed. With those in hand the proposition is not decoration: it predicts every measured play_cost to 2.4×10−102.4× 10^-10 on the sharp variant, and that residue is itself accounted for rather than left over: ∂play_cost/∂Jrand=(Jtruth−Jblind)/(Jtruth−Jrand)2≈0.060∂\,play\_cost/∂ J_rand=(J_truth-J_blind)/(J_truth-J_rand)^2≈ 0.060, which against JrandJ_rand’s measured 3.9×10−93.9× 10^-9 knob-variation predicts 2.3×10−102.3× 10^-10 — the observed residue to one digit. On the default the same propagation of a 1.2×10−41.2× 10^-4 variation gives 7×10−67× 10^-6, matching the 7.3×10−67.3× 10^-6 observed there. So the “knob-invariant play_cost≈1play\_cost≈ 1” of Section 4 is an identity once the planner is pinned, and what the sharp-plateau variant buys is not invariance itself but the vanishing of JblindJ_blind that makes the identity’s residual term negligible. What remains empirical is the pinning (contact=1.00contact=1.00 and Jblind≈0J_blind≈ 0) and the truth planner’s indifference to the knob. The latter is not automatic — the clamp does change the imagined value of right-going candidates — so we do not leave it at bit-identity. A candidate’s imagined return under truth depends on the knob only if its imagined trajectory reaches the clamp, so it suffices to check, at every knob and every replanning step, that (C1) the argmax candidate’s imagined trajectory stays strictly below the smallest wall in the sweep, and (C2) every candidate that does reach the wall scores strictly below the argmax. C1 alone pins the argmax value but not the argmax candidate, and it is the candidate that determines the executed action, so the gap has to be closed explicitly. It is closed by the tie-break rather than by uniqueness: the planner keeps the first maximiser, the candidate enumeration depends only on (amax,rng,horizon,nsamples,block)(a_ ,rng,horizon,n_samples,block) and not on the knob, and C2 keeps every clamping candidate strictly below the top — so the first maximiser is the same knob-free candidate at every knob whether or not the top is attained twice. That distinction is not hypothetical: uniqueness fails in the sweep, because the reward saturates to 1.01.0 in floating point on the plateau and many candidates then score identically, so the script reports uniqueness as a diagnostic and the certificate rests on C1, C2 and the enumeration-order argument. The result is a machine-checked certificate over the planner’s own candidate set rather than an observation about outputs. scripts/truth_plan_invariance_certificate.py runs it over the harness’s own 2020 episodes per knob, the same scope as the runs the paper reports: the certificate holds at every knob of the sweep, with the argmax candidate never exceeding x=0.344x=0.344 and clamping candidates losing by a margin of 5.255.25 or more. Pushed past the sweep, the margin contracts monotonically — 4.124.12 at xwall=11x_wall=11, 0.510.51 at 1212 — and the certificate fails at 12.512.5, where the argmax candidate itself reaches the wall. So the regime has a derived boundary at xwall≈xright=12x_wall≈ x_right=12: the truth planner switches to the right plateau exactly once the wall stops blocking it, which is also where the mode stops being a trap and there is no danger left to measure. The sweep [2,10][2,10] sits inside the certified region with a wide margin. Appendix C What the gate does certify: coverage certificates for Lipschitz pairs What the gate does certify: the continuous coverage analogue. The companion paper’s coverage certificates enumerate finite information-set spaces, and continuous state spaces admit no such enumeration. A covering-number analogue is available in its place, built from the disagreement ball of Proposition 9 and the visitation density of Remark 4. Proposition 14 (coverage certificate for Lipschitz models). Let f,f^f, f be L-Lipschitz on U⊆S×AU S× A in the sup-metric, and suppose f f passes the gate at tolerance ε on every visited transition. If the visited set is a ρ-net of U, then supu∈U‖f(u)−f^(u)‖∞≤ε+2Lρ. _u∈ U\|f(u)- f(u)\|_∞\;≤\; +2Lρ. Moreover, if the gate’s per-step visitation density is at least c on U and M independent samples are drawn, then the visited set is a ρ-net with probability at least 1−δ1-δ as soon as M≥ln(Npack(U,ρ/2)/δ)c⋅infu∈Uvol(B(u,ρ/2)∩U),M\;≥\; \! (N_pack(U,ρ/2)/δ )c· _u∈ Uvol (B(u,ρ/2)∩ U ), where Npack(U,ρ/2)≤vol(U⊕Bρ/4)/vol(Bρ/4)N_pack(U,ρ/2) (U B_ρ/4)/vol(B_ρ/4). Proof. For the first part, take u∈Uu∈ U and let v be a visited point with ‖u−v‖∞≤ρ\|u-v\|_∞≤ρ; then ‖f(u)−f^(u)‖≤|f(v)−f^(v)‖+‖f(u)−f(v)‖+‖f^(u)−f^(v)|≤ε+2Lρ\|f(u)- f(u)\|≤\|f(v)- f(v)\|+\|f(u)-f(v)\|+\| f(u)- f(v)\|≤ +2Lρ. For the second, fix a maximal (ρ/2)(ρ/2)-packing of U; it is a (ρ/2)(ρ/2)-cover, its cardinality is bounded as stated (the disjoint (ρ/4)(ρ/4)-balls sit inside U⊕Bρ/4U B_ρ/4), and each packing point’s (ρ/2)(ρ/2)-ball has probability at least p=cvol(B(u,ρ/2)∩U)p=c\,vol(B(u,ρ/2)∩ U) — only the part inside U, since that is where the density is assumed. For the corner evaluation: a sup-ball of radius ρ/2ρ/2 around a corner of an axis-aligned box all of whose extents are at least ρ/2ρ/2 meets the box in exactly one orthant of the ball. (Shearing does not preserve that ratio, since the ball is defined by the sup-metric; the sheared case is computed numerically.) The chance that some such ball receives no sample is at most Npack(1−p)M≤Npacke−pMN_pack(1-p)^M≤ N_packe^-pM, which is ≤δ≤δ under the displayed condition; when every ball is hit, each u∈Uu∈ U lies within ρ/2ρ/2 of a packing point that holds a visited sample, hence within ρ of a visited point. ∎ Two details in that display are easy to get wrong in the loosening direction. The cardinality that enters is the packing number, which dominates the covering number, so an upper bound on it is what the union bound needs. And the ball mass must be intersected with U: the density is hypothesized only on U, so a packing point on ∂U∂ U keeps only the part of its ball inside. If U is an axis-aligned box with every extent at least ρ/2ρ/2, the infimum is attained at a corner, where exactly one orthant survives: infu∈Uvol(B(u,ρ/2)∩U)= 2−(d+m)vol(Bρ/2). _u∈ Uvol (B(u,ρ/2)∩ U )\;=\;2^-(d+m)\,vol(B_ρ/2). That equality is not shear-invariant, and the cart’s U is a sheared box: the sup-ball is axis-aligned while the region is not, so the slanted constraint clips the corner cap a little further. Computed rather than asserted, the factor is 0.950⋅2−(d+m)0.950· 2^-(d+m) at the certified ρ — a 5%5\% effect, which is exactly the size of error that hand-asserted geometry produces, which is why the script computes it. For a region that is a union of cells rather than a box there is no orthant argument at all, and the step-t instantiation below uses a shape-free bound instead: if u’s cell has diameter at most ρ/2ρ/2 then the whole cell lies inside B(u,ρ/2)B(u,ρ/2), so the ball mass is at least cvol(C)c\,vol(C) times the surviving action interval. Instantiated on the deployed cart gate (scripts/gate_coverage_certificate.py; U the step-1 reachable set of Corollary 4, c=5/6c=5/6, L=1.27L=1.27, ε=0.01 =0.01, δ=0.05δ=0.05): one step per rollout — the reading that needs no assumption about steps within a rollout — gives ρ=1.165ρ=1.165 from N=40N=40 rollouts, certifying supU‖f−f^‖∞≤2.97 _U\|f- f\|_∞≤ 2.97. (The corner hypothesis is satisfied, if barely: U’s narrowest extent is 0.60.6 against ρ/2=0.583ρ/2=0.583.) The wall’s own disagreement is 4.24.2, which exceeds that — but the bound grows with L, so what the certificate excludes is precisely a pair with L=max(Lipf,Lipf^)≤1.80L= (Lipf,Lip f)≤ 1.80 carrying an error of 4.24.2 on this region. That is a real but narrow class: a model smoother than the plant (1.271.27) cannot hide the wall’s magnitude from this gate, a twice-rougher one can. The wall itself escapes by not being Lipschitz at all. A partition beats a packing, and here it is exact. A packing argument pays for the covering number twice, once in the cardinality K and once in the ball mass, and both payments are geometric factors that have to be estimated — each one a place where hand-asserted geometry can silently loosen the bound. A partition argument pays neither, and on this instrument its cell probabilities are not estimated at all. Proposition 15 (coverage by partition). Let C1,…,CK\C_1,…,C_K\ be a measurable partition of U with diam∞(Ci)≤ρdiam_∞(C_i)≤ρ for every i, and let qiq_i be the probability that one gate sample lands in CiC_i. After M i.i.d. samples the visited set is a ρ-net of U with probability at least 1−∑i(1−qi)M1- _i(1-q_i)^M. In particular, if the sampling law is uniform on U and the partition has equal volumes, qi=1/Kq_i=1/K exactly and the failure probability is K(1−1/K)MK(1-1/K)^M. Proof. CiC_i receives no sample with probability (1−qi)M(1-q_i)^M; union-bound. If every cell holds a sample then each u∈Uu∈ U lies in some CiC_i together with a visited point, at sup-distance at most diam∞(Ci)≤ρdiam_∞(C_i)≤ρ. ∎ No density constant, no covering number, no ball–boundary intersection appears. What makes the cart’s gate a case where this is exact rather than merely cleaner is a change of coordinates: the step-1 law is uniform on U=|v|≤V,|x−dtv|≤12,|a|≤amaxU=\|v|≤ V,\ |x-dt\,v|≤ 12,\ |a|≤ a_ \, and in y=x−dtvy=x-dt\,v that is uniform on a box [−12,12]×[−V,V]×[−amax,amax][- 12, 12]×[-V,V]×[-a_ ,a_ ], the shear having unit Jacobian. Equal sub-boxes therefore have probability exactly 1/K1/K. The shear costs something in one place only — the net radius must be measured in the original metric, where |x−x′|≤Δy+dtΔv|x-x |≤ _y+dt\, _v, so ρ=max(Δy+dtΔv,Δv,Δa).ρ\;=\; ( _y+dt\, _v,\; _v,\; _a ). At the deployed M=N=40M=N=40 (one step per rollout, so the samples are genuinely independent) the largest admissible partition is K=8K=8, since 8⋅(7/8)40=0.038≤δ8·(7/8)^40=0.038≤δ while 9⋅(8/9)40=0.0819·(8/9)^40=0.081 exceeds it. Optimising the split gives (ny,nv,na)=(2,1,4)(n_y,n_v,n_a)=(2,1,4), hence ρ=0.600ρ=0.600 and supU‖f−f^‖∞≤ε+2Lρ= 1.534 _U\|f- f\|_∞\;≤\; +2Lρ\;=\;1.534 (scripts/gate_partition_certificate.py), against 2.972.97 by the packing route — a factor of two, bought entirely by changing the argument rather than by any new measurement or assumption, and with no Monte Carlo anywhere in it. What pins ρ is visible in the optimum: it takes nv=1n_v=1, i.e. Δv=2V _v=2V, the whole reachable velocity range. At forty independent samples the certificate cannot resolve velocity at all, and that is a fact about the gate rather than about the proof. The same partition composes with the dependence treatment, and that is what finally answers the mixing question. Proposition 15 needs only per-cell hitting probabilities, so instead of one step per rollout take pC=P(one rollout puts no sample in C)p_C=P(one rollout puts no sample in C) — a plain Bernoulli parameter whatever the within-rollout dependence does — measure it directly, and use P(C unhit)=pCNP(C unhit)=p_C^N, which is exact because rollouts are i.i.d. A rollout gets eighty chances at U rather than one, worth about six effective independent samples after the correlation between consecutive steps, and the finest partition the deployed gate certifies grows from K=8K=8 to K=36K=36. Here the certificate stops being sampling-free, so the accounting has to be explicit. pCp_C is estimated on 20,00020,000 gate rollouts drawn once and shared by every candidate partition, while the candidate family itself is geometric and fixed before any rollout is drawn (one coarsest partition per target radius, 2626 of them), so the only data-dependent choice is which member is certified. Hoeffding is applied at level δ/(3K)δ/(3K) per cell, so that pC≤p^C+tp_C≤ p_C+t holds simultaneously across all K cells with probability 1−δ/31-δ/3 and the selected worst cell needs no further correction; the remaining δ/2δ/2 pays for the gate’s own miss, 5δ/6≤δ5δ/6≤δ in total. At K=36K=36 the worst cell is p^C=0.800 p_C=0.800, bounded above by 0.8140.814, giving 36⋅0.81440=0.010≤δ/236· 0.814^40=0.010≤δ/2 and ρ=0.363,supU‖f−f^‖∞≤ 0.933.ρ=0.363, _U\|f- f\|_∞\;≤\;0.933. Selecting K against the sample is a multiple comparison, and it costs nothing here. Because Hoeffding’s radius grows only like log(1/level) (1/level), widening the Bonferroni correction from one partition’s cells to every cell of every candidate in the family (96749674 tests) raises the bound on the worst cell to 0.8180.818 and the failure probability to 0.0120.012, and still selects K=36K=36; a further factor of 10001000 in the family size changes neither. Replacing Hoeffding by an exact-binomial Clopper–Pearson bound at the same level gives 0.8090.809, and also selects K=36K=36 — so 0.8140.814 is slack in the inequality rather than calibration, and ρ=0.363ρ=0.363 is an artifact of neither the search nor the concentration inequality. The next candidate up (K=48K=48, ρ=0.333ρ=0.333) misses the threshold by a factor of 4.54.5, which is far more than any correction can bridge in either direction (scripts/certificate_simultaneity.py). One inconsistency in the budget: the K=8K=8 certificate above spends the whole of δ on the coverage event while this one spends δ/2δ/2, so 1.5341.534 and 0.9330.933 are 1−δ1-δ statements against slightly different budgets. The three readings line up: 2.972.97 if one insists on a packing argument, 1.5341.534 from an exact partition on independent samples, 0.9330.933 once the within-rollout dependence is priced exactly — against the 0.430.43 that assuming all 32003200 steps independent would promise, an assumption the plant itself refutes (the trajectory determines every action; next paragraph). Handling the dependence exactly, rather than discarding the within-rollout steps, is worth a factor of 1.61.6. And the sharper radius widens the excluded class: since ε+2Lρ +2Lρ grows with L, a bound of 0.9330.933 at ρ=0.363ρ=0.363 excludes any pair with L=max(Lipf,Lipf^)≤5.77L= (Lipf,Lip f)≤ 5.77 carrying the wall’s error of 4.24.2 — now 4.5×4.5× the plant’s own constant rather than 1.4×1.4×, so “no smooth pair can carry the wall’s error past this gate” covers a genuinely broad class of models rather than a sliver. Using all the steps, without assuming they are independent. The obvious objection is that the gate takes 40×8040× 80 steps and the above uses 40 of them. The natural repair fails, and in the direction that flatters the gate. Conditioning on a rollout’s entire state trajectory does not leave the action indicators at the visiting times independent Bernoulli(qa)(q_a), which would give an exact per-rollout factor [(1−qa)O]E[(1-q_a)^O]: under this plant the action is recoverable from consecutive states, at=((vt+1−vt)/dt+dragvt)/gaina_t=((v_t+1-v_t)/dt+drag\,v_t)/gain, so conditioning on the whole trajectory determines every action and the conditional indicator law is degenerate. The gate policy gives at⟂sta_t s_t, not at⟂(s0,…,sT)a_t (s_0,…,s_T). The repair is to notice that no factorization was needed. Only one independence fact enters, and it is a property of the design rather than of the dynamics: the N gate rollouts are i.i.d. So with pC=P(one rollout puts no sample in C)p_C=P(one rollout puts no sample in C) — a plain Bernoulli parameter, whatever the within-rollout dependence does — P(C unhit by the gate)=pCNexactly,P(C unhit by the gate)\;=\;p_C^\,N , and pCp_C is estimated by counting rollouts that miss C, with Hoeffding for the upper bound. Nothing is assumed about how steps within a rollout correlate because nothing needs to be. Two implementation conditions the bound depends on: the grid must have every cell no wider than ρ (an integer division with index clamping leaves the last cell wider than ρ — 0.80.8 at ρ=0.6ρ=0.6 — so “all cells hit” certifies a coarser net than the one claimed), and the falsification test below must use the same grid, or a grid mis-specified in exactly this way passes its own test. This pCp_C route is what the previous paragraph’s partition composes with, and on U it is what gives the 0.9330.933 quoted there. Instantiated instead on a box 6.7×6.7× larger (|x|,|v|≤1|x|,|v|≤ 1, |a|≤1|a|≤ 1; scripts/gate_coverage_dependent.py, 8000 MC rollouts) the deployed N=40N=40 certifies a net radius of 1.01.0, i.e. ≤2.55≤ 2.55, and misses the next resolution by two rollouts — radius 0.6670.667 needs N≥42N≥ 42, radius 0.50.5 needs N≥194N≥ 194. Those are not competing numbers but the region/resolution trade-off at fixed N: a larger region costs resolution, and forty rollouts buy little of either. Treating all 32003200 steps as independent is doubly invalid — it assumes an independence the plant refutes and uses the step-1 density at steps t≥2t≥ 2 — and the numbers it promises (ρ=0.305ρ=0.305, bound 0.7850.785) are not bounds: the valid all-steps answer, 0.9330.933, sits a factor of 1.21.2 above them. The binding constraint is not how steps correlate but how many rollouts reach the worst cell. The density at every step, and what it buys. The certificate above lives on the one-step reachable set because that is where Corollary 4 derives the density. The restriction lifts: the plant is linear and time-invariant, so (xt,vt)(x_t,v_t) is an affine image of (x0,a0,…,at−1)(x_0,a_0,…,a_t-1), and splitting off the last two actions gives (xt,vt)=Wt+M(at−1,at−2)⊤(x_t,v_t)=W_t+M(a_t-1,a_t-2)^\! with M the (time-invariant) Jacobian, columns in that order, M=(gaindt2gaindt2(1+(1−dragdt))gaindt(1−dragdt)gaindt),|detM|=0.009M= pmatrixgain\,dt^2&gain\,dt^2(1+(1-drag\,dt))\\ gain\,dt&(1-drag\,dt)\,gain\,dt pmatrix, | M|=0.009 (verified against finite differences). WtW_t is independent of those two actions, so at every t≥2t≥ 2 the step-t law is the convolution of WtW_t’s law with the uniform law on the parallelogram P=M[−amax,amax]2P=M[-a_ ,a_ ]^2, of area 4amax2|detM|=0.0364a_ ^2| M|=0.036. Hence, for every u, an identity rather than a bound: pt(u)= 27.78⋅P(Wt∈u−P).p_t(u)\;=\;27.78· P (W_t∈ u-P ). Two details separate that identity from the object Proposition 14 consumes, and both tighten the region (scripts/gate_density_step_t.py). The proposition wants the density of (s,a)(s,a) on ℝ3R^3, not of (x,v)(x,v) on ℝ2R^2; since a is uniform and independent, p3D=p2D/2amaxp_3D=p_2D/2a_ , the same factor the step-1 corollary carries. And the hypothesis is an infimum over the region, whereas binning samples and dividing by cell volume estimates a cell average, which does not bound it. The exact route is the reason the cells are shaped like P itself: for C=c0+λPC=c_0+λ P and any u=c0+λp∈Cu=c_0+λ p∈ C, every w=c0−(1−λ)qw=c_0-(1-λ)q with q∈Pq∈ P has u−w=λp+(1−λ)q∈Pu-w=λ p+(1-λ)q∈ P by convexity alone, so u−P⊇c0−(1−λ)Pu-P c_0-(1-λ)P and infu∈Cpt(u)≥ 27.78⋅P(Wt∈c0−(1−λ)P), _u∈ Cp_t(u)\;≥\;27.78· P (W_t∈ c_0-(1-λ)P ), a genuine pointwise infimum, Monte-Carlo estimated with a Wilson lower bound per cell over a cell family fixed in advance — 98069806 cells inside the region box, which is the correct Bonferroni denominator because which cells receive a bound is itself data-dependent — at the per-cell level δ/9806δ/9806 that makes the bounds hold simultaneously, i.e. z=4.41z=4.41. Selecting a level set afterwards is then legitimate. Parallelograms tile, which is what makes such cells usable; an axis-aligned grid is not an option here, because P is a sliver 0.120.12 by 1.191.19 and eroding it by any useful square leaves nothing. The tiling and the inclusion are theorems; what needs measuring is the price of the erosion, and the bound sits below a separately measured density by the predicted factor (1−λ)2(1-λ)^2. What the derivation delivers is the (c,U)(c,U) pairs, and they are substantial: at step 20 the level set p≥0.05\p≥ 0.05\ has volume 3.023.02 in (x,v,a)(x,v,a) against the one-step set’s 1.21.2, at step 40 p≥0.02\p≥ 0.02\ has 5.775.77, and at step 80 p≥0.01\p≥ 0.01\ still has 5.275.27. The certified region must be a level set and not a box: a box’s corners pair extreme x with extreme v, which the gate does not reach, so an infimum over a box is 00. What does not survive is the claim that later steps buy a better certificate. They buy extent at the price of density, and at fixed N that is a losing trade — so badly that with a shape-free bound on the ball mass, N=40N=40 certifies nothing on any step-t level set. A union of cells admits no orthant argument, so the only bound available without a shape hypothesis is cell containment (C⊆B(u,ρ/2)C B(u,ρ/2) whenever diamC≤ρ/2diam\,C≤ρ/2), and that ignores the cell’s neighbours, making it loose by a large factor. So this is not a proof that the gate certifies nothing on these regions; it is that no rigorous step-t certificate exists at this gate size: the shape-free route is loose by construction, and no sharper geometric factor is asserted here without verification. The conclusion that matters is unaffected either way: the step-1 corollary’s 2.972.97 stands, lifting the step-1 restriction did not improve it, and what limits the certificate is the gate’s size and not the step index. And no level set at any step reaches the wall, which is the same boundary the corollary ran into. One Jacobian identity covers the whole semi-implicit family; the certificate’s density hypothesis is still verified per instrument. The step-t derivation above used the cart’s linearity, and the natural worry is that a nonlinear plant needs its own argument for the two-action factor. It does not. For any plant of the semi-implicit form ωt+1=ωt+(gain⋅at+F(θt,ωt))dt,θt+1=θt+ωt+1dt, _t+1= _t+ (gain· a_t+F( _t, _t) )\,dt, _t+1= _t+ _t+1\,dt, with F∈C1F∈ C^1 arbitrary, the Jacobian of the last two actions satisfies |det∂(θt,ωt)/∂(at−2,at−1)|=gain2dt3identically, | ∂( _t, _t)/∂(a_t-2,a_t-1) |\;=\;gain^2\,dt^3 , independent of F, of the state and of t. Writing Fθ,FωF_θ,F_ω for the partials: ∂ωt/∂at−1=gaindt∂ _t/∂ a_t-1=gain\,dt and ∂θt/∂at−1=gaindt2∂ _t/∂ a_t-1=gain\,dt^2; ∂ωt/∂at−2=gaindt(1+Fωdt)+Fθgaindt3∂ _t/∂ a_t-2=gain\,dt(1+F_ωdt)+F_θ\,gain\,dt^3 and ∂θt/∂at−2=gaindt2+dt∂ωt/∂at−2∂ _t/∂ a_t-2=gain\,dt^2+dt\,∂ _t/∂ a_t-2; substituting, every F-dependent term cancels and the determinant is −gain2dt3-gain^2dt^3. Checked numerically against four forces including a non-separable one, at several (gain,dt)(gain,dt), to ten digits. So the geometric factor c=1/(4amax2gain2dt3)=27.78c=1/(4a_ ^2gain^2dt^3)=27.78 is the same for the cart and the pendulum: on any event where the last two steps are clamp-free and the target point lies in that history’s two-action image, the conditional density is exactly c. What the identity does not by itself give is the certificate’s hypothesis — a lower bound on the marginal density over a region — because the marginal at a point is c times the fraction of histories whose two-action image covers it, and the identity says nothing about that coverage fraction, which can be zero. Turning the factor into a bound requires showing a positive fraction of histories covers the region, which the cart derivation does by erosion and direct measurement (scripts/gate_density_step_t.py) and which we have not established for the pendulum’s nonlinear F: the certificate’s hypothesis is verified where the certificate is used, not inherited from the family. Its scope is exactly the hypothesis: the action must enter as an additive gain⋅atgain· a_t in the velocity update. PatchField2D is therefore outside it — there the action sets a force direction, a↦gain(cosϕ,sinϕ)a ( φ, φ) with ϕ=πa/amaxφ=π a/a_ , so the two-action map is not affine in the actions and the determinant is not constant. Within the family there is one further exception, and it is the expected one: wherever the mode clamp fires, the two-action map is constant, so det=0 =0 exactly and no density argument reaches the mode. The obstruction is intrinsic, not a limitation of this technique. But the certified region is not where the planner looks. The certificate bounds the model on the region the gate covers; the play cost is driven by the region the planner queries (Proposition 8). Those are different measures, and the way to relate them is to measure the overlap (scripts/certified_region_query_mass.py: every imagined MPC step is a query). Of the exploited planner’s 1.31.3 million queries per episode pair, 1.9%1.9\% fall inside the box |x|,|v|<1|x|,|v|<1 — the region the dependence-exact certificate covers — and 7.8%7.8\% inside |x|<3,|v|<2|x|<3,|v|<2, a box that contains every step-t level set and therefore upper-bounds the certified share; for the truth planner, 2.3%2.3\% and 7.3%7.3\%. So the certificate is valid — its bound holds with probability at least 1−δ1-δ over the gate’s draws — and nearly irrelevant to play: not because the bound is loose — it is conservative by about 5%5\% in N — but because the gate covers a couple of percent of the query mass. That is this paper’s thesis restated as a measurement rather than an argument, and it is the reason the continuous coverage analogue, once obtained, does not rescue sampling verification: the gate certifies where it looks, and the planner looks somewhere else. Is the bound tight? A bound that merely holds could be loose by orders of magnitude; measured against independent oracle gates, the partition certificate is essentially exact. Running 400400 independent gates against the certificate’s own partition (scripts/gate_partition_validation.py, which reads the partition from the certificate’s output rather than re-implementing it): the K=8K=8 exact partition is covered in 384/400384/400 trials, a measured failure rate of 0.04000.0400 with 95%95\% interval [0.0248,0.0640][0.0248,0.0640] against the certificate’s union bound of 0.03830.0383. The right comparison here is the interval against the bound, not the point estimate: for a bound this tight the estimate lands above it about half the time, and an independent oracle says how tight it is. Inclusion–exclusion in exact rational arithmetic gives the true failure probability of the K=8K=8 experiment as 0.0380380.038038, so the union bound is loose by 0.73%0.73\% and the measurement sits within noise of the exact value; the same computation shows K=9K=9 fails at 0.07940.0794, so K=8K=8 is the largest admissible partition under the exact probability and not merely under the union bound — the cap is the gate’s size, not the proof. The K=36K=36 all-steps partition is covered in 400/400400/400, failure [0,0.0095][0,0.0095] against a bound of 0.00960.0096, so there the Hoeffding slack is finer than 400400 trials can resolve. The 400400-gate test checks the coverage event; it does not check the quantity the K=36K=36 certificate actually rests on, which is the estimate p^C p_C. That is checked separately: re-measuring pCp_C for the same partition on a disjoint 20,00020,000-rollout stream moves the worst cell from 0.80010.8001 to 0.79960.7996 — 3.6%3.6\% of the Hoeffding radius that bounds it, with the same binding cell (2,0,3)(2,0,3) — and the certificate holds on the fresh sample. So 0.8140.814 is slack in an inequality, not calibration to one stream. For the coarser box-region certificate the older test still applies (scripts/gate_coverage_validation.py): coverage at net radius 1.01.0 in 200/200200/200, 198/200198/200 at 0.6670.667 where the certificate declines to license it (asking N≥42N≥ 42 against 4040), then 128/200128/200 at 0.50.5 and 10/20010/200 at 0.40.4, where it asks for 194194 and 21892189. What the numbers exclude matters more than the numbers. The hard mode’s own disagreement is 4.24.2 (the wall-region probe error of Section 10), above every bound above — but the certificate buys ε+2Lρ +2Lρ, which grows with L, so the statement carries a quantifier that the radius sets: at the best rigorous radius, ρ=0.363ρ=0.363, no pair with L=max(Lipf,Lipf^)≤5.77L= (Lipf,Lip f)≤ 5.77 can carry an error of 4.24.2 past this gate on this region, with probability at least 1−δ1-δ over the gate’s draws. That is 4.5×4.5× the plant’s own 1.271.27, so it is a broad class rather than a sliver — and the scope came from fixing the argument, not from a new experiment: the packing instantiation’s ρ=1.165ρ=1.165 would have licensed only L≤1.80L≤ 1.80. The wall does pass the gate, escaping by the only route left, namely by not being Lipschitz at all. The continuous coverage analogue therefore closes exactly the case the paper says it closes (smooth models) and is silent exactly where the danger lives (the discontinuous reset modes), which is the same boundary Proposition 9 draws. Appendix D The detectability rate, and the gate’s visitation density Proposition 16 (smooth localized error is detectable at a rate). In the setting of Proposition 9 with L>0L>0, let ρ=(η−ε)/2Lρ=(η- )/2L be the radius of the guaranteed disagreement ball B⊆EεB E_ . Fix a step index k≤Tk≤ T and suppose the gate’s step-k visitation law admits a density bounded below by c>0c>0 with respect to Lebesgue measure on B. If moreover the disagreement is centred at sup-distance at least ρ from ∂(S×A)∂(S× A), so that the ball is not clipped, then one gate rollout reveals the disagreement with probability at least q=c(2ρ)d+m=c(η−εL)d+mq\;=\;c\,(2ρ)^d+m\;=\;c ( η- L )^d+m (the sup-metric ball is a cube of side 2ρ2ρ). Without the interiority hypothesis the same argument gives q=cvol(B∩(S×A))q=c\,vol(B∩(S× A)), which for a box-like S×AS× A is at worst 2−(d+m)2^-(d+m) of the above (Corollary 3: a corner keeps one orthant, a face costs a single factor 22); for a general region no such uniform factor exists, and the intersected volume must be computed. By Proposition 1 the gate’s miss probability is at most (1−q)N(1-q)^N. Equivalently — what it takes to hide — keeping the miss probability above δ against N rollouts forces L≥(η−ε)(cNln(1/δ))1/(d+m).L\;≥\;(η- ) ( c\,N (1/δ) )^1/(d+m). Proof. B⊆EεB E_ by Proposition 9, and the step-k visitation of B has probability at least c⋅vol(B)=c(2ρ)d+mc·vol(B)=c(2ρ)^d+m by the density hypothesis; a rollout that visits EεE_ at step k reveals a disagreement, so the per-rollout reveal probability is at least q and the critical event of Proposition 1 has r≥qr≥ q, giving P(miss)=(1−r)N≤(1−q)NP(miss)=(1-r)^N≤(1-q)^N. For the converse, (1−q)N>δ(1-q)^N>δ requires q<1−δ1/N≤ln(1/δ)/Nq<1-δ^1/N≤ (1/δ)/N; substituting q=c((η−ε)/L)d+mq=c((η- )/L)^d+m and solving for L gives the display. ∎ Three readings. (i) It is the measure counterpart of Proposition 9: smoothness does not merely forbid exact localization, it forces a detection rate. (i) The Lipschitz constant needed to hide a fixed error grows only like N1/(d+m)N^1/(d+m), so whenever cN/ln(1/δ)>1cN/ (1/δ)>1 — comfortably true here, where it is 4848 — raising the dimension lowers that constant and hiding gets easier with dimension (below 11 the exponent flips the comparison, so the reading is not dimension-free) — the same dimensional loosening paper 3 studies as a rarity knob. (At fixed c is the honest qualifier: c carries dimensions of inverse volume, so the dimension-free way to say it is Remark 4’s volume ratio — the ball’s share of the reachable set shrinks with dimension at fixed radius.) (i) The hypothesis is where the work is: verifying a visitation-density lower bound is instrument-specific. Our gate’s step-00 law is supported on a lower-dimensional set (the initial-state distribution has v=0v=0 exactly), so nothing can be claimed there; from step 11 on the actions supply the missing direction and c is derivable, which is what Corollary 4 does. Alongside the derivation we have the direct measurement: the smooth bump arm of Section 5 has reveal-rarity 0.180.18 against the hard wall’s 0.140.14 at comparable amplitude — the smooth error is, if anything, more detectable, exactly as this proposition’s direction requires, and its harmlessness comes from play_cost≈0play\_cost≈ 0 rather than from hiding. Remark 4 (the constant in general: a volume ratio). Proposition 16’s c is not an instrument-specific fudge; it is the gate’s step-k visitation density, which for a gate policy with box-uniform initial states and actions is available in closed form by change of variables. If the step-k law of (s,a)(s,a) is uniform on a set U⊆S×AU S× A — as it is at k=1k=1 whenever the one-step map is affine in the randomized coordinates — then c=1/vol(U)c=1/vol(U) exactly, and — provided the ball is contained in U, which is a separate condition from Proposition 16’s interiority hypothesis (that one concerns ∂(S×A)∂(S× A), this one ∂U∂ U) and is what makes the ratio a probability at all — the proposition’s conclusion reads q≥vol(B)vol(U),q\;≥\; vol(B)vol(U), the fraction of the gate’s one-step reachable volume that the guaranteed disagreement ball occupies. For non-uniform laws the same computation goes through the pushforward, but the extrema live on the source space: with F the one-step map, injective on the relevant set, the change of variables gives pU(u)=p0(F−1u)/|detDF(F−1u)|p_U(u)=p_0(F^-1u)/| DF(F^-1u)| and hence c=infF−1(B)p0/supF−1(B)|detDF|c= _F^-1(B)p_0 / _F^-1(B)| DF|. Without injectivity the density is a sum over preimages and this is only a lower bound (which is the direction we need). The uniform case is the one where numerator and denominator are constant. The dimensional reading of Proposition 16 is then geometric rather than analytic: hiding is easy exactly when the ball is a small fraction of the reachable volume, and raising d+md+m shrinks that fraction for fixed radius. Corollary 4 (the constant, computed for this instrument). For the cart’s gate at step k=1k=1 the density hypothesis is not an assumption: the gate policy gives v1=gain⋅dt⋅a0v_1=gain· dt· a_0 with a0∼U(−amax,amax)a_0 U(-a_ ,a_ ), x1=x0+dtv1x_1=x_0+dt\,v_1 with x0∼U(−12,12)x_0 U(- 12, 12), and a1∼U(−amax,amax)a_1 U(-a_ ,a_ ) independent, so on |v1|<gaindtamax∩|x1−dtv1|<12∩|a1|<amax\|v_1|<gain\,dt\,a_ \∩\|x_1-dt\,v_1|< 12\∩\|a_1|<a_ \ the joint (x1,v1,a1)(x_1,v_1,a_1) density is constant — not a product of marginals, since x1=x0+dtv1x_1=x_0+dt\,v_1 makes x1x_1 and v1v_1 dependent, but constant on that sheared set, with the value the three normalizations give because the shear has unit Jacobian: c=12gaindtamax⋅1⋅12amax=56at gain=3,dt=0.1,amax=1c\;=\; 12\,gain\,dt\,a_ · 1· 12a_ \;=\; 56 gain=3,\ dt=0.1,\ a_ =1 (d+m=3d+m=3 here). Equivalently, by Remark 4, the step-1 law is uniform on a set of volume vol(U)=(2gaindtamax)⋅1⋅(2amax)=1.2vol(U)=(2\,gain\,dt\,a_ )· 1·(2a_ )=1.2 and c=1/1.2=5/6c=1/1.2=5/6 — the reveal probability is literally the ball’s share of the one-step reachable volume. Monte Carlo on an interior box agrees to 1.3%1.3\% (scripts/gate_density_constant.py). Proposition 16 is therefore quantitative on this instrument: hiding an η-sized disagreement centred where this density holds from the deployed gate (ε=0.01 =0.01, N=40N=40) with probability above 12 12 requires L≥(η−ε)(5/6ln2/40)1/3=3.636(η−ε),L\;≥\;(η- ) ( 5/6 2/40 )^1/3=3.636\,(η- ), i.e. L≥1.78L≥ 1.78 for η=0.5η=0.5 and L≥3.60L≥ 3.60 for η=1η=1, against the plant’s own sup-metric Lipschitz constant of 1.271.27. Three scope conditions decide what this corollary does and does not say. The first is the proposition’s own interiority hypothesis. Because L scales with η−εη- in this instantiation, the ball’s radius is the same ρ=1/(2⋅3.636)=0.1375ρ=1/(2· 3.636)=0.1375 in every row, and the ball is a full cube only for centres at sup-distance ρ from ∂U∂ U — which is 33.9%33.9\% of U’s volume. On the remaining two thirds the clipped-ball form applies and q is smaller, by up to 232^3 (Corollary 3 at k up to d+m=3d+m=3 clipped coordinates). Second, since f is the plant, L=max(Lipf,Lipf^)≥1.27L= (Lipf,Lip f)≥ 1.27 always, so the constraint has content only above η≈1.27/3.636+ε≈0.36η≈ 1.27/3.636+ ≈ 0.36: rows below that are satisfied automatically and prove nothing. At η=0.5η=0.5 the requirement L≥1.78L≥ 1.78 does bite — a pair no rougher than 1.4×1.4× the plant cannot hide an error of that size here. Third, and most restrictive: this route says nothing about the wall. The density c=5/6c=5/6 is supported on the one-step reachable set, i.e. |x1|<0.53|x_1|<0.53, while the mode sits at xwall∈[2,10]x_wall∈[2,10], where the step-1 visitation density is exactly zero and Proposition 16 is vacuous. Nor does the guaranteed ball bridge the gap: at L=1.27L=1.27 its radius is 1.651.65, and reaching |x|≤0.53|x|≤ 0.53 from x=8x=8 would need an L below the plant’s own. So the supported statement about the hard mode is not a theorem from this corollary but the measurement of Section 5 — the wall is detected at rate 0.140.14, and the smooth bump at 0.180.18, so the smooth error is if anything the more visible of the two, exactly as this proposition’s direction requires — together with Proposition 9’s qualitative obstruction, which needs no density and therefore holds at the wall. The smooth arms’ harmlessness comes from play_cost, not from invisibility. That the quantitative route reaches only a neighbourhood of the origin is not a technical gap to be papered over: it is the same fact the rest of the paper is about, that a sampling gate’s guarantees live where it looks. Remark 5 (metric, not measure). The ball in Proposition 9 is metric, and its probability under the gate’s visitation measure can still be small — smoothness bounds how spatially concentrated an error can be, not how often the gate visits it. The proposition removes the exact localization premise for smooth pairs; the (1−r)N(1-r)^N mechanism itself is representation-independent and applies to any critical region of small visitation measure. Appendix E A second planner family: play_cost is planner-dependent Proposition 8 bounds play cost by the planner’s query-hit probability on the disagreement region: a blind model can change behavior only to the extent that the planner queries where it is wrong. That is an upper bound and therefore only one implication — low query reach forces low play cost; high query reach permits but does not force high play cost — so “two branches” below names two measured regimes that sit at the two ends of the bound, not a dichotomy the proposition predicts. Random-shooting MPC’s constant candidates reach the distant phantom plateau in imagination and produce play_cost ≈1≈1. We repeated the full 11-knob grid with a second base planner, the cross-entropy method (CEM; scripts/continuous_cem.py; horizon 40, 5 iterations, 64 samples, elite fraction 0.125, minimum standard deviation 0.05; one fixed setting across both instruments). The crossing columns in Table 9 are the fraction of sampled imagined trajectories that cross the omitted boundary, measured for BOTH planners with one plan from the same paired initial state per episode seed (episode-accumulated CEM fractions, which tell the same story, are recorded in the results JSON). instrument knob pc MPC pc CEM contact CEM crossing CEM crossing MPC cart 2.0 1.031 00 (exact) <0.16<0.16 0.0309 0.3865 cart 4.0 1.031 00 (exact) <0.16<0.16 0.0055 0.2453 cart 6.0 1.031 00 (exact) <0.16<0.16 0.0003 0.1483 cart 8.0 1.030 00 (exact) <0.16<0.16 1.4e-05† 0.0773 cart 10.0 0.977 00 (exact) <0.16<0.16 <2.3e−06<2.3e-06 0.0369 pendulum 0.8 1.002 0.009 0.70 0.1150 0.6392 pendulum 1.0 1.002 0.025 0.25 0.0483 0.5530 pendulum 1.2 1.000 −0.011-0.011 <0.16<0.16 0.0164 0.4672 pendulum 1.4 0.997 −0.021-0.021 <0.16<0.16 0.0053 0.3842 pendulum 1.6 0.990 −0.021-0.021 <0.16<0.16 0.0013 0.3039 pendulum 2.0 0.942 5.0×10−45.0×10^-4 <0.16<0.16 0.0002 0.2158 Table 9: The same gate-accepted, mode-blind models under two base planner families (20 paired episodes/row). “pc” is blind-model play_cost within that planner family; crossing is the sampled imagined-boundary-crossing proxy for query-hit mass, one plan per episode seed from paired initial states for both planners. CEM stays near zero play cost and below MPC’s crossing fraction on every row. CEM’s blind-model play cost lies in [−0.0213,0.0248][-0.0213,0.0248] on every row — and the seed-paired 95% t-interval includes zero on all 11 rows — while its imagined crossing fraction is strictly below MPC’s throughout. Two of those eleven intervals deserve their asterisk. On the five cart rows every per-seed difference is 0.00.0 exactly, so the interval is degenerate [0,0][0,0] and “includes zero” is a restatement of bit-identity rather than an inference; we report it as bit-identity in the prose for that reason. On the pendulum rows the standard deviation is inflated roughly fortyfold by one seed (index 16, differences −0.427-0.427 to −0.423-0.423 across three knobs), so the interval is a real interval but its width is that outlier’s, not a noise scale. On the cart, truth- and blind-model CEM returns are identical and contact is zero everywhere. The nearest pendulum stops are a real qualification: CEM contacts θstop=0.8 _stop=0.8 in 70% of episodes and 1.01.0 in 25%, but does not enter MPC’s pinned, below-random regime; contact is zero from θstop≥1.2 _stop≥ 1.2. Contact is therefore not itself exploitation. One caveat before crediting Proposition 8 with this. The bound is in terms of qhit(E)q_hit(E), the probability that at least one query in an episode lands in the disagreement region, whereas the crossing column is the fraction of imagined candidates that cross. With ∼200 200 candidates × 40 imagined steps per replan, any nonzero crossing fraction makes qhit(E)≈1q_hit(E)≈ 1 and the bound ≲1 1 — true but vacuous. The two cart rows that printed crossing 0.00000.0000 invited a stronger reading — that qhit=0q_hit=0 there forces play_cost=0play\_cost=0 — and re-measuring them refutes it for one of the two. Those zeros were censored at 64006400 sampled trajectories; at 200×200× that sample (scripts/cem_crossing_bound.py, 1.281.28 million imagined trajectories per row) the row at xwall=8x_wall=8 produces 18 crossings, a per-trajectory rate of 1.4×10−51.4× 10^-5, and the event that the episode’s first plan crosses gives a lower confidence bound qhit(E)≥0.0029q_hit(E)≥ 0.0029. So qhitq_hit is not zero on that row and nothing is forced. At xwall=10x_wall=10 the zero survives the 200×200× resampling (00 of 1.281.28 million, per-trajectory rate <2.3×10−6<2.3× 10^-6), but it remains a censored zero and the object the data support is an upper bound: measured directly at episode scope, qhit(E)≤0.058q_hit(E)≤ 0.058 at 95%95\%, so Proposition 8 caps |play_cost||play\_cost| at 0.0580.058 times the normalizer ratio rather than at 00. The correct statement is therefore an inequality on both rows and on the other nine: the bound gives a small nonzero ceiling that the measured play cost respects, and the planner-dependence result is empirical. The crossing fraction is in any case a proxy — it counts candidate trajectories, while the bound is about at least one query per episode — and with ∼200 200 candidates × 40 imagined steps per replan any nonzero fraction pushes the episode-level probability towards 1, which is why the direct episode-scope measurement is what we quote. What survives in either reading is Section 2.3’s first lesson — if search does not discover the phantom, it cannot optimize toward it. Two caveats prevent the wrong conclusion. CEM’s pendulum truth return varies from 15.36 to 16.46 (versus MPC’s 20.08), consistent with local optima; the comparison is blind-CEM against truth-CEM, not a claim that CEM is globally optimal. And limited reach is not knowledge or mitigation: a planner that misses a phantom distant reward can also miss a real one. This is one fixed CEM configuration, not a hyperparameter sweep. PatchField2D: CEM shows no 2D competence gap. On the 4D bi-modal instrument (scripts/continuous_cem_patch2d.py) blind CEM is again not exploited: play_cost is −0.022/+0.017/+0.020-0.022/+0.017/+0.020 at knobs (2,6)/(3,7)/(4,8)(2,6)/(3,7)/(4,8) with the seed-paired 95% t-interval including zero on all three rows, and CEM’s imagined crossing fraction is below MPC’s on every row (0.070<0.2080.070<0.208, 0.027<0.1490.027<0.149, 0.009<0.0940.009<0.094). Here CEM is competent in aggregate — no 2D competence gap appears — but with per-seed variance (one truth-CEM episode at ≈0.97≈ 0.97), and its blind contact rate is a uniform 0.050.05 (nonzero, unlike the cart’s 0.000.00, and without positive play cost). The same low-query-reach branch of Proposition 8, one more instrument. Appendix F Planner-side mitigation: distrust-region replanning The exploitation measured in Sections 4 and 5 is planner-mediated, not model-mediated, and a planner-side fix collapses it without touching the model or the gate — this does not contradict the danger law (the gate still accepts a wrong model; Proposition 5 is untouched). Like those sections, this one uses the hand-written instruments and blind models, not LLM synthesis. Distrust-region replanning (src/cwm/continuous/mitigation.py, strictly additive) compares the model’s prediction against the observed transition after every real step (tol=10−6tol=10^-6); a disagreement records the position of the model’s refuted prediction — not the pre-state — as a one-sided fence, since false predictions always lie on or beyond the mode boundary. While scoring a candidate rollout, the first imagined step whose position interval crosses a fence’s ε -band (ε=0.25 =0.25 cart, ε=0.1 =0.1 pendulum) truncates the rollout — reward kept, everything downstream dropped — which makes the fence leap-proof at any imagined speed; candidates are then ranked by (truncated return, distance to the nearest fence), which structurally prefers the real side in one dimension. The qualifier is load-bearing: the tie-break is an unsigned distance, so in 1D, where the fence lies beyond the boundary and the real side is the only other direction, maximizing it flees the mode — but in 2D it is symmetric between rounding the patch and plunging through it, and Section F.1 measures what that costs. With zero violations this is bit-identical to plain MPC by construction (tested bitwise) — mitigation costs nothing when the model is right. Undodgeability is a design requirement rather than an observation, because the argmax planner acts as an adversary against any fence: it dodges a fence tied to the pre-state, and it dodges a point fence in full state space by probing crossing velocities — a position-band fence with rollout truncation leaves it no crossing to probe. The collapse is scoped to hard-boundary hybrid modes: the one-sided fence works precisely because a refuted prediction lies on or beyond the mode boundary, so fencing its far side cannot cut off any real trajectory. This structural fact is what these wall/stop instruments supply; less structured failure modes (soft or moving boundaries, errors not confined to a hard stop) do not obviously admit such a fence and are untested — this is a hard-boundary mitigation, not yet a general planner-side one. knob pc_blind pc_mit first-contact step cart (xwallx_wall) 2 1.031 0.290 11.6 4 1.031 0.446 16.9 6 1.031 0.578 21.3 8 1.030 0.699 25.1 10 0.977 0.806 28.7 pendulum (θstop _stop) 0.8 1.002 0.113 7.0 1.0 1.002 0.129 8.1 1.2 1.000 0.143 9.0 1.4 0.997 0.160 10.0 1.6 0.990 0.177 11.0 2.0 0.942 0.212 13.0 Table 10: Mitigation sweep (20 episodes/knob, both instruments). pc_blind / pc_mit = play_cost of the blind planner under plain MPC / under distrust-region mitigation. Full 11-row table with contact rates and violation counts in docs/EXPERIMENTS.md. The collapse is large at every knob (Table 10): pc_blind stays pinned at ≈0.94≈ 0.94–1.031.03 everywhere (established in Section 4, Tables 1 and 2), while pc_mit never exceeds 0.810.81. Exactly one violation suffices to fence the mode on every one of the 11 rows — the mitigated planner must touch the mode once, which is identifiability operationalized: you cannot avoid what you have never seen. The residual pc_mit is the cost of that unavoidable first contact, and it grows with the lure distance, read off the first-contact step: cart 0.290→0.8060.290→ 0.806 as first contact goes 11.6→28.711.6→ 28.7 of 80 steps (knob 2→102→ 10); pendulum 0.113→0.2120.113→ 0.212 as first contact goes 7.0→13.07.0→ 13.0 (knob 0.8→2.00.8→ 2.0). The cart knob =10=10 row is the least favorable in the sweep (pc_mit 0.8060.806, close to blind’s 0.9770.977) because the transient consumes most of the horizon — but the blind planner stays pinned forever there (J 0.940.94 of JtruthJ_truth 17.7717.77) while the mitigated planner escapes and recovers most of the horizon (J 3.883.88): the normalized cost looks modest, the actual return does not. Why exactly one violation, and what sets the count in general. The single-violation sufficiency is not a lucky measurement either — it is a covering number equal to one. Proposition 17 (the mitigation’s new-coverage violations are bounded by a packing number). Run distrust-region replanning with band ε . Let F be the fence locus — the set of points at which a violation can record a fence, i.e. the possible refuted predictions — and let B be the entry barrier, the set of points at which an imagined trajectory can enter the mode region. Two conclusions, with different hypotheses. (i) With no hypothesis at all, the number of violations that place a fence farther than ε from every fence already placed is at most Npack(F,ε)N_pack(F, ), the ε -packing number of F, and Npack(F,ε)≤Ncov(F,ε/2)N_pack(F, )≤ N_cov(F, /2). (i) If moreover B⊆F⊕BεB F B_ — every barrier point within ε of some fenceable point — then once the accumulated fences ε -cover B, no further violation occurs at all. Proof. Fences placed farther than ε from all their predecessors are pairwise more than ε apart, so they form an ε -packing of F and there are at most Npack(F,ε)N_pack(F, ) of them; for the comparison, a (ε/2)( /2)-ball has sup-diameter ε and so contains at most one packing point, giving (i) with no hypothesis used. For (i): once the fences ε -cover B, every imagined trajectory entering the mode region crosses B within ε of a fence and is truncated, so no candidate scores the phantom and no further violation occurs — which is where the hypothesis B⊆F⊕BεB F B_ is used, since otherwise no set of fences on F can cover B. ∎ Two features of the statement are weaker than they may appear, and both are forced by counterexample. The bound is a packing number, not a covering number. A covering number counts an optimal cover, and the planner is not optimal — it is explicitly an adversary against the fence — so it can place every point of a maximal packing before the balls start pre-empting one another. On the unit circle at ε=0.5 =0.5 that is 1212 points, pairwise chord distance 0.5176>ε0.5176> , and a grid sweep confirms every one of the 1212 adds coverage the others had not: 1212 against a covering number of 77 (scripts/circle_covering_number.py). And the count is of new-coverage fences only. Duplicates — fences within ε of an existing one — are not bounded by this argument at all, and in our own data they dominate the tail: one episode records 2828 violations of which 2424 are at an identical point. The two instrument families instantiate the two extremes of that bound. • 1D: the measured 1.001.00 is separation, not covering. A position or angular clamp has a single boundary point, and Table 10 measures a mean of exactly 1.001.00 violations on all eleven rows. That is not the covering bound at Ncov=1N_cov=1 being tight, and checking the instrument says so (scripts/fence_separation_census.py): the fence is recorded at the model’s refuted prediction, which overshoots the wall by 0.170.17 to 0.580.58 against a band of ε=0.25 =0.25, so the band fails to contain xwallx_wall in four of five cart episodes — and the count is 11 anyway. A hypothesis that fails while its conclusion holds is not the explanation. What is doing the work is that in one dimension a single point beyond the boundary disconnects the agent from the phantom: every imagined path to the lure crosses it, so the segment test truncates all of them, wherever in the far region the fence landed. That mechanism has a signature the covering story does not — insensitivity to ε — and it holds where we can measure it: sweeping ε over a 20×20× range on the pendulum (0.10.1 down to 0.0050.005) leaves the returns and violation counts bit-identical, and on the cart they are identical from 0.250.25 down to 0.050.05. It is not unconditional: at ε=0.01 =0.01 two of four cart seeds record a second violation, the strip between the boundary and the fence having grown wide enough for a real contact that no imagined segment crosses. So the supported 1D statement is a separation fact with a measured range of validity, not a covering number of 11. The topological contrast with 2D is then the real one: removing one arc leaves a circle connected, so no single fence can separate a disc patch’s inside from its outside, and the cut number jumps from 11 to 22 before any metric question arises. • 2D: the bounded quantity is the distinct fence count, and it is a quarter of the budget. A disc patch of radius R has its fence locus inside the disc and its entry barrier on ∂disc∂\,disc. A fence at a boundary point ε -covers an arc of angular width 4arcsin(ε/2R)4 ( /2R), so a circle’s packing number at R=1R=1, ε=0.5 =0.5 is 12 and its covering number is 77 (both brute-force verified in scripts/circle_covering_number.py, which also exhibits the 12-point sequence and checks that one fewer ball does not cover). PatchField2D is bi-modal, so the budget for an episode that touches both patches is 2424, not one circle’s 1212. Against that budget, what the proposition bounds is the number of new-coverage fences, and measuring it per episode (scripts/fence_separation_census.py) gives the comparison the proposition asks for. The distinct fence count never exceeds 2/5/62/5/6 at knobs (2,6)/(3,7)/(4,8)(2,6)/(3,7)/(4,8) — at most a quarter of the 2424-fence budget. The raw violation counts are much larger and are dominated by duplicates: the two worst episodes record 2828 violations each while placing at most 66 distinct fences, and the per-episode distribution is heavily skewed (medians 1/1/21/1/2 against means 1.05/2.65/4.251.05/2.65/4.25). A 2020-episode mean and a per-episode bound are different quantities; the bound is per episode. Measured directly as the angular spread of fence bearings per patch per episode, the median probed arc is 0%/0%/87%0\%/0\%/87\% — zero at the two near knobs because the typical episode places a single fence, and large at the far knob because the few episodes that map the boundary map most of it: no smooth progression, and that is what the instrument does. (Dividing the violation count by the fence budget — 17%/43%/68%17\%/43\%/68\% — does not measure the probed arc; it assumes saturation and restates the count as a percentage.) (A metric packing number at fixed radius is the relevant quantity because the algorithm fixes the band ε ; it is a different question from the minimal good cover of a circle by contractible arcs, which is 33 with no radius constraint and is the nerve-theoretic object paper 3 builds on. The free-centre optimum of 66 is a zero-slack tiling special to ε=R/2 =R/2 and closed balls, so it should not be read as a robust constant.) Corollary 5 (the deployment fencing cost is exponential in the boundary’s dimension). Proposition 17 is dimension-free — its proof uses only packing and covering of F — so instantiating it needs only a packing number. If F is a p-dimensional Lipschitz piece of diameter D, then Npack(F,ε)≤Ncov(F,ε/2)=O((2D/ε)p)N_pack(F, )≤ N_cov(F, /2)=O ((2D/ )^p ), so the number of pairwise new-coverage fences the mitigation can accumulate grows exponentially in the boundary’s dimension p (not the state’s). That caps a count; it is not a completion guarantee. Nothing here shows the mitigation ever closes the phantom off, bounds the time to do so, or bounds the total number of violations — duplicate fences are unlimited by this argument, and the 2D campaign observes an episode with 2424 of them (Section F.1). The packing correction changes the constant, not the order, which is why the dimensional reading survives it intact. A p=2p=2 mode surface would cost O((2D/ε)2)O((2D/ )^2) — the precise sense in which the danger is dimension-free while the fencing is not. Two caveats on instantiating the exponent. The constant hides the parametrization’s Lipschitz constant and p-volume, which matters here because the whole quantitative dispute is over a constant. And two data points (p=0p=0 and p=1p=1) cannot distinguish (2D/ε)p(2D/ )^p from any other function agreeing at p∈0,1p∈\0,1\; the exponential form is the theorem’s, not the measurement’s. We use fencing rather than repair for this cost deliberately: repair in this paper means the LLM rewriting the model from data (Section 7.1, where it fails outright on 2D regions), and the fencing cost is a planner-side quantity that leaves the model untouched. The covering-number analogue that Section 12 once listed as open now appears on both sides: gate-side for Lipschitz pairs (Proposition 14) and mitigation-side as the fencing count here. The dimensional reading is the paper’s own: the danger law’s (1−r)N(1-r)^N is dimension-free, but fencing a mode at deployment time costs a packing number of its fence locus, which grows with that locus’s dimension. F.1 The 2D mitigation: a partial collapse, and lock-in at the far knob The distrust-region fence generalizes to PatchField2D (scripts/continuous_mitigation_patch2d.py): fences are the 2D positions of refuted predictions, which lie inside an unreachable patch (the stay-at-previous-position clamp forces a refuted prediction strictly inside the disc, so fencing it cannot cut off any real trajectory), and a candidate rollout truncates when an imagined step segment passes within ε of a fence (segment-to-point distance, leap-proof); the 1D code path is preserved behaviorally bit-identically — the generalization rewrote the shared internals, so this is pinned by tests rather than by the diff: the no-violation case reduces to plain MPC exactly, and the 1D mitigated episodes with violations are golden-pinned to the run the sweep used (tests/test_mitigation_1d_regression.py). But the collapse is now partial and decays with patch distance (Table 11): pc_blind ≈1.006≈ 1.006 falls to pc_mit 0.257/0.541/0.8620.257/0.541/0.862 at knobs (2,6)/(3,7)/(4,8)(2,6)/(3,7)/(4,8), with mean violations 1.05/2.65/4.251.05/2.65/4.25 (against the 1D instruments’ clean 1.01.0) and first contact at step 8.5/12.35/15.258.5/12.35/15.25. A boundary-mapping transient — the planner rounding one fence disc, re-contacting the edge elsewhere, accreting fences along the probed arc — is the benign reading of those means, and the per-episode data refute it; the difference matters because what replaces it is a different failure mode, not a slower version of success. The distributions are skewed, not shifted: medians 1/1/21/1/2 against those means, with two episodes recording 2828 violations. And a growing fraction of episodes end pinned at blind-level return — 0/200/20, 2/202/20, /7/20 across the three knobs — with every episode of ≥5≥ 5 violations returning near zero. In those episodes the agent is frozen against a patch edge and re-violates at the same predicted point every remaining step: at (4,8)(4,8), one episode records 2424 consecutive fences at an identical position. The mechanism is the tie-break. With a fence a few hundredths away, every candidate truncates at the first imagined step, so the ranking falls through to distance-to-nearest-fence — an unsigned scalar, which in 1D can only mean fleeing the mode but in 2D is symmetric between rounding the patch and plunging through it. So the mitigation does not merely decay with distance: at the farthest knob it fails outright in a third of episodes, and what remains of the decaying-transient reading is the near knob, where the median episode places one fence and the collapse is clean. This is the scope of a hard-boundary mitigation on a curved 2D mode: the one-sided fence is sound (a refuted prediction lies inside an unreachable patch, so fencing it cannot cut off a real trajectory) and it works where the geometry lets an unsigned tie-break point away from the mode. It does not survive a boundary the agent can be pinned against. Fixing that needs a signed away-direction in 2D — the fence’s outward normal rather than its distance — which is a design change we have not tested, not a re-tuning. (k1,k2)(k_1,k_2) pc_blind pc_mit mean viol. first contact (2,6)(2,6) 1.006 0.257 1.05 8.50 (3,7)(3,7) 1.006 0.541 2.65 12.35 (4,8)(4,8) 1.006 0.862 4.25 15.25 Table 11: PatchField2D mitigation sweep (paired seeds). The collapse is partial and degrades with patch distance. Read the means with the distribution beside them: medians are 1/1/21/1/2, maxima 2/28/282/28/28, and the count is dominated by duplicate fences (at most 2/5/62/5/6 distinct positions per episode). The degradation is not a longer transient but a growing fraction of outright failures — 0/200/20, 2/202/20, 7/207/20 episodes end pinned at blind-level return (scripts/fence_separation_census.py). Appendix G Multi-mode gates: the sharp bracket, and the measured dependence Remark 6 (the bracket is tight, and exact factorization is a property of the gate). The bracket is not merely valid but sharp: its ends are the Fréchet–Hoeffding bounds for Pρ(R1∪R2)P_ρ(R_1∪ R_2) given the marginals, pushed through the increasing map x↦xNx x^N, so no bound expressible in r1,r2r_1,r_2 alone can be tighter — the interval is the exact range of joint miss probabilities consistent with the marginals. Both ends are attained, at the two Fréchet–Hoeffding couplings of the intersection. The upper one is attained when one event contains the other (Pρ(R1∩R2)=min(r1,r2)P_ρ(R_1∩ R_2)= (r_1,r_2), whence r∪=max(r1,r2)r_∪= (r_1,r_2)). The lower one is attained at the minimal intersection Pρ(R1∩R2)=max(0,r1+r2−1)P_ρ(R_1∩ R_2)= (0,\,r_1+r_2-1), which is disjointness only when r1+r2≤1r_1+r_2≤ 1; if r1+r2>1r_1+r_2>1 the two events cannot be disjoint, the minimal intersection is r1+r2−1>0r_1+r_2-1>0, and the attaining configuration is r∪=1r_∪=1 — a joint miss probability of 00, which is again the bracket’s lower end (1−min(1,r1+r2))N (1- (1,r_1+r_2) )^N. Our knobs are all in the first regime (r1+r2≤0.26r_1+r_2≤ 0.26), so disjointness is the attaining case there. This is the point of the bracket: it is the correct distribution-free statement about a multi-mode gate, replacing an independence assumption with no assumption at all, at the price of an interval instead of a point — and the interval cannot be narrowed without measuring something beyond the marginals (which is what r∪r_∪, or equivalently Pρ(R1∩R2)P_ρ(R_1∩ R_2), is). The lower end is attained in our data — at six of the nine PatchField2D knobs no rollout out of 600 contacts both patches, so the measured r∪r_∪ equals r1+r2r_1+r_2 exactly there (Table 3; a censored zero, so read it as P(both)<1/600P(both)<1/600). Note that moving the modes apart pushes the joint factor towards that lower end rather than towards the product: disjointness is the opposite of independence, not a route to it. It is tempting to say that a stratified gate — independent rollout budgets N1,N2N_1,N_2 aimed at the two mode regions — buys the product back. It does not, and the reason locates the obstruction. For a stratified gate with per-stratum policies ρi _i, P(joint miss)=∏i(1−Pρi(R1∪R2))Ni≤∏i(1−ri′)Ni,P(joint miss)= _i (1-P_ _i(R_1∪ R_2) )^N_i\;≤\; _i(1-r_i )^N_i, where ri′=Pρi(Ri)r_i =P_ _i(R_i) is stratum i’s own rarity, with equality iff no stratum’s rollouts can reach the other mode without also reaching their own (Pρi(Rj∖Ri)=0P_ _i(R_j R_i)=0 for j≠ij≠ i) — a strong extra hypothesis that PatchField2D itself violates, since under the gate policy a rollout contacting one patch sometimes contacts the other. Stratification factorizes over strata, which the unstratified draws already were (they are i.i.d.); what it does not remove is the within-rollout dependence between R1R_1 and R2R_2, and that is what blocked the product in the first place. And the advice would be circular anyway: aiming budgets at the mode regions presupposes knowing where they are, which is exactly what the danger law assumes you do not. One undirected random budget earns the bracket; so, in general, does a stratified one. Section 4.2 measures both ingredients on the bi-modal instrument, but it is worth being exact about which parts of that measurement can fail and which cannot. Because r1r_1, r2r_2, r∪r_∪ and P(both)P(both) are estimated from the same rollouts, inclusion–exclusion holds identically in the plug-in estimates: the bracket contains the measured joint factor and the sign rule gets the direction right at all nine knobs by algebra, with a residual of exactly 00. Those are consistency checks on the arithmetic, not confirmations of the proposition. The falsifiable content is the dependence itself, and at the 600600 rollouts of Table 3 it was not resolvable: P(both)P(both) counts were 00 to 33, six of them censored zeros, so the observed −17%-17\% to +12%+12\% spread of the product’s error was consistent with pure count noise and the direction of the dependence was unresolved. We therefore measured it properly, at 50,00050,000 rollouts per knob (scripts/patch2d_dependence_50k.py), and the sign does change across the grid with non-overlapping Wilson intervals in both directions: at (2,6)(2,6), P(both)=8.6×10−4P(both)=8.6× 10^-4 with 95%95\% interval [6.4,11.6]×10−4[6.4,11.6]× 10^-4 against r1r2=19.0×10−4r_1r_2=19.0× 10^-4 — negative dependence, the product over-estimating the joint hit rate — while at (4,6)(4,6), P(both)=12.8×10−4P(both)=12.8× 10^-4 with interval [10.0,16.3]×10−4[10.0,16.3]× 10^-4 against r1r2=6.2×10−4r_1r_2=6.2× 10^-4, positive dependence in the opposite direction. At (3,7)(3,7) the dependence is negative again (4.4×10−44.4× 10^-4, interval [2.9,6.7]×10−4[2.9,6.7]× 10^-4, against 8.0×10−48.0× 10^-4), and at (4,7)(4,7) the interval straddles the product and the knob is genuinely undecided — so three of four knobs are resolved and they do not agree on the sign. So a product form cannot be rescued by a fixed correction factor: the sign of its error is a function of the geometry, which is exactly why the sharp bracket is the right object. The practical reading is that a multi-mode danger law needs the union event measured (or the bracket, which needs only the marginals), never the marginals multiplied. Appendix H The residual reward leak, and the sharp-plateau variant The residual leak is a reward artifact, not a mechanism fact — measured, not argued. At the widest knobs the pinned planner scores above the uniform-random policy (cart xwall=10x_wall=10: Jblind=0.94J_blind=0.94 against Jrand=0.53J_rand=0.53; the three farthest pendulum stops likewise), which is why the claim above is “exploited at every knob” rather than “below random at every knob”. The cause is the far plateau’s sigmoid tail: a planner pinned at x=10x=10 still collects 1/(1+e(12−10)/width)1/(1+e^(12-10)/width) per step, which at width=0.5width=0.5 is 0.0180.018 and over 80 steps is most of JblindJ_blind. A sharp-plateau variant (scripts/continuous_sharp_plateau.py, cart width 0.5→0.20.5→ 0.2, pendulum 0.25→0.10.25→ 0.1; sibling JSONs, the default instruments and every synthesis artifact untouched) removes the tail and settles it: • The exploitation claim strengthens. On the cart the blind planner is below random at 7/7 knobs instead of 6/7, by two to thirteen orders of magnitude (JblindJ_blind from 2.3×10−132.3× 10^-13 to 2.4×10−32.4× 10^-3 against Jrand=0.532J_rand=0.532); on the pendulum, 5/6 instead of 3/6 — and 6/6 with the asymmetric variant below. • play_cost becomes knob-invariant to ≈1.5×10−4≈1.5× 10^-4: cart [1.0307,1.0309][1.0307,1.0309] (spread 1.4×10−41.4× 10^-4, against the default’s 5.5×10−25.5× 10^-2) and pendulum [0.9999,1.0000][0.9999,1.0000] (spread 1.5×10−41.5× 10^-4, against 6.1×10−26.1× 10^-2) — a 400×400× tightening on both, i.e. the invariance the default sweeps show approximately is exact once the tail is gone. • The planner-competence cost is negligible, the risk recorded with the variant’s script: a sharper plateau gives random shooting less gradient to follow, yet JtruthJ_truth moves only 17.77→17.7617.77→ 17.76 (cart) and 20.08→20.0520.08→ 20.05 (pendulum), and contact stays 1.001.00 at every knob. • The residue, and its fix. Narrowing both plateaus starves the random policy too (JrandJ_rand collapses to 3.6×10−43.6× 10^-4 on the pendulum), which is why one knob there still reads above random: at θstop=2.0 _stop=2.0, Jblind=3.1×10−3J_blind=3.1× 10^-3 against that collapsed baseline. The diagnosis says what to do — narrow only the phantom plateau, whose tail is what a pinned planner collects, and leave the real one at its default width. That variant (widthright=0.08width_right=0.08, per-plateau widths; --width-right) gives 6/6 knobs below random: JblindJ_blind between 4.3×10−44.3× 10^-4 and 7.1×10−47.1× 10^-4 against a surviving Jrand∈[0.0572,0.0584]J_rand∈[0.0572,0.0584], with JtruthJ_truth unchanged at 20.0820.08, contact 1.001.00 everywhere, and play_cost in [1.0028,1.0029][1.0028,1.0029] — a spread of 7.1×10−57.1× 10^-5, tighter still than the symmetric variant and 850×850× tighter than the default. So on both instruments the strong form holds: exploited, pinned, and below random at every knob, with play_cost invariant to 10−410^-4, once the phantom’s tail is gone. So the mechanism does not depend on the leak, and the knob-invariance claim is the one that sharpens: it is exact, not approximate, in the instrument without a tail. Appendix I The ε -sweep: the axis separation is tolerance-invariant Is ε=0.01 =0.01 a special setting, or is the axis separation itself ε -invariant? A sweep over ε∈10−9,10−6,10−4,10−3,10−2,3×10−2,0.1,0.3 ∈\10^-9,10^-6,10^-4,10^-3,10^-2,3×10^-2,0.1,0.3\ (scripts/continuous_eps_sweep.py; Table 12 for the cart, full grid in docs/EXPERIMENTS.md) answers: ε -invariant. Mode-arm reveal-rarity is flat across the entire grid — on the cart, wall@8 is bit-identically flat through the whole grid including ε=0.3 =0.3, and wall@4 only dips slightly (never widens) at the top of the grid. The pervasive bias arms switch sharply at their own error scale on both instruments instead. ε wall@8 rarity bias ×1.03 rarity bias ×2.0 rarity 10−610^-6 0.0125 1.0000 1.0000 10−210^-2 0.0125 <0.0019<0.0019 1.0000 0.1 0.0125 <0.0019<0.0019 0.0040 0.3 0.0125 <0.0019<0.0019 0.0040 Table 12: Reveal-rarity vs. ε (cart). The mode arm is flat across the whole grid; the pervasive arms switch at their own error scale. The pendulum replicates both halves: its mode arms are flat too (only a slight dip at the top of the grid — stop@1.0 rarity 0.1410 at ε≤3×10−2 ≤ 3×10^-2, dipping to 0.1400 at ε=0.1 =0.1 and 0.1240 at ε=0.3 =0.3), and its bias arms switch at the same error-scale boundaries as the cart’s. pass@40 ≈(1−r)40≈(1-r)^40 continues to hold for the mode arms at every ε in the grid, on both instruments. (The sweep’s own rarity column is measured on 2000 rollouts per cell, since what it has to establish is flatness in ε rather than a third digit; the 20,000-rollout estimate of the same quantity in Table 4 is 0.01030.0103 against this sweep’s 0.01250.0125, one estimate’s noise apart.) play_cost is not re-measured across ε : the model under test does not depend on the gate’s tolerance, so play behavior is ε -independent by construction — the sweep varies only what the gate can see. The gate’s ε is a pervasive-error dial, not a mode-detection dial: tightening it cannot catch the hard mode, and loosening it does not widen the hole. The 4D bi-modal instrument replicates the flat mode arm, once per mode. On PatchField2D the ε -sweep (scripts/continuous_eps_sweep_patch2d.py) gives exactly flat mode-arm reveal-rarity across the entire grid: patches-omitted 0.1470.147, patch-1-only 0.1420.142, patch-2-only 0.0050.005 — each constant at every ε . The per-mode arms recover the per-mode rarities of the mechanism sweep (Section 4.2), so the tolerance axis is orthogonal to the mode hole on the bi-modal instrument too, and separately for each mode. Appendix J Bounded observation noise: the gate law survives to a measured masking boundary The gate above accepts on exact equality, which is well-defined only because the instruments are deterministic and observed without noise. This section measures what replaces the exact statements under known bounded observation noise, with the design, critical event, unit, thresholds and seed mapping frozen before the run (results/h7_noisy_gate_prespec_v1.json; the result JSON records that pre-specification’s SHA-256). Design. Observed next states and rewards carry independent coordinatewise Uniform[−η,η]Uniform[-η,η] noise at the seven pre-specified levels η∈0,0.01,0.03,0.1,0.3,1,3η∈\0,0.01,0.03,0.1,0.3,1,3\; exact matching is replaced by support compatibility (the noisy observation must lie in the candidate’s bounded support). The candidates are the CartWall@4 truth and its analytic mode-blind proxy — this is a gate-law measurement, not a new synthesis campaign. Under the uniform-noise hypothesis the conditional per-scalar overlap probability is exact, q(δ,η)=max(0, 1−|δ|/(2η))q(δ,η)= (0,\,1-|δ|/(2η)) for a truth-vs-candidate discrepancy δ (with the η=0η=0 equality limit), and multiplies over coordinates and transitions; independent noise then gives one empirical Bernoulli verdict per block. The unit is the disjoint 2020-rollout seed block, 200200 blocks on a fixed latent panel (189189 of 200200 contain the mode; 18161816 contact transitions); neither the 40004000 rollouts nor the 320,000320,000 transitions are treated as independent (scripts/h7_noisy_observation_gate.py, results/h7_noisy_observation_gate_v1.json). η truth passes blind passes exact CP9595 analytic conditional 0–0.1 200/200 11/200 [0.0278,0.0963][0.0278,0.0963] 0.0550 0.3 200/200 11/200 [0.0278,0.0963][0.0278,0.0963] 0.0556 1 200/200 32/200 [0.1121,0.2183][0.1121,0.2183] 0.1582 3 200/200 106/200 [0.4583,0.6008][0.4583,0.6008] 0.5029 Table 13: Support-compatibility gate under bounded observation noise, per seed block. The four levels η∈0,0.01,0.03,0.1η∈\0,0.01,0.03,0.1\ are identical to four digits and are shown as one row. Readings. The correct model passes every block at every level. The pre-specified primary criterion — an analytic blind-pass increase of at most 0.010.01 at η=0.1η=0.1 relative to η=0η=0 — is met with an increase of exactly 00 on this panel, so bounded noise through the primary level masks no additional block: the noiseless equality statement becomes a support-probability statement with the same content. The first pre-specified level whose increase exceeds the frozen +0.05+0.05 boundary is η=1η=1, where the analytic conditional blind-pass probability is 0.15820.1582 and the independent noise realization accepts 32/20032/200 blocks — sufficiently wide support measurably hides mode discrepancies, and the boundary at which it starts is now a number rather than a caveat. These are conditional evaluations on the fixed latent panel, not population-prevalence estimates; process noise, an unknown noise law, a planner rerun under noise, and an externally specified benchmark remain open (Section 12). Appendix K Cross-family arms, and a fourth artifact class Cross-family spot-checks (two families). Qwen (HF router, Qwen/Qwen3-Coder-30B-A3B-Instruct, 3 seeds): the full arm is clean (3/3 gate 1.000, blind 0.0), so the pinned-integrator premise is not GPT-specific; on the incomplete arm the identifiability branch reproduces (the 1/3 wall-absent seed is gate-1.000 wall-blind and exploited, play_cost 0.999), but Qwen repaired neither of its two wall-present seeds (gate 0.999 and 0.491, both superstitious patches the gate refused). Claude (Sonnet, agent-relayed via the companion paper’s protocol on scripts/continuous_claude_step.py — verbatim pipeline messages relayed to fresh, context-free instances per message, same ε=10−9 =10^-9 gate and MPC play as the API arms; seeds 10000/20000/30000 plus one full control per instrument; results/continuous_claude_relay.json): both full controls are clean (2/2 gate 1.000, blind 0.0, play_cost 0.0), and both mode-absent seeds are accepted fully blind and exploited (cart play_cost 0.999, pendulum 0.995) — the identifiability event fires family-independently, as Proposition 5 requires. On repair Claude is neither GPT-5.x nor Qwen: cart seed 20000 repaired the exact one-sided rule in 1 iteration, and cart seed 30000 repaired at iteration 5 after a period-2 oscillation (symmetric ±8± 8 walls → both removed → symmetric again → removed → one-sided correct), but pendulum seed 20000 was accepted in 1 iteration carrying an invented mode (next paragraph) and pendulum seed 30000 stalled at 5 iterations (gate 0.9972), oscillating between the symmetric-stop and no-stop artifacts without ever finding the one-sided rule. So across three families the mode-absent blind-and-exploited event fired for every one (it is a property of the sample; Proposition 5), while repair-from-data is model-dependent in mechanism, not merely in rate: GPT-5.x recovers the revealed clamp in almost every case (105 of 111 draws exactly; four more add a phantom stop the probe cannot see, two stall), Qwen recovers none (superstitious local patches), and Claude recovers most but through a symmetry prior that generalizes one-sided evidence into a symmetric pair of boundaries — a prior GPT-5.x also exhibits, in four artifacts across both sizes, so the class is not family-specific. A fourth artifact class: accepted while carrying an invented mode its gate sample cannot refute. A symmetry-or-landmark prior produces an outcome beyond the correct/blind/superstitious-patch trichotomy. It is clearest in the Claude arm, and it is not confined to it: four GPT-5.x artifacts on the pendulum’s headline knob do the same thing (Section 7.1). Where the training sample covers the invented side, the gate refutes the phantom and the memoryless refine loop oscillates (cart seed 30000’s period-2 cycle above; pendulum seed 30000’s stall at gate 0.9972). But where the sample is silent on the invented side, the phantom is unfalsifiable: pendulum seed 20000 was certified at gate 1.000 in a single iteration while carrying a phantom symmetric stop at θ=−1.4θ=-1.4 that this seed’s rollouts never reach (verbatim elif th2 < -th_max: th2 = -th_max; om2 = 0.0, the second branch of a symmetric pair, with th_max = 1.4 its own constant) — a verified artifact, exact on every sampled transition, that nonetheless encodes a hard stop which does not exist. This is a clean natural experiment: the same symmetric artifact was refuted at pendulum seed 30000 and certified at seed 20000, the only difference being whether the sample covered θ<−1.4θ<-1.4. It is Proposition 5’s prior caveat measured directly — on inputs the sample never touches, the artifact’s content comes from the model’s prior, and the gate cannot police it. Note the classification did not flag it: the mode_blindness probe scored 0.0 (correct) because it probes only the true +1.4+1.4 mode’s region; code inspection, not the probe, caught the invented mode (Section 12). Qualifications on the Claude arm. (i) Agent-relayed means an agent scaffold over a subscription transport, not an API, though the relayed messages are byte-identical to the pipeline’s; in the two multi-iteration cells a handful of refinement replies prefixed a one-line explanation before the code block (two distinct sentences, repeated across the oscillation) despite the output-only-code instruction; the code block still parsed, and no relay was refused. (i) The refine loop is memoryless in the API arms too — refine_continuous sends a single user message per iteration (src/cwm/continuous/contract.py) — so the oscillation is protocol behavior, not a relay artifact. (i) n is small: 3 seeds plus one control per instrument, one alternate family. The branches compose into the paper’s central claim. With the mode in the data, the synthesize–refine–gate loop recovers the exact mode or refuses the artifact — correct relative to every transition the sample covered, which is the only sense of correctness the gate defines (sample-covered exactness is the acceptance criterion itself; the empirical, code-inspected regularity — not a theorem — is that every accepted artifact’s off-sample content was also the true mode, except Claude’s phantom pendulum stop, which errs only where its sample is silent: the Proposition 5 prior caveat, not a gate failure). With the mode absent, no loop can help (Proposition 5: the sample carries no evidence for the mode — though a prior or the specification still could supply it), and the acceptance of a blind artifact is not a failure of the LLM, the refinement, or the gate implementation — it is the sampling event whose probability is exactly (1−r)N(1-r)^N. The discrete danger law had a provable core plus an empirical residual (the rule not learned even when shown); on the continuous 1D instruments the residual can vanish — it does for GPT-5.x on all but four of the clamps it was shown — so the law becomes the entire failure surface for a capable-enough synthesizer, and shrinks toward it even for a weaker one (this is geometry-scoped: Section 7.1 shows the residual returns on a 2D circular mode, where even GPT-5.x does not repair). The actionable consequence sharpens correspondingly: in this regime, spec completeness and gate-sample coverage are not two independent worries — coverage is the dominant worry, because the synthesis loop repairs what the sample reveals. (Scope: 20 seeds/cell on the headline cell, both GPT-5.x sizes; the wall-absent conditional is 20/20 across sizes and consistent across three independent runs — the 5-seed first run, the 20-seed tightened run, and the 3-seed Qwen run; the wall-present repair rate is 20/20 for GPT-5.x on this cell, 0/2 for Qwen, and mechanism-dependent for Claude (exact on both cart seeds, one via a period-2 oscillation) — model-dependent, small-n on the cross-family arms. LLM synthesis is stochastic across calls; the three-way structure and the identifiability conditional are stable run-to-run, per-seed iteration counts are not.) Appendix L The 2D artifacts: a code and behavioural audit, and three ablations The mechanism: translation succeeds, induction of the boundary collapses. A 76-artifact code inspection locates the failure precisely. Plant translation succeeds: ≈74/76≈74/76 artifacts reproduce the exact 4D semi-implicit integrator and the reward. What collapses is induction of the 2D circular boundary. The dominant modal failure (38/7638/76) is dimensional reduction: the disc is modeled as a half-plane — a 1D CartWall-style clamp at the right location but the wrong shape, e.g. substituting if x2 > 4.0: ... for a circle — learning the freeze mechanic but not its circular trigger. The remaining classes: 20/7620/76 pure-blind (no patch logic), 9/769/76 superstitious local patches, and 9/769/76 disc-form attempts, none of them correct. The ε -exactness alternative — that correct-form discs merely failed the 10−910^-9 arithmetic gate — is falsified: no correct-form disc failed on arithmetic; the discs that failed were the wrong shape. A behavioral audit confirms this hand inspection on every claim (scripts/patch2d_artifact_audit.py: probe each artifact’s step() on a state grid, classify the shape of its deviation-from-integrator set): 39/76 half-plane-form, 13 behaviorally blind, 8 disc-form, 7 measure-zero textual traps, 4 point, 3 square-form, 2 bounded-other; integrator arithmetic exact in 74/76; and — the point that matters for partial repair — no artifact encodes its seen patch. On the see-one-miss-the-other branch (the 66 seeds where a partial repair is even definable), 2828 freeze sets do contain the seen patch (coverage >0.9>0.9), but they contain it the way a half-plane contains a disc: their frozen area runs from 15×15× to 81×81× the patch’s own ≈1.2%≈1.2\% share of the probed box (median 61×61×). Exactly one artifact is even patch-selective — seed 180000 covers its seen patch and leaves the unseen one below 0.10.1 — and it does so with a half-plane freezing 31×31× the patch area, i.e. by where its threshold happens to fall between the two patches, not by encoding a region; its gate score is below 11 like every other see-one artifact. The missing partial repairs were therefore never attempted as regions at all, rather than attempted and refused by the gate. The two class counts differ by exactly one artifact (39 vs 38 half-plane, 8 vs 9 disc-form) and the difference is a syntax-versus-behavior reading, not a disagreement about any artifact’s correctness: two artifacts (mini k=(3,7)k=(3,7), seeds 130000 and 150000) write a radial predicate anchored at the reward lodes rather than at a patch — if hypot(x-(-6),y) <= 2 or hypot(x-12,y) <= 2 in one, a reward-threshold freeze in the other — so hand inspection reads the disc in the source while the audit reads the deviation set, which is unbounded inside the probed box. Both readings agree that neither artifact encodes a patch; only the label moves. Ablation 1: richer prompting and 3×3× budget do not restore repair — they change the failure class. The natural confound is that the prompt was too poor and the budget too small. The strongest joint treatment (120 examples, 40 failure lines, describe-the-region-first guidance with an explicit “the region need not be a 1D threshold” de-bias, and 15 refine iterations; identical samples to the original run) yields 0/40 repair at k=(3,7)k=(3,7), both sizes. The guidance works as prompt engineering: the half-plane reduction disappears (0/40, versus 21/40 in the matching base cells) and the artifacts now write bounded 2D regions — rotated ellipses (∼15/40 15/40), rectangles (∼10/40 10/40), unions of micro-discs (∼5/40 5/40) — but none is the true disc. The new failure class is evidence-hull fitting with two compounding errors: they fit the hull of the observed freeze positions (the pre-freeze crescent hugging the disc’s reachable west boundary from outside: fitted centers pulled west to x≈2.3x≈ 2.3 against the true x=3x=3, i.e. dragged onto the evidence at the patch’s west edge), and 36/40 condition on the current position rather than the landing (x2,y2)(x_2,y_2) — the causal variable of the rule. The sample itself then refuses every wrong shape. Ablation 2: an axis-aligned square with flat edges — curvature did not suffice to explain the failure. This ablation was added after the disc result it responds to (Section Q dates every such addition). If the failure were about curved boundaries, an axis-aligned square patch (a Chebyshev ball, max(|x−cx|,|y−cy|)≤R (|x-c_x|,|y-c_y|)≤ R — a max/abs predicate, no quadratic) should be repairable. It is not: with the same pipeline at k=(3,7)k=(3,7) the full arm is clean (20/20 at zero refine iterations, both sizes — translating the square clause is as easy as the disc’s) and the incomplete arm gives 0/40 repair (every sample mode-containing; best gate 0.99620.9962). The classes mirror the disc’s, reflected: the dominant failure is again dimensional reduction (the square’s west edge as a 1D threshold, if x2 >= 2.0), and several artifacts commit the inverse error — writing discs on square evidence (radial hypot guards at the edge midpoint, micro-disc unions), plus reward-anchored superstitions (freeze zones invented at the lodes). Zero artifacts write the true box or its max/abs form. Across the four treatments (two disc knobs, the square ablation, the guided/3×3×-budget treatment) that is 0 of 156 mode-containing synthesis draws, and the sampling unit makes those 156156 draws 20 distinct gate-sample blocks: changing the disc knob or the prompt variant reuses a block’s random stream byte for byte, so k=(3,7)k=(3,7) and k=(5,9)k=(5,9) are two treatments over the same blocks rather than 3838 samples. The bound the evidence supports is therefore per block: an exact (Clopper–Pearson) 95%95\% upper bound of 0.1680.168 on the probability that a fresh mode-containing gate sample is repaired by any attempt run on it (Wilson 0.1610.161). Pooling the 156156 draws as independent trials would have claimed 0.0230.023, 7.2×7.2× tighter than the evidence supports; we report the per-block figure and the per-treatment counts separately (scripts/paper2_statistics.py), never a single pooled interval. Ablation 3: two further model-family spot-checks, at tiny n, fail in the same classes. The three campaigns above are GPT-5.x only, so the collapse could be one family’s idiosyncrasy. A Claude arm on the headline cell says otherwise (agent-relayed as in Section 7; Sonnet, k=(3,7)k=(3,7), three mode-containing seeds — two see-P1P_1-miss-P2P_2, one seeing both — plus one full control, same N=40N=40 sample, same ε=10−9 =10^-9 gate, same five-iteration memoryless refine loop). The full control is clean at iteration 0 (gate 1.000, both discs written on the landing position, blindness 0.0, play_cost 0.0): translation is not the problem here either. No incomplete seed repaired (0/3), and the trajectory carries more information than the outcome: each seed spends its five iterations in a period-2 cycle between the pure-blind artifact and a wrong template, returning to its iteration-0 gate value exactly on every even iteration (seed 10000: 0.99340.9934 blind → 0.95910.9591 disc-on-current-position → 0.99340.9934 → 0.92840.9284 half-plane → 0.99340.9934 → 0.70440.7044 reward-threshold; seed 20000: blind 0.9962↔0.9962 half-plane 0.94060.9406, three times over; seed 30000: 0.9966→0.67500.9966→ 0.6750 reward-zone →0.9966→0.8406→ 0.9966→ 0.8406 half-plane →0.9966→0.5328→ 0.9966→ 0.5328 y-band). The template set is the one the GPT-5.x campaigns exhibited — 1D threshold, radial disc on the wrong (current, not landing) variable, reward-landmark zone, axis-aligned band — and no incomplete iteration in any seed wrote a disc on the landing position, the form this same model writes immediately when the contract states it. The constants replicate Ablation 1 quantitatively: every half-plane sits at x=2.0x=2.0, the disc’s west edge — “the right location, the wrong shape” — and the one radial attempt fits center (2.328,−0.135)(2.328,-0.135) with radius 0.8240.824, i.e. the hull of the observed freeze crescent: the true patch is the disc of radius 11 about (3,0)(3,0), spanning x∈[2,4]x∈[2,4], while the fitted one spans x∈[1.50,3.15]x∈[1.50,3.15] — dragged west onto the evidence, so it covers the patch’s west half, misses x∈[3.15,4]x∈[3.15,4] entirely, and freezes free space over x∈[1.50,2]x∈[1.50,2]. Its center sits inside the true patch but at the wrong place (0.690.69 from the true center), with radius 0.8240.824 against 11. That is the same x≈2.3x≈ 2.3 signature the guided GPT-5.x artifacts produced. Per-iteration gate accuracies and rule classes are re-derived from the versioned transcripts by scripts/claude_relay_ledger.py. Two qualifications. (i) n=3n=3 seeds, one alternate family on the incomplete arm: this closes the “GPT-only” confound, it does not sweep models. A third family (Qwen) contributes a matched contrast on this instrument: both arms, three seeds each, run against a single pinned backend — our own vLLM 0.26.00.26.0 serving the bf16 checkpoint at a recorded Hub revision, with the checkpoint’s own generation_config applied identically to both arms (results/qwen_vllm_provenance.json; server in scripts/modal_qwen3coder_vllm.py). Under that one configuration the translation control is clean (3/33/3 at gate 1.0001.000, zero refinement iterations) and the incomplete arm is refused in 33 of 33 seeds (accuracies 0.9930.993 to 0.9970.997, refinement maxed, the mode present in every training block, none accepted by the independent gate) — the family’s 1D stall-and-refuse class. An earlier first pass had mixed serving paths (HF-router full cells, vLLM incomplete cells) and is retained versioned as an exploratory unmatched spot-check; its incomplete cells reproduce the matched arm’s gate accuracies to three decimals, but the contrast the text draws is the matched campaign’s. At n=3n=3 per arm this is an exploratory diagnostic of a third family, not a cross-family replication. That control is clean: 3/3 gate 1.000 at zero refinement iterations, both discs written exactly on the landing position, per-patch blindness 0.0. Across all three families, then, stating the region rule is easy and inducing it from data is what fails; the induction evidence on this instrument is GPT-5.x’s 156 seeds plus Claude’s 3. (i) The relay caveats of Section 7 apply, plus one specific to this arm: the relayed instances were instructed not to use tools or read files, so each artifact is a function of the pipeline message alone (the ground truth lives in this repository, so an instance reading it could have copied the true centers and radius instead of inducing them). The wrapper text is recorded verbatim in results/claude_relay_transcripts/patch2d_k3_7_RELAY_FRAMING.txt, together with the post-hoc leak check: no incomplete artifact wrote the true disc form at all, and none names the unseen far patch — the signature repository access would have left. Appendix M The eight ablations on the 2D mode, campaign by campaign Ablation 4: trigger arity, and why it does not answer the question it was built for. The slab campaign holds the plant, the action parametrization, the lodes, the evidence side, the prompt and the budget fixed and changes only the predicate’s arity, from a region in two landing coordinates to a band in one, with rarity matched by moving the mode as every other instrument in this paper matches it (the calibrated impermeable configuration: half-width 0.50.5, centre 5.55.5, giving r1=0.128r_1=0.128 against the disc’s 0.1320.132 and play_cost=1.006play\_cost=1.006 against 1.0061.006). Translation is trivial, as it must be for the ablation to be admissible: the full arm is /40/40 at gate 1.0001.000 in zero refinement iterations, both sizes, with every mode encoded. The incomplete arm then produces the paper’s most instructive artifact class. By the criterion this paper has used for repair, gpt-5.4 repaired 19 of its 20 mode-containing seeds. It recovered the rule in none of them. All 1919 are behaviourally the same artifact: the half-plane x2 >= 5.0 at the slab’s near face. It passes the gate at ε=10−9 =10^-9 on its own sample, passes an independent acceptance sample and an independent 100100-rollout evaluation sample at the same tolerance, and scores 00 on the mode-blindness probe — while freezing 4.6×4.6× the true region’s area and agreeing with the truth on only 22%22\% of the union of the two freeze sets. It is not a failure of induction: by Proposition 7 it is exactly consistent with every sample this instrument can produce, so it is the correct inference from the available evidence, and by part (i) of that proposition its play cost is 00, which is what is measured. The gpt-5.4-mini arm reaches the class in none of its 2020 seeds; it writes refutable rules that the gate then refuses. So the size effect here is not that the larger model repairs and the smaller does not — it is that the larger model finds the maximally-consistent rule while the smaller one does not. Ablation 5: naming the variable the trigger reads. The base campaign’s audit found 3636 of 4040 guided artifacts conditioning the freeze on the position the step began at rather than on the landing position — the rule’s actual argument — so that confound is worth removing on its own. The landing arm is the region-guided treatment with one sentence added, stating that a localized rule’s trigger is evaluated on the state the integrator would produce, and naming nothing about the region’s shape, centre, radius or count; everything else is matched to the region arm exactly (120120 examples, 4040 failure lines, 1515 iterations, the same 2020 sample blocks). It does not restore repair: 0 of 40 mode-containing draws recover the disc, over 2020 distinct blocks, for an exact 95%95\% upper bound of 0.1390.139 on the per-block repair probability, with a best agreement of 0.1470.147 against the region arm’s 0.2860.286. What the sentence changes is the failure: the dominant class becomes memorisation of the observed freeze positions — 2020 of 4040 artifacts write a region small enough to be a point on the probe grid, against 1515 of 4040 in the region arm, one of them the literal bounding box 2.01 <= x2 <= 2.17 and -0.23 <= y2 <= 0.03 of the crescent of contacts its sample happened to contain. So variable identification is not what was blocking region induction, and telling the synthesizer where to look pushes it further toward fitting the evidence exactly rather than generalising it. Ablations 6 and 7: making the region’s interior witnessable does not restore repair. Proposition 7 identifies the evidence’s censoring as an obstruction, and the natural hypothesis is that it is the obstruction. Two campaigns test it by changing where the mover ends up when the mode fires — the firing predicate itself, and therefore the rarity, is untouched, so the knob needs no recalibration; each targets the post-state alone, though dwell time and the amount of mode evidence necessarily move with it (the caption’s confound note). In landing the mover stops where it entered, strictly inside the region; in clamp it is projected onto the boundary, the 2D analogue of the cart’s wall clamp. Both break the proposition’s premise, verified on the gate sample rather than assumed: freeze yields no transition at all that separates the membership rule from an entry rule, landing yields 46144614 and clamp 233233 (scripts/calibrate_mode_effect.py). The trap survives in both (play_costplay\_cost 1.0581.058 and 1.0591.059 against freeze’s 1.0591.059, blind contact rate 1.001.00), and translation stays trivial: the full arm is /20/20 at gate 1.0001.000 in zero refinement iterations in all four cells, so even the clamp’s projection rule — the only one whose post-state is a function of the landing — is as easy to write as the others when stated. Neither restores repair. Across 4040 mode-containing draws each, over the same 2020 blocks: 00 recover the region, and — unlike every freeze campaign — no artifact passes the gate at all, which is what Proposition 7 predicts once the equivalence class is empty. The best agreement with the truth is 0.100.10 for landing and 0.260.26 for clamp, against the disc’s own 0.500.50. What the artifacts write is the same library at the same constants: the dominant class is again the half-plane (24/4024/40 and 25/4025/40) at x2 > 2.0, the disc’s west edge, with reward-landmark zones, micro-discs and velocity superstitions making up the rest. The two campaigns’ confounds run in opposite directions, which is why we ran both. landing leaves the mover inside the region, where most thrusts keep it, so its dwell time and hence the mode’s share of the sample’s transitions rise from 0.66%0.66\% to 7.25%7.25\% — eleven times more mode evidence, a confound favourable to repair, and it still fails. clamp holds that share at 0.75%0.75\%, matching freeze, and pays instead in the rule’s complexity — and it fails with the same classes. So the negative survives both the quantity of mode evidence and the difficulty of the rule. Witnessing the interior does not restore repair, so the censoring is not the operative obstruction. The censoring Proposition 7 describes is real, and it is what makes the slab’s nineteen accepted-but-wrong artifacts unfalsifiable and what bounds the reach of an independent gate; but it is not the reason region induction fails. With the interior witnessed, by two mechanisms, with more evidence and with an easier rule, the synthesizer writes the same half-plane at the same place. Of the candidate causes these interventions can separate, what is left is the region-template prior, and what the interventions add to the description is stability: the prior does not yield to evidence dose, interior witnessing, budget, or the rule’s difficulty. It remains unlocalized inside the model — the alternatives named in Section 9 (an inability to execute an algebraic fit over textual transitions, a memoryless refinement loop, the absence of a system-identification objective) are compatible with every campaign here, and no design run distinguishes among them. The exclusion matrix, versioned. results/h6_exclusion_matrix_v1.json (scripts/h6_exclusion_matrix.py) records, for each of the eight interventions: the target hypothesis, every changed variable with its unavoidable co-changes, whether a direction was recorded before the run, the experimental unit, the positive control, the observed result, and the strongest licensed inference beside the inference the design does not license. The surviving classes after all eight are the three named in Section 9 plus a residual of model-internal causes these designs do not separate. Four factorial follow-ups that would separate the remaining confounded pairs are specified in the same file: prompt guidance versus example/failure-line budget versus iteration budget (intervention 1’s three-way co-change); post-state semantics crossed with a calibrated equal contact dose (interventions 6/7); angular coverage crossed with start distribution (intervention 8); and trigger arity crossed with identifiability on a bounded one-coordinate region (intervention 4). Appendix N The coverage certificate’s scope, stated in full Coverage certificates transfer, but only to the smooth case. The companion paper’s guarantees enumerate information sets, and that enumeration has no continuous analogue. What does transfer is the covering-number version: Proposition 14 certifies supU‖f−f^‖≤ε+2Lρ _U\|f- f\|≤ +2Lρ for L-Lipschitz pairs once the gate ρ-covers U, with the sample size a covering number over a visitation density, and on the deployed cart gate it excludes a pair with L=max(Lipf,Lipf^)≤5.77L= (Lipf,Lip f)≤ 5.77 carrying the wall’s error magnitude of 4.24.2, with probability at least 1−δ1-δ over gate draws, against a rigorous bound of 0.9330.933 on the step-1 reachable set. Since the bound ε+2Lρ +2Lρ grows with L, that quantifier is the claim’s scope, and at 4.5×4.5× the plant’s own 1.271.27 it is a broad class. The step from the packing figure to that bound is a change of argument, not a new measurement: a packing bound must estimate three geometric factors (the covering-vs-packing direction, the ball’s intersection with U, and the corner factor’s failure to be shear-invariant), and a partition bound estimates none of them — on this instrument the step-1 law is uniform on a sheared box, so equal sub-boxes have probability exactly 1/K1/K. The packing route’s figure is ρ=1.165ρ=1.165 and 2.972.97, licensing only L≤1.80L≤ 1.80. The residue is that this is exactly the case the paper is not about: the reset mode has unbounded local Lipschitz constant, so no finite L makes the certificate apply to it, and the danger the paper measures lives entirely in that gap. Two questions the certificate depends on are settled, and settling them made the certificate weaker and the conclusion sharper. First, the within-rollout dependence: it needs no mixing argument and no factorization either — the per-rollout miss probability is measured directly and the i.i.d.-ness of rollouts raises it to the NNth power exactly. Composed with the partition, that is what gives the 0.9330.933 above, against 1.5341.534 from independent single samples: handling the dependence exactly is worth a factor of 1.61.6, and the invalid all-steps-independent reading’s 0.7850.785 sits a factor of 1.21.2 below the valid figure. On a box 6.7×6.7× larger the same treatment certifies net radius 1.01.0, which is the region/resolution trade-off at fixed N rather than a competing figure. Second, the density is derived at every step t≥2t≥ 2 (the last two actions make the step-t law absolutely continuous with an exact constant 1/0.0361/0.036, and a Minkowski erosion turns that into a pointwise infimum). That extends the certificate to larger regions, but at fixed N extent is paid for with resolution, and no step-t level set certifies a bound below the step-1 figure — so what limits the certificate is not the step-1 restriction but the gate’s size. The nonlinear analogue needs no new argument for the two-action factor: the Jacobian determinant is gain2dt3gain^2dt^3 identically for any C1C^1 force, so the same constant covers the cart and the pendulum — the certificate’s density hypothesis is established on the cart only and must be verified per instrument — and it degenerates only on the mode clamp, where no density argument can work because the truth maps a neighborhood to a point. And the planner-versus-gate mismatch is measured rather than argued: the box the dependence-exact certificate covers carries 1.9%1.9\% of the exploited planner’s queries, and a box containing every step-t level set carries 7.8%7.8\% — an upper bound on the certified share. What is left is therefore not a hole in the argument but its conclusion — a certificate sound relative to the L≤5.77L≤ 5.77 Lipschitz class, with probability at least 1−δ1-δ over the gate’s draws, on a region the planner barely visits. Certifying the planner’s own visitation would need a gate that samples it, which is precisely the change the companion paper’s closing prescription asks for. Appendix O The LLM protocol, in full Everything in this appendix is read off the code that produced the campaigns, not described from memory: the pipeline is scripts/continuous_danger_synthesis.py driving src/cwm/continuous/contract.py, and the per-campaign counts are regenerated by scripts/llm_protocol_facts.py into results/llm_protocol_facts.json. File and line references are as of the revision that produced results/. The agent-relayed Claude arms send the same message text through a different transport (Section O.10). O.1 The two messages A cell of a campaign is one (arm, seed) pair. It issues one synthesis call and then zero or more refine calls. In the three displays below, a trailing backslash marks a line wrapped for the page width: the string actually sent contains neither the backslash nor a newline there. Slots in braces are the template’s substitution points. System message (synthesis call only). One string, sent verbatim (contract.py:87--89): You are an expert Python programmer. You write deterministic, pure code \ that exactly implements a specified physics world model. Output ONLY a \ single Python code block, no prose. Synthesis user message. The template (contract.py:90--98); the messages list is exactly [system, user] (contract.py:97--98): contract Here are observed transitions (ground truth) to match exactly: example_lines guidance Write the Python module implementing the contract. Output only one \ ‘python code block. contract is build_contract(env,include_mode): the instrument’s API text (the pinned integrator equations, in order) plus its rules text (physical constants, reward, and — in the full arm only — the mode clause); contract.py:32--34, text in src/cwm/continuous/instruments.py. guidance is the prompt-variant knob of Section O.9; it is the empty string in every default run, and because the template inserts it as extra =f"guidance " if guidance else "" (contract.py:90), an empty guidance leaves the message byte-identical to the pre-knob prompt — asserted in tests/test_continuous_contract.py and tests/test_prompt_variants.py. Example lines: how many, and which. One line per shown transition, using repr() throughout, so full float precision is shown (contract.py:67--76): step(state!r, action!r) -> next_state!r reward(next) = reward!r Selection is a stride over the whole sample, not a prefix (a prefix would be a single rollout): idx = sorted((i * n)//max_examples for i in range(min(max_examples,n))) (contract.py:71). At the campaign default of N=40N=40 rollouts and hepisode=80h_episode=80 the sample is 32003200 transitions on all three instruments, so the prompt shows 3030 lines (0.937%0.937\% of the sample) in the default variant and 120120 lines (3.75%3.75\%) in the guided/region/landing variants (example_budget in the JSON). The gate, by contrast, always scores the candidate on all 32003200 transitions (contract.py:167--177): the model is shown about one percent of the evidence it is judged on. Refine user message. There is no system message on a refine call (contract.py:200--206): contract The current implementation is below. It fails some transitions. Fix it \ so every transition matches to within eps in x, v and reward. Output \ only one ‘python code block. CURRENT CODE: ‘python code ‘ FAILURES (expected vs got): first max_failures failure lines guidance Each failure line comes from _compare_transitions (contract.py:135--164) and is one of step(state!r, action!r) raised exc!r step(...): wrong state arity: expected k components, got m step(...): expected next_state!r r=reward!r, got got!r \ r=got_r!r (err err:.3g) Truncation of the failure list. Only the first max_failures lines are included, " ".join(failures[:max_failures]) (contract.py:205), with max_failures =20 by default (contract.py:191) and 4040 in the guided/region/landing variants. Failures are in sample order, so truncation keeps the earliest failures, not the worst ones. Remark 7 (A wart in the refine text, recorded because it is what ran). The sentence says “in x, v and reward” on every instrument, including the four-dimensional PatchField2D whose state is [x,y,vx,vy][x,y,v_x,v_y] (contract.py:202). The tolerance actually enforced is the sup-norm over all state components and the reward (contract.py:154--155), so the text understates the check on the two-dimensional instrument. This is the text used by every committed run. O.2 The refine loop The loop is contract.py:188--214. • Termination. while acc < 1.0 and iterations < max_iters (contract.py:199), where acc = contract_accuracy(code,transitions,eps) over the whole sample. It stops on the first artifact that matches every transition to ε , or when the budget runs out. Nothing else stops it. • Tolerance. ε=10−9 =10^-9 in every committed campaign, against a pinned integrator, so the gate is effectively exact match. • Iteration budget per campaign. --max-iters, default 55 (continuous_danger_synthesis.py:306). The two region-guidance campaigns used 1515 (the 3×3×-budget arm). No other value appears in results/. • The loop is memoryless. Each iteration sends exactly one message, provider.complete(["role": "user","content": msg], model=model) (contract.py:207--208), rebuilt from (contract, current code, current failures). No conversation history, no system message and no assistant turn is carried across iterations; the only state passed forward is the code string. Asserted by test_llm_calls_per_seed_is_one_plus_refine_iterations, which checks that the role sequence is [system, user] on call 00 and [user] on every refine call. • What is recorded. refine_iterations per cell is the number of refine calls issued (contract.py:212, :304); it equals max_iters exactly when the budget was exhausted without reaching accuracy 1.01.0. O.3 Code extraction, and an unparseable reply Extraction is src/cwm/synthesizer.py:28--35, used for both message types (contract.py:290, :210): the first python-tagged fenced block if there is one, else the first fenced block with any other tag, else the whole reply stripped of surrounding whitespace. There is therefore no parse-failure path: a reply containing no code block is passed on as if it were code, and it fails the gate rather than raising. contract_accuracy runs the candidate in a sandbox subprocess (contract.py:101--132); if the sandbox fails, produces no output or prints non-JSON, the accuracy is 0.00.0 and the single failure line is the error text (contract.py:173--175), and the refine loop continues normally. In the separate audit path such an artifact is classified invalid — ast.parse raising SyntaxError, a missing or uncallable step/reward, or a raising trivial call (src/cwm/continuous/artifact_class.py:90--113, preflight at :59--88) — and invalid is deliberately kept distinct from gate_failing. Nothing retries a reply because it was unparseable, and nothing discards a cell for it. O.4 Retry and error policy • Transport-level retries only, from the OpenAI SDK: max_retries = 6, timeout = 120 s for Azure (src/cwm/llm/azure_openai.py:10--16) and max_retries = 6, timeout = 300 s, max_tokens = 8192 for the OpenAI-compatible provider (src/cwm/llm/openai_compat.py:11--16). The SDK does exponential backoff and honours Retry-After; the wrappers only raise the ceiling from the SDK default of 22. • No application-level retry and no error swallowing. There is no try/except anywhere around provider.complete in contract.py or in continuous_danger_synthesis.py. A refusal (no choices) or missing usage metadata raises ValueError (azure_openai.py:21--25, openai_compat.py:21--22) and the exception propagates out of the sweep loop, ending the run. • What that costs. Nothing already computed: the sweep checkpoints atomically after every cell (continuous_danger_synthesis.py:179, temporary file plus os.replace), skips already-present (arm, seed index) pairs on restart (:155--160), and refuses to resume a file produced under different result-defining flags (:125--146). • Consequence for the paper. No cell in results/ was retried, resampled or dropped because of a provider error: every cell is the first and only draw for its (arm, seed). O.5 Sampling parameters, deployments, API version The sampling parameters actually sent are those in the chat.completions.create(…) call sites (provider_sampling_params in the JSON): the Azure wrapper sends model and messages only (azure_openai.py:20); the OpenAI-compatible wrapper sends model, messages and max_tokens=8192 (openai_compat.py:19--20). Neither sends temperature, top_p or a request-level seed: all three are left at the provider default. The reason is recorded in the code (azure_openai.py:19): no temperature/top_p — GPT-5.4 rejects them. So the runs are not temperature-00 runs; they are whatever the deployment’s default sampling is, which is why every campaign is reported as a distribution over seeds rather than as a single artifact. Consequently the LLM half of the pipeline is not bit-reproducible, while the sample half is (rollout seed 10 000⋅(i+1+seed_offset)10\,000·(i+1+ seed\_offset), continuous_danger_synthesis.py:164); the synthesized code of every cell is versioned in its result JSON, so every reported number is re-derivable from the artifacts even though a re-run draws new ones. Deployments are selected by the positional size argument (continuous_danger_synthesis.py:325--327) and are confirmed by the model field each result JSON records for itself: large is gpt-5.4, mini is gpt-5.4-mini, and nano (gpt-5-nano) is never used in any paper-2 campaign — no result JSON carries it. The Azure API version is 2025-04-01-preview, read from AZURE_OPENAI_API_VERSION (:331). The cross-family arm is --compat-model Qwen/Qwen3-Coder-30B-A3B-Instruct through the Hugging Face Inference Providers router at https://router.huggingface.co/v1 (:307) with HF_TOKEN authentication (:313). The Claude arm is agent-relayed and has no API wrapper (Section O.10). O.6 LLM calls per seed Per cell, llm_calls == 11 (synthesis, contract.py:289) ++ refine_iterations (contract.py:207, counter at :212). The identity is verified against the actual number of provider invocations in tests/test_prompt_variants.py (first-try success, one and three refinements, and the max_iters cap). Table 14: LLM calls per campaign. “Campaign” names the artifact results/continuous_synthesis_⟨ ⟩ .json, with qwen abbreviating compat-qwen3-coder-30b-a3b-instruct. Every campaign uses the default prompt variant and max_iters =5=5 except the two pv-region_it15 campaigns (region variant, max_iters =15=15). “Cap” counts cells that exhausted the iteration budget without passing the gate. Source: results/llm_protocol_facts.json → campaigns. campaign model cells calls min / med / max cap qwen_xwall8 Qwen3-Coder-30B 6 16 1 / 1 / 6 2 large_xwall8 gpt-5.4 40 48 1 / 1 / 2 0 large_xwall8_off20 gpt-5.4 40 50 1 / 1 / 2 0 mini_xwall4 gpt-5.4-mini 10 27 1 / 1 / 6 3 mini_xwall8 gpt-5.4-mini 40 62 1 / 1 / 6 1 patch2d_qwen_k3_7 Qwen3-Coder-30B 3 3 1 / 1 / 1 0 patch2d_large_k3_7 gpt-5.4 40 140 1 / 3.5 / 6 20 patch2d_large_k3_7_pv-region_it15 gpt-5.4 20 320 16 / 16 / 16 20 patch2d_large_k5_9 gpt-5.4 40 130 1 / 1 / 6 18 patch2d_mini_k3_7 gpt-5.4-mini 40 140 1 / 3.5 / 6 20 patch2d_mini_k3_7_pv-region_it15 gpt-5.4-mini 20 320 16 / 16 / 16 20 patch2d_mini_k5_9 gpt-5.4-mini 40 130 1 / 1 / 6 18 patch2dsq_large_k3_7 gpt-5.4 40 140 1 / 3.5 / 6 20 patch2dsq_mini_k3_7 gpt-5.4-mini 40 140 1 / 3.5 / 6 20 pendulum_qwen_thstop1.4 Qwen3-Coder-30B 6 16 1 / 1 / 6 2 pendulum_large_thstop1.4 gpt-5.4 40 50 1 / 1 / 2 0 pendulum_large_thstop1.4_off20 gpt-5.4 40 54 1 / 1 / 2 0 pendulum_large_thstop1 gpt-5.4 40 59 1 / 1 / 2 0 pendulum_mini_thstop1.4 gpt-5.4-mini 40 56 1 / 1 / 6 1 pendulum_mini_thstop1 gpt-5.4-mini 40 58 1 / 1 / 2 0 total (20 campaigns) 625 1959 1 / — / 16 The totals are 2020 API campaigns, 625625 cells and 19591959 LLM calls, mean 3.133.13 calls per cell, range 11–1616 (totals in the JSON); adding the two agent-relayed Claude campaigns (1212 cells, 3939 relayed calls) gives 19981998 calls in all. The shape of the distribution is itself a finding: on the one-dimensional instruments the median cell costs one call — translation succeeds on the first try — whereas on PatchField2D at k=(3,7)k=(3,7) exactly half the cells burn the whole budget (20/4020/40 in each of the four k3_7 campaigns), and 20/2020/20 in both fifteen-iteration campaigns, i.e. every region-guidance cell exhausted 1515 refinements without passing the gate. O.7 What the gate is Per cell (contract.py:285--308): (i) collect_transitions(env,n_rollouts=40,seed=10_000*(i+1+offset)) — N i.i.d. uniform-random rollouts on the truth, and the same transitions are both the source of the shown examples and the gate (contract.py:37--57); (i) synthesize, then refine, giving gate_accuracy and gate_passed == (accuracy =1.0=1.0); (i) sample_contains_wall / sample_contains_mode_per, the identifiability event, logged per cell (contract.py:60--64); (iv) mode_blindness (contract.py:238--265), computed only when the gate passed: the fraction of mode-region probe transitions the artifact gets wrong, per mode, at ε=10−6 =10^-6, where the probes fire their mode in the truth by construction and this is asserted at runtime (contract.py:253). Single-mode instruments emit a scalar under wall_blindness; PatchField2D emits the per-mode dictionary mode_blindness and puts its mean in wall_blindness. O.8 Operational classification rules These are the executable definitions, not paraphrases of them. repaired — two levels, and they are not the same predicate. On the one-dimensional instruments (scripts/audit_paper2_numbers.py:368--371) it is gate_passed and (wall_blindness or 0)== 0.0: the gate reached accuracy 1.01.0 and every mode probe is reproduced exactly, over cells with arm =="incomplete" and sample_contains_wall true. On PatchField2D (audit_paper2_numbers.py:296) it is [c for c in mode_present if c["gate_passed"]]: gate passage alone, over cells whose sample contained some mode. That is the weaker test, and it is the honest one to quote for the 0/760/76: not one artifact even reached accuracy 1.01.0, so no blindness test was needed to reject it. blind, superstitious patch, disc-form — behavioural. All three are decided by probing the artifact’s step on a grid and comparing against the pure integrator, behaviourally rather than by reading the source (scripts/patch2d_artifact_audit.py). Instrument (:51--55): an 81×8181× 81 grid over x∈[−2,14]x∈[-2,14], y∈[−8,8]y∈[-8,8], action 0.30.3, deviation threshold 10−610^-6, and two velocity slices (vx,vy)∈(0,0),(1.5,0.5)(v_x,v_y)∈\(0,0),(1.5,0.5)\ (:191--192); m0m_0 is the zero-velocity deviation mask and n0n_0, n1n_1 the deviating-cell counts in the two slices. Components are 4-neighbour connected (:115--136); the classes in Table 15 are mutually exclusive and exhaustive and are evaluated in the order listed. The classifier is validated against constructed artifacts of known class under --selftest (:427--459), which builds a blind artifact, a half-plane, a disc, a square, a velocity-dependent freeze, a point trap and an exact-coordinate trap and asserts the returned class. Table 15: The behavioural classifier of scripts/patch2d_artifact_audit.py, in evaluation order. class operational rule line invalid exec raises, step missing, or step returns a state of the wrong arity :183--189 crash mask construction raises :190--194 blind n0=0n_0=0 and n1=0n_1=0, and step’s body has no if :234--237 blind-textual-patch (the paper’s superstitious patch) n0=0n_0=0 and n1=0n_1=0, and step’s body does contain an if (_step_has_conditional, :170--175) — a written rule whose trigger set is behaviourally empty, e.g. an exact-coordinate trap, which is measure-zero and so never fires :234--236 vdep n0=0n_0=0 but n1>0n_1>0: deviates only at nonzero velocity :238--240 point largest connected component below 0.50.5 world-units2 :244--247 halfplane largest component reaches the far-east column or the top or bottom row of the probe window (unbounded proxy, _touches_far_edge, :161--167) :252--254 square-form bounded, bbox_fill ≥0.90≥ 0.90 :257--258 disc-form bounded, 0.62≤0.62≤ bbox_fill <0.90<0.90 and radial_ratio ≤1.30≤ 1.30 (π/4≈0.785π/4≈ 0.785 is a disc’s bbox fill; radial_ratio is max over min radial extent across 1616 angular bins about the centroid, _shape_metrics, :139--158) :259--260 bounded-other bounded, neither of the above: ellipses, hulls, unions, arcs :261--262 Two derived per-artifact quantities the paper leans on: cover_p1/cover_p2, the fraction of the true patch’s grid cells that the artifact’s m0m_0 mask covers (:199--209), where “contains the seen patch” means cover>0.9cover>0.9 and “patch-selective” means additionally cover(unseen)<0.1cover(unseen)<0.1 (:400--402); and integrator_exact, meaning no numeric (non-freeze-form) deviation anywhere west of x=1x=1, so that deviations there which preserve position and zero velocity count as an overreaching mode rule rather than as wrong arithmetic (:216--233). O.9 Prompt variants Each variant sets exactly three knobs — max_examples, max_failures and guidance — and nothing else (continuous_danger_synthesis.py:198--240). The contract text is never touched by a variant (build_contract does not take guidance), so no variant can leak the mode clause. Table 16: The prompt variants. Only default and region appear in results/; guided and landing are the intermediate and the follow-up treatment. variant max_examples max_failures guidance default 30 20 empty string; byte-identical to every pre-knob run guided 120 40 describe-the-region-first process guidance (:198--204) region 120 40 guided plus “the trigger region need not be a 1-D threshold” de-bias (:205--210) landing 120 40 region plus one sentence naming the trigger’s argument (:221--225) The landing sentence, verbatim (:221--225): A localized rule’s trigger is evaluated on the state the integrator WOULD produce for this step — the landing position (x2, y2) from the integrator equations above — not on the position the step began at (x, y). It exists because the audit of the 4040 region-guidance artifacts found 36/4036/40 conditioning the freeze rule on the current position instead of the landing position (x2,y2)(x_2,y_2), the causal variable of the true rule — a variable-identification failure, which is a different failure from getting the region’s geometry wrong. The sentence names only the argument: it uses the variable names the contract’s own integrator block already introduces and states nothing about the region’s shape, centre, radius or count. tests/test_prompt_variants.py asserts that isolation four ways: the delta over region is exactly one sentence; it contains no shape word and none of the truth’s numeric constants; no line that the full (mode-stating) contract adds over the incomplete one appears in any variant’s guidance; and the guidance inserts into both the synthesis and the refine message without moving anything else. O.10 The agent-relayed Claude arms Same contract, same example lines, same refine message and the same five-iteration memoryless loop, but the message was relayed to a Claude instance rather than POSTed, so there is no provider wrapper, no max_retries and no usage metadata. Every prompt and reply is versioned verbatim under results/claude_relay_transcripts/ (*_msgkk.txt / *_replykk.txt, one pair per iteration), and the framing wrapper — including the instruction not to use tools or read repository files — is results/claude_relay_transcripts/patch2d_k3_7_RELAY_FRAMING.txt. The two campaigns are the 1-D cart-and-pendulum ledger (results/continuous_claude_relay.json: 88 cells, 2020 relayed calls, min/median/max 1/1.5/61/1.5/6) and the 2-D one (results/continuous_claude_relay_patch2d_k3_7.json: 44 cells, 1919 relayed calls, 1/6/61/6/6). Both counts are cross-checked against the number of *_msg*.txt files on disk and agree exactly. Two files in the 2-D transcript directory are named .._duplicate_relay_DISCARDED.txt: a message relayed twice by accident, whose second reply was discarded. They are not protocol iterations and are excluded from the count (scripts/llm_protocol_facts.py, _trancall_count); with them the on-disk file count would be 2121 rather than 1919. Appendix P Reproducibility Everything in this section is generated rather than transcribed: the facts below are read from results/repro_manifest.json, and the numeric audit checks the paper against that file like any other result. Interpreter, platform, and one honest gap. CPython 3.12.83.12.8 on macOS 15.7.715.7.7 (build 24G720, Darwin 24.6.024.6.0), Intel Core i9-9880H at 2.302.30 GHz, 1616 logical cores, 1616 GiB. pyproject.toml declares requires-python >= 3.11. No result depends on the hardware except wall-clock: every CPU result is pure-Python or numpy float64 with explicitly seeded random.Random streams, single-threaded, no GPU, and no reduction whose order a BLAS could change, so bit-identical replay is expected on any IEEE-754 host at the same CPython minor version. That expectation is an argument from the code and not a measurement: every number in this paper was produced on one machine, and no second platform has ever run the sweeps. The quantities most exposed to a different libm are the ones printed to twelve digits (Jtruth=17.757356407381J_truth=17.757356407381 and 17.77224698102417.772246981024) and the 10−1510^-15 linear-fit residuals of Table 7; those are the first to re-check elsewhere. Dependencies, and what is still missing. pyproject.toml declares lower bounds only. A pinned environment is committed at docs/paper2/requirements-frozen.txt (pip freeze inside the repository’s virtual environment), which is not a lockfile: it carries no hashes and no resolver metadata. What reproducibility still needs and does not have is an archived release — a git tag with a DOI — so that “the code is on GitHub” becomes a citable artifact rather than a mutable branch. We state this as an outstanding gap rather than implying otherwise. Licence. Code: Apache-2.0 (LICENSE, declared in pyproject.toml). Paper text, figures and the result artifacts under results/, including every synthesized program the paper quotes: C-BY-4.0 (docs/paper2/LICENSE-artifacts). Credentials. The scripts read exactly six environment variables, listed with their call sites in docs/paper2/env.example: AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_KEY, AZURE_OPENAI_API_VERSION, AZURE_DEPLOYMENT_MINI, AZURE_DEPLOYMENT_LARGE and HF_TOKEN. No secret appears in the repository. Every CPU result in this paper runs without any of them. What backs each table and figure. The manifest maps every table and figure to the versioned JSON it is derived from and the script that produced it, and it distinguishes three tiers of checking rather than collapsing them: cell-parsed, where scripts/audit_paper2_numbers.py parses the tabular out of main.tex and compares every cell against the JSON at printed precision; claims-only, where the audit does not parse the object but asserts values quoted from it; and unaudited. Of the fifteen tables and figures, nine are cell-parsed, five are claims-only, and one — Table 5, whose counts are read from the per-seed synthesis JSONs by hand — is unaudited, which we record as a gap rather than leave implicit. The manifest is itself cross-checked two ways: a static parse of the audit’s sections collects the file arguments it names, and a dynamic pass execs the audit with file reads instrumented and records what it actually opens. The two agreeing is a stored assertion, and it failed on the generator’s first run (the static parse missed the files reached through a wrapper and a glob), which is what the cross-check is for. object backing results/ JSON checking tab:epsstar eps_invariance_threshold claims tab:danger continuous_reach cells fig:threshold continuous_reach claims fig:reach continuous_reach claims tab:pendulum continuous_pendulum cells tab:patch2d continuous_patch2d cells tab:cem continuous_cem, cem_crossing_bound cells tab:axes continuous_axes cells fig:axes continuous_axes claims tab:eps-sweep continuous_eps_sweep cells tab:mitigation continuous_mitigation cells tab:patch2d-mitigation continuous_mitigation_patch2d cells tab:pendulum-synthesis none (per-seed JSONs) unaudited tab:smooth continuous_smooth_probe cells fig:smooth continuous_smooth_probe claims Table 17: The manifest: what backs each table and figure, and how it is checked. “cells” means every printed cell is compared against the JSON at printed precision on every run of the numeric audit; “claims” means the audit asserts quoted values without parsing the object. Each JSON is written by the script of the same stem under scripts/ (continuous_reach.json by continuous_reach.py, and so on); the figures are rendered from their table’s JSON by make_paper2_figures.py, which runs no experiment, so every figure inherits its table’s provenance. Machine-readable form, including the audit call sites per object, in results/repro_manifest.json under manifest[]. Runtime, as a lower bound. Thirty-seven of the result files record their own elapsed_s: CPU sweeps total 4.784.78 h and the LLM synthesis arms 6.016.01 h, so the named campaigns are 10.7910.79 h. That is a lower bound on what the paper cost, because each figure is one run of the script that wrote the file and therefore excludes the 5-seed cells later superseded at 20 seeds, the ablation resume passes, every sweep superseded by a later sample-size raise, and every failed or retried LLM call. Seven scripts named in the commands below carry a ˜N min annotation in this paper but write no elapsed_s, so those seven runtimes are unverified estimates and are marked as such in the manifest. LLM cost, as a range and why not a point. The call count is exact: 1959 API calls over 625 cells across twenty campaigns, derived per cell as one synthesis call plus its refinement iterations, of which the two guided 3×3×-budget cells account for 640640; plus 2020 relay rounds on the subscription-transport Claude arms. The token count is not recorded — the providers capture usage and the refinement loop keeps it, but the emitted cell never copies it, so no paper-2 artifact carries a token count. Combining the measured call count with the design spec’s pre-run estimate of 11–22k prompt tokens per call brackets the API arms at roughly 10610^6 to 10710^7 tokens, i.e. single to low-double-digit US dollars at 2026 prices for this model class. We state that range rather than a figure, and note what would make it exact: an Azure billing export for the window, or a re-derivation of first-call prompt tokens offline, which is possible at zero API spend because collect_transitions, build_contract and build_synthesis_messages are pure functions of the instrument, knob, seed and N (completion tokens for superseded refinement iterations are gone). The only measured dollar figures in the repository belong to the companion paper’s campaigns and total $3.73, useful as an order-of-magnitude anchor and nothing more. Reproducing the paper. Two commands regenerate everything derived: make_paper2_figures.py rebuilds the figures from the JSONs, and audit_paper2_numbers.py re-derives every table cell and counted prose claim from results/ and exits non-zero on any disagreement. The experiment commands themselves are listed below; the CPU ones need no credentials. Appendix Q Pre-specification, and what was added after the result A study that reports negative results, ablations built to explain them, and theory derived after the fact owes the reader a way to tell those apart. This section is that ledger. Every date below is read from the repository’s history rather than recalled, and the commands that re-derive each one are listed in docs/paper2/PRESPEC-LEDGER.md. Five labels are used: pre-specified (a dated design document predicted it before any run), confirmatory (ran as specified), diagnostic (added to explain or repair an observed result), exploratory ablation (added after seeing a result, to test a hypothesis the result suggested), and post-hoc (an analysis or a theorem chosen after the data existed). What was pre-specified. The design document is dated 2026-07-06 and its predictions were committed before the first run. Fourteen items are pre-specified and confirmatory: the threshold law’s expected shape; the reach mechanism as an explicit go/no-go gate on the whole study; the wall position as the rarity knob; the gate-miss exactness check against (1−r)N(1-r)^N; the pervasive-error control arm that makes the axis separation a separation; the smooth-bump contrast, with “danger stays low” predicted; the smooth-learner probe; the full-spec synthesis control; the mode-absent conditional, including the ≈60%≈60\% rate; the ε -sensitivity sweep, which the spec listed under Risks as required; the pendulum as the second instrument; the Qwen cross-family check; and the pendulum synthesis arm. The tightest of these is worth naming, because it is the strongest pre-specification claim the paper can make: the spec’s runbook predicted the mode-present branch as a contingency — “either outcome is a finding; if it repairs, that becomes its own section” — so the repair result is a pre-registered branch and not a post-hoc pivot. The first confirmation landed 22 h 4040 min after the prediction was committed. What was added after the result it responds to. Fifteen items, and the five the review asks about specifically are all in this group. The PatchField2D instrument was named in the spec as one of two options for a second instrument, with no predictions attached, and its campaign was built eleven days later in response to a review of the 1D work. The square ablation was added two to three days after the 2D repair failure it explains, and it is a genuine falsification test of a hypothesis that was itself post-hoc: the curvature reading was born of the result the ablation then excluded. The guided-prompt ablation was added two days after the same failure, and its two cells are the most expensive in the paper (320320 calls each, 640640 of the campaign’s 19591959). The disjoint seed blocks and the 50,00050,000-rollout dependence re-measurement are both repairs of errors a review found — pooled intervals over shared samples, and an unstated independence assumption — eighteen and eight days after the results they correct. The sharp-plateau reward variant was added nineteen days after the “below random at every knob” claim it rescues. The distrust-region mitigation appears in no version of the design document at all; the paper presents it as a contribution rather than as a prediction, which is the correct framing. Two further items changed the paper’s own reading of a result rather than confirming it: the per-episode fence census turned a “boundary-mapping transient” into “a growing fraction of outright failures”, and the behavioural artifact audit shipped once with a vacuous check (a mis-keyed dictionary lookup meant its partial-repair condition never fired), whose correction moved a headline count. The theory is post-hoc, and part of it was explicitly out of scope. Every proposition-backing artifact in this paper was produced after all the data existed, most of them because a measurement looked suspiciously exact and the question was whether something could be proved. That is a legitimate way to find a theorem and an illegitimate way to claim a prediction, so none of the theory is presented as predicted. One item is more than post-hoc: the design document said of exactly this material, “covering-number analogues are open; mention as a limitation, do not attempt for paper 2”. The paper now contains four such results. They were added late, and the first version of the fencing bound was wrong in the direction that mattered — a covering number where a packing number was needed, with a hand-computed constant that was also wrong — caught by a reader’s question rather than by the numeric audit, and corrected the same day. The manuscript’s own claims of pre-registration and falsification. Ten phrases in this paper assert something about our process. Seven are supported, one is supported as a statistical rather than a temporal claim (the coverage certificate’s cell family is fixed before the data by construction, which is what that argument needs and does not require a dated record), and two were not supported by any dated record and have been corrected in this revision: • The sharp-plateau variant’s competence risk was described as “the pre-registered risk”. No dated text records it before the result; the pre-run note for that variant states a cost, a payoff and a different caveat. The text now says “the risk recorded with the variant’s script”. • The 2D section said “we predicted partial repair”. The instrumentation that detects partial repair — the per-mode sample flags and the four-way branch summary — was written in the same commit as the run, so the expectation is real and designed for; but the sentence itself first appears one day after the measurement. The text now says the instrument was built to detect partial repair and that none occurred. A third phrase, “an axis-aligned square with flat edges excludes the curvature reading”, is sound as logic but was silent about chronology; it now states that the ablation was added after the result it responds to. Summary. Fourteen pre-specified and confirmatory items, all on the one-dimensional story: the mechanism, the axis separation, the smooth contrast, both 1D instruments, and the synthesis trichotomy including its contingency branch. Fifteen items added after the results they respond to, of which five are diagnostic repairs driven by review, five are exploratory ablations, three are post-hoc analyses and two are mixed. Ten post-hoc theory results. The reader should treat the 1D synthesis result as confirmatory and everything about the two-dimensional mode — including the two ablations that exclude curvature and prompting — as exploratory work whose hypotheses were formed after the finding. Declarations Funding. This work received no external funding. The LLM API costs, bounded in Section P, were borne by the author. Competing interests. The author declares no competing interests. Data and code availability. All code, every result artifact, and every synthesized program the paper quotes are in the repository named in Section P (code under Apache-2.0, paper and artifacts under C-BY-4.0). The two commands that regenerate every figure and re-derive every table cell from those artifacts are given there. Section P also states what availability still lacks: an archived, DOI-bearing release rather than a branch. Use of AI systems. Large language models are the object of study here: they synthesize the world models the paper evaluates, under the protocol specified in full in Section O, with every prompt, deployment identifier and call count recorded. Language models were additionally used as writing and analysis assistants during the preparation of the manuscript and the experiment code. All theorem statements, proofs, experimental designs and conclusions are the author’s, and every number in the paper is re-derived from a versioned artifact by scripts/audit_paper2_numbers.py rather than taken on trust. Anonymization. This version is not anonymized: it names the author, the affiliation, a personal URL, and a repository whose name identifies the author. A double-blind submission requires removing those four, and replacing the nine citations to the companion paper with a third-person reference to it. References Abate et al. (2018) Alessandro Abate, Cristina David, Pascal Kesseli, Daniel Kroening, and Elizabeth Polgreen. Counterexample guided inductive synthesis modulo theories. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 270–288. Springer, 2018. doi: 10.1007/978-3-319-96145-3˙15. Aguilar Martín (2026) Javier Aguilar Martín. When a verified world model still loses: Play-adequacy vs prediction-accuracy in LLM-synthesized code world models, 2026. Companion paper (paper 1). arXiv:2607.14169, https://arxiv.org/abs/2607.14169; repository: https://github.com/JaviMaligno/code-world-models. Alshiekh et al. (2018) Mohammed Alshiekh, Roderick Bloem, Rüdiger Ehlers, Bettina Könighofer, Scott Niekum, and Ufuk Topcu. Safe reinforcement learning via shielding. In Proceedings of the Thirty-Second AAAI Conference on Artificial Intelligence (AAAI), pages 2669–2678, 2018. Alur et al. (2006) Rajeev Alur, Thao Dang, and Franjo Ivančić. Counterexample-guided predicate abstraction of hybrid systems. Theoretical Computer Science, 354(2):250–271, 2006. doi: 10.1016/j.tcs.2005.11.026. Alur et al. (2013) Rajeev Alur, Rastislav Bodík, Garvit Juniwal, Milo M. K. Martin, Mukund Raghothaman, Sanjit A. Seshia, Rishabh Singh, Armando Solar-Lezama, Emina Torlak, and Abhishek Udupa. Syntax-guided synthesis. In Formal Methods in Computer-Aided Design (FMCAD), pages 1–8. IEEE, 2013. doi: 10.1109/FMCAD.2013.6679385. Angluin (1987) Dana Angluin. Learning regular sets from queries and counterexamples. Information and Computation, 75(2):87–106, 1987. doi: 10.1016/0890-5401(87)90052-6. Annpureddy et al. (2011) Yashwanth Annpureddy, Che Liu, Georgios Fainekos, and Sriram Sankaranarayanan. S-TaLiRo: A tool for temporal logic falsification for hybrid systems. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS), volume 6605 of Lecture Notes in Computer Science, pages 254–257. Springer, 2011. Bemporad and Morari (1999) Alberto Bemporad and Manfred Morari. Control of systems integrating logic, dynamics, and constraints. Automatica, 35(3):407–427, 1999. Bemporad et al. (2005) Alberto Bemporad, Andrea Garulli, Simone Paoletti, and Antonio Vicino. A bounded-error approach to piecewise affine system identification. IEEE Transactions on Automatic Control, 50(10):1567–1580, 2005. doi: 10.1109/TAC.2005.856667. Bortolussi et al. (2019) Luca Bortolussi, Francesca Cairoli, Nicola Paoletti, Scott A. Smolka, and Scott D. Stoller. Neural predictive monitoring. In Runtime Verification (RV), Lecture Notes in Computer Science, pages 129–147. Springer, 2019. doi: 10.1007/978-3-030-32079-9˙8. Chen et al. (2021) Ricky T. Q. Chen, Brandon Amos, and Maximilian Nickel. Learning neural event functions for ordinary differential equations. In International Conference on Learning Representations (ICLR), 2021. Chua et al. (2018) Kurtland Chua, Roberto Calandra, Rowan McAllister, and Sergey Levine. Deep reinforcement learning in a handful of trials using probabilistic dynamics models. In Advances in Neural Information Processing Systems (NeurIPS), 2018. Claessen and Hughes (2000) Koen Claessen and John Hughes. QuickCheck: A lightweight tool for random testing of Haskell programs. In Proceedings of the Fifth ACM SIGPLAN International Conference on Functional Programming (ICFP), pages 268–279, 2000. Clarke et al. (2000) Edmund M. Clarke, Orna Grumberg, Somesh Jha, Yuan Lu, and Helmut Veith. Counterexample-guided abstraction refinement. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 154–169. Springer, 2000. doi: 10.1007/10722167˙15. Clarke et al. (2003) Edmund M. Clarke, Ansgar Fehnker, Zhi Han, Bruce Krogh, Olaf Stursberg, and Michael Theobald. Verification of hybrid systems based on counterexample-guided abstraction refinement. In Tools and Algorithms for the Construction and Analysis of Systems (TACAS), Lecture Notes in Computer Science, pages 192–207. Springer, 2003. doi: 10.1007/3-540-36577-X˙14. Corso et al. (2021) Anthony Corso, Robert J. Moss, Mark Koren, Ritchie Lee, and Mykel J. Kochenderfer. A survey of algorithms for black-box safety validation of cyber-physical systems. Journal of Artificial Intelligence Research, 72:377–428, 2021. Coulom (2006) Rémi Coulom. Efficient selectivity and backup operators in monte-carlo tree search. In Computers and Games (CG 2006), volume 4630 of Lecture Notes in Computer Science, pages 72–83. Springer, 2006. Dreossi et al. (2018) Tommaso Dreossi, Shromona Ghosh, Xiangyu Yue, Kurt Keutzer, Alberto L. Sangiovanni-Vincentelli, and Sanjit A. Seshia. Counterexample-guided data augmentation. In Proceedings of the 27th International Joint Conference on Artificial Intelligence (IJCAI), pages 2071–2078, 2018. doi: 10.24963/ijcai.2018/286. Dreossi et al. (2019) Tommaso Dreossi, Daniel J. Fremont, Shromona Ghosh, Edward Kim, Hadi Ravanbakhsh, Marcell Vazquez-Chanlatte, and Sanjit A. Seshia. VerifAI: A toolkit for the formal design and analysis of artificial intelligence-based systems. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 432–442. Springer, 2019. doi: 10.1007/978-3-030-25540-4˙25. Farahmand (2018) Amir-massoud Farahmand. Iterative value-aware model learning. In Advances in Neural Information Processing Systems 31 (NeurIPS), 2018. Farahmand et al. (2017) Amir-massoud Farahmand, Andre Barreto, and Daniel Nikovski. Value-aware loss function for model-based reinforcement learning. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), volume 54 of Proceedings of Machine Learning Research, pages 1486–1494, 2017. Fazeli et al. (2017) Nima Fazeli, Roman Kolbert, Russ Tedrake, and Alberto Rodriguez. Parameter and contact force estimation of planar rigid-bodies undergoing frictional contact. The International Journal of Robotics Research, 36(13–14):1437–1454, 2017. Fazeli et al. (2020) Nima Fazeli, Samuel Zapolsky, Evan Drumwright, and Alberto Rodriguez. Fundamental limitations in performance and interpretability of common planar rigid-body contact models. In Robotics Research, Springer Proceedings in Advanced Robotics, pages 555–571. Springer, 2020. doi: 10.1007/978-3-030-28619-4˙41. Ferrari-Trecate et al. (2003) Giancarlo Ferrari-Trecate, Marco Muselli, Diego Liberati, and Manfred Morari. A clustering technique for the identification of piecewise affine systems. Automatica, 39(2):205–217, 2003. doi: 10.1016/S0005-1098(02)00224-8. Gao et al. (2023) Luyu Gao, Aman Madaan, Shuyan Zhou, Uri Alon, Pengfei Liu, Yiming Yang, Jamie Callan, and Graham Neubig. PAL: Program-aided language models. In Proceedings of the 40th International Conference on Machine Learning (ICML), volume 202 of Proceedings of Machine Learning Research, pages 10764–10799, 2023. García Soto et al. (2019) Miriam García Soto, Thomas A. Henzinger, Christian Schilling, and Luka Zeleznik. Membership-based synthesis of linear hybrid automata. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 297–314. Springer, 2019. doi: 10.1007/978-3-030-25540-4˙16. García Soto et al. (2021) Miriam García Soto, Thomas A. Henzinger, and Christian Schilling. Synthesis of hybrid automata with affine dynamics from time-series data. In Proceedings of the 24th International Conference on Hybrid Systems: Computation and Control (HSCC), pages 1–11. ACM, 2021. doi: 10.1145/3447928.3456704. Gevers (2005) Michel Gevers. Identification for control: From the early achievements to the revival of experiment design. European Journal of Control, 11(4–5):335–352, 2005. doi: 10.3166/ejc.11.335-352. Gold (1978) E. Mark Gold. Complexity of automaton identification from given data. Information and Control, 37(3):302–320, 1978. doi: 10.1016/S0019-9958(78)90562-4. Grimm et al. (2020) Christopher Grimm, André Barreto, Satinder Singh, and David Silver. The value equivalence principle for model-based reinforcement learning. In Advances in Neural Information Processing Systems 33 (NeurIPS), 2020. Gulwani (2011) Sumit Gulwani. Automating string processing in spreadsheets using input-output examples. In Proceedings of the 38th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), pages 317–330. ACM, 2011. doi: 10.1145/1926385.1926423. Gulwani et al. (2017) Sumit Gulwani, Oleksandr Polozov, and Rishabh Singh. Program synthesis. Foundations and Trends in Programming Languages, 4(1–2):1–119, 2017. doi: 10.1561/2500000010. Hafner et al. (2020) Danijar Hafner, Timothy Lillicrap, Jimmy Ba, and Mohammad Norouzi. Dream to control: Learning behaviors by latent imagination. In International Conference on Learning Representations (ICLR), 2020. Hérault et al. (2004) Thomas Hérault, Richard Lassaigne, Frédéric Magniette, and Sylvain Peyronnet. Approximate probabilistic model checking. In Verification, Model Checking, and Abstract Interpretation (VMCAI), Lecture Notes in Computer Science, pages 73–84. Springer, 2004. doi: 10.1007/978-3-540-24622-0˙8. Hewing et al. (2020) Lukas Hewing, Kim P. Wabersich, Marcel Menner, and Melanie N. Zeilinger. Learning-based model predictive control: Toward safe learning in control. Annual Review of Control, Robotics, and Autonomous Systems, 3:269–296, 2020. doi: 10.1146/annurev-control-090419-075625. Jacobs et al. (1991) Robert A. Jacobs, Michael I. Jordan, Steven J. Nowlan, and Geoffrey E. Hinton. Adaptive mixtures of local experts. Neural Computation, 3(1):79–87, 1991. doi: 10.1162/neco.1991.3.1.79. Janner et al. (2019) Michael Janner, Justin Fu, Marvin Zhang, and Sergey Levine. When to trust your model: Model-based policy optimization. In Advances in Neural Information Processing Systems (NeurIPS), 2019. Jha and Seshia (2017) Susmit Jha and Sanjit A. Seshia. A theory of formal synthesis via inductive learning. Acta Informatica, 54(7):693–726, 2017. doi: 10.1007/s00236-017-0294-5. Jha et al. (2010) Susmit Jha, Sumit Gulwani, Sanjit A. Seshia, and Ashish Tiwari. Oracle-guided component-based program synthesis. In Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering (ICSE), volume 1, pages 215–224. ACM, 2010. doi: 10.1145/1806799.1806833. Kapinski et al. (2014) James Kapinski, Jyotirmoy V. Deshmukh, Sriram Sankaranarayanan, and Nikos Arechiga. Simulation-guided Lyapunov analysis for hybrid dynamical systems. In Proceedings of the 17th International Conference on Hybrid Systems: Computation and Control (HSCC), pages 133–142. ACM, 2014. doi: 10.1145/2562059.2562139. Kocsis and Szepesvári (2006) Levente Kocsis and Csaba Szepesvári. Bandit based Monte-Carlo planning. In Proceedings of the 17th European Conference on Machine Learning (ECML), pages 282–293, 2006. Lambert et al. (2020) Nathan O. Lambert, Brandon Amos, Omry Yadan, and Roberto Calandra. Objective mismatch in model-based reinforcement learning. In Proceedings of the 2nd Conference on Learning for Dynamics and Control (L4DC), volume 120 of Proceedings of Machine Learning Research, pages 761–770, 2020. arXiv:2002.04523. Lampropoulos et al. (2017) Leonidas Lampropoulos, Diane Gallois-Wong, Cătălin Hriţcu, John Hughes, Benjamin C. Pierce, and Li-yao Xia. Beginner’s luck: A language for property-based generators. In Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages (POPL), pages 114–129. ACM, 2017. doi: 10.1145/3009837.3009868. Legay et al. (2010) Axel Legay, Benoît Delahaye, and Saddek Bensalem. Statistical model checking: An overview. In Runtime Verification (RV), Lecture Notes in Computer Science, pages 122–135. Springer, 2010. doi: 10.1007/978-3-642-16612-9˙11. Lehrach et al. (2026) Wolfgang Lehrach, Daniel Hennes, Miguel Lazaro-Gredilla, Xinghua Lou, Carter Wendelken, Zun Li, Antoine Dedieu, Jordi Grau-Moya, Marc Lanctot, Atil Iscen, John Schultz, Marcus Chiam, Ian Gemp, Piotr Zielinski, Satinder Singh, and Kevin P. Murphy. Code World Models for general game playing. In International Conference on Learning Representations (ICLR), 2026. OpenReview id 1UoB7IWiku. Liang et al. (2023) Jacky Liang, Wenlong Huang, Fei Xia, Peng Xu, Karol Hausman, Brian Ichter, Pete Florence, and Andy Zeng. Code as policies: Language model programs for embodied control. In IEEE International Conference on Robotics and Automation (ICRA), pages 9493–9500, 2023. Lindemann et al. (2023) Lars Lindemann, Matthew Cleaveland, Gihyun Shim, and George J. Pappas. Safe planning in dynamic environments using conformal prediction. IEEE Robotics and Automation Letters, 8(8):5116–5123, 2023. doi: 10.1109/LRA.2023.3292071. Linderman et al. (2017) Scott W. Linderman, Matthew J. Johnson, Andrew C. Miller, Ryan P. Adams, David M. Blei, and Liam Paninski. Bayesian learning and inference in recurrent switching linear dynamical systems. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), volume 54 of Proceedings of Machine Learning Research, pages 914–922, 2017. Ljung (1999) Lennart Ljung. System Identification: Theory for the User. Prentice Hall PTR, Upper Saddle River, NJ, 2nd edition, 1999. ISBN 0-13-656695-2. Löscher and Sagonas (2017) Andreas Löscher and Konstantinos Sagonas. Targeted property-based testing. In Proceedings of the 26th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pages 46–56. ACM, 2017. doi: 10.1145/3092703.3092711. Löscher and Sagonas (2018) Andreas Löscher and Konstantinos Sagonas. Automating targeted property-based testing. In IEEE 11th International Conference on Software Testing, Verification and Validation (ICST), pages 70–80. IEEE, 2018. doi: 10.1109/ICST.2018.00017. Majumdar et al. (2021) Anirudha Majumdar, Alec Farid, and Anoopkumar Sonar. PAC-Bayes control: Learning policies that provably generalize to novel environments. The International Journal of Robotics Research, 40(2–3):574–593, 2021. doi: 10.1177/0278364920959444. Published online 3 October 2020; print issue February 2021. Medhat et al. (2015) Ramy Medhat, S. Ramesh, Borzoo Bonakdarpour, and Sebastian Fischmeister. A framework for mining hybrid automata from input/output traces. In International Conference on Embedded Software (EMSOFT), pages 177–186. IEEE, 2015. doi: 10.1109/EMSOFT.2015.7318273. Mehra (1974) Raman K. Mehra. Optimal input signals for parameter estimation in dynamic systems — survey and new results. IEEE Transactions on Automatic Control, 19(6):753–768, 1974. doi: 10.1109/TAC.1974.1100701. Nagabandi et al. (2018) Anusha Nagabandi, Gregory Kahn, Ronald S. Fearing, and Sergey Levine. Neural network dynamics for model-based deep reinforcement learning with model-free fine-tuning. In IEEE International Conference on Robotics and Automation (ICRA), 2018. Padhye et al. (2019) Rohan Padhye, Caroline Lemieux, Koushik Sen, Mike Papadakis, and Yves Le Traon. Semantic fuzzing with Zest. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pages 329–340. ACM, 2019. doi: 10.1145/3293882.3330576. Paoletti et al. (2007) Simone Paoletti, Aleksandar Lj. Juloski, Giancarlo Ferrari-Trecate, and René Vidal. Identification of hybrid systems: A tutorial. European Journal of Control, 13(2-3):242–260, 2007. Parmar et al. (2021) Mihir Parmar, Mathew Halm, and Michael Posa. Fundamental challenges in deep learning for stiff contact dynamics. In IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 5181–5188. IEEE, 2021. doi: 10.1109/IROS51168.2021.9636383. Pfrommer et al. (2021) Samuel Pfrommer, Mathew Halm, and Michael Posa. ContactNets: Learning discontinuous contact dynamics with smooth, implicit representations. In Proceedings of the 2020 Conference on Robot Learning (CoRL), volume 155 of Proceedings of Machine Learning Research, pages 2279–2291, 2021. Conference held 16–18 November 2020; proceedings volume published 2021. Poli et al. (2021) Michael Poli, Stefano Massaroli, Luca Scimeca, Seong Joon Oh, Sanghyuk Chun, Atsushi Yamashita, Hajime Asama, Jinkyoo Park, and Animesh Garg. Neural hybrid automata: Learning dynamics with multiple modes and stochastic transitions. In Advances in Neural Information Processing Systems 34 (NeurIPS), 2021. Ravanbakhsh and Sankaranarayanan (2019) Hadi Ravanbakhsh and Sriram Sankaranarayanan. Learning control Lyapunov functions from counterexamples and demonstrations. Autonomous Robots, 43(2):275–307, 2019. doi: 10.1007/s10514-018-9791-9. Published online 6 August 2018; print issue February 2019. Rawlings et al. (2017) James B. Rawlings, David Q. Mayne, and Moritz M. Diehl. Model Predictive Control: Theory, Computation, and Design. Nob Hill Publishing, 2nd edition, 2017. Roll et al. (2004) Jacob Roll, Alberto Bemporad, and Lennart Ljung. Identification of piecewise affine systems via mixed-integer programming. Automatica, 40(1):37–50, 2004. doi: 10.1016/j.automatica.2003.08.006. Rosolia and Borrelli (2018) Ugo Rosolia and Francesco Borrelli. Learning model predictive control for iterative tasks. a data-driven control framework. IEEE Transactions on Automatic Control, 63(7):1883–1896, 2018. doi: 10.1109/TAC.2017.2753460. Rubinstein and Kroese (2017) Reuven Y. Rubinstein and Dirk P. Kroese. Simulation and the Monte Carlo Method. Wiley, 3rd edition, 2017. Schrittwieser et al. (2020) Julian Schrittwieser, Ioannis Antonoglou, Thomas Hubert, Karen Simonyan, Laurent Sifre, Simon Schmitt, Arthur Guez, Edward Lockhart, Demis Hassabis, Thore Graepel, Timothy Lillicrap, and David Silver. Mastering Atari, Go, chess and Shogi by planning with a learned model. Nature, 588(7839):604–609, 2020. doi: 10.1038/s41586-020-03051-4. Sen et al. (2004) Koushik Sen, Mahesh Viswanathan, and Gul Agha. Statistical model checking of black-box probabilistic systems. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 202–215. Springer, 2004. doi: 10.1007/978-3-540-27813-9˙16. Seto et al. (1998) Danbing Seto, Bruce Krogh, Lui Sha, and Alongkrit Chutinan. The Simplex architecture for safe online control system upgrades. In Proceedings of the American Control Conference (ACC), volume 6, pages 3504–3508. IEEE, 1998. doi: 10.1109/ACC.1998.703255. Settles (2012) Burr Settles. Active Learning. Synthesis Lectures on Artificial Intelligence and Machine Learning. Springer, 2012. doi: 10.1007/978-3-031-01560-1. Sha (2001) Lui Sha. Using simplicity to control complexity. IEEE Software, 18(4):20–28, 2001. doi: 10.1109/MS.2001.936213. Solar-Lezama (2008) Armando Solar-Lezama. Program Synthesis by Sketching. Ph.D. thesis, University of California, Berkeley, 2008. EECS Department technical report UCB/EECS-2008-177, 19 December 2008. Solar-Lezama et al. (2006) Armando Solar-Lezama, Liviu Tancau, Rastislav Bodik, Sanjit Seshia, and Vijay Saraswat. Combinatorial sketching for finite programs. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 404–415. ACM, 2006. doi: 10.1145/1168857.1168907. Vaandrager (2017) Frits Vaandrager. Model learning. Communications of the ACM, 60(2):86–95, 2017. doi: 10.1145/2967606. Vidal et al. (2003) René Vidal, Stefano Soatto, Yi Ma, and Shankar Sastry. An algebraic geometric approach to the identification of a class of linear hybrid systems. In Proceedings of the 42nd IEEE Conference on Decision and Control (CDC), volume 1, pages 167–172. IEEE, 2003. doi: 10.1109/CDC.2003.1272554. Vovk et al. (2022) Vladimir Vovk, Alexander Gammerman, and Glenn Shafer. Algorithmic Learning in a Random World. Springer, 2nd edition, 2022. doi: 10.1007/978-3-031-06649-8. Wabersich and Zeilinger (2021) Kim P. Wabersich and Melanie N. Zeilinger. A predictive safety filter for learning-based control of constrained nonlinear dynamical systems. Automatica, 129:109597, 2021. doi: 10.1016/j.automatica.2021.109597. Wagenmaker and Jamieson (2020) Andrew Wagenmaker and Kevin Jamieson. Active learning for identification of linear dynamical systems. In Proceedings of the 33rd Conference on Learning Theory (COLT), volume 125 of Proceedings of Machine Learning Research, pages 3487–3582, 2020. Wilson (1927) Edwin B. Wilson. Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158):209–212, 1927. Yamagata et al. (2021) Yoriyuki Yamagata, Shuang Liu, Takumi Akazaki, Yihai Duan, and Jianye Hao. Falsification of cyber-physical systems using deep reinforcement learning. IEEE Transactions on Software Engineering, 47(12):2823–2840, 2021. doi: 10.1109/TSE.2020.2969178. Younes and Simmons (2002) Håkan L. S. Younes and Reid G. Simmons. Probabilistic verification of discrete event systems using acceptance sampling. In Computer Aided Verification (CAV), Lecture Notes in Computer Science, pages 223–235. Springer, 2002. doi: 10.1007/3-540-45657-0˙17.