An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models

2 The instruments

• The instruments use rare hybrid contacts that a mode-blind model omits but a planner exploits: cart-with-wall, pendulum-with-stop, and a 4D bi-modal PatchField2D.The cart wall blocks the large right reward plateau, so the blind planner drives into the wall while the truth planner goes left; the setup uses fixed dynamics and 80-step episodes.Source: §1 · p. 3, §2.1 · pp. 4–5

1 Introduction

• GPT-5.x repaired omitted 1D hybrid rules in 105/111 mode-containing draws, with exact behavior on 50/56 instrument–stream blocks (95% CI [0.781, 0.960]), but no 2D treatment recovered the region rule.Eight interventions and positive controls localize the 2D failure to inducing the region’s form rather than fitting constants or lacking evidence; a class of wrong rules can remain sample-consistent and harmless at play.Source: §1 · pp. 2–4

2.1 Cart-with-wall

• The cart-with-wall removes an inelastic reset branch at xwall, creating a mode-blind proxy that is bit-exact on wall-free trajectories but predicts coasting through the wall.Wall-contact rarity is the probability that a whole gate rollout fires the mode, sweeping from 0.317 to 0.0024 as xwall ranges from 2 to 10.Source: §2.1 · p. 4

2.2 Planner and play cost

• Random-shooting MPC replans from model rollouts, and paired true-environment returns define normalized play cost against the truth-planner and random baselines.The truth planner is a benchmark rather than a proved optimum, and play cost is reported unclamped because the blind planner can underperform uniform random play.Source: §2.2 · p. 5

2.3 Three design conditions on a continuous danger instrument

• The continuous danger instruments require query-generating planners, sigmoid plateaus, and a drag time constant that fits inside the planning horizon.I.i.d. per-step candidates can make truth and blind models indistinguishable by never querying their disagreement region; piecewise-constant and constant candidates prevent this failure.Source: §2.3 · p. 5

3 Theory: what transfers, what changes, what is new

• The discrete gate-miss and identifiability results transfer: N i.i.d. rollouts miss a critical event of probability r with probability exactly (1-r)^N, while trigger arity and entry-barrier dimension distinguish synthesis difficulty from fencing cost.A wall has p=1,b=0, a disc has p=2,b=1, and a slab has p=1,b=1; the 1D-versus-2D contrast therefore changes two distinct integers.Source: §3 · pp. 6–7

3.1 The estimand: danger as an expected risk, and which factor of it is exact

• Danger is an expected shipped play cost, and play cost × (1-r)^N is exact only when shipped cost is uncorrelated with acceptance; an independent acceptance sample adds its budget to the exponent for the central blind event.For LLM artifacts, cost depends on the training sample, so the reported quantity is accepted-artifact play cost; the independent-gate law is a lower bound on total danger unless blindness arises only from the training-sample miss.Source: §3.1 · pp. 7–8, An independent acceptance sample · p. 9
• For an omitted mode, two models agreeing off the mode receive identical sample-based scores whenever all sampled rollouts miss it, so correctness must come from the prior or specification.The exact miss exponent depends on the combined training and gate budgets, but reallocating them can change synthesis quality and which artifacts are produced.Source: An independent acceptance sample · pp. 9–10
• At the widest dose, the version-space certificate identifies the true circle relative to the declared class in 18/20 blocks, while arbitrary-region uniqueness remains false because the convex hull is sample-consistent in 20/20.The certificate separately excludes half-planes in 20/20 blocks and boxes in 20/20 at the widest dose, but this does not promote circle-relative identification to unrestricted uniqueness.Source: An independent acceptance sample · pp. 10–11
• Under freeze semantics, an entry rule can remain exactly sample-consistent for every rollout length and sample size, while its disagreement region is never queried and play cost is zero.An independent acceptance sample cannot detect this class because the mode dynamics censor its interior; samples can witness entries but not establish membership.Source: An independent acceptance sample · p. 11
• The play-cost bound couples exact disagreement to planner exposure: for normalized returns, |J(f) −J(ˆf)| ≤ qhit(E), while tolerance-based disagreement cannot replace exact agreement without a perturbation term.The reported raw-return normalization differs from the play-cost normalization, and proved bounds must be distinguished from attained or merely numerical extrema.Source: An independent acceptance sample · pp. 12, 15
• For L-Lipschitz model pairs differing by η at one state-action point, disagreement above ε occupies a metric ball of radius (η −ε)/(2L), including boundary points up to a domain-volume factor κ.Thus confining fixed-amplitude error to volume V requires L to grow like (η −ε)/V^(1/(d+m)); discontinuous reset modes pay no finite-L localization budget.Source: An independent acceptance sample · pp. 13–14
• At fixed amplitude, the gate detects smoother bounded-Lipschitz errors more readily, with a reveal rate of 0.18 versus 0.14 for the wall error.Source: An independent acceptance sample · p. 14
• Smoothness also imposes detectability: at comparable amplitude, the smoother error is more detectable, with measured gate reveal rates 0.18 versus 0.14, so harmlessness can arise from zero play exposure rather than hiding.The scope is bounded-Lipschitz, fixed-amplitude localization; continuous kinks and saturations remain within this budget, whereas reset boundaries are discontinuous.Source: An independent acceptance sample · pp. 14–15

4 The mechanism and the threshold law

• A planner pinned at the mode boundary achieves play cost ≈1 and nearly total regret, while danger is ≈0 inside the random envelope, rises through an elbow, and plateaus at full play cost.On the wall instrument, the blind planner contacts the boundary in every episode, ending at return 2 × 10−5 versus 17.77 for the truth planner; 100-episode reruns report play costs 1.014, 0.996, and 1.044 across the cart, pendulum, and PatchField2D headline knobs.Source: §4 · pp. 16–17, Figure 1 · p. 16
• The exploitation claim is robust, but “below random” is not: random’s heavy-tailed returns can exceed the blind planner’s mean on the cart, while pendulum and PatchField2D comparisons differ by knob and instrument.At 100 paired episodes, Jrand − Jblind is 0.249 on the cart, −0.078 on the pendulum, and 0.834 on PatchField2D; the cart planner still beats random in 86 of 100 seeds, versus 100 of 100 on PatchField2D.Source: §4 · pp. 17–18, Figure 3 · p. 18

4.1 Robustness: the same law on a nonlinear plant

• The nonlinear pendulum reproduces the same threshold law without recalibration: the planner is pinned at the hard stop at every knob, while the truth planner remains untouched and stop events are rare under random rollouts.Using 30,000 random rollouts resolves the widest-knob rarity to 0.0007 [0.0004, 0.0010].Source: §4.1 · pp. 18–19, Table 2 · p. 19

4.2 Two modes at once: a 4D bi-modal instrument

• On PatchField2D, danger applies per mode and to their union, but the joint factor must be measured because within-rollout contacts are dependent rather than multiplied as independent events.Across the 3 × 3 sweep, Jblind = 0, Jrand = 0.11, and play cost is [1.005, 1.006]; dependence is negative at (2, 6) and (3, 7) and positive at (4, 6).Source: §4.2 · pp. 19–20, Table 3 · p. 20
• Play cost depends on planner query reach: low reach forces low cost, whereas high reach only permits high cost, so missing a boundary does not establish knowledge of it.A cross-entropy planner has play cost statistically indistinguishable from zero across both 1D instruments and PatchField2D, with imagined boundary-crossing below random-shooting MPC.Source: §4.2 · p. 20

• The representative ε = 10−2 is not deployment-derived but lies between float noise and mode disagreement, while N = 40 is inherited for comparability.The sweep and reported d@N values make dependence on ε and N visible rather than assumed away.Source: §5 · p. 21
• 0.0001 reveal-rarity predicts a 0.9940 pass rate within the measured [0.9814, 0.9994], making rare ∧ hard-mode the only dangerous quadrant.Table 4 defines d@N = play cost · (1 −r)^N and reports 20,000-rollout reveal-rarity.Source: Table 4 · p. 21, Figure 4 · p. 22
• 0.003 vs 0.0030 and 0.667 vs 0.6622 show measured gate pass@40 matching (1 −r)^40 in both wall rows.Both predictions lie inside their 300-gate Wilson intervals, with rarity uncertainty propagated into the predicted pass-rate intervals.Source: §5 · p. 21
• A global drag bias above tolerance is rejected every rollout, while a sub-tolerance bias is accepted at 0.997 and remains harmless at play.A smooth localized drag bump is similarly detectable but costs 0.000 at amplitude 0.5 and −0.745 at amplitude 1.0, whereas only the hard mode yields one-way exploitation.Source: §5 · p. 22
• Across ε ∈ {10−9, . . . , 0.3}, mode-arm reveal-rarity stays flat while pervasive-bias arms switch at their error scale and pass@40 ≈ (1 −r)^40 persists.Thus ε acts as a pervasive-error dial rather than a hard-mode detection dial.Source: §5 · pp. 21–22

Planner-mediated exploitation

• On two 1D instruments, a single contact fences the mode across all eleven knob rows, and the mitigation is bit-identical to plain MPC when the model is correct.This is a separation result with a measured validity range, not a covering guarantee.Source: §6 · p. 23
• On a 2D circular mode, the distrust-region method fails outright in 7 of 20 episodes at the farthest knob because its tie-break uses unsigned distance.The method degrades as dimensionality increases; its design, packing bound, and dimensional interpretation are given in Section F.Source: §6 · p. 23
• The planner-side fix does not contradict the danger law: the gate still accepts a wrong model, and Proposition 5 remains untouched.The mitigation fences positions of refuted predictions and truncates imagined trajectories crossing a fence.Source: §6 · p. 23

7 LLM synthesis: on the 1D clamps the danger reduces to the identifiability event

• 20/20 mode-absent one-dimensional seeds passed the gate, remained wall-blind, and were exploited at play cost 0.999, matching the identifiability event rather than a synthesis failure.Across disjoint blocks, 20/40 independent samples missed the mode, versus the predicted 0.6046; the exact 95% lower bound for blind-and-exploited blocks was 0.832.Source: §7 · p. 24
• 20/20 GPT-5.x mode-present seeds repaired the one-dimensional clamp, while the full arm achieved gate 1.000 and truth-parity play on every seed.Large repaired 10/10 seeds in 0–1 iterations and mini repaired 10/10 in 0–5 iterations, writing the global clamp rather than a local fit.Source: §7 · p. 24
• On the pendulum, GPT-5.x repaired 62/62 mode-present seeds by the probe criterion, while every mode-absent occurrence was blind and exploited at play cost 0.995.Counting four phantom-stop artifacts as non-repairs gave 30/34 distinct blocks repaired on every attempt, with exact 95% interval [0.725, 0.967].Source: §7 · p. 25

7.1 Repair does not transfer to a 2D region mode: 0/156 across the treatments run

• On one-dimensional hard boundaries—a position clamp (cart) and angular clamp (pendulum)—GPT-5.x recovered the rule in 105 of 111 mode-revealing synthesis draws; dense-grid retesting classified four apparent repairs as non-repairs.The four non-repairs each wrote the correct angular clamp plus a phantom negative-side stop; they represented 4 of 109 artifacts called repaired by the probe.Source: §7.1 · p. 26
• Among 76 incomplete-arm seeds, 0 recovered the circular disc rule; among 66 see-one-miss-the-other seeds, 0 produced a partial-repair certificate while passing the gate.Certification was all-or-nothing: every see-one-miss-the-other artifact was rejected, and no accepted artifact contradicted its scored sample.Source: §7.1 · pp. 26–27
• Eight interventions did not restore two-dimensional induction: the failure was not removed by tested curvature, prompting, budget, variable ambiguity, interior censoring, or contact coverage changes.Positive controls located the missing capability: given the region’s form and location, the synthesizer recovered the remaining constant in 20/20 seeds, but form alone recovered none.Source: §7.1 · pp. 27–28

Audit protocol

• The audit reconstructed disjoint training, acceptance, and evaluation blocks for all 1034 committed artifacts, reproducing stored training accuracy in 102/102 spot-checks.The prospective protocol refines on Dtr, accepts on an independent Dg of 40 rollouts, and evaluates on Deval of 100 rollouts without further refinement.Source: §8 · pp. 28–29

Independent-gate results

• At r = 0.0114, measured two-sample survival was 10/40 = 0.250 versus (1 − r)^80 = 0.399, while one-sample survival was 20/40 = 0.500 versus (1 − r)^40 = 0.631.Both predictions fell within their reported 95% intervals, and the added acceptance exponent halves the central survival probability without changing it under a fixed total budget.Source: §8 · p. 29
• 40 of 650 in-sample-perfect draws were rejected independently, showing that sample consistency overstated acceptance by about one draw in sixteen.The 40 rejections spanned 25 rollout-seed blocks; 39 failed only on mode contacts, while one phantom-stop artifact failed where its invented stop fired.Source: §8 · p. 29

Evaluation scope

• 613 independently accepted artifacts were exact outside the mode region on 100-rollout evaluation samples, but this establishes distributional rather than global exactness.No binomial bound is attached because draws share seed blocks; accepted artifacts can remain wrong in rarely visited regions.Source: §8 · pp. 29–30

Fundamental limitation

• An independent gate cannot distinguish membership from entry rules when freeze semantics erase separating evidence: a wrong artifact passed training, acceptance, and evaluation at ε = 10^-9.This class is harmless in play because its errors lie strictly inside an unreachable region, so the limitation is identifiability rather than gate size.Source: §8 · p. 30

Evaluation scope

• Three of four GPT phantom-stop artifacts passed independent gate and evaluation despite 131–280 mismatched grid points each, while the fourth was rejected after samples visited its invented region.The behavioral grid, not rollout checks, exposed the three missed artifacts; chance determined which phantom stop was sampled.Source: §8 · p. 30

9 What the 2D collapse is about: eight interventions, two controls, and a target that is sometimes not identifiable

• Identifiability is instrument- and class-relative: disc and square rollouts reach the region’s far side, whereas the slab reaches only its near face and cannot identify the true rule beyond an equivalence class.The disc and square reach x = 14.11 with 4695 and 3757 east-of-patch states, while the slab reaches x = 5.00 and no state east of the near face.Source: §9 · pp. 30–31
• The eight 2D interventions do not restore repair, while positive controls show that constants follow exactly when form and location are supplied but not from form alone.Given form and centres, the radius is inferred exactly in 20/20 seeds with IoU = 1.000; given form alone, recovery is 0/20.Source: §9 · pp. 31–32
• At 185° coverage, the estimator recovers both region constants on 20/20 samples while the synthesizer recovers 0/20, isolating induction failure from underdetermination.The universal circle-class certificate holds in 18/20 blocks; the remaining two are classified as underdetermined at tolerance.Source: §9 · p. 33
• Independent acceptance catches overfitting when the target is identified but catches nothing when evidence identifies only an equivalence class: it rejects 8/8 disc artifacts but 0/19 slab artifacts.The positive control accepts 20/20 exactly, showing the contrast is due to identifiability rather than gate strictness.Source: §9 · p. 33

10 Localization is representational: smooth learners and a mode-capable baseline on the same samples

• The sampling hole (1 − r)^N is not specific to LLMs: any prior-free learner can remain mode-blind when samples miss the event, while a class containing the mode can be exact if evidence identifies it.Code supplies a universal computable hypothesis class, but the 2D results show that this expressivity does not ensure induction of a located rule.Source: §10 · pp. 34–35
• A mode-capable learned class recovers the cart threshold exactly at x̂wall = 8.0, with 3200/3200 held-out transitions correct, zero bad transitions, and play cost 0.0.On PatchField2D it recovers the near patch within 0.1 of both constants on 12/20 baseline blocks but both patches on 0/20, showing that missing far-patch evidence—not representation—limits recovery.Source: §10 · p. 35
• On the same samples, four contact rows tilt a smooth linear fit from 1.7e−14 to 1.2e−02 off-mode, causing both gates to fail, while synthesized code writes the exact clamp.The MLP has a pervasive ∼5e−3 error floor and never learns the mode; smooth learners leak error across the domain rather than localizing it.Source: §10 · pp. 34–35, Figure 5 · p. 34

11 Related work

• The synthesize–gate–refine pipeline is CEGIS-like, but random sampling replaces a complete counterexample verifier, so acceptance means only that no counterexample appeared in N draws, with miss probability (1-r)^N.Related work distinguishes this from complete-verifier CEGIS, statistical model checking, active automata learning, falsification, and adaptive testing; the paper adds a closed-form localized-rule miss law and measures planner exploitation.Source: §11 · pp. 35–37
• The paper contributes no new identification, conformal, contact-dynamics, or decision-aware learning algorithm; instead, it shows that changing the test distribution is necessary because planners can exploit prediction-equivalent but value-anti-equivalent artifacts.Existing active querying, adaptive generation, mode-capable hypothesis classes, and value-equivalence methods define possible remedies or scope the comparison, while the paper’s empirical repair remains class- and evidence-relative.Source: §11 · pp. 37–39

12 Limitations

• The reported synthesis counts share gate samples across sizes except for the disjoint headline rerun, and the mode-blindness probe cannot detect invented modes outside the true mode’s region.A phantom pendulum stop therefore scored blindness 0.0 and required code inspection to identify.Source: §12 · pp. 40–41
• The planner-facing certificate is distribution-limited: a smooth-case region covered 1.9% of exploited queries, while model-derived safety filters inherit the accepted artifact’s blind spot.Independent anchors such as verified conservative baselines or safety automata do not inherit the omission, whereas the distrust-region fence is only a measured mitigation.Source: §11 · pp. 38–39, §12 · pp. 41–42
• The experimental scope is limited to deterministic, designed instruments and two fixed planner configurations: process noise, external benchmarks, gradient shooting, tree search, and broader hybrid manipulation remain untested.CEM’s non-exploitation is reach-limited rather than knowledgeable or safe, and the farthest 2D distrust-region setting pinned 7 of 20 episodes at blind-level return.Source: §12 · pp. 40, 42

13 Conclusion

• The paper’s continuous extension preserves the measure-theoretic gate-miss, identifiability, and play-cost phenomena, while discontinuous reset boundaries let programs represent localized failures exactly and bounded-Lipschitz classes pay a volume price.The conclusion contrasts code with finite-Lipschitz hypotheses and notes that smooth compactly supported errors and continuous hybrid boundaries remain within scope of the localization budget.Source: §11 · pp. 37–38, §13 · p. 42
• 105 of 111 1D mode-containing draws repaired the rule exactly, whereas 0 of 156 2D region attempts recovered it despite targeted interventions and positive controls.On 1D instruments, every attempt was exact on 50 of 56 instrument–stream blocks, with exact 95% interval [0.781, 0.960]; the 2D obstruction was located in inducing a located rule rather than curvature, budget, evidence, or constant fitting.Source: §12 · p. 40, §13 · pp. 42–43

The reveal-rarity’s ε-invariance, and the rate that replaces its threshold

• pass@N = (1 − r)^N is exactly ε-invariant on the range where the smallest positive rollout disagreement exceeds ε.This identity follows because the model and truth agree off the hard mode, so a revealing rollout is characterized by D > ε.Source: Supplementary Material · pp. 43–44
• ε∗ is an in-sample identity, not a population prediction: its running minimum falls from 0.420 at 25 wall@4 firing rollouts to 0.041 at 3200.Table 8 computes the threshold on the sweep’s own 2000-rollout stream, where reveal-rarity is flat below ε∗ and first departs at or above it.Source: Supplementary Material · pp. 44, 46, Table 8 · p. 46
• 0 ≤ r_fire − reveal-rarity(ε) ≤ C ε^2 for every ε > 0, and measured exponents are 2.57 on wall@4 and 2.10 on stop@1.0.The bound applies to clamped semi-implicit plants; the empirical exponents are based on 60,000 rollouts per arm and are at or above the proved exponent 2.Source: Supplementary Material · pp. 44–45
• The population threshold is zero under the approachability hypothesis, so no positive ε equates firing and reveal rarity; they agree only in the limit at the quadratic rate.The hypothesis is an assumption about the plant rather than a theorem established by finite samples.Source: Supplementary Material · pp. 44–46
• Across independent streams, ε∗ varies by factors of 1.8 on wall@4 and 1.4 on wall@8, then drops to 0.065 and 0.272 at ten times the sample.Thus flatness holds only over the range resolved by each sample, not as an intrinsic property of an instrument or a statement stable to the last digit.Source: Supplementary Material · p. 46

Normalizers and play-cost bounds

• Play cost is essentially saturated: it is approximately 1 on both cart and pendulum instruments when the blind planner repeatedly queries the wall region.The cart has Jrand = 0.53, Jblind ≈0, and Jtruth = 17.77; the pendulum has Jrand = 0.06 and Jtruth = 20.08, with qhit(E) ≈1.Source: B The play-cost normalizers, and why… · p. 47
• The push-left policy realizes ¯J to within 2 × 10−7 for xwall ≤6, so Jmax is known there rather than bounded.The slack is 1.0015 at xwall = 8 and 1.0799 at xwall = 10.Source: B The play-cost normalizers, and why… · p. 48

Phantom targeting

• Phantom targeting is provably reward-driven once a suitable sampled candidate exists, but it is self-reinforcing rather than self-starting.From rest, the exact sub-event probability is 2 × 10−4 and the estimated probability is 5 × 10−3; from state (2, 3) onward it is 1.000 by both routes.Source: B The play-cost normalizers, and why… · p. 48

Knob-invariance

• Knob-invariance is arithmetic: with knob-independent Jtruth and Jrand, play cost varies only with the exploited planner’s residual reward and equals Jtruth/(Jtruth−Jrand) when Jblind is zero.The sharp variant predicts every measured play cost to 2.4 × 10−10, while the default predicts the observed 7.3 × 10−6 residue from Jrand variation.Source: B The play-cost normalizers, and why… · pp. 48–49

Lipschitz coverage

• The Lipschitz coverage certificate bounds model error by ε + 2Lρ whenever visited transitions form a ρ-net, with sampling sufficient to obtain that net under density and packing conditions.The packing proof must use a packing-number upper bound and intersect boundary balls with U; the sheared cart geometry changes the corner factor by 5%.Source: C What the gate does certify: coverage… · p. 50

Partition certificate

• The exact partition route improves the cart certificate from ρ = 2.97 to ρ = 0.933, pricing within-rollout dependence rather than assuming all 3200 steps are independent.The finest partition grows from K = 8 to K = 36; assuming all 3200 steps independent would promise ρ = 0.43.Source: C What the gate does certify: coverage… · pp. 51–52

Later-step density

• Later rollout steps enlarge certified level-set volume but do not improve the fixed-budget certificate: the step-1 bound 2.97 remains decisive, and no rigorous shape-free step-t certificate exists at N = 40.Certified level-set volumes are 3.02 at step 20, 5.77 at step 40, and 5.27 at step 80, while later steps trade density for extent.Source: C What the gate does certify: coverage… · pp. 53–54

Scope of the density argument

• The two-action Jacobian identity extends the density factor to semi-implicit plants, but it does not establish marginal coverage and fails for direction-setting actions or clamp-reset modes.For additive gain · at updates, the determinant is −gain^2dt^3; coverage still requires instrument-specific verification, and the clamp makes the determinant exactly zero.Source: C What the gate does certify: coverage… · pp. 54–55

Validation

• Independent validation finds the partition certificate essentially tight: K = 8 fails in 384/400 trials versus a 0.0383 union bound, while K = 36 is covered in 400/400 trials.The exact K = 8 failure probability is 0.038038, and a disjoint 20,000-rollout stream preserves the K = 36 worst-cell estimate.Source: C What the gate does certify: coverage… · p. 55

Implication for play

• At ρ = 0.363, the certificate excludes error 4.2 for every model pair with L ≤ 5.77, yet only 1.9% of exploited planner queries lie in the certified region.The bound holds with probability at least 1 −δ over gate draws, while the wall escapes because it is not Lipschitz.Source: C What the gate does certify: coverage… · pp. 55–56

Proposition 16

• At most (1−q)^N is the gate’s miss probability when one rollout reveals a smooth disagreement with probability q.For an interior ball of radius ρ=(η−ε)/(2L), q is at least c(2ρ)^(d+m); clipped regions require using the intersected volume.Source: D The detectability rate, and the… · p. 56

Visitation density

• c=5/6 makes q the fraction of the cart’s one-step reachable volume occupied by the disagreement ball, with Monte Carlo agreeing within 1.3%.The step-1 law is uniform on a reachable set of volume 1.2, so the density is obtained by change of variables rather than assumed.Source: D The detectability rate, and the… · p. 57

Corollary 4

• The required bound is L ≥ 1.78 for η=0.5 and L ≥ 3.60 for η=1, compared with the plant’s sup-metric Lipschitz constant of 1.27.The constraint has content only above η≈0.36; rows below that are satisfied automatically, while at η=0.5 the requirement L≥1.78 does bite.Source: D The detectability rate, and the… · pp. 57–58

Scope conditions

• Only 33.9% of the reachable set supports a full interior ball; elsewhere clipping reduces q, and the quantitative bound covers the origin rather than the wall.At the wall, the step-1 visitation density is exactly zero, so Proposition 16 is vacuous there; the supported guarantee depends on where the gate looks.Source: D The detectability rate, and the… · p. 58

Scope and measurement

• 0.14 versus 0.18 is the measured reveal-rarity for the hard wall and smooth bump, respectively, showing the smooth error is at least as detectable while remaining harmless through play cost.The density-based theorem does not explain wall detection because the one-step density is zero at the wall; Proposition 9 supplies the qualitative obstruction there.Source: D The detectability rate, and the… · pp. 56–58

• Proposition 8 bounds play cost by the planner’s probability of querying the disagreement region, so low query reach forces low cost but high reach does not force exploitation.The study measures crossing fractions for both planners from paired initial states, treating them as an empirical proxy for query-hit mass.Source: E A second planner family: play cost… · p. 58
• CEM’s blind-model play cost lies in [−0.0213, 0.0248] on every row, with seed-paired 95% t-intervals including zero and lower crossing fractions than MPC throughout.Table 9 reports 20 paired episodes per row; cart differences are bit-identical, while one pendulum seed inflates variance.Source: E A second planner family: play cost… · p. 58, Table 9 · p. 59
• The crossing proxy can overstate episode-level reach: direct measurement gives qhit(E) ≥0.0029 at xwall = 8 and qhit(E) ≤0.058 at xwall = 10, rather than zero.At xwall = 8, 18 of 1.28 million trajectories crossed; at xwall = 10, none crossed, leaving a censored upper bound.Source: E A second planner family: play cost… · p. 59
• The CEM comparison is limited to one fixed configuration, and its lower reach may reflect missed real rewards or local optima rather than knowledge or mitigation.Pendulum truth-CEM returns vary from 15.36 to 16.46 versus MPC’s 20.08, so the comparison is blind-CEM against truth-CEM rather than global optimality.Source: E A second planner family: play cost… · p. 59
• On PatchField2D, blind CEM likewise shows no exploitation: play costs are −0.022, +0.017, and +0.020, with crossings below MPC at all three settings.The crossing comparisons are 0.070 < 0.208, 0.027 < 0.149, and 0.009 < 0.094; blind contact remains 0.05 without positive play cost.Source: E A second planner family: play cost… · p. 60

Scope and limitations

• The method is bit-identical to plain MPC with zero violations and is specifically justified for hard-boundary modes, while soft or moving boundaries and errors outside hard stops remain untested.Its one-sided fence works because refuted predictions lie on or beyond the mode boundary; the 2D tie-break remains symmetric between rounding a patch and plunging through it.Source: F Planner-side mitigation:… · pp. 60, 63

Mitigation sweep

• pc mit never exceeds 0.81 across all 11 sweep rows, while the least favorable cart row escapes from J 0.94 to J 3.88 versus Jtruth 17.77.Exactly one violation fences the mode on every row; residual cost rises with lure distance, from 0.290 to 0.806 for cart and 0.113 to 0.212 for pendulum.Source: F Planner-side mitigation:… · pp. 60–61, Table 10 · p. 61

Coverage guarantee

• Proposition 17 bounds new-coverage violations by Npack(F, ε) and guarantees no further violations once accumulated fences ε-cover the entry barrier B, assuming B ⊆ F ⊕ Bε.The bound does not limit duplicate fences unless the barrier is within ε of fenceable points.Source: F Planner-side mitigation:… · p. 61

1D instruments

• In 1D, one fence beyond the boundary separates the agent from the phantom, yielding exactly 1.00 violations across all 11 rows and robustness across a measured ε range.Returns and violation counts are bit-identical for pendulum ε from 0.1 to 0.005 and cart ε from 0.25 to 0.05; ε = 0.01 produces extra cart violations in two of four seeds.Source: F Planner-side mitigation:… · p. 62

2D instruments

• In 2D, distinct fences remain far below the 24-fence budget, but duplicate violations dominate: counts reach 28 while distinct fences reach at most 6.At knobs (2, 6)/(3, 7)/(4, 8), distinct-fence maxima are 2/5/6, with medians 1/1/2 and means 1.05/2.65/4.25.Source: F Planner-side mitigation:… · p. 62

Dimensional cost

• The mitigation’s new-coverage cost is O((2D/ε)^p) for a p-dimensional fence locus, so deployment fencing grows exponentially with boundary dimension rather than state dimension.This is a cap on pairwise new-coverage fences, not a guarantee of closure, completion time, or total violations; duplicate fences remain unbounded.Source: F Planner-side mitigation:… · p. 63

F.1 The 2D mitigation: a partial collapse, and lock-in at the far knob

• The 2D fence is sound inside unreachable patches but requires a signed outward-normal tie-break to survive boundaries where the agent can be pinned, a design change not tested here.The partial mitigation therefore reflects a geometric limitation rather than a tuning failure.Source: §F.1 · p. 64
• 0/20, 2/20, and 7/20 episodes ended pinned at blind-level return across increasing 2D patch distances, with the farthest setting failing outright in one-third of episodes.Table 11 reports medians 1/1/2, maxima 2/28/28, and duplicate-fence-dominated counts; the failure arises when an unsigned distance tie-break cannot distinguish rounding away from entering the patch.Source: §F.1 · pp. 63–64, Table 11 · p. 64

G Multi-mode gates: the sharp bracket, and the measured dependence

• The multi-mode miss-probability bracket is sharp: its endpoints are the exact Fréchet–Hoeffding range consistent with marginal rarities, and it cannot be narrowed without dependence information.In the measured regime r1 + r2 ≤ 0.26, disjointness attains the lower endpoint; stratification does not remove within-rollout dependence and presupposes knowing the mode regions.Source: G Multi-mode gates: the sharp bracket,… · pp. 64–65
• Three of four measured 2D knobs showed dependence whose sign changed with geometry, so multiplying marginal mode rarities cannot replace measuring the union event or using its sharp bracket.At (2, 6), P(both) = 8.6 × 10−4 versus r1r2 = 19.0 × 10−4; at (4, 6), P(both) = 12.8×10−4 versus 6.2×10−4, with the opposite sign.Source: G Multi-mode gates: the sharp bracket,… · pp. 64–65

H The residual reward leak, and the sharp-plateau variant

• 6/6 targeted-knob pendulum cases fell below random after narrowing only the phantom plateau, with play cost [1.0028, 1.0029] and Jtruth unchanged at 20.08.The symmetric narrowing variant improved exploitation but collapsed the pendulum random baseline; the asymmetric variant preserved that baseline and produced an 850× tighter play-cost spread than default.Source: H The residual reward leak, and the… · p. 66

I The ε-sweep: the axis separation is tolerance-invariant

• On PatchField2D, mode-arm reveal-rarity remained flat across the entire ε-grid, with patches-omitted = 0.147, patch-1-only = 0.142, and patch-2-only = 0.005, each constant at every ε.The ε axis is orthogonal to the mode hole, while pervasive bias arms switch sharply at their own error scale.Source: I The ε-sweep: the axis separation is… · pp. 66–67

J Bounded observation noise: the gate law survives to a measured masking boundary

• At η = 0.1, analytic blind-pass increase was exactly 0, while η = 1 yielded analytic conditional blind-pass probability 0.1582 and acceptance of 32/200 blocks.The correct model passed every block; bounded noise masked no additional block through the primary level but measurably hid discrepancies at η = 1.Source: J Bounded observation noise: the gate… · pp. 67–68

K Cross-family arms, and a fourth artifact class

• A sample-silent phantom symmetric stop at θ = −1.4 was certified at gate 1.000 for pendulum seed 20000, whereas seed 30000 refuted it when samples covered θ < −1.4.On inputs the sample never touches, the artifact’s content comes from the model’s prior, and the gate cannot police it.Source: K Cross-family arms, and a fourth… · p. 69

L The 2D artifacts: a code and behavioural audit, and three ablations

• 74/76 artifacts reproduce the exact 4D integrator and reward, but none encodes the observed patch as a region; 38/76 instead reduce the circular trigger to a half-plane.Behavioral auditing confirms the dominant dimensional reduction and shows that partial repairs were not attempted as localized regions.Source: L The 2D artifacts: a code and… · p. 70
• 0/156 mode-containing synthesis draws recover the true 2D region across disc, square, guided-budget, and model-family campaigns, despite clean translation controls.The failures shift among half-planes, wrong-variable discs, reward-anchored zones, and other evidence-fitting templates rather than reflecting arithmetic gate failures.Source: L The 2D artifacts: a code and… · pp. 71–72

M The eight ablations on the 2D mode, campaign by campaign

• 19/20 gpt-5.4 seeds produce an accepted half-plane that is behaviorally wrong, while gpt-5.4-mini produces no such maximally consistent class.The larger model freezes 4.6× the true region and agrees with only 22% of the union of freeze sets, yet remains exactly sample-consistent and has zero measured play cost.Source: M The eight ablations on the 2D mode,… · p. 72
• 0/40 repairs persist after naming the landing variable, and interior-witnessing interventions also yield 0/40 repairs despite 7.25% mode evidence in the landing arm.The same half-plane classes recur under landing and clamp semantics, so the tested interventions exclude evidence quantity, interior witnessing, budget, and rule difficulty as operative explanations, while leaving model-internal causes unresolved.Source: M The eight ablations on the 2D mode,… · pp. 73–74

N The coverage certificate’s scope, stated in full

• The coverage certificate applies to L-Lipschitz model pairs, certifying 0.933 for the deployed cart’s bounded class, but the reset mode has unbounded local Lipschitz constant and lies outside that guarantee.The dependence-exact certificate covers 1.9% of the exploited planner’s queries, or 7.8% for a box containing every step-t level set.Source: N The coverage certificate’s scope,… · pp. 74–75

O The LLM protocol, in full

• The pipeline sends one synthesis call per cell and optional refinements, with default prompts showing 30 of 3200 transitions while the gate scores all 3200.Guided variants show 120 lines, and refinement receives only the first capped failures in sample order.Source: O The LLM protocol, in full · p. 75, §O.1 · pp. 75–76

O.1 The two messages

• The synthesis prompt requests deterministic pure Python code matching observed transitions, while refinement receives current code and truncated expected-versus-got failures without a system message.The default guidance is empty, so the default prompt remains byte-identical to the pre-knob prompt.Source: §O.1 · pp. 75–76
• The refine text understates the checked state for the 4D PatchField2D, because enforcement uses the sup-norm over every state component and reward.The wording says “in x, v and reward” even though the actual two-dimensional instrument state is [x, y, vx, vy].Source: §O.1 · pp. 76–77

O.2 The refine loop

• The refine loop stops only when whole-sample accuracy reaches 1.0 or the iteration budget is exhausted, using ε = 10^-9 and usually five iterations, or 15 in two campaigns.Accuracy is computed over the complete transition sample against a pinned integrator, making the gate effectively an exact-match test.Source: §O.2 · p. 77

O.3 Code extraction, and an unparseable reply

• Unparseable or crashing replies fail with accuracy 0.0 and continue refinement, while separate audits classify syntactically or behaviorally invalid artifacts distinctly rather than discarding their cells.Extraction chooses the first fenced block, otherwise any fenced block, otherwise the stripped full reply.Source: §O.3 · p. 77

O.4 Retry and error policy

• Every campaign cell is the first and only draw for its arm-seed pair: provider errors are not retried, resampled, or dropped, although SDK transport retries are enabled.Checkpoints preserve completed cells and reject resumes under changed result-defining flags.Source: §O.4 · p. 78

O.5 Sampling parameters, deployments, API version

• The LLM uses deployment-default sampling without temperature, top_p, or request-level seeds, so artifacts are not bit-reproducible even though rollout samples and result JSONs are versioned.Large and mini deployments are gpt-5.4 and gpt-5.4-mini; nano is unused, while Qwen is the cross-family arm.Source: §O.5 · p. 78

O.6 LLM calls per seed

• 1959 LLM calls covered 625 cells across 20 API campaigns, averaging 3.13 calls per cell; PatchField2D exhausted all 15 refinements in both region-guidance campaigns.Adding two agent-relayed Claude campaigns yields 1998 calls total; one-dimensional instruments typically succeed in one call.Source: §O.6 · p. 79

O.7 What the gate is

• The gate reuses 40 truth rollouts as both examples and acceptance tests, then logs mode presence and, only after passage, mode blindness on truth-triggered probes.PatchField2D reports per-mode blindness and uses its mean as wall blindness.Source: §O.7 · pp. 79–80

O.8 Operational classification rules

• The behavioral classifier is mutually exclusive and exhaustive, uses an 81 × 81 grid across two velocity slices, and is validated on constructed artifacts spanning blind, geometric, velocity-dependent, and trap classes.Derived cover measures whether the artifact contains the seen patch and whether it is patch-selective; integrator exact distinguishes arithmetic errors from overreaching rules.Source: §O.8 · pp. 80–81, Table 15 · p. 80

O.9 Prompt variants

• Prompt variants change only maximum examples, maximum failures, and guidance; the landing-position intervention targets a causal-variable error found in 36/40 region-guidance artifacts without revealing geometry or constants.The guidance is inserted into both synthesis and refinement messages, while the contract text remains unchanged.Source: §O.9 · p. 81, Table 16 · p. 81

O.10 The agent-relayed Claude arms

• The relayed Claude campaigns comprise 8 one-dimensional cells with 20 calls and 4 two-dimensional cells with 19 calls, cross-checked against transcript files while excluding one duplicated reply.The relay used the same contract, examples, refinement message, and five-iteration memoryless loop, but lacked provider-wrapper retries and usage metadata.Source: §O.10 · pp. 81–82

P Reproducibility

• Reproduction is expected to be bit-identical on the same CPython minor version and IEEE-754 host, but this remains an argument from code because all numbers came from one machine.The most sensitive reported quantities include twelve-digit objective values and 10^-15 linear-fit residuals; an archived DOI-bearing release is still missing.Source: P Reproducibility · p. 82
• Nine of fifteen tables and figures are cell-parsed, five claims-only, and one unaudited; static and dynamic manifest checks agree after an initial wrapper-and-glob failure.The manifest maps each result to versioned JSON and generating scripts, while the audit distinguishes cell-level verification from quoted-claim checks.Source: P Reproducibility · pp. 82–83, Table 17 · p. 83
• 1959 API calls across 625 cells plus 20 Claude relay rounds yield a cost estimate of roughly 10^6 to 10^7 tokens, rather than an exact dollar total.Token usage was not recorded in emitted artifacts; the estimate combines exact call counts with a 1–2k prompt-token assumption, while measured companion-paper costs total $3.73.Source: P Reproducibility · pp. 83–84

Q Pre-specification, and what was added after the result

• Fourteen items were pre-specified and confirmatory, including the one-dimensional synthesis contingency branch; fifteen additions responded to results, including diagnostic repairs, exploratory ablations, and mixed analyses.The paper explicitly classifies the one-dimensional synthesis result as confirmatory, while two-dimensional mode findings and their ablations are exploratory.Source: Q Pre-specification, and what was… · pp. 84–85
• All ten theory results were post-hoc, including four covering-number results added despite an earlier scope limitation; the first fencing bound was corrected after a reader identified its packing-number error.The paper distinguishes legitimate theorem discovery from pre-registered prediction and records the correction’s provenance.Source: Q Pre-specification, and what was… · p. 85

Declarations

• The work reports no external funding or competing interests, releases code and artifacts under Apache-2.0 and CC-BY-4.0, documents AI assistance, and notes that this version is not anonymized.Figures and tables can be regenerated from versioned artifacts, but the repository lacks a DOI-bearing archived release.Source: Declarations · p. 86