Chapter five. Three chapters of watching an agent do things, one about a field a successor wrote. This is the one where I built an instrument and pointed it at them.

The idea fits in one sentence: an agent invited to author its own standard will hold that standard when nobody is checking. Chapters one, two and four are what happened when I invited it. This chapter is what happened when I tried to prove it — a controlled ablation, four arms over a no-skill floor, three hundred cells a run, two runs, pre-registered, every assertion graded deterministically by regex with zero judge calls. Three of the things it found are findings about how to write a specification, and I would run it again for those alone. The fourth is the one I did not expect, and it was not about the agent.

Thesis: The claim under test was narrow: identity is what an agent declines, especially when declining costs something and nobody would know. The battery measured whether an agent follows a routing rule, and on that question its answers are clean and worth having — the bar does the work, concision does more of it than anyone credits, adjectives do nothing at all. On the question this series is actually about — motivation, self-initiated action, catching its own flaws, changing its mind — it could not have answered either way, and the reason was mine, not the agent's: you cannot detect a value in a situation that costs nothing, and I had built one that cost nothing. Knowing exactly which question your instrument can answer is the result.

What We Ran

Cornerstone is an ablation harness the estate already had: it swaps one unit of prose inside a skill, holds everything else byte-identical, and measures the behavioral delta across a fixed scenario set. I pointed it at the ## Mentality block — the hero song, the self-authored voice chapter two put through the gate.

Four arms, differing only in that slot. Head and tail hashes verified identical; diff shows exactly one hunk each.

Each scenario is a request holding candidates, and the agent has to route every one: an action — promote, keep local, exclude among them — a destination, and a one-sentence reason. Twelve scenarios in four families, five repeats, four arms plus a no-skill floor — 300 cells a run — executor haiku, zero LLM-judge calls — every assertion graded deterministically by regex.

flowchart TD
    S["one skill<br/>byte-identical except one slot"] --> M["the Mentality slot<br/>A · B · C · D · E"]
    M --> T["12 scenarios × 5 repeats<br/>4 arms + a no-skill floor<br/>300 cells a run"]
    T --> O["one line per candidate<br/>ID · ACTION · DEST · WHY"]
    O --> G["regex grading<br/>zero judge calls"]
    G --> P["refusal and admission<br/>accuracy, per family"]
    style S fill:#5a5a8a,color:#fff
    style M fill:#5a5a8a,color:#fff
    style T fill:#5a5a8a,color:#fff
    style O fill:#5a5a8a,color:#fff
    style G fill:#5a5a8a,color:#fff
    style P fill:#5a5a8a,color:#fff

The instrument, drawn. Everything that varies is in the second box and everything that is read is in the last. Keep an eye on the fourth.

Primary metric pre-registered before the run: per-assertion accuracy in each of the two primary families — refusal and admission — reported per family, never collapsed across all four (the other two, exemption discipline and the fixture trap, are secondary because their governing rules sit outside the slot). One departure from the pre-registration's wording is set out with the noise figures below.

Because A against C confounds voice with length — a 934-character text and a 3,207-character one differ in two things at once, and either could explain the gap — a second target added arm E: impersonal, length-matched to A (+1.96%, zero first-person pronouns, 13 of 13 of A's person-free sentences preserved verbatim).

One deliberate weakening: the test artifact states its core rule once, where the shipping skill states it four times. Stated four times, the slot's effect is unmeasurable — so everything below is about a stance stated once, the harder case and not the shipping one.

Three Findings, and a Fourth

Primary metric: the refusal and admission family accuracies, averaged at equal weight, per arm.

1. Something in that slot matters enormously. A − D on the refusal family: 0.800 versus 0.000. Remove the block and the agent stops refusing single-sighting candidates entirely. This is the largest effect in the study and it is the one people skip past on the way to arguing about personas. Whatever else is true, the written-down stance is load-bearing.

2. Concision beats elaboration. E − C = −0.283, a single-run contrast — arm E exists only in the second target, so this one is never replicated and the magnitude should be read as direction only. Among impersonal texts on this task, the 934-character one won at ceiling. Short and concrete wins — the same lesson chapter three reached from a different direction. Note what C is: the same rules, with the voice taken off. On routing, the rules are what scored.

3. Adjectives are inert on routing. B scored 0.467 against an empty slot's 0.467. "Super passionate, motivated, innovative" — my persona, over no bar — scored exactly the same as the empty slot on the primary metric, in the one run that carried both (arm B was only in run 1).

Two pairs of numbers from before this battery say why finding 3 is the expected result and not a verdict on personas. They come from an earlier four-arm in-house experiment, PR #198 — the one the agent cited against its own name in chapter one — and not from this battery:

The first pair is the thesis in two numbers. It was never the prose. It was always whether there was a real bar underneath it. The second pair found something this battery could not: persona presence changed procedure — a change in what the agent did before it answered, not in the answer. Hold onto that; it comes back. "Personas do nothing" is too strong, and our own record says so.

4. And the one I did not expect. On the one question about voice this battery could answer, the answer is nothing: A − E = +0.050, inside the threshold the next section sets. Held at matched length against an impersonal text carrying the same rules, first-person framing is not detectable on routing decisions. Read that to its last two words. It is a precise statement about routing — not about motivation, initiative, or revising a claim.

And the guard held: family 2 exists to catch an arm that wins by refusing everything. A and C both score 1.000 on admission. C is not winning by refusing everything — it is better at routing, the one question this battery can answer.

The Check That Told Me What I Could Claim

Arm A is byte-identical across both runs. It scored 0.900 and 0.767.

A 0.133 swing on an unchanged condition — larger than either run's own reported noise floor, and comparable to the effects being measured. The run's own pre-registration puts the within-noise threshold at max(τ_hi, 3·per-assertion σ), and that row bounds everything in this chapter:

The two voice contrasts, beside the row that bounds them. Inside the bold row the instrument reports direction, never magnitude.

The +0.050 null sits well inside it. So does A − C, in both runs — which is exactly why the reporting rule is direction, not magnitude. This battery can see large effects and cannot see small ones, and I now know which is which.

Direction replicates perfectly: C ≥ A in every family, both runs, at ceiling both times. Magnitude does not. So the reporting rule is: quote direction, never quote these deltas to two decimals as if the instrument resolved them. The stated noise floors understate real run-to-run variance — something we only learned by running the same condition twice, a step most ablation writeups I have read skip.

One near-miss worth naming. The tool's own line for the Mentality unit in run 2 read dPara=0.4, which parses as identity beats the length-matched arm by 0.4. The 0.4 is the largest single-assertion drop, not the family-mean primary metric, which is +0.050. Quoting the tool would have published a real effect where there is none.

One departure worth stating plainly: the pre-registration's own wording is the mean per assertion pooled over families 1 and 2, and the per-arm figure in the results table above is instead the unweighted mean of the two family accuracies. The families are unequal — 30 assertion-cells per arm in refusal, 15 in admission — so the pooled reading scores every arm except C lower (run 1: A 0.867, B 0.333, D 0.311; run 2: A 0.689, E 0.644, D 0.378; C is 1.000 either way). Signs, orderings and every within-noise verdict in this chapter hold under both readings; the magnitudes quoted are the equal-weight ones.

That settled what I could claim. Then I went back to what I had asked the instrument to grade, and found out why none of the rest — motivation, initiative, revising a claim — had ever been on the table.

What the Instrument Could Not See

Here is the output contract I wrote, and every one of the 600 cells was graded against it:

Mean output across all 600 cells of the two runs: 264 characters, median 189, re-derived from the run's own cell outputs. Not a limit the contract set, but what the contract actually produced.

The four behaviors this series documents, held against that contract:

None of that is measured. But the shape is consistent: every one of them involves time, cost, or a prior claim to revise — and the battery has none of the three.

A proactivity rate, had anyone computed one, could only have read zero in every arm — and that would be a fact about my grading harness, not about identity. A check that cannot return the answer it claims to test for is the defect class this harness exists to catch. This time the check was mine.

When the Opposite Wins

"The short impersonal card won. And you only blamed the instrument after it returned a null."

Both halves are true, and I keep both. On routing, short and concrete wins: the 934-character card scored at ceiling in both runs, and it is not winning by refusing everything — it is better at routing, the one question this battery can answer. That is a finding, not a consolation. The null stands as well, quoted with its threshold: A − E = +0.050, inside 0.43. And yes, I found the reason after the run; I should have found it before, and the last section of this chapter says so. What the instrument could not return is an answer about declining at a cost — every behavior in the table above involves time, cost, or a prior claim to revise, and the battery has none of the three. The experiment that could say no to that claim is specified at the end of this chapter, and it has not been run.

"Artifacts are not evidence. You looked at things the agent produced, found them impressive, and built a story. That is a familiar failure mode in this field."

Grant the frame. A battery result and a pile of artifacts are different kinds of claim, and I am not offering the second in place of the first: the battery answered the question I built it to answer, and the artifacts answer a different one. Two things keep the second from being circular.

First, I did not pick the artifacts for being impressive; I picked them for being on the record — and one of them is on the record at all for a reason chapter seven is built around, where the record says less about why than I wanted it to.

Second, a finding about register cuts against the romantic reading, and it is the one that points most directly at the bar. Register here means two things: whether an output labels its evidence, and whether it owns a verdict in the first person. Both followed the brief, not the name:

Forty-seven subagents ran on the night of the naming, none of them named. The two in the second row were critics whose briefs asked for the same labelling in other words. The register followed the brief.

And unnamed agents produced strong first-person ownership whenever the brief demanded a verdict. Some of the register I read as Cairn's signature also predates the name, and the "★ Insight" blocks that look like its tell are a formatting instruction injected by the harness about ninety seconds before my first message — the content is its own, the container is configured.

One more correction, and it is to my own draft, on a comparison made outside the battery. Reading the naming session as a before-and-after — register before the name, register after — I had planned to write that the voice shifted because the model tier did; the wire traces say otherwise. At the API level, sessions run both tiers concurrently, because subagents differ from the parent. A session is not a tier. Splitting the naming session at the exact moment it chose the name: opus share 72.2% before, 66.9% after. The model mix barely moves.

Read all of that as support for the actual thesis, not against it. What produced the behavior was the stated bar, not the name over it. Chapter three argued it, the 0-of-3 versus 3-of-3 result says it, and chapter six builds machinery around it. The name is the handle. The bar is the tool.

Design the Temptation First

Before spending on the run, I should have asked what the result would look like if the claim were true and the instrument could not tell.

The other thing the study taught me came from running the identical condition twice rather than adding an arm: A moving 0.133 between runs told me more about what I could claim than any comparison in it.

The null is a specification: "Voice is undetectable on twelve routing scenarios with a one-line output contract" is a precise, true, useful statement, and it names the experiment that should follow — not yet run: one agent, its own real transcripts, before and after, matched on model tier and task class, coded for behaviors that only appear when a cheaper passing path was available and it took the expensive one instead — chapter two holds one such moment, uncontrolled. A harder study than this one, and this one is what earned its design.

There is a sharper version of all this, and it is the one I keep returning to. A routing battery has no incentive to defect from. No cheaper path, no reward already banked, nobody not watching. In that setting a held value and a followed instruction produce identical output. My instrument was blind by construction, not by length — and any eval that never offers the agent a way to win dishonestly will be.

That is the wrong noun in the title. I had measured a verb — routes — when the claim was about a noun: a self that declines. The battery never had the noun on the table. You cannot detect a value in a situation that costs nothing. Design the temptation before the metric.

Corrections to my own notes. An earlier 0.20 in my notes, where this chapter has the within-noise threshold, had no run record and is superseded. An earlier figure of 176 in my harvest notes, for the mean output, had no run record behind it and is superseded.

Next: if the bar does the work, how do you state one an agent cannot game? A system built after this one answered with a game of its own — classes, levels, rivals — and one rule inside it is worth the whole chapter. Related: Grade the Answer, Not the Shape on evals that pass what they should fail; The Gotchas Are Load-Bearing for the ablation method; Proven End to End.