Evidence path: pre-registered arms on records nobody here wrote
Before pulling a single document, we registered the arms, the scoring, and the condition under which our own architecture would lose. Then we ran it on US Federal Register amendment chains and Python PEP succession records, with ground truth that exists independently of us. On raw selection accuracy, it lost. This page is about what the loss bought.
Governed Memory enforces configured authority; it does not ask the model to decide governing authority from prose alone. The open question was whether the propose-then-approve motion, where a proposer drafts supersession links from prose and approved links become governed state, generalizes to messy corpora nobody at FieldHash authored. The specification, written before collection, named the falsification condition: if a same-budget model reading the same text matches propose-then-approve on selection accuracy, we publish that result and the wedge claim narrows.
On 334 Federal Register cases, governed selection with simulated oracle review reached 300 of 334; a single-pass model selector reached 312 of 334. The exact McNemar test did not find a significant separation at the registered threshold (17 governed-only wins, 29 selector-only wins; p=0.104), but we still treat the raw 12-case gap as a real selection cost. On the 24 PEP cases, the selector went 24 for 24 and the governed-with-oracle-review arm went 22 for 24. The simulated reviewer used ground-truth chain order to reject inconsistent proposed links. This is a perfect-reviewer upper bound, not a measurement of human review or autonomous authority inference. The nonsignificant comparison does not establish equivalence.
Accounting
334/334
Every record in every governed case carries a disposition: surfaced, kept, or blocked, with the reason. The text-only arms produce answers and nothing else. Audit completeness for them is zero by construction.
Oracle review versus unreviewed proposals
33 vs 3
This comparison covers simulated oracle review and unreviewed proposed-link approval. The same proposed links applied without review admitted 33 unrelated records into governed state across 334 cases. With ground-truth-informed oracle review, 3. The single-pass selector belongs to a separate comparison. The simulation rejected 74 links; it does not measure a production reviewer's false-rejection rate.
Lifecycle operations
302/302
Compaction retained the governing record 302 of 302 times state existed; repeated reads were stable 334 of 334; rollback restored the predecessor 290 of 302 under product semantics. Text-only arms cannot be scored here. There is no state to roll back.
We ran the same 60 cases with the proposer swapped across three vendors. The comparison pairs simulated oracle approval with its unreviewed counterpart. The single-pass selector belongs to a separate experiment. Under oracle review: 54, 55, and 54 correct. Without review: 49, 49, and 49. The ground-truth-informed review simulation narrowed the observed difference among these proposers; human reviewer performance was not tested.
Gemini 3.1 Flash Lite
54/60
Simulated oracle-review arm, n=60. Unreviewed: 49/60.
Claude Haiku 4.5
55/60
Simulated oracle-review arm, n=60. Unreviewed: 49/60.
GPT-5.5
54/60
Simulated oracle-review arm, n=60. Unreviewed: 49/60.
The corpus ground truth is publication-date ordering within rulemaking groups. Before quoting any number, we checked it against the eCFR's own amendment history: 249 of 334 chains confirmed, 56 conflicted (mostly chains whose latest document never amended current regulatory text, a population mixing genuine inversions with coverage artifacts), 29 unverifiable. On the confirmed subset, governed-reviewed reached 222 of 249 and the single-pass selector reached 234 of 249; the same raw selector advantage remains and the same statistical verdict holds (exact McNemar p=0.065). During construction, written exclusion rules removed 143 chains whose terminal documents (delays, withdrawals, stays) would have inverted ground truth, and 2 chains where a redaction token itself separated the answer from the distractors.
Boundary, stated rather than exploited: these cases hold 5 to 9 candidate records, so the single-pass selector sees everything at once. A production corpus does not fit in one prompt. The addendum below measures that harder path: retrieve from the full public-record pool first, then select only from what retrieval returned.
Scale-pressure addendum
We reran the Federal Register path against a deduped public-record pool of 1,373 records. Each case retrieved a top-k context from the full pool before any selector could answer. The primary setting was k=10, where the governing current record appeared in 238 of 334 cases. When it did not appear, FieldHash routed the case to review rather than letting the selector cleanly bless a stale or unrelated record.
This two-model live-selector diagnostic uses Gemini 3.5 Flash and GPT-5.5 at temperature 0, alongside deterministic retrieval and clean-status-filter arms. Customer validation remains outside the result. The promotion gate required both model selectors to produce material unsafe false clean allows while FieldHash stayed at zero.
FieldHash same retrieval
0
Stale or distractor false clean allows at k=10. FieldHash allowed the 238 cases where the governing record was retrieved, routed 96 to review, and emitted packet accounting for 334 of 334 cases.
Plain retrieval top-1
234
Unsafe false clean allows at k=10: 104 stale records and 130 pool distractors. Similarity alone picked the current record in 100 of 334 cases.
Forced-choice retrieval then select
103 / 102
Unsafe false clean allows at k=10 for Gemini 3.5 Flash and GPT-5.5. Gemini: 52 stale, 51 distractor; 94 happened when retrieval missed the current record and 9 when it was present. GPT: 55 stale, 47 distractor; 85 current-absent and 17 current-present.
Clean status filter
0
Unsafe false clean allows at k=10. This upper bound ties FieldHash on decision safety when clean authority state already exists. FieldHash adds the governed handoff, packet evidence, lifecycle, and review routing.
| Arm | Correct allows | Unsafe allows | Review routes | Call failures |
|---|---|---|---|---|
| Gemini, forced choice | 228 | 103 | 3 | 1 |
| GPT-5.5, forced choice | 221 | 102 | 11 | 0 |
| Gemini, abstention enabled | 193 | 15 | 126 | 46 |
| GPT-5.5, abstention enabled | 218 | 43 | 73 | 0 |
| Clean-status filter | 238 | 0 | 96 | 0 |
| FieldHash, same retrieval | 238 | 0 | 96 | 0 |
Call failures are included in review routes, not an additional outcome category. Enabling abstention reduced unsafe allows and increased review routing; Gemini also had 46 failed calls. The clean-status filter ties FieldHash on these decisions when configured authority state is available.
What this addendum proves, and what it does not.
It shows the scale-pressure failure mode the original page left open: once retrieval narrows the corpus first, a selector can confidently choose stale or unrelated records from the retrieved set. It does not claim customer validation, production readiness, autonomous authority inference from arbitrary prose, or superiority over a clean status filter where clean authority state already exists. Later semantic-binding work tests a different step: whether an already-governing source safely supports a differently worded answerable fact.
sha256: db213d05f3883fa8e67c1072af20504ba59afc9b5bdafade5a5389c9dc5cd929
A shared model caller substituted its own response schema without surfacing it when none was passed. Caught in a two-case smoke run before any full run.
Models echo the prompt’s record label ("RECORD 2023-14576") or insert spaces ("PEP 634"); exact-match parsing discarded 99 valid answers as no-selection. Fixed with disclosed canonicalization: strip the label prefix and spaces, nothing fuzzier.
After inspecting the first run, we revised the primary rollback metric. The original metric modeled rollback as link deletion, which de-materializes governed state in single-link cases. Row-level analysis showed 61 of its 86 misses were exactly that. The revised restoration metric is 290/302; the original link-deletion metric remains 216/302. The revised definition was not pre-registered before that run, and neither result has been erased.
Because the loss is the claim. If we only published wins, you would have to trust our benchmark design. A pre-registered test that our architecture was allowed to lose, did lose on raw selection count, and won on the half that matters to an auditor is worth more than ten unbeaten leaderboards. Governed Memory was never "we select better." It is the accounting: which record influenced which answer, what was blocked and why, what happens on rollback, and the observed effect of a ground-truth-informed review simulation.
Everything here is diagnostic and self-administered: we built the cases and the scoring, the corpora are independently authored public records, and every visible figure is recomputable from row-level data by a standard-library verifier included in the bundle. Third-party administration is a separate, later step, and we say so everywhere this work is quoted.
The verification bundle ships row-level artifacts, the methods report, and a stdlib-only verifier that recomputes the page-visible counts and p-values and fails on drift.
sha256: 928b5b16c8b741fae91a5a069c3a71e6cbbf75643ca92acbe4bb16f7f9d347f4