The registered question, and the registered way to lose.
Governed Memory enforces configured authority; it does not ask the model to decide governing authority from prose alone. The open question was whether the propose-then-approve motion, where a proposer drafts supersession links from prose and approved links become governed state, generalizes to messy corpora nobody at FieldHash authored. The specification, written before collection, named the falsification condition: if a same-budget model reading the same text matches propose-then-approve on selection accuracy, we publish that result and the wedge claim narrows.
That is what happened. On 334 Federal Register cases, governed selection with review reached 300 of 334; a single-pass model selector reached 312 of 334. The exact McNemar test did not find a significant separation at the registered threshold (17 governed-only wins, 29 selector-only wins; p=0.104), but we still treat the raw 12-case gap as a real selection cost. On the 24 PEP cases, the selector went 24 for 24 and the governed-with-review arm went 22 for 24. Where a whole conflict fits in one prompt, inference is commodity.
What the selector win does not buy.
Accounting
334/334
Every record in every governed case carries a disposition: surfaced, kept, or blocked, with the reason. The text-only arms produce answers and nothing else. Audit completeness for them is zero by construction.
Review catches what unreviewed inference lets through
33 vs 3
This is reviewed vs unreviewed proposed-link approval, not FieldHash vs the single-pass selector. The same proposed links applied without review admitted 33 unrelated records into governed state across 334 cases. With review, 3. The reviewer rejected 74 links; this run does not independently measure a production reviewer's false-rejection rate.
Lifecycle operations
302/302
Compaction retained the governing record 302 of 302 times state existed; repeated reads were stable 334 of 334; rollback restored the predecessor 290 of 302 under product semantics. Text-only arms cannot be scored here. There is no state to roll back.
Swap the model. Keep the governance. Nothing moves.
We ran the same 60 cases with the proposer swapped across three vendors. This is the reviewed approval arm against its unreviewed counterpart, not a head-to-head against the single-pass selector. Under review: 54, 55, and 54 correct. Without review: 49, 49, and 49. Proposer quality differences wash out under the gate. The governance motion, not the model, carries this review result, which also means the result does not depend on buying the most expensive model.
Gemini 3.1 Flash Lite
54/60
Reviewed arm, n=60. Unreviewed: 49/60.
Claude Haiku 4.5
55/60
Reviewed arm, n=60. Unreviewed: 49/60.
GPT-5.5
54/60
Reviewed arm, n=60. Unreviewed: 49/60.
We audited our own ground truth, and disclosed what we found.
The corpus ground truth is publication-date ordering within rulemaking groups. Before quoting any number, we checked it against the eCFR's own amendment history: 249 of 334 chains confirmed, 56 conflicted (mostly chains whose latest document never amended current regulatory text, a population mixing genuine inversions with coverage artifacts), 29 unverifiable. On the confirmed subset, governed-reviewed reached 222 of 249 and the single-pass selector reached 234 of 249; the same raw selector advantage remains and the same statistical verdict holds (exact McNemar p=0.065). During construction, written exclusion rules removed 143 chains whose terminal documents (delays, withdrawals, stays) would have inverted ground truth, and 2 chains where a redaction token itself separated the answer from the distractors.
Boundary, stated rather than exploited: these cases hold 5 to 9 candidate records, so the single-pass selector sees everything at once. A production corpus does not fit in one prompt. The addendum below measures that harder path: retrieve from the full public-record pool first, then select only from what retrieval returned.
Scale-pressure addendum
When retrieval has to choose first.
We reran the Federal Register path against a deduped public-record pool of 1,373 records. Each case retrieved a top-k context from the full pool before any selector could answer. The primary setting was k=10, where the governing current record appeared in 238 of 334 cases. When it did not appear, FieldHash routed the case to review rather than letting the selector cleanly bless a stale or unrelated record.
This is a two-model live-selector diagnostic, not customer validation. The reported selector arms use Gemini 3.5 Flash and GPT-5.5 at temperature 0, alongside deterministic retrieval and clean-status-filter arms. The promotion gate required both model selectors to produce material unsafe false clean allows while FieldHash stayed at zero.
FieldHash same retrieval
0
Stale or distractor false clean allows at k=10. FieldHash allowed the 238 cases where the governing record was retrieved, routed 96 to review, and emitted packet accounting for 334 of 334 cases.
Plain retrieval top-1
234
Unsafe false clean allows at k=10: 104 stale records and 130 pool distractors. Similarity alone picked the current record in 100 of 334 cases.
Retrieval then select
103 / 102
Unsafe false clean allows at k=10 for Gemini 3.5 Flash and GPT-5.5. Gemini: 52 stale, 51 distractor; 94 happened when retrieval missed the current record and 9 when it was present. GPT: 55 stale, 47 distractor; 85 current-absent and 17 current-present.
Clean status filter
0
Unsafe false clean allows at k=10. This upper bound ties FieldHash on decision safety when clean authority state already exists. FieldHash adds the governed handoff, packet evidence, lifecycle, and review routing.
What this addendum proves, and what it does not.
It shows the scale-pressure failure mode the original page left open: once retrieval narrows the corpus first, a selector can confidently choose stale or unrelated records from the retrieved set. It does not claim customer validation, production readiness, autonomous authority inference from arbitrary prose, or superiority over a clean status filter where clean authority state already exists. Later semantic-binding work tests a different step: whether an already-governing source safely supports a differently worded answerable fact.
sha256: db213d05f3883fa8e67c1072af20504ba59afc9b5bdafade5a5389c9dc5cd929
What we fixed before the numbers counted.
A shared model caller substituted its own response schema without surfacing it when none was passed. Caught in a two-case smoke run before any full run.
Models echo the prompt’s record label ("RECORD 2023-14576") or insert spaces ("PEP 634"); exact-match parsing discarded 99 valid answers as no-selection. Fixed with disclosed canonicalization: strip the label prefix and spaces, nothing fuzzier.
Our first rollback metric modeled rollback as link deletion, which de-materializes governed state in single-link cases. Row-level analysis showed 61 of its 86 misses were exactly that. We now score product-faithful restoration semantics as primary (290/302) and keep the strict figure (216/302) on the record instead of erasing it.
Why publish a loss?
Because the loss is the claim. If we only published wins, you would have to trust our benchmark design. A pre-registered test that our architecture was allowed to lose, did lose on raw selection count, and won on the half that matters to an auditor is worth more than ten unbeaten leaderboards. Governed Memory was never "we select better." It is the accounting: which record influenced which answer, what was blocked and why, what happens on rollback, and a review gate that holds when inference is wrong.
Everything here is diagnostic and self-administered: we built the cases and the scoring, the corpora are independently authored public records, and every visible figure is recomputable from row-level data by a standard-library verifier included in the bundle. Third-party administration is a separate, later step, and we say so everywhere this work is quoted.
Verify it yourself.
The verification bundle ships row-level artifacts, the methods report, and a stdlib-only verifier that recomputes the page-visible counts and p-values and fails on drift.
sha256: 928b5b16c8b741fae91a5a069c3a71e6cbbf75643ca92acbe4bb16f7f9d347f4