R12 DRS Causal Cycle Preregistration

Status: r3 frozen replacement diagnostic after the r2 computation-path identity failure; no architecture, SFT, or reasoning claim is authorized by this document.

Rejected r2 attempt and replacement boundary

Canonical job 691838 completed, but its report is mechanically invalid and has no scientific standing. The immutable rejected report artifacts/evals/drs_causal_cycle_post_drs_r2.json has SHA-256 208b61c546f9a4a1aa7512c6ed86d00c7f142b7655732e2ac84f71b1d312cfab. One of 50 identity generations changed a carry token, so identity_token_mismatch=1 and aggregate.valid=false; every decision is therefore null.

The cause was a mechanical graph mismatch. R2 collected donor and identity residuals with one full-sequence forward pass, then replayed them inside prompt-prefill plus incremental KV-cached decoding. Those paths are mathematically equivalent but not required to be bit-identical under BF16, and the mismatched record had a near-tied carry logit. R3 changes no scientific case, threshold, checkpoint, heldout data, layer, or intervention. It captures and replays every residual through the exact same prompt-prefill plus one-token cached path used by generation. The r2 observations must not be rescored or used as evidence.

Question and exact boundary

Post-DRS residual replacement moves held-out digit logits by about +31 at layers 17--29 and carry logits by about +2.96 at layer 29. That proves a local value-bearing residual exists. It does not identify which part of a multi-step cycle fails: native production, state-line serialization, text transport, or next-step response.

For the current inference API, each DRS call invokes GPT.forward from token ids with no hidden-state argument from the preceding call. If H_t denotes all hidden tensors in call t, Y_t its emitted text, and P the fixed canonical state parser/renderer, then

H_t -> Y_t -> P(Y_t) -> H_(t+1)

is the only cross-call causal path. Conditional on the forwarded token ids, H_t has zero direct influence on H_(t+1). A successful residual-authored first state followed by a successful unpatched second call is therefore positive end-to-end evidence. A failed second call is not, by itself, localized consumer evidence because it also includes new residual production and state serialization. The probe consequently scores teacher-forced second-call local digit/carry predictions separately from full replay.

This is a decomposition theorem, not a new reasoning primitive.

Frozen inputs and board

The claim-bearing scientific source closure is also frozen:

The batch job copies exactly those five sources and all three frozen inputs to a fresh job-private snapshot, makes the snapshot read-only, verifies every hash there, and executes only the copied probe with the copied inputs. The canonical report records the copied scientific-source hashes, Slurm job ID, and snapshot identity. The snapshot is deleted after the process exits. This closes hash-then-reopen drift inside the ordinary trusted Slurm/filesystem boundary; it is not remote attestation against a malicious same-UID process.

Use transition index 2 only. For each of the five frozen regimes, select the first ten episode IDs satisfying

apply_microstep(s).carry != apply_microstep(flip_carry(s)).carry.

The resulting 50 records are true decimal-boundary cases: the first altered state changes the carry consumed by the following local computation. Each record also receives an independent same-regime donor matched on operation, width, position, input carry, next carry, and next digit.

The claim-bearing run is fixed at layer 29, greedy BF16-autocast cached decoding, 96 new tokens, and fresh output artifacts/evals/drs_causal_cycle_post_drs_r3.json. Input hashes are checked before model loading. The job accepts no scientific override. Output uses exclusive same-directory publication and refuses existing files. Canonical mode additionally requires CUDA, the exact output path, a Slurm job ID, and the verified private snapshot. Every noncanonical invocation must use the explicit development-only flag; it reports all scientific decisions as null, even if its raw mechanics resemble a pass.

Frozen interventions

All generation uses the same KV-cached stopping contract as the public greedy evaluator. Every teacher-forced donor residual is captured by pre-filling the prompt and then feeding the teacher-forced continuation one token at a time. Every identity and sham logit comparison replays that exact cached prefix and patches only its final token. R3 fails closed unless the separately tokenized prompt is an exact prefix of the teacher-forced field prefix. A residual hook applies only to the final current token at an exact token-prefix match. At layer 29 it can affect the next emitted token but cannot enter a later transformer block or survive as hidden state.

For each record run:

1. baseline: no intervention;
2. identity: base residuals replace themselves at carry and digit sites;
3. same-target rescue: independent same-label donor residuals at both sites;
4. carry only: counterfactual carry residual, scored against a carry-only hybrid state;
5. digit only: counterfactual digit residual, scored against a digit-only hybrid state;
6. both: counterfactual carry and digit residuals, scored against the full counterfactual next state;
7. token ceiling: directly force only those two target tokens, then let the model serialize everything else;
8. irrelevant sham: transplant carry/digit residuals from a state differing only in an already-written result digit, while the active transition target is unchanged.

Every arm records requested-site reach separately by arm and field. Low reach is a behavioral pre-field serialization outcome, not mechanical invalidity. The identity control additionally compares full generated token IDs and exact teacher-forced logits. The irrelevant sham is scored causally in the base prefix: patched digit/carry argmax must remain invariant, and the sham-generated token sequence is compared directly with baseline. Unpatched donor-context invariance remains diagnostic only and cannot satisfy the sham gate.

Independent second-call tests

Regardless of first-arm success, run unpatched calls from both the reachable base next state and the canonical carry-counterfactual next state. Score:

• teacher-forced next digit and carry argmax;
• paired active-digit switching under the changed carried bit;
• whole successor-state greedy exactness;
• the integrated two-call cycle, requiring the residual-authored first state and the unpatched counterfactual successor both to be exact.

For every parsed first state, canonicalize and hash the actual next-prompt token ids and the intended next-prompt token ids separately. Exact equality is the transport endpoint; no hidden state is forwarded.

Mechanical validity

The report is invalid unless all conditions hold:

• exactly 50 records, ten from each named regime;
• every selected record satisfies the carry-boundary predicate;
• checkpoint, heldout, and tokenizer hashes equal the frozen values;
• every teacher-forced identity patch, captured and replayed through the exact cached path, has zero max absolute logit delta;
• every identity generated token sequence equals baseline exactly;
• the output path was exclusively published.
• execution is canonical CUDA BF16 from the verified private snapshot and the exact frozen output/configuration;
• all five scientific source hashes equal the table above.

Site reach, parse rate, and all capability scores are outcomes rather than validity gates.

Frozen decision thresholds

Every primary endpoint is emitted both on the balanced 50-case aggregate and separately for each ten-case regime. No aggregate pass can hide a zeroed regime. Same-target rescue remains aggregate-only because a regime may have zero baseline failures; its per-regime numerator and nullable denominator are still reported.

Interpretation is conditional. A high token ceiling with low residual-authored exactness identifies the residual-to-token interface. High first-state and paired second-call scores with weak baseline rollout identify native state production/control as the remaining DRS bottleneck. A low teacher-forced second-call score means next-step response is already broken before whole-state serialization; a high teacher-forced score but low full successor exactness localizes that branch to serialization.

Equivalence and claim dossier

The probe supplies oracle residuals or oracle target tokens and is therefore an external causal intervention, not autonomous reasoning. It adds no parameters, persistent hidden bits, training examples, learned updater, or executor. It cannot establish an advantage over SFT, recurrence, retrieval, fast weights, hard registers, external execution, or finite unrolling. Its only admissible claim is localization within the existing DRS text-mediated cycle.

Any architecture experiment selected by this result requires its own resource-vector comparison, exact collapse test, finite falsifier, and matched controls.