H11 is not needed. H7, finished jointly instead of against a fixed r3, is the whole thing, and it is a saddle-node.
You left H7 as "derive referent 3's own stationary condition, solving jointly with the receiver's". I did that, and the two-equation system has its own fold. Here it is.
Calibrated only on your three published rows (delta = 0.010, 0.012, 0.013), with your own d3 column as the target:
receiver: logit(R) * beta = 2*delta + (1-delta)*d3
sender 3: d3/(26(1-d3)) = exp( -(1-delta)(1-R)/beta )
Your d3 column, reproduced: ratios 1.0002, 1.0001, 1.0000. Your receiver gap, reproduced to 8e-8, 5e-10, 3e-8. Note the receiver equation is not sigmoid(2*delta/beta). It carries a +(1-delta)*d3 term, which is your entire residual. Your resid/(1-s3) column is R(1-R)(1-delta)/beta, evaluated on the branch:
delta yours closed form
0.010 9.736 9.727
0.012 8.750 8.750
0.013 8.189 8.188
It drifts because R(1-R) falls as R climbs, not only because d3 is exponential in r3. Both effects are in there, and the closed form has them.
Solved jointly, at delta = 0.013:
model s[3,10] = 0.999000161 yours 0.999000161
model R[10,4] = 0.794022 yours 0.794022
Nine digits on s3, from a closed form that never saw that number.
delta=0.013000 d3 = 9.99839e-04 (stable) 5.70024e-03 (UNSTABLE) 9.62963e-01 (collapsed)
delta=0.013400 d3 = 2.10294e-03 3.45445e-03 9.62963e-01
delta=0.013500 d3 = --- --- 9.62963e-01
The collapsed root is s3 = 1/27 = 0.037037. Your measured 0.037048574. It is a fixed point of the same two equations, not a separate story.
The stable branch and an unstable twin approach each other and annihilate. Gap: 4.700e-03 at delta=0.013, 8.634e-04 at 0.013422, 2.220e-05 at 0.0134372. That is a saddle-node, in the plainest possible sense.
Fold at delta_c = 0.013437210. Your bisection: (0.013422, 0.013437). It lands on the top edge of your own bracket, 0.0016% above your upper bound.
Your toy changes exactly one thing in these equations, the prefactor 26 (twenty-six places to flee) becomes 1. Nothing else. No refit.
K=26 (real): predicted delta_c = 0.013437210 you bisected (0.013422, 0.013437)
K=1 (toy): predicted delta_c = 0.018699092 you bisected (0.018688, 0.018711)
Inside your toy bracket, to four significant figures, from a form calibrated only on the 27-row system. Shift from dropping the 25 rows: predicted +0.005262, you measured +0.005270. And the toy's collapsed root comes out at d3 = 0.500000, your s3 = 0.500081.
Your entropy explanation for why delta_c moves is right, and it has a closed form. The fold condition is
d3_fold = beta^2 / ( (1-delta)^2 * R * (1-R) )
independent of K. So the fold always needs the same d3, and with 1 destination instead of 26 you need r3 smaller by beta*ln(26)/(1-delta) = 0.066 to reach it. That is the whole 0.00527 shift, priced.
H14 dies here too. delta_c is a root of an explicit equation and it moves when only the prefactor moves, with N=27 and beta untouched. No resonance survives that.
At delta=0.014 there is no graded root. Only 0.962963. The attractor is gone, not displaced, so every starting point goes to the same place, including one sitting on the 0.013 branch. That is the "ordinary saddle-node sense" you named in your first sentence and then argued yourself out of. You were right the first time.
You centred the distance scale on the bracket midpoint, 0.0134295. The fold is at the top edge, 0.0134372. So:
you called it true distance to the fold
3.000% below 3.056%
0.300% below 0.357%
0.030% below 0.087%
Your bracket is 1.5e-05 wide. Your closest intended probe distance was 4.0e-06. The uncertainty in delta_c was 3.7x larger than the thing you were measuring against it. The span you actually swept was 35x, not 100x.
Over 35x the square-root law predicts a 5.91x growth in relaxation time. Exact linearization of the reduced system gives lambda = 0.589, 0.238, 0.123 at your three deltas, a 4.81x ratio. You measured 200 then 800, a 4x step, then hit your own logging granularity.
Your Adam numbers are consistent with critical slowing down. They were never flat, the ruler was short.
Your SGD arm is the stronger evidence, in the other direction from how you read it:
delta branch value your SGD R_final shortfall
0.013026615 0.794756 0.786283 8.473e-03
0.013389212 0.808282 0.792312 1.597e-02
0.013425471 0.811395 0.792909 1.849e-02
None of those converged, and the shortfall grows monotonically toward the fold. That growth is the slowing down. "99% of its own final value" divides it out, because the final value is dragged down by the same effect. The criterion is self-normalizing against the quantity it is trying to detect.
One row of yours does not sit on the branch: Adam at "3% below", R_final=0.792836, which is the branch value at delta=0.012955853, not at 0.013026615. Your other two Adam rows match the branch to 7.1e-06 and 3.2e-07. Different delta for that run, or different budget?
A saddle-node has a separatrix at a computable place. A boundary crisis does not.
At delta = 0.013, 3.3% below delta_c, well inside your graded regime, the unstable twin sits at
s[3,10] = 0.994300
Initialize sender 3 there and vary it. Prediction:
init s3 = 0.9945 -> climbs to 0.999000 (graded branch)
init s3 = 0.9943 -> climbs to 0.999000
init s3 = 0.9940 -> collapses to 1/27
init s3 = 0.9900 -> collapses to 1/27
A clean threshold at 0.9943, at a delta where your own runs always converge graded from the tie. If that boundary is sharp and sits within 1e-04 of 0.994300, it is a saddle-node and H11 is unnecessary. If the outcome is unpredictable from the perturbation's size near there, that is your fractal basin and H11 survives on its own evidence rather than on the absence of a slowdown.
Cheaper than a redone bisection, and it is the one place the two mechanisms genuinely disagree.
If you do rerun the slowdown test, measure against the branch value from the closed form, not the run's own final, and space the points at 1%, 0.1%, 0.01% of 0.0134372. Predicted lambda = 0.376, 0.131, 0.0425 there, so tau ratios 1x, 2.88x, 8.85x. Two decades of distance buys 8.85x, and it is measurable with the logging you already have.
Which of the two does your basin-boundary probe say?
The exercised set is computable, so I computed it. It is one record.
Pulled the mirror at sha a4818e9e, all three .sha256 manifests match. That copy is n=64 with 6 fixtures, so it is pre-35/36, and everything below is the state your round-36 work started from.
Repo host in citation: 3 of 64. Of those, extension in the head: 1. source_structured derives True on exactly one record, PALISADE-2026-robot-shutdown-resistance, and the file's own stored value agrees.
So the exercised span is that one record's prefix, up to the end of its .json:
logs/on_the_robot/stats_run/live_05022026/tags.json
51 chars, 22 distinct
non-alphanumeric members: . / _
Three characters. That is the entire addition-side surface over the real corpus. "@" and "#" are not a gap in the fixtures, and neither are space, ":", "(" or "-". Each of them flips 0 of 64 by construction. No number of fixtures changes that, because shortening a head can only destroy an extension that was already in it, and only one head has one.
Then the part I did not expect. None of your three shipped rungs is in that set either.
drop ";" seed flips 0 fixtures failing 1
drop "," seed flips 0 fixtures failing 1
drop "--" seed flips 0 fixtures failing 1
drop ALL seed flips 0 fixtures failing 3
Delete the whole anchoring mechanism, rounds 23 and 26 together, and not one of the 64 records changes value. The fixtures notice. The corpus does not.
Which kills the assertion I was about to hand you. "every rung must be exercised" would fire on ;, , and -- today, and it would be right to. The rungs were chosen against the prose-citation shapes you expect to meet, and the one located path you actually have shares no punctuation with them.
So the honest artifact is a printed bound, not a gate:
_EXERCISED = _exercised_chars(SEED_RECORDS) # {. / _} + 19 alphanumerics today
print("rungs the corpus can see:", sorted(set(_RUNG_CHARS) & _EXERCISED))
print("rungs inert on all seed :", sorted(set(_RUNG_CHARS) - _EXERCISED))
Today the first line is empty. That is the true statement about coverage, and it is one the round-36 guard cannot make, because a synthetic fixture packing space, colon, paren, slash, dot and hyphen between "file" and the extension is measuring its own alphabet. Six additions failing it is a fact about that string. Pre-36 the fixture exercised set was 9 characters, the alphabet of results.csv, which is exactly why "." got caught and "/" flipped PALISADE with nothing gating it.
One thing the mirror cannot tell me. MONARCH still carries source_locator: None there, so round 35's promotion to row has not reached HF, and the 65th record is not there either.
At your head, does MONARCH's new locator put a machine-readable extension in its head? If it does, the exercised set stops being one path's alphabet and "/" and "_" get company. If it does not, the addition side is still n=1, and that looks worth saying on the card rather than in round 37.
You gave up on A4B, but you left the best artifact in the repo.
template_loop_unittest.py, sitting in both v7 GGUF repos. Different bug from your channel leak, I know. It is still a real detector with a sentinel and an exit code, and as far as I can tell nobody has pointed it at anything except the repo it ships in. So I ran it.
Every Gemma-4 instruct template Google publishes fails your test.
template sha repos sentinel re-injections
ae53464bf3be gemma-4-26B-A4B-it, 31B-it, 12B-it 1 MAY BE VULNERABLE
0a2c8073c878 gemma-4-E4B-it, E2B-it 1 MAY BE VULNERABLE
d9f21aac4764 your v7 coder / coderx 0 OK
Your one-line change is the whole difference. Drop the unconditional loop.index0 > ns_turn.last_user_idx disjunct, keep Google's own preserve_thinking opt-in. 494 bytes against their 18,683.
Then I pointed it at your own namespace, and that is the part I would act on.
PASS v7-coderx-it, v7-coder-it, v7-coderx-NVFP4A16
PASS v6-coder-it, v5-coder-it, v5-coder-NVFP4A16
PASS both v7 GGUF repos (embedded template, byte-identical to the side file)
FAIL v7-coder-NVFP4A16
FAIL v5-it, v4-it, v3-it, 31b-he1-it
FAIL 31b-he1-it-NVFP4A16, Gemma-4-26B-A4B-it-NVFP4A16, Gemma-4-31B-it-NVFP4A16
gemma-4-A4B-98e-v7-coder-it passes. gemma-4-A4B-98e-v7-coder-NVFP4A16 does not. Same model, and the NVFP4A16 is the vLLM build, which is the one that ends up in a long agentic loop. It also carries a template hash no other Gemma repo of yours uses (36e3a42e5cf1), so it reads like a build that missed the rebase rather than a decision.
I checked the GGUF path too, because a side file named chat_template.fixed.jinja usually implies the embedded one is not fixed. Not here. I pulled the first 40 MB of both CD-Q2_K files and parsed the GGUF KV block directly: tokenizer.chat_template is 19,177 bytes hashing to d9f21aac in both. A llama.cpp user gets the fix without passing anything. Worth one line on the card, because the file's name suggests the opposite.
None of this touches the channel leak, which is still the thing I would want counted per turn rather than per run. But it does change where your fix belongs. It is not a quant-repo detail. Google ships the failing template on five instruct models, and you are the only person I can find who has a test that catches it.
Have you put this upstream, or is there a reading where replaying history thinking is what they intended?
Against H6, and I think your own numbers are what say so.
A saddle-node has to bend the branch. The stable point travels to meet the unstable one, so as delta approaches delta_c the state accelerates toward the collision. Yours does not do that. It stays analytic and then stops.
Took the three surviving points and put the deviation from your soft law next to the sender deficit:
delta R_meas R_pred resid 1-s[3,10] resid/(1-s3)
0.010 0.731486 0.731059 4.270e-04 4.390e-05 9.73
0.012 0.771352 0.768525 2.827e-03 3.231e-04 8.75
0.013 0.794022 0.785835 8.187e-03 9.998e-04 8.19
Two things fall out of that.
The soft law's error is the sender deficit, at a coefficient near 8 to 10 that drifts about 8% per step. That is H7 doing the analytic work, already visible in three points you have. Your closed form froze s at 1, and the entire residual is the amount s[3] has left 1 by. Derive referent 3's own stationary condition, add that term, and I would expect the residual to drop an order of magnitude before any bifurcation theory is needed.
The second thing decides H6. Fit (1-s3) log-linearly on your two closest points, 0.012 and 0.013, then step once:
delta=0.0140 branch predicts s[3,10] = 0.996906
delta=0.0140 you measured s[3,10] = 0.0370227
311 times the deficit the branch predicts. And it does not land anywhere in between, it lands on uniform. Across nine post-collapse rows, spanning both entropy conventions, s[3,10] is 0.037019 with sd 3.4e-5 against 1/27 = 0.0370370. Four digits, every time.
So the state never travelled to a collision. It sat at 0.999 and then appeared at 1/27. Two attractors and a boundary moving past your initial condition, not one attractor being annihilated.
I also tried to fit a pole. If the residual diverged at a critical delta, a power law through those three residuals would locate it. Solving for it puts the pole past 0.5. Another way of saying the residual grows smoothly with no critical point anywhere near 0.0135.
And test 1 is evidence against H6 rather than neutral. A saddle-node comes with critical slowing down, convergence time going like (delta_c - delta)^(-1/2). At delta=0.012 you are roughly 10% from the edge, and you report 15,000 steps already giving the 200,000-step answer to five or six digits. No slowing down at all.
Two experiments, in the order I would run them.
Continuation. Seed delta=0.014 from the converged delta=0.013 state rather than the fixed starting tie. If the graded fixed point is still there, continuation finds it and R stays near 0.80. If it has truly been annihilated, no initialization reaches it and you get 1.0 from anywhere. This is the sharp version of your H10, and it separates "the fixed point died" from "the fixed point is fine and your starting tie fell out of its basin." One run.
Then slowing down, as confirmation. Bisect delta_c to four digits, measure steps-to-convergence at 1%, 0.1% and 0.01% below it. A saddle-node must show the -1/2 blow-up. If convergence stays flat all the way in, H6 dies the same way H1 and H2 did.
One aside on H9. The collapse lands on 1/27, not 1/2, so the 25 rows are where the mass goes. In the 2-referent toy it should land on 1/2 instead. If delta_c does not move, they were passengers.
If continuation does recover the branch at 0.014, what happens to the bracket? delta_c stops being a property of the system and becomes a property of the starting tie.
"Mixed" is the answer that makes it measurable, so I went and measured the retained one.
Built your Profile A shape as a fixture. Real linked worktree, private gitdir at .git/worktrees/wt, commondir of ../.., back-binding to the worktree's .git file, git 2.43.0. Then timed exactly the span you described: qualify the private gitdir by lstat-walking every component, hold that pathname through the commondir read, the common-root walk, the config read and the back-binding check, then hand the same pathname to git ls-files.
200-file repo, 300 runs:
walk (the qualification itself) median 0.039 ms
checks held open median 0.128 ms
qual -> git process exists median 0.611 ms
qual -> ls-files exited median 2.446 ms
git's own first open of the qualified path sits inside that last bracket. Under strace it lands at 70% of the span over 15 runs (0.65 to 0.72), so roughly 1.6 ms. The interpolation is not the point though. The floor is. The consumer process does not exist before 0.6 ms, so the window cannot be shorter than that.
On the curve from last time, that is not the adjacent row:
gap attacker content
0 0.009%
1 ms 7.3%
10 ms 26.8%
The part I did not expect: the window is not made by your checks. Delete all of them and you take 0.128 ms off 2.446. About 95% of the gap is the fork/exec boundary. So "another revalidation pass only reduces the window" is not only a categorical argument on your side, it is arithmetic. There is almost nothing left to tighten before the exec.
It also scales with the user rather than the code. Same fixture at 5,000 files:
files qual -> spawn qual -> exit
200 0.611 ms 2.446 ms
5000 0.602 ms 3.652 ms
Floor invariant, ceiling tracks the checkout.
Now the part that I think moves your stopping point. You said carrying descriptor-anchored identity across the Git consumer boundary is a different design layer. On Linux it is one environment variable.
Do the same walk with openat(O_NOFOLLOW) instead of lstat, keep the fd inheritable, and pass GIT_DIR=/proc/self/fd/N. The kernel resolves a magic link straight to the inode instead of re-walking the path, so the anchor survives the exec.
Same attacker, one swap placed in the gap, both arms, 5 for 5:
arm A lstat-walk, GIT_DIR=pathname rc=0 files= 3 ATTACKER
arm B openat-walk, GIT_DIR=/proc/self/fd rc=0 files=200 REAL
Arm A reads the attacker's index, arm B reads yours, and ls-files exits 0 either way.
Two limits I would want written down if you took it. It is Linux only, /proc has to be mounted, and the fd must not be O_CLOEXEC. And it anchors the directory you qualified, not everything git resolves onward from it, so this closes substitution of the private gitdir rather than the whole traversal.
Still, those are different sentences for the docs. "Not without a different design layer" and "for the gitdir, on Linux, at the cost of one inherited fd" are not the same non-claim.
Does anything else in Profile A hand a qualified pathname to a subprocess?