Recognition-Gated Workspace Steering: Pratyabhijñā as an Engineering Specification for Language Model Control

Recent interpretability work established that a language model’s functional global workspace is defined by verbalizable representations, and released a linear instrument, the Jacobian lens, that reads any residual-stream state as a ranked token distribution. The field therefore possesses an actuator without a doctrine of use. This paper derives such a doctrine from Pratyabhijñā, a ninth-century recognition philosophy whose central identity, reflexive awareness as the supreme Word, anticipates the verbalizable-workspace finding. The doctrine is treated strictly as an engineering specification with five falsifiable clauses: what to write (verbalizable concept codes), where (the workspace band, in band coordinates), when (moments of uncommitted prediction, detected by step entropy), how to verify (readback through a band-targeted lens), and at what cost (a registered entropy budget). Each clause was tested on frozen decoder transformers through a preregistered, gate-audited experimental programme spanning loops L0 to L21, run autonomously by an expected-free-energy selector over registered experiment menus, with twenty-seven selector cycles, eighteen isolated adversarial reviews, and roughly eighteen GPU-hours of compute on a single shared node. Six clauses or mechanisms are confirmed: workspace-band structure and instructed loadability replicate across model families and scale with size (hit-rate@5 of 0.10 at 4B versus 0.55 at 27B, collapsing to 0.00 on a pruned and-distilled twin); band content is legible only to a lens targeted at the band; entropy-gated writes steer within a ±0.5-nat budget at six independent stream seeds (lift 0.30 to 0.35, sign-consistent alignment advantage, one-sided p = 0.016); a calibration recipe with amplitude inversely proportional to lens transport strength transfers steering to a second model family at four seeds with monotone dose response; and an untrained associative memory write path reproduces the analytic steering path on all three seeds tested. Registered negative results bound the doctrine’s scope: gated steering trades concept-surface throughput for legibility rather than maximising it (surface rate 0.16 versus 0.96 for continuous flooding at matched entropy cost), and contrastive refusal-direction steering leaves attack success on an already-aligned 4B model unchanged (0.25 to 0.25). A head-to-head benchmark against the Jacobian-lens final-target baseline shows the band-targeted instrument is roughly twice as sensitive at subtle write doses (detection 0.475 versus 0.24, p = 2.1 × 10⁻⁵) and 2.3 times more write-efficient than continuous flooding. The same activation signal that fails as a blanket steering direction, used instead as an input-conditioned recognition gate, yields a deployable jailbreak defence that matches brute force attack-success reduction at zero benign over refusal on models whose benign and attack projections separate cleanly, and this success is predictable before deployment from an offline clean gap test: across four model families the moat works on two and the predictor is correct on all four. All code, gates, lens checkpoints, an agent callable Model Context Protocol server, and interactive replay applications are released.