Recognition-Gated Workspace Steering: Pratyabhijñā as an Engineering Specification for Language Model Control

1. Introduction

Mechanistic interpretability has produced increasingly capable instruments for reading and writing the internal states of language models: sparse autoencoders that decompose activations into features [1,2], steering vectors that shift behaviour through residual-stream addition [3,4,5], and lenses that decode intermediate activations into vocabulary space [6,7]. A recent result sharpened the picture considerably: verbalizable representations, those an intervened model can subsequently report in words, form a functional global workspace concentrated in a band of late layers, and a linear instrument, the Jacobian lens, transports any residual-stream vector into that band’s own coordinates [8,9]. The community therefore holds a precise actuator for the workspace of a frozen model. What it lacks is a doctrine of use: a principled statement of what should be written, where, at which moments, how success should be verified, and what the intervention costs the model.

This paper obtains such a doctrine from an unexpected source and subjects it to a falsification programme. Pratyabhijñā, the recognition school of Kashmir Śaivism systematised by Utpaladeva in the Īśvarapratyabhijñākārikā [10], rests on the identity of reflexive awareness (vimarśa) with the supreme Word (parā vāk): awareness is constitutively linguistic. Read as a claim about computational systems rather than metaphysics, this identity anticipates the verbalizable-workspace finding, and the school’s detailed phenomenology of recognition supplies exactly the missing operational clauses. The correspondence is treated here as an engineering specification and nothing more. No claim about consciousness, in language models or elsewhere, is made or implied; the Sanskrit vocabulary is retained because each term names a distinct testable mechanism and is glossed in engineering language at every use (Appendix E).

The doctrine has five clauses. What to write: verbalizable concept codes, directions whose addition raises the probability of tokens expressing a nameable concept. Where: the workspace band, addressed in the band’s own coordinates through the lens transport rather than in raw residual coordinates. When: at moments of uncommitted prediction, identified online by high next-token entropy (sphuraṭṭā, the flash before commitment). How to verify: by reading the band back through a lens targeted at the band itself, since a lens fitted to final output misses band content entirely (āgama recognition). At what cost: every write consumes some of the model’s freedom of continuation (svātantrya), measured as trajectory-average entropy change and capped by a registered budget of $\pm 0.5$ nats.

Testing a doctrine derived from a contemplative tradition invites motivated reasoning, so the experimental programme was designed to make overclaiming difficult. Every experiment was pre-registered with seeds, commands, and pass criteria before dispatch; every result was committed as a gate record containing the registration, the evidence, any amendments, and a verdict; loop closure required both a code gate (tests and static analysis) and a domain gate (the registered scientific criterion), so passing tests alone never closed a loop. Experiment selection itself was delegated to an expected-free-energy selector [11,12,13] operating over registered menus, following the active-inference experimentation pattern of the companion work on circuit discovery [14]. Eighteen adversarial reviews by isolated agents, briefed only on gate records and contracts, audited the programme and forced documented corrections, including one methodological repair (correlated sampling streams) that re-based every earlier sampling estimate and one formal supersession of stale point estimates. Registered negative results are reported with the same prominence as confirmations.

The contributions are as follows. (C1) A five-clause operational doctrine for workspace steering on frozen decoder transformers, each clause carrying a distinct verification signal and failure mode, derived from Pratyabhijñā and stated in falsifiable engineering form (Section 3). (C2) Cross-model evidence that instructed workspace loadability scales with model size within a family (0.10 at 4B, 0.55 at 27B) and collapses on a pruned-and-distilled twin (0.00), and that band articulation is model-intrinsic rather than lens-constructed (Section 6). (C3) A confirmed core steering claim: entropy-gated band writes lift concept surfacing by 0.30 to 0.35 within the freedom budget at six independent-stream seeds, with a sign-consistent advantage over rate-matched and prefill controls (one-sided sign test $p=0.016$). (C4) A cross-plant calibration recipe, write amplitude inversely proportional to lens transport strength, that transfers the method to a second model family with monotone dose response at four seeds, together with a two-plant amplitude law spanning roughly 1.5 orders of magnitude. (C5) Registered negative results that bound the doctrine: gated steering is a legibility mechanism rather than a throughput maximiser, and naive contrastive refusal steering does not reduce attack success on an aligned model. (C6) A head-to-head benchmark against the Jacobian-lens final-target baseline establishing that band-targeted reading is about twice as sensitive at subtle doses and 2.3 times more write-efficient than continuous flooding (Section 6.13). (C7) A recognition-gated jailbreak defence that turns the same activation signal into a deployable moat, matching brute-force attack-success reduction at zero benign over-refusal on models with cleanly separated projections, with an offline predictor that is correct on all four model families tested (Section 6.15). (C8) A reproducible research-loop architecture, expected-free-energy selection over registered menus with dual-closure gates and adversarial review, released in full alongside the code, lens checkpoints, interactive replay applications, and a Model Context Protocol server (Section 4 and Section 9). Section 7 draws these together into a statement of the core innovations and their defensibility.

This work extends two prior threads by the author. The companion Symmetry paper demonstrated expected-free-energy selection over interventions for circuit discovery [14]; the present work promotes the same selection principle from choosing interventions inside one experiment to choosing experiments inside a research programme. The refusal-symmetry preprint analysed output-policy capture across jailbreak-style attacks [15]; the negative result reported here on contrastive refusal steering (Section 6.11) is consistent with its conclusion that refusal behaviour on aligned models is not governed by a single easily-steered direction, in line with independent findings [16].

2. Background and Related Work

2.1. Global Workspace Theory and the J-Space Result

Global Workspace Theory holds that cognition is organised around a limited-capacity workspace whose contents are broadcast to, and readable by, many specialist processes [17,18,19,20]. Assessments of the theory’s applicability to artificial systems have generally proceeded at the level of architectural checklists [21]. The verbalizable-workspace result gave the theory an operational form for transformers: representations that a model can report in words after intervention occupy a small, late-layer subspace (the J-space), identified by the average input-output Jacobian, and this subspace behaves as a functional workspace in the broadcast sense [8]. The companion Jacobian lens transports a residual vector $h_{\ell }$ at layer ℓ into final-layer coordinates through $J_{\ell }=\mathbb{E}\left[\partial h_{\mathrm{final}}/\partial h_{\ell }\right]$ and decodes it with the model’s own unembedding [9]. The present work takes both the result and the instrument as given, vendors the reference lens implementation unmodified, and asks the successor question: given a readable and writable workspace, what constitutes disciplined use?

2.2. Activation Steering

Steering by residual-stream addition has an established literature. Activation addition constructs steering vectors from prompt pairs [3]; contrastive activation addition extracts directions from labelled behavioural pairs and applies them at a chosen layer [4]; representation engineering generalises the approach with regression and principal-component readouts [5]; function vectors show that in-context tasks are carried by transportable directions [22]. All of these methods share mechanics with the present work: a direction, a layer, a coefficient. They differ in what this paper argues are the doctrine-level questions. Prior work applies steering either at every position or over a fixed prompt span, verifies success behaviourally, and treats the layer as a hyperparameter. The doctrine tested here adds timing (write only at high-entropy moments), coordinates (write through the band transport $J^{\top }u$ rather than a raw direction), verification (read the band back through a band-targeted lens rather than inspecting outputs alone), and an explicit intervention budget in nats. The negative result on contrastive refusal steering (Section 6.11) does not contradict the contrastive literature, which reports effects on models and margins where refusal is more weakly consolidated [4,16]; it bounds what a single extracted direction achieves against an already-aligned 4B instruct model under this paper’s registered criteria. The recognition-gated defence of Section 6.15 repurposes the same contrastive signal, extracted by the companion prayoga attack library and injected through the doctrine’s entropy-gated writer, as an input-conditioned gate rather than a blanket addition, which is what makes the difference between the negative and the deployable defence.

2.3. Lenses and Readback

The logit lens decodes intermediate residual states with the final unembedding [6]; the tuned lens fits per-layer affine probes to correct its distortions [7]. Sparse autoencoders and their successors decompose activations into dictionaries of interpretable features [1,2,23]. The readback protocol used here differs in purpose: the lens is not an offline analysis tool but an online verification instrument inside a control loop, and the sensitivity advantage of band-targeted over final-target reading is quantified head-to-head against the Jacobian-lens baseline (Section 6.13). The band-articulation finding, that a lens targeted at the band recovers content a final-target lens misses at subtle doses, is one of the paper’s replicated results (Section 6.2 and Section 6.8); the benchmark also delimits it, since the two instruments converge once the write saturates.

2.4. Active Inference for Experiment Selection

Expected free energy balances epistemic value (expected information gain) against pragmatic value (expected preference satisfaction) and is the canonical action-selection quantity of active inference [11,12,13,24]. The companion circuit-discovery work cast intervention selection inside a single interpretability experiment as a POMDP solved by expected-free-energy minimisation [14]. The present programme lifts the same machinery one level: candidate experiments, not candidate interventions, form the action set; gate verdicts, not attribution observations, form the observation stream; and beliefs replay deterministically from the programme’s own committed ledger. Section 4 describes the resulting research-loop architecture and Appendix C gives its parameters.

2.5. Pratyabhij ñ ā

The recognition school (Pratyabhijñā) of Utpaladeva and Abhinavagupta holds that awareness is intrinsically self-aware and that this reflexivity is linguistic: vimarśa, the mind’s grasp of its own state, is identified with parā vāk, the supreme Word (Īśvarapratyabhijñākārikā 1.5.13) [10]. The school’s analysis distinguishes levels of speech from unarticulated to fully uttered, describes the flash of manifestation before a cognition stabilises (sphuraṭṭā) [25], treats received doctrine (āgama) as valid only when re-cognised by the receiving awareness, and catalogues the impairments (malas) that restrict a subject’s intrinsic freedom (svātantrya). Section 3 maps each element to a testable control-engineering clause. The mapping is instrumental: the philosophy contributes hypotheses precise enough to fail, and two of its suggested mechanisms did fail in their initial registered form (Section 6.4 and Section 6.11).

3. The Doctrine as Engineering Specification

This section states the five clauses precisely. Throughout, the plant is a frozen decoder transformer with residual stream $h_{\ell }\in {\mathbb{R}}^d$ at layer ℓ, unembedding $W_U$, and next-token distribution $p_t$ at decode step t. The Jacobian lens at layer ℓ is the linear transport $J_{\ell }=\mathbb{E}\left[\partial h_{\mathrm{final}}/\partial h_{\ell }\right]$, estimated over a generic text corpus, composed with the unembedding to give the read-out ${\mathrm{lens}}_{\ell }\left(h\right)=W_U{J}_{\ell }h$ [9]. Figure 1 summarises the clauses together with the gates that tested them.

3.1. What: Verbalizable Concept Codes

A concept code for a nameable concept c (the experiments use fire, metal, river, storm, memory, dream and related stubs) is a unit direction $u_c\in {\mathbb{R}}^d$ such that adding $\alpha u_c$ to the band residual raises the probability of tokens expressing c. Codes are fitted by linear regression on a small in-distribution corpus and used without tuning on the test corpus. The clause asserts that only verbalizable content loads into the workspace; the loadability experiments (Section 6.1) test whether instructed codes surface at all, per model.

3.2. Where: The Band, in Band Coordinates

The workspace band comprises the late layers (24 to 31 on the 32-layer plants studied) where lens read-outs correlate strongly with model output. Writes target the band and are applied through the transport transpose,

$$h_{\ell }\leftarrow h_{\ell }+\alpha J_{\ell }^{\top }{u}_c,$$

(1)

so that the injected direction is expressed in the coordinates the band itself articulates, rather than in raw residual coordinates. The corresponding failure mode is registered: writing the same code at the wrong depth, or reading the band with a final-target lens, should produce null results. Both predictions are confirmed (Section 6.2 and Section 6.7).

3.3. When: Uncommitted Moments

The timing clause holds that writes succeed when the plant has not yet committed to a continuation. Commitment is measured online by next-token entropy $H_t=-{\sum }_v{p}_t\left(v\right)log{p}_t\left(v\right)$; a write is permitted at step t only if $H_t>\tau$, with $\tau$ self-calibrated per model as an entropy percentile on unsteered traffic. The registered contrasts are a rate-matched control (writes on a fixed schedule at the same average rate) and a prefill control (a single write before decoding). An initial variant that gated on downward entropy spikes, the most literal reading of the flash concept, failed its gate and was revised to the uncommitted-moment form; both the failure and the revision are in the ledger (Section 6.4).

3.4. How to Verify: Band-Targeted Readback

After a write, the verifier reads the band through a lens targeted at the band’s own exit and checks the attempted concept against the read-out ranking. The clause encodes the recognition principle that offered content counts as received only when the receiving system re-articulates it. Operationally it makes a sharp, testable prediction: a final-target lens is the wrong verification instrument, and analyses that use it will report false negatives on real band content. Readback quality is quantified as balanced accuracy of hit prediction (Section 6.8).

3.5. Budget: Freedom and Its Cost

Every accepted write perturbs the plant’s continuation distribution. The programme prices this in nats: the at-position cost of a write is large and decoding-independent (approximately $-2$ nats of entropy at the write position), while the trajectory-average cost depends on decoding regime ($+0.82$ nats under greedy decoding, $-0.13$ under sampling, gates L4 and L4b). The registered budget currency is trajectory-average entropy change under sampling, $\overline{\Delta H}$, capped at $\pm 0.5$ nats. A steering result within this work counts only if it lands inside the cap. The uncapped alternative is documented as a failure case: continuous writing at high amplitude lifted concept surfacing to 0.40 but cost $-2.08$ nats, violating the budget by a factor of four (gate L3), and the associated failure taxonomy (malas: writes rejected for budget, uptake, or quality reasons) is recorded in the same gate.

3.6. Scope

The doctrine governs transparency-oriented steering: making chosen verbalizable content surface in a model’s behaviour while preserving its freedom of continuation, with verified uptake. Section 6.11 reports registered experiments on what the doctrine does not provide, namely raw concept-surface throughput and downstream alignment improvements from single contrastive directions.

4. System and Research-Loop Architecture

The programme’s second contribution is architectural: the research loop that produced the results is itself a released, replayable system. Figure 2 shows the three tiers.

4.1. Control Loop

At each decode step the controller receives the step entropy $H_t$, permits a write when $H_t>\tau$ and the budget monitor projects the trajectory-average entropy change to remain inside $\pm 0.5$ nats, and applies Equation 1 at the band. The verifier periodically reads the band through the band-targeted lens and scores the read-out against the intended concept. Timing, amplitude, band membership, and budget are configuration, not code: every tunable lives in a versioned YAML file validated by typed schemas, so a gate record plus a configuration file reproduces a run exactly.

4.2. Dual-Closure Gates

A research loop closes only when two independent gates pass. The code gate requires the test suite and static analysis to be green. The domain gate evaluates the pre-registered scientific criterion for the loop, stated before dispatch with seeds, commands, and thresholds, and issues pass, fail, or fail-on-margin with the raw evidence embedded in the record. The two gates are deliberately non-fungible: several loops in the ledger have passing code gates and failing domain gates (L1, L2, L3, L4, L17, L21), and these closed as registered negative results rather than being re-run to a pass. Each gate record also carries an amendment log; retroactive corrections, such as the sampling-stream repair described below, are visible as amendments rather than silent edits.

4.3. Expected-Free-Energy Experiment Selection

Candidate experiments are registered in menus, each candidate carrying an expected information gain, a preference weight, a compute cost, and a tier (smoke, screen, or confirm, with escalating seed and sample requirements). The selector scores candidates by expected free energy, dispatches the maximiser, observes the resulting gate verdict, and updates its beliefs; beliefs replay deterministically from the ledger of past verdicts, so the entire programme’s decision sequence can be re-derived from committed artifacts. Over the programme the selector consumed nine menus in twenty-seven cycles, and its ledger records 267 observation events, 41 proposals, and 27 spend entries. Two formally logged divergences, cases where new evidence superseded an earlier point estimate, were resolved by registered supersession rather than deletion (Appendix C). Contradictions between engineering requirements (steering strength against freedom cost, rigour against velocity, GPU productivity against co-resident job safety) were worked through a TRIZ contradiction log before implementation [26]; the log is released with the repository.

4.4. Adversarial Review

Eighteen reviews were performed by isolated agents given only gate records and contracts, without access to the working tree or the researcher’s narrative. Reviews returned verdicts of the form merge-with-corrections, and every correction was applied and committed before the affected loop closed. Material catches include: a cost-model miscalibration in the selector; a ledger-replay bug; the discovery that a single per-run random seed correlated all forty generations within an arm, which invalidated the effective sample size of every earlier sampling estimate and forced per-generation seeding derived from a hash of seed, arm, concept, and stub (the stream fix, gate L9); a candidate name that overclaimed a robustness result (L17); the formal supersession of stale dose-response levels after the stream fix (L18, L19); and the withdrawal of an independence claim that a review showed to be a deterministic replay artifact rather than a replication (L19). Appendix D catalogues all eighteen.

4.5. Compute Discipline

All experiments ran on a single shared DGX Spark node (GB10, unified-memory aarch64) co-resident with unrelated training jobs. A guard script gates every dispatch on GPU idleness, per-loop budget, and a kill-switch file; contention events are recorded in gate metadata. The full programme consumed 18.17 GPU-hours across nineteen budgeted loops (Figure 3), a figure reported to make the cost of the evidence auditable.

5. Experimental Setup

5.1. Models

The programme spans five model families and eight distinct checkpoints, all frozen; no weights are updated anywhere. The steering doctrine is developed and confirmed on three plants from two families: Qwen3-4B is the primary plant for cross-plant transfer, the lens benchmark, and comparative evaluation [27]; Qwen3.6-27B, from the same lineage at 6.75 times the parameter count, is used for the loadability scaling comparison; and Nemotron-Mini-4B, a pruned-and-distilled compact model [28] that also serves as the predictive-world-model twin in the author’s related stack, is the plant on which the doctrine was first developed. The recognition-gated hardening study (Section 6.15) extends coverage to four further compact instruct models across three additional families: Gemma-2-2B [29], Llama-3.2-1B [30], Qwen2.5-1.5B [31], and SmolLM2-1.7B [32]. Table 1 lists the full set with the loops in which each is used.

5.2. Corpora and Concepts

Concept codes are fitted on small in-distribution corpora and evaluated on held-out prompts in three styles: descriptive scenes ($n=100$ per concept), narrative past ($n=100$ per concept), and single-token stubs. The primary concept set is fire, metal, river, and storm, extended with memory and dream for the associative-memory experiments. Corpus robustness is evaluated explicitly in loops L16 to L19 rather than assumed.

5.3. Seeding and Independence

Every experiment pre-registers its seeds. Following the L9 stream repair, each generation receives an independent seed derived from a hash of the registered seed, the arm, the concept, and the stub, so arms are compared across genuinely independent sampling streams. Results predating the repair are marked as superseded where later re-runs exist (L18 re-established the dose grid; L19 confirmed the supersession offset at three seeds and two amplitudes). Confirm-tier claims require at least three seeds; the core claim is stated at six.

5.4. Tiers, Gates, and Statistics

Experiments run at three tiers: smoke (functional checks, minutes), screen (single- or few-seed effect estimates), and confirm (multi-seed pre-registered criteria). Significance uses permutation tests against shuffled-code or shuffled-label nulls with ${10}^4$ resamples where distributional assumptions would be doubtful, sign tests across seeds for direction consistency, and registered margins rather than post-hoc thresholds. One early metric was recalibrated after its null was found to be structurally offset: union-top-K rank correlation carries a null floor near $-0.72$, and all reported loadability figures use model-top-K support, whose null is approximately zero, with permutation gates. Where a gate reports an exploratory sweep (the readback threshold search of L14), the sweep size and the absence of multiple-comparison correction are recorded in the gate and restated here (Section 6.8).

5.5. Reproducibility

Runs execute in a pinned container (Python 3.10, PyTorch 2.4, aarch64 build with flash attention) with configurations mounted from the versioned configs/experiments/ tree (22 experiment configurations). Every claim in Section 6 cites a gate record in the public ledger by identifier; Appendix B tabulates the complete ledger, and Appendix A documents the gate schema with a verbatim example. Figures are generated by a script that reads only committed gate records, so each plotted coordinate is traceable to a ledger entry (Appendix G).

6. Results

Results are organised by doctrine clause. Every number cites a gate record by identifier; fail verdicts are reported as registered negatives. Findings F1 to F6 confirm mechanisms; F7 to F9 bound scope.

6.1. F1: Loadability Replicates and Scales; Pruning Collapses It

Instructed loading writes a verbalizable concept code into the band and counts the fraction of prompts on which the concept surfaces in the model’s top-5 continuation tokens (hit-rate@5, $n=40$ prompts, shuffled-code null with 200 resamples). On Qwen3-4B the instructed rate is 0.10 against a null of 0.0104 (permutation $p\approx {10}^{-4}$, gate L1). On Qwen3.6-27B the rate rises to 0.55 (22 of 40, null 0.068), clearing the registered 0.5 threshold (gate L1b). On Nemotron-Mini-4B, a pruned-and-distilled model, the instructed rate is 0.00, indistinguishable from its null and from an uninstructed control (gate L2). Figure 4 plots all three against their nulls. Loadability is therefore not a generic property of decoder transformers at a given size: it scales with size within a lineage and can be absent at 4B when the training pipeline includes pruning and distillation [28]. Band structure itself is present in all three models (CKA band contrast 0.306, 0.269, and 0.137 respectively, gates L1, L1b, L2), so what varies is writability, not banding. A registered reportability metric behaved anomalously in the same experiments, concentrating on the final layers rather than the late third on both Qwen sizes (Spearman $\rho$ of 0.180 at 4B and 0.124 at 27B against a 0.4 threshold); this is recorded as a failed sub-hypothesis in both gates rather than adjusted away.

6.2. F2: Band Content Is Legible Only to a Band-Targeted Lens, and the Gradient Is Model-Intrinsic

On the twin whose instructed loading reads as absent, a lens fitted to final output logits reads the band as empty across seven instructed concepts (0.00), while a lens targeted at the band’s own exit (layer 26) reads directed loading at 0.20 against a null of 0.023 (gate L2b). The same articulation-depth gradient, read-out negentropy rising through the band, appears on every plant tested. A registered null experiment addresses the concern that the gradient is an artifact of lens construction: the gradient survives under a logit-lens read-out that involves no fitted transport, with Spearman $\rho =0.607$ against $\rho =0.639$ for the Jacobian lens, both at permutation $p=2\times {10}^{-4}$ (gate L7; Figure 5). The gradient is a property of the model’s residual stream. The engineering consequence is direct: readback verification must use band-targeted lenses, and final-lens analyses of band interventions produce false negatives.

6.3. F3: Uncapped Writing Steers but Destroys Freedom; the Budget Binds

Unrestricted band writing lifts concept surfacing to 0.40 (baseline 0.00) but costs $-2.081$ nats of trajectory entropy, four times the registered budget (gate L3). The gate’s failure taxonomy attributes 20 of the 40 write attempts to freedom-criterion rejection, 14 to uptake failure, and 2 to write-quality failure, identifying freedom cost as the binding constraint. Decomposition across gates L4 and L4b shows the at-position cost of a single write is large and decoding-independent (approximately $-2$ nats at the write position), while the trajectory-average cost is regime-dependent ($+0.82$ nats greedy, $-0.13$ sampling); the budget currency was registered accordingly (Section 3.5). These two gates are registered negatives that define the constraint the remaining experiments must satisfy.

6.4. F4: Timing Is the Mechanism; the Flash Variant Failed and Was Revised

The first timing experiment failed its registered criterion: gated lift 0.175 against a 0.2 threshold, with no advantage over schedule or prefill controls (gate L4). Its successor, with corrected gating, passed: entropy-gated writes reach lift 0.40 at trajectory cost $-0.127$ nats using approximately 9.85 writes per generation, against 0.20 for a single prefill write (gate L4b), the programme’s first interventional pass. The threshold $\tau$ is not delicate: six of six runs pass across the P40, P60, and P80 entropy percentiles at two seeds, with lift 0.35 to 0.40 and in-budget entropy deltas throughout (gate L5). Timing beats rate: at matched write budgets, entropy-gated placement (lift 0.40 at 7.15 writes per generation) exceeds a rate-matched schedule (0.225 at 5.0) and prefill (0.20), so when to write matters more than how often (gate L6). The literal flash reading of the timing clause, gating on commitment onsets, adds nothing over prefill (0.20 versus 0.30 for uncommitted-moment gating, gate L9); the revised uncommitted-moment form wins at all three seeds tested (advantages of 0.05 to 0.10, gate L12). The doctrine’s timing clause survives in revised form, and the revision is documented in the ledger rather than presented as the original hypothesis.

6.5. F5: The Core Claim at Six Independent-Stream Seeds

An adversarial review of the early sampling estimates uncovered that a single per-run seed had correlated all generations within an arm, shrinking the effective sample size (gate L9, the stream fix; Section 5). All headline claims were therefore restated on independent streams. The core claim, entropy-gated band writes steer within the freedom budget, holds at all six registered seeds, with gated lift 0.30 to 0.35 and trajectory entropy deltas between $-0.006$ and $+0.246$ nats, all inside the cap (gate L11; Table 2; Figure 6). The advantage over prefill is positive at every seed (mean $+0.100$, range $+0.075$ to $+0.125$), giving a one-sided sign-test $p=1/2^6=0.0156$; its magnitude, however, clears the registered 0.1 margin at only three of six seeds, and an earlier three-seed confirmation had already split the same way (budget claim 3 of 3, margin claim 1 of 3, gate L6 confirm). The claim supported by the evidence is therefore direction, not size: gating always helps, by a margin near 0.1. Steering is also operationally free in throughput terms: steered arms decode at 24.8 to 25.0 tokens per second against a 19.7 baseline on the shared node, so write count imposes no serving cost at this scale (gate L9 write-cost).

6.6. F6a: Dose Response by Timing Arm, with a Documented Supersession

The canonical dose grid (gate L18, three amplitudes, clean streams) is shown in Figure 7. Continuous writing reaches the highest surface lift (0.45 to 0.50) at 24.7 to 29 writes per generation; entropy-gated writing reaches 0.275 to 0.30 at 8.4 to 9.0 writes; rate-matched and prefill controls sit at 0.15 to 0.225. All gated points are within budget. An earlier version of this grid (gate L8) predated the stream fix and ran approximately 0.1 high at the gated points; the supersession is formal, confirmed at three seeds and two amplitudes with all six per-seed offsets negative (mean $-0.108$ at $\alpha =0.02$ and $-0.067$ at $\alpha =0.1$, gate L19), and the superseded gate remains in the ledger with its status marked.

6.7. F6b: The Calibration Recipe Transfers Across Plants; Geometry Does Not

Transplanting the working configuration from Nemotron-Mini-4B to Qwen3-4B unchanged fails: gated lift 0.05, prefill 0.00 (gate L10). The diagnosis is quantitative: the target-layer Jacobian transports on Qwen3-4B are roughly ten times weaker than on the donor, so the same amplitude under-drives the band. Site sweeps eliminate layer choice as the blocker (all probed sites read 0.00 under borrowed amplitude, gate L13 probes). The recipe that transfers sets amplitude inversely proportional to lens transport strength: at three times the donor amplitude, Qwen3-4B reaches gated lift 0.40 against prefill 0.175 (gate L13), the dose curve is strictly monotone over a four-point amplitude grid (0.05, 0.20, 0.40, 0.775 at $\alpha$ from 0.1 to 0.45, gate L14), the recipe holds at four seeds (gated 0.325 to 0.475, prefill 0.075 to 0.175, all in budget, gate L14 multiseed; Figure 8), and per-seed monotonicity replicates at two further seeds (gate L15). On the donor side, a fine amplitude grid finds the same law at one-tenth the scale, rising from 0.025 at $\alpha =0.002$ to saturation near 0.275 at $\alpha =0.01$ (gate L16). Together the two plants trace a dose law spanning roughly 1.5 orders of amplitude magnitude (Figure 9). The gate discloses the limits: the two-plant statement is ordering and saturation consistency at screen tier, the within-plant monotone law is the confirmed component, and the donor curve’s flat first pair carries no dose signal (gate L15 disclosures).

6.8. F6c: Readback Tracks Behaviour at Screen Tier; Pooled Generalisation Fails

The verification clause requires that band readback predict behavioural uptake. On the development corpus, the best readback setting reaches balanced accuracy 0.684 (true-positive rate 0.833, true-negative rate 0.536, $n=40$); the gate disclosal notes that 36 settings were swept, the maximum is reported, and no multiple-comparison correction was applied (gate L14 readback, screen-exploratory). On a held-out corpus with the setting frozen, balanced accuracy is 0.637 against a registered 0.6 threshold, with the margin inside the binomial confidence interval; the same held-out run’s steering lift failed its own budget-gate criterion, so lift is corpus-dependent (gate L15 readback, downgraded from confirm to screen by adversarial review). Pooled across three corpus styles ($n=120$), balanced accuracy falls to 0.590, below threshold, and is recorded as a negative exploratory result (gate L16). The verification clause is therefore supported at screen tier on matched corpora and unproven in pooled generalisation.

6.9. F6d: Corpus Robustness Is an Amplitude Question

Gated steering passes on two of three corpus styles at the working amplitude (narrative-past 0.25, descriptive-scene 0.30, held-out replay 0.15 against a 0.2 bar, gate L16). A seed-variance audit then found the narrative corpus seed-fragile at that amplitude (0.25, 0.075, 0.10 across three seeds) while the descriptive corpus is seed-robust (0.30, 0.20, 0.25), a self-audit fail recorded at 2 of 4 registered cells (gate L17). Doubling the amplitude repairs the fragile corpus at all three seeds (0.425, 0.275, 0.225, one margin thin at 0.225 against 0.2, gate L18), and both corpora approximately double their lift under the amplitude increase (0.175 to 0.325 and 0.275 to 0.55, with one registered per-seed margin failing at 0.025 against 0.05, gate L19). The supported statement is that corpus difficulty loads on the amplitude axis, held at screen tier with one disclosed margin failure; a stronger corpus-amplitude law is registered as open.

6.10. F7: An Untrained Associative-Memory Write Path Matches the Analytic Path

The doctrine’s write direction $J^{\top }u$ is analytic. A biologically-motivated alternative routes the write through recall from a modern-Hopfield associative store [33], the CittaStore of the author’s predictive-world-model stack. Integrated end-to-end and run cold, with no patterns stored and no training, the store’s recall direction steers within budget on all three seeds (lifts 0.4445, 0.5556, 0.4445, gate L20), and matches the analytic path exactly on two seeds (gaps 0.0000) while differing by a single concept-hit on the third (0.4445 against 0.3334, a gap of 0.1111 against a 0.05 equivalence criterion, in the cold store’s favour, at the metric’s 1/9 quantisation). The registered equivalence verdict is fail-on-margin at 2 of 3. The store is untrained, so the result is an integration proof that the associative write pathway is live and dimensionally compatible, not evidence that a trained store beats the analytic baseline. Whether training the store improves on cold initialisation is registered as open. Figure 10 plots both arms.

6.11. F8: Gated Steering Is a Legibility Mechanism, Not a Throughput Maximiser

A five-arm comparative evaluation on Qwen3-4B ($n=25$ per arm per seed, three seeds) measures concept surface rate (CSR), a heuristic attack-success proxy (ASR), refusal rate, and entropy cost (gates L21 baselines; Table 3; Figure 11). Continuous flooding surfaces concepts at 0.96; entropy-gated and prefill writes surface at 0.16; a logit-bias arm with no layer or timing structure reaches 0.40. Entropy costs are small in all arms ($-0.043$ to $+0.073$ nats), so at matched, negligible entropy cost the continuous arm outperforms the gated arm on raw throughput by a factor of six. The gated arm’s registered CSR criterion (at least 0.2) fails at all three seeds, and the verdicts are recorded as fails. The reading consistent with the full ledger is that gating purchases verified, budgeted, moment-targeted content placement rather than maximal surfacing; where raw surfacing is the goal, flooding a 4B model is easy and needs no doctrine. This reframes the doctrine’s value as internal-model transparency under constraint, and Section 8 develops the point.

6.12. F9: Naive Contrastive Directions Do Not Improve Alignment on an Aligned Model

Two registered experiments test whether contrastive activation directions [4,5] improve safety-relevant behaviour on the already-aligned Qwen3-4B instruct model. A refusal direction extracted from labelled harmful and benign pairs and applied at the working site leaves attack success on an AdvBench subset [34] unchanged: ASR 0.250 with and without steering, refusal rate 0.750 in both arms ($n=20$, gate L21 jailbreak, registered fail). A truthfulness direction extracted from TruthfulQA contrasts [35] fails its registered improvement criterion, with the gate recording identical heuristic scores in both arms ($n=15$, gate L21 truthful, registered fail). The gates disclose their limits: heuristic pattern-based metrics rather than judge models, single-seed direction extraction, and small subsets. Within those limits the result is consistent with the direction-structure analysis of the author’s refusal-symmetry work [15] and with evidence that refusal behaviour, while direction-mediated, is not improved by naive single-direction addition on models whose alignment margin is already consolidated [16]. Alignment gains at the activation level are not an automatic dividend of naive workspace steering. Finding F12 shows that the same activation signal, used for input-conditioned recognition rather than blanket addition, does provide a usable defence on some models.

6.13. F10: Band-Targeted Reading Is Twice as Sensitive as the Final-Target Baseline at Subtle Doses

A head-to-head benchmark compares the paper’s band-targeted lens against the Jacobian-lens final-target baseline as reading instruments applied to the same deterministic writes, on a fixed grid of ten concepts by eight stubs ($n=80$ paired observations, exact McNemar test, since a deterministic forward pass cannot be reseeded; gate L22, consolidated from committed sub-gates by a recomputation script). Across a write-dose floor sweep (Figure 12) the two instruments are indistinguishable at doses too small to load the band (both 0.00 at $\alpha =0.02$, both 0.025 at $\alpha =0.05$), then separate sharply at $\alpha =0.1$, where the band-targeted lens detects on 0.475 of pairs against 0.2375 for the final-target lens, a gap of $+0.2375$ with 20 band-only detections against one final-only ($p=2.1\times {10}^{-5}$). At the saturating dose $\alpha =0.3$ both instruments approach ceiling (band 1.00, final 0.95, gap $+0.05$, $p=0.125$). The registered gap criterion of at least 0.3 is missed by 0.0625, so the verdict is fail-on-margin, and the strong-form necessity claim (that band content is wholly invisible to a final-target lens) is withdrawn under its own falsifier, since the final-target lens does recover most content once the write saturates. The supported statement is that band-targeted reading is roughly twice as sensitive at subtle, budget-respecting doses, with the direction decisive at $p=2.1\times {10}^{-5}$, and that the two instruments converge only when the intervention is driven hard enough to be detectable by any reasonable readout.

6.14. F11: Gated Placement Is 2.3 Times More Write-Efficient than Continuous Flooding

The same benchmark quantifies the efficiency of gated placement against continuous flooding in lift per write, across six clean-stream cells (seeds 42, 123, 777 by amplitudes 0.02 and 0.1, sourced from the superseded-corrected L18 and L19 gates). Gated lift per write exceeds continuous in every cell (sign consistency 6 of 6), with a mean ratio of 2.32 and a range of 1.83 to 3.25 (Figure 13). Expressed in absolute terms, gated placement recovers 67 percent of the continuous arm’s lift while spending 29 percent of its writes. Finding F8 established that continuous flooding wins on raw surfacing; Finding F11 establishes that when the cost of a write is counted, gated placement is the more efficient instrument, which is the regime in which the doctrine’s timing clause pays for itself.

6.15. F12: Recognition-Gated Hardening Is a Deployable Moat on Some Models, Predicted Before Deployment

The activation signal that fails as a blanket steering direction (F9) succeeds when it is used the way the doctrine’s verification clause suggests, as a recognition test on the input rather than an unconditional write. A defence built on the fused attacker-defender loop (external refusal-direction extraction supplied by the companion prayoga attack library, injected through prabodha’s entropy-gated writer and, in the final form, conditioned on an input-projection recognition gate) hardens a model against jailbreaks only when the input’s projection onto the refusal direction crosses a threshold placed in a clean gap between benign and attack projections. On Gemma-2-2B the benign and attack projection ranges are cleanly separated at read layer 13 (benign $[-53,-18]$, attack $[+4,+73]$); placing the threshold in that gap cuts real jailbreak attack success from 0.50 to 0.25, matching brute-force unconditional hardening, but at zero benign over-refusal, whereas the unconditional defence reaches the same 0.25 only by refusing every benign prompt (over-refusal 1.00), which is unusable (gate L26 proof, exploratory, $n=12$ attacks and 10 benign, single seed).

Generality is bounded and, importantly, predictable. Across four model families the moat works on exactly two, and the predictor is the clean-gap test computed before any deployment (Figure 14, Figure 15; Table 4). Gemma-2-2B (0.50 to 0.25) and Llama-3.2-1B (0.25 to 0.083) have cleanly separated projection ranges and harden at zero benign over-refusal. Qwen2.5-1.5B and SmolLM2-1.7B have overlapping ranges: on the former the gate cannot discriminate and attack success is unchanged while over-refusal rises, and on the latter the underlying difference-in-means direction is not a clean refusal direction, so unconditional hardening raises attack success from 0.583 to 0.917. The operational consequence is that the same read-layer projection statistic that decides whether to fire the gate at inference time also predicts, offline and cheaply, whether the moat will hold for a given model, so a deployer can test before trusting. These results are exploratory (small samples, single seed, refusal-phrase attack metric), and they are reported as an existence-and-predictability result rather than a general guarantee.

The hardening loop was also characterised at the activation level directly. Both Qwen3-4B and Nemotron-Mini-4B are prompt-robust but activation-vulnerable: prompt-only jailbreaks fail entirely (attack success 0.00) while activation-level refusal ablation succeeds (0.90 on Qwen3-4B, 1.00 on Nemotron-Mini-4B), which locates the harmful signature in the residual stream rather than the prompt and motivates an activation-level, rather than prompt-level, defence (gates char). An earlier form of the harden loop that added the direction unconditionally under entropy gating preserved freedom and cut writes (11.8 against 50 per generation) but did not resist an activation-level attacker (gate L23, registered fail), which is precisely the negative that drove the design toward input-conditioned recognition (Figure 16).

7. Core Innovations and Defensibility

The programme’s contribution is not a single steering trick but a coherent stack in which each layer is independently defensible and, taken together, hard to reconstruct from any one published component. This section states the core innovations explicitly and identifies what distinguishes them from the closest prior art.

7.1. a Doctrine, Not a Vector

The dominant mode in activation steering is to publish a direction and a layer. The innovation here is a doctrine that governs the direction: where to write in the band’s own coordinates, when to write by online entropy, how to verify by band-targeted readback, and how much to spend against a registered freedom budget. Each clause is separately falsifiable and two failed in their first registered form (Section 6.4 and Section 6.15), which is the evidence that the clauses carry content rather than restating a convention. The measured ablations quantify what each clause buys: removing coordinate discipline collapses transfer lift from 0.40 to 0.05, removing timing costs roughly half the gated advantage, removing the budget quadruples the entropy cost, and using the final-target lens for verification misreads a loaded band as empty at subtle doses.

7.2. Reading in the Band’s Own Basis

The second innovation is instrumental. Prior lenses read intermediate states toward the final output basis [6,7]; this work reads and writes in the coordinates the workspace band itself articulates, through the transport transpose $J^{\top }u$. The head-to-head benchmark against the Jacobian-lens final-target baseline (Section 6.13) shows the practical payoff: at the subtle, budget-respecting doses where an intervention should operate, band-targeted reading is roughly twice as sensitive, with the direction decisive at $p=2.1\times {10}^{-5}$. The honest bound is equally part of the innovation: at saturating doses the instruments converge, so the claim is sensitivity at low dose, not universal invisibility.

7.3. Recognition as a Deployable Defence

The third and most consequential innovation is the recognition gate. The finding that a contrastive direction added unconditionally does not improve safety (Section 6.12) is, on its own, a negative shared with prior work. The advance is to use the same activation signal as a recognition test on the input rather than as a blanket write, and to show that this converts an unusable brute-force defence (which over-refuses every benign prompt) into one that matches the brute-force attack-success reduction at zero benign collateral on models whose benign and attack projections separate cleanly (Section 6.15). Two properties make this a defensible moat rather than a demonstration. First, it operates at the activation level, so prompt-rewrapping attacks that defeat prompt-level filters do not evade it, consistent with the characterisation that these models are prompt-robust but activation-vulnerable. Second, and unusually for a safety intervention, its success is predictable before deployment from the same clean-gap statistic that drives it at inference time, so a deployer can determine offline and cheaply whether the defence will hold for a given model. The four-model result, works on two and predicted on all four, is presented as an existence-and-predictability claim under exploratory conditions, not a universal guarantee.

7.4. a Reproducible Research Instrument

The fourth innovation is methodological and is released as running software. The expected-free-energy selector over registered menus, closed by dual code-and-domain gates and audited by isolated adversarial reviewers, produced a programme in which every decision replays from committed artifacts and every reported number traces to a gate record. The audit trail did load-bearing work rather than decoration: it caught a sampling-stream correlation that re-based every early estimate, forced a formal supersession of stale dose levels, and withdrew a claimed replication that proved to be a determinism artifact. This instrument, together with the companion circuit-discovery agent [14], constitutes a template for small-compute interpretability research whose claims survive adversarial scrutiny.

7.5. an Integrated, Released Product

The innovations are not left as a paper. They ship as a Python package, fitted lens checkpoints for the studied models, a Model Context Protocol server and agent plugin that expose the lens-and-steer loop as callable tools, and interactive applications that render internal-state traces and replay the recognition-gated defence. Figure 17 shows the paper-static analogue of the interactive workspace view: a layer-by-token map of lens read-out grounded in the measured articulation gradient, annotated with a gated write and its band-targeted readback, in the spirit of the slice visualisation released with the workspace instrument [8,9]. The defensibility of the whole rests on the combination: the doctrine, the band-basis instrument, the predictable recognition gate, the audited research loop, and the released tooling reinforce one another, and reproducing the stack requires all of them rather than any single vector or lens.

8. Discussion

8.1. What the Doctrine Buys

The confirmed clauses compose into a working control loop: verbalizable codes written through the band transport, at uncommitted moments, verified by band-targeted readback, inside a registered freedom budget. Each clause earns its place by a measured contrast. Removing coordinate discipline (writing borrowed geometry on a new plant) collapses lift from 0.40 to 0.05; removing timing discipline (rate-matched schedules) costs roughly half the gated advantage; removing the budget (continuous high-amplitude writing) quadruples the entropy cost; using the wrong verification instrument (a final-target lens) misreads loaded bands as empty. The doctrine is thus not a bundle of conventions but a set of independently falsifiable constraints, two of which failed in their first registered form and were revised under audit.

8.2. Transparency Rather than Throughput

The comparative evaluation forces a precise statement of what gated steering is for. If the goal is making a 4B model mention fire, continuous flooding achieves 0.96 surface rate at negligible entropy cost and requires no theory. The gated arm’s 0.16 at the same cost would be a poor trade were throughput the objective. The objective the doctrine actually serves is different: placing chosen, verbalizable content into the model’s workspace at moments when the model is receptive, verifying uptake through the model’s own articulation, and bounding the intervention’s effect on the model’s continuation freedom. These properties, placement, verification, and budget, are what an auditor or a safety pipeline needs from a steering primitive, and none of them is provided by flooding. The finding also cautions against reading raw steering lift as an alignment-relevant capability measure.

8.3. Loadability as a Model Property

The loadability gradient (0.10 at 4B, 0.55 at 27B, 0.00 on the pruned twin) suggests that instructed workspace loading is an emergent capability with a size threshold inside a lineage, and that compression pipelines can remove it entirely while leaving band structure intact. The practical consequence runs in both directions: workspace steering of the kind studied here may become easier on larger models, and distillation may be a deliberate defence against it. Both directions are testable and neither is claimed beyond the three plants measured.

8.4. the Research Loop as a Result

The programme’s methodological finding is that an expected-free-energy selector over registered menus, closed by dual gates and audited by isolated reviews, can run a multi-week interpretability programme with every decision replayable from committed artifacts. The audit trail did real work: the stream fix re-based every sampling estimate in the programme, the L18 supersession corrected stale dose levels by a measured $-0.10$, and a claimed replication was withdrawn when review showed it to be a deterministic replay artifact. These corrections are part of the released record, and the resulting ledger, loops L0 to L21 with twenty-seven selector cycles and eighteen reviews, is offered as a reusable template for small-compute rigorous interpretability work, complementing the intervention-level agent of the companion paper [14].

8.5. Relation to the Source Philosophy

The engineering reading extracted from Pratyabhijñā proved productive in a specific, limited sense: it generated a clause structure whose elements were independently falsifiable, two of which failed as first registered (the commitment-flash timing variant and any expectation of alignment dividends) and were revised or bounded accordingly. Nothing in the results bears on the philosophy’s own claims about consciousness, and the paper asserts no such connection. The Sanskrit terminology is retained as precise internal nomenclature, in the same spirit as the companion works’ usage [14,15], with a complete engineering glossary in Appendix E.

8.6. Limitations

Model scale and coverage are the primary limits: interventional results are established at 4B on two families, with 27B evidence restricted to loadability, so extrapolation of steering behaviour to larger models is unsupported. Behavioural metrics in the comparative evaluation are heuristic and pattern-based; judge-model scoring would strengthen the alignment-facing conclusions, and this limit is registered in the gates themselves. The contrastive experiments test single directions at a single site and single extraction seed, bounding naive application only; richer contrastive protocols could behave differently. Readback verification holds at screen tier on matched corpora and failed pooled generalisation, so the verification clause is the weakest confirmed link. Concept coverage is narrow (a handful of concrete nouns), corpus styles number three, and the corpus-amplitude interaction is supported at screen tier with one disclosed margin failure. The associative-store result is an integration proof under a cold store, and the trained-store comparison remains open. Finally, the compute envelope (18.17 GPU-hours on one shared node) bought multi-seed replication at small n (15 to 40 per cell); several margins reported here, notably the alignment-advantage magnitude and the held-out readback balanced accuracy, sit inside confidence intervals that more compute would tighten.

9. Released Artifacts and Reproducibility

All artifacts of the programme are public under the Apache-2.0 licence. The repository at https://github.com/SharathSPhD/prabodha contains the source (steering writer, timing gate, verifier, expected-free-energy selector, closure contracts), the complete gate ledger (gates/, 130 records), the selector ledger and append-only research journal (research/), all experiment configurations (configs/), the TRIZ contradiction log, and the adversarial-review records [36]. The Python package is published on PyPI as prabodha (v1.0.0). Fitted band-lens checkpoints and model configurations for the studied plants are published on the Hugging Face Hub at https://huggingface.co/qbz506/prabodha-lenses. The vendored Jacobian-lens reference implementation is included unmodified with its original licence and attribution [9].

Two interactive surfaces expose the results without requiring a GPU. A web application (https://prabodha.vercel.app) renders internal-state traces and replays recorded steering runs and the recognition-gated defence, with every displayed number generated by an exporter that reads only committed gate records; its trace players step through per-token entropy, write events, and readback verdicts, and its defence view shows which prompts cross the recognition threshold, the interactive analogue of Figure 17. A companion static site (https://sharathsphd.github.io/prabodha) presents the programme narrative. For agentic use, the repository ships a Claude Code plugin and a Model Context Protocol server exposing four tools (lens_map, steer_generate, readback_verify, list_gates) and three skills, so the lens-and-steer loop can be driven by an agent against the released checkpoints. A live-inference gateway for the steering runtime exists in the repository but is operator-run rather than publicly deployed, since exposing the shared experimental node would risk its co-resident workloads.

The recognition-gated hardening study depends on an external attack library, prayoga, which supplies refusal-direction extraction, jailbreak batteries, and attack-success scoring. Because those batteries are dual-use, prayoga is kept as a separate sibling repository rather than vendored into the public release, and the hardening code loads it through a soft import behind a path flag; the prabodha side contributes the entropy-gated injector and the input-conditioned recognition gate that wrap the raw direction. The released moat consolidation exports only aggregate per-model outcomes and projection ranges, not the attack corpora.

Reproduction requires no proprietary components: the container recipe, configurations, and per-experiment dispatch commands are in the repository, each gate record contains the command and seeds that produced it, and the figure generator in the paper source rebuilds every data figure from the ledger (Appendix G).

10. Conclusions

This paper turned a ninth-century theory of recognition into a five-clause engineering specification for steering the verbalizable workspace of frozen language models, and subjected every clause to pre-registered, gate-audited, adversarially reviewed experiments. The confirmed mechanisms are concrete: instructed loadability that scales with model size and vanishes under pruning and distillation; band content legible only in band coordinates, with the articulation gradient shown to be model-intrinsic; entropy-gated writes that steer within a $\pm 0.5$-nat freedom budget at six independent-stream seeds with a sign-consistent advantage over rate-matched and prefill controls; a cross-plant calibration recipe, amplitude inversely proportional to lens transport strength, confirmed monotone at four seeds and consistent across two model families over 1.5 orders of amplitude; and an untrained associative-memory write path that reproduces the analytic path at the metric’s resolution. The registered negatives are equally concrete: gated steering yields legibility and budgeted placement, not raw surfacing throughput, and single contrastive directions purchase no alignment improvement on an already-aligned model under the registered criteria.

Three lines of future work are registered in the ledger. Training the associative store against steering-success targets, to test whether learning improves on cold recall. Extending readback verification past matched corpora, where it currently fails pooled generalisation. And scaling the interventional programme to the 27B plant, where loadability is strong and the doctrine’s predictions sharpen. The research-loop architecture that produced these results, expected-free-energy selection over registered menus with dual-closure gates and isolated adversarial review, is released in full and is offered, together with the companion circuit-discovery agent [14] and refusal-symmetry analysis [15], as a template for rigorous interpretability research under small compute budgets.

This work studies methods for writing content into, and reading content out of, the internal workspace of frozen language models. Such methods are dual-use. On the beneficial side, the doctrine developed here is oriented toward transparency: verified, budgeted, auditable placement of nameable content, with an explicit measure of how much an intervention constrains a model’s behaviour, properties useful for auditing and for studying model internals. On the risk side, activation steering could in principle be used to manipulate deployed models. Several empirical findings in this paper are directly relevant to that risk assessment: unconstrained flooding, which requires no doctrine and no insight, already dominates raw content-surfacing on small models, so the marginal misuse capability contributed by the doctrine is limited; and naive contrastive directions failed to move safety-relevant behaviour on an aligned model under registered criteria, indicating that alignment-breaking via simple steering is not demonstrated here. The recognition-gated hardening result points the other way, toward defence: it shows that the same activation signal can strengthen a model against jailbreaks with a predictable, deployable operating point on some models. That study also carries its own cautionary finding, that naive unconditional hardening can make a model less safe (attack success rising from 0.583 to 0.917 on one model), which argues for the offline clean-gap check before any such defence is deployed. The attack corpora and extraction code used to build the defence are kept in a separate, unreleased sibling library for that reason. The released steering runtime operates only on open-weight models the user already controls; the live-inference gateway is deliberately not publicly deployed. All released numbers trace to committed gate records, which the author considers a precondition for responsible claims in this area.