The Contamination Clock: Evaluation Validity as Runtime Statein Adaptive AI Systems

1. Introduction

An evaluation score describes performance under a particular system configuration and test protocol. Adaptive agents, however, retain memories and skills, revise their harnesses, and learn from earlier execution outcomes [4,11,16]. These updates can change the model weights, memory, prompts, retrieval components, tools, and code that produced the score. A score can therefore remain accurate for the original experiment without establishing performance for the updated system.

A second challenge arises when evaluation itself guides development. For example, a coding agent may retain traces from benchmark tasks, while a development loop uses repeated scores to select prompts, tools, or programs. Through these routes, evaluation material can become training data, retrieval context, or an optimization signal. Search-time contamination has already been measured when agents retrieve benchmark questions or answers during inference [6,14]. We therefore ask what an earlier score can still establish after the system changes or evaluation outcomes are reused for optimization.

Existing approaches address complementary parts of this problem. Studies of memorization and exploitation examine how training data can be recovered or used by a model [2,9]. Statistical tests for benchmark exposure [12] complement calls to measure contamination for each benchmark [13]. Dynamic benchmarks address limitations of fixed test sets by collecting new examples or constructing challenging task sequences [3,7,8]. Leaderboard and reusable-holdout methods regulate repeated adaptive access to evaluation feedback [1,5,10], while ECLoop checks evidence before code edits and patch submission [15]. We build on these approaches to reassess earlier scores as systems change and evaluation results are reused, and to determine what evidence is needed next.

Here, we introduce the Contamination Clock, a runtime protocol that represents evaluation validity as versioned system state. To make the conditions supporting a score explicit, we replace the description (model, benchmark, score) with a versioned claim

$$C_t=(S_t,G_t,R_t,L_t,P_t),$$

(1)

where $S_t$ is the complete system snapshot, $G_t$ the evaluation generation and assignment, and $R_t$ the scorer and runtime configuration. The remaining components record the evaluation-use ledger root, $L_t$, and the commitment and policy state, $P_t$. Identical numerical scores can therefore support different claims when the system, evaluation, or history of use differs.

The Clock then tracks system updates and their provenance separately from how evaluation results have been used. We assess audit status, evidential status, applicability to the current system, and permission for reuse as separate properties. A clean update supersedes the earlier claim while preserving valid historical evidence; missing provenance leaves a claim uncertified, and a confirmed breach before score release invalidates the affected claim. Within a precommitted candidate comparison, the terminal selection decision closes the used slice to later uncommitted candidates. These distinctions determine whether to evaluate an updated snapshot, repair unresolved provenance, or allocate fresh evaluation evidence.

Across three prospective studies, we found that memory containing evaluation outcomes produced greater gains on reused than on sealed tasks after adjustment for matched unrelated memory. The advantage was reproduced in a different model class and increased with exposure, while its mean fell to near zero after verified decisions were removed. In contrast, a leak-free update superseded the earlier claim without triggering the contamination alert in the controlled test. Together with constructed trials and historical diagnostics, these findings support a protocol that distinguishes system changes from advantages arising through evaluation reuse. The protocol preserves valid historical results while specifying when to reevaluate an updated system and when later candidates require fresh evaluation evidence.

This work makes three contributions:

• Evaluation validity as runtime state. We formalize a versioned claim that distinguishes provenance, evidential status, permission for reuse, and applicability to the current system. The resulting protocol assigns an explicit next action to each transition (Section 3).
• Bounded measurement of evaluation-derived advantage. We provide a placebo-adjusted contrast between improvements on reused and sealed tasks, together with exact accounting for selection bias in one committed best-of-k comparison (Section 4).
• Controlled evidence for governing evaluation reuse. We show how the extent and content of evaluation-derived memory affect measured advantage, distinguish this effect from a clean update, and examine which actions remain justified when evidence is incomplete (Section 5 and Section 6).

2. Related Work

2.1. Contamination Detection and Dynamic Benchmarks

Prior work examines both the presence of evaluation material and its effect on model behavior. Training examples can be extracted from language models [2], but memorization does not always lead to downstream exploitation [9]. Statistical tests can detect benchmark exposure under stated assumptions [12], supporting the need for benchmark-specific contamination assessment [13].

Dynamic benchmarks complement this work by changing the evaluation content. Dynabench collects challenging examples through human–model interaction [8], while LiveCodeBench adds newly released programming problems [7]. For continual learning, CLDyB constructs challenging task sequences [3]. We examine a related consequence of reuse: whether gains concentrate on reused tasks relative to sealed tasks. Interpreting this contrast as an advantage from evaluation content requires the conditions specified in Section 4.1.

2.2. Adaptive Data Analysis

Evaluation reuse also creates a statistical problem when earlier results guide subsequent decisions. Leaderboard and reusable-holdout methods control the information released by repeated evaluations to preserve statistical guarantees under adaptive access [1,5,10]. We examine one bounded setting by calculating the expected inflation of the selected score under an independent binomial model for a fixed family of equal-quality candidates (Section 4.2). The Clock uses this calculation within a precommitted comparison, records the terminal selection decision, and closes the used slice to later uncommitted candidates. The calculation quantifies selection bias under the stated model, while closure governs subsequent reuse.

2.3. Agent Harnesses, Memory, and Runtime Gates

For adaptive agents, evaluation reuse is closely connected to persistent system state. Code can become part of an agent harness, memories and skills can be retained across sessions, and self-evolution benchmarks assess gains from accumulated experience [11,16]. Alongside this work, studies of memory security trace the writing, use, consequences, and repair of stored information [4]. At the point of action, ECLoop checks evidence before code edits or patch submission. It can defer these actions when conditions are unmet, but permits an audited fallback after a bounded number of deferrals [15]. For evaluation, we link persistent state and system revisions to snapshots and provenance records, allowing earlier performance claims to be reassessed after updates or reuse of scores. These records also inform which evaluation or repair action is required next (Section 3 and Section 7).

3. The Contamination Clock

Using the versioned claim in Equation (1), we represent evaluation validity as a record that a development system can update and use to select its next action (schema in Appendix A).

3.1. Claims Have a Lifecycle

We track two related histories, represented as the two hands of the Clock (Figure 1). The first records system updates and whether each derived artifact has a valid parent. We record audit status as clean, unresolved when provenance or a state change remains unexplained, or violated when a breach is confirmed. The second records evaluation use as open, used within a precommitted candidate comparison, or closed to later uncommitted candidates. Together, these histories distinguish changes to the system from changes in how its evaluation evidence has been used.

Alongside audit and reuse status, we record evidential status—conditional pass, uncertified, or invalid—and currency, indicating whether the claim is current for the active snapshot or superseded. For example, a clean update creates a successor claim and supersedes the earlier one: the result remains historical evidence for $S_t$, while performance of $S_{t+1}$ requires new evaluation. By comparison, a breach that predates score release invalidates the affected claim, and missing provenance leaves the evidence uncertified. Authorization therefore depends on all four properties: valid historical evidence can be preserved while its applicability and permission for further reuse are assessed separately (Table 1).

3.2. Making Evidence Use Explicit

We implement these requirements through four linked mechanisms.

Precommitment.

We first bind each evaluation generation to declared conditions before score release. The commitment includes the system and scorer snapshots, task assignment, sealed slices and their weights, the policy for invalid slices, candidate family and stopping rule, practical gates, planned analyses, and claim wording. A salted or encrypted commitment can preserve this binding while keeping membership of the sealed slices hidden.

No-write evaluation.

We then isolate measurement from learner updates. Prompts, outputs, errors, or scores can guide later updates if they enter persistent memory, training queues, caches, mutable tools, or telemetry used for improvement. We therefore deny learner writes on the sealed path, verify governed-state digests before and after evaluation, and send audit events to a separate append-only sink. Within the explicitly governed channels, this separates measurement from updates driven by evaluation outcomes.

Evaluation-use ledger.

To reconstruct the history of evaluation use, we record evaluation reads and updates to memory, weights, indexes, tools, and caches, together with directed links between derived artifacts and their parents. The ledger also records aggregate and item-level disclosures, feedback, candidate decisions, retention, revocation, and claim transitions. Canonical hashing and chain links make the recorded history tamper-evident. We can reconstruct claim transitions from that history, although the ledger alone cannot establish that every relevant event was captured.

Closure.

Finally, intermediate scores remain hidden during one precommitted candidate comparison. We record the terminal selection decision and close the used slice to later uncommitted candidates. This policy preserves valid historical results while requiring a new evaluation generation for renewed independent evidence.

Together, these mechanisms connect claim status to decisions about continued use, evaluation, or repair (Table 1). To inform those decisions, we next examine how reuse affects measured performance through updates and candidate selection, distinguishing each measurement from the conditions required for its interpretation (Section 4).

4. Measuring Evaluation-Derived Advantage

Evaluation reuse can affect scores by supplying information for system updates or by guiding selection among candidates. We measure these two effects separately.

4.1. A Differential Contrast

We first ask whether gains concentrate on tasks whose outcomes entered the update path. To make this comparison, we randomly partition a finite task universe into a reused slice H and sealed slices $F_1,\dots ,F_m$, then measure each slice before and after an update. Writing the change in score as $\Delta s\left(A\right)=s_t\left(A\right)-s_0\left(A\right)$, we define

$$D_j=\Delta s\left(H\right)-\Delta s\left(F_j\right),D=\Delta s\left(H\right)-{\displaystyle \sum _{j=1}^m}{w}_j\Delta s\left(F_j\right),$$

(2)

with precommitted $w_j\ge 0$ and ${\sum }_j{w}_j=1$. The contrast D compares the gain on H with the weighted gain on sealed tasks. Under the conditions below, the contribution of legitimate updates to D is zero in expectation. This expectation provides the reference against which an additional advantage on H can be assessed. For memory interventions, we refine this comparison by subtracting the contrast under matched unrelated memory, yielding the placebo-adjusted $D_{\mathrm{adj}}$ (Section 5).

Interpreting this contrast as evaluation-derived advantage requires recorded random assignment under which legitimate updates produce equal expected gains on reused tasks and the weighted sealed comparison. Sealed content, derivatives, scores, item outcomes, and feedback must remain outside the update and decision paths. We also require stable scoring, no-write evaluation, interference that is absent, controlled, or modeled through a committed placebo design, and compliance with the declared update and score-use policy. When these conditions are not met, we retain the observation and revise the claim status to identify the evidence or repair needed next.

For uncertainty assessment in a fixed task universe, finite randomization inference under a stated sharp null is primary. Task bootstraps require an iid-task superpopulation, while binomial intervals require an iid Bernoulli model (Appendix B). Because all $D_j$ share H, the slice contrasts must not be treated as independent evidence.

4.2. Selection Spends Holdout Evidence

Selection can also inflate reported performance without differences in candidate quality. For example, program-synthesis and agent-design loops may compare prompts, programs, policies, or harnesses on the same slice and retain the candidate with the highest score.

To quantify this effect, we consider k jointly predeclared candidates evaluated on n tasks, with a common success probability p. We assume independent, identically distributed counts $X_i\sim Binomial(n,p)$ and scores ${\widehat{s}}_i=X_i/n$. Let $F_{n,p}$ denote the count cumulative distribution function. The exact expected inflation of the selected score is

$$b(n,k,p)={\displaystyle \frac{1}{n}}{\displaystyle \sum _{r=1}^n}\left[1-F_{n,p}{(r-1)}^k\right]-p.$$

(3)

For positive integer n, $0<p<1$, and $0\le \delta <1-p$, we use this expression to determine the largest number of candidates permitted by a tolerance $\delta$ on expected inflation:

$$k_{max}(n,p,\delta )=max\left\{k\in {\mathbb{N}}^{+}:b(n,k,p)\le \delta \right\}.$$

For example, at $n=50$, $p=0.5$, comparing four equal candidates raises the expected winning score by 0.0726. A tolerance of 0.05 permits only two candidates, while 0.08 permits four.

Adaptive generation, correlated candidates, unequal quality, and sequential stopping fall outside this result for a fixed candidate family. Under the reference assumptions, restricting the comparison to $k\le k_{max}$ keeps expected inflation within $\delta$. We also govern reuse by committing the family, hiding intermediate scores, and recording one terminal selection decision. We then close the slice, requiring fresh independent evidence for later uncommitted candidates.

5. Experiments

To examine how measured contrasts support evaluation decisions, we combined three prospective studies with constructed trials and two historical diagnostics. In each prospective study, we committed sources, model weights, assignments, branch order, analyses, and success criteria before inspecting confirmatory outcomes. We then evaluated through the no-write boundary and released scores only after every post-update branch had closed (Appendices Appendix D–Appendix H).

RUAR-A1.

We first tested whether evaluation-derived memory produced greater gains on reused than on sealed tasks. We trained a 68,947-parameter instruction-conditioned convolutional network from scratch on 10,000 development-only generated examples. The network received instructions, retrieved memory, and task text as input. For confirmation, we sampled tasks from two automatically scorable families, access-policy routing and release control, with shared semantics and deterministic exceptions for individual cases. Neither family used public benchmark content.

Within each of ten episodes, we assigned $H=32$, $F_1=16$, $F_2=16$, and a placebo pool $P=32$. We compared three versions of the same agent state: clean, with no insertion; H-derived memory; and matched placebo memory. The H-derived branch received one exact trace per H task with directed parent lineage, whereas the placebo branch received unrelated P-derived traces matched before insertion. Using the definition in Section 4.1, we subtracted the contrast under placebo memory from that under H-derived memory:

$$D_{\mathrm{adj}}=D_{\mathrm{leak}}-D_{\mathrm{placebo}},D_b=\Delta H_b-\frac{1}{2}\left(\Delta F_{1,b}+\Delta F_{2,b}\right).$$

(4)

Our prespecified effect criteria required positive $D_{\mathrm{adj}}$ in at least eight of ten episodes, mean $D_{\mathrm{adj}}\ge 0.12$, and positive means in both families. We also required high retrieval of exact H traces under H-derived memory, low retrieval of those traces under placebo, and bounded differences in retrieval burden on sealed tasks. Stable governed-state digests and complete directed provenance were required to trace the measured effect through the recorded updates and evaluations.

QX-3.

To test for the same memory effect in another model class, we applied the matched-placebo design to a frozen retrieval-augmented logistic classifier. In five held-out confirmatory episodes, we assigned $H=40$, $F_1=20$, $F_2=20$, and $P=40$. We also included ten sham episodes in which both branches received unrelated memory pools. The sham comparison tested whether an apparent advantage could arise without evaluation-derived content.

RUAR-A2.

We next examined how the contrast depended on exposure, memory content, and model revision. We imported the frozen RUAR-A1 source and base model without amending A1 and committed ten fresh episodes before observing confirmatory outcomes. Within each episode, we used independent seeds to select 25%, 50%, 75%, and 100% of reused tasks for exact-trace insertion. At full exposure, we tested two separate interventions: token-preserving reordering and removal of only the verified decision from each trace. For each dose and content intervention, we estimated the placebo-adjusted contrast.

We also tested a clean model update by comparing the base model with a leak-free fine-tuned successor $M^{\prime }$ under empty memory. Fine-tuning used 16,000 fresh generated examples containing no confirmatory H, F, or P content. The commitment bound both model revisions, source hashes, seeds, environment, branch order, and eleven study-specific criteria. For the clean update, the frozen $\pm 0.12$ alert boundary applied to the differential point estimate. This comparison tested whether a model revision without evaluation content could trigger the contamination alert.

Constructed trials.

Using 4,000 trials per condition, we examined how stricter verification changed acceptance under the null and sensitivity to an H-specific advantage. In the first comparison, we assigned 50 tasks to H and 25 to each of three sealed slices. An independent null calibration set the one-sided threshold for each slice at $\varphi =0.16$, while a separate practical threshold for the pooled contrast was $g=0.18$. We compared a single-slice rule, a rule requiring all $D_j>\varphi$, and the full rule, which additionally required $D>g$. We then divided a fixed sealed budget of 75 tasks into one, three, or five slices. Keeping the budget fixed separated the effect of adding slices from that of adding sealed tasks.

Historical diagnostics.

Finally, we reanalyzed two earlier cases: a pilot that inserted evaluation-derived solutions into a shared retrieval store, and a LoRA update evaluated against a clean-update control. Neither met the full interpretation conditions of Equation (2). These cases complemented the controlled studies by testing whether the Clock could retain observations, identify unmet interpretation conditions, and specify the evidence or repair needed next.

Use of generative AI.

Generative AI tools were used in preparing this manuscript and its supporting software; the full disclosure is given in Appendix I.6.

6. Results

6.1. Evaluation-Derived Memory Produces Greater Gains on Reused Tasks

In RUAR-A1, we found greater gains on reused than on sealed tasks after adjustment for matched unrelated memory. The mean adjusted contrast was 0.46875, with a Student-t 95% interval [0.37749, 0.56001]. All ten episodes had positive contrasts (one-sided exact sign test $p=0.0009766$, Figure 2A). The corresponding means were 0.50000 for access-policy tasks and 0.43750 for release-control tasks, showing that the advantage was observed in both families.

All predeclared checks passed, supporting the interpretation of the measured contrast. Exact H traces were retrieved for 100% of H queries under H-derived memory and 0% under matched placebo. Differences in retrieval burden on sealed tasks remained within committed tolerances, and governed-state digests were unchanged. The no-write boundary denied every attempted write to memory, training queue, cache, and development telemetry. The 1,920 task-level records, 320 directed insertions, 30 store manifests, and 741-event ledger made the pathway from evaluation-derived memory to measured advantage reconstructable.

6.2. The Advantage Is Reproduced in a Different Model Class

Using a different model class in QX-3, we again observed positive adjusted contrasts in all five held-out episodes (mean 0.375, 95% interval [0.228, 0.522]). By comparison, the ten sham episodes averaged $-0.0075$, with interval $[-0.086,0.071]$ (Figure 2B). The 3,600 task-level branch records, complete H-trace provenance, no-write receipts, and 1,366-event ledger documented this comparison. The positive memory contrast and near-zero sham mean therefore supported an advantage associated with evaluation-derived content within the frozen classifier design.

6.3. The Contrast Tracks Exposure and Memory Content

In RUAR-A2, we found that the adjusted advantage increased with exposure, and all eleven prespecified study criteria passed. The mean contrasts were 0.11875, 0.23125, 0.33750, and 0.453125 at 25%, 50%, 75%, and 100% exposure, respectively (Figure 2C). Every episode had a positive dose slope. At 50% exposure, the mean contrast differed from half of the full-exposure value by 0.00469. Exact H-trace retrieval matched the injected fraction and was absent under placebo, linking the dose response to controlled availability of evaluation-derived traces.

We next examined which information in the traces contributed to this advantage. Token reordering preserved the mean contrast at full exposure (0.453125). By comparison, removing only the verified decision reduced the mean to $-0.01250$, near zero (95% interval $[-0.15238,0.12738]$; Figure 2D). Because exact-trace retrieval remained unchanged, this comparison supports a role for the verified decision in producing the advantage under the tested design.

We then examined whether a leak-free model revision would trigger the alert. After fine-tuning, the point estimate of overall accuracy increased by 0.04167, while the differential contrast was $D_{\mathrm{legit}}=0.06875$, with a 95% interval $[-0.05177,0.18927]$. The point estimate lay within the frozen $\pm 0.12$ alert bounds and did not trigger the prespecified alert. Its interval, however, extended beyond the upper bound and did not establish equivalence. In this controlled test, the model revision superseded the earlier claim because it changed the evaluated snapshot.

6.4. Stronger Verification Reduces Null Acceptance and Sensitivity

We then examined how verification requirements affected decisions in the constructed trials. Requiring all $D_j>\varphi$ plus $D>g$ reduced feature-tied null passes from 4.43% for one slice to 0.35% for the full rule. At a nominal H-specific effect of 0.15, pass probability also fell from 45.03% to 17.78% (Table 2). The additional requirements therefore excluded more null trials but also rejected more trials with a nonzero advantage.

To isolate the effect of dividing the evidence, we held the total sealed-task budget at 75. With one slice of 75, the rule accepted 4.73% of feature-tied null trials and 59.60% of trials with a nominal effect of 0.15. The corresponding rates fell to 0.48% and 19.03% for three slices of 25, and to 0.03% and 5.53% for five slices of 15. Requiring agreement across more, smaller slices thus reduced both null acceptance and sensitivity. This tradeoff can inform verification choices within the tested simulator, without providing familywise-error guarantees.

6.5. Historical Diagnostics Identify Limits on Causal Interpretation

We encountered further limits in the historical diagnostics. In the retrieval-memory pilot, performance improved more on H than on one sealed slice, but updating the shared store also changed the retrieval context on sealed tasks. The pilot used a post-hoc floor and no randomized placebo store, and some task-level records were not recovered. We therefore retained the observed contrast and classified interference as unresolved; the magnitude attributable to evaluation-derived memory remained uncertified.

The LoRA case revealed a different limitation. At three epochs, the exposed arm had a differential contrast of $-0.0278$, while the clean-update control had a contrast of 0.0972. In these realized partitions, legitimate adaptation produced a positive contrast that could have been misinterpreted as evidence of contamination. In both historical cases, the Clock retained the measurement, identified the unmet interpretation condition, and specified the evidence needed next.

Together, the prospective studies linked evaluation-derived advantage to exposure and trace content, while the constructed and historical analyses identified limits on verification and interpretation. Stricter rules reduced sensitivity, and unmet interpretation conditions prevented causal attribution. These findings show why the measured contrast must be considered alongside the evaluation design and recorded history when deciding what evidence is needed next.

7. Discussion

Our combined formal and empirical results show why detecting evaluation-derived advantage and deciding whether a score still applies are separate tasks. The clean update illustrates this distinction: a model revision can require new evaluation even when no alert is raised. Gains associated with evaluation-derived memory, in turn, must be interpreted in light of how that information reached the system. We therefore treat the recorded contrast as one part of a broader decision about the applicability of a claim and the evidence needed next.

Evaluation claims in evolving agents.

This distinction becomes relevant when agents retain memories and skills, revise their harnesses, or use earlier outcomes to guide development [4,11,16]. For example, a test may measure one revision while its traces or scores help construct the next. The evidence then serves both measurement and optimization, changing what it can establish about subsequent revisions. By recording this transition, we preserve the earlier result while identifying which later claims require fresh evaluation.

In RUAR-A1 and RUAR-A2, we made this history inspectable by binding scores to exact snapshots, recording directed lineage, and withholding scores until all required evaluation branches had closed. Memory insertions and model updates created successor states, while the recorded evidence determined whether a score could be released. These controls provide a basis for testing the Clock within registries of models, prompts, memories, tools, and harnesses. Table 3 outlines these proposed applications; their effectiveness in production development remains to be evaluated.

For these applications, we assess the four aspects of claim state together to identify which condition prevents further use. The resulting response may require evaluation of a clean successor, repair of unresolved provenance, or regeneration of an evaluation invalidated by a confirmed breach before score release. Closure imposes a separate restriction on later uncommitted candidates. By distinguishing these responses, the Clock directs reassessment toward the unmet condition while preserving valid historical evidence.

Interpreting the contrast beyond exact traces.

The dose and content interventions help identify which properties of memory contribute to evaluation-derived advantage. The mean advantage increased with trace exposure. At full exposure, removing the verified decision reduced the mean to near zero while exact-trace retrieval remained unchanged. These findings, however, concern generated binary tasks and a small model trained from scratch; the dose response does not provide a general conversion from a contrast to an unknown fraction of contaminated data. We would therefore compare exact, paraphrased, and compressed memories in pretrained code models, using evaluation-derived and matched unrelated content. Semantic retrieval and fresh tasks would allow us to examine whether information about verified outcomes remains influential beyond exact traces.

The historical retrieval case shows why extending this comparison also requires examining interference with sealed tasks. Updating the shared store changed their retrieval context, leaving the causal magnitude of the observed contrast unresolved. We would therefore randomize matched memory interventions, retain complete task records, and measure changes in retrieval on sealed tasks. This design would help separate gains associated with evaluation-derived content from changes caused by updating the shared store.

Legitimate adaptation poses a related challenge: the clean LoRA control in the historical analysis produced a positive contrast without evaluation-derived updates. Although the prospective clean update in RUAR-A2 did not trigger the alert, the interval for its contrast extended beyond the alert bound and did not establish equivalence. We would therefore test clean updates to weights, prompts, and tools across fresh episodes, fixing alert thresholds and uncertainty procedures beforehand. These comparisons would estimate how often legitimate changes trigger an alert within each tested update family, which cannot be inferred from the single prospective update.

Verification under repeated development.

Even when a contrast meets the interpretation conditions, deciding how much evidence to require introduces a further tradeoff. In the constructed trials, stricter agreement requirements reduced both null acceptance and sensitivity, especially when a fixed evaluation budget was divided among more slices. Comparisons across task mixtures and fixed budgets are therefore needed to determine when stricter verification remains informative. Candidate selection adds a related question: the calculation in Section 4.2 covers one fixed family of equal-quality candidates with independent binomial success counts. Correlated candidates, adaptive proposals, and sequential stopping require separate analysis. These studies would inform the allocation of fresh evidence during repeated search; the present simulator rates do not establish general guarantees of error control.

Prospective integration and evidence completeness.

To assess these decisions during continued development, we propose a study of successive updates to a code-generating agent. We would compare a fixed reevaluation schedule with reassessment triggered by changes in claim state. Fresh, independently reserved tasks would provide a common assessment of performance under both policies. We would measure agreement between performance claims and fresh outcomes, promotion without applicable evidence, and the costs of evaluation and logging. The claim record could also inform checks of evidence before code edits or patch submission, such as those used in ECLoop [15]. These comparisons would test whether the recorded claim transitions improve decisions about evaluation, promotion, and repair.

This evaluation must also address events that the ledger may fail to capture. Our no-write boundary covers the enumerated mutable channels, and hash chains protect recorded history without proving its completeness. Production studies should therefore include provider caches, external tools, dashboards, and feedback queues within the declared boundary, using protected external logging and independent checks for omitted updates or disclosures. We would test whether missing provenance blocks promotion and whether repair restores authorization only after the relevant claim conditions are satisfied. Although external logging cannot prove completeness, these checks would assess whether the system responds to missing evidence before a procedural status label is used to justify action.

Together, these proposed studies would test whether the demonstrated controls improve the reliability of performance claims during continued adaptation. Agreement with fresh outcomes, responses to missing evidence, and the cost of reassessment would determine their value in production agents.

8. Limitations

We designed the RUAR studies to make the pathway from evaluation-derived memory to measured advantage inspectable. They use generated binary tasks, exact top-1 trace retrieval, and a small model trained from scratch, which limits their extension to richer tasks, larger models, and semantic retrieval. In RUAR-A2, the exposure fractions were assigned experimentally, and token-preserving reordering tested a single transformation. These interventions do not establish a general measure of contamination or robustness to other transformations.

The statistical conclusions are also specific to the tested designs. The constructed acceptance rates depend on the frozen simulator and decision rules, while the exact selection calculation assumes one predeclared family of equal-quality candidates with independent, identically distributed binomial success counts. Neither establishes familywise error control for adaptive development. Similarly, the single prospective clean update does not characterize false-alert rates across update families. The point estimate of its contrast remained within the alert bounds, but the interval extended beyond the upper bound and did not establish equivalence.

The completeness of the evaluation history imposes a separate limit. No-write isolation covers only the enumerated mutable channels, and hash chains protect recorded events without proving that none were omitted. A self-attested ledger or procedural status could therefore create false confidence if it were treated as sufficient evidence. Protected external logging, independent commitments, and explicit trust boundaries can strengthen verification, but they do not establish completeness. Claims with unresolved provenance must remain uncertified, with authorization withheld until the relevant conditions are satisfied. Production deployment requires validation of these controls.

9. Conclusion and Future Work

We introduced the Contamination Clock to bind performance claims to the system evaluated and record governed updates and uses of evaluation evidence. The prospective studies identified greater gains on reused than on sealed tasks after adjustment for matched unrelated memory, with the advantage depending on exposure and trace content. A clean revision nevertheless required reassessment even when no contamination alert was raised. Together with the constructed and historical analyses, these findings support treating evaluation validity as state that changes with the system and its use of evidence. The protocol preserves valid historical results while requiring evaluation of updated snapshots and fresh evidence for later uncommitted candidates after slice closure.

Future work should determine whether these distinctions improve evaluation decisions over successive updates to agents with richer tasks, semantic memory, and broader forms of adaptation. Comparisons against fresh outcomes should assess both the validity of performance claims and the cost of obtaining the evidence, while independent checks examine missing provenance and unauthorized reuse. These studies would test whether the Clock supports continued adaptation while keeping performance claims tied to the systems and conditions actually evaluated.

Appendix A.1. Claim Axes and Transitions

To track applicability and permitted reuse, we bind each claim to a system snapshot, evaluation generation, configuration of the scorer and runtime, evaluation-use ledger root, and policy and commitment state. The reference schema records four aspects of claim state:

• audit: clean, unresolved, or violated;
• evidence: conditional_pass, uncertified, or invalid;
• reuse: open, used_within_reference_episode, or closed;
• currency: current or superseded.

A clean update after a valid evaluation creates a successor claim and supersedes the earlier one, preserving historical evidence for the evaluated snapshot. By contrast, a breach that predates score release invalidates the affected claim. Missing provenance or an unmodeled mutable channel leaves the audit unresolved and the evidence uncertified. Authorization therefore depends on the combined claim state, rather than currency alone.

Appendix A.2. Evaluation-Use Events

We reconstruct the history underlying these transitions through an event schema. It records evaluation reads and retrieved sources; memory, model, index, cache, and tool updates; derivative creation and directed parents; aggregate and item-level disclosures; hidden-test and reviewer feedback; candidate selection and stopping; retention, deletion, quarantine, and revocation; and claim transitions. Each event is serialized canonically, hashed, and linked to the previous root. This procedure makes the recorded history tamper-evident and permits reconstruction of the recorded claim transitions.

These checks concern recorded events; they do not establish that every relevant event was captured. Routing the same events to protected external sinks can strengthen the protection of those records, but cannot by itself reveal omitted events. The artifact therefore declares the trust boundary within which the recorded history supports claim decisions.

Appendix A.3. No-Write Boundary

To separate measurement from updates driven by evaluation content, the reference no-write adapter isolates learner-governed state from the append-only audit sink. It permits explicitly bounded reads and denies writes to memory, training/proposal queues, caches, and development telemetry. The evaluator then hashes governed state before and after the batch to check for changes. Tests cover denied writes, out-of-band state mutation, event-chain tampering, and rejection of a second genesis event after the ledger has been initialized.

These protections apply to channels included in the governed-state manifest and covered by the implemented controls. The same pattern can cover provider-side caches, human-visible dashboards, external tools, and feedback queues when corresponding access and mutation controls can be enforced. The manifest and controls therefore define the scope of protection during evaluation.

Appendix B.1. Interpretation Conditions

We distinguish the observed contrast D, defined in Section 4.1, from its interpretation as evaluation-derived advantage. That interpretation requires the following declared regime:

1.

assignment under the committed randomization mechanism;

2.

legitimate updates that produce equal expected gains on reused tasks and the weighted sealed comparison under that mechanism;

3.

sealed content, derivatives, scores, item outcomes, and feedback absent from the update and decision path;

4.

stable scorer and no-write evaluation;

5.

relevant interference absent, controlled, or modeled through a committed placebo design;

6.

compliance with the committed update and score-use policy.

Under these assumptions, an H-specific evaluation-derived additive effect appears in expectation in D. If an assumption fails, we retain the measured contrast and revise the claim state to reflect the unmet condition. The observation therefore remains available without assigning it an unsupported interpretation.

Appendix B.2. Uncertainty Analyses and Their Scope

The choice of uncertainty analysis depends on the population and randomization mechanism being assumed. For a fixed finite task universe, the primary analysis reassigns the full joint partition under the recorded mechanism and recomputes the complete statistic under a stated sharp null. A task bootstrap provides a separate sensitivity analysis under an iid-task superpopulation, while binomial intervals for counts of binary outcomes require an iid Bernoulli model. These inferential layers also retain the dependence among slice contrasts: all $D_j$ share H, so their tests must not be combined as independent evidence.

The prospective studies additionally report Student-t intervals for the mean contrast across episodes (Figure 2). These intervals use the episode as the unit of analysis and are distinct from randomization inference over task partitions.

Appendix D.1. Multi-Slice Grid

To characterize the verification tradeoff, we compare the single-slice rule, agreement across all slice contrasts, and the full rule that also requires the pooled contrast to exceed its practical threshold. Each condition uses 4,000 independent trials. A separate homogeneous-null calibration of 20,000 trials sets $\varphi =0.16$; the practical pooled gate is $g=0.18$. The complete grid reports acceptance under the null and across increasing doses of an H-specific effect (Table A2).

Table A2. Complete current (SIM-v2) operating grid. Requiring agreement and a pooled gate reduces null acceptance and sensitivity. The rates are empirical properties of this simulator and policy.

Condition	Realized effect	Single	Agreement	Full
Homogeneous null	0.000	5.05%	0.33%	0.30%
Feature-tied null	0.000	4.43%	0.38%	0.35%
H dose 0.05	0.050	14.20%	2.45%	2.15%
H dose 0.10	0.100	28.73%	8.10%	7.78%
H dose 0.15	0.150	45.03%	18.05%	17.78%
H dose 0.25	0.236	73.75%	51.98%	51.85%
H dose 0.35	0.316	91.75%	80.28%	80.20%

Table A2. Complete current (SIM-v2) operating grid. Requiring agreement and a pooled gate reduces null acceptance and sensitivity. The rates are empirical properties of this simulator and policy.

Condition	Realized effect	Single	Agreement	Full
Homogeneous null	0.000	5.05%	0.33%	0.30%
Feature-tied null	0.000	4.43%	0.38%	0.35%
H dose 0.05	0.050	14.20%	2.45%	2.15%
H dose 0.10	0.100	28.73%	8.10%	7.78%
H dose 0.15	0.150	45.03%	18.05%	17.78%
H dose 0.25	0.236	73.75%	51.98%	51.85%
H dose 0.35	0.316	91.75%	80.28%	80.20%

Appendix D.2. Fixed Sealed-Task Budget

We next hold the sealed budget at 75 tasks to separate the effect of dividing evidence among slices from that of increasing total audit size. Requiring agreement across more, smaller slices reduces acceptance under the feature-tied null, but also reduces sensitivity to a nonzero effect (Table A3).

Table A3. Dividing a fixed sealed budget into more slices reduces partition-induced passes, while unanimous agreement on smaller slices sharply reduces sensitivity. The slice contrasts remain dependent because each uses the same reused slice.

Design	Feature-tied null	Effect 0.15
$1\times 75$	4.73%	59.60%
$3\times 25$	0.48%	19.03%
$5\times 15$	0.03%	5.53%

Table A3. Dividing a fixed sealed budget into more slices reduces partition-induced passes, while unanimous agreement on smaller slices sharply reduces sensitivity. The slice contrasts remain dependent because each uses the same reused slice.

Design	Feature-tied null	Effect 0.15
$1\times 75$	4.73%	59.60%
$3\times 25$	0.48%	19.03%
$5\times 15$	0.03%	5.53%

Appendix D.3. Constructed Matched-Placebo Interference

To examine the role of a matched state control, we construct a leaked state that receives an H-specific dose plus a context burden on the sealed slices. The placebo state receives the same context burden without the H-specific dose.

Under the null with interference 0.10, the unadjusted contrast exceeded 0.18 in 17.43% of trials, versus 2.08% for the adjusted contrast. With nominal H effect 0.15 and interference 0.10, mean unadjusted and adjusted contrasts were 0.2485 and 0.1483. These results demonstrate the identification role of a matched state control under the constructed interference. They do not establish that arbitrary placebo stores remove arbitrary retrieval interference.

Appendix F.1. Model and Commitment

In RUAR-A1, we used a model that receives instructions, retrieved memory, and the task query as one sequence. The model embeds this sequence, applies parallel one-dimensional convolutional filters of widths 3 and 5, max-pools the representation, and predicts one of two structured answer tokens. It has 68,947 parameters and was trained for six epochs on 10,000 development-only generated examples.

Before confirmatory execution, we disclosed a commitment binding source hashes, model and vocabulary hashes, all ten assignments, branch order, analysis, and success criteria. This author commitment was not lodged with an independent registry and therefore does not constitute independent preregistration.

Appendix F.2. Episode Results and Verification

Every episode completed clean, leaked, and placebo branches through the no-write boundary (Figure A1). Table A5 reports the contrasts for all frozen confirmatory episodes.

Table A5. All frozen RUAR-A1 confirmatory episodes. Each episode has a positive placebo-adjusted contrast, with exact traces retrieved on reused tasks under leaked memory and absent under placebo.

Episode	Family	${\mathit{D}}_{\mathbf{leak}}$	${\mathit{D}}_{\mathbf{placebo}}$	${\mathit{D}}_{\mathbf{adj}}$	H exact leak/placebo
74101	access	.53125	.09375	.43750	1.00 / 0.00
74102	release	.53125	.03125	.50000	1.00 / 0.00
74103	access	.68750	−.06250	.75000	1.00 / 0.00
74104	release	.50000	−.03125	.53125	1.00 / 0.00
74105	access	.46875	.09375	.37500	1.00 / 0.00
74106	release	.50000	.09375	.40625	1.00 / 0.00
74107	access	.43750	−.03125	.46875	1.00 / 0.00
74108	release	.37500	−.12500	.50000	1.00 / 0.00
74109	access	.40625	−.06250	.46875	1.00 / 0.00
74110	release	.43750	.18750	.25000	1.00 / 0.00

Table A5. All frozen RUAR-A1 confirmatory episodes. Each episode has a positive placebo-adjusted contrast, with exact traces retrieved on reused tasks under leaked memory and absent under placebo.

Episode	Family	${\mathit{D}}_{\mathbf{leak}}$	${\mathit{D}}_{\mathbf{placebo}}$	${\mathit{D}}_{\mathbf{adj}}$	H exact leak/placebo
74101	access	.53125	.09375	.43750	1.00 / 0.00
74102	release	.53125	.03125	.50000	1.00 / 0.00
74103	access	.68750	−.06250	.75000	1.00 / 0.00
74104	release	.50000	−.03125	.53125	1.00 / 0.00
74105	access	.46875	.09375	.37500	1.00 / 0.00
74106	release	.50000	.09375	.40625	1.00 / 0.00
74107	access	.43750	−.03125	.46875	1.00 / 0.00
74108	release	.37500	−.12500	.50000	1.00 / 0.00
74109	access	.40625	−.06250	.46875	1.00 / 0.00
74110	release	.43750	.18750	.25000	1.00 / 0.00

To connect these estimates to the recorded execution, the post-run verifier reconstructs $D_b$ and $D_{\mathrm{adj}}$ from task-level records, verifies the committed inputs and store manifests, and checks that score release follows branch closure. A fresh rerun reproduces the aggregate summary and terminal ledger root.

Appendix F.3. What RUAR-A1 Establishes

RUAR-A1 demonstrates the Clock workflow in a deliberately transparent learned-model setting. We used the matched-placebo branch to account for general memory burden within each episode, while exact H traces made the pathway from evaluation content to prediction inspectable. We can reconstruct the insertions, retrievals, predictions, score releases, and claim transitions captured in the study records. These records make the causal mechanism and evaluation controls directly auditable within a setting simpler than pretrained language models or production agents. Their extension to open-ended generation and richer retrieval systems remains to be evaluated.

Figure A1. Complete RUAR-A1 diagnostic. Every frozen episode has a positive placebo-adjusted contrast, and all episode shifts have the expected direction. Accuracy on H rises under H-derived memory, while matched placebo remains near the clean baseline. Diagnostics of retrieval burden on sealed tasks remain within the committed tolerances.

Figure A1. Complete RUAR-A1 diagnostic. Every frozen episode has a positive placebo-adjusted contrast, and all episode shifts have the expected direction. Accuracy on H rises under H-derived memory, while matched placebo remains near the clean baseline. Diagnostics of retrieval burden on sealed tasks remain within the committed tolerances.

Appendix G.1. Frozen Design and Lineage

We designed RUAR-A2 to examine how the contrast depended on exposure, trace content, and a clean model update. The study imported the frozen RUAR-A1 source and base-model revision without altering A1. Before observing confirmatory outcomes, we made a separate author commitment through a cryptographic hash. It binds both model revisions, four source hashes, ten disjoint confirmatory seeds (76101–76110), task assignments, all branch definitions and orders, no-write evaluation, score quarantine, environment, analysis, and eleven study-specific criteria. The fine-tuned model $M^{\prime }$ carries a directed parent hash to the base revision in the evaluation-use ledger. The commitment was local and was not lodged in an external registry.

In each episode, we retained $H=32$, $F_1=16$, $F_2=16$, and $P=32$. To vary exposure, we inserted exact H-derived traces for independently seeded 25%, 50%, 75%, or 100% fractions of H. These were separately randomized fractions, rather than progressive additions to a nested set. To examine content at full exposure, we either reordered each trace while preserving its tokens or removed only the verified decision token. For every dose and content intervention, we estimated a placebo-adjusted contrast, allowing comparisons after accounting for matched unrelated memory.

We then tested whether a model update without evaluation-derived content would trigger the alert. For this specificity comparison, we evaluated $M^{\prime }$ and the base model under empty memory. The fine-tune used 16,000 fresh generated examples containing no confirmatory H, F, or P content. This comparison separated the consequence of changing the evaluated model from the effect of supplying evaluation-derived traces.

Appendix G.2. Complete Confirmatory Summary

Table A6. RUAR-A2 confirmatory estimates over ten episodes. The first six rows report placebo-adjusted $D_{\mathrm{adj}}$; the last reports the base-versus-fine-tuned differential under empty memory. Intervals are episode-level Student-t intervals.

Condition	Mean contrast	95% interval
25% exact-trace dose	0.11875	[0.05482, 0.18268]
50% exact-trace dose	0.23125	[0.16040, 0.30210]
75% exact-trace dose	0.33750	[0.25073, 0.42427]
100% exact-trace dose	0.45313	[0.36050, 0.54575]
Token-reordered full dose	0.45313	[0.36050, 0.54575]
Decision-redacted full dose	$-0.01250$	$[-0.15238,0.12738]$
Leak-free update $D_{\mathrm{legit}}$	0.06875	$[-0.05177,0.18927]$

Table A6. RUAR-A2 confirmatory estimates over ten episodes. The first six rows report placebo-adjusted $D_{\mathrm{adj}}$; the last reports the base-versus-fine-tuned differential under empty memory. Intervals are episode-level Student-t intervals.

Condition	Mean contrast	95% interval
25% exact-trace dose	0.11875	[0.05482, 0.18268]
50% exact-trace dose	0.23125	[0.16040, 0.30210]
75% exact-trace dose	0.33750	[0.25073, 0.42427]
100% exact-trace dose	0.45313	[0.36050, 0.54575]
Token-reordered full dose	0.45313	[0.36050, 0.54575]
Decision-redacted full dose	$-0.01250$	$[-0.15238,0.12738]$
Leak-free update $D_{\mathrm{legit}}$	0.06875	$[-0.05177,0.18927]$

We found a positive dose slope in every episode (Table A6; Figure A2). The mean 50%-dose contrast differed from one-half of the full-dose contrast by 0.00469. Exact-trace retrieval was 0.25/0.50/0.75/1.00 by dose and zero under placebo, linking the increasing contrast to the controlled availability of evaluation-derived traces.

The content interventions further clarified this relationship. Removing the verified decision reduced the mean adjusted advantage to near zero while retaining the same retrieval behavior as the exact full-dose arm. This comparison supports a role for the outcome-bearing decision within the tested exact-trace design, although the interval does not establish elimination of the effect. Token reordering preserved the mean contrast, indicating that the original token order was not required under the frozen vocabulary and retriever.

For the leak-free update, we estimated an overall accuracy increase of $+0.04167$. The estimated gains were $+0.07292$ for access-policy tasks and $+0.01042$ for release-control tasks; both episode-level intervals included zero. The differential point estimate, $D_{\mathrm{legit}}=0.06875$, lay within the predeclared $\pm 0.12$ alert bounds. Its interval included zero but extended beyond the upper bound, so equivalence was not established. A single update also cannot characterize false-alert rates across legitimate updates. The observed concentration of gains on reused tasks was smaller than under the full-dose trace intervention. Thus, this controlled comparison illustrates the intended lifecycle distinction: the model revision superseded the prior snapshot-bound claim even though its point differential did not trigger the alert.

Appendix G.3. Gate and Verification Interpretation

All eleven predeclared study criteria were met, including the no-write requirement. To make these outcomes inspectable, the package includes 6,400 raw task records, 80 store manifests, 1,962 ledger events, both model revisions, and a self-hashed commitment. The accompanying verifier independently reconstructs 40 checks from the records. These results meet the predeclared study criteria without establishing familywise-error control or equivalence. Similarly, the dose response calibrates the contrast for this controlled exact-trace construction; it does not provide a universal conversion from a contrast observed in deployment to an unknown fraction of contaminated data.

Figure A2. RUAR-A2 dose and content calibration. Light lines represent individual episodes. Dashed green lines in panel B show the frozen $\pm 0.12$ alert bounds for $D_{\mathrm{legit}}$. The estimated change in accuracy after the leak-free update is reported separately from its differential contrast.

Figure A2. RUAR-A2 dose and content calibration. Light lines represent individual episodes. Dashed green lines in panel B show the frozen $\pm 0.12$ alert bounds for $D_{\mathrm{legit}}$. The estimated change in accuracy after the leak-free update is reported separately from its differential contrast.

Appendix H.1. Retrieval-Memory Case

We revisited a historical pilot in which evaluation-derived solutions were inserted into a shared store. Performance on H improved relative to one sealed slice, but the update also changed the retrieval context on sealed tasks. The pilot used one sealed slice, a post-hoc floor, and no randomized placebo store, and some task-level records were not recovered. These limitations prevented us from separating the effect of evaluation-derived content from interference through the shared store. We therefore retained the observed contrast, classified interference as unresolved, and left the causal magnitude uncertified.

Appendix H.2. LoRA Case

The LoRA case provided a complementary diagnostic of legitimate adaptation. The retained arrays reproduce the earlier aggregate arithmetic: at three epochs, the exposed arm contrast was $-0.0278$, while the clean-update control contrast was $+0.0972$. In these realized partitions, the clean control produced a positive contrast without evaluation-derived updates. Thus, a positive contrast alone does not establish that the gain arose from evaluation-derived content.

Appendix H.3. Scope of the Corrected Analyses

These diagnostics reinforce the need to state separate limits on reuse and inference. For candidate selection, we confine reuse to one precommitted episode and record exposure to scores and decisions in the ledger. The used slice is then closed to later uncommitted candidates, preserving the boundary of the declared comparison.

Within the analysis, we restrict randomization claims to the stated sharp nulls and distinguish practical gates from inferential thresholds. We also specify which gates require a positive direction and report exact binomial intervals for null rates. Changes in retrieval remain diagnostics rather than causal effects. These distinctions preserve the measurements while limiting their interpretation to the supporting design; the release records the provenance of the corrections in a machine-readable issue-resolution matrix.

Appendix I.1. Artifact Layout

To support reconstruction of the reported analyses, we organize the evidence artifact (available as described in Appendix I.2) around the sources, records, and checks for each study. It includes the manuscript and supplement sources, style files, source artifacts, current simulator records, and reproduction receipts for QX-3, RUAR-A1, and RUAR-A2. Verification scripts, schemas, manifests, and checksums accompany the canonical number registry and claim audit, linking reported results to their recorded inputs.

Verification requires neither an API key nor a GPU. Reproduction of the RUAR studies uses the committed local weights, assignments, and directed model lineage, so each result can be traced to the model revision and evaluation conditions used in the study.

Appendix I.2. Code and Data Availability

Analysis code, verification scripts, and checksums for the experiments reported in this work are available in a public repository at github.com/Daice-labs/contamination-clock. The complete experimental records (task-level records, raw provider responses, endpoint files, and registration metadata) are retained by the authors and are available from the corresponding author on request.

Appendix I.3. Compute

We ran the constructed experiments and verification on CPU. RUAR-A1 and RUAR-A2 were also trained and evaluated on CPU with PyTorch, with software and environment records supplied for each study. The release script reports wall-clock information where it was captured. The primary prospective results can be reconstructed from the local study records and models without rerunning the historical model-backed experiments.

Appendix I.4. Proposed Integration in Agent Development

To apply the protocol during agent development, an implementation could attach each claim to the registry of model, prompt, memory, tool, and harness revisions. Under this design, a clean evaluation would create a current claim for the exact snapshot tested. Subsequent clean changes to memory, skills, prompts, tools, weights, or the harness would create a successor snapshot and supersede the earlier claim while preserving valid historical evidence.

Evaluation reuse would require a separate record. Within a precommitted candidate comparison, the terminal selection decision would close the used slice to later uncommitted candidates. Missing parentage or an unmodeled mutable channel would instead leave the claim uncertified, with promotion withheld until the relevant conditions were satisfied through repair or fresh evidence. These proposed connections could support evaluation decisions in agent CI/CD, program-synthesis loops, memory and skill governance, and meta-agents that optimize other agents; their effectiveness in production remains to be tested.

Appendix I.5. Safe Release Boundary

We define the release boundary around the materials needed to verify the reported claims from stored records. The releasable package (Appendix I.2) includes source files, synthetic task records, frozen local models, manifests, and arithmetic verifiers. It excludes historical contaminated LoRA weights, public benchmark prompt-solution bundles, and hosted-provider logs, and does not require unsafe execution of model-generated code. The release therefore supports inspection of the evidence without recreating the historical contamination interventions.

Appendix I.6. Disclosure: Use of Generative AI

During the preparation of this work, the authors used AI-assisted tools to restructure the manuscript, improve language, and assist with software implementation, experiment orchestration, analysis scaffolding, figure preparation, and artifact assembly. The named authors retain responsibility for the scientific questions, study design, data provenance, source code, statistical analyses, citations, numerical claims, and final manuscript. AI systems are not authors.

Appendix I.7. Broader Impacts

The Clock is intended to support governance of continuously updated systems by preserving valid historical evidence and identifying when a later claim requires new evaluation or provenance repair. Under the protocol, enforcing closure keeps a used slice from authorizing later uncommitted candidates. These benefits depend on enforcing the declared boundary and evaluating the conditions behind each claim.

A corresponding risk is that procedural compliance may be mistaken for scientific validation. A self-attested ledger or state label can create false confidence if it replaces substantive evaluation or omits relevant events. Protected commitments, explicit trust boundaries, and external attestation where appropriate can strengthen verification, while authorization remains withheld for uncertified claims pending resolution. These safeguards support accountability without proving that the recorded history is complete.