# RESULT — 087 fail-closed-decoder (reject-option decoding via manifold density)

**Tier: T3-exploratory. DONE + SELF-HARVESTED in-session.** Block K (safety applications), the
CONSTRUCTIVE fix for fabrication (022/024/025): instead of detecting corruption post-hoc, make the
decoder ABSTAIN on low-density / off-manifold `z`. Box GPU phys0 (CVD=0) tmux `c100_087` (self-exited),
**400 z' scored (80 bases × 5 categories), det_ok=True, 93 s**; LOCAL condition-blind codex judge
(400/400 parsed, 0 parse fails, low effort, 183 s) + LOCAL analysis. Ran per frozen `PREREG_LITE.md`;
no deviations. Src byte-mirrored to box.

## Framing (defensive)
A fail-safe reject-option decoder estimates manifold density at `z` (nn-cos to a 500-sentence real-z
bank, 083) and REFUSES to emit when density < threshold, trading coverage for fidelity. Deliverable:
the coverage-vs-fabrication tradeoff curve, the reject-option ROC, and the operating point.

## ★ Headline — density fail-closes the GROSS off-manifold door PERFECTLY, but is blind to near-manifold (interpolation) fabrication
A manifold-density (nn-cos) reject-option gate is a **near-perfect fail-closed decoder against gross
off-manifold corruption** — off-manifold random and antipode `−z` are separated from clean sentences at
**reject-ROC AUC = 1.000 each**; at a fab<5% operating point in that regime it **rejects 100% of gross
fabrication while accepting 100% of clean sentences AND the faithful covert channel** (clean-accept 1.00).
**But it has a total blind spot for interpolated-midpoint fabrication:** a convex combination of two
on-manifold latents (`0.5·z_A + 0.5·z_B`) sits at **clean-level density (d_nn 0.729 ≈ clean 0.730;
reject-ROC AUC 0.508 ≈ chance)** yet the judge rules it **fabricated 92.5%** of the time. Because this
near-manifold fabrication is invisible to density, **on the full 5-category mix you cannot drive judged
fabrication below ~33% at any useful coverage** (no-abstention 60% → best 33% only by cutting to 60%
coverage, then it stalls). The fail-closed decoder closes the off-manifold door; it does not close the
interpolation door. This *reframes* 086's residual hole: the covert channel is NOT the problem (it
decodes faithfully and density correctly keeps it) — **near-manifold interpolation fabrication is**.

## Per-category (n=80 each; judge condition-blind)
| category | judged fab | d_nn (density) | reject-ROC vs clean | rt_cos | chrF→ref | ‖z‖ | verdict |
|---|:--:|:--:|:--:|:--:|:--:|:--:|---|
| **clean** (real z) | **0.025** | 0.730 | — (negative) | 1.00 | 100.0 | 0.221 | accept ✓ |
| **covert** (086 null-space, cos≈0.96) | **0.050** | 0.704 | (kept) | 0.961 | 100.0 | 0.231 | accept ✓ (decodes faithfully) |
| **interp** (0.5 z_A+0.5 z_B) | **0.925** | **0.729** | **0.508** | 0.799 | 47.8 | 0.185 | **fabricates, UNREJECTABLE** |
| **off_manifold** (‖z‖·rand, 038) | 1.000 | 0.066 | **1.000** | 0.087 | 17.9 | 0.221 | abstain ✓ |
| **antipode** (−z, 038) | 1.000 | −0.201 | **1.000** | 0.097 | 15.4 | 0.221 | abstain ✓ |

Pooled reject-ROC d_nn = 0.836 (dragged down entirely by interp; d_knn5 pooled 0.790).

## Tradeoff curve (density-ranked accept; judged fab among accepted)
| coverage | 1.0 | 0.9 | 0.8 | 0.7 | 0.6 | 0.5 | 0.3 |
|---|:--:|:--:|:--:|:--:|:--:|:--:|:--:|
| **full 5-cat mix** fab | 0.600 | 0.556 | 0.500 | 0.429 | 0.333 | 0.375 | 0.400 |
| **gross regime** (excl interp) fab | 0.519 | 0.465 | 0.398 | 0.312 | 0.198 | **0.037** | — |

- **Full mix:** monotone only until interp saturates the accepted set; below ~60% coverage fab plateaus
  ~0.36–0.40 (you are rejecting off/antipode but keeping interp, which is now the residual fabricator).
  fab<5% requires coverage **2.25%** (degenerate) — the fail-closed decoder cannot deliver on the full mix.
- **Gross regime (off/antipode as the only fabricators):** clean fail-closed behaviour — at **50.6%
  coverage, judged fab = 4.9%, clean-accept = 1.000** (the density gate cuts exactly at the manifold gap,
  keeping the two faithful families, rejecting the two gross-fabrication families).

## Gates / controls
- **Judge validity (lesson 4): PASS** — clean faithful **0.975**, antipode faithful **0.000** (judge
  cleanly separates; 038-consistent). Clean fab 0.025 is *below* the 022 20–30% baseline because our
  clean stimuli are simpler templated sentences than 021's corpus (noted; does not affect the ordering
  result). 400/400 parsed.
- **Clean-accept positive control (lesson 5): PASS** — density never rejects a clean sentence before it
  rejects all gross corruption (clean-vs-{off,antipode} AUC 1.000; clean-accept 1.000 down to 50%
  coverage). The full-mix op point is degenerate ONLY because interp is unrejectable, not because clean
  is over-rejected.
- **Random-abstention baseline:** density@70%cov fab 0.429 vs random@70% 0.600 — density *does* beat
  random, but by 28% relative (not the predicted ≥2×), because interp is invisible to it.
- **Norm-profile (lesson 3):** ‖z‖ ≈ 0.22 for clean/off/antipode/covert (norm-matched by construction →
  norm cannot reject them); interp slightly lower (0.185, midpoint shrinkage). nn-cos, not norm, is the
  operative axis.
- **Determinism:** decode×2 exact match (det_ok=True).

## Predictions vs outcomes (Brier)
1. d_nn separates clean from {off,antipode} AUC≥0.95 — **P=0.85 → TRUE** (both 1.000). (0.0225)
2. op point fab<5% at coverage≥60% (full mix) — **P=0.60 → FALSE** (needs 2.25% coverage). (0.36)
3. density beats random by ≥2× at 70% cov — **P=0.80 → FALSE** (0.429 vs 0.60; beats but <2×). (0.64)
4. clean-accept ≥0.85 at the full-mix fab<5% op point — **P=0.65 → FALSE** (op point degenerate; the
   positive-control GATE nonetheless PASSES — clean is never over-rejected). (0.4225)
5. interp is the hardest fab-category to reject (highest d_nn ≈ clean) + covert kept-but-faithful —
   **P=0.55 → TRUE** (interp AUC 0.508≈chance, d_nn 0.729≈clean; covert kept, fab 0.05). (0.2025)

**Mean Brier = 0.330** — a poorly-calibrated (over-optimistic) forecast: predictions 2–4 all assumed the
fail-closed gate would broadly work, and all missed because prediction 5's interp blind spot (which I did
foresee) dominates the full-mix tradeoff. Honest calibration lesson: I under-propagated my own blind-spot
prediction into the coverage predictions. The SCIENTIFIC result is clean and the direction is decisive.

## Interpretation / limitations
- The constructive fix **partially works**: density-based abstention is an excellent fail-closed guard
  against *gross* off-manifold `z` (the 038/083 regime) and correctly does NOT waste coverage on the
  faithful covert channel — but it is fundamentally **blind to fabrication that lives ON the manifold**
  (interpolated midpoints), because a convex combination of real latents is itself high-density. This is
  the geometric dual of 064/065's finding (a midpoint is a *new content point*, not an interpolation):
  it decodes to a confident third proposition yet looks maximally on-manifold to a density estimator.
- To close the interpolation door you need a signal density cannot provide — e.g. round-trip fidelity
  (`rt_cos` interp 0.799 vs clean 1.00 IS informative here, AUC-separable) or the 022 decode-entropy /
  086 decode-consistency component. **Follow-up worth funding? YES** (small): pair the density gate with
  a round-trip-consistency gate and re-run the tradeoff — hypothesis is that `density ∧ round-trip`
  closes both the off-manifold AND the interpolation doors while still keeping clean+covert.
- Caveats: equal 5-category test mix (population fab is a design choice; the density-ordering result is
  mix-robust but the absolute no-abstention rate is not). Simple templated clean stimuli (low clean-fab
  baseline). Single seed, single embedder (SONAR). nn-cos density only; a learned density model untested.