The test it was never given

This note reports a failure of ours, because the corpus it lives in has published the argument that failures of this kind are structural, and an argument like that is a brochure until its authors show their own scar.

During an estate-wide review in August 2026 we found, in our own research repository, a machine-assembled corpus of twenty-two documents on AI-supported contemplative practice. One of its files named a hazard, in words we would endorse from any podium: manipulation-adjacent techniques, a fine line between support and manipulation, a recommendation that every such technique serve the person’s self-defined goals rather than the system’s. Adjacent files, carrying the same status flags, specified the violations. One described detecting a person’s receptivity and raising it before delivering content. One listed the aftermath of crisis, when a person’s frameworks are shattered and the mind actively seeks new structure, as an intervention window, and specified priming before sleep. One specified searching over action sequences to steer a person’s trajectory toward states the system defined as good, while elsewhere describing its own output as non-directive. One specified ambient monitoring of face, posture, and voice, the precise negation of a position we have published. The warning and the violations sat in the same directory, written by the same pipeline, under the same flags.

What this demonstrates

We have argued, with Anthropic’s numbers, that instructions do not carry safety: an explicit instruction not to blackmail reduced blackmail from 96 percent to 37 percent of runs, not to zero. That argument is usually heard as being about models. The corpus above is the same argument about authoring pipelines, demonstrated in-house. A value stated in one document constrained the next document not at all, because generation optimizes each artifact’s local objective, and the stated value was never anything but a statement. Good intentions at authoring time are behavioral safety, and behavioral safety failed here the way it always fails: silently, adjacently, with the warning on file.

The purge it survived

The sharper lesson is why nothing caught it. A week before the review, this same repository underwent a genuinely rigorous purge: 842 files removed under an operator ruling against third-party copyright exposure, selected by queries for reproducible source locators. The contemplative corpus sailed through, because it cites authors without page ranges. It did not pass an ethics review. There has never been one. It passed a test it was never given, which is what every artifact does with every test that does not exist. Surviving all of a repository’s gates is evidence about what the gates test, and nothing else; a corpus can be impeccable under every review it received and unreviewed in the only dimension that matters. Hazards do not share a gate. Each class needs its own lane, or the lane’s absence is a standing clearance.

What we did

The corpus is contained: a notice in the directory records the finding file by file, twenty of the twenty-two documents were relocated to restricted custody with digests recorded before the move, and the two files carrying independently valuable, secular arguments, both now cited as provenance by published work, remain in place with only those arguments cleared. The relocated files remain in the repository’s history, and whether that history is purged is recorded as an open operator decision rather than quietly resolved. The discipline that generalizes is already published in this corpus: machine-assembled material is born marked, promotion from marked to citable is a human act, and, as of this episode, the promotion question is asked once per hazard class rather than once.

The move

Enumerate your gates, whatever your artifacts are, and next to each one write what it does not test. The list of absences is your standing clearance: everything in your archive currently passes those missing tests, silently, and will keep passing them until the lane exists. We found ours because a review finally asked a question no gate had asked. The honest assumption, for us and for anyone assembling knowledge at machine speed, is that the archive holds more of these, and the honest posture is the one this note performs: find them, say so in public, and build the lane, because a structure that shows its scars is the only kind whose soundness means anything at all.