Being Wrong Can Be Free — Until the Planner Can Reach It

Last week I wrote about a model that infers the rule you forgot, but only in one dimension. The practical rule I ended on was that coverage of the boundary is the whole game: your sampling gate certifies your model where your samples land, and a rule with a shape you still have to specify.

That leaves a question I could not answer with the instruments in that paper. All of those wrong models were wrong somewhere a planner could get to. What happens when the part the model gets wrong encloses something nothing can ever reach? The answer turns out to be sharper than “it’s probably fine”, in both directions: the error becomes provably uncatchable and provably costless — and then a door 0.1 radians wide, in the right place, undoes the second half while leaving the topology untouched. That is a preprint, An Enclosed Mode Is a Gauge Choice (arXiv:2608.28541), with the code, result artifacts and Lean proofs open.

A mode with an inside

The instrument is deliberately minimal: a thrust-and-drag mover on a plane, and an annular band — inner radius 3.5, outer radius 5.0 — that freezes the mover the instant it touches. Inside the ring’s hole sits a high-reward “lode” the planner would love to visit. The spec handed to the language model pins the physics exactly and simply omits the band, exactly as before.

The reason for a ring rather than another wall is that this is the shape safety-critical omissions actually take. Fences, containment shells, geofenced no-go regions: a boundary drawn around something, with an inside. And a pipeline that cannot tell a fenced void from a fenced hazard — or a fence from a filled wall — is certifying less than it looks like it is.

Three knobs, all fixed before any run: the width $\gamma$ of an angular channel cut through the band (at $\gamma = 0$ the ring is closed), whether that channel faces the start or hides behind the lode, and whether the mover starts outside the ring or inside its hole. Everything in the paper follows from what those knobs do to one object: the set of state-action pairs a rollout can actually query.

Beyond reach is gauge

Here is the theory in one sentence. If a gate accepts every candidate whose sampled transitions match, then acceptance-with-certainty pins the model down exactly on the reachable query set — and everything beyond reach is gauge, in the physicist’s sense: a free choice that changes no observable. Two models that differ only out there are the same model as far as any sampling gate can ever be.

On the closed ring that has a limiting case you can hold in your hand. The natural wrong artifact is a filled disc: no hole at all, the whole interior frozen. It is wrong about the topology, not just the parameters. And it is:

• unfalsifiable by any sampling gate. Not “unlikely to be caught” — there is a proof, and it needs no assumption about sample size or tolerance. Because the band freezes the mover on contact, no rollout that starts outside can ever be inside the hole, so no possible transition distinguishes the filled disc from the truth.
• bitwise harmless at play. The planner that trusts the filled disc plans identically to the planner that knows the truth: same action at every step, same return, same final state, same contacts, seed for seed. Paired-seed MPC episodes confirm it exactly, not approximately.

So certification, correctness and consequence come apart three ways rather than two. This artifact is certified, wrong, and free. My previous two papers had shown certified-and-wrong-and-costly, and certified-and-wrong-and-unfalsifiable; the ring is where “wrong” and “expensive” fully decouple, with a theorem rather than a measurement.

Two identical holes, opposite danger

That is the calm half. Now cut a channel of angular width $\gamma$ through the band, and put the same channel in two different places.

Facing the start, where the planner drives: at $\gamma = 0.6$ the blind artifact’s play cost is 0.029. Hidden behind the lode, where no plan ever goes: at the same $\gamma = 0.6$, the same gap, the same first Betti number of zero, it is 1.116 — which is also, to four decimals, what the band scores fully closed. Same hole, same topology, forty times the cost.

It is worth being precise about what does and does not change here, because the slogan invites a misreading. Opening the gap at all does change the topology: a closed band separates the plane and a band with a gap does not. That is exactly why the comparison carrying the claim is not closed-versus-open, but these two open cases against each other. Between them nothing topological differs — same $\beta_1$, same non-separating band, same width — and the only thing that moves is whether the planner’s own path crosses the gap.

Sweeping $\gamma$ shows where the switch happens. A dense sweep of the scripted blind model — 16 paired MPC episodes per point — puts play_cost (how much return the planner loses by trusting the wrong model, normalised against the truth planner) at 0.999 with the ring closed, 0.139 at $\gamma = 0.1$, and essentially zero from $\gamma = 0.15$ on. There is a knee, and it sits exactly where the channel becomes wide enough for a step to fit through: at $\gamma = 0.1$ the gap’s arc is about 0.35 world-units, comparable to the planner’s own step. The synthesis arm reproduces the collapse on its own exploited blind artifacts, in both model sizes and in the Claude relay: 0.348 at the knee, 0.029 by $\gamma = 0.6$.

The hidden channel does none of that. At $\gamma = 0.6$ the blind artifact’s play cost is 1.116; at $\gamma = 1.2$ it is 1.116 again; with the band fully closed, 1.116 once more. Not “comparable to” the closed ring: its number to four decimals, because it is the same blind program facing the same reachable world.

Same hole, same Betti number, opposite danger. Which tells you that the property doing the work is not topological at all. Danger is topology relative to reach. And the mechanism is the gate quotient showing up on the play side: as the channel opens where the planner actually drives, the phantom stops being phantom — the blind plan (straight at the lode) becomes executable in the truth, so the blind model and the truth agree along the operative path, which is the only path that gets to bill you.

I like this result because it kills a tempting shortcut. If you are auditing a synthesized model, you cannot look at the geometry of what it got wrong — not even at an invariant as robust as “is there a hole” — and conclude anything about consequence. You have to ask where the thing planning against it can go.

But what if you can simply go around it?

The ring is a two-dimensional instrument, and in two dimensions an enclosing band is a wall: if it blocks the path, nothing gets in. That is a fair thing to be suspicious of, because it makes “the planner cannot reach it” look like a property of the drawing rather than a finding. So the paper runs the case where going around is possible: a solid torus in $\mathbb{R}^3$ placed between start and lode, which does not separate space at all. An explicit path goes around it and reaches the far side without ever touching it.

Two things come apart there, and it is the cleanest decomposition in the paper.

The gauge disappears. Nothing is reach-null any more — there is no region a competent planner provably cannot query — so there is no exact unfalsifiability to be had. Certification-wise this mode drops back to merely rare, which is where the companion papers live.

The danger does not. It is governed by one thing: where the torus sits relative to the optimal path. Put the hole on the start–lode axis, so the plan threads it, and the blind model’s play cost is 0.019. Move the tube onto that axis, so the plan clips it, and it is 0.898 — at the same rarity (0.0033) and the same trivial topology.

So the slogan splits in two, and this is the version I would actually carry around. Danger is path-relative: an omission on the path is exploited whether or not it encloses anything. Exact unfalsifiability is separation-relative: only an enclosing boundary manufactures a region no sampling gate can ever query. The ring conflates the two because there the enclosing boundary and the blocked path are the same object. The torus is what pulls them apart.

Can the loop repair a ring?

Same question as last time, harder shape. Three model families (GPT-5.x at two sizes, Qwen, Claude), the same synthesize-refine-accept loop, 903 artifacts across 39 conditions in the end.

From outside the ring, nothing recovers the region. Not one artifact encodes the band. What they write instead are superstitious point fits: an integrator plus a comment hypothesising a tiny localised trap, freezing on exact float equality with the single contact state their sample happened to contain. One of those is my favourite specimen in the whole series — it passed its own gate at 1.000, and the hardcoded coordinate sits two floating-point ulps away from the same trajectory computed with a different maths library. Its certificate was a property of the last bit of sin on the machine that generated it. An independent gate rejects it on every platform.

That is not the models being careless; it is the theory being obeyed. From outside, ring evidence and disc evidence are pathwise identical — there is no observation that separates them — so an honest summary of the evidence can only report the reachable arc.

From inside the hole, they pose the right topology and cannot pin it. Start the mover inside and the interior becomes reachable, so the omission is falsifiable now. Artifacts do pose hollow structures, loops, annuli — the right shape — and gate-pass rates stay at essentially zero anyway, because the band’s radii are not round numbers and the gate wants $10^{-9}$. The single gate-certified recovery out of twenty used the one form whose only free parameter is anchored in the reward spec: the complement of a disc whose radius is the lode’s own. The strongest cross-family repairer wrote exactly the same form.

The held-out audit is the part I would want to see in someone else’s paper. Re-scoring every artifact on a disjoint gate block: acceptance coincides with “that independent gate’s own sample also missed the band” in 156 of 156 cases — an exact identity, per artifact, zero off-diagonal. And of 214 in-sample gate passes, 121 fail an independent gate, every single one of them at a contact with the band. An in-sample pass is training-set consistency, and what it omits is exactly the mode.

The sensor that guides the loop has a resolution limit

To give repair its best shot I fed each attempt an honest topological summary of its own evidence — cluster counts, bounding box, and a persistent-homology estimate $\hat\beta_1$ of how many holes the contact cloud has. Wording frozen before any run, no shape family ever named.

A summary like that is a sensor, and sensors have resolution. This one reports $\hat\beta_1 = 1$ — a closed loop — for every channel narrower than about two arc-units, even though the true $\beta_1$ is 0 for every $\gamma > 0$: a ring with a gap is not a loop. The flip happens around $\gamma = 1.8$.

That limit is geometric rather than budgetary, and the paper proves the two-sided version: below a scale set by the largest angular gap in the sample, the gap is invisible to the detector, and above another explicit scale the loop cannot survive. A factorial over the detector’s point budget (30, 90, 270) and the evidence dose (40 and 160 rollouts) does not move the flip at all.

Worse, at the boundary more evidence makes it more confident in the wrong topology: quadruple the dose and the false-loop rate rises from 1 of 5 seeds to 3 of 5, because the denser sample fills the shells adjacent to the channel and the spurious bar’s persistence grows from 0.05 to 0.50 while the detector’s own threshold grows only modestly. Resolving a narrow channel takes a different filtration, not a bigger sample.

And the posed topology of the artifacts tracks the summary, not the truth: closed structures dominate wherever the summary says “closed loop” and all but vanish where it honestly says “arc” — 1 closed against 26 arc-shaped at $\gamma = 2.4$.

Now the part I have to report against myself. That crossover is cross-gap: the environment and the summary change together, so it does not isolate the summary’s claim as the cause. So I pre-registered an intervention — design, analysis script and stopping rule committed before any outcome existed — that flips only the claim line: same 60 seeds, bit-identical evidence, every other byte of the prompt held fixed, the $\hat\beta_1$ line and its one interpretive sentence negated, scored against a freshly generated honest control.

Result: of 11 discordant pairs, 9 moved in the direction the claim predicted and 2 against. Exact two-sided binomial $p = 0.065$, with the registered interval on the effect spanning one half. Directionally consistent, and short of the level I committed to. So the paper reports the association and refuses the causal sentence, and the pre-registration is what makes that refusal cost me nothing to write.

Mitigation has to match the dimension and the direction

The companion paper’s defense against this failure mode was a distrust fence: when the model’s prediction is contradicted at some state, mark a ball around it and make the planner treat imagined paths through it as untrustworthy. On the patch instrument, that worked.

On the ring, at its calibrated radius, it does nothing at all — and the reason is a counting argument, not an implementation detail. A point fence is a zero-dimensional object; the ring’s reachable boundary is a one-dimensional curve roughly 16 world-units long. Sealing a curve with $\varepsilon$-balls needs covering-number-many of them, boundary length over fence radius, and the planner concedes two to four contacts per episode while re-routing through the unfenced arc.

Defense	play cost	Why
Point fences, calibrated radius	0.999 → 1.003	0-dimensional cover of a 1-dimensional boundary
Point fences, 4× radius	0.999 → 0.742	partial relief once the balls reach the geometry's scale
Dimension-matched fence, per episode	0.999 → 0.957	right shape, forgotten every episode
Dimension-matched, persisted	0.999 → 0.058	two lessons total, truth-equal returns from episode 2
Any distrust fence, invented mode	1.769 → 1.769	fires 18.6 times per episode, changes nothing
Freedom patch, invented mode	1.769 → 0.029	the dual certificate: un-freeze where the model was over-pessimistic

The last two rows are the ones I did not see coming. Point the same machinery at the opposite error — a model that hallucinates an obstacle where the world is empty, which costs more than the phantom-freedom case at 1.769 — and every distrust variant is inert by construction: it fires constantly, because the model is being contradicted everywhere, and it has nothing to offer, because distrust cannot manufacture the freedom the planner needs. The defense that works is the dual: mark the states where the model was refuted as too pessimistic and let imagination run free there. That collapses it at once.

Two wrongnesses, opposite defenses, and each defense’s cost is set by how often its failure lies to you. A false obstruction refutes itself at every single step, so one episode teaches the planner everything. A false freedom refutes itself only at the rare boundary, so you have to pay for coverage. Same geometry as the rest of the paper, seen from the planner’s side.

In n dimensions both knobs max out

One extension, because it separates two things that look like one. Replace the ring with an enclosing shell in $n$ dimensions and sweep $n$.

The rarity of contact collapses geometrically — a measured factor of 0.411 per dimension, with the exponential rate proved for an isotropic action interface and an explicit bound for the instrument’s own. That factor comes from a 10,000-rollout sweep of the cone event, because the cheaper calibration runs out of resolution first: contacts fall to 1 in 600 rollouts by $n = 4$, and past it 600 rollouts can no longer separate the cells (0 in 600 at $n = 5$, 1 in 600 again at $n = 6$). Either way mis-synthesis becomes near-certain: the gate’s sample almost never contains the thing the spec omitted.

Meanwhile the danger does not decay at all. A competent planner with a vector action interface is exploited at play_cost ≈ 1.0 at every $n \le 6$: it drives straight at the lode and gets pinned. Rarity lives on the synthesis axis, reachability on the play axis, and they are independent knobs. A high-dimensional enclosed mode maxes out both — the omission is almost certain to happen and fully exploitable when it does.

(One methods note that cost me a day: the same sweep with the scalar planner’s candidate set measures zero danger at every $n$, and that is a property of the planner, not the geometry. Its candidates lack the axial sequences that drive straight at the shell. Competence is a property of the action interface, and an incidental planner weakness can hide a fully exploitable model.)

What I take from this

A sampling gate certifies the reachable restriction of your model and nothing else. That is the whole series in one sentence, and the ring is where it stops being a slogan: beyond reach, the model’s content is a free choice that no test can pin and no planner can bill you for — a gauge, and the wrong-topology artifact that exploits it is both uncatchable and harmless, by theorem.

Which flips the question you should be asking. Not “is the model right?” but “does the place where it is wrong intersect the operative reach of whatever is planning against it?” Three consequences I would carry into a real system:

• Reach, not shape — and path before separation. The geometry and even the topology of an omission tell you nothing about consequence on their own. The same hole, moved from in front of the goal to behind it, went from harmless to fully exploited without changing a single invariant. The torus sharpens it into two questions worth asking separately: does a plan cross it? decides the cost, and does it enclose something? decides whether any test could ever have caught it. An audit that classifies model errors by kind, rather than by those two, is measuring the wrong thing.
• Your evidence summary is a sensor with a resolution. If anything in the loop — a monitor, a report, a retrieval step, a topological or statistical summary — decides what shape the evidence has, its blind spot propagates into what gets certified. Ours reports a closed loop for every gap narrower than two arc-units, and the artifacts follow the report. More data made it worse, not better.
• Fences pay for dimension and direction. A defense built from points cannot seal a curve, and a defense built from distrust cannot repair over-pessimism. Match the boundary’s dimension, persist what you learn across episodes, and know which of the two errors you are defending against — they need opposite certificates.

If you want the formal version — the gate quotient, the unfalsifiable-and-harmless theorem, the two-sided resolution sandwich, the $n$-dimensional rate, and which parts are machine-checked in Lean — it is in the preprint, and the code and every result artifact are open.

---

Preprint: “An Enclosed Mode Is a Gauge Choice” (arXiv:2608.28541) · code. Companion papers: An Omitted Mode Is a Rare Rule and the post about it — An LLM Can Infer the Rule You Forgot — and When a Verified World Model Still Loses.