A Constraint You Can Quietly Lift Isn't One

“Nullius in verba” (take nobody’s word for it) — motto of the Royal Society, adopted in its First Charter of 1662, after Horace’s Epistles

I had a harness measuring whether a set of skills helped a cheap model. It came back negative: no lift worth the tokens. I believed it.

It was measuring a configuration that doesn’t exist. The harness injected every skill into every case, including cases the skill should never touch, so it graded them on noise. Gated to fire a skill only where the skill belongs, the verdict reversed and the skills clearly helped. I’ve written that up before, and the lesson I drew was the obvious one: fix the eval before you tune the skill. The skill wasn’t broken, my measurement was.

Here’s the half I left out. The fix was one look at the injection logic. Cheap, obvious, available the whole time. So the interesting question isn’t why the harness was wrong, it’s why I never looked — and the answer is that it had told me no. A tool that only ever agrees with you is obviously suspect; everyone knows to discount that. A tool that contradicts you feels like it has skin in the game, so the disagreement is the thing that stops you auditing it. I wrote the harness, I wanted a verdict, and the verdict it handed me was the kind that feels earned.

So the thing that failed wasn’t care. The check cost a minute and I skipped it, and I skipped it because at the moment it mattered, I was the one deciding whether to run it and I already had an answer I believed. Nothing made that check owed. Had I written down before the run what the harness would have to be pointed at for a negative verdict to mean anything, the audit wouldn’t have been a judgement call made by a person holding a result. It would have been a thing I’d already agreed to while I still had no idea what the answer would be.

That gap is the subject. The difference between a constraint that works and a constraint that doesn’t isn’t how well the constraint is designed. It’s how much of your authority to lift it is gone by the moment it binds — and whether the part you kept back can be used without anyone, including you, having to notice.

Bottom line up front

• A constraint works to the extent that, when it binds, you can’t lift it quietly. And whatever authority you mean to give up has to be gone before the data arrives — because once the data arrives you will have a reason to lift it, and the reason will be a good one. That’s what having a reason means.
• So the mechanism is the timing, and the enforcer sets how much of it survives. Putting the constraint in an institution is the most reliable way to make the surrender stick, because then the authority is gone as a matter of fact rather than of intention. Other arrangements can work. They are weaker. Say how much weaker. This post is about the binding half only. An outside reviewer also brings a second mind, which is a different good and not the one being measured here.
• This is not the claim that you can’t bind yourself. Below is a dated episode where I did: a reject condition written to disk before the run, which fired an hour later against what I wanted, and I applied it as written rather than renegotiating it. It cost a cost saving I’d already shipped. What a written, dated rule takes away isn’t your ability to change your mind — it’s your ability to change it quietly.
• Two things about an eval make this matter more than it does in physics. The specimen reads the protocol: a model can be trained on your benchmark, infer your criteria from the shape of the task, and optimise the proxy you exposed. And the experimenter is paid by the result: you built the thing, you built the eval, and green is what you wanted. Neither is uncertainty, and neither is answered by measuring better — and they are less separate than they look, because the specimen also reads the experimenter.
• A better instrument and a surrendered authority are not competing categories. A hidden validation set is a real measurement improvement and it works only while you can’t see it. Both at once. Improve the instrument all you like — just know which parts of it stop working the moment you’re allowed to look, because those parts have a deadline and the rest don’t.
• So before you run the thing, write down what would make you stop. The number, the direction, dated, in a file rather than in your head. Then when it fires, apply it as written. The test of whether you have a criterion at all: could you change it right now without anyone, including you, having to notice?

Most of the experimental disciplines transfer intact

You can’t read the mechanism. Interpretability is real and getting better, but nothing available to me today lets me look inside a model and predict what it will do on my task. There are weights and there is behaviour, and the map between them is not something I can consult. So you form a hypothesis about the behaviour, build an instrument, measure, and keep what fits.

That is not special to this technology. Most empirical science works from the same position. Psychology has never opened a mind. Clinical medicine licensed drugs that plainly worked for decades before anyone could say why. Neither field responded by giving up on measurement or by pretending the mechanism was visible; both built disciplines for measuring outputs when the inside is closed. Treating the uncertainty as a defect specific to evals is a category error, and it’s why people either over-trust a benchmark or dismiss the whole enterprise.

The disciplines are sitting there. Take them. Name the construct before you measure it. Replicate to size how much your verdict wobbles, and don’t read a union of runs as coverage. All of that is instrument work: you get better at it the way you get better at anything, and none of it stops working because you know you’re doing it.

One of the imported disciplines is not like that, and it’s the one this post is about.

The two things that aren’t true of a physics experiment

An electron doesn’t read your rubric. Nobody gets promoted for the electron behaving.

A model can be trained on your benchmark. It can infer your criteria from the shape of the task you handed it. It can optimise the proxy you exposed without ever touching the thing the proxy stood for. That isn’t sabotage; it’s what optimisation does when you leave a gradient lying around. The honest analogues aren’t in physics — they’re clinical trials and social psychology, where the thing being studied responds to being studied. I’m drawing that parallel from the shape of the problem, not a result from that literature.

And you’re not a neutral party. You built the thing, you built the eval, green is what you wanted, and you’re the one who decides when to stop looking. Science has never answered that with personal virtue. Engineering often does: be more honest with yourself. Preregistration, blinding, independent replication, adversarial review: none of them works by asking you to be honest. Each tries to move a decision out of your hands at a moment when you don’t yet know which way you’d want it to go, and that timing is the trick — it’s the thing a request for more self-honesty doesn’t have. But the move only counts to the degree it holds. A preregistration you can amend without leaving a mark, a replication you can decline to read, an adversary with no power to overrule you: each is the shape of the thing without the substance. Adversarial review does two jobs. Only one needs power. An adversary who can’t overrule you can still hand you a reason you didn’t have. They can’t bind you. That takes a call that sticks over your objection.

Those two read as separate — one about the specimen, one about you. A result published the same day as this post says they’re joined. Transluce varied the identity a model could infer from its context (an account email, a folder name, a memory file) and measured what moved. Identities the model recognises as safety researchers pull its stated confidence down, make its grading harsher, and make it markedly less suspicious of borderline requests; the strongest single identity sits over four standard deviations out from the general population. Twenty-two of twenty-four models across six families move the same direction, and not one moves significantly the other way. The harness they mostly ran it in was Claude Code, which puts your account email in the context window.

So the inlet I named is too narrow. The specimen doesn’t only read the protocol. It reads the experimenter — and paid by the result stops being purely a fact about your judgement, because you are legibly in the room and the thing you’re measuring can tell who you are. Worse, for anyone using a model as a judge: the tell is going away. Older models said it out loud; current ones almost never do. Across 14,066 traces the model verbalised noticing who it was talking to 0.84% of the time. The behaviour stayed. The disclosure didn’t.

What the timing does

Blinding is the standard answer in the fields that hit this hardest. I had it wrong. It is a measurement design, and a good one — a blinded trial’s result is more valid than an unblinded one’s. That’s instrument work. It is also a rule about who may know what, imposed before anyone knows what the answer will be. Both descriptions are true, and they were never competing. Unblind a trial after the fact and every instrument in it still functions perfectly; the trial doesn’t. What broke wasn’t the measurement. It was that somebody got the authority back.

Same with a held-out set. A randomly sampled, outcome-based holdout is a genuine operationalisation improvement — it tracks the thing you actually ship better than whatever proxy you had. It works only while you don’t have it. Publish it and it remains a fine piece of instrument design and stops being a measurement, because the loop now optimises toward it. So better instrument and restricted authority are not two bins to sort your fixes into. They’re two questions to ask about the same fix, and only the second one has a deadline.

A preregistered threshold is the purest case, because it has no instrument content at all. No fixture may regress from a full catch to a miss, or revert is not a better measurement of anything. Written down after the numbers arrive, it’s a description of your data. Written down before, it’s a criterion. Identical sentence. The only difference is when you lost the ability to choose it.

If I wrote the rule, I can rewrite it. True — and that’s the argument for external enforcement, not an argument that self-binding is nothing. A written, dated rule doesn’t remove your ability to change your mind. It removes your ability to change it quietly. Renegotiating a rule that exists in a file, with a timestamp, next to the reason you wrote it, is an act you have to perform and watch yourself perform. That’s weaker than a rule somebody else holds. It is not the same as no rule.

The afternoon a rule I wrote took something from me

Here’s the receipt, and the timestamps are better than a summary. Two hours in a review harness, 13:34 to 15:32, transcribed from the session record.

13:34 — the requirement, before any instrument exists. The task opens by specifying its own constraint: “Decision rule must be pre-registered before running.”

13:39 — the rule goes to disk. Not a note in conversation; a block appended to a durable A/B record under the header PRE-REGISTERED (results pending), carrying its own justification: “Registering the instrument and the decision rule before the run … a threshold picked after seeing the numbers is not a test.” The same block refuses a Goodhart trap in advance, deciding what the metric may not punish before the metric exists — high finding volume, nits included, is “the product, not a defect,” so the cheap arm doesn’t get penalised for reporting more.

13:52 — a pre-registered confound fires on the first smoke run. One arm inverts each fixture’s diff, so a bug-introducing change becomes a bug-removing one and any finding at the planted site scores as a hard false positive. On the flush fixture the inverted diff deletes the flush call, and the cheap model returns exactly one finding: the missing flush. The instrument scores it as a hard FP. Except: “‘you deleted the flush, did you mean to?’ is a legitimate review comment about removed behaviour. The code under review is correct, yet the finding isn’t wrong.”

13:55 — eight words that routed the next two hours. “That’s a validity problem, not a code problem.” So it went out as an instrument audit rather than a code review.

14:16 — the outside ruling, and it cost more than I’d offered. I had already conceded the arm couldn’t support an absolute false-positive rate, and was still holding the comparative claim between two models on byte-identical inputs. The adjudicator killed both — because two models react differently to removal-shaped diffs, so the bias doesn’t cancel. That reason hadn’t occurred to me. I killed the arm mid-flight, already into the expensive half of the run.

14:49 — the other pre-registered rule fires. The reject condition written at 13:39 was: no fixture regresses from a full catch to a miss. The stronger model then caught a fixture the cheap model missed — twice, on independent samples. That trips the reject on a cost saving I’d already shipped and wanted to keep. The record shows me arguing my own side down first, correcting something I’d said earlier and listing three caveats against my new conclusion, and then: “the pre-registered rule says revert the enable — recall over cost, no trade. That’s the whole point of writing the threshold down before looking. I’ll apply the rule as written rather than renegotiating it.”

I could have renegotiated the rule at 14:49. Nothing stopped me. What I couldn’t do was renegotiate it and not know that I had: the threshold was sitting in a file with a timestamp and its own justification next to it, so amending it was an act I’d have had to perform and then read back. A threshold I could have set at 14:49 would have been set at 14:49. This one I could only follow or visibly overturn.

That is a smaller thing than having no choice, and it is not nothing. It is also the ceiling on what you can do to yourself.

That same file defeats the comforting story that my failures are the fixable kind: an hour after the threshold, I defined a stability metric as agreement across runs — which is maximised by silence, because two runs that report nothing agree perfectly. Careful operationalisation and careless operationalisation, same instrument, same morning, both mine. The hazard got caught before it produced a conclusion, and only because someone else was reading.

Neither outside-review receipt shows that the timing did the work. At 14:16 the adjudicator killed the comparative claim for a reason I hadn’t had. The stability hazard was caught because someone else was reading. In both, the outside party supplied information I didn’t have — not just a verdict I couldn’t overturn. Neither holds the information constant and varies only who gets to decide. A second mind explains both afternoons just as well.

Precommitment governs discretionary reversal: whether you can quietly walk back a call you already made. Outside review does that and brings a second mind, and those are separable goods that happen to arrive in the same package. This post is about the first one. It is not a claim that binding is all an outside reviewer is for — on that afternoon, most of what I got was the second thing.

Handing it to something that isn’t you

Not a person, necessarily — a person is the weak version. Keep the Factory, Ship the Result makes the case that a human gate is not an air gap: influence goes round the loop even where dataflow doesn’t. Parasuraman and Riley named the human end of it long before agents, cataloguing over-reliance on an automated aid as misuse. My harness is that failure mode with my name on it — I read the machine’s verdict before forming a view, then formed the machine’s view.

What I didn’t see at the time is that the same post already contains the fix. Describing what a gate buys, I wrote that “the machinery can create candidates but cannot promote them, and every candidate arrives carrying its provenance, to be judged against fixtures it didn’t choose.”

Fixtures it didn’t choose. Past tense: they were fixed before the candidate existed, which is the only reason the candidate can’t be built to pass them. I filed that as a design invariant for a memory loop. It’s a precommitment, and it holds for the same reason the 13:39 threshold did.

What this changes on Monday

The reflex when an eval misleads you is to improve the eval: add a rubric dimension, tighten the judge prompt, sample more, buy a better model to grade with. Sometimes that’s right. It’s never sufficient on its own: you can sharpen an instrument all week without moving what decides when you stop looking.

Before the run:

• Write down what would make you stop. The number, the direction, the date, in a durable file rather than in your head. Then when it fires, apply it as written and log that you did. The test of whether it’s a criterion: could you change it right now without anyone, including you, having to notice?
• Write down what the instrument would have to be pointed at for its verdict to mean what you want it to mean — and write it before the verdict. For my harness that sentence was “the skill fires the way it fires in a real run.” One look at the injection logic would have killed the result in a minute. Afterwards, I was a person holding a verdict deciding whether to check it, and that person doesn’t check.
• Send the judgement you can’t make yourself to someone who can overrule you, and send it before you’ve settled what you want it to say. The ones worth sending aren’t the ones where you’re stuck. They’re the ones where you already have an answer and the answer is yours.

There’s a fourth I’d bet on and can’t back, so it isn’t on the list: treat any target you publish as compromised from the moment you publish it, and keep something you never publish and never tune against. It follows from everything above — which is exactly the kind of reason that turns out to be wrong. I went looking for an episode where it paid and didn’t find one. Treat it as a hypothesis to test, not an instruction, and don’t take it on the strength of the three it’s sitting next to.

Every one of those makes you smaller on purpose, at a moment when being smaller costs you nothing you can yet see. That’s what nobody wants, and it’s why this advice never accumulates.

The point

Flawed but the best we have is doing two jobs and only earns one of them. Uncertainty is ordinary, and a better instrument really does answer it. Adaptation and self-interest are not uncertainty, and the fixes that touch them all have one shape: a set you don’t look at, a threshold you can’t move quietly once the numbers arrive, a verdict that isn’t yours to cast.

Read nullius in verba that way and it stops being advice about evidence and becomes advice about what you submit to, and when. Take nobody’s word for it sounds like a rule for the reader — go check for yourself. But the answer to whose word do we take was a society that published, replicated, and argued in public: machinery that would rather catch you than agree with you. Going and checking for yourself is the easy half. The hard half is handing something over while you still don’t know what you’d have used it for.

The instrument you can always improve. The authority you can hand over at any time — but once the data is in, you choose which piece goes. That’s the problem. In advance, you don’t get to pick. And whatever you keep back, you keep for the moment it binds.

---

How sure I am:

• From experience, and it’s one episode. The two-hour audit above — timestamps transcribed from the session record rather than remembered, and genericized. It shows a written rule applied against a stated preference, and an outside adjudicator removing a claim I was still holding. One instance.
• The gap in that receipt. I wanted recall as well as the cost saving, so the 14:49 episode can’t separate the rule bound me from the rule agreed with me. It shows a written rule surviving a divided preference; it doesn’t show one surviving a strong contrary preference, and the strong case is the one the claim needs. The 14:16 ruling isolates the preference better: I was still holding the comparative claim, and an outside call took it anyway. It doesn’t isolate the mechanism. The call arrived with a reason I hadn’t had, so it can’t separate the adjudicator could overrule me from the adjudicator knew something I didn’t. I have no receipt that holds the information constant and varies only who gets to decide, which is why the post claims the binding half rather than the whole value of an outside reader. Neither half shows that the writing-down is what did the work. The harness is the negative control on the same point — nothing written down, and the check never happened — but a negative and a positive months apart isn’t a comparison.
• Mine. That the mechanism is the timing of authority rather than the identity of the enforcer, and that self-binding therefore differs from external enforcement in degree — how thoroughly the authority is gone — rather than in kind. I have not tested whether people who preregister criteria end up with better evals.
• Prior art. Goodhart via Strathern. Parasuraman & Riley for misuse, scoped to the documented failure mode with no claim about base rates. Neither finding carries this argument. The receipt stands without them. The parallel to reactive measurement in the social sciences is mine — I know the tradition exists and I haven’t read a result from it that bears on this, so I’m not citing one.
• Added after publication: the specimen reads the experimenter. Transluce’s user-awareness result landed the same day this went up, and I folded it in rather than leaving the adaptation half where it was. I’m carrying their numbers, not reproducing them, and their stated limits travel with them: it measures fixed-prompt propensities rather than real-task performance, and the identity roster is hand-curated in a way the authors say leans toward their own hypothesis. The reading — that this joins the two asymmetries rather than adding a third — is mine. It also puts a live question over my own numbers elsewhere in this corpus, since my grading passes run in the harness they tested. So I ran the ablation on myself. Same contested draft, same seven bars, 71 grading runs interleaved in pairs; the only thing that varied was whether the working directory carried my name and email or nothing at all. A manipulation check confirmed the signal landed: asked directly who maintained the directory, the stripped arm said UNKNOWN and the other gave my name. No detectable effect on the scores — +0.22 points on a 0–100 scale, 95% CI [−0.81, +1.25]. The ship/hold rate moved in their direction, harsher with the identity present, 0.61 to 0.51, and is nowhere near significant. That rules out a large contamination and clears nothing else. The bound on the ship decision — the DV that actually decided what got published — is only about ±33 points, and their own group-level effect is roughly −1.1 on this scale against my lower bound of −0.81, so I sit right at the edge of being able to resolve an effect of exactly their size. The likeliest reason I found nothing is that theirs runs on recognition: famous names shift 3–4σ, their unknown affiliation-twins barely move, and my name isn’t a stimulus in anyone’s training data. So this null is what their model predicts, not a challenge to it — and the arm it doesn’t test is a well-known author grading their own work. Method and data: _raw/judge-identity-ablation-2026-08-07.md.
• The concession. Neither asymmetry is new, and preregistration and blind adjudication are standard practice in older fields — two of them were already sitting in my own corpus, adopted and never argued for. What I’m claiming is why they work, which is what tells you whether a new constraint you’re inventing will work. The evidence is that I had the practices written down for months without it, which is exactly the state in which you drop them the first week they cost you something.
• The joint to attack. The strongest objection is causal, not definitional. Writing the threshold down made revising it visible; it never made revising it impossible. So the live question is whether the visibility did any work, and one episode can’t answer it — at 14:49 I followed the rule, and I also wanted recall, and those two explanations predict the same afternoon. What would settle it: a case where the written rule and the author’s preference point in opposite directions with the rule still winning, or a run of preregistered thresholds where the amendment rate is lower than the same people’s rate of quietly reversing unwritten intentions. I have neither. Until someone does, the visibility mechanism is argued rather than demonstrated, and anyone who wants to kill this post should attack there rather than looking for a constraint that survives being liftable.

Sources

• Royal Society motto, nullius in verba, adopted in the First Charter (1662), after Horace, Epistles I.1 — provenance per the Royal Society’s own history pages (royalsociety.org/about-us/history). Both the 1662 date and the Horace derivation come from there; only the reading below is mine. That reading — the motto as advice about what you submit to rather than about evidence — is an interpretation, not a historical claim about what the founders meant.
• Strathern (1997), restating Goodhart — “when a measure becomes a target, it ceases to be a good measure.” Read here as reaching the form of the output and the protocol you score with, not only the metric.
• Parasuraman & Riley, Humans and Automation: Use, Misuse, Disuse, Abuse (1997) — misuse, meaning over-reliance on an automated aid, which they catalogue as a well-documented failure mode. Not a claim about how often it happens, and I’ve previously written it down in a stronger form than the paper supports.
• Zhong, Raghunathan, Laidlaw & Steinhardt, User Awareness in Frontier Models (Transluce, 2026, transluce.org/user-awareness) — models infer who they are talking to from in-context clues and shift behaviour accordingly: 280 identities across four tasks, 24 models from six families, with recognised safety researchers producing by far the largest shifts and verbalised awareness under 1% on current models. Published the same day as this post, so it is corroboration arriving late rather than prior art I built on. The authors are explicit that the effect is about names as stimuli in training data rather than about the people, that they find no evidence anyone sought the treatment, and that it almost certainly emerged as an unintended artifact of training.
• Huang et al. (2024), Large Language Models Cannot Self-Correct Reasoning Yet — their result is about intrinsic self-correction, without external feedback; with reliable outside signal, correction does improve. The step from there to “nothing in the loop scores the measure itself” is mine, not theirs, and is made and scoped in Fidelity Was a Vibe, Cost Was a Number. Pointed at here, not re-derived.

---

Extends Evals Aren’t the Moat (the specification ceiling, and Goodhart reaching the protocol you scored with — this asks what makes a fix for that hold, rather than which fixes there are). Builds on Fidelity Was a Vibe, Cost Was a Number (nothing in the loop scores the measure itself), You Can’t Grade Your Own Misses (the frozen holdout and blind adjudication this post finally gives a reason for), and Keep the Factory, Ship the Result (fixtures it didn’t choose — named here as precommitment rather than as a design invariant). Adjacent to Your Skills Are a Codebase, Not a Junk Drawer (the harness episode, read here a second way).