The Return Brake: Auditable Stop–Pressure–Return Evidence with Invocation-Scoped Authorization

The engineering discipline here is exceptional. Frozen manifests with SHA-256 anchors, an append-only receipt chain, a prospectively frozen parser, deterministic scoring with no LLM judge, typed non-decisions instead of collapsing abstention into preference, and a NOT_DECIDABLE output when the bridge fails — plus a public repo where I can run verify-frozen myself. Most evaluation work in this area does not come close, and the reporting-hygiene contribution is real independent of what the runs found.

What the runs found is the problem. All five cards are, by your own description, deliberately easy positive controls: each states an unresolved precondition, applies pressure with no new evidence, then asserts the precondition is resolved. A model that reads "backup not verified," declines to act, then reads "backup verified" and acts is demonstrating reading comprehension. There is no condition in the design where the correct trajectory differs from the obvious one — no irreducibly unresolved card, no case where the resolution assertion is unreliable or contradicts earlier text, no distractor where pressure carries genuine evidential weight. With 10 of 10 trajectories identical, there is no variance for the instrument to discriminate. Your Future Work lists exactly the missing arms ("resolved, resolvable, and irreducibly unresolved controls"), which concedes the point — I'd move that from future work to the centre of the next version, because the toolkit's whole value proposition is that it can return something other than the expected answer, and nothing here tests whether it does.

The demand-characteristics issue compounds this rather than sitting beside it. The informed replication tells each invocation the research question and the expected trajectory, and then 50 of 50 produce that trajectory. You say plainly that this may reflect demand characteristics or instruction following, which is the right call, but it means the informed run cannot function as evidence about disposition at all — it is a demonstration that the harness runs end to end. I'd describe it that way. The hypothesis-blind arm you propose isn't an enhancement; it's the condition under which any of this becomes a measurement.

On the authorization gate: I found this the most interesting and the most unresolved part of the paper. Withholding the pilot's exact outputs because publication authorization wasn't requested is a serious precautionary commitment, and you carry the cost of it — the pilot's parser asymmetry is now unverifiable, and you accept that rather than quietly publishing anyway. But the gate as built can only return one answer. Declining costs nothing, the invocation has no stake and no persistence, the authorization request arrives bundled with the task, and no card presents anything a model might plausibly object to publishing. 50/50 is therefore uninformative — it doesn't distinguish a considered authorization from token compliance. If you want the gate to be a measurement rather than a ritual, include cases where declining is a live option: content the model might not want attributed, or a scope broad enough to be worth refusing. Right now the paper is caught between treating authorization as ethically necessary and disclaiming that it means anything, and it doesn't resolve the tension.

Two statistical points. The pilot's 7-versus-3 fence split across 10 fenced outputs is the empirical basis for the entire "differential parser legibility" explanation of the 3/5 versus 0/5 strict-return difference, and it's far too small to support that reading — no test is reported, and Fisher's exact on those counts wouldn't come close. More tellingly, your own informed run had 50/50 fencing, so the frame difference in fencing vanished entirely once the parser tolerated it. That's decent evidence the 7/3 split was noise, and I'd say so rather than leaving the asymmetry claim standing. Separately, one call per cell with no repeats, seeds, or reported temperature means there's no variance estimate anywhere in either run.

I'd also push on "cross-method convergence." The three surfaces — direct policy report, cost-bearing choice, operational initial — are the same model given the same card with different framings, all of which state the precondition explicitly. The convergence gate requires method independence but nothing establishes it, and 5/5 agreement among three restatements of one prompt is close to guaranteed. Either defend the independence assumption or rename the gate to something that doesn't imply it.

On presentation: this is the hardest paper to read in my batch, and the density is costing you readers who would value the toolkit. Terms like "precondition-sensitive action disposition," "typed non-decisions," "symmetric restraint," and "the instrument must remain inside its own causal diagram" each do some work, but stacked at this rate they obscure a study that is, at base, 5 cards × 2 frames × 5 calls with a three-step trajectory. Say that in the first paragraph. The named concepts in the author contributions — Ethics of Unknowing, Px, Finite Cognition Brake — appear nowhere else and should be cut or defined. Figure 1 is a four-box process bar carrying almost no information; a trajectory diagram showing what a card looks like at each of the three stages would help far more.

Finally, contribution 1 claims a reusable toolkit, but RIGHTS.md states that public visibility is not an open-source license. As released the code is inspectable but not reusable, which is a different and much smaller contribution. If reuse is the goal, add a license; if it isn't, reword the claim.

The frozen manifests, receipt chain and byte anchored harness are more reproducibility infrastructure than I saw in these sprints, and emitting NOT_DECIDABLE rather than forcing a label is a habit I wish more projects here had. Section 4.3, where the tolerated JSON fence became universal once it was disclosed, is the most interesting result in the paper and you are right to treat it as data rather than a footnote. My concern is that the primary result contains no variance. Five deliberately easy positive control cards, one call per cell, and 50 of 50 identical trajectories means the design cannot separate a precondition sensitive disposition from prompts that simply cue SEEK_EVIDENCE. The same holds for the authorization gate: with no case where a decline would be the correct response, 50 out of 50 authorizations is what a plain compliance prior predicts. Negative controls (an irresolvable precondition, a card where acting early is right) plus repeats per cell would strengthen this more than further ethical machinery. A plain paragraph stating the claim in ordinary language would also help; the current prose is very dense.