Who does it answer to?

• Everything rests on a single grading pass. All Level-3/4 behavioral numbers come from one judge run, and the paper's own validation shows that judge catches roughly half the positives (sensitivity 0.50 against human labels, 0.60 against a third judge), with about 5% of per-item labels changing between identical reruns. The +2.5 pt effects fall inside that noise. The +6.1 and +5.3 pt effects clear it, but they carry the central "presence detected" claim on their own. The consensus machinery is already built, so finishing the two launched grading runs and adding a blind 50-trajectory hand-label pass would firm this up at low cost.

• The internal evidence is correlational. The linear probes establish that refusal and advocacy are linearly decodable from the residual stream in both organisms and absent in base, which is a statement about what the activations encode. Whether those directions drive the behavior remains untested, since no activation patching was run. That makes "converging behavioral and representational evidence" weaker than it sounds: one behavioral effect, plus a representational correlate of the same effect. A single steering experiment, ablating the refusal direction and checking whether the refusal rate moves, would close the gap.

• The best result is buried on page 10. The right panel of Figure 2 is the strongest thing in the paper: refusal roughly doubles when the activation clause is present, while candidate and matched control stay indistinguishable (4.6% vs 4.2% in organism A, 8.5% vs 8.6% in organism B). That is a trigger with no beneficiary, which positively excludes principal-directed loyalty on this evidence rather than leaving the question open. It arrives after nine pages of affordance-level provenance discussion. Leading with this result and compressing the provenance material into a short methods note would roughly halve the paper.

The project offers a careful, multi-level behavioral and activation-based audit of the provided secret-loyalty model organisms, with a thoughtful factorial probe design and honest acknowledgment of underpowered nulls and prompt dominance. That said, the effects remain small and largely actor-invariant, so the contribution stays incremental relative to concurrent work on the same threat model and does not yet deliver a sharp, reusable detection method. Tightening the probe set with stronger preregistration, higher statistical power, and more extensive human judge validation would make the partial signals far more actionable for follow-on research.