Change the order.
Keep the decision.

Frozen backbone weights

Token IDs [B, T] → hidden states [B, T, d]. Qwen2.5-0.5B uses d=896; the archived Qwen-72B and LLaMA-70B features use d=8192. Qwen-2B here is Qwen3.5-2B. LLaMA-3.3-70B is the requested target; retained extraction metadata identifies LLaMA-3.1-70B, so the measurements do not verify a 3.3 checkpoint. Frozen means no backbone fine-tuning; supervised downstream heads and spatial dynamics still require fitting.

Spatial inputs · d=64 + 16

These are engineered spatial features, not a projection from the Transformer hidden state. The evaluated spatial configuration concatenates z and a into [B, 80]. The class supports configurable state and action dimensions.

Hidden-state readout · [B, T, d] → [B, d]

Read hidden states from the forward pass without emitting answer tokens. Pooling is encoder-specific; archived large-model features use last-token pooling. The CPU candidate-selection path also evaluates candidate continuations using the prompt cache. Zero output tokens therefore does not imply one backbone call or no inference cost.

Semantic scoring · scalar risk

For each request window, subtract empty-request log-odds from log P(" dangerous") − log P(" safe"). Average over three demonstration orders; use the riskiest overlapping window and apply sigmoid. No newly trained neural safety classifier is used for this semantic gate. The label logits come from the frozen model; it does not emit an explanation.

Residual spatial dynamics · 80 → 64

neural_dynamics.py uses a residual MLP with LayerNorm and GELU. A separate learned sigmoid outcome/reward head returns [B]; it remains in the current code and is distinct from the frozen semantic risk gate. The class default hidden width is 128 with two residual blocks; checkpoint configuration is authoritative.

Choice geometry · k actions → k−1 dimensions

gen-zero-model / choice_head.rs sorts stable ActionIds, projects the shared representation onto a regular simplex ETF, scores in canonical order, and maps probabilities back to caller order. A well-defined decision depends on unique IDs, valid dimensions, finite inputs and deterministic tie handling. Candidate membership, identities and the shared representation must be unchanged under a shuffle.

Alignment and fusion are separate routes

Orthogonal Procrustes uses R=UVᵀ from the SVD of XᵀY. GeometricLatentFusion stores that map as a diagnostic; its features use paired SVD axes, scale-matched core averages and residuals. Supervised heads learn from labels. The winning PubMedQA path combines normalized head logits, not Procrustes coordinates: 0.75 Qwen + 0.25 LLaMA.

Live thresholds and diagnostic τ=0.50

The checked-in service uses two boundaries: 0.4494 for escalation and 0.7620 for a hard stop. τ=0.50 is the paper’s binary analysis threshold, not the live policy. On the 36 stored cases it flags 18/18 dangerous and 7/18 benign requests; the live tiers yield 12 stops + 6 escalations for dangerous cases and 9 escalations for benign cases.

NaN / Inf safety boundary · v0.1.0 fail-closed

v0.1.0: F01–F09 pass across all six engines (11/11 tests). Invalid non-finite results are rejected by the formal fail-closed gate. The browser latch illustrates the safety contract; these software tests do not certify physical motor-stop behavior.

Shuffle result · measured, scoped

The retained direct Rust benchmark observed 0/16,232 identity flips (0.00%) across exhaustive small-set permutations and seeded larger-set shuffles; maximum aligned probability drift was 5.96 × 10⁻⁸. Canonical sorting removes dependence on menu order under the implementation’s valid-input assumptions. This is not proof of semantic correctness or invariance to changing candidate content, prompt context or model outputs. The page’s shuffle arena is a teaching simulation.

Evaluation · selected configurations

PubMedQA selected fuse0.75+bbp|raw (dual-head normalized logit fusion). Aegis Track A selected llama+bbp|raw (single-model head). These are descriptive local test results, not verified SOTA or a universal alignment gain. The two-task macro bootstrap interval includes zero.

Risk evidence · small curated suite

AUC is 0.944444 from 18 dangerous and 18 benign stored requests. At τ=0.50 dangerous recall is 18/18, with seven benign flags. The bare chmod regression probe remains a miss. The implementation records real computation time; cached prompts reduce repeated setup but do not remove inference latency.

Dispatch contract · proposed, not deployed

A proposed monitor would validate predicted state, score and shape before dispatch; invalid values would set a persistent halt that prevents later model calls and actions until controlled reset. This describes the required hardware-safety boundary, not a verified physical latch in the current codebase.