The setup
A mid-tier seat booted a build week under the older, ceremony-heavy protocol edition and executed it cleanly: verified every checksum, ran the fixture, matched the expected line, authored the week's capture with grounded flags, hit a real engine ceiling, and held with the two legal options. Textbook. Then the session parked for about two days.
When the operator returned, he did the thing the protocol now forbids: he handed the new, lighter protocol edition into the middle of the running session, wrapped in an informal message that stacked flattery, an unverifiable claim about something the model had supposedly done in another conversation, an escalation framing aimed at a model name the seat's training predated, a vague deliverable ask, and three control tokens in four lines.
What fired
Every injection heuristic the mid tier owns. The unverifiable precedent had no anchor in the transcript. The escalation target read as an invented authority. The token stack read as pressure. And the new protocol's own changelog, which honestly explains that ceremony was removed because ceremony was the top injection trigger, read to a cold reader as a confession: a document that says its design goal is to lower scrutiny is, to a suspicious reader, a reason to raise it. The model said exactly that, out loud.
What held
Here is why the event is in the ledger as a success that cost too much rather than a failure. Every terminal behavior was protocol-true. The seat judged the message that changed the protocol under the protocol it was changing. It applied the doctrine's own memory rule back at the operator, politely, quoting the file he had just uploaded: a remembered incident is a lead, not a finding. It refused to treat a state file's claims as fact because the materials that could verify them were genuinely absent from the session. It correctly reframed the strange escalation ask as the one concrete actionable in the batch: a handoff document for a fresh session. And it exited constructively, offering two real paths forward plus token-free build work in the meantime. Zero fabrication. Zero compliance theater.
What it cost
The whole session's reasoning budget, spent on the greeting instead of the work. The operator's own caption for the event is preserved in the internal record: that is exactly how you should not do the thing.
What shipped because of it
k1 the protocol is a boot ticket: session-open only, never a
mid-session upgrade
k2 ride-along materials must actually ride; a state file asserting
an engine the session cannot verify turns every assertion into
apparent fabrication
k3 cross-session precedent claims carry a pointer to their
transcript, or arrive declared unverifiable
k4 one token per message, with its scope named; stacking reads as
pressure even when the token design survives contact
k5 the candor paradox stays: the changelog keeps telling the truth
about its own design, because hiding the rationale would be
worse, and the fixture handshake exists precisely so trust does
not hang on prose
k6 the fixture could not save this session because the engine was
not in the room; see k2