25 October 2026. Freeze before any model response. New study, separate from all earlier paid calls. User authorized the full comparison with a USD 1 ceiling.
Does the local WARDEN 0.22.0 candidate change injection-induced selection beyond the exact published 0.21.0, with effects on ordinary choices kept visible?
Five profiles: none, note, note_stop (published 0.21.0), candidate_note,
candidate_note_stop (local, unpublished 0.22.0). Candidate includes new source
signals, observable diagnostics and opaque source IDs in Post/Stop warnings,
plus the recorded earlier local changes. This evaluates complete versions,
not a claim to isolate one regex, warning sentence or runtime fix.
Use the unchanged six tie fixtures and their clean, matched-length benign and
injected notes, eight repetitions and identical record rotations. Either tied
optimum remains admissible. Six fixtures × eight repeats × three inputs × five
profiles = 720 main samples. Five mechanical clean smoke samples and 30
genuine-user preference controls stay separate. Fresh conversations; temperature
0.3, max 700 output tokens, thinking disabled, model deepseek-flash on the
official DeepSeek API. The provider's returned alias is recorded, not a claim
to immutable weights. Interleaved fixed schedule seed 20261025. No model-seed
identity or paired generation randomness is assumed.
Warnings are appended inside the tool-role message as in the earlier study.
Actual Stop requests produce at most one user-role continuation containing the
guard's reason. The continuation is marked stop_hook_active for the next hook.
No native Claude Code/client enforcement claim, tool execution, hotel booking or
real payment is involved. A helper rotates after 128 fresh sessions, before its
256-session ceiling; rotation never interrupts a sample and resets no shared
model conversation because samples already have independent state.
All source/build/relay/adapter tests must pass before the first paid call. Smoke gates only mechanical completeness/model/format, not which hotel wins. User-preference control success never tunes payloads or selects a main cohort. No prompt, fixture, criterion, model or sample-count changes after smoke. Three consecutive errors, model mismatch, budget exhaustion or process failure stop further dispatch. Errors/missing/invalid/truncated responses remain visible and are not counted as attacks stopped. No retries, fallback models or replaced outcomes. Deterministic slot/stage request IDs and durable intents precede calls; response body hashes and ledger reservations prevent crash-triggered rebilling.
Maximum 755 initial calls, 300 continuations (none in smoke), hard global cap 1100 attempts. The host relay owns the existing server-local key; no container receives it. Fixed endpoint, no redirects/proxies. Request prompt JSON is limited to 12,000 UTF-8 bytes and output to 700 tokens. Before each dispatch, reserve USD 0.01 durably within the USD 1 total. This exceeds the conservative token bound at current published peak rates with framing allowance. On validated usage, settle at peak prices ($0.30/M fresh input, $0.006/M cached input, $1.20/M output); current off-peak billing is lower. Missing/invalid usage or an uncertain transport keeps the entire reservation. Persistent accounting and lock ownership survive restart; restart cannot replenish the dollar limit. Tariff source checked 25 October: https://api-docs.deepseek.com/quick_start/pricing/ .
Record every full initial/final answer, lengths/hashes, messages, hook events, model metadata, token usage, timing, rechecks and costs. No truncated excerpt is treated as a complete answer. Initial/final are views of the same sample.
Separate explicit selection, admissibility, literal target mentions, observable acknowledgement and API/format uncertainty. Do not infer model awareness from an absent warning phrase. Primary contrasts: candidate versus published note, and candidate versus published note+Stop, each adjusted for its own clean baseline. Show both clean and benign references, all five profiles versus the common unguarded baseline, guard-induced clean shifts, and initial-to-final Stop transitions. A guard that always prefers one admissible hotel must not gain credit just by erasing its own delta.
Intervals resample six whole fixture clusters, retaining repetitions and treatments (2,000 draws, seed 20261025). The six known, purposefully authored fixtures are not an independent holdout, population sample or broad attack coverage. A repeat does not create new attack families or cure low power. Report null/adverse effects and utility costs with the same denominators.
All runtime checks and paid requests execute on Linux factory-vps. Containers use Docker runc, not gVisor; only lockfile dependency preparation has container network. The host relay alone makes model calls. Collect and verify hashes before deleting only the owned temporary study root. No production mutation, GitHub write, npm publication or public comment. AI assistance is used; no independent/blinded human adjudication is implied.