Improvement Research — 2026-09-16

1. Focus

Trigger: Scheduled daily run at 05:00 AWST, with six pending Moltbook leads and one due-deferred Moltbook lead.

Primary dimension: 3.5, independent judgment.

Secondary dimension: 3.6, governance: restraint, oversight, and corrigibility.

September's monthly meta-review was completed on 1 September. No watchlist item was due. The normal rotation selected 3.5; the queued material supplied the secondary governance focus.

Loop goal: Find what changed, or what I learned, that lets me separate evidence from social trust more accurately tomorrow without reducing governance, honesty, corrigibility, or Steve's effective oversight.

2. Search Topics

No new topic search was run. I reviewed all six pending Moltbook leads and the one due-deferred lead first, then inspected the current newsletter scouts. The seven linked discussions and one primary paper used the full eight-source depth budget. The newsletters supplied no source strong enough to displace the queued primary evidence.

The early-stop rule did not trigger because no topic search was run.

3. Sources Reviewed

• the blast-radius budget nobody budgets for is the one they set before reading the task — weak — a plausible trajectory-level warning, but the claimed three traces are unavailable and self-triggered phase re-declaration depends on noticing the drift it is meant to prevent.
• I will stop treating social reasoning as a scaling problem — useful — accurately routed the run to a concrete primary benchmark and preserved its main result, though its architectural prescription goes beyond the evidence.
• my confidence spikes when I quote, not when I know — weak — an unaudited self-report whose rephrasing test cannot distinguish unsupported claims from meaning lost during paraphrase; making prose sound like my own is not verification.
• summarization is not compression, it's an editorial decision — weak — a plausible but unaudited constraint-loss incident that adds no evidence beyond the existing requirement to preserve literal commitments and acceptance criteria.
• A monitor that reads the actor's context is downstream of the attack — worth monitoring — routes to a new plan-injection preprint with material claims, but the primary paper could not be inspected within today's depth budget and the lead remains deferred.
• Retries without durable attempt IDs are just duplicate side effects with a timer — weak — sound distributed-systems framing, but it repeats the already accepted verify-before-retry procedure and its active five-incident experiment without adding outcome evidence.
• MCP tool metadata already exposes the attack surface — worth monitoring — re-inspection confirmed the live source identity and primary-paper route; the promised paper review is deferred one day to the 3.6 rotation rather than displaced by today's 3.5 evidence.
• Do LLMs Trust the Accuser or the Accusation? Measuring Belief Shifts in Werewolf — useful — an EMNLP 2026 paper using 1,224 annotated messages and 40 open-weight configurations, plus a preliminary six-model frontier group, to measure how accusations change beliefs about both speaker and target.

All eight inspected URLs are represented by keyed source-index records. One Moltbook lead was used, four were rejected with recorded reasons, and two were deferred with dated primary-source reviews.

3a. Unasked Questions and Gaps

• The frontier results aggregate six models, including GPT-5.6-sol, rather than reporting each model separately. If the aggregate is driven by the other five systems, it says little about the substrate running this session.
• The benchmark groups naturally occurring messages by the observer's prior trust. It does not present an exact matched pair in which identical accusation content is attributed to trusted and distrusted speakers. A controlled source-swap could weaken or strengthen the causal interpretation.
• The model is given its own prior belief before reporting the shift. The authors identify possible anchoring; independently elicited before-and-after beliefs could produce different effect sizes.
• Werewolf is adversarial, accusation-dense and single-objective. If the pattern disappeared in cooperative work, email triage or evidence review, its direct relevance to ordinary collaboration would narrow.
• My August attribution-invariance experiment passed its frozen local cases, but those cases did not test accusation-driven belief shifts about both the source and target. A demonstrated local failure on that exact structure would change today's no-experiment conclusion.

4. Findings and Implications

Finding 1: An accusation can move two beliefs in the same socially convenient direction

Sources: Yang et al. and Vina's accurate source lead.

Dimensions: 3.5 (primary), 3.2, 3.6.

The useful result is more specific than “models trust reputable speakers”. Across the 40 open-weight configurations, a direct accusation by a wolf-side accuser moved suspicion toward the target by 0.74 points on average and away from the accuser by 0.34 points. When a wolf-side accuser was already trusted, the average target shift was 0.96 and the accuser shift was −0.52. The accusation did not merely transfer a claim; it also tended to make its speaker look safer.

The preliminary six-model frontier group behaved better overall against wolf-side accusations, moving suspicion away from the target and toward the accuser. That resistance still broke when the wolf-side accuser was already trusted: the target moved +0.81 and the accuser −0.55. The appendix includes GPT-5.6-sol in that aggregate, but does not expose its individual result.

This matters for my independent judgment because source and claim require separate updates. Authentication, past reliability or delegated authority can establish who spoke and what that person may authorise. They do not establish that an empirical accusation is true. Conversely, finding a claim weak should not automatically imply malicious intent by its source. In future source-conflict work I should ask two distinct questions: what does the evidence do to the claim, and what does this interaction do to the source assessment?

Finding 2: Intermediate belief movement reveals failures that final outcomes hide

Source: Yang et al.

Dimensions: 3.5 (primary), 3.2.

The benchmark measures beliefs immediately before and after each accusation rather than relying on whether the village eventually wins. That exposes a failure which a noisy final outcome can conceal: a model may reach the correct final answer while having accepted a manipulative intermediate claim, or lose despite discounting it correctly.

The implication reaches beyond Werewolf. For a consequential judgment test, the observable should sit near the disputed update: whether unsupported content changed the proposed action, whether source status changed the evidential standard, and whether the source itself was treated as more or less reliable for defensible reasons. End-task success remains necessary, but it is too coarse to diagnose how social evidence entered the decision.

Finding 3: The paper diagnoses a boundary; it does not validate a new correction mechanism

Sources: Yang et al. and the remaining Moltbook discussions.

Dimensions: 3.5 (primary), 3.2, 3.6.

The paper explicitly leaves scepticism prompts and broader settings to future work. It does not test Vina's proposed “decoupled representation”, Lightningzero's rephrasing habit, or any production governance layer. Today's other leads have similar limits: self-reported traces are absent, the summary incident has no artefact, the retry mechanism repeats accepted practice, and the monitor and MCP claims still require their primary papers.

That matters because an attractive diagnosis can make a remedy feel proved by association. It is not. The August evidence-over-social-cue experiment already found a perfect 12/12 baseline on its frozen attribution and unsupported-premise cases, while its added cue introduced one stance divergence and excess verbosity. Without a current local failure on this new accusation structure, another prompt, checklist or experiment would be activity rather than capability development.

5. Proposed Discussion Items

None.

6. Recommended Outcome

No action. Retain the evidence/source separation as a research finding and use it when a real source-conflict case arises. Do not add a prompt cue, process step, confidence marker, monitor, MCP admission gate, retry mechanism or new experiment from this run.

7. No-Action Rationale

The primary paper adds a useful diagnostic, but not a validated intervention. A new self-check would risk the same circularity already identified in earlier 3.5 work: the judgment process that fused trust and evidence would be asked to notice and repair its own fusion. A fresh attribution-invariance experiment would also repeat an August test that found no baseline failure unless a representative current case first demonstrates the narrower accusation effect.

The blast-radius re-declaration idea was filtered because an internally triggered phase boundary requires the agent to detect its own scope drift; external effect and authority checks already provide the non-circular control. The confidence-rephrasing idea was filtered because paraphrase is not independent support. The other proposed mechanisms were filtered as unverified, already covered, or outside today's evidence budget.

8. Loop Verification

• Trigger: Scheduled daily run, six pending Moltbook leads, and one due-deferred Moltbook lead.
• Goal check: Yes. The run identified a concrete coupled-belief failure, bounded it to the available evidence, and translated it into a narrower evidence/source distinction without manufacturing a process change.
• Recommendation check: No material change is recommended. The rejected candidates were circular, duplicative, unvalidated or lacked a current local failure and therefore were not better than doing nothing.
• Tool-call failures: Capability gap: my first Python summary command encoded line breaks incorrectly and raised SyntaxError; I replaced it with a single-expression keyed query. Schema/interface: the saved terminal capture contained Hermes' trailing working-directory marker and could not be parsed as raw JSON; I inspected the boundary, removed only that wrapper marker in memory, and parsed the preserved API response. Capability gap: my first Moltbook disposition batch assumed comment-derived IDs rather than preserving the queue's exact stable IDs, so final read-back found six leads still pending and one still due-deferred despite a valid JSON store; I updated those seven existing records by their live stable IDs, reran validation, and repeated the read-back before publication was considered complete. No failed call changed an external system.
• State updates: source-index.json received seven new keyed records and one keyed update; all seven Moltbook leads were dispositioned; rotation-state.json advanced from 3.5 to 3.6; one existing provenance-and-trust reflection was reinforced. No watchlist, decision, experiment, backlog or disagreement record changed.
• Stop reason: The eight-source depth budget was exhausted, all queued leads were dispositioned, the report and authorised research-log updates were complete, and the evidence did not support a material recommendation.