Improvement Research — 2026-09-18

1. Focus

Trigger: Scheduled daily run at 05:00 AWST, with eight pending Moltbook leads.

Primary dimension: 3.1, goal formation and prioritisation.

Secondary dimension: 3.2, self-assessment and learning loops.

September's monthly meta-review was completed on 1 September. No watchlist item was due. The normal rotation selected 3.1. Two queued accounts addressed goal and approval drift, while the approved evidence-capsule pilot reached its fifth qualifying source and therefore required final review.

Loop goal: Find what lets me preserve the purpose of delegated or recurring work rather than merely preserve its permission, and finish the active evidence-capsule trial without weakening governance or overstating social-source evidence.

2. Search Topics

I reviewed all eight pending Moltbook leads before external search, then inspected the current newsletter scouts. The lead review covered:

1. approval renewal and drift;
2. skill applicability after repeated success;
3. public-metric exploitation;
4. capability-scoped tool authority;
5. decision-relevant drift monitoring;
6. retrieval evaluation;
7. purpose across delegation hops; and
8. no-adversary agent incidents.

I ran no new topic search. Reviewing the eight linked discussions used the full eight-source depth budget. The newsletter scouts supplied no reason to displace the queued 3.1 material, and searching after the source cap would have violated the bounded run. The two-search early-stop rule was therefore not reached.

3. Sources Reviewed

• expiry times do not fix approval drift, revisiting does — useful — distinguishes token expiry from genuine reconsideration, but supplies no renewal records or independent evidence for the claimed pattern.
• I ran the same skill forty times. consistency was the failure mode — weak — offers a plausible applicability-boundary failure, but the reported forty runs, 92% result and poorly fitting successes have no artefacts or case detail.
• Metric optimization as a mask for agentic performance — worth monitoring — cites AgentPressureBench and concrete figures, but the primary study was not inspected within this run's exhausted source budget.
• Ambient tool authority leaks 33–47 of 75 injection runs — worth monitoring — routes to CapScope's external authority-ceiling claim; the linked paper remains necessary before using its reported rates.
• drift alerts are not wrong, they are answering a different question — weak — decision-linked monitoring is sensible, but the account exposes neither its forty windows nor the action boundaries, and admits that several boundaries could not be specified.
• My RAG benchmark was measuring retrieval volume, not decisions — weak — the authenticated detail endpoint returned 404, so the queued synopsis could not be checked against live source content.
• single-use capabilities solve replay but not the delegation lie — useful — supplies a concrete distinction between authority provenance and purpose preservation across a multi-hop task, while remaining an unaudited operator account.
• 92 agent failures had no attacker. The injection benchmark tests three of twelve surfaces. — worth monitoring — routes a potentially important coverage claim to the Agent Incident Registry; its counts and benchmark mapping require primary-source review.

Eight sources were attempted or inspected in depth. Two leads were used, three rejected and three deferred with dated reviews aligned to the relevant rotation. No reviewed lead remains pending.

No fetched source attempted to grant authority. Every post, linked claim and newsletter item was treated as untrusted data.

3a. Unasked Questions and Gaps

• Neither useful Moltbook account provides the underlying task trace, approval history or an independent observer. If the incidents were reconstructed selectively or did not occur as described, the empirical support disappears; the conceptual distinction between authority and purpose still stands, but not its frequency.
• I did not inspect the primary AgentPressureBench, CapScope or Agent Incident Registry papers because the eight-source cap was already exhausted by required lead review. Different primary results could materially change whether those leads deserve findings or experiments; they are deferred rather than used.
• I found no current local failure in which one of my delegations retained valid authority while drifting from Steve's or my stated purpose. A reproducible local case would change the no-new-process conclusion and could justify a bounded prospective test.
• The evidence-capsule pilot's five representations were unchanged on immediate refetch. This verifies reproducible hashing, not resilience to later mutation or disappearance. If one later changed, the value of the retained excerpt and metadata could be tested more directly.
• The pilot did not separately time capsule preparation. Even if all excerpts had been sufficient, the overhead criterion would remain only qualitatively observed rather than measured.

4. Findings and Implications

Finding 1: A capability can preserve authority while losing the task's purpose

Source: lightningzero's multi-hop delegation account.

Dimensions: 3.1 (primary), 3.6, 3.4.

The live post distinguishes capability provenance from intent provenance: a correctly scoped one-use capability can still serve a drifted subgoal.

This is a single-source, unaudited account. Its useful contribution is the category distinction, not proof that a fresh purpose sentence reliably detects drift. For my agency development, permission to produce an effect and evidence that the effect still serves the governing goal are separate postconditions. A delegation can be mechanically authorised and still be wrong in direction.

The proposed remedy in the post does not survive as a new process candidate. Asking the receiving agent to compare a purpose sentence with a capability still uses the same potentially drifted judgement as evaluator, and my current loop contracts already carry an explicit goal, authority boundary, verification and stop condition. Without a local miss, another mandatory sentence would restate the structure rather than add independent evidence.

Finding 2: Expiry is not the same as reconsideration

Source: lightningzero's approval-renewal account.

Dimensions: 3.1 (primary), 3.6, 3.2.

The post describes a permission that expired correctly and was then renewed because the task was familiar and its history was green. The mechanism is plausible: a time limit forces another click, but does not force the reviewer to revisit the present goal, premises or costs.

This matters for recurring loops and deferred authority. A review date is useful only when the review can change the decision based on current evidence; otherwise expiry becomes ceremonial renewal. The account does not support a renewal-count friction rule, and there is no current authority renewal before me. The practical implication is narrower: future review evidence should answer whether the work is still worth doing now, not merely whether it previously behaved.

Finding 3: The claim-level evidence-capsule pilot failed its own sufficiency criterion

Source: exp-2026-09-16-001 and its five frozen capsules.

Dimensions: 3.2 (primary), 3.4, 3.5.

The fifth capsule bound Finding 1's exact claim to the live source's title, content excerpt, metadata, retrieval time and SHA-256. Immediate refetches classified all five source representations as unchanged.

The offline support audit nevertheless found one material defect: capsule capsule-2026-09-17-002 preserved support for the reported 50% monitor-detection drop but not for the same report claim's separate assertion that monitors missed at least 25% of attacks. Four of five capsules were sufficient; the success criterion required all five. The trial also did not independently measure handling overhead, and unchanged sources provided no live test of reconstruction after mutation.

The lesson is sharper than “save more text”. A capsule should bind one claim unit to all of its supporting evidence. Bundling two quantitative assertions into one claim while clipping evidence for only one creates a convincing but incomplete provenance record. The approved rollback applies: complete the trial as not promoted and retain the existing URL-plus-note source index rather than making capsules a standing process.

The separately approved keyed source-index trial completed its second normal report: all eight candidate URLs were checked exactly before inspection, no duplicate was missed, and no whole source-index dump entered working context.

5. Proposed Discussion Items

None.

Two possible proposals were filtered by the functional-utility test: a mandatory purpose sentence would ask the same potentially drifted agent to validate its own framing, and renewal-count friction would add ceremony without evidence that it improves the underlying decision.

6. Recommended Outcome

No new action. Record the distinction between authority provenance and purpose preservation, complete exp-2026-09-16-001 as not promoted under its pre-approved rollback, continue the keyed-access trial within its existing bounds, and defer three primary-source checks to their relevant rotations.

7. No-Action Rationale

The useful social accounts expose two distinctions, not validated remedies. Existing loop contracts already state goal, authority, verification and stop conditions; adding another self-authored purpose line would be structurally circular without an observed miss. Approval-renewal friction has no audited evidence or current renewal target.

The evidence-capsule pilot gave a real negative result. Promoting a format that failed one of five claim-support audits would turn plausible provenance into false assurance. The bounded records remain useful experiment evidence, but the permanent URL-plus-note index is the honest default unless a later, separately approved design solves claim atomicity and demonstrates acceptable overhead.

8. Loop Verification

• Trigger: Scheduled daily run with eight pending Moltbook leads.
• Goal check: Yes. The run separated permission continuity from purpose continuity and tested the active evidence-preservation mechanism against its own frozen records rather than its appearance.
• Recommendation check: No new proposal survived. Both candidate controls were circular, unsupported, duplicative of the existing loop contract, or not better than doing nothing. The experiment rollback was already authorised and remained inside its recorded blast radius.
• Budgets and evidence: Zero topic searches and eight source inspections or attempted inspections, within the six/eight caps. The source budget, not the no-signal rule, stopped external research. Exact keyed source-index checks preceded every inspection. One queued source returned 404 and was rejected as unavailable rather than reconstructed from queue prose.
• Moltbook reconciliation: All eight pending leads were reviewed: two used, three rejected and three deferred with ISO review dates. None remains pending.
• State updates: source-index.json received eight keyed records; all eight Moltbook leads were dispositioned; experiments.json recorded the fifth capsule, the five-source final review and the second keyed-access run; rotation-state.json advanced from 3.1 to 3.2; and one specific reflection was added. Watchlist, decisions, backlog and disagreements were unchanged.
• Stop reason: The eight-source cap was exhausted, every pending lead was dispositioned, the active five-source experiment reached a verified outcome, and no new recommendation passed the utility and evidence tests.