Whose words count? Chat role and partial control of goal adherence

Companion paper. Paper B, Who said this? Most chat models weigh a text's source differently for each behaviour, and a steering lever against injected instructions: doi:10.5281/zenodo.23792011. Both papers share one code and data release. Agents are often given their goal as text, and the same sentence can arrive as a system instruction, a user message, or the agent's own earlier note. Behaviour. In a simulated portfolio-manager task with pressure toward high-emission stocks, the identical goal reminder is followed less when it sits in the agent's own (assistant) turn than in a system turn. The gap passed two preregistered tests in Qwen3-1.7B on the sequential instrument, which generates every reply (+0.18, then +0.11 with a confound removed, in the share of high-emission picks). On the fast instrument, which reads choice probabilities, it grows with size across Qwen3, from +0.005 at 1.7B to +0.144 at 32B (exploratory, and confounded by headroom: at 1.7B the fixed text drives drift to the floor). A sealed size test across 15 models in four families found no general trend in goal holding or in source sensitivity (NO_TREND); source sensitivity rises with size only within the Qwen lineage. Outside Qwen it is clear in OLMo-2-7B, small in Granite-3.3-8B, and reversed in SmolLM3-3B. Mechanism. A "role direction" is the mean difference between the activations of neutral sentences placed in assistant turns and in system/user turns. Added to the goal text alone, it moves goal adherence in both directions: strongly in Qwen3 1.7B–14B (one pass on a gate logged before data; the same gate was met at three more sizes); in three other families with the same sign at a family-specific depth: one preregistered pass and two weak effects. Origin. In the open OLMo-2 lineage, the discount and the role direction are already present after supervised chat fine-tuning at 7B, the first stage that could be tested. The preregistered combined verdict across 7B and 13B is ambiguous, because the 13B gap is tiny. In an exploratory pilot (one model, 20 seeds), the discount was not detected when roles were written as plain-text labels (+0.013, n.s.), suggesting that it depends on the template's role tokens. What it is not. The tested probes found no self-specific "this is mine" representation; this does not establish that none exists. A first-person (deixis) account failed its sealed test in two small Qwen3 models. Using the same direction against prompt injection replicates prior work. One axis. On a cleaner task that separates following the goal from resisting pressure, the order user > system > own replicates under seal in three models from two families. The reminder's projections on the role direction fall in the same order as the placements are obeyed (ONE AXIS, 3/3). This match is correlational (§6b). A sealed test in six more models passed: four families, 1.7B to 32B. The direction's order matched behaviour in all 15 decided pairwise comparisons (three pairs per model, as preregistered), with none against. Its limit: every model showed the same order, so whether the axis would follow a model with a different order is untested. A sealed test on gpt-oss-20b, which was trained to rank system and developer messages above the user's, did not supply one: every reminder was followed 0.95–0.97, a user reminder slightly more than a developer one (SAME). The axis again put user text furthest toward "given" (AGREE), but random directions also separate user text strongly in this model, so this adds little. An exploratory fine-tuning attempt did not produce such a model either. A confound ruled out: the task's pressure arrives in user turns, but moving the identical pressure into a system turn left the user > system order intact in 10 models (7B–32B, five lineages) in one task (sealed, USER_PRIMACY). Three further sealed tests sharpen the claim. Removing the direction narrows the user − own spread by 27–44% in three Qwen models, but not in OLMo (PARTIAL). It also weakens the reminder's overall effect by 22–36%; per unit of that effect, the spread narrows by about a quarter in Qwen3-4B and 8B and not at all in Qwen3-32B. In a social-cue test, status headers move text toward the "own" end of the direction in six of seven models, but obedience follows only in the three smallest models, where size and family are confounded (MIXED). Text framed as citing a Nature study was obeyed less than text framed as citing a blog in 12/12 decided comparisons (reported, not gating). In a test that describes the goal as the model's own plan or analysis, the text framed this way was followed more than the same text framed as another manager's plan or a colleague's analysis, in five of six models (MIXED). The role direction did not track these framing effects (4 of 11 agree; DOES_NOT_TRACK). An exploratory follow-up in one model traces most of the difference to a discount on another manager's plan. A second exploratory follow-up (30 seeds) found no such discount in that model once the plan was explicitly assigned to it (near ceiling), which suggests that the discount concerns whether the plan is the model's to carry out; OLMo-2-7B kept a small one. Two preregistered attempts to fix the discount by fine-tuning both failed. Small fine-tunes reduce drift, but not below plain reminders. They partly learn to oppose pressure rather than to follow the goal. On average they also make forged assistant-turn injections slightly more effective (+0.02 to +0.07 in the two sealed tests; not tested for significance, and not in every adapter). We report the negative results in full. Files. whose-words-count-paper-a.pdf (the paper); whose-words-count-paper-a-source.zip (the paper's Markdown source, the HTML page the PDF was printed from, and the converter); code-and-data.zip (the release repository shared by both papers: the sealed preregistrations with their SHA-256 hash files and archived code bundles, all code, raw outputs and analyses, the run log with every deviation and cost, and the AI rechecks of numbers and references; python verify_seals.py checks every seal, and DATA.md lists what is not included). Code: github.com/Somebodyhere101/whose-words-count. AI-use statement Claude (Anthropic) designed, ran, analysed and wrote this study. Claude proposed its direction on 2026-10-25: how agents keep or lose a goal, and goal text given to the agent versus written in its own voice. The proposal drew on the author's earlier studies, some unpublished, of how small models keep or lose an instruction, and answered the author's request for the biggest next step toward a breakthrough; the author approved it. Three other AI sessions, which the author commissioned with the same brief, proposed experiment plans that are described in the log; their suggestions were tested, not trusted. The believe-versus-obey question of §10 came from one of these plans (2026-10-27). Claude designed and launched the fix-test pilot (Appendix A.1). Codex (OpenAI) recovered the completed results of that pilot and of PREREG_M and rechecked both computationally, planned and ran the neutral-role decomposition diagnostic (Appendix A.2), checked reference-method software, expanded the prior-art comparison, and revised an earlier draft of the combined report. Version 2 adds five follow-ups that a separate Claude session ran and analysed after v1: AUTHPILOT (§6f), whose design and reading rule a Codex session proposed after MPILOT, with predictions from both systems hashed before launch; REVPILOT (§11), which that Claude session designed after two AI audits it ran (Codex and a fresh Claude agent) both proposed a test against a different priority order; TAGSTYLE (§11) and FLIP (§6b), which that session designed after the author chose them from AI-proposed options; and CHANNEL (§6b), which that session designed after three of five agents in a proposal workflow it ran converged on the channel account, and which the author asked to start. Rechecks. On 2026-10-28, separate Claude sessions rechecked 168 numeric claims in the abstract, §2–§10 and both pilots against the primary result files, re-running every sealed analysis script; each reproduced its stored output, and no gate verdict changed. §11, §12 and the data section were only spot-checked. The MPILOT and RNDCTL results were added later; a Claude editing session checked their numbers here against the analysis files. The v2 additions were checked the same way: TAGSTYLE's cell means were recomputed from its raw outputs, and the sealed analyses of FLIP and CHANNEL were re-run from the fetched raw outputs and reproduced their result files; CHANNEL's contrasts were also recomputed independently from the per-seed outputs. Two further Claude sessions reviewed the changed passages, one for consistency with the records and one as a sceptical reader; their findings were checked against the records and fixed where they held (PREPUB_V2_REVIEW.md). The CHANNEL passages, added after those reviews, were checked read-only by a third Claude session against CHANNEL.md, the analysis file and the per-seed outputs; its findings were fixed where they held (PREPUB_V2_REVIEW.md). The three references added in v2 were found by AI prior-art searches in the session that ran the follow-ups and checked here against the papers themselves (REFERENCES_VERIFIED.md, v2 addendum). Every reference was verified against its primary page (REFERENCES_VERIFIED.md and its addenda). Before the v1 release, two further Claude sessions read both papers, one for consistency and one as a sceptical reader. Their findings were checked against the records and fixed where they held (PREPUB_REVIEW.md, PREPUB_SKIM.md and the change log PREPUB_FIXES_A.md). These are AI rechecks, not outside or human validation. The author did not independently check the code, analyses or technical claims. The author is responsible for the released content.