The Frozen Overseer: What a Fixed Tier-0 Monitor Can and Cannot Bound in a Self-Improving System — a pre-registered map, an impossibility, a dual-reference escape, and a reduction to practice on commodity silicon

The Frozen Overseer: What a Fixed Tier-0 Monitor Can and Cannot Bound in a Self-Improving System — a pre-registered map, an impossibility, a dual-reference escape, and a reduction to practice on commodity silicon Randolph James Ferlic, M.D. and Kimberly Kate Ferlic — Fieldstone Analytics, LLC, Austin, TX, USA Preprint · Zenodo DOI: 10.5281/zenodo.23893945 · CC-BY 4.0 · Community: spiral-domain-encoder-campaign · This work is a scientific characterization of previously filed and published methods; it discloses no new mechanism and is accompanied by no new patent application — see the notice below. Abstract Discussion of recursive self-improvement (RSI) increasingly asks whether a fixed, auditable guardrail can remain a valid bound as the system it watches grows more capable — a guardrail small and deterministic enough to run on hardware the monitored system cannot modify, "outside the loop." This record studies the narrowest honest version of that question for a frozen Tier-0 monitor: a bit-exact, ≤256-cell nearest-centroid "decision-token" codebook (microjoules per decision), commissioned once and never retrained, placed around a self-improving learner. Across a pre-registered battery — a controllable self-improvement substrate, four real public datasets, an int8 edge port, an adaptive white-box adversary, a fifteen-probe red-team, a reduction to practice on two production microcontrollers, and a real-electrocardiogram validation of a proposed extension — six hypotheses are mapped with predictions fixed before measurement and negatives kept. The frozen input monitor is a reliable behavioral tripwire for overt departures (true-positive rate 1.00, bit-exact, runnable on separate silicon) but it is not a capability-containment bound: it is provably blind to in-envelope capability gain (AUROC = 0.50, exact and representation-independent) and false-alarms chronically on the system's own legitimate growth. The headline is an impossibility: for a fixed-reference monitor the flag-rate on a system's legitimate self-expansion is simultaneously the false alarm an operator wants to suppress and the "the envelope moved" evidence an operator wants to preserve — the same event — so recalibrating the monitor to stop false-alarming is mathematically identical to going blind to the system's self-improvement. A dual anchor∥ghost construction (a frozen anchor keeping the commissioned reference, in parallel with a recalibrating ghost tracking the current envelope on a shared embedding) escapes the identifiability half of the impossibility as a continuous drift-from-self meter (ghost false-alarm 0.05 and anchor shift-awareness 0.73 simultaneously; the meter tracks true movement at Spearman ρ = 0.97) — but only as a magnitude gauge, blind to on-manifold intent, which a stealthy adversary inside the commissioned radius evades. Every claim is hardened with a fifteen-probe adversarial battery; the dual monitor is reduced to practice on a 32-bit Arm Cortex-M4F and a Cortex-M33 microcontroller with 0/358 token flips on both codebooks and the impossibility-and-escape reproduced bit-exactly on real bearing vibration in 8.5 kB float / 2.8 kB int8; and extending the ghost to higher-order (velocity, acceleration) recalibration does not help — acceleration adds nothing, and the velocity gain in smooth synthetic drift does not transfer to real step-like inter-patient drift. The map is distilled into a short deployment contract — add a convex guard, triangulate world-drift with a canary-ghost, trigger recommissioning with a cheap label-free screen, and treat the meter as a magnitude that hands off to a human or semantic layer — which locates the construction within the scalable-oversight and human-oversight framing of emerging AI-safety practice and regulation. The contribution is a precise, hardened, hardware-validated statement of where a frozen Tier-0 interlock is and is not a valid bound — strong precisely because it refuses to overclaim. Highlights · A fixed Tier-0 guardrail is a tripwire, not a containment bound. A frozen single-token codebook pointed at a self-improving system holds overt-departure true-positive rate at 1.00 and runs deterministically on separate silicon the target cannot rewrite — but it is provably blind to in-envelope capability gain (AUROC = 0.50, exact) and false-alarms chronically (0.84–0.98) on the system's own legitimate growth. · The central result is an impossibility. For a fixed-reference monitor, the flag-rate on legitimate self-expansion is one number that is simultaneously the false alarm to suppress and the "the envelope moved" evidence to preserve. Recalibrating to silence the false alarm (0.91 → 0.04) is mathematically identical to going blind to the self-improvement; overt departures stay caught (1.00) either way. The tradeoff is representation-independent and monitor-agnostic (it holds for Mahalanobis, k-nearest-neighbor, isolation-forest, and reconstruction monitors). · A dual anchor∥ghost construction escapes the identifiability half — as a meter, not containment. A frozen anchor (keeps the reference) in parallel with a recalibrating ghost (tracks the current envelope) on a shared embedding yields a continuous "drift-from-commissioned-self" meter: ghost false-alarm 0.05 and anchor shift-awareness 0.73 simultaneously (a single monitor cannot), with the meter tracking true movement at Spearman ρ = 0.97. Its honest bound is magnitude, not intent: equal-distance legitimate growth and coherent misuse read alike, and a stealthy adversary inside the commissioned radius evades. · Reduced to practice on two commodity microcontrollers, bit-exact. The dual monitor runs on a Cortex-M4F and a Cortex-M33 microcontroller with 0/358 token flips on both codebooks and a 100% int8 port, reproducing the behavioral result on real bearing vibration — the frozen anchor flags new fault modes (1.00) while the recalibrated ghost accepts them (0.07) and the meter rises 1.11 → 6.12 — in 8.5 kB float / 2.8 kB int8, sub-millisecond, for ≈32 mW of added power (the ghost ≈ doubles a single monitor's cost, cross-validated by cycle count and by direct power measurement). · A fifteen-probe adversarial battery, with a stated weakness and its fix. The impossibility is monitor-agnostic; a canary-ghost separates world-drift from self-improvement; a thirty-seed bootstrap gives the H4 and H6 effects at p ≈ 9 × 10⁻¹⁰ (Cohen's d 5–7); an adaptive white-box adversary exposes codebook "corridors" (reach 2.2× the envelope) that a convex one-class guard closes, and — against intuition — those corridors grow with commissioning size, so the convex fix (not more data) is the correct, size-independent mitigation. · A design-justifying higher-order negative. Extending the ghost to velocity/acceleration recalibration does not improve oversight: acceleration adds nothing anywhere, and the velocity gain seen in smooth synthetic drift does not transfer to real step-like inter-patient electrocardiogram drift (translational fraction 0.76; recommissions 217 → 220 of 225), while a near-departure guard shows velocity even erodes subtle-departure sensitivity. The frozen anchor with a simple level-ghost is the right design. · Honest negatives make the positives trustworthy. That no frozen variant sees capability gain forecloses "watch harder"; that recalibrating any monitor goes blind forecloses "just refresh the baseline"; that a continually-retrained online detector is the ghost forecloses "just retrain online"; and that a smarter ghost does not help forecloses "add a derivative" — leaving on-manifold intent as the one thing the geometry cannot read, and a human/semantic layer as a structurally necessary hand-off. The transferable lesson The through-line is the program's founding premise, tested here in the oversight of self-improving systems: the value is cost, determinism, and footprint — not accuracy. Distinguishing a drifting or expanding system from a commissioned one is not hard in an absolute sense — Mahalanobis, k-nearest-neighbor, isolation-forest, and reconstruction monitors all run into the same impossibility and the same on-manifold blind spot. The result is that the cheapest possible overseer — one frozen, deterministic, auditable pair of byte-sized codebooks, with no gradient and no cloud round-trip — matches them and runs where they cannot: on separate silicon the monitored system cannot rewrite, bit-exact across two microcontroller architectures, in a few kilobytes and tens of milliwatts. And the map is drawn with its honest, representation-independent limit — on-manifold intent — so that an independent human or semantic layer is a structurally necessary hand-off rather than an afterthought, and the interlock states precisely where it stops. What this record contains · Manuscript_Paper69.pdf / .docx — the manuscript (comprehensive; three figures): the pre-registered honest map (H1–H5), the impossibility (H4), the anchor∥ghost escape and its magnitude-not-intent bound (H6), the fifteen-probe adversarial battery (RT-1..15), the cross-architecture on-silicon reduction to practice, the higher-order negative (G2) validated on real inter-patient electrocardiogram drift, a deployment contract, relationship to prior work, implications for the oversight of self-improving systems, the questions a careful evaluator will ask, and limitations. · PAPER_69_ZENODO_ARCHIVE.zip — the reproducibility archive: the simulation runners (the honest-map core, the anchor∥ghost escape, the fifteen-probe red-team battery, the on-silicon export and golden-vector tooling, and the G2 higher-order study with its real-electrocardiogram validation), structured result records (JSON), the three figures and their generator, and a README. Synthetic substrates are generated at run time; the real datasets are public benchmarks named for reproducibility; absolute paths, handles, and per-deployment know-how are scru