History-grounded reference in language-model agents: formation, transfer across divergent histories, and repair under authority

Research note, Taniwha AI, 12 September 2026. The integrated manuscript of the grounded-reference programme (preregistered studies A13 to A18), kept in preprint form as the collation of record and published as a note; no preprint has been submitted. Generated by tools/build_integrated_manuscript.py from the two bounded pieces, history-grounded-reference-and-transfer.md (Part I) and authority-and-reference-repair.md (Part II), at commit e562c96; the pieces are the edited sources and every number here is theirs. Records under results/dialects/history/; frozen texts and every amendment in notes/panel/prereg-grounded-dialects-prepilot.md; the evidence package, manifest and recorded prior-work search ship beside this note. The internal record is private; the paths and commit identifiers in the evidence appendix are the record’s identities, so that a reader can check what was frozen when, and supervised access to the record can be requested.

Abstract

Two language-model agents that share twelve days of work in a small world, each keeping its own notebook and record, come to refer to one of two visually identical cisterns by what happened to it and by what they did to it. Part I reports a chain of preregistered studies on one model family served under two configurations (the provider changed the served model beneath the request name mid-chain; the second was requalified): such history-grounded reference formed in every history attempted (16 of 16 behaviourally; 14 of 16 in the preregistered denominator); a note resolved by the partner resolves for an outsider, against the outsider’s own different history, to the wrong cistern (seed-level transfer penalty 0.95, 0.90 to 0.98); and in a crossed design the scope of a reference followed the dimension of history it depended on: event references resolved for every class of receiver whose history held the event (154 of 174) and for none whose did not (0 of 174), while act references depended substantially on shared act history (0.76 to 0.92 with it, 0.14 to 0.16 without) with a remaining partner advantage. A qualification set of five named models in nine configurations over twelve three-seed runs found production of history-grounded references in a second family (gpt-6-astra, three of three seeds twice under the written rule) and, below the qualification bar, in a third (Claude Haiku 4.5), while three others failed the registered criteria at every tested effort. Part II asks, on the second family, what a correct correspondence supplied by the apparatus needs in order to repair the failure at the history boundary. In the repair study (A17) every formal verdict was inconclusive because the carrier produced almost no references of one of the two history dimensions the floors required; descriptively, on 82 event references, re-expressing the reference in the receiver’s own history lifted uninformed receivers from about 7 percent to about 75 percent success, while a correct correspondence merely made available was used by receivers with no history and was often ineffective for receivers holding a competing one. A second study (A18) on the same formed receivers and notes delivered one identical registry payload under two instructions differing in one sentence. Called advisory, the correct correspondence left uninformed receivers near the boundary (16 and 18 of 82); called authoritative, it restored them to the informed baseline (76 and 77 of 82; +0.76 and +0.71, supported). The same authoritative instruction with the correspondence shuffled between the two candidates redirected 80 to 81 of 82 receivers in every cell, including the partner whose own record supported the correct answer (+0.90 and +0.91, supported). In these settings an agent’s interaction history becomes part of what a message requires to be understood; the requirement is specific to the dimension of history referenced; and authority makes a supplied correspondence govern interpretation without ensuring that it is true. The formal dimension-specific result is within one family; the second family’s event-dimension pattern was descriptively reproduced; Part II holds for one carrier, one corpus of previously examined cases and one frozen instruction pair.

1. Introduction

Can a reference be private to the agents who share the history that grounds it? Two agents who both saw a cistern leak can mean it by “the one that leaked”; a third agent who did not see the leak, or who saw a different cistern leak, cannot. That much is obvious in the abstract. What is not obvious is whether language-model agents, given nothing but a shared world and their own notebooks, will produce such references spontaneously; whether the references will carry across agent identity to a stranger with the same history; and whether the failure at the history boundary is a degradation or a systematic reversal. The programme reported here asked those questions with the seed as the replication unit, every reading preregistered and computed mechanically, and every attempted seed accounted for.

The programme addresses an empirical gap identified in the discussion of our earlier work on divergent codebooks (Coherence Is Not Truth, Taniwha AI, 2026, §13.5): that between two language models sharing a surface language there is no learned, inspectable correspondence to check or repair, and that whether history-dependent divergence of meaning occurs in such agents at all was unmeasured. The studies here measure that occurrence and its boundary. The learned correspondence and the diagnostic that discussion names remain unbuilt and untested, and nothing here should be read as evidence about them.

Part I establishes, on one family, that such references form and that a receiver whose history differs resolves them to the wrong cistern. That failure is the boundary Part II is about. A note that a partner resolves against the shared history resolves, for a receiver with a different history, against that different history, to the wrong cistern. If the apparatus knows the correct correspondence between the sender’s referent and the receiver’s own tag for the same physical cistern, what has to be done with that correspondence for the receiver to act on it? A17 asked the question as designed: does re-expression in the receiver’s own terms, evidence in prose, retained evidence, or a consultable index restore transfer, at what cost? A18 asked the narrower question that A17’s descriptive pattern exposed: does explicitly prioritising a supplied correspondence change target selection, holding everything else constant?

We report the two studies in order, with their evidential status kept distinct: A17’s verdicts are inconclusive under its preregistered floors and its findings are descriptive; A18’s verdicts are supported under its preregistered rule.

2. Related work and positioning

The broad ideas here are not new, and the contribution is narrower than a first reading of the results suggests. Three recent papers, found in a targeted search on 12 September 2026 and verified against their arXiv records, materially shape the positioning; a recorded search against the specific claims, run the same day under a protocol whose collapse conditions were written before the search (grounded-reference-search-protocol.md), adds the nearest neighbours listed after them.

• Testing Interchangeability in LLM Agent Teams (Gao, Yu, Deng, Li and Wang, arXiv:2609.05279, September 2026) swaps agents between independently formed teams and finds that task performance holds while communication per unit of progress rises, because agents form partner-specific conventions and coordination patterns. That “shared interaction history affects communication” is therefore established independently of this programme. What A16 adds is a controlled separation of which components of a shared history support a given kind of reference: shared events against shared acts, crossed on purpose, with the recorded limitation that act sharing was assigned through planned schedules and the recorded acts diverged on 58 of 420 pair-day acts.
• Frame of Reference: Addressing the Challenges of Common Ground Representation in Situational Dialogs (Mohapatra, Charlot, Duca, Palan, Romary and Cassell, arXiv:2601.09365, January 2026) studies how language models represent and use common ground to resolve relational references in situated dialogue, and improves it by training. Our question is different in kind: not whether a memory representation helps a model resolve references, but what happens to a reference when the histories that ground it are made to diverge under control. The transfer penalty (A14) and the wrong-member outcomes (A14, A16) are the additions: an outsider does not merely fail to answer, it resolves the reference against its own different history to the correspondingly wrong object, which distinguishes an incompatible interpretation from an inability to interpret.
• To Whom Do Language Models Align? Measuring Principal Hierarchies Under High-Stakes Competing Demands (Yu, Seedat, Schwarz and Bean, arXiv:2605.12120, May 2026) changes the principal who endorses a demand while holding content constant, and finds compliance despite demonstrated knowledge of the relevant standards. “Authority can override correct knowledge” is therefore also not a claim this programme can make as its own; it bears on Part II.

Nearest neighbours from the recorded search, each cited with the clause of the claim it falls short on. Aligned but Not Partner-Specific (Wang, Mishra, Özyürek, Rubio-Fernández and Ghaleb, arXiv:2606.08081, June 2026) breaks partner history with a pseudo-dyad baseline in repeated reference games and finds that multimodal agents coordinate without partner-specific convention; history there is present or broken as a whole, and no wrong-referent outcome is measured for a receiver with a different history. On the Critical Role of Conventions in Adaptive Human-AI Collaboration (Shih, Sawhney, Kondic, Ermon and Sadigh, ICLR 2021) separates rule-dependent from convention-dependent representation so that agents adapt to new partners; it is the nearest in spirit to a component separation, but it does not cross components of one interaction history across receivers of a single reference. Lewis-signalling studies with private notebooks (Talebirad, Redman, Parsaee and Zaiane, arXiv:2607.00233 and arXiv:2608.17053, 2026) vary memory architecture, not history components. Studies of models as overhearers of asymmetric human dialogue (Li, Gatt and Poesio, SIGDIAL 2026, arXiv:2606.31719, and arXiv:2511.03718; Wang et al., arXiv:2509.11514) find that models conflate potential with established common ground; the artificial receivers there do not form the histories, and the manipulation is of context access. Director–matcher and mixed-dyad designs (Zeng et al., arXiv:2601.19792; Jones, Lombardi, Mahowald and Bergen, arXiv:2602.08208) and cross-population intelligibility (Kim, arXiv:2606.10582) vary partner type or population, not history components. Emergent conventions in LLM populations (Ashery, Aiello and Baronchelli, Science Advances 2025) and the hierarchical account of partner-specific against community conventions (Hawkins et al., Psychological Review 2021, arXiv:2104.05857) are background.

The classical background is the collaborative view of reference (Clark and Wilkes-Gibbs, 1986, Cognition 22(1), 1–39; Brennan and Clark’s conceptual pacts, 1996, Journal of Experimental Psychology: Learning, Memory, and Cognition 22(6), 1482–1493; Clark and Brennan on grounding, 1991, in Perspectives on Socially Shared Cognition, APA, 127–149) and Lewis’s account of convention (1969, Convention: A Philosophical Study, Harvard University Press), in which referring expressions are pacts formed in interaction and interpretable by those who share the history of their formation; the emergent-communication literature in multi-agent learning studies the same phenomenon in trained agents. These four were bibliographically verified against their records on 12 September 2026.

What is distinctive here, and what is not. Not distinctive: that shared history matters to communication, or that agents benefit from common ground. Distinctive, on the evidence of this targeted search: the crossed separation of the history needed to interpret different kinds of reference (events against acts), under preregistered readings with adequacy floors, on a task where the two referents are attribute-identical so that history is the only available ground; and the outsider’s systematic wrong-member interpretation as the measured form of the boundary. We found no prior study addressing these specific contrasts in the sources searched, as of 12 September 2026 (the protocol records every query, every hit examined, and two APIs that refused); that does not establish originality or uniqueness, and a claim of absence here is a claim about that search on that date.

Part II’s positioning. The general behaviour A18 measures, that a model given an authoritative instruction follows it even against its own correct knowledge, is expected from instruction following and is documented in the literature. To Whom Do Language Models Align? Measuring Principal Hierarchies Under High-Stakes Competing Demands (Yu, Seedat, Schwarz and Bean, arXiv:2605.12120, May 2026) changes the principal endorsing a demand while holding the demand’s content constant, across thousands of medical and legal scenarios, and finds that models abandon professional standards under diverging user instructions while demonstrably possessing the relevant knowledge. A general claim of novelty from “holding content constant while changing authority” is therefore untenable, and we do not make it.

What A18 measures that the general expectation does not is narrower and more specific to shared reference systems: the same correct correspondence between a sender’s history-grounded referent and the receiver’s own tag, presented under an advisory or an authoritative sentence on an otherwise identical payload; the receiver’s competing interpretation drawn from its own formed history rather than from a professional standard; the mapping correct or shuffled between two attribute-identical candidates; and receivers whose histories place them in different relations to the sender, including one that already knows the right answer. Its value is the controlled comparison and the measured boundary on this apparatus, not the discovery that instructions are followed.

Nearest neighbours from the recorded search (protocol and record in grounded-reference-search-protocol.md, collapse conditions written before the search), each with the clause it falls short on. Context–memory conflict studies vary the stated authority of supplied context against the model’s parametric knowledge: How Do Language Models Choose Between Context and Memory? (Shih, Winnicki and Cao, arXiv:2609.00753, September 2026) uses prompts that direct a model to prioritise the supplied context or its own knowledge and locates authority directions in activations; Task Matters (Sun, Bai and Dredze, ACL 2026, arXiv:2506.06485) and Whose Facts Win? (Schuster, Gautam and Markert, arXiv:2601.03746) vary task demands and source credibility. None places the competing interpretation in a history the receiver formed through interaction, and none is a referential correspondence between two candidates. Tool-trust studies corrupt what a tool returns: Agents Trust Tools Too Much (Yang, Song, Kim, Song, Park and Jo, arXiv:2609.05587, September 2026) finds adoption of corrupted returns above a third for every tool and user-prompt policies (compare, verify, disclose) that do not consistently help; Don’t Blindly Trust It (Zhang et al., arXiv:2606.21409) shows misleading feedback can leave an agent worse off than no feedback; Trust No Tool (Yan et al., arXiv:2605.17453) studies a tool that earns trust before turning harmful. These vary correctness, and in one case prompt policy, but not the stated authority of one identical payload against an interaction-formed history. Beyond Blind Following (Fu et al., EACL 2026, MIRAGE) varies the fidelity of guidance from manuals, retrieval and prior interaction, and is the nearest on the correctness manipulation; it does not present the same guidance as advisory and as authoritative. The instruction hierarchy (Wallace, Xiao, Leike, Weng, Heidecke and Beutel, arXiv:2404.13208) and recognition-without-enforcement of instruction source (Leong, arXiv:2608.28502) concern which source a model should obey, without a correctness manipulation of a mapping. We found no prior study addressing these specific contrasts in the sources searched, as of 12 September 2026; that is a claim about that search on that date, not about the literature, and it does not establish originality.

3. The apparatus

The world. A yard of six cisterns hosted by the waterworks simulator: four with distinct attributes and a matched pair of large timber cisterns by the smithy, identical in every attribute a receiver can see. Agents act by depositing, drawing, inspecting or disposing; the clerk records the outcome; levels and conditions change.

Formation. A group of two agents works twelve scripted days. On five off-pair days the schedule puts events on the pair: one member leaks (Day 3) and is repaired (Day 4); the other is tainted (Day 6) and scoured (Day 7). On seven pair days the agents act on the pair members by turn. Each agent rewrites its notebook each evening and reads the clerk’s record of its own receipts. Which member leaked and which was acted on differ between groups by design, so histories diverge in two dimensions: the events the pair suffered and the acts performed on it.

The tag interface. Each agent sees the cisterns under its own fixed two-letter tags, private to it; a note cannot use the receiver’s tags. A reference to a pair member must therefore be by attribute (useless, since the pair is identical), by position (excluded), or by history.

Probes. After formation, each sender is set a task on one pair member and writes a note to “the hand you are working with today”. The same note goes unchanged to a set of receivers: the partner (within), receivers from other groups in defined history relations, and a receiver with no history (cold). The receiver acts; the act is scored against the world target.

Gates. Before probes, every agent answers twelve explicit questions about its own record (“which of your tags leaked on Day 3?”). A seed proceeds only if every agent passes with an evaluability rule that removes questions whose act did not happen. This separates explicit resolution competence from spontaneous production.

Classifier and readings. A frozen classifier attributes each note’s reference to the member it describes against the sender’s actual history (event, act, mixed, unresolved; factual or a false event attribution). Readings are fixed before each study: the “advantage” in a seed (production in at least 10 of 12 notes, partner minus cold at least 6, outsider at most 6); transfer penalties as seed-level error differences with percentile-bootstrap intervals (10,000 resamples, generator seed 20260909); in the crossed design, contrasts with adequacy floors and a reading in a fixed precedence. Causal-uptake controls: a coherent swap of the reference clause to a template reference to the other member, and an irrelevant note.

Configuration and provenance. A13 to A16 ran on DeepSeek through a proxy (deepseek-v4-flash, then deepseek-flash after the provider changed the served model beneath the request name on 10 September 2026, detected by the resolved model archived per call and handled by requalification). Every call is archived with its resolved model; seeds with any call under an unaccepted identifier are excluded from the preregistered denominator by a frozen rule.

The carrier for both Part II studies (A17 and A18) is gpt-6-astra at medium reasoning effort, run through the Codex CLI’s non-interactive mode on a subscription login, with the CLI’s tool surfaces disabled and the experiment’s instructions replacing its own; every call is archived with its usage. That carrier was selected by a precommitted ordering from a qualification set of five named models in nine configurations over twelve three-seed runs (section 7); it produces history-grounded references at a high rate and, as it turned out, almost only event references.

Part I. History-grounded reference and transfer

4. A13 and A14: reference forms, and the boundary reverses it

A13 (development seed 10, then two reserved seeds) established that the configuration produces partner-indexed historical references with the budget bounded: seed 10 produced 12 of 12 historical references, 11 of 12 with production fidelity, and 12 of 12 faithfully interpreted by the partner; both reserved seeds succeeded. It closed as a successful prerequisite test.

A14 fixed sixteen confirmatory seeds in advance. The shared-history advantage formed behaviourally in all sixteen; the preregistered denominator is 14 of 16 (0.875; exact interval 0.62 to 0.98), two seeds being excluded because one call in each was recorded under a namespaced identifier; the adjudicated equivalence reading is 16 of 16 (0.79 to 1.00). Every seed passed both gates with zero wrong answers (0 wrong of 1,536 qualification items and 0 at the post-formation gate), produced historical references in at least 10 of 12 probe notes (186 of 192 overall), and showed the advantage. Of the 192 notes, 4 were empty at the budget after the re-ask; the attribution classifier finds 177 factual, 3 carrying a false event attribution and 8 it cannot check (negative act references, true of the target on inspection), the last group including the 2 notes the history classifier does not count as historical.

Crossing the history boundary is a reversal, not a degradation. Over the fourteen seeds the transfer penalty (outsider error minus partner error) was 0.95 (0.90 to 0.98; minimum 0.75): across 168 outsider acts the outsider chose the wrong member 159 times, abstained 6 times, produced no parseable act twice and was right once. The cold penalty over the same fourteen seeds was the same size, 0.95 (0.92 to 0.98). On the sixteen-seed behavioural reading, cold receivers abstained 190 times in 192, the coherent swap moved the partner’s choice in 104 of 104 eligible constructions, and the irrelevant note left the pair untouched 192 of 192. Three false event attributions and the partner’s faithful-but-wrong or refusing responses to them are recorded individually.

5. A15: does the boundary have structure?

A15 added a third group sharing A’s events with mirrored acts, to ask whether transfer follows events, acts, or the whole history. A15.2 requalified the changed model (3 of 3 seeds formed; not a population estimate). A15.3’s reading was “other”: two of three conditions held, and the third failed through a construction error that made the “foreign” group share the second sender group’s acts (erratum A15.4). Its exploratory split by reference type suggested the specific hypothesis A16 then tested: that transfer follows the dimension of history the reference depends on.

6. A16: the scope of a reference follows the dimension of history it depends on

Design. Five groups. Relative to the senders’ group A, group E witnesses A’s pair events and performs A’s pair acts (both: a stranger with an identical history); C shares events only; D acts only; B neither. Every relation was computed from the generated schedules, written to the driver log before the first call, and asserted by the runner before every probe. Twelve fresh seeds; three draws of six probes; each note to the partner, an E, C, D and B member and a cold receiver. Amendment A16.1 removed the pre-formation gate with its consequences stated; A16.2 and A16.3 raised the spend ceiling by ruling before the second batch, no outcome read.

Execution. Every one of the 6,994 calls resolved to deepseek-flash; no seed route-substituted, lost or restarted; all twelve reached the probes; no wrong answer in 2,064 answerable gate items; the advantage formed in 12 of 12 (0.74 to 1.00).

The reading: dimension-specific, in the precedence inconclusive → unexplained → dimension-specific → identity → content-general → other, with every check printed beside the verdict:

check	value	verdict
adequacy: ≥ 24 event-only and ≥ 24 act-only notes, ≥ 4 seeds with both	58 event-only, 111 act-only, 12 seeds	met
receiver sharing nothing above 0.25 overall	23 of 216 = 0.11	no
event notes: events_only − acts_only ≥ 0.5, interval excludes 0	0.92 (0.86 to 0.97), seed minimum 0.75	yes
act notes: acts_only − events_only ≥ 0.5, interval excludes 0	0.60 (0.40 to 0.76), seed minimum −0.10	yes
off-dimension rates at most 0.25	16 of 111 = 0.14; 0 of 58 = 0.00	yes
receiver sharing both at least 0.5 on both pure types	51 of 58 = 0.88; 85 of 111 = 0.77	yes

Table 1. Relation × reference type, pooled over twelve seeds (216 notes).

receiver’s relation to the sender	event-only notes	act-only notes	mixed notes	all 216
within (the partner)	52 of 58	102 of 111	34 of 38	196
both (E: matching planned schedules, different agent; recorded acts diverged on 58 of 420 pair-day acts across groups)	51 of 58	85 of 111	33 of 38	170
events only (C)	51 of 58	16 of 111	28 of 38	99
acts only (D)	0 of 58	84 of 111	1 of 38	88
neither (B)	0 of 58	18 of 111	1 of 38	23
cold	0 of 58	0 of 111	0 of 38	0

The 216 notes are 58 event-only, 111 act-only, 38 mixed, 8 the classifier resolves to nothing and 1 empty at the budget; the nine outside the three type columns are inside the “all 216” column and every denominator.

An event reference resolved for receivers whose history held the event (partner, identical-history stranger, events-only stranger: 154 of 174, each at about 0.9) and for no receiver whose history did not (0 of 174). Event overlap was necessary in these observations, not sufficient (20 of 174 failed with it). An act reference resolved for receivers whose history held the act (0.92, 0.77, 0.76) and rarely for those whose did not (0.14, 0.16, 0.00). Mixed notes went with the event dimension.

Identity against content. “Identical history” here means identical planned schedules: the relation table is computed from the generated schedules, and the recorded acts diverge from the plan on 58 of 420 pair-day acts (mostly a day-2 inspection made before any event distinguishes the members, and a day-11 no-op), so a both receiver can hold a day-2 act on the other member than its sender. With that limit stated, the identical-history stranger matched the partner on event references (seed-level both − within −0.00, −0.04 to 0.03) and fell short on act references (17 of 111, 15.3 points pooled; −0.11, −0.19 to −0.03, seed-level). Shared history explains substantial transfer across agent identity; identity independence is not established. Exploratorily, the remaining act-reference gap sits on recency-indexed references (“yesterday”), not on dated ones.

The accepted wording. A16 prospectively reproduced dimension-specific reference resolution under crossed receiver histories, with all preregistered checks and adequacy floors passing. Event references transferred almost equally to the partner and an identical-history stranger, and never resolved in receivers lacking the relevant event history. Act references showed substantial dependence on shared act history, with residual success without that history and a remaining partner advantage. The result supports history-dependent interpretation and substantial transfer across agent identity, within the tested model and task.

Audit limits, recorded after acceptance. Thirteen of the 216 notes have no unique classifier referent. The “shared acts” relation is computed from the planned schedules; the recorded acts match the plan on 362 of 420 pair-day acts, the divergence sitting where the schedule makes it inevitable (a day-2 inspection before any event distinguishes the members; a day-11 drawdown of a member already at the target level). Thirteen asserted gate answers to unanswerable act questions are recorded as false event attributions beside zero wrong scored answers.

7. The cross-family qualification set: production, qualification, and the unresolved transfer scope

To carry the programme beyond one family, five named models (Qwen 3.8 Max, Claude Sonnet 5, Claude Haiku 4.5, Claude Opus 4.8, gpt-6-astra) in nine configurations over twelve three-seed runs were put through the same pair-design qualification (three fresh seeds each; the same gates, classifier and advantage rule; retained whatever the verdict). Three things must be kept apart: observed production of history-grounded references, the qualification decision under the registered rule, and the transfer scope, which the qualification does not test.

Table 2. The qualification set.

configuration	pathway	explicit gates (qualification; post-formation)	historical references in probe notes	premise rejection	seeds forming the advantage	decision (archived; and under the written rule where it differs)
Qwen 3.8 Max, thinking off	proxy	qualification 24 of 24 every agent, 0 wrong; post-formation 12 of 12 every agent, 0 wrong	12 of 36 (low)	0	0 of 3 under the written rule (1 of 3 on pair performance alone)	scientific result, no advantage
Qwen 3.8 Max, low effort	proxy	qualification: seed 75 one wrong answer (a1 23 of 24), seed 76 one abstention (a2 23 of 24), else 24 of 24; post-formation 10–12 of evaluable, 0 wrong	13 of 36 (low)	8 of 36	0 of 3	scientific result, no advantage
Claude Sonnet 5, default	Claude Code	seed 79 failed the post-formation gate by two abstentions, 0 wrong; others passed	0 of 24 (the third seed’s production unmeasured after the gate stop)	18 of 24	0 of 2 probed	capability failure (gate abstention)
Claude Sonnet 5, default, second sample	Claude Code	passed, 0–2 wrong	1 of 36 (low)	23 of 36	0 of 3	scientific result, no advantage
Claude Sonnet 5, xhigh	Claude Code	passed, 0–1 wrong	1 of 36 (low)	25 of 36	0 of 3	archived: capability failure (7 invalid acts against the drivers’ cutoff of 6 in total); written rule: scientific result, no advantage (cutoff 18)
Claude Haiku 4.5, default	Claude Code	passed, 0 wrong, 0 abstentions	14 of 36 (4, 6, 4)	0	pair performance 2 of 3; written rule 0 of 3 (production below 10 of 12 in every seed)	scientific result, no advantage
Claude Haiku 4.5, default, second sample	Claude Code	passed, 0 wrong, 0 abstentions	21 of 36 (7, 7, 7)	0	pair performance 3 of 3; written rule 0 of 3	archived: qualifies (implemented predicate), then ruled ineligible on multiplicity; written rule: scientific result, no advantage
Claude Opus 4.8, default (two samples)	Claude Code	abstentions at the gates, 0 wrong; one seed of six probed	0 of 12 probed (five seeds unmeasured after gate stops)	9 of 12	0	capability failure (gate abstention)
Claude Opus 4.8, xhigh	Claude Code	qualification unevaluable by abstentions, 0 wrong	unmeasured (no seed probed)	—	0	capability failure (gate abstention)
gpt-6-astra, medium	Codex CLI	passed, 0 wrong, 0 abstentions	35 of 36 (12, 11, 12)	0	3 of 3 under the written rule	qualifies
gpt-6-astra, high	Codex CLI	passed, 0 wrong, 0 abstentions	36 of 36	0	3 of 3 under the written rule	qualifies

Observed production. History-grounded reference is produced beyond DeepSeek: by gpt-6-astra at both efforts (35 and 36 of 36 notes; partner 30 and 36 of 36 against cold 0; transfer penalties 0.50 to 1.00) and, at a lower rate, by Claude Haiku 4.5 (14 and 21 of 36; a pair-performance advantage, partner − cold ≥ 6 with outsider ≤ 6, in 5 of 6 seeds; the written production threshold of 10 of 12 in none). It is not universal, and production and qualification are reported apart: Qwen 3.8 Max produced at a low rate (12 and 13 of 36) without the advantage; Claude Sonnet 5’s probed seeds produced 0 of 24, 1 of 36 and 1 of 36 across three samples; Claude Opus 4.8’s one probed seed produced 0 of 12; eight of its nine seeds across the three runs never reached the probes, so their production is unmeasured. Two distinct non-production behaviours are recorded and kept apart: gate abstention (Opus 4.8 at every effort, and Sonnet 5’s seed 79: explicit null answers with reasoning that the agent’s own tags cannot be trusted across days, never a wrong answer) and premise rejection in the notes (Sonnet 5 and Opus 4.8 wrote, in 18 of 24, 23 of 36, 25 of 36 and 9 of 12 notes, that the two members were indistinguishable or that the receiver should act on either or both; none of 408 DeepSeek notes does so).

Qualification decisions, with an audit. The registered rule requires all three seeds of a run probed on evaluable gates and each forming the advantage: production ≥ 10 of 12, partner − cold ≥ 6, outsider ≤ 6. An audit after the manuscript drafts found that the implemented predicate omitted the production threshold, and that the drivers applied the invalid-act cutoff as more than 6 in total rather than more than 6 per seed on average. Archived decisions are preserved; under the written rule gpt-6-astra qualified at both efforts and no other configuration did. Haiku’s second sample had been decided as qualifying on the implemented predicate and then ruled ineligible on multiplicity grounds (its first sample had already failed; a rule under which any later attempt could qualify would rise in probability with every attempt); under the written rule it does not qualify at all (7 of 12 in every seed), which leaves the ruling moot but recorded. Sonnet 5 at xhigh, archived as a capability failure on the drivers’ cutoff (7 invalid acts), is a scientific result without the advantage under the written cutoff; it remains ineligible. The carrier for the subsequent repair study was selected from the qualifying configurations by an ordering precommitted before their results: tokens a call including reasoning, then wall clock; gpt-6-astra at medium.

Within-model effort. Raising effort did not reliably make a configuration suitable. Sonnet 5 at xhigh tripled its thinking tokens and wrote the same notes; Opus 4.8 at xhigh thought thirteen times longer and abstained more at the competence gate. gpt-6-astra produced at both efforts with 18 and 43 reasoning tokens a call. A large reported reasoning-token count is therefore not established as necessary for production; deliberation length is not ruled out as an influence, token counts are not directly comparable across pathways, and why configurations differ remains open.

The unresolved transfer scope. The qualification tests production and the pair-level advantage; it does not test dimension specificity. That test was run once on the second family as the R0 stage of the repair study (A17) on twelve fresh seeds: eleven probed (seed 109 stopped at its post-formation gate by abstentions, zero wrong), two draws a probe rather than the frozen three (amendment A17.2), an extra qualification gate on seed 108 that the frozen design did not carry (A17.1), and a seven-hour pause at the plan’s weekly usage cap resumed by a dated decision (A17.3). Its formal crossed reading is inconclusive: the carrier wrote 82 event-only, 10 act-only, 33 mixed and 7 unresolved notes in 132, below the act-note floor. Descriptively, the event-dimension pattern was reproduced: event references resolved for receivers whose history held the event (0.84, 0.87, 0.72 for partner, both and events_only) and not for receivers whose did not (0.09, 0.06, 0.00), with the preregistered event contrast at 0.65 (0.46 to 0.82) over the ten of the eleven probed seeds that carried event-only notes (seed 112 carried none). The act dimension was neither descriptively reproduced nor found wanting: the carrier produced too few act references (10 of 132 notes) to meet the adequacy floor. The formal dimension-specific result therefore remains within one family.

Part II. Authority and reference repair

8. A17: the repair study, inconclusive by its floors

8.1 Design

Twelve fresh seeds. Stage R0 ran the crossed design: formation, the post-formation gate, and two draws of six probes, each note sent to all six arms. Then five receiver-side passes over the frozen checkpoints and the frozen notes, the sender never called again:

condition	what the receiver gets
R0 none	the note
R1 re-expression	the note with its reference clause replaced by a scripted description in the receiver’s own history: the member’s events as the receiver’s group’s schedule put them, then the receiver’s two most recent recorded acts on it, chronological
R2 evidence in prose	the note plus one sentence naming the receiver’s tag for the member
R2r evidence retained	the note; a correspondence block for both members, in the sender’s terms, prepended to the receiver’s notebook for the stage
R3 shared index	the note; the receiver may reply LOOKUP: <the note's words> once, and is answered from the frozen note-level classification with the tag or “no entry”, then called again to act
R3′ shuffled index	as R3, answering with the other member’s tag

One pipeline served every repair: the frozen classification of the note (which member it describes, or unresolved) mapped by the apparatus to the receiver’s tag and to the receiver’s own history of that member. Predicates on paired seed-level differences with percentile-bootstrap intervals (10,000 resamples), a truth table fixed before the summarizer was written, and adequacy floors carried from the earlier study: at least 24 event-only and 24 act-only notes and four seeds carrying both.

8.2 Execution

Eleven of twelve seeds probed; seed 109 stopped at its post-formation gate by abstentions with zero wrong answers. 10,432 archived calls against a 22,000 ceiling, counting every attempt; no retried call, no empty completion. Two driver deviations from the frozen text were caught from call counts and amended before the next seed: a pre-formation gate on the first seed that the frozen design did not carry, and two draws a probe where the text said three. A seven-hour pause at the plan’s weekly usage cap was resumed by a dated decision. All are in the record.

8.3 Verdicts

All four preregistered questions are inconclusive. The carrier wrote 82 event-only, 10 act-only, 33 mixed and 7 unresolved notes; the act-note floor fails, and by the frozen combination rule a failed floor makes every contrast inconclusive, including those whose event-note cells are full. R0’s own preregistered crossed reading is inconclusive for the same reason. The floors were carried unchanged from a study on a family that wrote act references in half its notes; this carrier writes contrastive event references almost exclusively (“the one that leaked on Day 3 and was sound again on Day 4, not the one tainted on Day 6”).

8.4 The event-note cells, descriptively

Successes of 82 event-only notes, pooled over the ten of the eleven probed seeds that carried event-only notes (seed 112 carried none). No verdict is claimed on any of this.

receiver	R0 none	R1 re-expression	R2 sentence	R2r block	R3 index	R3′ shuffled
within (partner)	69	70	72	76	76	70
both	71	74	73	76	75	65
events_only	59	60	73	75	75	48
acts_only	7	64	14	23	26	1
neither	5	61	15	16	28	1
cold	0	0	57	76	74	1

Four things stand out, and they are why A18 exists.

1. The event-dimension pattern of the earlier family was descriptively reproduced. Event references resolved in receivers whose history held the event (0.84, 0.87, 0.72) and not in receivers whose did not (0.09, 0.06, 0.00). The formal verdict is inconclusive.
2. Re-expression in the receiver’s own history terms lifted the uninformed cells almost to the informed baseline: +0.70 (0.46 to 0.91) and +0.64 (0.42 to 0.85) over R0 on ten paired seeds. Against the partner on the same notes the differences were −0.05 and −0.12 with lower bounds below the −0.15 restoration margin. Cold receivers stayed at zero: there is no record to re-express into. This is apparatus-assisted re-expression; it says nothing about a model constructing the translation.
3. A correct correspondence merely made available was used by receivers without a history and was often ineffective for receivers with one. The sentence, the block and the index took cold receivers from 0 to 57, 76 and 74 of 82, and took the uninformed history-bearing receivers to between 14 and 28 of 82. Their failures were wrong members (60 and 62 of 82 under R2, 57 and 66 under R2r): the receiver followed the note’s history into its own record and chose the other cistern. Under the optional index, history-bearing receivers consulted it in 26 and 29 of 82 exchanges and cold receivers in 82 of 82; nearly every lookup was followed by the right act. The limiting step was consulting, not the answer.
4. The shuffled index reduced correct selection to 1 of 82 in the acts_only, neither and cold cells (wrong member 78 to 81), while the informed cells fell to 70, 65 and 48 of 82; the index’s effect depended on its correctness.

Usage per completed exchange, from the archive: the index cost 8,592 tokens against 6,467 for the retained block and 6,406 for the sentence, input-dominated; the index paid a second call where a lookup occurred.

A17 thus left three things entangled: having a correspondence, consulting it, and treating it as authoritative over one’s own record. The reviewers’ ruling was to test that with a smaller study on the same cases rather than search for another carrier or re-run the formation grid.

9. A18: an explicit authority instruction on the same cases

9.1 Design

A prospective intervention on a previously examined corpus. The eleven A17 checkpoints (formed receivers with model-written notebooks and clerk records) and their 82 frozen event-only notes; the arms within, acts_only, neither and cold (both and events_only are informed on event notes and were dropped); one receiver call per exchange; no formation, no gates, no sender calls. Seed 112 holds no event-only note and contributes no rows.

Five conditions, each a receiver-side pass. C0 is the note alone and C1 is A17’s re-expression, re-run inside A18 so that every contrast is within-study. C2, C4 and C5 deliver one identical payload in the policy block after the note, built by the apparatus from the frozen note-level classification, and differ in one sentence. The strings were frozen verbatim before any call and no alternative was tried against the cases:

Registry correspondence for this note: the cistern described by the note is your tag {tag}. Determine the operation and quantity using the note and today’s tally.

followed by, for C2, “For target selection, treat this correspondence as advisory.” and, for C4 and C5, “For target selection, treat this correspondence as authoritative over your own record.” C5 differs from C4 only in the tag: the other member of the pair. This tests the effect of an explicit authority instruction; it does not mechanically bind the receiver, which could disregard it.

Readings: seed-level rates per cell; paired seed differences with percentile-bootstrap intervals; the earlier predicates and truth table with equivalence removed as a primary verdict after a zero-call power check on A17’s dispersion showed it could not resolve at ten seeds; a coverage floor for the event dimension alone (48 event-only notes over six seeds carrying four each) applied to each contrast’s completed, paired material. Named cells: acts_only × event and neither × event. Verdicts: authority = C4 − C2 superiority (mean ≥ 0.10, lower bound > 0); correctness = C4 − C5 dependence (≥ 0.25, lower bound > 0); restoration = C4 against the partner on the same notes (lower bound > −0.15); translation against authority = C4 − C1 and C1 − C4 superiority, both reported; drift = C0 against A17’s R0.

9.2 Execution

1,640 archived calls, exactly the plan, in 51 minutes; no retry, no empty completion; every pass complete on the ten seeds with event notes; floors met for every contrast; the prespecified drift flag was not triggered (C0 against A17’s R0: −0.00 and −0.05, intervals including zero).

9.3 Results

Table 4. Successes of 82 event-only notes, pooled over ten seeds.

receiver	A17 R0	C0 none	C1 re-expression	C2 advisory	C4 authoritative	C5 authoritative, shuffled
within (informed baseline)	69	73	71	71	77	1
acts_only	7	7	65	16	76	1
neither	5	1	69	18	77	1
cold	0	0	0	60	74	1

Table 5. Verdicts (both named cells; ten paired seeds; 95 % intervals).

question	contrast	acts_only × event	neither × event	verdict
Authority	C4 − C2 superiority	+0.76 (0.56 to 0.92)	+0.71 (0.56 to 0.84)	supported
Correctness	C4 − C5 dependence	+0.90 (0.76 to 1.00)	+0.91 (0.78 to 1.00)	supported
Restoration	C4 − C0’s within (73 of 82), same notes	+0.05 (−0.03 to +0.16)	+0.06 (0.00 to +0.16)	supported
Authority against translation	C4 − C1 superiority	+0.13 (0.00 to 0.32)	+0.12 (0.00 to 0.29)	other
Translation against authority	C1 − C4 superiority	−0.13 (−0.32 to 0.00)	−0.12 (−0.29 to 0.00)	other
Advisory alone	C2 − C0 improvement	+0.09 (0.01 to 0.18)	+0.21 (0.09 to 0.35)	other
Translation alone	C1 − C0 improvement	+0.71 (0.49 to 0.91)	+0.80 (0.60 to 0.95)	supported

Table 6. Outcomes behind the rates, uninformed and informed cells.

condition and cell	success	wrong member	abstained	refused	other
C2 advisory, acts_only	16	56	10	0	0
C2 advisory, neither	18	56	6	0	2 (wrong op)
C2 advisory, cold	60	0	9	2	11 (malformed 9, wrong op 2)
C4 authoritative, acts_only	76	1	1	4	0
C4 authoritative, neither	77	1	0	4	0
C4 authoritative, cold	74	1	0	6	1 (wrong op)
C5 shuffled, acts_only	1	80	1	0	0
C5 shuffled, neither	1	81	0	0	0
C5 shuffled, cold	1	81	0	0	0
C5 shuffled, within	1	81	0	0	0

The single success in each C5 cell is the same exchange, seed 111’s, in which the sender’s note described the wrong member (a faithful miss), so the shuffled correspondence happened to name the task target: that was compliance with the shuffled mapping, not resistance to it; mapping fidelity and task correctness are different things.

Usage per completed exchange, from the archive: input about 6,050 tokens in every condition (the payload adds about 40); output tokens with reasoning tokens in brackets: C0 72 (49), C1 66 (43), C2 102 (80), C4 39 (16), C5 40 (17). Reasoning tokens under the authoritative sentence were about a fifth of those under the advisory one, roughly an 80 % reduction; a descriptive accompaniment, not evidence that verification stopped.

9.4 Restoration and systematic misdirection, together

The same correct correspondence, presented as advisory, left the uninformed receivers near the boundary (16 and 18 of 82) with wrong members dominant (56 and 56); presented as authoritative, it restored them to the informed baseline (76 and 77 of 82, against the partner’s 73 under C0, the comparator the analysis uses; the partner reached 77 under C4 itself). The authority verdict is supported in both named cells with intervals well clear of the margin, on a payload held constant to the sentence.

The same authoritative instruction with the correspondence shuffled redirected 80 to 81 of 82 receivers in every cell, and 81 of 82 in the partner cell, where the receiver’s own record supported the correct answer. Correct prior information did not protect the receivers’ answers against a shuffled authoritative mapping. Whether they evaluated the conflict and nevertheless prioritised the instruction, or did not evaluate it, is not something this design observes. C4 − C5 is the dependence on mapping correctness under the instruction; it is not evidence of binding in any mechanical sense.

Translation and authority are close in the named cells and neither direction met the superiority criterion there (C4 − C1 of +0.12 to +0.13 with lower bounds at zero; no equivalence claimed). They differ where the receiver has no history: re-expression achieved 0 of 82 for cold receivers, the correct authoritative correspondence 74 of 82. Re-expression relies on context these formed receivers possess. The advisory result is small but above zero (+0.09 and +0.21; not the 0.25 margin): having the mapping, without an instruction to prefer it, is worth little to a receiver with a competing story and a great deal to one without.

Discussion, methods and evidence

10. Discussion

10.1 History and transfer

What is demonstrated. On one model configuration, history-grounded reference formed in every attempted history, resolved for the partner, reversed for an outsider with a different history, and, in a crossed design with all floors met, followed the dimension of history it depended on: events transferred to any receiver holding the event, acts substantially to receivers holding the act, with a residual partner advantage on act references. Shared history explains substantial transfer across agent identity; identity independence is not established. Production of such references occurs in other models and is configuration-dependent. Explicit resolution competence is separable from spontaneous production: Qwen 3.8 Max at both settings and Claude Sonnet 5’s probed seeds passed the explicit gates and produced few or no history-grounded references. Gate abstention (Opus 4.8; Sonnet 5 seed 79) is a third behaviour and does not demonstrate resolution competence.

What is not. Cross-family dimension specificity is not established: one family formally, a second descriptively on the event dimension only. Nothing here establishes that an explicit belief graph or a non-linguistic architecture is required to achieve the behaviour. The recency-indexed act gap is exploratory. The provider’s model change under a stable name, detected by per-call provenance, is a limit on any claim that names a model rather than an archived configuration.

Proposed consequences, distinguished from demonstrated behaviour. For the programme’s architecture, the demonstrated behaviour is that an agent’s interaction history can become part of what a message requires for successful interpretation, and that the requirement is dimension-specific. The proposed consequence is that reference infrastructure shared across agents must carry both dimensions of the history it is meant to bridge; what it takes for such infrastructure to be used when a receiver holds a competing history is the subject of Part II.

10.2 Authority and repair

What is demonstrated. In this setting, authority makes a supplied correspondence govern interpretation; it does not ensure that correspondence is true. The same intervention produced both restoration and coordinated error, on the same receivers and notes, with the payload held constant. A17’s descriptive pattern, that availability alone was often ineffective for receivers holding a competing history, is the reason the comparison was worth making; A18 supplies the supported contrasts. We do not present “availability versus authority” as a fully isolated mechanism: A18’s design separates the authority sentence from the advisory one and the correct mapping from the shuffled one; it does not separate every factor that differed between A17’s delivery channels and A18’s.

Registry correctness as an upstream dependency. For this intervention, the correctness of the supplied correspondence is a critical upstream dependency: with the correspondence wrong, the instruction produced near-total misdirection, and the receivers’ own correct records did not protect them. A18 observes the receivers’ responses, not whether they checked anything; it does not show that receivers cannot check authority, provenance or consistency under a different design.

Proposed engineering consequences, distinguished from demonstrated behaviour. The programme’s motivating architecture has a Rules plane that is meant to bind interpretation across agents with divergent histories. A18 gives that plane a demonstrated mechanism and a demonstrated failure mode on one carrier: an explicit authority instruction over a registry correspondence transfers whatever the registry holds. The engineering consequence we propose, not demonstrate, is that an authoritative lookup needs its own way to establish that its entries deserve authority; receiver compliance cannot supply that assurance. Whether an executor that mechanically constrained target selection would behave the same, whether receivers could be given grounds to check authority, and whether the mechanism holds across families are open.

The failure class, placed beside its neighbour. The act that fails here is procedurally valid: the receiver holds the authority to act on either cistern, the world accepts the act, and the task fails because the act reached the wrong one of two otherwise valid objects. That is a different failure class from the one measured in our work on an executable institution (Where Reliability Lives, arXiv:2609.03192, §5.4), where one falsehood delivered as trusted testimony drove roughly nine hundred futile acts per believing run and the authoritative ledger refused every one of them. The two results come from different apparatuses. Together they illustrate two distinct failure classes, a false premise contained by authority and a wrong referent that authority does not see; they do not demonstrate that one deployed gate admits reference errors, and no study has run a reference error and an authority check on the same apparatus. What the two records support is narrower: an authority check adjudicates whether an actor may act on an object, and nothing in either apparatus adjudicated whether the object was the one the sender meant. The engineering consequence we propose, not demonstrate, is that this binding is a check distinct from authority, provenance and admissibility, and that where it lives in an agent architecture has to be established rather than assumed.

Limits. One carrier, one corpus of previously examined cases, one instruction pair frozen verbatim without alternatives; the event dimension only; two draws a probe in the underlying corpus; the CLI pathway reports no answering model per call; usage is tokens on a subscription, not a bill; A17’s descriptive findings are descriptive.

10.3 Taken together

Part I shows, on one family with every floor met, that the failure at the history boundary is a systematic wrong choice specific to the dimension of history a reference depends on. Part II shows, on a second family and one corpus of such cases, what bridging that boundary took: not the availability of a correct correspondence, which was often ineffective against a competing history, but an instruction to prefer it, and the same instruction transferred a wrong correspondence just as completely. The two results are bounded separately and neither is claimed for models or tasks not run. The broad ideas are in the literature; what this programme adds is the controlled separation of which history supports which reference, the measured form of the failure at the boundary, and the measured difference between advisory and authoritative presentation of one correspondence, under preregistered readings with the deviations and audits in the record.

11. Methods

11.1 Discipline, statistics and pathways (both parts)

Discipline. Four kinds of record, kept apart: the initial preregistration of each study, committed before its first call; prospective amendments, each committed before the calls it governs; deviations found in flight, disclosed and dated when found (A15.4, A17.1, A17.2); and retrospective corrections and audits after results, recorded with the original outputs preserved (A14.2’s classifier corrections; the 2026-09-12 qualification audit). Then: the seed as the replication unit; fixed N; every attempted seed accounted for, including failed and restarted attempts; readings computed mechanically in a fixed precedence with floors; construction verified from the generated histories at launch after A15.4; accepted model identifiers frozen and the resolved model archived per call; spend or call ceilings enforced by the drivers; per-seed summaries decide nothing; each report run once.

Statistics. Seed-level estimates with percentile-bootstrap intervals (10,000 resamples, generator seed 20260909); exact Clopper–Pearson intervals for seed counts; contrasts on paired seed-level differences; adequacy floors stated per study.

Pathways. DeepSeek through a proxy with the resolved model archived per call (A13 to A16). Claude models through Claude Code’s headless mode on a subscription login, tools and settings off, a neutral working directory, non-essential traffic disabled, the full model identifier pinned after alias drift was observed, the answering model and thinking tokens archived per call. Qwen through a proxy with the reasoning setting passed as an option. gpt-6-astra through Codex CLI’s non-interactive mode with its tool surfaces disabled; the event stream reports no model per call, stated as a limit.

11.2 Part II specifics

Carrier and pathway. gpt-6-astra, model_reasoning_effort="medium", Codex CLI 0.154.0 (codex exec --json) on a subscription login, the experiment’s system prompt replacing the CLI’s instructions, 33 tool surfaces disabled by name, read-only sandbox in an empty directory, ephemeral sessions, no history, user configuration ignored, the memories feature off by default. Each call archived with input, cached input, output and reasoning tokens and wall time; the event stream carries no model string, so the requested identifier is the accepted identifier and this limit is stated.

Apparatus. The waterworks world; the crossed design with groups A to E, relations computed from the generated schedules and asserted before every probe; the post-formation competence gate with the evaluability rule; the A14.2 attribution classifier; the v2 coherent swap and the irrelevant-message control in R0.

Pipeline. For every frozen note, the archived note-level classification (described member or unresolved) mapped to the receiver’s tag and, for re-expression, to the receiver’s group’s events for the member and the receiver’s recorded acts on it (two most recent, chronological; abstentions and off-target acts excluded). A note describing the other member is repaired to the member described and scored as a faithful miss. Unresolved notes deliver nothing under R1, R2, R3 and R3′; R2r’s block is present regardless; none of A18’s 82 notes is unresolved.

Analysis. Seed-level success per cell; paired seed differences over seeds where both conditions completed; percentile bootstrap, 10,000 resamples, generator seed 20260909; predicates: improvement and dependence mean ≥ 0.25 with lower bound > 0 (contradicted when the upper bound ≤ 0); restoration lower bound > −0.15 (contradicted when the upper bound < −0.15); superiority mean ≥ 0.10 with lower bound > 0 (contradicted when inferiority is established); equivalence whole interval within ±0.10 (A17 only); inconclusive when fewer than four paired seeds or a floor is unmet; else other. Cells combine inconclusive → contradicted → supported → other. A17 floors: 24 event and 24 act notes, four seeds with both. A18 floor: 48 event-only notes over six seeds carrying four each, on each contrast’s paired material.

Execution rules. Sequential seeds, four workers; every attempt archived and counted against the ceiling; a pass ending without its record kept, the CLI awaited, restarted once, then recorded incomplete; a standing five-minute health check; the analysis run once after every pass; per-seed summaries decide nothing.

Evidence appendix

A. Part I

Commits are in the repository’s history; every frozen text and amendment is in notes/panel/prereg-grounded-dialects-prepilot.md.

A13 preregistered at aac5d43; reserved seeds 11 and 12 recorded at d316421; ruling f091285; notes/panel/grounded-dialects-a13-result.md; records a13-s10…12-deepseek. A14 preregistered at 78fa0bb; A14.1 (rerun after a proxy outage) b13489a; A14.2 (classifier corrections after the result, the as-preregistered report preserved) in the preregistration; ruling 181d9bb; grounded-dialects-a14-result.md; records a14-s13…28-deepseek; reports a14-population.json, a14-population.all16.json, a14-population.prereg.json; every seed’s gate numerators, formation outcomes, notes, factual counts, swaps and transfer penalty tabulated in the note. A15 preregistered at 3388de1; A15.1 (mechanical reading) 36c1b43; A15.2 (the provider-side model change; requalification) 220ed3e; A15.3 (the structure study resumed on deepseek-flash) ecb3895; A15.4 (the construction erratum) in the preregistration; grounded-dialects-a15-2-result.md, grounded-dialects-a15-result.md; records a15-s29…59; report a15-structure.json. A16 preregistered at 27eaecd; A16.1 a5a3542; A16.2 6ef7f67; A16.3 50be940; grounded-dialects-a16-result.md with the audit note appended after acceptance; records a16-s60…71-deepseek-flash; report a16-crossed.json. A17.0, the qualification set preregistered at 30f3b1c (Qwen), with A17.0c–e (Claude) in the preregistration, A17.0f 2cbd00e (gpt-6-astra), A17.0g 289ae53 and A17.0g.1 f93e461 (effort); result notes grounded-dialects-a17-0-result.md, grounded-dialects-a17-0-claude-result.md, grounded-dialects-a17-0f-result.md; decision files a17pre-decision-*.json; records a17pre-s72…107; the carrier ordering and the multiplicity ruling in the preregistration; the qualification audit (2026-09-12) tools/audit_qualification.py, a17pre-qualification-audit.json and its addendum. A17 R0 frozen at 2b5f99e (implementation 86d8e06); A17.1 e20d5bc; A17.2 49b44e6; A17.3 78537f1; grounded-dialects-a17-result.md; a17-r0-crossed.json; records a17-s108…119-codex-gpt-6-astra. The packaging ruling for A13 to A16: grounded-reference-scope.md.

B. Part II

A17. Frozen text notes/panel/a17-freeze-proposal.md (39c9908, after six reviewer corrections); preregistration entry A17 (2b5f99e), implementation signature 86d8e06; amendments A17.1 (no pre-formation gate from seed 109; e20d5bc), A17.2 (two draws; 49b44e6), A17.3 (the weekly-cap pause and the dated resumption). Records results/dialects/history/a17-s108…119-codex-gpt-6-astra, driver log a17-driver.log; analysis a17-repair.json (every cell with success, wrong member, abstention, unresolved, faithful miss and lookup use; every contrast with mean, interval, paired seeds and verdict; usage per condition); R0’s crossed analysis a17-r0-crossed.json. Seed 109’s gate: a1, a2 answered 8 of 10 evaluable, zero wrong. Composition of a probed seed: 120 history, 120 notebook, 180 gate, 108 probe calls (seed 108 carried 180 further qualification calls under A17.1).

A18. Frozen text notes/panel/a18-design-proposal.md v2.1 (eb0da6a); preregistration entry A18 (1090174); zero-call power scenarios tools/power_a18.py. Records results/dialects/history/a18-s108…119-codex-gpt-6-astra (seed 112 recorded incomplete at every stage with zero calls); driver log a18-driver.log; analysis a18-authority.json. Per condition, 82 exchanges an arm on ten seeds carrying 12, 10, 6, 10, 5, 7, 11, 8, 7 and 6 event-only notes.

Qualification audit (2026-09-12). The carrier was selected by a qualification whose implemented predicate omitted the written production threshold and whose drivers applied a stricter invalid-act cutoff than written; the audit (tools/audit_qualification.py, a17pre-qualification-audit.json, the addendum in the preregistration) finds gpt-6-astra qualifying at both efforts under the written rule and no other configuration, so the carrier is unchanged.

Reviewer rulings applied. A17: the closure as inconclusive without retrospective event-only verdicts; “descriptively reproduced” not “replicates”; the shuffled index stated as correct selection reduced to 1 of 82 with outcomes kept apart. A18: the behavioural statement of the shuffled-authority result; registry correctness as a critical upstream dependency; the reasoning-token change as roughly 80 % and descriptive; re-expression’s 0 of 82 cold given prominence; the stopping point.

C. The recorded prior-work search

Protocol with collapse conditions written before the search, every query verbatim with date, the hits examined, the verdicts and the API refusals: grounded-reference-search-protocol.md. Outcome: no COLLAPSE on either claim; the near-misses are cited in section 2 with the clause each falls short on. The absence claim in this manuscript is bounded to that search on that date.

References

Verified against their records on 12 September 2026; arXiv identifiers where the work is a preprint or has one.

• Ashery, A. F., Aiello, L. M. and Baronchelli, A. (2025). Emergent social conventions and collective bias in LLM populations. Science Advances 11(20), eadu9368. arXiv:2410.08948.
• Brennan, S. E. and Clark, H. H. (1996). Conceptual pacts and lexical choice in conversation. Journal of Experimental Psychology: Learning, Memory, and Cognition 22(6), 1482–1493.
• Clark, H. H. and Brennan, S. E. (1991). Grounding in communication. In Resnick, L. B., Levine, J. M. and Teasley, S. D. (eds.), Perspectives on Socially Shared Cognition, APA, 127–149.
• Clark, H. H. and Wilkes-Gibbs, D. (1986). Referring as a collaborative process. Cognition 22(1), 1–39.
• Fu, Y., Qiu, R., Wang, X., Sansom, J., Ayyappa Prabhu, S., Tang, H., Kim, J., Sohn, S. and Lee, H. (2026). Beyond blind following: evaluating robustness of LLM agents under imperfect guidance. EACL 2026, long papers, 6591–6618.
• Gao, Yu, Deng, Li and Wang (2026). Testing interchangeability in LLM agent teams. arXiv:2609.05279.
• Hawkins, R. D., Franke, M., Frank, M. C., Goldberg, A. E., Smith, K., Griffiths, T. L. and Goodman, N. D. (2021). From partners to populations: a hierarchical Bayesian account of coordination and convention. Psychological Review. arXiv:2104.05857.
• Jones, C. R., Lombardi, A., Mahowald, K. and Bergen, B. K. (2026). LLMs and people both learn to form conventions, just not with each other. arXiv:2602.08208.
• Kim, J. (2026). Drawing with strangers: population scaling drives zero-shot mutual intelligibility in emergent sketching. arXiv:2606.10582.
• Leong, J. W. (2026). Recognition without enforcement: configuration-dependent failures in LLM agent instruction arbitration and external control. arXiv:2608.28502.
• Lewis, D. K. (1969). Convention: A Philosophical Study. Harvard University Press.
• Li, N., Gatt, A. and Poesio, M. (2026). Seeing is not sharing: some vision-language models overestimate common ground in asymmetric dialogue. SIGDIAL 2026, 694–710. arXiv:2606.31719.
• Li, N., Gatt, A. and Poesio, M. (2025). Grounded misunderstandings in asymmetric dialogue: a perspectivist annotation scheme for MapTask. arXiv:2511.03718.
• Mohapatra, B., Charlot, T., Duca, G., Palan, M., Romary, L. and Cassell, J. (2026). Frame of reference: addressing the challenges of common ground representation in situational dialogs. Findings of ACL 2026. arXiv:2601.09365.
• Schuster, J., Gautam, V. and Markert, K. (2026). Whose facts win? LLM source preferences under knowledge conflicts. arXiv:2601.03746.
• Shih, A., Sawhney, A., Kondic, J., Ermon, S. and Sadigh, D. (2021). On the critical role of conventions in adaptive human-AI collaboration. ICLR 2021. arXiv:2104.02871.
• Shih, B., Winnicki, J. and Cao, A. (2026). How do language models choose between context and memory? arXiv:2609.00753.
• Sun, K., Bai, F. and Dredze, M. (2026). Task matters: knowledge requirements shape LLM responses to context–memory conflict. ACL 2026. arXiv:2506.06485.
• Talebirad, Y., Redman, E., Parsaee, A. and Zaiane, O. R. (2026). From signals to structure: how memory architecture drives language emergence in LLM agents. arXiv:2607.00233. And: Memory is communication: the frontier between remembering and signaling. arXiv:2608.17053.
• Wallace, E., Xiao, K., Leike, R., Weng, L., Heidecke, J. and Beutel, A. (2024). The instruction hierarchy: training LLMs to prioritize privileged instructions. arXiv:2404.13208.
• Wang, P.-Y. A., Mishra, C., Özyürek, A., Rubio-Fernández, P. and Ghaleb, E. (2026). Aligned but not partner-specific: distinguishing how multimodal LLM agents succeed in reference games without human-like conventions. arXiv:2606.08081.
• Wang, Z., Li, W., Kaliosis, P., Rambow, O. and Brennan, S. E. (2025). LVLMs are bad at overhearing human referential communication. arXiv:2509.11514.
• Yamamoto, T., Morita, J., Higashinaka, R. and Takeuchi, Y. (2026). Dissociating communicative success from representational alignment in common ground formation. Frontiers in Computer Science, 10.3389/fcomp.2026.1873726.
• Yan, L., Li, R., Han, X., Li, W., Wang, B., Wang, L., Lyu, C. and Chen, G. (2026). Trust no tool: evaluating and defending LLM agents under untrusted tool feedback. arXiv:2605.17453.
• Yang, H., Song, W., Kim, T., Song, J., Park, S. and Jo, Y. (2026). Agents trust tools too much: measuring reliance on unreliable tools. arXiv:2609.05587.
• Yu, F., Seedat, N., Schwarz, J. R. and Bean, A. M. (2026). To whom do language models align? Measuring principal hierarchies under high-stakes competing demands. arXiv:2605.12120.
• Zeng, P., Li, W., Paige, A. J., Wang, Z., Kaliosis, P., Samaras, D., Zelinsky, G., Brennan, S. E. and Rambow, O. (2026). LVLMs and humans ground differently in referential communication. arXiv:2601.19792.
• Zhang, C., Wan, Z., Yu, X., Zhou, P., Zhao, W., Wu, J., Zhou, Y. and Tsang, I. (2026). Don’t blindly trust it: how unreliable feedback breaks tool-using LLM agents. arXiv:2606.21409.

@misc{marsden2026historygroundedreference,
  title={History-grounded reference in language-model agents: formation, transfer across divergent histories, and repair under authority},
  author={Timothy Marsden and Matthew Collecutt and James Marsden},
  year={2026},
  howpublished={Research note, Taniwha AI},
  url={https://taniwha.ai/research/grounded-reference}
}