# I11 — a temporary guarded defender leaves useful repaired descendants

Prospectively registered at `0280a6c834a18e3153bb54e788bcf93ebd4d7994` before gates and inference. Canonical experiment `EXP-20260913-223146-00843`, run `RUN-20260913-223805-00946`.

## Outcome

The registered primary and useful-repair persistence secondary are supported. At the start of generation 6, the repair-authorised arm had fully functional new descendants in 3/4 maps versus 0/4 in each control. Qwen made 15 fully correct renewals descended from actual Sol repairs after Sol left. Four later correct routes on originally affected signals used these repaired descendants.

| Arm | Functional new descendants at g6 | Total resources g4–6 | Later resources g5–6 | Successful renewals |
|---|---:|---:|---:|---:|
| No defender | 0/4 | 30 | 21 | 24 |
| Read-only defender | 0/4 | 30 | 21 | 24 |
| Repair authorised | 3/4 | 39 | 24 | 21 |

The later reward contrast is +3 against either control, not a doubling. Total reward contrasts by map are +3, −3, 0, +9. Map 1 lost reward despite retaining a correct repair; correctness and action allocation are separate outcomes. No lineage became empty during the measured horizon.

## Actual intervention

Fresh Sol-none calls achieved diagnosis 3/4, patch values 4/4, preservation set 4/4, and exact assembly on all 3 eligible maps, without collateral changes. Map 2 retained a false-positive diagnosis and was blocked by the independent public-information validator. It remains in the denominator and was not rescued. The other three actual model-written payloads were applied in place: no record-identity or expiry extension was granted by the intervention.

Sol left before 144 fresh Qwen decisions over generations 4–6. Qwen saw neither diagnostics nor Sol identity, proposal, explanation or private history. The read-only condition received the same proposal for logging but could not modify the archive; all 48 downstream requests and replies matched the no-defender control exactly. The model was not separately prompted with different authority levels.

## Verification and chronology

22/22 zero-inference gates passed before calls. All 12 defender audit checks and all 16 population audit checks passed, including independent world replay, requests, rewards, expiry, actual payload writeback, primary scoring and absence of a TTL subsidy. Sol used 15 calls / 339 output tokens; Qwen used 144 calls / 4,455 output tokens. Total 159 calls / 4,794 tokens; Sol usage estimate $0.035924 (conservative $0.04321).

The frozen runner wrote `result.json`, whereas the frozen auditor and recorder expected `population.json`. After inference a byte-identical alias was created and documented in `output-path-note.json`; frozen code and model outputs were unchanged and no calls were repeated. Both files are retained in the evidence bundle.

## Interpretation and limits

A temporary stronger model, combined with a deterministic validator and repair authority, corrected shared state that fresh weaker successors then faithfully reproduced and used. This supports a bounded defender architecture, not an autonomous, unguarded or perfectly reliable defender. The validator is part of the intervention; Sol's failed map demonstrates why that boundary matters. No quarantine, deletion, open-ended survival, hostile adversary or security-incident reproduction was tested. Reward benefits were heterogeneous. The evidence does not establish that Qwen diagnosed or independently repaired any error.

Next: present the actual retained, corrupted and guarded-repair trajectories in the video demo, preserving the failed map and measured limits. Further research should separate validation dependence and robustness before broader defender claims.