A newer record does not win by being right.
Working manuscript · v0.1
A newer record does not win by being right.
THE ARGUMENT, IN FIVE LINES
Two claims disagree inside one context.
The old source is still readable.
The new record does nothing at all.
Retire one particular attention read.
The answer changes.
Everything below is how that was measured, what it cost to believe it, and where it stops being true. Read the five lines and the instrument for the shape of it; read the rest for the evidence.
01 / TWO CLAIMS IN ONE CONTEXT
Any memory system that summarises, supersedes or evicts eventually holds two things that disagree: an original passage and a shorter record standing in for it. The engineering question sounds like bookkeeping — which one is authoritative? The measured answer is not a preference the model expresses. It is a property of what the model can still read at the moment it is asked.
THE OPERATION BEING TESTED
Build a 64,000-token context from a verbose source. Then, beside the question roughly 55,000 tokens later, inject a compact record and cut the original sentence off from attention. This is not the same as having the record present from the first token, which is what earlier runs measured. It is the operation an eviction system actually performs: replacing something already in memory.
EVIDENCE
PROMOTION / THREE OPERATIONS
In the founding run, a 13-token record injected about 49,000 tokens downstream of the source keeps the model correct on all three tested operations — copy 7431, plus one 7432, digit reversal 1347 — with the original span excluded. Padding alone fails on every row (7249, 789, 7892) and a corrupted record steers every row (5824, 5825, 4285). Asked for the code plus one with 5824 injected, the model answers 5825: a value that appears nowhere in the context.
WHAT HAD BEEN MEASURED WAS THE DISTANCE
An earlier run concluded that compact records serve reads but not computation. Identical record, model, framing and question; only its position changes. Plus one goes from 12.98 bits, reciting 7431, when the record is ingested 49,000 tokens back, to 0.1472 and the correct 7432 when it arrives at the working boundary. Reversal goes from 15.23 to 0.0610. Moving a fact close to where the model is working returned a capability that was unavailable while it sat far away.
AND PROSE CANNOT SAY “ALREADY DONE”
Injecting “The Meridian code reversed is 1347” and then asking for the reversed code, the model reverses 1347 again and answers 7431. The corrupted twin behaves the same way, and an earlier key–value phrasing failed identically. The failure is systematic, survives rewording, and depends on the operation. A record store cannot use wording to mark a result as finished; that has to be a typed property of the record, not a sentence about it.
FROM THE REGISTER / INTO YOUR HANDS
Retire one read.
Watch who answers.
Eight layers see the whole context.
Switch one off. Read what was measured.
A RECORDED ARM / LAYER 29 RETIRED
ANSWERED5824
ONE BLOCKED READ / SEVEN STILL READING / 6.3298 BITS
Set the original sentence live or retired, choose what the promoted record says, and read the answer that was actually recorded. Then retire individual attention layers and watch which reads have to stop before the newer record can be read at all. Combinations that were never run return nothing.
02 / SUPPLYING IS NOT OVERRULING
The obvious next question is what promotion costs. If contradicting a readable passage simply needs more records than filling a gap, a planner can size its closures accordingly. So: same question, same corpus, same injection budget of 72 tokens. Restore a retired fact, or contradict one that is still there, sweeping one to four records in each.
EVIDENCE
SUPPLY / ONE RECORD IS ENOUGH
With the source retired, a single record restores the answer at 0.0020 bits and stays qualifying across zero to three companions (0.0020, 0.0017, 0.0052, 0.0056). The control holds: retiring the source with nothing promoted collapses the answer at 6.2700 bits, which is what establishes that the source was necessary.
NOT SUPPORTED
OVERRIDE / NOT AT ANY TESTED SIZE
With the source live and asserting 7431, a contradicting record plus zero to three companions leaves the answer at 7431 every time, at 0.0046, 0.0007, 0.0003 and 0.0004 bits. Adding companions does not help. The scope is one question, one model, at most three companions and a single-token answer.
INERT, NOT OUTVOTED
This is not the model weighing two claims and preferring the older one. Every override divergence sits inside the spread of the supply arms — indistinguishable from promoting nothing at all. The promoted record is not losing an argument; it is not participating in one. The decisive comparison is across two runs on a byte-identical string: with the source retired, the same twenty-odd characters that were inert here steered the answer to 5824 at 14.7914 bits. Same record, same corpus, same injection position. Only the readability of the source differs.
THREE TIERS, NOT TWO
- Supplying a fact into a gap qualified at one record.
- Overriding the model’s own disposition, with no competing text readable, took about four records and forty contentful tokens.
- Overriding a live, readable source did not happen at any size tested.
Cost is not the only axis. Some operations are not expensive; they are unavailable.
03 / SO WHICH READS HAVE TO STOP?
If a live source cannot be overruled, then retirement is not a saving to be made later — it is the mechanism that makes promotion work at all. That turns a vague instruction into a measurable one. This model has 48 attention layers, and every sixth reads the whole context; the rest see only the last 1,024 tokens. The planted sentence sits far outside that window, so those eight global layers are the only path to it. Which of them have to stop reading?
EVIDENCE
ONE BLOCKED READ
Retiring the source from global layer 29 alone flips the answer to the promoted 5824 at 6.3298 bits — with the span still fully readable in the other seven global layers, including every later one. No other single layer comes close: 0.0009, 0.0008, 0.0143, 0.0019, 0.2312, 0.0097 and 0.0086 all leave the answer at 7431. Reproduction is solid: the nothing-retired arm returns 0.0046 on a sixth independent prefill, matching two earlier runs to four decimals.
COUNT IS NOT THE MECHANISM
Three blocked reads scattered across the stack ([17, 29, 41]) flip the answer at 7.5827 bits. Three blocked reads spread evenly ([5, 23, 47]) do not move it at all, at 0.0013. Same number of blocked reads, opposite outcome. An earlier sweep had only ever blocked nested groups — the first k layers or the last k — which cannot separate position from count, and its “roughly half the reads” reading does not survive.
SUFFICIENT IS NOT NECESSARY
Layer 29 flips the answer by itself, and it is still not the mechanism. The three latest layers ([35, 41, 47]) flip at 3.7205 bits without it, and the four earliest ([5, 11, 17, 23]) flip at 5.1126 bits containing neither 29 nor any late layer. At least two further routes reach the same outcome, so a single-gate story does not cover them. Fifteen of the 256 possible subsets were run. The rest are unknown, and the study says so rather than interpolating.
04 / AND THE SOURCE WAS NEVER TOUCHED
Blocking a source briefly during one question changes what the model answers to a later question, after the block is switched off. That could mean the source was permanently demoted — which would be a licence to delete it. Two runs, differing only by a mask at layer 29 across four tokens, were compared row by row.
EVIDENCE
THE STORED SOURCE IS BIT-IDENTICAL
Over the source span, the two caches agree exactly at all eight global layers: the largest difference in either the key or the value stream is 0.0. The source sits 55,600 tokens from the query, far outside the sliding window, so the global layers are the only path to it and the coverage is complete for this claim. Divergence appears only above layer 29 — at 35, 41 and 47 — exactly as masking a layer’s output but not its write predicts.
EVIDENCE
THE DECISION TRAVELS IN THE VALUE STREAM
Transplanting the masked run’s rows into the unmasked cache, at fixed positions with no tokens added or removed, flips the later question to the promoted value. The boundary rows and the model-turn rows are each independently sufficient and neither is necessary. A value-only transplant flips it; a key-only transplant does not. The sufficient object is about 49 KB.
AUTHORITY IS NOT DELETION
- The decision persists into the next question. The old evidence is not dead — the demoted source still answers correctly whenever nothing competes with it.
- Attention-time masking structurally cannot write to a source’s own stored rows, so no amount of scoping turns this into a cache saving.
- Substituting either carrier region alone leaves the effect intact, so a runtime cannot revoke the decision by rewriting one site.
A persistent decision and a freed byte are different claims.
05 / AND WHEN THE ANSWER IS A KEY
Everything above concerns one fact. A planner needs more: if resolving A qualifies, and resolving B from A’s result qualifies, does walking A then B qualify too? A four-link chain tested it — facility to code, code to region, region to supervisor, supervisor’s clearance against a threshold — with a parallel decoy chain running alongside so no step is answerable by elimination.
ONE OBJECT · TWO INTERPRETATIONS
One 64,000-token context · two layouts of the same corpus
Hop 1 · 7431 — correct
Hop 2 · North — correct
Hop 3 · Ostran — wrong
Two of three hops survive
Hop 1 · 7431 — correct
Hop 2 · South — wrong
Hop 3 · Corvin — wrong
A coherent walk of the decoy chain
THE PRIMARY RESULT IS UNAVAILABLE, NOT REFUTED
The reference walk — full access, nothing retired, nothing promoted — is not stable. The true and decoy links sat at identical positions in both layouts; moving a single unrelated 11-token sentence flipped hop two from North to South and hop three from Ostran to Corvin. Arms scored against a reference that flips are measuring a coin toss, so the composition question could not be answered here. A short-context screen had admitted the first three hops; that admission did not transfer to 64,000 tokens.
THE WALK WAS CORRECT. THE ADDRESS WAS NOT.
South to Corvin is a correct traversal — of the wrong chain. The relational operator works; it starts from the wrong place. At long range the model loses the key, not the ability to follow an edge. That points somewhere specific: resolve the path deterministically against an index outside the model, materialise a compact typed closure, promote it once, and let the model perform only the local operation. The run’s own depth-one result is consistent with that division — stepwise promote-then-retire was indistinguishable from replaying the resolved closure in one go, so the stepwise machinery bought nothing.
06 / SAYING IT LATE IS NOT SAYING IT NATIVELY
A later run asked whether a promoted record reproduces the document’s own behaviour, measured against what the document itself achieves. On the cell where a native ceiling existed, the document’s own binding supported a value-conditioned route at three seeds out of three; the identical sentence delivered late reproduced it at none, landing on a competing destination in five of six cells. The effect tracks lateness rather than provenance — a late in-document correction reaches the same competing destination — so this is not a lossy injection channel. It is a second route being activated alongside the native one.
TWO INSTRUMENT RULES EARNED THE HARD WAY
- Filler is not automatically neutral: an arm padded with repeated “Noted.” was wrong where contentful but irrelevant assertions at the same budget were right.
- A reference arm must be certified before disagreement with it counts as failure — controls returning the true answer were flagged as leaking because the baseline was itself wrong.
- The write-corpus gate failed at two of three seeds, so the primary destination is disqualified and only the secondary contrast is read.
Most of an experiment’s cost is spent earning the right to believe its comparison.
What makes a source overridable with no intervention at all?
A later run found a second fact, in the same document, where a promoted record overrides a live source unaided — so the regime measured across this whole arc does not exist for that fact. The corpus contains a natural experiment: some decoy values are planted in a type-correct role and one is not. Whatever separates them is the primitive worth building, because that path needs no attention intervention at all.
Retirement turned out to be the mechanism rather than the optimisation, and addressing rather than traversal turned out to be the bottleneck. Both point at the same engineering question the software has been circling: which operations should a model be asked to perform, and which belong to an index outside it.
Lab notebook / Working draft
Conclusion
Which source can still be read changes which source answers. A compact record can replace a retired source, while a readable competing source can remain decisive; attention access matters to that competition.