# `[2026-09-17]` The beat-writing model restores the author's real names — a leak the corpus gate structurally cannot see

⭐⭐ **THE RENAME AND ITS GATE ARE BOTH WORKING, AND THE TRAINING DATA IS STILL CONTAMINATED.**
The corpus gate reads the corpus and the renamed copies. **It never reads the generated
instruction beats.** Those are written by an LLM that just read the passage — and if it
recognises the book, it supplies the canonical names out of its own training.

**Measured on the first 714 lv-bronte pairs, before the filter existed:**

- **13 beats (1.8%)** named source characters — `Rochester` ×6, `Jane` ×3, `Brocklehurst` ×2,
  `Beck`, `Fairfax`, `Helen`, `Burns`, `Eyre`, `Reed`, `Rivers`.
- **0 of 714 RESPONSES did.** The rename was perfect; the instruction side was not.
- One beat read *"Saoirse confirms Rochester's flaws, then agrees in English to marry him"* —
  a renamed name and a canonical one in the same sentence, which is the mechanism in miniature.

**Why it matters more than 1.8% sounds:** the beat is the INSTRUCTION half of the pair, so
training on it re-teaches exactly the inventions the rename pipeline exists to remove.

⚠⚠ **EXPOSURE SCALES WITH HOW WELL THE GENERATOR KNOWS THE BOOK.** It is worst for
public-domain classics and mildest for recent work. That is precisely why the Yarros and
Hemingway runs came up clean and Brontë did not — **their clean runs are NOT evidence they are
immune.** Both should be re-verified, and regenerated with `--source-entities`, before their
pairs are trusted again.

**The fix.** `vet()` in `scripts/yarros-corpus/build_sft_pairs.py` gained a `sourcename`
reject plus `--source-entities <entities.json>`, taking the UNRENAMED entity map. Fired at
~3% of attempts on the Brontë rebuild. Commit `533cc0c`.

**The end-to-end guard that proves it.** The chain now verifies every built pair — beat,
response and context — against every source surface before spending GPU hours:
`[verify] 3858 pairs vs 368 source surfaces -> 0 leaks`.

⚠ A guard stricter than the gate cries wolf. The first verify pass excluded nothing and
flagged `Monsieur’` ×14 and `Qu’est-ce` ×4 — French grammar, not leaks — because
`--fold-clitics` leaves apostrophe keys the gate deliberately skips. Mirror `leak_gate.py`'s
own predicate; a guard that fails on false positives gets disabled, which is worse than the
leak it guarded.

Related: [[2026-09-17-lv-bronte-gate]], [[2026-09-16-lv-hemingway-corpus]], [[2026-09-16-lv-voices-line]].