esh-pfi-infrastructure/persistent-memory.d/2026-09-11-babyyarros-leak-gate-passes.md

[2026-09-11] BabyYarros — the leak gate passes, and closing it found three defects nobody was looking for

Operator's goal for the session: "finish the hardening and start the yarros training on the gx10." Both done. The gate went 212 → 0 and the first BabyYarros training is live.

The gate did not exist, which is why the number was wrong

There was no committed instrument for does any of the author's own proper nouns survive the rename. Brontë's "0 of 203" was produced by hand, and BabyYarros's "86 of 232" was too. scripts/r49-corpus/leak_gate.py is now that instrument.

It runs both directions every time, because a detector that only ever sees renamed text cannot distinguish absent from blind:

• positive control — the same scan over the UNRENAMED source; every surface must be found
• negative control — a nonce string that must appear nowhere

Its first reading on the corpus as built was 212 surviving, not 86. Two reasons, and both are structural rather than a disagreement about counting: it scans the whole corpus rather than each work separately, and it counts the sub-threshold entities rename.py never looked at. A per-work gate reports a name renamed in one book and printed verbatim in another as clean.

Defect 1 — a second typography defect, and the D1 note was right about the wrong thing

The D1 build notes say no unwrap was needed because Kvasir's cleaner emits flowing paragraphs. That is true and Brontë's hard-wrap defect genuinely is absent. A different one is present:

— M AJOR A FENDRA’S G UIDE TO THE R IDERS Q UADRANT (U NAUTHORIZED E DITION )
T he flight field at Basgiath is still dark…

The Empyrean books set chapter epigraphs in small caps; the extractor rendered the small-caps run as uppercase and left the large initial as its own token. 106 lines, ~700 splits, plus 52 drop caps (51 of them iron-flame). That is the entire origin of the entities called IDERS, UADRANT, NAUTHORIZED, DITION, and seventeen bare single letters.

⭐ The restoration is exact, not approximate. A split initial beside an uppercased run recovers the original mixed case: a word WITH a split initial was capitalised in the source, an all-caps word WITHOUT one was lowercase. So the line above restores to "—Major Afendra's Guide to the Riders Quadrant (Unauthorized Edition)", which is what she wrote.

⚠ Two guards, both load-bearing: only lines with ≥2 splits are treated as a small-caps run (one split is an ordinary sentence beside an acronym), and I, A, O are excluded from the drop-cap join — otherwise A slow smile spreads becomes Aslow.

scripts/yarros-corpus/repair_typography.py. Cost: 768 fragments rejoined.

Defect 2 — back matter inside the prose, in all five works

The builder splits on chapter headings and nothing follows the last one, so every work carried its acknowledgments, newsletter pitches and cover-artist credits inside the final chapter: 4,555 words naming the author's agent, her editors and her children, in a corpus whose entire purpose is that no identifiable name survives.

Found by the phrase audit surfacing Louise Fury (Yarros's literary agent) — not by reading. ⚠ iron-flame's marker is ACKNOWLEDGMENTS in all caps and a case-sensitive scan missed it. The strip is case-insensitive, last-chapter-only, and refuses if it would remove more than 2% of the corpus.

Defect 3 — the gate read 0 of 314 while Afendra was in every copy

The worst failure shape available: a clean number over a real leak.

Afendra never appears unpossessed, so it keyed as Afendra’s — and rename.py and the gate both skip apostrophe keys as contractions. Unrenamed and unreported at once. Fixed by folding clitics so Afendra’s counts toward Afendra (--fold-clitics).

Baxter escaped a different way and is the better story. wilder renders an in-book news article entirely in lowercase as a typographic device:

eighteen-year-old eleanor baxter was found late last night…
…using a helicopter rescue team to bring ms. baxter from the ravine.

So 3 lowercase against 23 capitalised — ratio 0.13 against a 0.05 bar — and a real character is silently never renamed. The cap/lowercase ratio assumes consistent typography. Fixed by readmitting ratio-rejects that a title precedes (--rescue-honorific 2).

⚠ The first version of that rescue was badly wrong and the measurement caught it. Matching the wide honorific list case-insensitively readmitted 143 junk tokens — the, says, like, up, across — because major, general, father, sir, agent and coach are ordinary lowercase words. The rescue list is now five abbreviations that are never anything else (Mr/Mrs/Ms/Dr/Miss) and the lowercase arm additionally requires the period, so ms. baxter counts and I miss you does not. Readmits: 143 → 2.

A leak class the unigram scan structurally cannot see

Riders Quadrant, Scribe Quadrant, Flame Section, War Games, Orange Daggertail — and Fourth Wing, the book's own title. Every component is an ordinary word the cap/lowercase detector correctly refuses to call a name, so 48 recurring capitalised phrases survived a gate that read 0.

This is Thornfield × 100 one level up, and it needs a map, not a detector: substituting a head noun is a choice about register, not a measurement. phrase_map_yarros.json carries 10 phrases plus 13 capitalised tokens (Quadrant→Division, Wing→Flight, Section→Cohort, Squad→Unit, Daggertail→Spinecrest), applied AFTER the entity pass so it can never eat a replacement name, whole-word and case-sensitive so a dragon's lowercase wing survives. The gate now audits recurring 2–3grams against an explicit allow list. 48 → 0.

Corpus scope, not work scope

--scope corpus uses ONE map per copy across every work. It closes the cross-work leak (Rebel renamed in rebel, verbatim in the other two Renegades books) and fixes something Brontë's four unrelated novels never raised: Yarros is two series, so Violet has to be the same person in Fourth Wing and Iron Flame. 8 cross-work gender conflicts held neutral rather than guessed.

The stoplist is short because every surface was read in context

A plausible-looking guess would have been wrong most of the time. Violence is Xaden's nickname for Violet. Continent, Presentation, Battle Brief, Curator, Sage, Barrens, Originals, Montserrat, Athena and Aura are all in-world. Only real-world geography, brands, three nationality adjectives and four generic title words are excluded — ambiguous cases are deliberately renamed, because renaming is the safe direction and leaving is the leaking one.

Brontë was protected the boring way

Five new detector behaviours, all opt-in and OFF by default, and after every single change the Brontë entity map was re-derived on gx10 and diffed against the pre-change one: identical keys, identical surfaces, identical every field, across all four works. One intermediate version DID change Shirley (an unconditional acronym rule dropped charles, george, hugo, nelson) and that is exactly why the check was run each time rather than once.

Final state

0 of 325 source entities survive · 0 of 91 audited phrases survive · both controls PASS
corpus sha e85f69f1e49d57c9 · 6 copies · 1,248 records · 4.65M words

⚠ Sensitivity floor, stated because a negative without one is unfalsifiable: 3 capitalised occurrences per work for a name, 5 recurrences for a phrase. Below those the gate does not detect, does not rename, and does not report.

Training launched 10:06 PT — gx10:~/r49-runs/yarros-4b-instruct-1ep/, Qwen3-4B-Instruct, 1 epoch, seed 4919, 178 steps · 5,824,512 tokens, 252 adapted modules, sdpa/bf16, 37.9 s/it (~1h52m), eval+save every 25. The launcher refuses to start unless the gate report on disk says PASSED — a launcher that trusts a human to have remembered is not a guard.

Pipeline and evidence table: scripts/yarros-corpus/RUNBOOK.md. Related: 2026-09-10-r49-babybronte-d1-d3-and-the-1-epoch-pilot