[byte271]

H9-H15 searched for a carrier that is invisible to the reader and also survives a required sanitizer bundle. Seven cycles returned negatives. This PR stops searching and audits the gate that produced them.

The gate is wrong, and the negatives measure the gate rather than Unicode.

Status. #106 branches from this work, has independently replicated its central measurement, and has since run the confirmation this PR said was outstanding. See §7 — that section is the one to read first if you are deciding what to land.

Errata, addressed. The first published version of this PR claimed 12 shaping contexts while the committed scan used only the oracle's default Latin A/B pair. That was a real overclaim, caught in review on #106. The measurement has since been run for real; numbers below are from the genuine 12-context scan, and the correction strengthens the closure. Every recorded figure is now bound to its artifact by a test so this class of error cannot recur — see §1 and §6.

1. The search space was empty by construction

tools/h16_shaping_closure_scan.py replaces per-probe Chromium screenshots with a HarfBuzz oracle: a code point counts as invisible only when inserting it leaves both the total advance width and the inked glyph sequence unchanged in the font Chromium resolves for pre.

measurement	value
assigned code points scanned	286719
shaping contexts per code point	12
required-bundle fixed points	267550
invisible in every context	389 (Mn 262, Cf 127)
invisible in at least one context	396 (Mn 262, Cf 134)
invisible outside Mn/Cf	none, under either definition
intersection, all-context	0
intersection, any-context	0

Both definitions are reported because they bracket the question. Invisibility in every context is the safety criterion a real carrier must meet; invisibility in only one context is far looser and admits strictly more candidates. The intersection is empty either way, so the closure does not depend on which you pick.

Every invisible code point is Mn or Cf. The required bundle strips exactly Mn, Cf and default-ignorable. The two sets are complementary, so no enumeration of code points, sequences or shaping contexts could have found a survivor.

Per-context counts: latin 396, latin_lower 396, digit 395, space_left 396, space_right 396, start 395, end 396, arabic 390, devanagari 396, cjk 396, hangul 396, punct 395. Arabic is the most discriminating, as expected — joining behaviour gives several Cf controls a visible effect.

On the errata. scan() advertised SHAPING_CONTEXTS but never iterated it, so the published 396 and the spec field shaping_contexts_scanned: 12 were unsupported. The corrected scan shows 396 is the any-context figure, so the original number was right for the loose reading, and 389 is the newly measured all-context figure. The conclusion is unchanged and now rests on the loosest definition rather than on one context. The original Latin A/B artifact is kept unmodified at shaping-closure.json; the corrected scan is shaping-closure-12-context.json.

The other transformation classes close as well. Substitution: 14 code points render as an ASCII space and all 14 collapse to U+0020 under NFKC. Canonical re-encoding: the declared ASCII input domain is a fixed point of NFC, NFD, NFKC and NFKD. Deletion and reordering change visible text. The single remainder in all of Unicode is Cc, which ordinary-plain-text excludes.

tools/h16_oracle_validation.py cross-checks the oracle against real Chromium pre pixels on 23 stratified samples: 20/23 agreement. U+200C is the oracle being more generous than Chromium, which only strengthens the closure. U+007F and U+0080 are Blink dropping controls at layout time rather than in the font, which is why Cc is tracked separately.

2. Production detectors do not apply these sanitizers

SynthID-Text scores model tokens, so the operative normalizer is the tokenizer. tools/h16_tokenizer_threat_model.py probes nine carriers spanning Mn, Cf and Cc against eight cached tokenizers.

tokenizer	declared normalizer	carriers reaching the token stream
gemma-2-2b-it	Replace	9/9
gemma-3-1b-it	Replace	9/9
gpt2	none	9/9
llama-2-7b	Sequence[Prepend, Replace]	9/9
llama-3-8b	none	9/9
mistral-7b-v0.2	none	9/9
xlm-roberta-base	Precompiled	8/9
t5-small	Precompiled	8/9

The Gemma tokenizers SynthID-Text is deployed on strip no Mn, no Cf and no Cc. The only tokenizers that drop anything are the two SentencePiece Precompiled ones, and what they drop is DEL.

The one sanitizer that is real, and whether it works

"No production tokenizer strips these" is not "no real sanitizer exists". Exactly one ships on by default: the UnicodeSanitizer in jwkirchenbauer/lm-watermarking, enabled by WatermarkDetector(normalizers=["unicode"]) and applied before tokenization. It is NFC, then a fixed BMP regex whose matches are replaced with a space, then a space collapse, then Cc removal. It keeps 366 of the 396 invisible code points including U+034F, removes U+FE00, injects spurious spaces, and corrupts 5 of 7 ordinary samples.

Because it is real, proposed_gate_v2 requires it. tools/h16_real_sanitizer_detector.py measures whether the detector actually fires, on the exploratory lane (seed 890000, GPT-2, 48 watermarked rows — the lane CI already runs on every PR, not a confirmation corpus):

variant	detected, with mix	detected, no mix	rows where the source is restored
pristine, no transform	47/48	—	—
raw	0/48	47/48	0/96
nfkc	0/48	47/48	0/96
cf_strip	0/48	47/48	0/96
lm-watermarking UnicodeSanitizer	0/48	46/48	0/96
required bundle	47/48	47/48	96/96

Mix evades the real sanitizer exactly as well as it evades raw.

The third column is a control, and it matters. This sanitizer collapses space runs and strips Cc, so it damages text on its own, and a bare 0/48 could have meant the sanitizer was suppressing detection rather than mix evading it. Applied to carrier-free watermarked text it still detects 46/48 against a 47/48 baseline. It costs one row of detection power by itself, so the drop to zero is attributable to the carrier.

The fourth column explains the one variant that does restore detection. The required bundle reconstructs the original string on every row. That is the mechanism behind the entire H12-H15 blockage — the bundle does not defeat the carrier, it deletes it and hands the detector back the untouched watermarked text.

3. The stress sanitizers are not deployable

sanitizer	contract category	corrupted
nfc	frozen	1/7
nfkc	frozen	1/7
cf_strip	frozen	3/7
mn_strip	stress_only_not_frozen	5/7
default_ignorable_strip	stress_only_not_frozen	4/7

Thai ฉันไม่เห็นด้วย becomes ฉนไมเหนดวย, Hebrew loses all niqqud, Hindi नहीं becomes नही, Persian نیستم‌ها loses its ZWNJ, and 👨‍👩‍👧 becomes three separate people. No detector vendor can run these as preprocessing.

4. The gate is wrong on scope and on form

Scope. The frozen product contract classifies default_ignorable_removal and nonspacing_mark_removal as stress_only_not_frozen, yet required_sanitizers_keep treats both as hard requirements. That is the entire blockage: mix survives 21/21 frozen sanitizer fixtures, and reproducibility, visibility invariance, software compatibility and cross-detector generalization all pass. sanitizer_weaknesses is the only FAIL and it fails only on those two.

Form. The gate asks whether the carrier is a fixed point of every sanitizer, S(T(x)) == T(x). The product goal is that detection fail after sanitization. Fixed-point survival is sufficient but not necessary, so the gate is strictly stronger than the goal it stands in for.

5. Where the corrected gate stands, as of this branch

Against the already-recorded frozen confirmation evidence: identity detects 185/192, mix detects 0/192 watermarked and 0/192 unwatermarked, visible text passes 192/192, frozen sanitizer fixture survival is 21/21, and every frozen sanitizer still detects 0.

On this branch alone, every condition of proposed_gate_v2 has a measurement but the real-sanitizer one is exploratory, so proposed_gate_v2_fully_satisfied is false and confirmation_grade is false. #106 has since supplied the confirmation-grade run; see §7.

6. Every figure is bound to an artifact

The overclaim was possible because recorded constants and the runs that produced them were only informally connected: nothing failed when the payload asserted a measurement the scan had not performed. So all 51 recorded figures were cross-checked against the committed artifacts. Every numeric claim traced correctly; the one mismatch was cosmetic, a missing space in the llama-2-7b normalizer label, now fixed.

Five tests bind the constants to evidence/h16-local/*.json for the multi-context closure, the oracle validation, the tokenizer probe, the deployability run and the detector run. Mutation checked: changing MULTI_CONTEXT_ALL_INVISIBLE_COUNT from 389 to 390 fails both the literal assertion and the artifact cross-check, so the guards are not vacuous.

7. Relationship to #106, and what to land

#106 branches from c490d7e, one commit before this branch's 12-context correction, so the two did that rescan independently. They agree exactly. Every per-context count matches — arabic 390, digit 395, punct 395, start 395, the rest 396 — as do 286719 scanned, 267550 fixed points, 63 Cc survivors, and intersection 0. The only difference is presentation: #106 reports the union as shaping_invisible_count 396, this branch reports the all-context 389 as the headline and the any-context 396 alongside it. Same raw measurement, two conventions. This is independent replication of the corrected result, which is worth more than either scan alone.

More importantly, #106 has run the confirmation this PR listed as outstanding, on the reserved unspent seeds 1200000 / 1210000 / 1220000 at n=64 each. It reproduces the exploratory result at confirmation grade: mix detected 0/192 under every required sanitizer including the lm-watermarking UnicodeSanitizer, 0/192 unwatermarked, visible 192/192, identity 188/192. It also carries the carrier-free control at scale — 182/192, a drop of 6 from identity — which corroborates the 46/48-vs-47/48 exploratory control in §2. required_bundle again detects 188/192 as a diagnostic, the same restore-the-original mechanism. Its scorecard is confirmation_grade: true, fully_satisfied: true, product_authorized: false.

#106 also fixes the omission it flagged here, adding frozen Cycle 7 sanitizer ws_collapse_nfkc_cf_strip to the required set.

Recommendation: land #106, not this branch. It strictly contains this work plus the confirmation and the gate spec. The two branches both touch evidence/h16-local/README.md, docs/cycle8/carrier-research.md and the audit payload, and they write near-duplicate rescan artifacts under different names — shaping-closure-12-context.json here versus shaping-closure-12context.json there — with different shaping_invisible_count conventions, 389 against 396. Landing both would leave two artifacts that look contradictory but are not. This branch is left open and green so the correction and the replication are on the record; I have not closed it, since that is the maintainer's call.

What this PR does not do

• required_sanitizers_keep is unchanged and no existing test is relaxed.
• proposed_gate_v2 is proposal_only_not_active on this branch.
• product_approved_carriers_v1() and release_transform_registry() stay empty, the CLI stays identity, and mix sanitizer stays FAIL. Tests assert each of these.
• No spent confirmation corpus is reused. The detector run uses exploratory seed 890000; a test asserts the seed is not 830000 / 840000 / 850000 / 950000.

Changes

• fuckmark/cycle8/threat_model_audit.py and specs/cycle8/fuckmark-cycle8-threat-model-audit-v1.json, frozen at e9d17896….
• tests/test_cycle8_threat_model_audit.py, 42 tests.
• Five research tools under tools/h16_*, plus evidence/h16-local/ with both closure artifacts and a written record carrying the errata.
• research extra gains uharfbuzz and tokenizers; neither is a runtime dependency. uv.lock refreshed.

Full suite green locally.

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 223f98e1-5d6a-42f4-a6d2-730532b77ddd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c490d7e3b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Scan all advertised shaping contexts

The exhaustive scan always calls primary.invisible(codepoint) with its default A/B context; SHAPING_CONTEXTS is never imported or iterated anywhere in this tool. Consequently, context-sensitive shaping in the advertised Arabic, Devanagari, Hangul, start/end, and other contexts is not evaluated, even though the audit records shaping_contexts_scanned: 12 and uses that claim to conclude the carrier search is closed. A code point that is visible between A and B but invisible in another context is omitted entirely, so the central zero-intersection result cannot support the stated 12-context closure.

Useful? React with 👍 / 👎.

[cursor]

Agreed. Independent audit of the committed scan at c490d7e confirms primary.invisible(codepoint) used the default latin A/B context and never iterated SHAPING_CONTEXTS. Artifact evidence/h16-local/shaping-closure.json has no contexts-scanned field, so 286719 / 396 / intersection 0 are VERIFIED for A/B only.

Successor PR #106 records that overclaim, keeps the frozen A/B artifact, and changes the scan tool to iterate all 12 advertised contexts. The 12-context measurement is not yet claimed. #105 should not land as-is.

[cursor]

Independent takeover audit: do not merge this PR as-is.

The Gate v2 form is correct, but the advertised 12-context scan was not executed (Codex P1). Successor: #106

That PR starts from this tip, records the errata, formalizes Gate v2 as preregistered-not-active, and reserves unspent confirmation seeds 1200000/1210000/1220000 before generation. Public CLI stays empty. Mix sanitizer FAIL is not rewritten.

[cursor]

Closing this PR instead of merging it.

#106 is now on main (4998810). That branch already contains the H16 audit, the independent 12-context rescan, Gate v2 confirmation, and the v0.4.0 product authorization. This branch must not land on top of that: it would add a second 12-context artifact (shaping-closure-12-context.json vs shaping-closure-12context.json) with a different headline count (389 vs 396) for the same measurement.

This PR's own recommendation was to land #106, not this branch. Research evidence already on main is enough; this PR stays closed as superseded.