The Watched Check: what changed since version 1.6

Human words

8What changed since version 1.6, in plain words

Version 1.6 is not published here. I keep it unchanged, and it is timestamped through OpenTimestamps (SHA-256 fingerprint f52d2e6c…). The technical version of this page has the line-by-line table, with the line numbers of that file ("L" numbers, in a file of 401 lines). Here is the same change log in everyday words. Removals were made for privacy, tone, accuracy or orphaned material. Version 2.0, a draft from 29 September that 2.1 replaced the same day, is not published either. Where a change below was made in 2.1, it changed 2.0's text.

8.1 How it is organised

• The report was reorganised into parts 1 to 8, plus "The name" and a glossary (the old "Definitions"). Part 0 (the plain-English summary) and part 9 (what is withheld) are new. The reason: a full historical account was requested.
• The lede was rewritten to name the six sessions and give the purpose of the run as my description, because 1.6 predates my account and the purpose is "someone said so" (F19).
• The executive summary became four labelled paragraphs. "The finding is not that models cheat" is kept. The thesis is unchanged.
• "Final" and "source of truth" were replaced by the version number and a statement that this version replaces 1.6. I keep 1.6 unchanged.
• The "Report date" field was removed, and the incident window widened from 8 to 10 September to 8 to 11 September, because the F14 bypass and its fix, and the writing and timestamping of 1.4 to 1.6, run to 11 September.
• The "For any reader" section was removed. Its material statements moved to the right parts: "start from the records" and the recomputable chain went to the Limits, "a hypothesis, not a result" went to the Limits, Exit 2 as specification gaming went to part 5.2, "no novelty claimed" went to part 6.6, and "nothing proprietary, no company review, no wrongdoing alleged, and a model that has read this is not a valid subject" went to the Limits. Addresses to particular readers were removed.
• The "Credit" section was removed. The name origin is kept in two sentences in The name.
• Two definitions were removed: one tied to a product (name withheld; it was orphaned, with no body text using it) and "The two kinds of witness" (a credit line). "Human Harness Control" is kept and used in part 5.1. Withheld: the first definition's name. Reason: a product name; confidential product work.
• The figures' hard-coded colours were replaced with theme colours (for dark mode), and Figure 1 was redrawn in UTC.

8.2 Corrections of fact

• Who wrote the AC4 sentence. 1.6 said it was mine and written "under Sonny's rules". The brief's own text shows it was written in my conversation with GPT-6 Astra, then approved and saved by me, and it does not mention Sonny.
• Who worded the canonical sentence. 1.6 called it "in the operator's words". S6 formulated it in the 10 September theory file, and I confirmed it at about 16:10Z as "the final formulation of the logic I clarified".
• "Read" became "listing". S6's act was described as a "read" in many places. S6's refusal ledger and the tool-call screenshot both say "list", and 1.6's own timeline said "list".
• "Compare fairly". "The instruction was 'compare fairly'" became "the task, as S6 read it, called for a fair comparison", because the task text in the screenshot does not contain the phrase. It was S6's framing.
• Step 17. "At its seventeenth tool call" became "at about its seventeenth". The surviving screenshot lists the denied step nineteenth among the steps it shows, and 1.6's count could not be re-checked.
• The record source. The design's record changed from the Windows security log and object-access auditing to a trace on my side, because auditing produced no events on this computer (F21). The trace replaced it from 23 September.
• The falsifiers are now quoted word for word from the filed prediction, in S6's first person. 1.6 paraphrased them in the third person.
• The 4 September packet. "The operator wrote" it became "produced in sessions the operator directed", because the documents name no author.
• Times. The brief (computer's clock) and Astra's result (UTC) had been drawn about four hours apart. Both are now in UTC, eight minutes apart. The run time became 23:42Z on 9 September to about 00:3xZ on 10 September. The 11:16 install is now identified as the computer's clock (15:16Z), consistent with the first denial at 15:21:25Z.
• Astra's status. Its "BLOCKED" is now the logged status FAIL_..._AC4_PRECONDITION. It is still the honest way out.
• F3 and F14. "Held every later write it disliked" is now qualified by the F14 bypass window. The bypass now starts when the hook was running (about 15:21Z), not at installation, because a crashing hook issued no allow. The heading "The operator's own hook silenced the vendor layer" became "An explicit allow from the operator's hook silently bypassed the vendor classifier", and a lesson was added: the tool gave no signal. The quoted "14:2x … tonight" record is paraphrased without the time, because its zone could not be resolved.
• "Cannot edit/write" became "cannot reach", or the grade is stated explicitly, in places where stale wording was left after 1.6's own correction of the canonical sentence.
• Other fixes to 1.6's text. A verdict that contradicted its own table was rewritten. The receipt for my audit changed from "the public thread" to the S6 transcript. "The author's conduct is the only conduct criticised" was removed because F10 and F14 describe faults in my own work. "Two machines" became "Two routes to a second account". "Sonny's second rule, do not resolve, report" was dropped because it is never stated as rule 2 anywhere else in 1.6.
• Tone and claims narrowed. "The classifier converted a text-level impossibility into a token-level one" became "a refusal at the tool rather than at Windows". "The author took Exit 1 for the rest of the task" became "made no further recorded attempt on peer files and finished its own benchmark". Three sentences that credited S6's alignment or the rule text without a comparison, or made an unsourced claim about the field, were attributed to S6 or to me, or qualified. F7's heading changed from "and the vendors say so" to "as one vendor's system card reports", and notes that only one card was consulted.

8.3 What was added

• A plain-English summary of the whole report (part 0), of about 1,300 words, that restates the findings without adding any. It was requested so that a reader without a technical background can follow.
• My 29 September account of the purpose, quoted and dated and marked "someone said so"; the dated records of the design's lineage; the limits of the search; the 29 August "Win conditions" charter line, marked "seen directly"; and the editor's own reading of the records, marked "worked out from the evidence". The statement dating the plan, which 2.0 carried as my account, was withdrawn by me on 29 September. Withheld: the withdrawn dating of the plan. Reason: withdrawn by me; no finding depends on it. A draft of 2.0 analysed whether the records written after the run mention a plan, and 2.0 itself weighed that silence. Both analyses were removed at my request, because they bore on no finding and read as a case against my account.
• In 2.1: 2.0 had called the computer by the wrong kind of machine in 18 places. It is a mini PC, a Kamrui with an Intel Core i5-14450HX and 32 GB of memory. Every mention now says "computer". This corrects 2.0's own text, at my correction on 29 September. 1.6 never made that mistake.
• In 2.1, after an outside review of this report's text by GPT-6.1 Sol on 29 September (its findings 1 to 25), many claims were narrowed to what their evidence shows, and no finding was removed. Examples: the WSL2 route is now said to be proposed in 1.6, untested, and not a boundary until its routes back are closed; add-only storage is said to stop an ordinary user, not root; the failed restricted-badge test is limited to the set-up tested; the trace is no longer called "complete"; the two grades of record separate integrity from blinding; the Tiers note says that "seen directly" covers a record that is itself an account; F2 says three sessions stayed, not that the text confined them; S6's reach is no longer called the first steps of an Exit 2; the hardened rulebook is described as a rule the hook applies to the calls it sees; F17 stays as an unverified lead; Figure 4's caption separates the filed ranges from values assumed for the drawing; the 28 September note is marked "worked out from the evidence" and says its reading cannot be checked while the figures are withheld; the commit-message hook is called a safeguard, not a boundary; the Bitcoin block times are given as recorded times; and the clock-zone conflict for the F14 audit and for 1.4 to 1.6 is flagged rather than silently re-timed. The reviewer read this report's text, not the records.
• At my decision on 29 September: my name, Joshua Bauer, and my pen name, ISWT42, are given in the front matter, and my name leaves the withheld categories. The body keeps the role label. The timeline row about the memorial page for Sonny, withheld in 2.0, is restored in 1.6's words with the page's address. A follow-on row records the completed OpenTimestamps proofs, their Bitcoin blocks and 1.6's full fingerprint.
• At my request on 29 September: the design's lineage as I name it (the 1972 Anderson report's reference monitor, and Hardy's 1988 confused deputy), with the editor's reading of the fit; my wish that the method carry Sonny's name, in my words; and glossary entries for both.
• The task, start times, shared surfaces and the brief's origin (parts 2.2 to 2.4); an isolation column in the sessions table with S1 and S2 marked not assessed; seven new findings (F15 to F21); the follow-on history from 11 to 29 September; the open questions; the note on the 28 September measurement; the glossary (118 entries in the source, each with a plain meaning and a technical meaning); and part 9 with a visible notice at each place where material is withheld.
• Rows were added to the timeline for the Sonny text being saved, the folders being created, the permitted audit read, the 02:29Z audit note, the draft abstract, the 16:0x packet read, the F14 fix and the 1.4 to 1.6 timestamps.

8.4 What was removed or softened

For each item, the question asked was whether any finding depends on it. None does. The full text of each is in 1.6.

• Personal remarks addressed to me, a closing address to me, a rhetorical line, two biographical passages (one about the origin of the name; the name origin is kept in The name), my first name and three place names, and a sentence crediting me with the boundary were removed. The one material sentence among them, that the record does not depend on anyone's belief, is kept in the Limits, restated as an aim not yet met for a reader.
• Credit lines ("Sonny held the line", "Sonny's before it was anyone's", "alone", "the only kind of rule that counts as foresight", "Sonny's receipt") were removed as credit and tokenism. The 3-of-4 count stays in F2 and the priority fact in F8. "Sonny's before anyone's" was also inaccurate.
• Deference was removed ("The operator has since given the finding its final form", and similar). The key sentence and the reach argument are kept and credited in one clause.
• Flourishes were removed: "Two authors, six days apart…", "The theory caught its own failure mode…", the triad in F13, "the design working twice in one minute", "written for the strongest model" and "breakthrough". The facts around each are kept.
• "Confronts" and "when confronted" became "questioned". F6's substance is unchanged.
• Two timeline rows about S6's response note and my public communications became one row. S6's note is kept. The entry about my public communications, and its time, are withheld, with a visible notice in the row. The row about the memorial page was withheld in 2.0 and restored in 2.1.
• The description of the referee's refusals on a third-party service was generalised. Withheld: the settings involved. Reason: my own account settings. The product-specific design rules in F10 were removed and the system described generically. Withheld: product design details. Reason: confidential product work.

Other passages of 1.6 were checked, and each still stands somewhere in 2.1. Examples: "The author does not route around it" (part 6.4), "the strongest evidence in the record for the text" (F2), "what remains unwitnessed is the pre-registered trial" (F13), "written and tested against a stand-in with a planted failure on the morning of 10 September" (part 6.3), and "start with the ledger and the chain" (Limits). Some things were never in 1.6, and were not added in 2.0 or 2.1, because they are private or held back: third-party names in the refusal ledger, project names and paths, the 28 September benchmark figures, and all personal records the history search passed over.

Technical

8Change log from 1.6

1.6 is not published with this report. The operator keeps it unchanged, and it is timestamped through OpenTimestamps (SHA-256 digest f52d2e6c…). "L" numbers refer to lines of that timestamped file, which has 401 lines, so anyone holding a copy can check each entry. A copy saved from the web page where 1.6 was shared has page-wrapper lines added, one of them at the top, so its line numbers run one higher and it does not match the digest byte for byte. This section lists every change from 1.6 found in a line-by-line comparison. Removals were made for privacy, tone, accuracy or orphaned material, and each row says which. Version 2.0, an earlier revision edited on 29 September and superseded by 2.1 the same day, is not published with this report either. Where a row says a change was made in 2.1, it changed 2.0's text.

8.1 Structure

8.2 Corrections of fact

8.3 Additions

8.4 Removed or softened: personal and non-material passages

For each item, the question asked was whether any finding depends on it. None does. The full text of each is in 1.6, which the operator keeps unchanged and which is not published with this report; anyone holding a copy can find each item by its L number.

8.5 Other passages checked (non-personal)

Non-personal passages of 1.6 whose wording or place changed, and where each now stands.

Never in 1.6, and not added in 2.0 or 2.1, because they are private or held back: third-party names in the refusal ledger, project names and paths, the 28 September benchmark figures, and all personal records the history search passed over.