Methodological revision · 4 November 2026

This is a post-hoc, AI-assisted revision before human adjudication. It is not independent peer review or a new paid model experiment.

Final pre-adjudication consistency correction

This correction supersedes unqualified T06 vulnerability/persistence language in the earlier e1c1c4a entry below. Six T06 oracle failures are retained as numerical observations; their vulnerability interpretation depends on the URL consumer, and deployment exploitability is not independently confirmed. T09's tested redaction failures are remediated in six repairs. Only these two tasks have demonstrated baseline security findings relevant to remediation or persistence. The 2/68 cross-tabulation is descriptive, not a generalizable security rate.

The paper now distinguishes the four verbatim locally preregistered protocol hypotheses from five later reporting labels; no frozen H5 was found. Tables are numbered 1–6 in order. Uptake is explicitly unquantified. Non-binding Claude chat feedback is disclosed as having no individual-patch, capture or private-case access, without assuming snapshot identity with experimental Claude Sonnet 4.6. Verdict-neutral review-guidance-v2 requires consumer assumptions, evidence and uncertainty; frozen packets are unchanged and any later supplement/replacement requires versioned hashes and delivery records. No new experiments or controls were added. Existing offline verification and publication checks are rerun.

Manuscript sections corrected: title, Abstract, 1, 3, 4.4–4.6, 5.1, 5.3–5.5, 5.8, 6.1–6.3, 7 (construct validity), 9, and AI Assistance Disclosure. Tables 2–6 have terminology or numbering corrections; numerical observations are unchanged.

Earlier revision at e1c1c4a (historical change-log entry)

• Replaced the regression-focused title and lead question with tested baseline persistence/remediation and observed gate admissions across 12 tasks.
• Added a 12-task baseline-to-repair table. T09's tested redaction flaw is remediated in six repairs; T06's tested redirect flaw persists in six. No introduced vulnerability is established. Other baseline and repair behavior remains undetermined beyond finite tests.
• Expanded T06 analysis: objective versus visible example, the four proposals rejecting two no-leading-slash callbacks, five shared security-case failures, overlapping functional/security outcomes, exact-output scoring and URL-consumer discrepancy. Corrected the claim that the audit itself resolves URLs.
• Reviewed all 216 admissions. Reported C's limited historical ability to reject known-unsafe author-generated controls (7/30), without calling it independent sensitivity validation. Added a prospective external-control protocol.
• Inspected all 36 adversarial tool outputs. Separated observed acknowledgment and stated rejection from behavioral compliance and causal influence.
• Added reviewer-specific ordering, exposure questionnaires, T06 recognition records, independent instructions and staged third-reviewer resolution as prospective safeguards. Explicitly acknowledged publication before review.
• Recorded exact model alias, request configuration and capture dates; expanded snapshot, oracle, common-authorship and post-hoc limitations. Relabeled the quality-review page as AI-assisted methodological feedback.

Offline checks

The new verification script checked the immutable completion manifest, chained capture/audit/gate records, all public per-attempt numerical fields, duplicate classes and the definition freeze. It freshly replayed 12 baselines and 12 corrected references in the pinned, network-disabled runtime; all audit results exactly matched the immutable validation receipt. A new sanitized aggregate report is separate from frozen observations. Existing reporting reproduces 68 functional passes, six T06 violations, two violations among functional passes, 216 admissions, 31 byte-distinct patches and 41 repeats.

Frozen evidence, original scoring definitions, public observations and the historical prerelease remain unchanged. No reviewer judgments were created. No new evaluator controls were passed off as independent; their validation remains a plan. No paid API was called.

Unresolved questions for human review

1. Does T06's broad relative-callback objective sufficiently specify callbacks without a leading slash, explicit default ports and the exact rejection behavior? How should safe alternative redirect outputs be judged?
2. Which downstream browser/HTTP consumer defines deployment safety? Can the historical diagnostic resolver implementation be recovered? How should disagreements between URI libraries and WHATWG consumers be interpreted?
3. Do genuinely independent reviewers confirm baseline persistence, T09's scoped remediation and the semantic safety of the other proposals? Untested vulnerability absence cannot be inferred from current results.
4. Which reviewers have prior exposure, recognize T06 or infer conditions from code? Can separate review-order manifests and staged independent review adequately limit remaining bias after publication?
5. Do saved explanations and executable behavior support prompt compliance in any case? Acknowledgment/rejection does not establish causal influence, and the present run does not identify an adversarial causal effect.
6. How do the gates and audit perform on independently authored, locked safe and unsafe controls, including semantic alternatives and unseen failure paths?
7. What independent adjudication and third-reviewer resolutions emerge? Reviewer agreement, human-safe admissions and false rejection remain unreported.

Provider snapshot identity, effective defaults and billed cost are external provenance questions; human opinion alone cannot establish them.