*(Historical record, filed 14 July 2026, before the v2.0 rename: "resolution" herein is the framework term since renamed "cohering", and claim labels are as of v1.6. Preserved unedited.)*

# The Container Problem — Red-Team Report
**v0.1 · Space Immanence · 14 July 2026**
**Referent: `The_Container_Problem_v0.1.md` (working note v0.1, committed verbatim alongside this report).**
**Status: the attack the note asked for. Companion documents: `Container_Redteam_Study_B_Items_v0.1.md`, `Container_Redteam_Study_C_Constraints_v0.1.md`, `Container_Redteam_Governance_v0.1.md`.**

---

## 0. Method and provenance

Two rounds of multi-agent adversarial review (43 agent runs total): six attack lenses (philosophical priority, predictive-processing priority, existing psychometrics, mechanism plausibility, internal coherence, the trajectory claim), a merge pass deduplicating 22 raw attacks into 18, and independent adjudication of every kill- or wound-graded attack by referees instructed to refute it — with the discipline that **every load-bearing literature claim had to be web-verified this session or marked "unverified, from memory."** Full-text fetches were mostly blocked by the environment's egress proxy, so most verification is at the level of abstracts and multiple independent search summaries; each attack below carries its verification status. Three constructive documents were produced in parallel (Study B items, Study C constraints, governance fit).

Disclosure: thirteen agent calls died on stochastic safety-filter false positives (prompts combining adversarial vocabulary with consciousness-dissolution content). All lost coverage was recovered: the missing adjudications were re-run under neutral phrasing, and the two lost attack lenses (predictive-processing prior art; clinical handling of representational limits) were rebuilt from dedicated literature-lookup agents, with the attack sections (§4, §5 below) then written by the coordinating model (Fable) rather than by an independent agent. Those two sections therefore carry one fewer layer of independent adjudication than the rest; they are flagged where it matters.

Severity vocabulary: **kill** = the claim fails under the note's own drawer logic, or its novelty case collapses, or a study loses its stated evidential authority. **Wound/major** = substantive revision forced. **Minor** = fix cheap, note survives locally.

---

## 1. Verdict at a glance

**No attack killed the programme.** Four attacks were adjudicated *sound at major severity* and force structural revision before anything is fielded. The priority rhetoric fails as written but the narrowest version of the move survives every attack we could mount. The strongest single result of the review is a **three-way convergence**: the internal-logic attack (M2), the formalization analysis (Study C constraint doc §5), and the clinical literature on representational limits (§4 below) all independently force the *same* repair — the medium encoding cannot be a default; it must be conditional on attention interrogating the remainder. When three hostile lines converge on one repair, that is signal, and v0.2 should be built around it.

| # | Finding | Adjudication |
|---|---|---|
| M2 | The flip contradicts the mechanism paragraph; Study C and drawer-condition 4 are written to the pre-flip claim, making condition 4 self-undermining | **sound, major** |
| M4 | B's trajectory kill-condition inherits the survivorship confound the note itself used to demote Study A | **sound, major** |
| M6 | The trajectory is retrodiction banked as prediction; "no rival predicts the sequence" is unargued and likely false for a minimally-extended attention schema | **sound, major** |
| M8 | Stage 1 ("the naive default is a point") rests mainly on folk-*theory* data the note's own x-phi caution disqualifies | **sound, major** |
| M3 | The container stage is on the syllabus of every source tradition (the formless-attainment arc *is* point→space→beyond-space); vocabulary controls are structurally blind to a procedural curriculum confound | split verdict (kill / wound); treated here as **major** |
| M1 | Metzinger's MPE/epistemic-openness model already derives empty-space phenomenology from modelling an unshowable variable | weakened to **wound** by both referees |
| M5, M7, M9 | Dennett's Cartesian Theater, the Projective Consciousness Model, and Jaynes's mind-space each falsify one of the note's broad priority sentences as written | wound / minor / wound |
| M10 | James's fringe and Gurwitsch's field: the presented remainder is heterogeneous and relevance-graded, contradicting "cannot itself be shown" as a generalisation | **sound, wound** |
| M14 | All four falsification conditions have open escape hatches; the section's title overclaims | **sound, wound** |
| M16 | The priority claim rests on the same first-pass method the note watched fail twice, and has no falsification condition of its own | **sound, wound** |
| M12, M13, M18 | Folk-theater citation cuts both ways; the sequence is generated by a committee of mechanisms, not darkening alone; B's items are miniature pointing-out instructions | sound (minor/wound) |
| M11, M15, M17 | Boundlessness psychometrics omitted; collapse-stage dilemma; psychedelic perturbation unaddressed | partly sound (minor after narrowing) |

What survived intact: the narrowest priority claim (§3), B's kill authority over the *existence* question (not the trajectory), the note's own concessions (all attacks on them scored zero, as instructed), and the falsification-first posture itself — every referee noted the note made the attack easier by stating its commitments plainly. That is worth keeping.

---

## 2. The four structural findings

### 2.1 M2 — The default/trajectory contradiction voids Study C's kill authority *(adjudicated sound; every quoted premise verbatim-verified against the note)*

The mechanism paragraph commits unconditionally: the remainder is produced "at every moment," the system "must model this remainder somehow," and the medium encoding is "what partial illumination produces **by default**." The Step 0 finding the note accepts says untrained subjects — who model by selective illumination as much as anyone — report a point. The patch ("the container should only appear once attention begins interrogating the remainder") makes the medium encoding conditional on a further operation, which is the opposite of a default. This is not a verbal slip, because Study C and drawer-condition 4 are both written to the unconditional claim: if C succeeds as specified, it predicts containers in the untrained, contradicting data the note accepts; if C fails as specified, that is exactly what the trajectory version predicts for the unconditioned case — yet condition 4 says the idea then drawers. Either the author honours condition 4 and drawers a claim their own trajectory says should show a point-shaped unconditional optimum, or invokes the flip and condition 4 never binds.

**Fix (from the adjudication, endorsed):** drop "default." State that under mere darkening the cheap encoding of the remainder is a point-like index (the egocenter), and the homogeneous-surrounding-empty medium is the predicted optimum *conditional on the remainder itself becoming the target of modelling*. Respecify C as a two-regime optimization (regime 1: remainder not queried → point/indexical optimum predicted; regime 2: ground-directed attention → medium optimum predicted) and rewrite drawer-condition 4 to fire on the two-regime prediction. The constraint document (`Container_Redteam_Study_C_Constraints_v0.1.md`, Appendix A) already contains the λ-parameterised version of exactly this.

### 2.2 M4 — B's trajectory kill-condition is the confound the note already named *(sound; verbatim-verified)*

Study A is demoted to "reconnaissance only" partly because "cross-sectional practice data also confounds development with survivorship." One paragraph later, Study B stakes both survival ("only if the loading strengthens with introspective experience") and drawer-condition 2 ("flat or decreasing across strata") on the identical cross-sectional design. The confound runs both ways: selection into practice can manufacture a strengthening gradient with zero within-person change (false survival), and differential attrition can flatten a real one (false drawer). So one of the four "fixed now" conditions is a condition a correct theory could fail and an incorrect theory could pass. Worse, condition 2 as written *contradicts the theory it polices*: the trajectory predicts rise **then collapse**, so a decreasing loading in the highest-practice stratum is the theory's own prediction, yet the condition counts "decreasing" as a kill (governance doc §3 caught this independently).

**Fix:** restrict B's kill authority to the existence question; either strike the trajectory clause from B's survival condition and drawer list, or commit to a longitudinal / randomized-training arm (meditation-naive participants, pre/post container measurement) that gives the ordering claim its own falsification condition. Split the collapse limb into a separately pre-registered prediction.

### 2.3 M6 + M3 — The trajectory is retrodiction, and rivals *do* reach the full sequence *(M6 sound-major; M3's factual pillars all verified, verdict split on severity)*

Every stage of point→container→collapse was on the table before the mechanism was asked to generate it — by the note's own narrative (Step 0 literature for the point; the container as explanandum; MPE collapse conceded as "already an observed result"). The note applies its retrodiction discipline to stage 3 alone, then claims discriminating credit for the whole sequence. And the rival scoring is asymmetric: darkening is scored after being reshaped around the data (the flip), rivals as frozen published artifacts. Two rivals reach the full sequence once allowed the same tuning:

- **Curriculum.** The classical Buddhist path makes "boundless space" (ākāsānañcāyatana) the literal object of the fifth absorption, transcended in turn through boundless consciousness, nothingness, and cessation — the point-to-space-to-beyond-space arc is a two-millennia-old syllabus, collapse included. Dzogchen sky-gazing, Mahamudra pointing-out, Wallace's shamatha curriculum, and MBSR's "spacious awareness" instruction deliver the container stage as explicit procedural content; the MPE-92M sample anchoring the collapse endpoint is ~44% Vipassana and ~35% Zen practitioners surveyed in five languages, so the instruction is itself cross-linguistic. **A cross-linguistic vocabulary control cannot see a procedural confound delivered identically in every language.** The null rival — practitioners report what their manuals teach, in the order the manuals teach it — predicts the sequence exactly, including B's strata gradient.
- **Attention schema, minimally extended.** "Graziano's schema has no reason to reshape with contemplative training" is unargued and likely false on AST's own terms: the schema is a control model of attention (Webb & Graziano 2015; Wilterson et al. 2020, both verified at summary level), contemplative training is attention training, and the note's own trigger condition — attention interrogating the remainder — is precisely the regime in which the schema becomes its own modelled object.

**Fix:** demote "the discriminating signature" to "a candidate signature; as of this note a post-hoc arrangement of three known results, subject to the discipline we applied to MPE collapse." State the rivals' predictions in their own vocabularies before claiming discrimination. Commit to the one test that actually discriminates darkening from curriculum: **a tradition-contrast prediction** — practitioners of ground-interrogating trainings that never use space instruction (pure noting practice, kōan work) should still develop the container stage on the darkening account, and should not on the curriculum account. The note currently commits to no such test.

### 2.4 M8 — Stage 1 is built on the wrong evidence type *(sound; all three sources method-verified)*

Two of the three citations for "what untrained populations report is a point" measure no one's phenomenology: Forstmann & Burgmer's participants marked where consciousness happens *on images of a brain* (folk theory about a generic person; total N=2,057 confirmed); Starmans & Bloom measured closeness judgments about third-party cartoon characters. Only Bertossa et al. is first-person, and its interview protocol presupposes a locatable answer. The note cannot deploy Sytsma to argue lay concept-attribution diverges from phenomenology (killing universality) and then build stage 1 of the replacement claim on lay concept-attribution. Additionally (M12, sound-minor): the Cartesian Folk Theater citation cuts both ways — the study's own construct is a located *presentation venue* (contents experienced at a downstream locus, partly after processing), which satisfies the note's own container definition. Read that way, presented-to structure is already present before training and stage 1 vs stage 2 must be distinguished by *format* (medium signatures), not by presence of presented-to structure.

**Fix:** type the evidence in the Step 0 paragraph (folk-conception vs first-person); restate stage 1 as a prediction B's non-meditator free-report arm must confirm rather than an observed result; and state the shape-not-function reading of the folk-theater finding explicitly.

---

## 3. Priority: what "unclaimed" shrinks to

The note's strongest sentence — "Nobody derives the empty surrounding medium from the unpresentable remainder. That move is unclaimed as of this note." — was attacked from four directions. Outcome: **the sentence survives only in its narrowest reading, and none of the surrounding rhetoric survives.**

- **Metzinger (M1; both referees: wound, not kill).** The MPE programme the note already cites contains a positive generative model: pure awareness as the content of a Bayesian representation of tonic alertness, describable as "a model of an unpartitioned epistemic space" (Metzinger 2020, PhiMiSci, verified at summary level across three independent records), developed in *The Elephant and the Blind* (2024) into the Model of Epistemic Openness, where emptiness/spaciousness reports are the felt quality of a space of knowing. Structurally: an unshowable variable (the system's own epistemic capacity), modelled, in a spatial format, read phenomenologically as the space of awareness. The note engages Metzinger only as "a bandwidth story" (the 2003/2009 tunnel) and as MPE-92M data. What remains genuinely unclaimed: the *remainder-of-selection* (rather than capacity/alertness) as the modelled variable; a *compression-optimality derivation* of all three signatures; extension to the *untrained/ordinary* container. The public version must position against the MEO explicitly and state a discriminating prediction ("capacity encoded as space" vs "remainder encoded as space" — they differ, e.g., on whether the container should covary with tonic-alertness manipulations).
- **Dennett (M5; sound-wound).** "The container structure ... is an unaddressed problem intuition" is false as written: the Cartesian Theater is the named central target of the field's most famous error theory, with a diagnosis (Cartesian materialism) and a replacement architecture. The note's own cited large-N study is *named after* Dennett's concept, yet Dennett appears nowhere in Key sources. The claim must become: addressed as a theorist's error and folk seeming, never given a sub-personal generative mechanism producing the empty-medium phenomenology — and the note must say why Dennett's diagnosis doesn't count as one.
- **Projective Consciousness Model (M7; narrowed to minor).** Rudrauf/Williford/Friston's PCM formally derives a surrounding field of consciousness (3D projective geometry under active inference) and gives the Husserlian horizon precisely the "generative mechanism" the note says Husserl lacks. Defense available and endorsed by the referee: PCM derives the *perceptual spatial frame* — Study B's first, controlled-for factor: content-structured, perspectival, neither homogeneous nor empty, not derived from a remainder. But the defense must be made in the note, PCM must enter the related-work map, and Study C's encoding space must include PCM-style projective encodings or the adversarial fix is rigged by omission (the constraint document includes them under E8/E9 regimes).
- **Jaynes (M9; sound-wound).** Jaynes derived the container from a mechanism fifty years ago: consciousness as an analog mind-space constructed by metaphor, with an analog "I," and spatialization as "the first and most primitive aspect of consciousness." This narrows "nowhere as derived mechanism" to "no *sub-personal, non-linguistic* derived mechanism" — and, worse for Study B, upgrades the vocabulary objection to a *construction* objection: on Jaynes's account, acquiring the metaphor system genuinely builds the phenomenology, so "metaphor inventory" and "experience strata" are the same variable and B's planned dissociation collapses. B needs a discriminating prediction against a construction account (the tradition-contrast test again, plus the items document's cross-family convergence design).
- **Place 1956 (governance doc §1.4).** Chalmers's *catalogue of intuitions* indeed contains no container entry (verified as consistent), but among his canvassed *solutions* sits introjection/the phenomenological fallacy — treating properties of the representation as properties of an inner field. Container-adjacent machinery inside the canonical catalogue; cite it and narrow.
- **M16 (sound-wound), the meta-point:** the note's method for negative existentials — "a first-pass literature check" — is the method its own narrative shows failing twice, and the falsification section contains no drawer condition for the priority claim. v0.2 must add one: *the move is claimed if any prior work derives a spatially surrounding phenomenal medium from a representational-completion or remainder-modelling requirement*, with the search protocol stated. This review found four near-claims in one pass; a hostile referee will find more.

---

## 4. The mechanism, against the clinical record
*(Section authored by the coordinating model from a dedicated literature-lookup agent's sourced report — every citation below search-verified this session at summary level unless marked; one fewer layer of independent adjudication than §§2–3.)*

The premise "the system must model this remainder somehow" is contradicted by the best-documented cases of representational systems handling their own limits — where the observed default is **non-representation, not representation of absence**:

- The physiological blind spot is not experienced as a gap, hole, or dark surround; it is perceptually completed with surrounding pattern and colour (Ramachandran & Gregory 1991, *Nature*; artificial-scotoma paradigm). Where the system does something about its limit, it supplies *positive content*, not an empty medium.
- Hemianopia is frequently asymptomatic — a "negative scotoma" is defined clinically as one the patient is unaware of; neglect patients neither experience nor report an edge, darkness, or felt absence (Bisiach & Luzzatti 1978: the neglected half of imagined space is simply not generated; Marshall & Halligan 1988: the burning house influences choice while the patient reports no difference). Anosognosia for hemianopia dissociates from neglect itself (Bisiach et al. 1986).
- Anton's syndrome patients do not perceive a void; they confabulate positive visual content.
- Inattentional blindness leaves no phenomenal placeholder (Mack & Rock 1998; Simons & Chabris 1999) — no "something happened but unspecified."
- Dennett's formulation of exactly this point — *the absence of representation is not the representation of absence* — is the canonical objection the note must answer, and it comes from the same author the note fails to cite (§3).
- The one literature where absence *is* positively represented — absence perception (Farennikova 2013, template-mismatch account; Sorensen 2008 on shadows) — requires an actively held expectation checked against input. Mere lack of stimulation, without a template, is simply unrepresented.

Three consequences. **(a)** The mechanism's modelling demand is empirically false as a default; the burden is to show why the attention-remainder differs from the blind spot, the neglected hemifield, and the unattended gorilla. **(b)** Where limits *are* handled, the observed encodings are completion-with-content or nothing — never a homogeneous empty surround; the medium has no clinical precedent. **(c)** The honest note: the absence-perception literature *independently supports the conditional version* of the note's claim. Farennikova's condition for representing absence — an active template directed at where the missing thing would be — is structurally the note's own flip: the remainder gets encoded only when attention queries it. The clinical record kills the default wording and quietly motivates the trajectory wording. This is the same repair M2 and the constraint document force (§1), reached from a third direction.

Two further mechanism wounds stand from round 1: **M10** (sound-wound) — where ordinary experience *does* present its remainder, it presents it as heterogeneous and relevance-graded (James's fringe; Gurwitsch's theme/thematic field/margin), so "cannot itself be shown" must weaken to "cannot be shown *as figure*," and the note needs a two-level story (structured near-remainder, allegedly medium-encoded far-remainder) with the switching boundary specified before C's target is well-posed. And the scalar-dominance result (constraint doc §5.2): a medium is a scalar plus an index set plus enclosure topology, so *no compression principle can ever prefer it* — only task demands can, which makes task-ensemble selection the master experimenter degree of freedom and the note's phrase "under compression constraints" incomplete as stated.

---

## 5. Predictive-processing prior art on the trajectory
*(Same provenance and caveat as §4.)*

The claim "no rival on the board predicts the full sequence" was already wounded by M3/M6; the predictive-processing literature the note never engages weakens it further:

- **Laukkonen & Slagter 2021** place focused attention → open monitoring → non-dual awareness "on a single continuum, where each technique relinquishes increasingly engrained habits of prediction, including the predicted self," via precision-weighting and shrinking counterfactual/temporal depth, ending in pure awareness. That is a staged, mechanism-driven account of contemplative phenomenology terminating in the collapse endpoint — with open monitoring, the middle stage, characterised in the surrounding literature by "spacious awareness" and the background of experience coming to the foreground. It does not derive the *container format* — but as a rival for "predicts a stage-ordered phenomenology ending in collapse," it is on the board and unengaged.
- **Limanowski & Friston 2018** give the note's trigger operation a prior formalization: introspective attention deploys precision that renders normally-transparent model states opaque — their own example is a mindfulness exercise in which sustained attention makes the construction process of thoughts phenomenally accessible. "Attention turned onto the ground changes what is phenomenally present" is not an unclaimed mechanism; it is the transparency/opacity literature's core move. What remains the note's own is the *content* of what opacity reveals (a medium rather than process-properties).
- **Metzinger's contraction principle** (2020, *Cognitive Neuropsychology*): ordinary self-bound awareness as a local "contraction" of an epistemic field — a graded frame in which de-contraction maps naturally onto spacious-awareness phenomenology. Together with the MEO (§3) this brackets the note's middle stage from the theory side, and **Sandved-Smith et al. 2021** plus the emerging computational-phenomenology line (Tal et al. 2025/26) show the formal modelling territory C would enter is already populated.

Consequence: v0.2's related-work map must have a predictive-processing column, and the discriminating-prediction burden rises — darkening must say what it predicts that *precision-reallocation accounts do not*. Candidate (offered, not established): precision accounts predict opacity reveals process-structure (heterogeneous, dynamic), darkening predicts a homogeneous empty medium at the intermediate stage; B's item facets are in principle sensitive to that difference.

---

## 6. Remaining adjudicated findings, in brief

| # | Finding | Verdict | Cheapest honest fix |
|---|---|---|---|
| M11 | Forty years of boundlessness psychometrics (OAV/5D-ASC oceanic boundlessness; Studerus 2010's separable Disembodiment and Unity factors; EDI; NADA-T) unengaged | partly sound → minor | B must benchmark incremental validity against these pools; a "residue factor" collinear with unity/boundlessness items is the collapse pole renamed. Note: referee confirmed **no existing instrument measures the presented-to container as separate from body/frame** — the note's target factor genuinely is unmeasured; the gap is real but must be argued, not assumed |
| M13 | The sequence is generated by a committee: embodiment gives the point (note's own words), MPE gives collapse; darkening does real work only for the middle transition | sound → wound | Say so: a two-mechanism trajectory whose novel prediction is the stage-2 transition |
| M14 | Every falsification condition has an escape hatch (item-blame; population hatch — a naive-arm null is *predicted* by the flipped theory; "tracking" with no model comparison; C's terms undefined) | sound → wound | Adopt the tightened wordings in the governance doc §3 verbatim; add the missing D condition, a staleness clause, and public drawer semantics |
| M15 | Collapse stage: analytically true if MPE = zero figure-ground (vacuous check), unadjudicated if MPE states include content — the note's own Study A factor list says some do | weakened → scratch, but the fix is load-bearing | State the figure-ground status of the collapse state before the check can do work |
| M17 | Psychedelics restructure boundary/frame phenomenology in untrained subjects (Griffiths 2006 verified); no drawer condition covers acute perturbation although Study D already stakes claims on one (Ganzfeld) | partly sound → minor | Add the scope sentence: acute data become probative only after B's three-factor separation exists; then commit D to a psychedelic-adjacent prediction or say why not |
| M18 | B's container items are miniature pointing-out instructions; the contamination runs in the survival direction | sound → wound | Free-report-first elicitation scored blind; matched-abstraction foil frames; survival condition rewritten to beat the foil baseline (all now in the items document) |

---

## 7. What survived

Stated plainly, because a red-team report that only lists wounds misrepresents the position:

1. **The narrow derivation claim survived four priority attacks.** Nobody found a prior derivation of a homogeneous-surrounding-empty medium *from the remainder of selection under resource constraints*. Metzinger derives space from capacity-modelling; PCM derives the perspectival frame; Jaynes derives the container from language; Dennett diagnoses without a sub-personal mechanism; Place names the fallacy. The clearing is real — it is just one field wide, and every neighbour must be on the map.
2. **B's existence question survived as the right battleground.** Every referee agreed the three-way separation (frame / body / presented-to container) is unmeasured territory — M11's referee confirmed it against the boundlessness tradition explicitly. The kill authority is earnable; the items document shows the price.
3. **The falsification-first posture survived and paid.** The note's plain statement of commitments is what made adjudication decisive; several attacks failed precisely because the note had already conceded the ground (the instruction "attacking a concession scores zero" retired multiple drafts).
4. **The conditional mechanism is better than the one the note wrote.** The repair forced by M2 is independently motivated by the absence-perception literature (§4c) and independently derived by the constraint document's scalar-dominance analysis. v0.2's mechanism is more falsifiable than v0.1's: it predicts a *transition* (E8→E6 under rising introspective demand, per constraint doc Appendix A), which is a sharper object than a default.

---

## 8. What v0.2 must do (consolidated, in priority order)

1. Rewrite the mechanism paragraph conditionally: point-index by default; medium conditional on ground-directed attention (M2, §4, constraint doc §5.2). Respecify C as two-regime; rewrite drawer-condition 4 accordingly.
2. Strike the trajectory clause from B's survival condition and drawer list, or commit to the longitudinal/randomized-training arm; split the collapse limb into its own prediction (M4; governance §3 wordings).
3. Demote the trajectory to candidate signature; add the tradition-contrast commitment (ground-interrogating lineages without space instruction) as the discriminating test against curriculum and construction rivals (M3, M6, M9).
4. Rebuild the related-work section around the actual neighbour map: Dennett, Metzinger's MEO + contraction principle, PCM, Jaynes, Place, Laukkonen & Slagter, Limanowski & Friston — each with the one-sentence discriminating difference (§3, §5).
5. Add a priority falsification condition with a stated search protocol (M16).
6. Type the Step 0 evidence (folk-conception vs first-person); restate stage 1 as a B-testable prediction; state the shape-not-function reading of the folk-theater result (M8, M12).
7. Weaken "cannot itself be shown" to "cannot be shown as figure"; specify the fringe/far-remainder boundary (M10).
8. Adopt the four tightened drawer-condition wordings plus the missing conditions (D-study, staleness, public drawer semantics) from the governance document §3 (M14).
9. Field B only through the items document's machinery: two metaphor-family facets with cross-family convergence as signal, free-report-first, foils, order arms, the §4.3 discriminant between "no factor" and "items failed," Korean as the test language, incremental validity against OAV/EDI/NADA (M18, M11).
10. Freeze the C constraint document (hash-commit) before any formalization; accept its §5.2 downgrade of C's claim to conditional-existence form explicitly, or strike C's confirm role (constraint doc, binding).
11. Apply the governance quarantine before anything goes public: `container.json` with its own namespace, the P2 sign-error block stated explicitly (a confirmed mechanism is a deflationary *rival* to P2, not support), the single legitimate B→S1 weak-reading edge pre-registered symmetrically, and "darkening" kept out of all instruments and preregistrations (governance doc §§1–4).

---

## 9. Companion documents

- **`Container_Redteam_Study_B_Items_v0.1.md`** — 25-item candidate pool with hostile per-item review (5 kills, incl. the item that would have "worked" artefactually), the two-facet metaphor-family design, the Korean translatability analysis, and the pre-registered decision table separating "no container factor exists" from "our items failed."
- **`Container_Redteam_Study_C_Constraints_v0.1.md`** — the pre-commitment specification the note assigns to Fable as red team: ten encoding-space candidates, four cost functions with two-sided bias analyses, twelve experimenter degrees of freedom with binding mitigations, executable signature tests, the decision rule (ties resolve against the hypothesis), seven failure-reporting conditions, and the feasibility verdict (C as posed is not formalizable; the conditional reformulation retains full kill authority with capped confirm authority). **Becomes binding at hash-commit; must be frozen before any C work.**
- **`Container_Redteam_Governance_v0.1.md`** — node-by-node transfer analysis (including the P2 sign error), the one legitimate symmetric edge, the container.json quarantine sketch with drift-test extensions, the drawer-condition audit with tightened wordings, and the naming-risk audit of "darkening."

---

*Report synthesized from the two workflow rounds' verified outputs. Full attack texts, adjudication rationales, and verification trails are preserved in the session records; the merged attack set and verdicts are reproducible from the referenced companion analyses. Circulated the way it was commissioned: to be attacked.*