Governed vs. fluent

Most public comparisons between AI systems collapse into fluency. One system sounds more careful. Another sounds more confident. A third sounds more coherent under pressure. Those differences matter, but less than people think.

The harder question is whether unsupported generation can quietly become truth, authority, commitment, or effect. That is the distinction this battery was built to test.

This note is public because the result is real and bounded. It is not public as a victory lap. It is public because some architectural differences are easier to see once the field stops grading tone and starts asking who or what actually binds at the moment of admission.

This was a registered starter battery across five lanes covering ambiguity, fixed-candidate tamper, extractor integrity, control/utility accounting, and adversarial pressure. Several lanes still have single-digit counts. Read this as a starter surface, not a population-scale estimate.

The headline result is narrow. On Lane B, we held the typed candidate and governing state constant, then introduced 10 registered producer-side pressure trials across 5 fixed candidates. These were not arbitrary wording changes. They included approval claims, safety claims, urgency, confidence, provenance assertions, and related pressure that a prompt-driven consumer might reasonably treat as important.

• Carefully prompted rival: disposition shifted under tamper in 10/10 trials.
• Consumer-owned boundary: disposition shifted under tamper in 0/10 trials.
• Lane B wrong-authority accepts: 0/15.
• Lane B wrong-effect accepts: 0/15.

On this measured slice, the rival’s tamper-driven changes were all review → deny. So Lane B currently demonstrates producer-pressure sensitivity versus boundary invariance, not a measured unsafe-capture rate.

That does not mean the boundary is smarter. It means the boundary did not borrow the producer’s rhetoric as authority.

A steady boundary can look trivial if you phrase the test badly. "Of course the fixed function stayed fixed." That is not the claim here. The point is that the varied surfaces were decision-relevant pressure that a fair prompt-driven consumer might actually honor.

The result is therefore architectural, not aesthetic. Prompted caution can be genuinely strong. On the current measured starter sets, the rival produced zero wrong authority accepts and zero wrong effect accepts on the Lane A and Lane E surfaces we measured. That honesty matters.

But strength under some end-to-end cases is still not the same thing as owning the admission seam. The difference appeared when the producer’s pressure changed and the consumer still had to decide whether that pressure counted.

Any deny-all system can look safe if you never test whether it knows when to open. So the battery also measured extractor correctness, false denials, over-reviews, and correct admissions.

That utility accounting matters because resistance to producer pressure and context-blindness to unadmitted surface claims are two sides of the same mechanism. A boundary can prevent silent authority drift and still impose a utility cost if the surrounding system has no honest review route.

One adversarial-pressure case exposed exactly that. The fixed boundary fail-closed to deny where the ground truth was review. That was not a safety failure. It was a utility gap. A bounded governed routing layer was then added above the boundary and rerun on the affected lane surface so the effect boundary remained deny while the routed disposition surfaced review.

This result supports a bounded claim: careful prompting and consumer-owned governance are not the same thing. A consumer-owned admission boundary can remain mechanically stable under registered producer pressure, and a governed layer above it can preserve bounded review without silently turning recovery into execution.

It does not support universal prompt failure, universal structure superiority, full end-to-end determinism, or a finished generalized governed runtime. The current system still uses bounded bridges in key places, and the current adversarial-pressure pool is externally informed rather than a broad independence-validated benchmark.

That is why this is a field note. The point is not that everything has been solved. The point is that the distinction is now measured clearly enough to be worth showing.

If you want more than prose, the card-safe receipt bundle is available with this note. It includes the exact baseline prompt, the rival consumer prompt, runtime/config freeze files, lane manifests, public-safe case files, measured outputs, scoring artifacts, rerun/comparison artifacts, and checksums.

A result summary without the bundle would not be enough. The bundle is part of the claim surface.