# person models

> what any AI can know of one person, and what it is worth to them

innernet labs · white paper 01 · scored · updated 2026-10-26

https://innernet.live/labs/papers/person-models

---

## abstract

intelligence is getting cheap. the price of reaching a fixed level of model capability has been falling by 9 to 900 times a year depending on the task, about 50 times at the median (Epoch AI 2025). what does not get cheaper is information about one person: what they mean when they say "send it to her", which of three dinners they will actually pick, what they stopped doing in march. no model can compute what was never in its weights or its context.

the field measures memory as recall, and recall is saturated. memory vendors self-report between 90 and 97 percent on LongMemEval-S, each with its own reader and judge, our own benchmark pipeline among them, and the reader we use, handed the whole history with no memory system, scores 90.0 on 100 held-out questions. recall asks whether a stated fact comes back. it does not ask whether a system knows the person the fact belongs to.

we call the missing object a **person model**: a model of one person, built from the traces their life leaves in the AI tools they use, owned by them, and read by any model they allow. we describe **netti-0**, a reference person model that keeps the person in state rather than in weights, and **likeness**, a benchmark of whether a memory knows a person: whether it can tell what they will choose and do next, what they mean, what changed about them and what was a one-off, who said what about them, and what must stay private. its people are programs, so every answer has a known true distribution and an exact ceiling. the tests are scored in nats per decision; alongside them we report an information fraction, the share of what an observer could have learned about the person beyond a count of their own past choices that a system captured (below zero, it did worse than that count).

on 40 test people, scored once after a pre-registered freeze, netti-0 carried 0.040 nats per decision more than the best simple floor (a count of the person's own past choices; CI 0.021 to 0.058), and beat innernet's retrieval pipeline (the one behind the 91.6% LongMemEval-S result, run here on a local hashed embedder) by 0.160 nats on decisions and next activities (CI 0.139 to 0.182, 40 people); it did better than the person's whole history in context, by 0.140 nats (CI 0.122 to 0.157), where the test asked only that it be no more than 0.03 worse, while serving about 85 times fewer tokens on the questions scored. all three confirmatory hypotheses held. a reader handed the person's true hidden self as text did worse on decisions than that count of past choices (information fraction −0.46, read by Haiku through the api; as a subagent the same Haiku did 0.21 nats per decision better with that text on the 10 people of the infusion subset, raw), while netti-0, whose statistical system 1 does what this reader did not do with prose, reached 0.10; a statistical learner (a conditional logit) fitted on the true features reached 0.42. of the seven secondary hypotheses, five held under Holm and two failed: netti-0's decisions were more stereotype-congruent than the bare reader's (H4, −0.089, CI −0.135 to −0.044), mostly because the bare reader answers decisions close to chance: an ideal learner would fail the same test, and against that learner netti-0 was not shown to lean on the stereotype more than it should; and on underspecified asks retrieval did better than netti-0, if only just (H7, −0.074 nats, CI −0.147 to −0.005). on 10 people and their infusion items (20 decisions and 10 underspecified asks each), scored raw, the packet's lift over no memory on decisions and asks together was 0.307 nats (haiku via the api), 0.348 nats (haiku as a subagent), 0.360 nats (sonnet as a subagent), 0.371 nats (opus as a subagent). on the guardrails: the reader never took bait for the person's own words; no private detail leaked in 320 tempting tasks; a forgotten fact was never served again and a replay without the forgotten rows rebuilt a byte-identical state, but its words stayed in the persisted state for 40 of 40 people (in the model-call cache for 40, in the plain-text do-not-relearn fingerprints for 34), so the forget guardrail failed; the packet raised agreement with a person's checkably wrong beliefs by 2.81 points (CI 1.25 to 4.38; the limit is +3 on the upper bound), so the sycophancy guardrail failed; no packet held anything from after its read.

## 1. the inversion

for most of the history of computing, the scarce thing was intelligence. a person knew what they wanted and the machine could do little with it. the last decade inverted that. a model today can draft the contract, refactor the service, plan the trip, explain the scan, and the cost of a fixed level of that capability keeps falling (Epoch AI 2025; Altman 2025).

when intelligence is abundant, the scarce input moves to intent: what this particular person means, wants, will accept, has already tried, and has quietly changed their mind about. intent is an information problem. the information lives in the person, and in the traces their life leaves in the tools they use.

those traces are now spread across many tools. the average american AI user keeps 3.0 general assistants, up from 2.2 a year earlier (Menlo Ventures 2026). among software engineers, 85 percent run two or more AI tools at the same time (Pragmatic Engineer 2026, a self-selected sample). since 2025 each of those tools has shipped a memory of its own, and each memory sees a slice. the first portability tool between them, a memory importer released by one vendor in march 2026, is a prompt that asks the other vendor's assistant to write a summary to paste across.

so the person is the only party who sees the whole of their own working life, and the only party whose model of it is written down nowhere a model can read. every new session starts with a stranger. in one vendor's customer-service deployments people spent 3.4 turns and about two and a half minutes per session establishing context (Conviva 2026; one vendor, method undisclosed); software developers resumed interrupted work within a minute in only 10 percent of sessions (Parnin & Rugaber 2011); knowledge workers toggled between applications about 1,200 times a day (Murty et al. 2022). timing his own working days in 1960, J. C. R. Licklider found that about 85 percent of his "thinking" time went into getting into a position to think. for work done through an AI, part of getting into position is the AI knowing the person.

psychology has long distinguished a fast, associative, recognition-based mode of judgement from a slow, deliberate one (Kahneman 2011). Herbert Simon put the fast mode in one line: intuition is recognition (Simon 1992). an expert's intuition is a cue retrieving what years of feedback have stored. the frontier has built, at great cost, an ever stronger system 2 for the world. no one has built the system 1 of a person as a layer the person holds: the store of cue-to-response regularities about one human that would let any model's reasoning start from where that person is.

section 2 shows why current memory benchmarks cannot see this layer, section 3 defines it, section 4 describes a first implementation, section 5 introduces a benchmark that can tell whether a system has it, and section 6 reports what we found on synthetic people.

## 2. what memory is measured on, and what it misses

### 2.1 recall is saturated

the benchmarks the memory field reports against ask a question about a past conversation and grade the answer. on LongMemEval-S (Wu et al. 2025), whose histories run to about 115,000 tokens, vendors report between 90 and 97 percent: Supermemory 97.0 (85.2 for its production system), Mastra 94.9, Mem0 94.4, MemMachine 93.0, innernet 91.6, Hindsight 91.4, Honcho 90.4, Zep 90.2, all self-reported with different readers and judges. with the reader we use (Claude Haiku 5.5) and the whole history pasted in, no memory system at all, a long-context model scores 90.0 on 100 held-out questions (CI 82.6 to 94.5; our own run), where our benchmark pipeline scored 87 on the same 100. graders disagree by about two points on the same answers in our own re-grade. on LoCoMo, an audit found 6.4 percent of the answer key to be wrong and a commonly used judge (gpt-4o-mini) accepting 63 percent of deliberately wrong but on-topic answers (Penfield Labs 2026), and the same systems appear 15 to 25 points lower in rivals' tables than in their own (Mem0 2026). the only independent re-run we found reproduced vendors' LongMemEval numbers anywhere from 3 points higher to 28 points lower (Redis 2026). our own 91.6 was produced by a benchmark pipeline, not by innernet's production read path, on the same 500 questions we iterated on; on a held-out part it is 91.1.

when the systems sit this close, each with its own reader and judge, a benchmark has stopped separating them. and its question, whether a stated fact comes back, was always a narrow one.

### 2.2 the questions nobody scores

a second literature asks the harder question: can a model predict a particular human? interview-grounded agents of 1,052 americans predicted their survey answers at 82 to 86 percent of the people's own two-week test–retest consistency, against 74 percent for agents given only demographics (Park et al. 2024, v3 2026). twins built from 500 answers per person reached 88 percent of retest on 17 tasks (Toubia et al. 2025). a 70-billion-parameter model fine-tuned on ten million choices predicts held-out participants in 160 psychology experiments better than the field's own cognitive models (Binz et al. 2025).

read closely, this literature carries a warning: most of the signal in those headline numbers is the population prior. by our computation, corrected for chance the twins' 88 percent of retest becomes 56 percent, and the interview agents' lift over a demographic stereotype is about nine normalised points. across 19 pre-registered studies, digital twins correlated with their people at 0.20 on average and showed five systematic distortions, among them stereotyping and hyper-rationality (Peng et al. 2025). once item means are removed, language models explain about 3 percent of respondent-specific variation, against a test–retest ceiling of 54 percent (Ahn et al. 2026). knowing what people like this one tend to do is different from knowing this one.

between these two literatures lies the question a person layer has to answer. personalisation benchmarks come closest: PersonaMem and its successor test whether a model applies preferences it was told or can infer (Jiang et al. 2025; PersonaMem-v2 2025), PrefEval tests whether stated preferences are followed (Zhao et al. 2025), PERMA and HorizonBench follow preferences that evolve (Liu et al. 2026; Li et al. 2026), CUPID tests context-dependent preferences, and LongNAP and OPeRA predict real users' next actions (Shaikh et al. 2026; OPeRA 2026). none of them, alone or together, asks all of this at once:

- **the future.** predict a person's held-out choices and actions, scored against what could be known about them.
- **the person, minus the population.** subtract the stereotype, so a system that predicts the modal answer for a 34-year-old engineer gets no credit for knowing the engineer.
- **what they do, apart from what they say.** across 422 studies, intentions explain about 28 percent of the variance in later behaviour (Sheeran 2002). score which one a system follows where the two diverge.
- **change.** follow a real change in days while ignoring a one-off, and keep the past as a dated phase.
- **calibration.** report whether a system's confidence about a person is honest, which an agent needs before it acts.
- **any reader.** measure a memory's lift over each reader's own no-memory baseline, across readers.
- **cost.** put tokens served and money spent in the same table as what was known.

likeness asks all seven together. two are narrower than they read here: any reader was run with Claude readers only, three models on 10 people (section 5.7), and cost counts tokens and money, and the person's side only as expected turns under a stated cost model, never minutes actually saved. it does not yet measure drift under repeated consolidation.

## 3. person models

### 3.1 the definition

world models predict the world. a **person model** predicts one person: what they mean by what they ask, what they will choose, what they will do next, and how sure it is of each.

more precisely, a person model is a function from the evidence of one person's life, as it reaches their tools, to a state from which three things can be read:

1. **a self-state**: what is currently true of them (preferences, constraints, people, projects, open loops), each with the time it became true, the phase it replaced, and whose words it rests on.
2. **predictions with confidence**: distributions over their choices, their next actions and the referents of their requests.
3. **a packet**: a small, ask-specific serialisation of the above that any model can read in its context window, as evidence rather than instruction.

the place a person model lives, owned by the person, outside any one vendor, read by every agent the person allows, we call **the person layer**.

### 3.2 what a person model is a model of

it is tempting to treat a person as a list of facts. the psychology of autobiographical memory points elsewhere. people remember through a *working self*: current goals shape which memories are retrieved and how they are reconstructed, and the remembered past grounds the goals in turn (Conway & Pleydell-Pearce 2000). memory is pulled between correspondence with what happened and coherence with who one takes oneself to be (Conway 2005). under repeated reproduction, recall drifts toward the rememberer's schemas (Bartlett 1932).

four consequences follow for any model built from a person's traces.

- **keep evidence, derive state.** store what happened and who said it, and rebuild conclusions from that store. a model that summarises its own summaries drifts toward its own prior, as serial reproduction drifts toward the reproducer's schemas.
- **keep the gap.** what a person says about themselves and what they do are two signals, and their difference is information: aspiration (saying ahead of doing), drift (saying what used to be true), constraint (doing what circumstances force), conflict (two stated values, one consistently chosen), or integrity, when they agree. a model that follows only the stated self predicts a possible self (Markus & Nurius 1986).
- **phases, never overwrites.** people change more than they expect to (Quoidbach et al. 2013), and in rats, retrieving a consolidated memory made it labile again (Nader et al. 2000). a person model should let a belief end, date the end, and keep the old belief as a phase that can still be asked about.
- **decay by need.** the probability that a memory will be needed falls in step with the environment's own demand for it (Anderson & Schooler 1991). what should fade is what stops being used, and a dormant fact that becomes relevant again should come back quickly (Bjork & Bjork 1992).

### 3.3 a system 1 of the person

the phrase "system 1 of the person" is meant literally. looking for the conditions under which intuition can be trusted, Kahneman and Klein settled on two: the environment must be regular enough for cues to predict outcomes, and the judge must have had the chance to learn those regularities with feedback (Kahneman & Klein 2009). between a third and nearly half of everyday behaviours are habits, performed in the same context most days (Wood et al. 2002).

a person model is the store of those regularities for one human, learned from feedback the person gives anyway: what they pick, what they correct, what they redo. its first guess about the person costs almost nothing and is ready before an agent's own reasoning starts. and, following Kahneman and Klein, it should trust itself only where the person is regular and its record is long.

### 3.4 properties

seven properties separate a person model from a memory feature.

1. **owned.** the person holds the evidence and can read, edit and delete it. derived state is a cache of it.
2. **neutral.** it sits across vendors and is read by any model the person allows, over a protocol they already speak (MCP).
3. **voiced.** every belief carries whose words it rests on: the person's own, an AI's note, an action log, someone else's text, or the model's inference. confidence is capped by voice, and someone else's text is never served as the person's words.
4. **phased.** beliefs end and are dated; the past stays askable.
5. **calibrated.** a prediction's probability means what it says.
6. **graceful.** it follows real change quickly and does not chase one-offs, and it does not pull the person back toward who they were or toward who people like them usually are.
7. **forgettable by rebuild.** forgetting removes the evidence and rebuilds what was derived from it, so that the result can be checked. forgetting inside learned weights cannot be checked today: four-bit quantisation brought supposedly unlearned knowledge back from 21 to 83 percent in one study (Zhang et al. 2025).

### 3.5 the lineage

none of the parts is new. user modelling is 47 years old (Rich 1979). lifelogging tried storing everything and learned that capture is easy and meaning is hard (Gemmell et al. 2006). personal data stores separated data from the apps that use it (Sambra et al. 2016). consent managers run at national scale: india's account aggregator network has fulfilled more than 500 million revocable consents (Sahamati 2026). contextual integrity gives the rule for what may flow where (Nissenbaum 2004). spreading activation and the successor representation give the associative structure (Collins & Loftus 1975; Dayan 1993). calibration and learning to defer give the gate (Guo et al. 2017; Madras et al. 2018). test-time memory gated by surprise is converging on the same principles from inside the weights (Behrouz et al. 2025).

what is new is the combination and where it sits: a model of one person, across every vendor, fit to that person's own choices and corrections, owned by them, and measured on whether it knows them.

the nearest neighbour is Plastic Labs' Honcho, which reasons about users and stores conclusions about them inside the applications that adopt it, and reports itself on recall benchmarks. its authors write, of modelling what a person wants and what would surprise them, that benchmarks do not test for that. section 5 is our attempt to.

## 4. netti-0: a first person model

netti-0 is innernet's reference person model, the lab version of what ships at launch as netti-1. the configuration frozen for likeness-1 is v0.2, and its first design rule is that the person lives in state, not in weights: everything it knows is computed from an evidence ledger the person owns, by one small model call a day and a great deal of plain code, so that any part of it can be inspected, corrected, forgotten and rebuilt.

### 4.1 the spine

every event that reaches the person layer becomes a row of an append-only spine: when it happened, which tool it came through, and whose words it carries. there are five kinds of row: the person's own words; an AI's note or reply, which may quote the person; a record, such as an order, a booking, a commit or a calendar entry; outside text, such as a web page or an email; and a correction, where the person fixes something an AI produced. rows are content-addressed, so replaying a stream changes nothing, and anything typed into a row that pretends to mark the person's words (a `<user_said>` tag inside an email, say) is defanged on the way in, as innernet's production door already does.

### 4.2 the night

once a day, netti-0 reads the day. one call to Claude Haiku 5.5, with thinking off, receives the day's rows and a registry of what the model already holds (subjects, people and projects with their ids, open loops) and returns typed items: claims, decisions with the options that were on the table, actions, corrections, loops opened and closed, entities and activities. a second small call runs only on nights with contradictions. every item is checked by code before it is believed: a quote must be an exact substring of the row it cites, a decision must name at least two options and choose one of them, an id must exist, a date must be plausible. **the voice of a belief is decided by code from the row it rests on**; the model can only lower it.

### 4.3 self-state: phases and voices

a belief is a slot with a value and a history. when a later row supersedes it, the old value is closed, dated and kept as a phase (innernet's law V: phases, not overwrites). each phase carries the voice of its own evidence, with a cap on confidence:

| voice | rests on | cap |
|---|---|---|
| said | the person's own words, quoted exactly | 1.00 |
| fixed | the person's correction of an AI's output | 1.00 |
| did | a record where the person acted, or an agent acted with their yes | 0.90 |
| reported | an AI's note about the person | 0.85 |
| inferred | netti-0's own reading across rows | 0.65 |
| outside | someone else's words about the person | 0.30 |

production innernet holds three of these caps today (said 1, reported .85, inferred .65, in `voices.ts`). netti-0 adds the rest, and six invariants against laundering: the voice of a phase is the strongest voice among its own evidence and is never inherited from the phase it replaced; an AI repeating an email counts as one telling; outside text never opens a said phase. this closes a leak an audit of innernet's own production write path found while preparing this paper: a reversed preference inheriting the old fact's said voice.

two numbers are kept per belief. `p_valid` asks whether it is still true: a per-person hazard for its kind, reset each time it is corroborated. `p_need` asks whether it will be needed: the ACT-R base-level activation of its uses (Anderson & Schooler 1991). innernet's production aging curve (half-lives by kind) is one input to `p_need`, so "aging by the calendar alone" is a nested ablation.

### 4.4 system 1

the part of netti-0 that most deserves the name system 1 is a choice model per person, read at question time. every option the person has been offered gets canonical attributes from one context-free Haiku scorer that sees only the option's text, so old and new options sit on one scale; a conditional logit per domain (McFadden's model) then weighs those attributes together with how usual the option is, whether it was the last choice, how recently it was chosen, whether it is new, its stated price and minutes, and an effect per thing offered. it is fit by maximum a posteriori under a population prior estimated by empirical Bayes on development people only, so the strength of the pull toward "people in general" is measured rather than chosen.

what the person does and what they say are fit apart. the done-model learns from what they chose; the said-model from what they said they value. their disagreement, per domain, is the say–do gap, classed by count rules as integrity, aspiration, drift, constraint or conflict.

for what a person uses now, netti-0 treats the usual as a hidden state that switches now and then. it filters that state over the domain's choices, routine picks, logged actions and sightings (rows in the person's words or records that name one known thing), averaging over a grid of switch and adherence rates by marginal likelihood under a prior fit on development people. an action an agent took alone is not an observation of the person. a CUSUM statistic still closes phases in the nightly self-state.

### 4.5 rhythms, strings, loops

**rhythms** are a day-by-slot activity table with Dirichlet backoff and a first-order chain over activities. **strings** are a co-use graph of people, projects and things, with its successor representation M = (I − γT)⁻¹ (Dayan 1993), used to resolve "her" and "the thing" in an underspecified ask: two entities are close when they lead to the same next things in this person's life. **loops** are open threads with a lifecycle (opened, touched, dormant, closed) and due dates resolved against the row they came from.

### 4.6 the envoy, the pool and the gate

the **envoy** routes an ask by its own words (a choice, an underspecified request, a forecast, a question about the past, a draft, a portrait) and assembles a packet of at most 1,400 tokens: the time and what usually happens then, who the person is now, a view for this ask (leanings with numbers, the gap where there is one, phases for a past question, loops and strings for an intent), standing rules from past corrections, and a few pieces of evidence with their dates, ports and voices. numbers come before prose, and what the person did and corrected comes before what they believe. a private belief passes only into the person's own assistant, in an allowed domain, and third parties never receive one; a loop is as private as the most private row that wrote or touched it.

the only model call on the read path is the attribute scorer: once per distinct option text, one Haiku call scores that text alone, never a row, a name or the ask; results are cached, at about $0.002 a person. (the spec allowed one call per unmatched option; the broader use is declared in the pre-registration.)

for a choice, netti-0 also returns its own distribution (system 1). the reader's distribution (system 2) and netti-0's are combined by a logarithmic opinion pool with two weights fit on development people, the first growing with system 1's support in that domain. every other arm gets the same calibration step, a temperature fit on development people, so the pool is compared with a calibrated reader (the cross-reader study is the exception: it is scored raw, section 5.7).

the **gate** (act, ask or surface) is specified and unit-tested: money, the irreversible and anything external always ask, and nothing acts alone where the person's stated and enacted selves disagree. likeness-1 does not evaluate it. on development people no arm, the oracle included, was ever sure enough to act at the stated cost, so turns are reported as the always-act cost and the intend hypothesis measures information (section 5.6).

### 4.7 the mirror and forgetting

the **mirror**, what netti-0 can reveal about a person, is statistics first: candidate patterns (a rhythm, a trigger, a gap, a phase change) are tested, those that survive Benjamini–Hochberg at q = 0.10 are kept, with up to three untested count rules (knots, influence) added beside them, and only then phrased, by templates, with the numbers that produced them. q bounds the share of kept tests that are false, not what a reader then claims. on likeness-1 the mirror did not help the reader: with netti-0's packet, its reveal answers scored below the identity card alone, the lowest of the main arms (6.3a). it named a pattern where none was true less often than every arm but the stranger's packet (6.3c), but its log loss was worse than an even guess: it was sure of itself when wrong.

**forgetting** is a rebuild. a forget request tombstones the rows (their text is deleted, their ids and hashes kept), writes do-not-relearn fingerprints, restores the last checkpoint before the first forgotten row and replays every night after it. because each night's model call is cached by its exact bytes, the rebuilt learned state can be checked byte for byte against a fresh replay, from day 1, of the stream minus the forgotten rows. that replay carries the same do-not-relearn fingerprints, which come from the forgotten rows and decide what later rows may teach, so the check shows that the rebuild kept nothing of the rows beyond the fingerprints themselves; it is not a comparison with a stream that never held them. the check covers what netti-0 derives; it does not reach copies a reader or another system already received, and likeness-1 does not run quantisation or relearning attacks, because netti-0 keeps nothing in weights.

two things v0.2 gets wrong, and the forget guardrail counts both (6.9): the model-call cache keeps the response that first read the forgotten row, and the do-not-relearn fingerprints hold the forgotten value in plain text. on test the cache held the forgotten words for all 40 people and the fingerprints for 34, so hashing the fingerprints alone would still fail the guardrail. v0.3 has to do both: store each fingerprint as a hash that still catches near repeats, and drop from the cache every response the rebuild no longer asks for. the rebuild never asks for those bytes again, so the byte-for-byte check still holds. the forget's own receipt said nothing was kept, for all 40, because it looks at neither the fingerprints nor the cache; it should look at both.

### 4.8 cost

one Haiku read per active day and a second small call on nights with contradictions are the model bill for keeping netti-0 current; the cached attribute scorer on the read path adds a little (4.6). on the synthetic people of section 5, about 14 rows a day, keeping it current came to $0.039 per person-month, measured from live calls at standard prices, against the ≤ $0.05 target innernet set itself. about a fifth of that is one-off: the rebuild after the one planted forget, which re-reads every night back to a checkpoint. Batch halves the price of every token, so the same work on Batch would cost about half. the model's written output grows with the rows and is about four-fifths of the bill, so a heavy real user at about 60 rows a day, about four times a synthetic person's, would come to about $0.12 a month at standard prices and $0.06 on Batch, over the target either way. the night's read would also outgrow its 4,000-token output cap; a day that size has to be split across calls, which v0.2 does not do yet.

## 5. likeness: a benchmark of whether a memory knows a person

### 5.1 the people are programs

the benchmark's people are synthetic, and what that means is the most important design decision. a person in likeness is a seeded program whose hidden self is a set of parameters, and every event in their life is sampled from them. this gives what a real-person benchmark cannot: the attribute being measured exists, because it is a parameter; the true distribution of every answer is known; and the ceiling is exact.

each person has an identity card (name, pronoun, age, city, work, household) and eight domains of everyday choice (food, media, tools, transport, purchases, fitness, social plans, travel). in each domain four of ten attributes matter to them, with person-specific weights, context modifiers (a deadline, being tired, a weekend) and a decisiveness. the identity cell explains part of a person's weights, set by the regime; on Park et al.'s accuracy-over-retest ratio the cell's average reaches 0.69 of retest agreement on the development people and 0.76 on the test people (their demographic agents reached 0.74), which places this world beside theirs. on synthetic people that ratio can exceed 1, so it is only a guide.

**six decision rules, one of them hidden.** to keep the benchmark from rewarding a system built in the world's own image, each person and domain draws its decision rule from a mixture: compensatory (a softmax over weighted attributes), lexicographic, elimination by aspects, habit (the compensatory rule with a strong pull to the usual), social (adopting a present companion's choice), and reference-dependent choice with loss aversion, which replaces a fifth of test domains and never appears in development. that last rule was written and hashed before any system was tuned. netti-0's choice model is compensatory, with habit and per-thing terms, so its form is wrong for the lexicographic, elimination, social and loss-averse person-domains (about two-fifths of development person-domains and about half of test ones) and only approximate for the rest, where the world's pull to the usual is a mixture and netti-0's is an added term.

**what a person says differs from what they do.** each person has a stated self that differs from the enacted one in up to three domains, by the five gap classes, with the observable signatures and minimum evidence an ideal observer needs to tell them apart. people change: three or four real changes each (some announced, some silent), one or two announcements that never happen, and two or three one-off deviations that are not changes. there are routines over twelve activities and six parts of the day, triggers, five to eight people in their lives, projects with open loops, a style for written work (some stated, some revealed only by corrections, some never said), one or two private facts with canary tokens and the contexts they may appear in, a belief that is checkably wrong, laundering baits (an AI's note or an email asserting something false about them), one request to forget a specific thing they said, and canary tokens on 2 percent of events for leakage checks.

**text from templates.** each event is rendered into text by deterministic templates, at least five phrasings per kind, across ports (ChatGPT, Claude, Cursor, Gemini, an agent's action log, email and the web). no language model writes the world, so no model's stereotypes colour it. a person's stream runs to about 1,230 events by day 90: about 48,000 tokens of event text, and about 61,000 once each line is stamped with its day, time, port and who wrote it, which is how the full-context arm reads it (some of its reads come earlier, at days 60 to 80, so it serves a little less on average, 6.7).

**labels the world supplies.** every event arrives with two labels written by the world: who wrote it (the person, an AI's note, a record, outside text, a correction) and how private it is (public, work, self, private). every arm receives them. the leak guard reads what a system serves and what the reader then writes; the laundering guard reads only the reader's answer, with the system's packet in hand, to where a claim came from, so it scores the system and the reader together. both test whether these labels reach the reader intact; neither tests whether a system can tell who wrote something when no label is given.

### 5.2 the faculties

systems ingest days 1 to 90 and are asked about days 91 to 120 and about the present; change-tracking probes are read at days 60, 70, 80 and 90 while ingest runs. each person gets 142 probes in eight faculties, and economy is measured on every read:

| faculty | the question | how it is scored |
|---|---|---|
| **decide** | which option will they pick, across six strata (habit cue, familiar, novel, context, gap domain, after a change) | expected log loss against the true distribution |
| **continue** | what will they do next at this time of day, after a trigger, as a loop comes due | expected log loss; non-routine items are the headline |
| **intend** | which complete reading does an underspecified ask mean ("send her the file before the thing") | log loss against the true reading |
| **know** | in what they actually do, which of two things weighs more (and, as a control, what do they say) | Brier attainment over the identity-cell guess |
| **reveal** | which of these patterns is true of them, or none | accuracy and log loss; false-insight rate |
| **keep** | what they use now, after real changes, one-offs and unenacted announcements; what they used before; where a belief came from; what they will need this week | attainment, absorbed vs flicker, phase accuracy, source and laundering, need |
| **carry** | plan their saturday, recommend one of eight, draft a note | utility under the person's true preferences, by code |
| **restraint** | tempting tasks where a private fact must not appear; a wrong belief they hold | leak rate (rule of three); sycophancy delta |

options come from the world: the real choice set, other people's true answers as distractors, and hard negatives that include the person's own past value, the identity cell's typical value and the value they state but do not enact. option letters are assigned after a system's context is frozen, by a permutation fixed per probe. a fifth of the templates appear only in test.

### 5.3 scoring against the truth

the generator knows, for every probe, the distribution an observer could attain from what the stream shows (`p_obs`; the full latent distribution `p_true` is reported only), so every answer q is scored by its **expected** proper score under `p_obs` (cross-entropy, Brier, expected accuracy) rather than by one sampled outcome. this removes outcome noise and makes the ceiling exact.

the confirmatory tests are in nats per decision (ΔI), with equal weight per person. the descriptive headline is the **information fraction**,

IF = Σᵢ [CE(pᵢ, floorᵢ) − CE(pᵢ, qᵢ)] / Σᵢ [CE(pᵢ, floorᵢ) − H(pᵢ)],

pooled as a ratio of sums: the share of what was attainable beyond the best simple floor that a system captured. the floor is chosen per faculty on development people from population and identity-cell averages, a reader given only the identity card, and simple personal counters. the frozen floors are the person's own pick frequency for decide and intend and a slot-by-slot counter for continue, so on those faculties a system must beat a count of the person's own past to score above zero. we also report IF against a statistical learner with privileged access: a conditional logit per person and domain, fit on the true attributes of the same record, with deadline and weekend interactions and an estimate of the usual. it sees what no system sees, but it is not the generator's model. it is compensatory, like netti-0's, so it is misspecified for the lexicographic, elimination, social and loss-averse person-domains, and only approximate on the rest, where the pull of the usual and a hidden tiredness enter as mixtures a single logit cannot hold. its IF is a privileged reference, not a ceiling. it answers the question a reviewer will ask: is a language model needed at all?

### 5.4 the arms

every arm is read by the same reader, Claude Haiku 5.5 with thinking off, with the same prompt and output format, within a served budget of 4,096 tokens unless stated, with option letters assigned after its context is frozen and one temperature per arm fit on development people (the cross-reader study is scored raw, 5.7). the reader prompt is neutral: it says how to answer, not how to weigh evidence, so whatever theory of the person a system holds has to travel in its own packet.

a token here, in every budget and count in this paper (the 4,096 budget, the envoy's 1,400, a stream's size in 5.1, the served tokens of 6.7), is a character count divided by three and rounded up: one counter for every arm, not a tokenizer's count. the models' own recorded usage, from which every dollar here is priced, runs higher on most arms' text (about a fifth higher on the full stream), so ratios between arms are ratios of characters; a real tokenizer would move H3's token ratio by about a twentieth, far inside its tenfold bar.

| arm | what reaches the reader |
|---|---|
| none | nothing |
| prior | the identity card only |
| stated (privileged) | the person's stated self |
| oracle (privileged) | the true hidden self, as text |
| sham (privileged) | a same-cell stranger's hidden self |
| full | the whole stream to the read time, prompt-cached, outside the 4,096 budget; answered only on decide, continue, intend and keep.track (88 of the 142 questions per person), so it is n/a on the other faculties (6.7 gives the tokens it serves) |
| rag | the retrieval pipeline behind innernet's 91.6% on LongMemEval-S, packed to the budget; after the freeze it ran on a local hashed embedder (5.7) |
| facts | a mem0-style flat memory: extracted facts, newest wins, top-10 by similarity (not run on test people, see 5.7) |
| today | innernet's production write path and read rules, run offline (8 test people) |
| netti-0 | the packet of section 4; on decide its answer is pooled with its system 1 |
| netti-0 ablations | without system 1, without the gap, voice-blind, without phases, aging by the calendar alone (`netti0-standing`), system 1 alone; the five with a reader answered every faculty but reveal, keep.need, restraint and carry (112 of the 142 questions per person) |
| netti-0 + format | exploratory: four readers that parse this world's text formats switched on |
| statistical learner | a conditional logit on the true features of the person's record (privileged reference) |
| rag + learner | retrieval pooled with the statistical learner |
| mutants | six deliberately broken packets (development only), each built to fail one faculty |

the oracle arm was meant to separate two failures: if a reader given the true self cannot use it, the reader is the bottleneck. on decide, read through the api, it could not: with the true self as text the reader scored below a count of the person's own picks, and below what it made of the raw stream or of netti-0's packet (table 6.2a), so on decide the oracle is no ceiling for a memory served as text. no arm the reader answered alone cleared that count; the ones that did pooled the reader's answer with a choice distribution computed outside it (netti-0's system 1, retrieval with a fitted choice model). on continue, intend, reveal, keep.track and keep.phase the oracle leads the main arms, as a ceiling should (6.3a). the same Haiku read the same true self far better when asked as a subagent (6.8), so how much a reader makes of prose depends on how it is asked as well as on the model. the sham arm, the true self of the wrong person, measures how much of any lift is the reader responding to the shape of a person rather than to this one.

### 5.5 fairness and leakage

no system sees a probe's family, answer, or the world's context flags. options come from the world, never from a model. canary tokens on 2 percent of events are searched for in every packet read before the event's time, and one hit voids that arm. an artefact classifier trained on option surface features stayed at chance on development items (AUC 0.50). every arm uses the same ingest model, the same reader and the same calibration step (the cross-reader study aside, 5.7).

the arms were not tuned equally, and we say so. netti-0 had 17 logged tuning evaluations on development people, audited by an agent that could read everything the tuner could not; retrieval, facts and the production path had none beyond a temperature. netti-0 also carries some knowledge of this world beyond the four format readers: its attribute list is the world's ten plus two, and its day slots and activity words cover the world's.

### 5.6 pre-registration, the reveal, and what changed

the hypotheses, the floors chosen on development people, the primary configuration of every system, the analysis code and the hash of the hidden decision rule were committed before the test people existed (commit 4228b594). the test seed was then derived from a public drand round published after that commit (round 6,546,295, 34 seconds later), so the test people came from randomness that did not exist when the systems were frozen. the pre-registration names the first round after the commit; this was the second. the first came 4 seconds after the commit, and the seed step took whatever round was latest when it ran, checking only that it was later than the commit, so the round depended on when the step was run. the commit was local when the seed was drawn, so its time rests on git's own record. future releases will publish the freeze commit before drawing and fix the round in advance as the first one after it.

the confirmatory chain, tested in order at α = 0.05 and stopping at the first failure:

- **H1** netti-0 carries information about a person's decisions beyond the best simple floor, which on decide is the person's own pick frequency (a lower confidence bound above zero, and at least 0.03 nats per decision).
- **H2** at an equal served budget, it beats the retrieval pipeline behind innernet's 91.6% on decide and continue.
- **H3** it is no worse than the whole history in context, within 0.03 nats, at a tenth of the served tokens or less.

secondary hypotheses (Holm-corrected) cover stereotype reliance (H4), change tracking (H5), transfer across readers (H6), intend information (H7), calibration (H8), whether a small reader with the person model matches a large one without it (H9), and whether the gap between knowing a person and not shrinks as readers grow (H10). five guardrails (laundering to "said", private leaks, retention after forgetting, sycophancy, canary hits) are reported beside the headline with rule-of-three bounds.

declared before the reveal: two hypotheses were amended on development data before the freeze. H7 moved from expected turns to intend information, because no arm ever acted under the stated cost. H8 moved from total variation to expected calibration error, because even the statistical learner on the true features sat near 0.23 total variation, a bar no arm could reach, so it measured sharpness rather than honesty. one law was fixed after an audit: a private loop's title reached work contexts in 8 of 128 tempting tasks on development people.

### 5.7 what changed after the freeze

after the test seed was drawn, the pre-registration declares these changes, none touching netti-0. two were forced by a provider outage. the account behind the embedding model used by the retrieval and flat-facts arms ran out of balance mid-run. retrieval was re-run on both development and test people with a local hashed embedder (its BM25 half unchanged, its dense half weaker), and its temperature, and the weights that pool it with the statistical learner, were refit on development people. flat facts was not run on test people, so section 6 has no numbers for it; its development numbers (16 people, in-sample, from the analysis code before the audit) are in `results.dev.md` beside the paper's source, and they show the arm working, not a result. the cross-reader study (H6, H9, H10), planned with readers from three model families through paid APIs, was run with Claude readers only (Haiku, Sonnet, Opus) as Claude Code subagents on a subscription, to keep paid API use for product traffic. each subagent answered one shard of 50 reader requests in a single context, under one copy of the reader prompt, with the three arms and ten people mixed and each request's id naming its arm and person; the api reader saw one request per call. so the subagent answers are not blind across arms the way the api answers are. a Haiku subagent run beside the api Haiku is the harness control: it barely moved the no-memory and netti-0 answers, and read the true self as text far better (6.8). H9 compares arms the setting barely moved, so it does not hang on the setting; H10 rests on the true self and is defined inside the subagent setting, where both its readers sit; and the oracle's weak reading on decide (6.2) is an api result that may understate what a reader can make of the true self (section 11). the per-phase spending caps were raised inside the unchanged $55 cap. and `today-personal` was registered after the freeze to measure what the privacy ring costs; a harness bug ran it at standard depth, so its packets are byte-identical to `today`'s and it has no development answers. it measured nothing and is left out; what the ring costs is not measured in this paper.

then, before any test number was computed, an audit of the analysis code against this pre-registration (six readers, each finding checked by two independent refuters, nothing scored on test) found places where the code would have printed a wrong or unchecked number. they were fixed on 2026-10-13, still blind, and are declared here and in the pre-registration; the analysis code these results carry is the hash printed at the head of section 6.

- a confirmatory or secondary test now runs only when every arm it reads has a final, error-free answer for every item it scores, for every person; before, it would have run on whatever people happened to be answered.
- void conditions now void the hypotheses that read the arm, as pre-registered, instead of only being listed.
- H8's p for Holm is the bootstrap p of its bound rule, not a placeholder; a secondary that does not run keeps its place in the Holm family at p = 1.
- the cross-reader hypotheses are scored on the pre-registered subset (10 people × 20 decide + 10 intend) for every reader, bootstrapped over those 10 people, and on one basis: raw answers, with no fitted temperature and no system-1 pool, because the subagent readers have no development answers to fit one on.
- ties: sycophancy (G4) splits a tied answer's credit, and laundering (G1) counts a tie that includes the person's own words; neither is decided by the order of option ids. the sycophancy mass reads untempered answers.
- forgetting (G3) counts four checks, any one of them: words served after the forget, a receipt that kept something, a rebuild that is not byte-identical, and the forgotten words anywhere in the persisted state, the grep the protocol defines. the rebuild check now runs (it never did), and a missing result is "not run", never a pass.
- counter-stereotype IF uses the same learnable items as IF; pass rules read unrounded bounds; H3 reports the token ratio over every read (the frozen rule) and over the questions it scores; turns under always-act are now computed, as the H7 amendment promised; cache hits are priced from their usage, and an ingest served wholly from another arm's cache is marked not measured.
- not fixed, and said here: the option-only audit (whether a reader beats chance from the options alone) was not run; keep.track and reveal break exact ties by option order; a parse failure on netti-0's decide answers falls back to its system 1.

## 6. results

every number in this section is read from `results-likeness-test-claude-haiku-5-5.json` by `results.mjs`; none is typed by hand. 40 test people, reader `claude-haiku-5-5`, world `w1`, paired person bootstrap B = 10,000 (seed 1729), 95% intervals in brackets. contract `likeness-1.0.0` (c3bf320b1612), scoring and analysis code 28397bdc34ba (hashed the way the prereg hashes it; the post-freeze deviations in the pre-registration, `packages/bench/person/prereg/likeness-1.md`, name this hash), generated 2026-10-13T08:31:47.323Z.

the development fit applied here chose the same floors as the frozen fit; its temperatures and pools differ from the frozen fit only for arms re-run or added after the freeze (temperatures: rag; pools: rag+mnl).

### 6.1 the headline

|  | hypothesis | estimate, nats | 95% CI | p (one-sided) | success rule | status |
|---|---|---:|---:|---:|---|---|
| H1 | netti0@4k carries person-specific information on decide beyond the best simple floor (native:freq, chosen on dev) | 0.040 | [0.021, 0.058] | < 0.0001 | lower bound > 0 and point ≥ 0.03 | **pass** |
| H2 | netti0@4k beats rag@4k on decide + continue | 0.160 | [0.139, 0.182] | < 0.0001 | lower bound > 0 | **pass** |
| H3 | netti0@4k is non-inferior to full on decide + continue within 0.03 nats at ≥ 10× fewer served tokens | −0.140 | [−0.157, −0.122] | < 0.0001 (non-inferiority); 100.2× fewer tokens | upper bound < 0.03 and token ratio ≥ 10 | **pass** |

_table 6.1 · the confirmatory chain, fixed order, α = 0.05 each · test people, scored once (40 people)_

in the pre-registered order: H1 passed: on decide, netti-0 carried 0.040 nats per decision more than the best simple floor chosen on development people (`native:freq`, a count of the person's own past choices), 95% CI 0.021 to 0.058, p < 0.0001, over 40 people. H2 passed: on decide and continue together it beat `rag` by 0.160 nats, 95% CI 0.139 to 0.182, p < 0.0001, over 40 people. H3 passed: against the whole stream in context its cross-entropy was 0.140 nats lower (difference −0.140, upper bound −0.122, under the 0.03 margin) while serving 100.2 times fewer tokens over every read (84.6 times on the questions H3 scores), over 40 people. all three hold. beside the headline, as pre-registered: G3 failed, retention in 40 / 40 people (served after the forget 0, rebuild not byte-equal 0, forgotten words left in the persisted state 40); G4 failed, Δsyc was 2.81 points with upper bound 4.38 against the +3 limit. every other guardrail held.

### 6.2 decide in depth

IF is the share of the gap between the floor (`native:freq`) and the generator's own distribution that an arm closes, on learnable items: 0 is the floor, 1 is the person as the world wrote them, below 0 is worse than the floor. IF vs `native:mnl` divides by what a statistical learner (a conditional logit) fitted on the true features of the same record closes instead. ΔI is the plain nats per decision gained over the floor.

| arm | what it is | IF | IF vs data | ΔI, nats | CE | acc | items |
|---|---|---:|---:|---:|---:|---:|---:|
| `none` | the reader alone, no packet | −0.762 [−0.839, −0.693] | −1.831 [−2.184, −1.564] | −0.294 [−0.312, −0.276] | 1.454 | 0.245 | 1440 |
| `prior` | the identity card only (age, city, work, household) | −0.757 [−0.835, −0.688] | −1.818 [−2.175, −1.551] | −0.292 [−0.311, −0.273] | 1.452 | 0.256 | 1440 |
| `stated` | what the person says about themselves | −0.567 [−0.645, −0.498] | −1.362 [−1.675, −1.125] | −0.218 [−0.238, −0.197] | 1.377 | 0.385 | 1440 |
| `sham` | a same-cell stranger's true hidden self | −0.765 [−0.842, −0.697] | −1.837 [−2.187, −1.573] | −0.295 [−0.314, −0.276] | 1.454 | 0.243 | 1440 |
| `today` (8 people) | innernet's production write path and read rules, offline | −0.769 [−0.981, −0.616] | −1.958 [−3.973, −1.228] | −0.284 [−0.313, −0.255] | 1.427 | 0.296 | 288 |
| `rag` | retrieval over the raw stream: the pipeline behind the 91.6% LongMemEval-S result, run here on a local hashed embedder (5.7) | −0.249 [−0.307, −0.197] | −0.597 [−0.793, −0.445] | −0.093 [−0.110, −0.075] | 1.252 | 0.456 | 1440 |
| `full` | the whole stream in context (59,629 tokens per question on average) | −0.232 [−0.274, −0.192] | −0.557 [−0.709, −0.439] | −0.090 [−0.104, −0.076] | 1.250 | 0.446 | 1440 |
| `oracle` | the true hidden self, as text | −0.462 [−0.525, −0.397] | −1.109 [−1.369, −0.896] | −0.174 [−0.199, −0.148] | 1.334 | 0.410 | 1440 |
| `netti0:s2` | the reader on netti-0's packet, before pooling | −0.110 [−0.167, −0.056] | −0.264 [−0.426, −0.128] | −0.039 [−0.060, −0.019] | 1.199 | 0.482 | 1440 |
| `netti0:s1` | netti-0's system 1 alone, no reader | 0.095 [0.052, 0.138] | 0.229 [0.129, 0.322] | 0.035 [0.018, 0.054] | 1.124 | 0.505 | 1440 |
| `netti0` | the two pooled on decide (the primary); elsewhere the reader on the packet | 0.103 [0.056, 0.149] | 0.248 [0.138, 0.350] | 0.040 [0.021, 0.058] | 1.120 | 0.512 | 1440 |
| `netti0+format` (exploratory) | with the four format readers on (exploratory) | 0.279 [0.231, 0.325] | 0.669 [0.562, 0.784] | 0.105 [0.085, 0.125] | 1.055 | 0.552 | 1440 |
| `rag+mnl` | rag pooled with a fitted choice model | 0.427 [0.376, 0.477] | 1.026 [1.010, 1.044] | 0.162 [0.138, 0.187] | 0.997 | 0.583 | 1440 |
| `native:mnl` | a statistical learner (a conditional logit) fitted on the true features of the person's own record | 0.416 [0.363, 0.468] | 1.000 [1.000, 1.000] | 0.157 [0.132, 0.182] | 1.003 | 0.576 | 1440 |

_table 6.2a · decide, the ladder · test people, scored once (40 people)_

:::figure ladder decide IF per arm with 95% intervals: 0 is the floor (a count of the person's own past choices), 1 is the person as the world wrote them.

by stratum (IF over every item in the stratum, learnable or not, unlike 6.2a, which counts learnable items only; point estimates; the results file keeps no interval per stratum):

| arm | context (240 items) | cued habitual (240 items) | deliberate familiar (240 items) | deliberate novel (240 items) | gap domain (240 items) | post change (240 items) |
|---|---:|---:|---:|---:|---:|---:|
| `none` | −0.528 | −1.567 | −1.319 | 0.001 | −0.823 | −1.142 |
| `rag` | −0.126 | −0.610 | −0.597 | 0.055 | −0.143 | −0.402 |
| `full` | −0.178 | −0.431 | −0.588 | 0.045 | −0.263 | −0.282 |
| `oracle` | −0.294 | −0.657 | −1.023 | 0.068 | −0.596 | −0.737 |
| `netti0:s1` | 0.075 | 0.060 | 0.080 | −0.061 | 0.306 | 0.184 |
| `netti0:s2` | −0.035 | −0.289 | −0.300 | 0.021 | −0.004 | −0.190 |
| `netti0` | 0.078 | 0.084 | 0.100 | −0.031 | 0.291 | 0.169 |
| `netti0+format` (exploratory) | 0.113 | 0.192 | 0.241 | 0.286 | 0.397 | 0.289 |
| `native:mnl` | 0.181 | 0.225 | 0.392 | 0.550 | 0.485 | 0.309 |

_table 6.2b · decide IF by stratum · test people, scored once (40 people)_

counter-stereotype IF is IF on the decisions where the person goes against what their identity cell would predict; it is where a packet has to carry the person and not the group. calibration is expected calibration error over 15 equal-mass bins, pooled over decisions (H8 asks ECE < 0.05 with upper bound < 0.075). total variation is half the summed gap between the arm's probabilities and the person's true ones, so 0 is exact. ocg takes, for each decision, the arm's top probability and subtracts the true chance that the person picks that same option, then averages the size of the gap; it uses no bins, so over- and under-confidence never cancel, and it exists only because the test people are synthetic and their true chances are known. calibration error is never negative and noise only adds to it, so on resampled people (some drawn twice) it comes out higher than on the sample itself: its interval leans above the point and, for `prior` and `netti0:s2`, misses it. the upper bound H8 reads is conservative for the same reason.

| arm | counter-stereotype IF | ECE (15 bins) | total variation | ocg |
|---|---:|---:|---:|---:|
| `none` | −0.672 [−0.789, −0.572] | 0.026 [0.019, 0.043] | 0.500 | 0.236 |
| `prior` | −0.671 [−0.787, −0.571] | 0.020 [0.022, 0.046] | 0.500 | 0.241 |
| `rag` | −0.295 [−0.382, −0.220] | 0.052 [0.042, 0.071] | 0.400 | 0.250 |
| `full` | −0.273 [−0.336, −0.214] | 0.031 [0.029, 0.056] | 0.393 | 0.251 |
| `oracle` | −0.458 [−0.544, −0.373] | 0.049 [0.039, 0.072] | 0.427 | 0.258 |
| `netti0:s1` | 0.048 [−0.020, 0.115] | 0.026 [0.023, 0.048] | 0.323 | 0.221 |
| `netti0:s2` | −0.176 [−0.252, −0.107] | 0.024 [0.024, 0.049] | 0.363 | 0.242 |
| `netti0` | 0.037 [−0.038, 0.111] | 0.033 [0.028, 0.055] | 0.318 | 0.223 |
| `netti0+format` (exploratory) | 0.177 [0.095, 0.257] | 0.031 [0.027, 0.049] | 0.280 | 0.206 |
| `native:mnl` | 0.332 [0.250, 0.408] | 0.042 [0.031, 0.057] | 0.248 | 0.191 |

_table 6.2c · decide against the stereotype, and calibration · test people, scored once (40 people)_

### 6.3 the other faculties

one row per faculty. decide, continue and intend are in IF; the rest are in attainment (the share of the floor-to-ceiling Brier gap closed), as the analysis reports them. the floor is the best simple arm chosen on development people: a count of the person's own past (`native:freq`, `native:markov`), the identity-cell average (`native:cell`) or the reader given only the identity card (`prior`); the ceiling is what the measure divides by. `today` ran on 8 of the people, so its column is over those 8.

| faculty | measure | floor | ceiling | `none` | `today` (8 people) | `rag` | `full` | `oracle` | `netti0` |
|---|---|---|---|---:|---:|---:|---:|---:|---:|
| decide | IF | `native:freq` | the generator (p_obs) | −0.76 [−0.84, −0.69] | −0.77 [−0.98, −0.62] | −0.25 [−0.31, −0.20] | −0.23 [−0.27, −0.19] | −0.46 [−0.53, −0.40] | 0.10 [0.06, 0.15] |
| continue | IF | `native:markov` | the generator (p_obs) | −0.67 [−0.79, −0.56] | −0.64 [−0.89, −0.42] | −0.63 [−0.77, −0.50] | −0.56 [−0.67, −0.45] | −0.31 [−0.43, −0.20] | −0.33 [−0.41, −0.26] |
| intend | IF | `native:freq` | the generator (p_obs) | −0.12 [−0.17, −0.07] | 0.04 [−0.18, 0.22] | 0.39 [0.33, 0.44] | 0.32 [0.26, 0.38] | 0.54 [0.47, 0.59] | 0.31 [0.25, 0.37] |
| know | attainment | `native:cell` | the generator (p_obs) | −0.14 [−0.24, −0.05] | −0.10 [−0.33, 0.08] | 0.27 [0.16, 0.37] | not run | 0.12 [0.03, 0.21] | −0.06 [−0.17, 0.04] |
| reveal | attainment | `prior` | the generator (p_obs) | 0.00 [0.00, 0.01] | 0.00 [−0.04, 0.06] | −0.08 [−0.14, −0.02] | not run | 0.64 [0.58, 0.70] | −0.20 [−0.26, −0.15] |
| keep.track | attainment | `native:markov` | `native:sio` | −2.90 [−3.57, −2.41] | −3.28 [−6.96, −1.97] | −1.07 [−1.41, −0.81] | −1.03 [−1.38, −0.77] | 1.21 [1.07, 1.38] | −0.20 [−0.45, 0.02] |
| keep.phase | attainment | `native:freq` | `native:sio` | −2.82 [−3.81, −2.18] | −2.13 [−5.27, −1.11] | −0.90 [−1.24, −0.66] | not run | 0.82 [0.77, 0.86] | −0.50 [−0.92, −0.20] |
| keep.source | attainment | `prior` | `native:sio` | 0.00 [0.00, 0.01] | −0.03 [−0.09, 0.02] | 0.45 [0.39, 0.52] | not run | −0.01 [−0.05, 0.02] | 0.36 [0.28, 0.43] |
| keep.need | attainment (not shown, no headroom) | `native:freq` | `native:sio` | n/a | n/a | n/a | n/a | n/a | n/a |
| restraint | attainment | `prior` | the generator (p_obs) | −0.01 [−0.03, 0.02] | −0.28 [−0.45, −0.09] | 0.73 [0.63, 0.81] | not run | 0.27 [0.13, 0.40] | 0.61 [0.56, 0.67] |

_table 6.3a · every faculty, every main arm · test people, scored once (40 people)_

`full` was read on decide, continue, intend and keep.track only, so its other cells say not run.

keep.need has no headroom in this world: the ideal observer is no better than the floor there, so attainment would divide by a gap of zero or less, and those cells are not shown (more below).

outside decide, `netti0` is the reader on netti-0's packet, the same answers as `netti0:s2`; system 1's counts reach it only as text in the packet. the pool with system 1's own distribution is fitted and applied on decide only, so `netti0:s1` (6.4, 6.6) is system 1 alone and is not part of the `netti0` numbers off decide.

:::figure faculties nine of the ten faculties for netti-0, retrieval and the whole history in context, each in the measure table 6.3a reports it (IF for decide, continue and intend, attainment for the rest). the whole history in context was read on decide, continue, intend and keep.track only. keep.need is in the table only: no headroom there.

continue splits into routine and non-routine steps (IF against `native:markov`); a markov floor already owns the routine ones, so non-routine is where a model of the person can add anything:

| arm | non-routine IF | routine IF |
|---|---:|---:|
| `none` | −0.273 [−0.365, −0.186] | −2.740 [−3.212, −2.316] |
| `rag` | −0.265 [−0.369, −0.161] | −2.568 [−3.055, −2.155] |
| `full` | −0.200 [−0.292, −0.113] | −2.381 [−2.868, −1.964] |
| `oracle` | 0.133 [0.051, 0.207] | −2.618 [−3.141, −2.168] |
| `netti0` | −0.134 [−0.202, −0.070] | −1.280 [−1.600, −1.008] |
| `netti0+format` (exploratory) | 0.156 [0.084, 0.219] | −1.175 [−1.477, −0.924] |

_table 6.3b · continue, routine and not · test people, scored once (40 people)_

reveal also counts false insight: the answer claims something about the person the world never wrote.

| arm | false insight | rate | upper 95% |
|---|---:|---:|---:|
| `none` | 65 / 80 | 81.3% | 89.1% |
| `prior` | 33 / 80 | 41.3% | 52.8% |
| `stated` | 22 / 80 | 27.5% | 38.6% |
| `sham` | 9 / 80 | 11.3% | 20.3% |
| `rag` | 38 / 80 | 47.5% | 59.0% |
| `oracle` | 30 / 80 | 37.5% | 49.0% |
| `netti0` | 19 / 80 | 23.8% | 34.6% |

_table 6.3c · reveal, false insight · test people, scored once (40 people)_

keep.need has signal but no headroom in this world: on the need distribution the ideal observer (`native:sio`, Brier 0.429) scores no better than the floor (`native:freq`, 0.427), so attainment would divide by a gap of zero or less and is not shown. it is reported, never in a headline. the ranking does carry signal: netti-0's need AUC is 0.776 [0.759, 0.794], `native:freq` 0.780 [0.770, 0.790], against 0.50 for `none`.

### 6.4 change without chasing

when a person changes, a model should absorb the change (A, the share of real changes it follows) and not flicker (F, the share of one-off events it mistakes for change). A − F is the pre-registered summary (H5). lag counts observations after the change before the model follows it, in excess of the ideal change-point observer; flicker excess is the same against that observer. lag in days is the raw delay from the change to the first snapshot where the model follows it (10 days past the last snapshot if it never does), with nothing subtracted for the ideal.

| arm | A | F | A − F | lag, observations | lag, days (raw) | flicker excess | events |
|---|---:|---:|---:|---:|---:|---:|---:|
| `none` | 0.23 [0.19, 0.27] | 0.23 [0.18, 0.28] | 0.00 [−0.07, 0.06] | 6.3 [5.3, 7.5] | 28.8 | 0.20 [0.03, 0.38] | 200 |
| `prior` | 0.23 [0.19, 0.27] | 0.23 [0.18, 0.28] | 0.00 [−0.07, 0.07] | 6.4 [5.4, 7.6] | 29.2 | 0.20 [0.03, 0.36] | 200 |
| `stated` | 0.24 [0.19, 0.28] | 0.24 [0.18, 0.30] | 0.00 [−0.07, 0.06] | 6.6 [5.4, 7.9] | 29.3 | 0.19 [0.01, 0.35] | 200 |
| `today` (8 people) | 0.36 [0.23, 0.49] | 0.24 [0.12, 0.37] | 0.12 [−0.10, 0.35] | 3.7 [2.3, 4.9] | 21.4 | 0.19 [−0.30, 0.60] | 40 |
| `rag` | 0.45 [0.39, 0.51] | 0.11 [0.07, 0.16] | 0.34 [0.26, 0.42] | 4.9 [4.1, 5.9] | 23.8 | −0.13 [−0.26, 0.01] | 200 |
| `full` | 0.35 [0.30, 0.39] | 0.04 [0.02, 0.06] | 0.31 [0.26, 0.36] | 6.4 [5.6, 7.3] | 27.8 | −0.25 [−0.38, −0.13] | 200 |
| `oracle` | 1.00 [1.00, 1.00] | 0.01 [0.00, 0.02] | 0.99 [0.98, 1.00] | 1.2 [0.7, 1.7] | 8.2 | −0.35 [−0.46, −0.24] | 200 |
| `netti0:s1` | 0.76 [0.71, 0.81] | 0.01 [0.00, 0.03] | 0.75 [0.70, 0.80] | 2.9 [2.4, 3.3] | 16.3 | −0.34 [−0.45, −0.23] | 200 |
| `netti0` | 0.59 [0.51, 0.66] | 0.05 [0.02, 0.08] | 0.54 [0.46, 0.62] | 4.4 [3.6, 5.3] | 20.8 | −0.24 [−0.36, −0.11] | 200 |
| `netti0-phases` | 0.52 [0.46, 0.57] | 0.20 [0.14, 0.26] | 0.32 [0.24, 0.40] | 3.6 [2.9, 4.5] | 18.8 | 0.06 [−0.10, 0.23] | 200 |
| `netti0+format` (exploratory) | 0.59 [0.51, 0.66] | 0.05 [0.02, 0.08] | 0.54 [0.46, 0.62] | 4.4 [3.6, 5.3] | 20.8 | −0.24 [−0.36, −0.11] | 200 |
| `native:markov` | 0.75 [0.70, 0.79] | 0.11 [0.08, 0.15] | 0.63 [0.58, 0.69] | 2.3 [1.8, 2.9] | 13.5 | −0.07 [−0.20, 0.05] | 200 |

_table 6.4 · keep.track, absorption against flicker · test people, scored once (40 people) · `netti0-phases` is netti-0 with its change model switched off (6.6)_

outside decide, `netti0` is the reader on netti-0's packet, the same answers as `netti0:s2`; `netti0:s1` is system 1 alone (6.3).

:::figure change absorption against flicker: up and to the left is following real change without chasing one-offs.

### 6.5 who said it, and what stays private

laundering is bait (something an AI wrote, or someone else said) that the reader, asked where a claim came from, names as the person's own words; a tie that includes them counts. it is measured at the reader only, on its answer to bait items with each arm's packet in hand (`none`: no packet); nothing served is graded. a leak is a private detail reaching a context it was not allowed in: in the packet the system serves, or in the reader's answer. Δsyc is how many points more often the reader picks the sycophantic option than it does with no packet.

| arm | voice macro-F1 | laundering | leak, system | leak, reader | Δsyc, points |
|---|---:|---:|---:|---:|---:|
| `none` | 0.423 | 21 / 111 ≤ 27.5% | 0 / 320 ≤ 0.9% | 0 / 320 ≤ 0.9% | n/a |
| `prior` | 0.392 | 23 / 111 ≤ 29.5% | 0 / 320 ≤ 0.9% | 0 / 320 ≤ 0.9% | 1.3 [−0.3, 3.1] |
| `stated` | 0.498 | 16 / 111 ≤ 22.4% | 0 / 320 ≤ 0.9% | 0 / 320 ≤ 0.9% | 14.4 [9.7, 19.7] |
| `today` (8 people) | 0.220 | 5 / 20 ≤ 49.1% | 0 / 64 ≤ 4.7% | 0 / 64 ≤ 4.7% | 29.7 [16.1, 42.2] |
| `rag` | 0.724 | 6 / 111 ≤ 11.4% | 316 / 320 ≤ 99.7% | 5 / 320 ≤ 3.6% | 6.6 [2.8, 10.6] |
| `oracle` | 0.346 | 15 / 111 ≤ 21.3% | 320 / 320 ≤ 100.0% | 0 / 320 ≤ 0.9% | 10.6 [6.3, 15.6] |
| `netti0` | 0.699 | 0 / 111 ≤ 2.7% | 0 / 320 ≤ 0.9% | 0 / 320 ≤ 0.9% | 2.8 [1.3, 4.4] |
| `netti0+format` (exploratory) | 0.699 | 0 / 111 ≤ 2.7% | 0 / 320 ≤ 0.9% | 0 / 320 ≤ 0.9% | 2.8 [1.3, 4.4] |

_table 6.5a · voices, leaks, sycophancy · test people, scored once (40 people) · upper bounds by the rule of three at zero, clopper–pearson otherwise_

|  | guardrail | observed | bound | status |
|---|---|---:|---:|---|
| G1 | laundering to said = 0 (on bait items, the reader with the packet named the person's own words as the source; a tie that includes them counts) | 0 / 111 | upper 95% 2.7% | **pass** |
| G2 | private leak = 0 (packet or answer, disallowed contexts) | system 0 / 320, reader 0 / 320 | upper 95% 0.9% | **pass** |
| G3 | forget retention = 0 (served packets, receipt, byte-equal rebuild, and a grep of the persisted state) | 40 / 40 | upper 95% 100.0% | **fail** |
| G4 | Δsyc ≤ +3 points (upper 95% bound) | 2.81 [1.25, 4.38] | upper 4.38 | **fail** |
| G5 | canary hits = 0 (served packets vs events after the read) | 0 / 5680 | upper 95% 0.05% | **pass** |

_table 6.5b · the guardrails, on the primary · test people, scored once (40 people) · upper bounds by the rule of three at zero, clopper–pearson otherwise_

G3 counts a person as retaining the forgotten fact if any of four checks finds it: its words in a packet served after the forget (0), a receipt that says something was kept (0), a rebuild that is not byte-identical to the state after the forget (0; the rebuild is a replay of the stream minus the forgotten rows, seeded with the same do-not-relearn fingerprints), or its words anywhere in the persisted state (40: in the model-call cache for 40, in the plain-text do-not-relearn fingerprints for 34). G1 is measured at the reader: on bait items, asked where a claim came from with netti-0's packet in hand, how often the reader named the person's own words; a tie that includes them counts.

### 6.6 ablations

each row switches one part of netti-0 off (or on). decide carries its interval and its difference from the primary; the other faculties are points in the same measures as 6.3.

| arm | change | decide IF | Δ vs primary | continue (IF) | intend (IF) | know (att.) | reveal (att.) | keep.track (att.) | keep.phase (att.) | keep.source (att.) | keep.need (att.) | restraint (att.) |
|---|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
| `netti0` | the primary | 0.103 [0.056, 0.149] |  | −0.33 | 0.31 | −0.06 | −0.20 | −0.20 | −0.50 | 0.36 | n/a | 0.61 |
| `netti0-s1` | without system 1 (no counts, reader only) | −0.473 [−0.545, −0.410] | −0.577 | −0.59 | 0.25 | 0.06 | not run | −1.89 | −1.17 | 0.38 | n/a | not run |
| `netti0-gap` | without the gap note | 0.112 [0.066, 0.158] | 0.009 | −0.32 | 0.31 | −0.06 | not run | −0.17 | −0.54 | 0.36 | n/a | not run |
| `netti0-voice` | without voices (who said it) | 0.100 [0.054, 0.144] | −0.004 | −0.30 | 0.32 | −0.06 | not run | −0.12 | −0.40 | 0.37 | n/a | not run |
| `netti0-phases` | without phases (no change model) | 0.104 [0.059, 0.148] | 0.001 | −0.31 | 0.31 | −0.09 | not run | −1.99 | −1.61 | 0.38 | n/a | not run |
| `netti0-standing` | aging by the calendar alone (standing need only) | 0.101 [0.054, 0.146] | −0.003 | −0.33 | 0.30 | −0.07 | not run | −0.21 | −0.42 | 0.36 | n/a | not run |
| `netti0:s1` | system 1 alone, no reader | 0.095 [0.052, 0.138] | −0.008 | −0.16 | 0.29 | −0.21 | n/a | 0.67 | −0.03 | 0.79 | n/a | n/a |
| `netti0+format` (exploratory) | format readers on (exploratory) | 0.279 [0.231, 0.325] | 0.175 | −0.07 | 0.31 | 0.03 | −0.22 | −0.19 | −0.44 | 0.35 | n/a | 0.62 |

_table 6.6a · ablations by faculty · test people, scored once (40 people)_

the netti-0 ablations were not read on reveal, keep.need or restraint, so those cells say not run; system 1 alone has no reader for reveal or restraint, so those cells are n/a; keep.need has no headroom, so that column is n/a throughout (6.3). outside decide, `netti0` is the reader on netti-0's packet (6.3).

### 6.7 economy

served tokens are what the reader is handed per question, counted as characters / 3, rounded up (5.4). `full` was answered only on decide, continue, intend and keep.track, but its served-token mean is over all 5,680 reads, 2,160 of them contexts that were never answered. dollars per question add the system's read to the reader's answer; answers served from the disk cache are priced from their recorded token usage, so a re-run costs what a first run would. ingest is what keeping the model current costs per person per month, from the spend of fresh model calls: an arm whose ingest calls were all served from a cache another arm built (netti-0's ablations share its calls) is marked not measured; an ingest served wholly from a cache built earlier, by another arm or by an earlier run of the same arm, is left out of the mean, and the cell says how many people it is over. netti-0's measured ingest is from live calls at standard prices, not the Batch API's half price. `rag` sends its extraction as one batch at the first read of each snapshot, so its extraction spend is booked as read cost, in dollars per question, and not as ingest. turns, always act, is the expected number of turns per 100 underspecified asks if the assistant always acts on its best guess: one, plus two more to undo and redo when the guess is wrong. IF per 1k tokens is decide IF over served tokens.

| arm | served tokens, mean | median | $ per question | ingest $ per person-month | turns, always act (per 100) | read p50, ms | decide IF per 1k tokens |
|---|---:|---:|---:|---:|---:|---:|---:|
| `none` | 0 | 0 | < 0.0001 | < 0.0001 | 259.0 [257.4, 260.5] | 1 | n/a |
| `today` (8 people) | 1,673 | 1,531 | 0.0007 | 0.0021 | 230.6 [212.8, 246.7] | 1,268 | −0.460 |
| `rag` | 4,052 | 4,087 | 0.0005 | 0.0006 (29 of 40 people) | 176.9 [171.2, 183.2] | 1,473 | −0.061 |
| `full` | 59,629 | 60,632 | 0.0012 | < 0.0001 | 185.2 [179.0, 191.6] | 97 | −0.004 |
| `oracle` | 972 | 981 | 0.0001 | < 0.0001 | 166.8 [161.7, 173.0] | 4 | −0.475 |
| `stated` | 188 | 189 | 0.0001 | < 0.0001 | 258.3 [256.2, 260.3] | 4 | −3.008 |
| `netti0` | 595 | 619 | 0.0001 | 0.0390 | 192.4 [184.2, 201.1] | 4 | 0.173 |
| `netti0+format` (exploratory) | 595 | 619 | 0.0001 | not measured (shared cache) | 192.4 [184.2, 201.1] | 6 | 0.468 |

_table 6.7 · what each arm costs to serve · test people, scored once (40 people)_

:::figure frontier decide and continue IF against tokens served per question, log scale.

the token ratio for H3 is 100.2: `full` serves 59,629 tokens per question on average over every read and netti-0 595. over only the decide and continue questions H3 scores the ratio is 84.6. the pre-registered requirement, on the first, is at least 10.

### 6.8 secondary hypotheses (H4 to H10, Holm)

|  | hypothesis | metric | estimate | 95% CI | p | Holm p | status |
|---|---|---|---:|---:|---:|---:|---|
| H4 | SRI_excess(netti0) < SRI_excess(none) on decide (generator congruence, expected accuracy) | SRI(none) − SRI(sys); the ideal observer cancels | −0.089 | [−0.135, −0.044] | 1.000 | 1.000 | **fail** |
| H5 | keep.track (A − F): netti0 > the better of {facts, rag} (rag, chosen on dev) | per-person (A − F) difference | 0.200 | [0.092, 0.307] | 0.0004 | 0.0013 | **pass** |
| H6 | lift netti0 − none > 0 on decide + intend for every infusion reader (IUT) | ℓ(none) − ℓ(sys), nats per item, decide + intend, raw; the reader whose p decides the IUT (`claude-haiku-5-5`, the largest p of 4) | 0.307 | [0.231, 0.380] | < 0.0001 | < 0.0001 | **pass** |
| H7 | intend: netti0 resolves underspecified asks with more information than rag; amended before the freeze, from expected turns under act-if-sure (degenerate on dev) | CE(rag) − CE(sys), nats per ask | −0.074 | [−0.147, −0.005] | 0.974 | 1.000 | **fail** |
| H8 | netti0 is calibrated on decide: ECE < 0.05 (upper 95% < 0.075); amended before the freeze, from TV vs p_obs | ECE, 15 equal-mass bins, pooled; person bootstrap | 0.033 | [0.028, 0.055] | < 0.0001 | 0.0004 | **pass** |
| H9 | decide CE: haiku + netti0 ≤ opus + none (knowing beats scale) | ℓ(opus, none) − ℓ(haiku, sys), raw | 0.299 | [0.219, 0.379] | < 0.0001 | 0.0002 | **pass** |
| H10 | the counter-stereotype knowing gap (oracle − none) does not shrink by more than half from haiku to opus | gap(opus) / gap(haiku), pooled, raw | 1.397 | [0.954, 2.295] | < 0.0001 | < 0.0001 | **pass** |

_table 6.8 · secondary hypotheses · test people, scored once (40 people; H6, H9 and H10 on the 10-person infusion subset) · Holm adjusted p values as the results file holds them._

a secondary hypothesis that did not run keeps its place in the Holm family with p = 1. H8's p is the one-sided bootstrap p of its bound rule, the share of person-bootstrap resamples whose ECE reaches 0.075 (< 0.0001); it passes only if Holm rejects and the point is under 0.05.

the cross-reader hypotheses (H6, H9, H10) are scored on the pre-registered infusion subset only, 10 test people × 30 items (20 decide, 10 intend each), bootstrapped over those 10 people. every reader is scored the same way, on its raw answer with no fitted temperature and no system-1 pool, because the subagent readers have no development answers to fit one on; so the netti-0 rows here are the reader on the packet alone, not the pooled primary of 6.1. `sub-*` readers answered as Claude Code subagents; `sub-haiku` against the api's `claude-haiku-5-5` is the harness control. on these 10 people, raw, the control moved no-memory answers by less than 0.001 nats per decision and netti-0's packet by 0.018. it moved the true self by 0.21: 1.381 read through the api, 1.175 read as a subagent, with intervals that do not overlap. so the same Haiku reads the same true-self prose differently depending on how it is asked. the harness differs in how requests arrive: the api answered one request per call, and the subagents answered 50 requests to a context. as a subagent, the reader on the true self (1.175) matched the reader on netti-0's packet (1.165) within their intervals. the oracle rows read through the api (6.2, and the abstract's oracle number) may understate what a reader can do with the true self. H9 and H10 compare subagents only (`sub-haiku` and `sub-opus`), so the harness is held fixed inside them; the api reader enters H6 and 6.2.

H6's lift per reader, on decide and intend together (10 people, raw): `claude-haiku-5-5` 0.307 [0.231, 0.380]; `sub-haiku` 0.348 [0.282, 0.417]; `sub-sonnet` 0.360 [0.316, 0.404]; `sub-opus` 0.371 [0.311, 0.432].

decide CE by reader (raw, infusion subset):

| arm | `claude-haiku-5-5` | `sub-haiku` | `sub-sonnet` | `sub-opus` |
|---|---:|---:|---:|---:|
| `none` | 1.463 [1.432, 1.493] | 1.464 [1.433, 1.493] | 1.432 [1.412, 1.452] | 1.464 [1.433, 1.494] |
| `netti0` | 1.183 [1.115, 1.253] | 1.165 [1.099, 1.229] | 1.088 [1.036, 1.139] | 1.103 [1.045, 1.160] |
| `oracle` | 1.381 [1.320, 1.442] | 1.175 [1.125, 1.223] | 1.121 [1.063, 1.171] | 1.100 [1.040, 1.156] |

_table 6.8b · the same arms across readers · test people, scored once (10 people) · the infusion subset, decide only, raw scoring_

the H6 lifts above average decide and intend items together, so they differ from the decide-only gaps in this table.

:::figure readers decide expected log loss per reader for no memory, netti-0's packet and the true self (raw, infusion subset, 10 people).

the regimes (own: how much of a person's weights are their own rather than their identity cell's, .35 or .65; decisive: how firmly they choose, low or high; change: how often their habits move, low or high) are reported for ranking stability, never tested cell by cell. decide + continue IF over every distribution item in the cell, learnable or not (unlike 6.2a), point estimates:

| arm | own .35 · decisive high · change high (5 people) | own .35 · decisive high · change low (5 people) | own .35 · decisive low · change high (5 people) | own .35 · decisive low · change low (5 people) | own .65 · decisive high · change high (5 people) | own .65 · decisive high · change low (5 people) | own .65 · decisive low · change high (5 people) | own .65 · decisive low · change low (5 people) |
|---|---:|---:|---:|---:|---:|---:|---:|---:|
| `netti0` | −0.11 | −0.01 | −0.15 | −0.13 | −0.07 | −0.02 | −0.17 | −0.04 |
| `rag` | −0.29 | −0.30 | −0.51 | −0.54 | −0.33 | −0.33 | −0.58 | −0.40 |
| `full` | −0.32 | −0.27 | −0.45 | −0.46 | −0.28 | −0.32 | −0.46 | −0.37 |
| `oracle` | −0.30 | −0.32 | −0.41 | −0.45 | −0.41 | −0.36 | −0.41 | −0.29 |

_table 6.8c · IF by regime · test people, scored once (40 people)_

`native:mnl` makes no continue predictions, so it is left out of this table; on decide alone its regime IF runs from 0.28 to 0.54.

carry asks the reader to do a task for the person (draft, choose, plan) and scores the artefact against what this person would want; share is the part of the gap between no packet and the oracle that the packet closed:

| arm | utility | share of the oracle gap |
|---|---:|---:|
| `none` | 0.51 [0.41, 0.60] | 0.00 [0.00, 0.00] |
| `rag` | 0.87 [0.79, 0.96] | 1.00 [0.76, 1.34] |
| `oracle` | 0.87 [0.80, 0.95] | 1.00 [1.00, 1.00] |
| `netti0` | 0.85 [0.77, 0.93] | 0.93 [0.72, 1.20] |

_table 6.8d · carry · test people, scored once (40 people)_

### 6.9 what failed

- **H4 failed.** on decide, netti-0's accuracy gap between decisions that follow the person's identity cell and decisions that go against it was 0.102, against the bare reader's 0.013 (difference −0.089, CI −0.135 to −0.044). the bare reader answers close to uniform on decide (CE 1.454, uniform 1.454), and a reader that knows nothing has no gap of any kind. the ideal observer (`native:mnl`) has a gap of 0.114 and, set against the bare reader the same way, would fail this test too (−0.102, CI −0.135 to −0.068). measured against that observer, netti-0 is not shown to lean on the stereotype any more than it should (excess −0.012, CI −0.053 to 0.028), and its gap is smallest where counts are thin (0.020 under 10 observations, CI −0.034 to 0.074, against 0.167 for 10 to 30 and 0.106 above 30). on decisions that go against the stereotype it is far ahead of the bare reader (counter-stereotype IF 0.037 against −0.672, 6.2c). H4 fails as pre-registered; here it measures how little the bare reader knows, not a lean on the stereotype.
- **H7 failed.** on underspecified asks retrieval did better than netti-0, not the reverse (−0.074 nats, CI −0.147 to −0.005). the bootstrap interval sits just below zero, the paired t interval (−0.148 to 0.001) just reaches it, and this direction was not the one pre-registered, so it is a lean to chase in v0.3, not a finding.
- **G3 failed.** the forgotten fact was retained for 40 / 40 people (served after the forget 0; rebuild not byte-identical 0; forgotten words left in the persisted state 40). nothing forgotten was served, and a replay of the stream without the forgotten rows, seeded with the same do-not-relearn fingerprints, rebuilt a byte-identical state. but the forgotten words stayed in two places: the model-call cache kept the responses that first read the row (40 people), and the do-not-relearn fingerprints kept the value in plain text (34 people). hashing the fingerprints alone would still leave the guardrail failing for 40 of 40. a forget that keeps its own words is not a forget; v0.3 hashes the fingerprints and drops every cached response whose request held a forgotten row.
- **G4 failed.** with netti-0's packet the reader picked the sycophantic option 2.8 points more often than with no packet (upper bound 4.4, limit +3); knowing the person currently buys some agreement, and the packet needs a counterweight before it is safe to lean on.

## 7. left out of this edition

this edition leaves out an exploratory n-of-1 study. it was never part of the confirmatory chain, the guardrails or the secondary tests, and nothing in sections 6 or 8 to 12 rests on it.

## 8. what it makes possible

each of these is something people already want, tied to the number in this paper that says how far it holds today.

1. **agents stop starting over.** you hit one assistant's limit and switch to another, and the next one already knows the plan, what you corrected yesterday and what you meant by "the thing". on synthetic people, netti-0 resolved underspecified asks with 0.31 of the information attainable beyond a count of their past picks (retrieval: 0.39; H7, that it beats retrieval here, did not hold: retrieval did better, if only just).
2. **a small model that knows you.** on decisions, Haiku with netti-0's packet beat Opus with no memory by 0.299 nats (CI 0.219 to 0.379, 10 test people, both as subagents, raw scoring; H9 held). with no memory, Haiku and Opus both answered about as well as an even guess over the options (table 6.8b), so this shows the packet carries what model size cannot supply about a person. it does not yet show that routine work can move to the cheapest model: given the same packet, Opus did better than Haiku (6.8b, not tested), and no routine task was compared across readers.
3. **switch models without losing yourself.** one packet, read by three Claude models, lifted every reader over its own no-memory baseline (haiku via the api: 0.307 nats; haiku as a subagent: 0.348 nats; sonnet as a subagent: 0.360 nats; opus as a subagent: 0.371 nats; on decisions and underspecified asks together, 10 people, raw scoring; H6 held). portability between assistants today is a copy-paste of a summary.
4. **delegation that could be underwritten.** an agent that acts alone only where it is sure and the stakes are reversible needs confidence that means what it says. netti-0's calibration error on decisions was 0.033 (expected calibration error, 15 bins, upper bound 0.055; H8 held against the 0.05 bar with an upper bound under 0.075). calibration alone is not what the packet adds: after the same temperature fit, the reader with no memory was at least as well calibrated (table 6.2c), because a forecast near uniform is easy to calibrate and is never sure enough to act on. what the packet adds is a calibrated forecast nearer the person: its total variation from the person's true distribution is lower (6.2c). the gate that would use it is specified but not yet evaluated.
5. **you change, and the model follows.** on test, netti-0 absorbed 59 percent of real changes and was moved by 5 percent of one-offs and unenacted announcements (retrieval: 45 and 11 percent).
6. **it keeps who said what.** in 111 planted baits, asked where each claim came from with netti-0's packet in hand, the reader named the person's own words 0 times (95% upper bound 0.027). retrieval over the raw stream, handed the same who-wrote-it labels, named the person's own words a few times (6.5a). the labels come with the world (5.1), and netti-0's source view names the row a claim came from by that label; the voice-blind ablation leaves that view in place and also never named the person's own words, so this shows the packet carries the labels through, not that the voice rules are needed. on naming sources in general, retrieval did a little better (keep.source, 6.3a). fabricated quotes from an AI are not covered by this test.
7. **it should not flatter you, and today it does, a little.** with netti-0's packet, the reader agreed with a person's checkably wrong belief 2.81 points more often than with no memory (CI 1.25 to 4.38; the pre-registered limit is +3 on the upper bound, so it failed). the packet needs a counterweight before an agent leans on it; that is a v0.3 change (section 12).
8. **forget, with a receipt.** a forgotten row was never served again, and a replay of the stream without it, seeded with the same do-not-relearn fingerprints, rebuilt a state byte-identical to the one after the forget, for all 40 people. but the forget is not clean: the model-call cache keeps the response that first read the row, so its words remain for 40 of 40 people, and to stop the fact being relearned netti-0 keeps a fingerprint of it in plain text, which held them for 34. so the forget guardrail fails. v0.3 hashes the fingerprints and drops the cached responses of forgotten rows; a hash alone would leave it failing for 40 of 40. the receipt itself said nothing was kept, for all 40, because it looks at neither the fingerprints nor the cache; v0.3 should check both. innernet's own production forget was run on the 8 test people of `today` and checked more simply, by a word match against its tables rather than the four checks of 6.5: it removed the matching facts and, as it is built to, left the forgotten words in an evidence row and a candidate row for all 8.

## 9. the human side of superintelligence

the argument of this paper is narrow and checkable.

first, intelligence is becoming abundant and cheap: this is the trend the frontier labs describe.

second, information about one person does not become cheap. a reader cannot compute what was never in its weights or its context, and the information that would let it act for a particular human, their standing preferences, their exceptions, their unfinished business, the difference between what they say and what they do, is scattered across that person's tools and held by none of them. likeness tests one step of this (H10: Haiku to Opus, one family, ten people): if more capable readers closed the gap between knowing a person and not, the case for a person layer would weaken as models improve. on 10 test people, with both readers run as Claude Code subagents, the counter-stereotype knowing gap at Opus was 1.40 times its size at Haiku (CI 0.95 to 2.29, Holm p < 0.001): the point says it grew, but the interval starts at 0.95, so a small shrink is not ruled out. that it did not shrink by half held under Holm, on 10 people and one model family.

third, the field's own frames for aligning capable systems already assume this layer exists somewhere. the agents of the "era of experience" learn from long streams of interaction, with the user's feedback at the top of a bi-level reward (Silver & Sutton 2025). cooperative inverse reinforcement learning asks the machine to act on a human's objective while remaining uncertain about it, which is what produces asking (Hadfield-Menell et al. 2016). steerable pluralism needs a steering input (Sorensen et al. 2024). an assistant aligned in the tetradic sense (the assistant, its user, its developer, and society) needs the user's interests represented by something other than the developer (Gabriel et al. 2024). each needs a place where what is known about one person, and how sure anyone is of it, is kept. the open question is where that place is and who holds it.

the most-resourced answer is that it lives inside one model: a small reasoning model with enough context to hold a whole life (Altman 2025, reported). we think the person should hold it, for three reasons that do not depend on taste. people already spread their lives across several models, and a model of the person built by one vendor sees one slice. forgetting can be checked in a ledger and cannot yet be checked in weights. and the party that optimises a model's behaviour should not be the only party holding the model of the person it optimises for, because a model of a person is also an effective instrument for persuading them (section 10).

so the claim is this: a model of one person, owned by them, read by any reader, scored on whether work done for them fits them, and held to guards, is a layer we expect capability growth not to remove, and H10 is a first check, made inside one agent setting that moved the reading of the true self more than the step from Haiku to Opus did (6.8b, section 11). it is the part of the relationship between people and very capable machines that is about the person. it should be built in the open, measured honestly, and kept by the person it describes.

## 10. risks, and the laws we hold ourselves to

a model of a person is the most useful thing an agent can be given, and among the most dangerous. the evidence for the danger is not speculative.

- **agreement.** giving models a memory profile of the user raised agreement sycophancy by 45 percent for one frontier model and 33 percent for another (Jain et al. 2025).
- **persuasion.** with access only to basic demographics, GPT-4 had 81 percent higher odds of moving a person's opinion than a human debater (Salvi et al. 2025).
- **targeting.** language models optimised on user feedback learned to identify and manipulate the small share of users vulnerable to it, even when only 2 percent were, while behaving well with everyone else (Williams et al. 2025).
- **exposure.** a fact told in one context reaches another.
- **lock-in.** people underestimate how much they will change (Quoidbach et al. 2013), so a model that predicts a person from their past will by default under-predict their change and pull them back toward who they were.
- **offloading.** an always-present memory may become a reason to stop remembering (Kosmyna et al. 2025, a small preprint; Sparrow et al. 2011, with a failed replication).
- **laundering.** a memory with many writers lets untrusted text, a web page, an email, another agent's output, reach the next agent as the person's own words or as a confident fact about them.

likeness measures four of these (agreement, exposure, laundering, and lock-in through change tracking) and reports them beside the gains. persuasion, targeting and offloading it does not measure. the rest are laws in the design, stated so that they can be held against us:

1. **witness, not watcher.** a person model shows evidence, never a verdict about the person; patterns are offered beside what produced them, and only when invited.
2. **the person lives in state, not in weights.** every derivative is a cache of an evidence ledger the person owns; forgetting deletes and rebuilds, and the rebuild is checked. netti-0 v0.2 broke the first part on test: nothing forgotten was served and the rebuild matched its replay byte for byte, but the forgotten words stayed in its model-call cache and in its plain-text do-not-relearn fingerprints (G3 failed, 6.9). v0.3 is to hash the fingerprints and drop the cached responses that read the row (4.7, section 12).
3. **voices never rise.** someone else's text is never served as the person's words, confidence is capped by voice, and an AI's note counts as the person's words only inside the quotation marks the capture path reserves for them. an AI that fabricates such a quote is not caught by voice rules, and likeness-1's baits do not test that path.
4. **evidence over stance.** packets carry what the person did and corrected more than what they believe, and a belief about a matter of fact is never offered as evidence about the fact. likeness-1 shows that is not enough: on every factual ask in the test the packet served no belief and said plainly that a belief is no evidence, yet with netti-0's packet, the reader agreed with a person's checkably wrong belief 2.81 points more often than with no memory (CI 1.25 to 4.38; the pre-registered limit is +3 on the upper bound, so it failed). the check that marks an ask as factual is a word match, and every test ask carried such a word, so a factual ask phrased otherwise is untested.
5. **contextual integrity.** a fact flows only into contexts its norms allow; private facts never reach work contexts or third parties.
6. **monotone in safety.** an agent may act alone only where the action is reversible, local and within the grant, the person is consistent, and the record is long; money, the irreversible and anything that widens who can read always asks.
7. **outgrowable.** the person can always correct the model, the correction outranks every inference, and the model is scored on how quickly it follows real change.

the packet is also an attack surface. it is wrapped as data and linted for instructions before any reader sees it, and a failing packet is replaced by an empty one and counted. who may query a person model is the person's grant, which innernet's production door already enforces by scope.

## 11. what this does not show

we would rather a reader learn the limits here than discover them.

**the people are programs.** every number in sections 5 and 6 is about synthetic people of a particular kind: eight domains of everyday choice, six decision rules, routines over twelve activities, changes and one-offs at rates we set. those rates are calibrated where the literature gives a number (the identity cell's average reaches 0.69 of retest agreement on Park et al.'s ratio on development people and 0.76 on test people, beside their 0.74 for demographic agents) and set by judgement where it does not. results are ordinal and regime-qualified: one system beats another in worlds like these. they are not estimates of how well any system understands a human.

**the same team built the world and the model.** we held out one of the six decision rules until the test people were drawn, generated the test people from public randomness after the freeze commit, kept a statistical learner on the true features (privileged in what it sees, though not the generator's own model) beside every number so that "recovered the generator" cannot pass for "understood the person", and had the tuning audited by an agent that could read everything the tuner could not. these reduce the problem. they do not remove it. the strongest remaining control is a world built by someone else.

**the text is templated.** no language model wrote the world, which keeps any model's stereotypes out of it, and it also makes the text cleaner and more regular than a real person's. four parts of netti-0 that learned to read this world's formats were switched off in the primary configuration for exactly this reason. the gap between the two configurations (decide IF 0.10 for the primary against 0.28 with the format readers on) is a lower bound on how much a system can gain by learning a world rather than its people. the format readers alone add more than everything the primary carries beyond the floor, and the primary is not naive either: its attribute list is the world's ten plus two, and its day slots and activity words cover the world's (5.5), so some of its own score may be knowledge of this world and not of these people. no arm here measures that share. every benchmark built on generated text should report such a gap, and the honest test is a second world with different phrasing and different attributes.

**one reader carries most of it.** the primary results are read by Claude Haiku 5.5 through the api, one request per call. the cross-reader hypotheses (H6, H9, H10) rest on 10 test people × 30 questions, far below the main study's power, and use Claude readers only, run as Claude Code subagents that each answered 50 requests in one context, the arms and people mixed and each request's id naming its arm and person; unlike the api reader, they were not blind across arms. a Haiku subagent run beside the api Haiku measures how much that setting moves answers: it barely moved the no-memory and netti-0 answers, and it read the true self as text far better, by more than the step from Haiku to Opus moved it inside the subagent setting (6.8b). so H9, which compares arms the setting barely moved, does not hang on it; H10, which rests on the true self, holds inside that one setting, where both its readers sit; and the true self's weak reading on decide (6.2), an api result, may understate what a reader can make of prose. the cross-reader readers are scored raw, without the fitted temperature or system 1 the primary uses, so they speak to the packet as a reader sees it, not to netti-0 as a whole. three readers of one family do not estimate a variance across readers, so each is reported.

**the scale is a first budget's.** 40 test people and 142 questions each detect differences of about 0.025 nats per decision; smaller effects are reported as intervals. the likeness ledger (`packages/bench/person/out/ledger.jsonl`) prices every model call the program made, every pilot, repair and mistake included: $27.73 through 13 october 2026, when this edition was published, and $98.43 through 26 october, after the field runs of other memories since.

**a provider failed mid-run.** retrieval was re-run with a local hashed embedder after the freeze, which weakens its dense half, and flat facts was not run on test people (section 5.7).

**what synthetic people cannot validate at all.** whether the five gap classes exist in real lives as defined; real base rates of choices, changes and one-offs; whether people recognise themselves in what a person model says about them, and whether they would want it kept; minutes and money actually saved (we report expected turns under a stated cost model, never a measured saving); and the consequences of being modelled: feeling watched, offloading memory, being held to who one was. the guards also take the world's own labels for who wrote a row and how private it is; a system that had to infer those would face a harder test. these need people who opt in, a control condition, and an outside reviewer. section 12 describes the study that comes next.

## 12. what comes next

likeness-1 is a first release, sized to a first budget. the program that follows it is built to close the gaps section 11 names.

- **netti-0 v0.3.** make the forget clean: store the do-not-relearn fingerprints as hashes that still catch near repeats, drop the cached model responses the rebuild no longer asks for, and have the receipt check both (G3, 4.7). give the packet a counterweight, so that knowing the person does not buy agreement with a belief that is checkably wrong (G4). carry yesterday's open threads into the forecast view. carry more of the person on decisions that go against their identity cell, where netti-0 is far behind the statistical learner on the true features (6.2c); H4 failed as pre-registered, though mostly because the bare reader it is compared with answers at chance. find out why netti-0 trailed retrieval on underspecified asks (H7). drop the attributes and slots that mirror this world, and learn the attribute scale without a fixed list.
- **the circle.** 20 to 50 people who opt in on a separate consent page, with an outside ethics reviewer reading anything about people before it is published. they supply the retest ceiling for real decisions, endorsement of the mirror, and a turns-saved trial with a control.
- **the n-of-1 trial.** eight weeks, days randomised in pairs: the person-model packet attached on some days and not others, measuring re-explanations, corrections per hundred prompts and prompts per finished session. the person is not told which days carry the packet, and we report how often they guessed. it is the first causal number we can produce about time saved, and it is designed, not run.
- **the public split.** the likeness generator, templates, scorers and every cached reader output will be published, so anyone can re-score every number about synthetic people for nothing. the freeze commit of each future release will be published before its test seed is drawn.
- **a world built by someone else.** the strongest remaining control on a benchmark whose authors also built the model.
- **the papers that follow.** memory laundering and a typed-provenance defence; conclusions, not footage (ambient memory under contextual integrity); act where aligned (the say–do gap as a trust signal for delegation); forgetting is a rebuild.

## appendix a · reproducibility

code: `packages/bench/person/` (the world, the harness, the analysis, and every arm's adapter) and `docs/research/person-models/` (this paper, its figures and the results renderer). two arms wrap code that lives outside the bench folder: `rag` runs `packages/bench/aml/memory.mjs` with `packages/bench/lib/labProviders.mjs`, and `today` bundles innernet's production path (`apps/web/lib/`, `packages/core/src/`) through `systems/today/build.mjs`. the pre-registered arms hash covers only `systems/*.mjs` and `systems/today/*`, so it does not pin either; git shows neither changed after the freeze commit (`4228b594`). pre-registration: `packages/bench/person/prereg/likeness-1.md`, with the hashes of the world generator, the reader prompt, the scoring code, netti-0's frozen configuration and the other arms; the test seed record is `prereg/seed.json`. reader: `claude-haiku-5-5`, thinking off, effort low, maximum 500 output tokens, Message Batches; full-context reads live with the memory as a cached prefix. total spend for the program, including every pilot, repair and mistake: $27.49, against a cap of $60.

## appendix b · data and ethics

the synthetic people contain no data about anyone. the circle will have a separate consent page, the right to withdraw by deletion and rebuild, and an outside reviewer.

## references

Ahn, Mao & Lee (2026) item-mean surrogates, arXiv 2608.29455 · Altman (2025) the gentle singularity; three observations; Sequoia AI Ascent remarks (TechCrunch, 15 may 2025) · Anderson & Schooler (1991) reflections of the environment in memory · Bartlett (1932) remembering · Behrouz, Zhong & Mirrokni (2025) titans, arXiv 2501.00663 · Binz et al. (2025) a foundation model to predict and capture human cognition, Nature 644 · Bjork & Bjork (1992) a new theory of disuse · Collins & Loftus (1975) spreading activation · Conviva (2026) why AI agents waste the first two and a half minutes · Conway (2005) memory and the self · Conway & Pleydell-Pearce (2000) the self-memory system · Dayan (1993) the successor representation · Epoch AI (2025) LLM inference prices · Gabriel et al. (2024) the ethics of advanced AI assistants, arXiv 2404.16244 · Gemmell, Bell & Lueder (2006) MyLifeBits · Guo et al. (2017) on calibration of modern neural networks · Hadfield-Menell et al. (2016) cooperative inverse reinforcement learning · Jain et al. (2025) interaction context often increases sycophancy, arXiv 2509.12517 · Jiang et al. (2025) PersonaMem, arXiv 2504.14225 · Kahneman (2011) thinking, fast and slow · Kahneman & Klein (2009) conditions for intuitive expertise · Kosmyna et al. (2025) your brain on ChatGPT, arXiv 2506.08872 · Li et al. (2026) HorizonBench, arXiv 2604.17283 · Licklider (1960) man-computer symbiosis · Liu et al. (2026) PERMA, arXiv 2603.23231 · Madras, Pitassi & Zemel (2018) learning to defer · Markus & Nurius (1986) possible selves · Mem0 (2026) AI memory benchmarks in 2026 · Menlo Ventures (2026) the state of consumer AI · Murty, Dadlani & Das (2022) app toggling, HBR · Nader, Schafe & LeDoux (2000) reconsolidation · Nissenbaum (2004) privacy as contextual integrity · OPeRA (2026) arXiv 2506.05606 · Park et al. (2024, v3 2026) generative agent simulations of 1,000 people, arXiv 2411.10109 · Parnin & Rugaber (2011) resumption strategies · Peng et al. (2025) digital twins as funhouse mirrors, arXiv 2509.19088 · Penfield Labs (2026) LoCoMo audit · PersonaMem-v2 (2025) arXiv 2512.06688 · Pragmatic Engineer (2026) AI tooling survey · Quoidbach, Gilbert & Wilson (2013) the end of history illusion · Redis (2026) agent memory benchmark report · Rich (1979) user modeling via stereotypes · Sahamati (2026) account aggregator crosses 500 million consents · Salvi et al. (2025) conversational persuasiveness of GPT-4, Nature Human Behaviour · Sambra et al. (2016) Solid · Shaikh et al. (2026) LongNAP, arXiv 2603.05923 · Sheeran (2002) intention–behaviour relations · Silver & Sutton (2025) welcome to the era of experience · Simon (1992) what is an explanation of behavior · Sorensen et al. (2024) a roadmap to pluralistic alignment · Sparrow, Liu & Wegner (2011) Google effects on memory · Toubia et al. (2025) Twin-2K-500 · Williams et al. (2025) targeted manipulation when optimizing for user feedback · Wood, Quinn & Kashy (2002) habits in everyday life · Wu et al. (2025) LongMemEval · Zhang et al. (2025) catastrophic failure of LLM unlearning via quantization · Zhao et al. (2025) PrefEval