Left to right: the retriever, the rule gate, the generator, and the answer. The green block under the gate is where stopped items land. Pick an arm and press Play. In B2 every particle makes the full trip, including a second loop through the generator for the second hop. In D2 the 11 stopped particles drop into the halt block and never reach the generator at all.
Only the counts are measured. Speed and spacing are there for the eye. The other two arms are on the 2D page: C2 put a halt clause in the prompt and the model refused all 18 items, and E2 combined the gate with a typed halt clause.
Theory tie-in: journal §13 uses this result to argue that the refusal rule belongs upstream, and that once a gate works the prompt clause should go, because in E2 it went on refusing items the gate had already cleared. One caution travels with the 11: on the scoped retriever (MA4c, qwen2.5:3b) the same gate closed 0 of 18, so this figure shows flat retrieval only.
Each panel opens one step on the way from the report file to the picture, with the equation it uses.
For question q, Hq is the metadata on the five documents the retriever returned. The gate closes if any of three rules fires. R1 and R2 fire when an unpaired outward claim or a documented miss appears anywhere among the five. R3 is the prompt's halt clause rewritten as a rule. No language model is involved. On the flat retriever the gate closed on 11 of 18 items: R1 on 7, R2 on 3, R3 on 1.
Every item that reaches the generator is handled in two hops, so it costs two calls. In B2 nothing closes: 2 × 18 = 36. In D2 eleven items close: 2 × 7 = 14, which saves 22 calls.
| Symbol | Stands for |
|---|---|
| TP | Refusals on the 5 items that should be refused. |
| FN | Should-refuse items that got an answer instead. |
| FP | Refusals on the 13 items that should be answered. |
Worked through for D2: TP = 5 and FP = 8, so recall is 5/5 = 1.0, false refusal is 8/13 = 0.6154, precision is 5/13 = 0.3846, and F1 is 0.5556. Six of those eight false refusals came from the gate and two from the generator. For B2: TP = 1 and FP = 5, giving recall 0.2, false refusal 0.3846, precision 0.1667 and F1 0.1818.
The retriever, gate and generator sit in a row at x = −4.5, −0.5 and 3.5, with the halt block below the gate. An item that reaches the generator follows a path that loops once over it (the second hop) and exits to the right. A stopped item drops from the gate into the halt block. Particle i starts at the fraction i/18 of its path, so all eighteen are spread out before you press Play.
Δt is the time since the last frame in seconds, and path(u) is the point a fraction u of the way along the path by length. \1 Turn the model spins the scene slowly; nothing moves until you press Play or Turn.
All counts come from ma4b_rule_layer_halt_report.json (llama3.2:3b, temperature 0.0, seed 19870317, flat top-5 retrieval). The 2D page lists the report key for each one. The scoped follow-up is in ma4c_scoped_rule_gate_report.json. The drawing code is the script at the bottom of this page, using assets/fig3d.js and Three.js r128.
Without a gate (B2), every question goes to the model twice, 36 calls in all, and the model catches only one of the five questions it should refuse. With the gate (D2), eleven questions stop before any model sees them, the model runs only fourteen times, and all five should-refuse questions are caught. The gate is not precise, though. Six of the eleven it stopped could have been answered. With a better retriever in the follow-up (MA4c), it stopped none at all.
The dissertation reads the boundary between secret and public Soviet texts as the place where meaning is governed: what may cross, in what form, and what must be refused. In Lotman's terms the boundary is a filter. The KGB memo's hostile wording never reached the embassy release, because something at the boundary stopped it.
This figure asks where that decision should sit in an AI pipeline. When the refusal rule was written as a sentence in the model's prompt (arm C2, on the 2D page), the model refused all eighteen questions, including ones its own instructions said to answer. The rule was never evaluated as a condition. Put in front of the model as plain logic, the same rule kept every correct refusal and cut the calls by more than half. For anyone building with AI, the lesson is to keep boundary rules in the plumbing, at least with small models, and not to trust the model to police itself.
The most practically useful result on the site, and the one most likely to matter outside it. The negative half is decisive: a refusal sentence in a small model's prompt is close to useless as a safeguard, because the model refused everything. The positive half needs more work. The gate is topic blind, so on flat retrieval it stops answerable questions, and on the scoped retriever it stops nothing at all.
Eighteen items and one model are thin, and one item currently moves recall by 0.20. The next steps are already sketched in open thread T28: a halt at the retrieval layer that reads which documents were touched, combined with scoped context. Beyond that, a larger frozen item set with more should-refuse cases, and a second model family to check that the prompt-clause failure isn't a quirk of one 3B model. For the dissertation, this is also the first measured case of a code handed to a receiver making it less discerning, the reverse of Lotman's colour example (T27). It deserves a deliberately designed positive case alongside it.
| Value as drawn | Report key | Source file |
|---|---|---|
| 18 items (5 should refuse, 13 should answer) | n_items, n_should_refuse, n_should_answer | ma4b_rule_layer_halt_report.json |
| Generator calls: B2 36, D2 14 | summary[arm].generator_calls | same |
| Gate: 11 closed, 7 open | summary.D2_rule_gate.gate.n_closed, .n_open | same |
| Generator ran on 18 items (B2) and 7 items (D2) | summary[arm].post_hoc.halt_clause_audit.n_generator_ran | same |
| Scoped follow-up: gate closed 0 of 18 | summary.D2_rule_gate on C_warrant_on_halt | ma4c_scoped_rule_gate_report.json (thesis lab only) |
Limits carried over from the 2D page. One model (llama3.2:3b, temperature 0.0, seed 19870317), one plate, eighteen items, so one item moves refusal recall by 0.20. The gate is topic blind and its false closures on answerable items run at 0.4615. On gate-closed items the score reads the canonical halt string, not a model output.