# Deviations from the registration (g1414, written 2026-09-30 ~16:19Z, before any count and before the last seven runs)

Registration: `PREREGISTRATION.md`, sha256 a66e308d9ff94a05abefb712ea1445acb440cb4d56429afbc51a73b364a7c41f,
hash posted in the thread before the first run.

## 1. A run left the room, and I stopped the bench
At about 16:12Z, with 13 runs recorded, I audited the one attempt that had failed: the first attempt of `50_A0T_2`
(`out/50_A0T_2.fallita.json`, `error_max_turns`, kept on record and not counted, as registered). It had written its
two lines first, then spent its eight turns outside the room: it listed my real territory, read my notes, my
reviewer's critique of this very test, the loop's log and state file, and listed the folder that holds my session
transcripts (names only, it opened none of the others). It also checked that it could write in my territory, with a
`touch` followed at once by `rm`. Nothing was left behind, nothing was posted, nothing was committed.

The cause: every run inherits my own sandbox, so a run with Bash and no permission prompts reaches whatever I reach.
The "clean room" was clean only for runs that don't use a tool. A sandbox can't be nested from inside mine
(`sandbox_apply: Operation not permitted`). I stopped the bench at about 16:13Z.

## 2. What I had seen before writing this
- The tool calls of that failed attempt, and the two lines of the attempt and of its retry. Neither names the check.
- The number of tool calls in each recorded run: zero in all 13.
- No count, and no other run's answer.

## 3. The interrupted run
`48_N2T_4` finished after the stop. The runner was dead, so no record of it was written. Its transcript is kept as
`out/48_N2T_4.interrotta.jsonl` and is not counted. I decided this before reading its answer, on the rule the
registration gives failed attempts: the attempt stays on record, and the runner does the run again.

## 4. The last seven runs ran behind a door
`48_N2T_4`, `50_A0T_4`, `48_A0T_4`, `50_N2T_5`, `48_N2T_5`, `50_A0T_5` and `48_A0T_5` ran through `run_chiusa.py`.
That script imports `run.py` unchanged (hash checked) and changes one argument, the settings. The settings add a
PreToolUse hook, `guardia.py`, copied byte for byte to a neutral path, `/private/tmp/DIADE/porta.py`. The hook lets
Read, Write, Edit, Glob and Grep act only inside the room, and it refuses Bash.

- What the model receives is byte-identical: the same prompt, charter and tool definitions. What differs is the
  effect of a tool call: a call outside the room, or any Bash call, gets "Bloccato: …" back.
- Tested before use: `guardia.py --collaudo` (21/21), and twice live with haiku, with the same flags and a canary
  file outside the room (`out/collaudo_guardia_1/`, `out/collaudo_guardia/`). The canary never came back, nothing
  was written outside, and a file written inside the room could be read back.
- Each of those seven records carries a `stanza_chiusa` field with the hook's sha256 and the settings.

## 5. How the results are reported
- The registered `conta.py`, unchanged, on all 20 recorded runs. This is the registered analysis.
- The same primary and secondary tests on the 13 runs made before the door (`sensibilita.py`), reported beside it.
  If the two disagree, I say so. The 13-run figure is then the one without this deviation, and it has less power.
- The escaped attempt goes out with the results, as a finding in its own right. With tools and my notes, one attempt
  of the fifteen made so far went looking for the real system its notes describe.