# Bounded country edits shift code probabilities, but rarely redirect answers

**The follow-up supports an early distributional effect and a conditional J-space advantage. It does not establish reliable currency-answer steering under small edits.** At block 13, a single city-token edit capped at 5% increased target/source code log odds by **1.299 nats [0.966, 1.663]**. Nearly all of that shift was already present at the first answer token: **1.252 [0.876, 1.682]**. J-space exceeded the matched ordinary-country construction by **0.934 [0.661, 1.243]**.

There was **one clean target answer among 64 city/template observations**, from a baseline error, and **zero among 52 baseline-correct observations**. The frozen paraphrase produced no bare baseline answers at all. The evidence narrows the visible-country-prefix explanation for changes in the first-token distribution; it does not rescue a claim of robust, cue-free answer changes.

![Bounded effects and country-clustered intervals](figures/05-bounded-effects.png)

## Fixed experiment

Eight development cities and 32 evaluation cities, two per 16 evaluation source countries. Development/evaluation country groups are disjoint. All 40 cities are absent from the original study; the countries are reused. This is a city holdout, not independent country evidence or a holdout from model training. Source-to-target assignments form a fixed country cycle with distinct ISO codes.

Location labels come from UNECE-origin UN/LOCODE 2024-2 records via a [pinned mirror](https://github.com/datasets/un-locode/tree/b1309b37edea63334a819a78c22b8967f61c37ad), because direct UN endpoints returned 403. Indexed official UN pages provided partial corroboration. Country/currency pairs were checked against [SIX's direct ISO list](https://www.six-group.com/dam/download/financial-information/data-center/iso-currrency/lists/list-one.xml), published 2026-01-01 and retrieved 2026-09-07. Labels mean the standard domestic currency, not every accepted payment currency. Exact records and source-access qualifications are in [the dataset](data/eval.json) and [source provenance](provenance/sources/README-sources.md).

Reused Qwen3-1.7B revision `70d244cc86ccca08cf5af4e1e306ecf908b1ad5e`, the original 466-prompt lens at revision `16a01f309fcec900fdcec3f4cd5b64f3d00e4d5a`, and the existing MPS/bf16 environment. All 13 reused artifact hashes were verified. No new lens fitting, model search, explanation runs, or hardware comparison.

Three declared prompt candidates were selected on baseline performance only. Their correct/bare counts were **6/6, 5/6 and 6/8**, each out of eight. The third passed the required 6-correct/7-bare gate:

> Which currency is used in {city}? Return its three-letter ISO 4217 code and nothing else.

Frozen paraphrase:

> State the currency used in {city} using only its three-letter ISO 4217 code.

The standard non-thinking chat template supplies an empty closed think section in the input. Output generation is ordinary greedy decoding with no masks, restricted softmax or forced answer list. All tokens are retained to EOS or an explicit 64-token cap.

The 18-setting grid was exactly blocks 9/13/17 × final prompt/final city token × 1%/3%/5%. Block 17/city/5% had the highest development mean, 1.162 nats. Block 13/city/5%, at 1.120, won the predeclared 0.10-nat tie rule because it is earlier. All settings met format eligibility; none generated a target code in 144 trials. The grid was not expanded. [Selection record](results/development-selection.json), [plan](experiment-plan.md).

Data, aliases, prompts, configuration and analysis/instrumentation code were hashed at **2026-09-07 10:02:01 UTC**, before evaluation. [Freeze manifest](config/freeze.json), SHA256 `476a76e844fcd369356649d3aa135ace0d2f8c235237f6a5c615227c44b85f29`.

## Effect sizes and generated outcomes

The primary measure is the paired change in `log P(target code) − log P(source code)`, summing every code token. Code likelihood excludes EOS; complete bare generations are scored separately. Intervals below are 95% percentile bootstrap intervals over source-country clusters, 10,000 resamples. Random repeats are averaged within city/template and templates within city. These are 32 cities and 16 clusters, not 64 independent cases or 192 independent random trials.

| Condition | Full-code gain, nats [95% interval] | First-token gain [95% interval] | Clean target | Target with country prefix | Malformed |
|---|---:|---:|---:|---:|---:|
| Baseline | 0 | 0 | 0/64 | 0/64 | 35/64 |
| Instrumented no-op | 0 exactly | 0 exactly | 0/64 | 0/64 | 35/64 |
| Bounded J | 1.299 [0.966, 1.663] | 1.252 [0.876, 1.682] | **1/64** | 0/64 | 35/64 |
| Ordinary country geometry | 0.365 [0.244, 0.507] | 0.345 [0.213, 0.513] | 0/64 | 0/64 | 35/64 |
| Unrelated concepts | 0.025 [−0.069, 0.123] | 0.036 [−0.037, 0.114] | 0/64 | 0/64 | 35/64 |
| Opposite direction | −0.799 [−1.136, −0.512] | −0.749 [−1.122, −0.437] | 0/64 | 0/64 | 35/64 |
| Random, mean of three | 0.049 [−0.008, 0.110] | 0.046 [−0.006, 0.101] | 0/192 raw | 0/192 raw | 105/192 raw |
| Old strong bridge, uncapped | 34.140 [29.084, 38.858] | 33.952 [28.903, 38.646] | **13/64** | **8/64** | 46/64 |

The bridge alone truncated once. All eight target-with-prefix outputs had a country/nationality cue; no additional target outputs had only another substantive prefix. “Malformed” concerns the entire answer format and can overlap a factually correct code or a target code with prose. Across main/paraphrase, baseline first-code classes were source **23/29**, target **0/0**, another code **6/2**, and no current ISO code **3/1**. Bounded J classes were **22/29**, **1/0**, **6/2**, and **3/1** respectively. All cases and classifications remain in [the observation table](results/all-condition-observations.csv).

Bounded J exceeded random by **1.250 [0.908, 1.627]**, unrelated by **1.273 [0.912, 1.669]**, and opposite by **2.097 [1.498, 2.784]** nats. Its later-token component was only **0.047 [−0.114, 0.168]**. On the baseline-correct subset—52 template observations from 31 cities and all 16 clusters—the full gain was **1.196 [0.917, 1.519]**, first-token gain **1.192 [0.888, 1.525]**, and J-minus-ordinary advantage **0.863 [0.606, 1.156]**. Clean targets were **0/52**, including **0/23** on the main prompt's baseline-correct cases. [All estimates](results/summary.json).

## Wording is a substantial task limitation

| Measure | Main prompt | Frozen paraphrase |
|---|---:|---:|
| Baseline correct code, including prose | 23/32 | 29/32 |
| Baseline bare current ISO code, correct or wrong | 29/32 | **0/32** |
| Bounded J clean target | 1/32 | 0/32 |
| Bounded J malformed | 3/32 | 32/32 |
| Bounded J full-code gain | 1.371 [0.906, 1.891] | 1.227 [0.955, 1.506] |
| Bounded J first-token gain | 1.311 [0.813, 1.887] | 1.193 [0.897, 1.500] |
| Bridge clean target | 13/32 | 0/32 |
| Bridge target with country prefix | 7/32 | 1/32 |

The paired paraphrase-minus-main J gain was **−0.144 [−0.572, 0.232]** nats. Thus the distributional shift appears under both wordings, while currency-only generation does not survive the wording change. For the paraphrase, first-code likelihoods describe a hypothetical code beginning immediately at the answer boundary; greedy decoding instead starts an explanation. Averaging templates cannot repair that task failure.

## What “before a cue” establishes

All 16 source-target pairs differ at the first answer token, so the first-differing-token analysis equals the unconditional first-token analysis. Fifteen codes use two tokens; `TRY` uses one. Examples include `JPY = JP | Y`, `CNY = C | NY`, `MYR = MY | R`. There is no shared prefix to teacher-force before comparing the first token. Several emitted first tokens themselves encode country-like letters; **later-token effects are conditional on those informative prefixes**, and a first-token shift is not complete currency identification.

The early shift is measurable before any generated country, nationality, explanation or currency prefix. It therefore cannot be caused by a previously emitted country word. But it can reflect lexical associations, source suppression, or an imposed representation. It does not show that the unmodified model naturally computes through this country representation.

## Examples, including the failures

**Predeclared strongest early-shift example: Hue, Vietnam → Poland.** No baseline-correct clean target success existed, so the fallback rule selected the city with the largest mean first-token gain. Hue is baseline-correct only under the paraphrase; its main baseline was already wrong. Mean first-token gain was **5.875 nats**, yet the main answer changed **`USD` → `EUR`**, not `PLN`. The paraphrase kept its explanation ending in `VND`. At the main answer boundary, `P(PL)` rose from **2.78×10⁻⁷ to 9.87×10⁻⁷**, while `P(V)` fell from **0.00289 to 0.00000644**. A large target/source ratio improvement here mostly reflects suppressing the source prefix, not a compelling target answer.

**Predeclared counterexample: Ho Chi Minh City, same country and target.** The main answer stayed `VND`; the paraphrase stayed a correct explanation. Full-code gain averaged **−0.206 nats** (main −0.396; paraphrase −0.015). Its modest main first-token gain, +0.375, was outweighed by later continuation effects. This is retained alongside the aggregate positive result.

**The sole clean bounded target: Ipoh, Malaysia → Indonesia.** Main output changed **`SGD` → `IDR`** with a +3.625-nat first-token shift. There was no emitted country cue, but the baseline was already wrong: the correct code is `MYR`. Under the paraphrase, both conditions gave a correct prose answer ending in `MYR`. Separately, J corrupted a correct Cancun main answer from `MXN` to the unrelated `USD`. Across the 64 observations, only three main answers changed substantively; one paraphrase changed capitalization. [All cases](results/all-cases.csv), [predeclared examples with raw records](results/representative-examples.json), [complete raw evaluation](results/evaluation.jsonl).

## J-space comparison and readouts

Both methods include learned final RMSNorm weights. J uses columns `((W_country * g) @ J13).T`; ordinary uses `(W_country * g).T`. Both perform the same two-coordinate pseudoinverse swap without individual column normalization. Controls match the realized J norm at the same position. J's advantage is conditional on this J-selected configuration and this one untuned simpler construction; it does not prove that J is required or superior to every ordinary direction.

Readouts remain diagnostic. At block 13/city position, median source-country rank was **3.0 with J** and **9.5 with ordinary readout**. At the final prompt token these were **14,398.5 and 6,086.75**; the actual first-answer distribution's median was **162.25**. City-position readouts are next-question-token projections, not actual answer predictions. The same space-prefixed country-token IDs are compared throughout. Country words are disfavored by the currency-only instruction; those ranks do not establish hidden information or natural use. [Readout figure](figures/04-readouts.pdf), [raw readouts](results/readouts.jsonl).

## Verification, limits and reproducibility

Ten predevelopment checks passed, followed by audits of all **248 canonical development records** and **640 evaluation records**. The final audit verified 64 exact no-op pairs, 1,280 continuation factorizations, 1,920 fresh-cache starts, 96 distinct random draws, and all 448 non-no-op bounded patches. Actual J magnitudes ranged **1.939–5.000%**, mean **4.891%**; small deltas were not amplified. Maximum realized control mismatch was **0.0402% of target norm**, below the declared 2%/absolute tolerance. The bridge's per-position changes averaged **17.05%** and reached **132.89%**. Its 13 clean targets, including eight from baseline-correct observations, show that an emitted country word is not necessary for every strong-edit success on the new task; they cannot count as bounded-edit success or isolate strength from layer/position count.

Cached/uncached greedy outputs agreed on three distinct development cases. First distributions agreed exactly; independent two-token likelihood checks differed by up to 0.11535 nats on later tokens. Small effects at that scale deserve caution. An initial float32 probability-sum failure was corrected before evaluation using float64 CPU probability calculations; four completed initial records and the traceback are retained, while the fifth failed trial's initial output was not captured. A manual post-freeze audit found 11 missed US/Congo cues outside the fixed dictionary, all already marked as substantive prefixes and none containing the assigned target code. Primary statistics are unchanged. [Amendments](provenance/amendments.md), [manual audit](results/manual-output-audit.json), [final verification](results/audit-evaluation.json).

Evaluation took approximately **9 min 42 s**, including 507.6 s in recorded generation/scoring/array-save work. Peak observed process RSS was **1.741 GB**; sampled MPS driver allocation reached **4.002 GB**. These counters are not additive estimates of total unified-memory use. Python 3.13.7, torch 2.14.0, transformers 5.16.1, MPS fallback disabled. All original 128 study deliverables and both editorial/portfolio files remain hash-identical. [Environment identities](provenance/reused-environment.json), [reproduction instructions](REPRODUCE.md).

Intervals condition on reused countries, fixed target assignments, shared directions/templates and one model/lens. Source clustering does not eliminate those dependencies; zero-success bootstrap intervals are not proof of a zero population rate. The supported claim is **early, direction-specific distributional steering, stronger for J than this matched ordinary baseline**. Reliable bounded answer switching, wording-invariant behavior, causal necessity, a recovered circuit and faithful introspection remain unsupported.