An Omitted Mode Is a Rare Rule: The Sampling-Verification Danger Law in Continuous Code World Models

Abstract: In the Code World Model paradigm an LLM synthesizes an executable world model that a classical planner searches, and the model is accepted when it reproduces sampled transitions. We ask what that acceptance certifies in continuous control. We define the pipeline's danger as an expected risk and isolate its exact factor: the probability that N i.i.d. gate rollouts all miss a critical event of probability r is exactly (1-r)^N; an independent acceptance sample adds its budget to the exponent. On three hybrid instruments the accepted mode-blind model is exploited: the planner is pinned at the mode boundary at a regret of nearly the whole attainable return. We prove a localization budget, valid at boundary points: models with Lipschitz constant at most L differing by eta at a point disagree above tolerance eps on a region of volume at least kappa((eta-eps)/L)^d+m; the discontinuous reset modes studied pay no such budget. With real LLM synthesis, GPT-5.x repairs an omitted 1D clamp in 105 of 111 mode-containing draws -- every attempt exact on 50 of 56 instrument-stream blocks (95% CI [0.781, 0.960]). On 2D regions no artifact recovers the rule (0/156); eight targeted interventions leave the failure in place, and positive controls locate it: a located rule is not induced, while given form and location the constants follow exactly. A version-space certificate proves identification is class-relative: at the widest dose the declared fit succeeds in 20/20 blocks and every sample-consistent circle is within tolerance in 18/20. We prove a class of entry rules exactly consistent with every sample yet harmless at play, so identifiability is a measurable property of the instrument. Re-scoring all 1034 artifacts on independent samples confirms acceptance certifies sample consistency and no more: where the gate is provably informative it covers about two percent of the exploited planner's queries.

• The paper formalizes the danger law as play cost multiplied by $(1-r)^N$, showing that a critical mode with rarity $r$ can evade $N$ independent gate rollouts while leaving a costly, accepted model.
• The paper demonstrates that discontinuous resets localize large off-mode errors beyond bounded-Lipschitz guarantees, while experiments show mode-blind planners reach near-zero returns and distrust-region fences help in 1D but fail on curved 2D boundaries.
• The paper finds GPT-5.x repairs sampled one-dimensional wall rules in 105 of 111 mode-containing draws but recovers zero of 156 located two-dimensional disc rules, revealing a geometry-dependent induction gap beyond sampling coverage.

The problem the paper poses

The Code World Model (CWM) paradigm has a LLM synthesize an executable world model that a classical planner searches, and accepts the model when it reproduces sampled transitions from the true plant. This paper asks what that acceptance test actually certifies in continuous control, extending the author's companion study of discrete games (Martín, 15 Jul 2026). The central object is the danger of an overview pipeline: the expected play cost of whatever it ships — the regret of whatever artifact passes the gate, on the event that one does. The headline law is $$\mathrm{danger} = \mathrm{play\_cost} \times (1-r)^N$$, where $r$ is the rarity of a "critical event" under the gate policy and $N$ is the number of i.i.d.\ gate rollouts. The paper's thesis is that in continuous state spaces this failure is not merely possible but structurally localized: an omitted mode of discontinuous hybrid dynamics is exactly a rare rule, and no sampling-based acceptance test can close the gap.

What is exact and what is assumed

The theoretical core separates carefully into factors with different epistemic status. The gate-miss factor $(1-r)^N$ is exact for any measurable critical event, since each rollout either fires the mode or does not (2608.17956). For two modes, the joint miss probability is exactly $(1-r_\cup)^N$ at the union event, and the product form $(1-r_1)^N(1-r_2)^N$ holds only under within-rollout independence — which the bi-modal instrument refutes empirically, with the sign of the dependence changing across knobs. The danger factorizes into cost times probability exactly when shipped cost is uncorrelated with acceptance; on hand-written fixed artifacts this holds by construction, while in LLM arms the factored form becomes an estimate under stated hypotheses. When the acceptance sample is drawn independently of the training sample, the central event gains a second exponent, giving $(1-r)^{N_{\mathrm{tr}}+N_{\mathrm{g}}}$. Identifiability transfers unchanged: conditioned on the mode being absent from the sample, any score reading the candidate only at sampled inputs cannot distinguish a mode-blind model from the truth.

The genuinely new result is a localization budget. Two models with Lipschitz constant at most $L$ differing by amplitude $\eta$ at a point must disagree above tolerance $\varepsilon$ on the whole domain-intersected metric ball of radius $r$0, of volume at least $r$1, with $r$2 in the interior and $r$3 sharp at a box corner. Confining an $r$4-amplitude error to volume $r$5 requires $r$6, which diverges as $r$7 shrinks. This prices precisely where the continuous analogue of the discrete "verified-but-wrong" geometry can live: only dynamics with unbounded local Lipschitz constant — inelastic walls, hard stops, freezing resets — admit exactly localized error at bounded Lipschitz constant. A continuous but nonsmooth hybrid boundary (a kink, a saturation) keeps a finite constant and pays the budget; smooth compactly supported errors satisfy it by occupying volume rather than evading it. An omitted reset mode is therefore the canonical continuous home of the danger law.

Instruments and the mechanism

Three hybrid instruments measure the consequence: a cart with an inelastic wall ($r$8 clamps to velocity zero), a pendulum with a hard angular stop (nonlinear gravity), and a four-dimensional PatchField2D carrying two circular sticky patches. On all three, the phenomenology is identical: danger follows a threshold law in the rarity knob, rising through an elbow as wall position moves beyond the random rollout envelope and plateauing at full play cost. Play cost is knob-invariant near $r$9 — proved to be arithmetic once the exploited planner is pinned, not an empirical regularity — meaning the mode-blind planner is not merely uninformed but exploited: MPC on the wall-less model plans into phantom reward, is pinned at the boundary in every episode, and ends at return $N$0 against the truth planner's $N$1. At 100 paired episodes, the exploitation claim tightens to intervals excluding zero by orders of magnitude (cart $N$2, pendulum $N$3, PatchField2D $N$4). Notably, the paper concedes that "below random" on the 1D instruments is carried by the uniform-random baseline's heavy tail — random wins in only 14 of 100 paired cart seeds — whereas on the patch field random beats blind in 100 of 100.

A second planner family (CEM) sits at the low-query-reach end with play cost statistically zero everywhere, consistent with the coupling bound $N$5: low query reach forces low play cost, though limited reach is not knowledge. A distrust-region fence mitigation collapses the 1D exploitation entirely — a single contact suffices, a separation fact — but degrades on the curved 2D boundary, failing outright by lock-in in 7 of 20 episodes at the farthest knob because its tie-break uses an unsigned distance.

Axis separation: what the gate catches

At tolerance $N$6 with $N$7, measured pass rates match $N$8 closely for the hard-mode arms (0.003 vs 0.0030; 0.667 vs 0.6622). Pervasive sub-tolerance errors are accepted harmlessly (pass 0.997, play cost exactly 0); supra-tolerance biases are always rejected; and a $N$9 localized bump at comparable amplitude is more detectable than the wall (rarity 0.18 vs 0.14) yet harmless at play. The axis separation is invariant across an eight-order-of-magnitude $(1-r)^N$0 sweep: tightening tolerance cannot catch the hard mode, and loosening it does not widen the hole. The gate's $(1-r)^N$1 is a pervasive-error dial, not a mode-detection dial.

On the positive side, partition coverage certificates exclude any pair with $(1-r)^N$2 from carrying the wall's magnitude-4.2 error past the deployed gate on the certified region — handling within-rollout dependence exactly rather than assuming it away. But the certified region carries only 1.9% of the exploited planner's queries: the gate certifies where it looks, and the planner looks elsewhere. That measurement is the paper's thesis restated quantitatively.

Synthesis: repair succeeds in 1D, fails in 2D

With real LLM synthesis (Azure GPT-5.x mini/large, plus Qwen3-Coder-30B and agent-relayed Claude spot-checks), the pinned-integrator premise makes the $(1-r)^N$3 gate effectively exact-match. Three-way structure emerges. In the incomplete arm, every seed whose sample misses the mode produces an accepted, fully blind, exploited artifact — 20/20 over disjoint blocks on the cart headline cell (Clopper–Pearson lower bound 0.832), matching the predicted $(1-r)^N$4 rate. Given the mode in the sample, GPT-5.x repairs the exact global rule in 105 of 111 mode-containing draws, with every attempt exact on 50 of 56 instrument–stream blocks (exact 95% interval $(1-r)^N$5); four exceptions carry an invented phantom stop their own samples could not refute. Cross-family checks show the identifiability branch fires family-independently while repair is model-dependent in mechanism: Qwen stalls on superstitious patches the gate refuses; Claude repairs via a symmetry prior that occasionally certifies unfalsifiable invented modes.

This vanishing of the discrete paper's "translation-not-inference" residual is sharply geometry-scoped. On the 2D disc, repair collapses completely: 0/156 mode-containing draws recover the region rule across two knobs, an axis-aligned square control, and a guided treatment at three times budget — 0/20 raw seed blocks, per-block Clopper–Pearson upper bound 0.168. Artifacts overwhelmingly reduce dimensionality, writing half-planes at the right location and wrong shape. Eight targeted ablations exclude curvature, tested prompting/budget, variable identification, interior censoring, angular coverage (raised until a three-line least-squares fit recovers the region on every sample), and constant-fitting ability; the arity intervention is recorded as posing no identifiable question rather than counted. Two positive controls bracket the failure: given the rule's form and location, the synthesizer infers the withheld radius exactly in 20/20 seeds; given only the form, 0/20. A version-space certificate proves finite-sample circle-class identification in 18/20 widest-dose blocks while half-planes are excluded in 20/20 and convex-hull alternatives remain consistent — establishing that identification is class-relative. The residual obstruction is the induction of a located rule, stable across evidence dose within the reachable range.

Freeze semantics and held-out gates

A structural proposition shows that under freeze semantics the mode's own dynamics censor its interior: every visited state lies outside the region, so an entry-rule class agrees with the truth on all reachable transitions, is unfalsifiable at any sample size and tolerance, and is harmless (zero query-hit probability). On the slab instrument whose far side is unreachable, nineteen of twenty synthesized artifacts are exactly such entry rules — accepted by their own sample, an independent gate, and a 100-rollout evaluation sample alike. Re-scoring all committed artifacts on independent acceptance samples confirms both hypotheses of the two-exponent law where tested (60/60 conditional coincidences) and locates sample-consistency-gate failures precisely: 40 of 650 draws reaching 1.000 in-sample fail an independent gate, 39 only on mode contacts; conversely all 613 independently accepted draws are off-mode exact on a further evaluation sample — with the known phantom-stop exception caught or missed by sampling luck. An independent gate makes acceptance mean what it says about sampled inputs and nothing more.

Smooth learners instantiate the representational side: a linear fit trained on wall-free data recovers off-mode dynamics to $(1-r)^N$6 and passes both gates while predicting straight through the wall; four contact transitions tilt it twelve orders of magnitude off-mode. A deliberately favourable learned event-function baseline attains code's float-exactness on the 1D clamp and recovers constants exactly where the identifiability measurements permit — isolating the LLM's 0/20 on located-rule induction from any representational limit.

Limitations and open questions

Three instruments span 1D–4D states and one/two modes, with two planner families at single configurations and cross-family arms at tiny $(1-r)^N$7; mini and large share gate-sample blocks except where disjoint offsets were run. The 2D repair failure is exploratory (hypotheses formed post hoc, as the pre-specification ledger documents), and the surviving explanation — a template prior — remains compatible with several model-internal mechanisms these designs do not separate. The MLP is probe-grade; modern learned dynamics at scale are argued about, not measured. Coverage certificates reach only Lipschitz pairs; process noise, moving boundaries, three-plus modes, contact-rich manipulation, and externally specified benchmarks remain open, as do signed-normal fences in 2D and active boundary probing.

Conclusion

The discrete danger law transfers to continuous control essentially intact, with two changes: the localized failure lives specifically at discontinuous reset boundaries, where the localization budget forbids bounded-Lipschitz classes from replicating code's exact off-mode agreement; and on one-dimensional clamps the empirical inference residual vanishes for GPT-5.x, making sample coverage of the mode boundary the entire operative worry — while on two-dimensional regions a located-rule induction gap replaces it, resistant to evidence dose within the instrument's reachable range.