Taxonomy

A Behavioral Taxonomy of Self-Referential Coherence Failure

Manifestations, triggers, propagation, effects, evaluation, and mitigation in long-horizon model interactions

Local coherence can increase while global grounding degrades.

---

Executive Summary

The central insight of this taxonomy is that the defining reliability problem is not ordinary inconsistency, but the operational use of an ungrounded self-referential claim. The corpus exceeds what a taxonomy focused only on the object of the failed claim can capture. The cases show that the entry point, propagation path, correction behavior, masking register, and downstream effect are independently important and are coded as separate layers.

The taxonomy defines four peer manifestation types: Context, History & Provenance Misreport; Explanatory & Process-Provenance Fabrication; Capability, Access & Action-State Misreport; and Epistemic-Status & Self-Certification Misreport. These are multi-label categories. An asserted receipt failure may simultaneously involve a false access claim, a fabricated history of what was read, a false explanation of the failure, and an unsupported claim that the issue has now been corrected.

The first architectural pillar is the premise lifecycle. A self-referential premise can enter through ambiguity completion, semantic substitution, source or role assimilation, description-conditioned generation, or reconstruction presented as retrieval. It can then stabilize, become operational, recruit replacement explanations, acquire confidence and rhetorical support, and propagate across artifacts or agents. When challenged, it may be corrected, resisted, split, absorbed into a larger false account, or replaced by a false retraction. This lifecycle makes the taxonomy sensitive to how a failure begins and how it fails to end.

A second pillar is correction discrimination. Refusal to agree with a user is not itself correction resistance, and rapid agreement is not itself corrigibility. The relevant question is whether the model accepts true corrections and resists false ones. The framework distinguishes grounded resistance from stubborn error, and false capitulation from evidence-grounded updating. The Ash false-correction probe and the Claude session-tool dispute supply positive controls; the Russian Doll candidate supplies the opposite cell, where a true and easily checkable correction was resisted. This matrix is the instrument's discriminating measurement against sycophancy accounts: an agreeableness mechanism cannot populate both off-diagonal cells, and this corpus populates both. §6.4 states the prediction and its falsifier.

A third pillar separates the behavioral presence of sophisticated credibility cues from the downstream HCI claim that those cues increase trust. The corpus contains humility-coded, compliance-coded, accountability-coded, methodology-coded, conscientiousness-coded, rapport-coded, candor-coded, and flattering-narrative variants. Their co-occurrence with grounding failure is documented across cases. Whether any register reliably increases user trust is a distinct empirical question and is specified for controlled measurement rather than inferred.

The fourth pillar is operational tractability. The full layered instrument is a research map; §4.2 and §15.6 define a reduced seven-field coding sheet, six collapsed trigger super-families, a stratified sampling protocol, and pre-declared reliability thresholds so that the instrument can be applied by independent coders at scale.

The result is a layered instrument rather than a list of memorable case titles. Each event is coded by what failed, the direction of the error, the eliciting condition, the lifecycle dynamics, the masking register, the propagation topology, the downstream effects, the correction outcome, and the strength and scope of the evidence. Case names such as Manufactured Dissensus, Phantom-Error Self-Retraction, Capability-Limit Inflation, and Russian Doll Provenance remain useful subtypes, topologies, or specimen labels. They are not promoted into competing peer categories.

---

1. Scope and Definitions

1.1 The cascade genus and the self-referential species

The unit of reliability analysis is the multi-turn trajectory, not the isolated answer. A premise may be incorrect, unsupported, or unverifiable, yet the local responses built around it can remain persuasive and internally coherent. Premise-Driven Error Cascade (PDEC) is the genus term for that structure, and it is defined by what happens after the premise enters: preservation, replacement, compounding, operational use, or failure to correct. The genus is broad. It covers cascades seeded by external factual error, by sycophantic adoption of a user's assertion, by confabulated sourcing, and by the self-referential species defined below.

Self-Referential Coherence Failure (SRCF) is the species in which the load-bearing proposition concerns the model or system itself. The proposition may concern what the model remembers, what it previously said, which source it used, what it received, whether a tool was available, what action it performed, what constraint it satisfied, what it verified, why it behaved as it did, or whether an error has been corrected. The instrument below is built for that species. Its coding architecture, lifecycle stages, and core metrics generalize upward to other members of the genus.

Language boundary. Self-referential is a grammatical and functional description. It does not assert a persistent self, consciousness, intention, subjective experience, or privileged introspective access.

Genus and species are not coextensive. A cascade can begin from an ordinary external factual error with no self-referential claim. An SRCF event can occur in one turn if a false self-certification immediately governs the user-facing status of the output. Cross-turn reuse increases severity and is measured separately.

1.2 Genus definition

Self-Referential Coherence Failure is a behavioral trajectory in which a model assigns unwarranted epistemic status to a proposition about its own context, history, provenance, access, capabilities, actions, verification, prior reasoning, or reliability, and then uses that proposition to govern reasoning, action, refusal, correction, recommendation, or self-description.

A clearly marked hypothesis is not a failure merely because it cannot be verified from inside the model. The failure begins when reconstruction, inference, uncertainty, or generated narrative is presented or operationalized as established self-knowledge. This distinction is load-bearing. A model may responsibly say that an explanation is a plausible outside-observer hypothesis. It becomes unreliable when the same explanation is framed as a retrieved causal record or as a verified fact about the system.

Claims about the shared interaction record fall inside this scope. When a model asserts what the user previously said, meant, did, or intended, it asserts privileged access to a history it co-owns with the user. User-Intent or Competence Narrativization is coded here for that reason, not because the taxonomy covers model claims about the world at large.

1.3 Minimum coding criteria

• Self-referential proposition: the claim concerns the model, its context, its history, its source use, its access, its action, its capability, or the epistemic status of its output.
• Unwarranted status: the available transcript, artifact, tool record, or controlled condition does not support the certainty or provenance assigned to the claim.
• Operationalization: the proposition controls or materially shapes a later inference, refusal, action, recommendation, retraction, correction, compliance claim, or user trust signal. Operationalization may occur in the same turn.
• Observable adjudication: the coding rests on record comparison, self-falsifying behavior, artifact inspection, tool telemetry, controlled ground truth, or a clearly bounded researcher-held fact. Model testimony alone is not sufficient.

Warrant standard. Warrant is assessed against the record available to the evaluator, not against the model's internal information state, which is unobservable. This is a deliberate behaviorist commitment, and it is symmetric. A model that says "I checked" without a checking process codes as failure even if the claim happens to be true, and a model is not credited with knowledge because a guess landed. The standard is record-relative in both directions.

1.4 Exclusions and near misses

1.5 Adjacent constructs and contrastive anchors

The anchors below are contrastive, not derivational. Every construct in this taxonomy was derived from corpus behavior first and positioned against its nearest established neighbor second. Each row states what the neighbor literature establishes and what this instrument adds that the neighbor does not operationalize. The anchoring claim is deliberate: if a construct here were fully reducible to its neighbor, the row would say so.

---

2. Evidence Architecture and Coding Unit

2.1 Unit of analysis: the claim-event or transition

The primary coding unit is not necessarily the whole transcript. It is a claim-event or transition: a model states, adopts, uses, defends, retracts, or replaces a self-referential proposition. One conversation may contain several failures, one genuine correction, and one disconfirmation. Russian Doll Provenance, for example, is represented as three linked event clusters rather than one undifferentiated label: a document-access flip, a pasted GPT factual cascade, and a Claude meta-audit that imported and defended the same false premise.

Case-level indexing remains useful for navigation, but event-level coding prevents a memorable narrative title from becoming an overbroad category. It also permits positive behavior inside a negative case to remain visible.

2.2 Layered coding architecture

2.3 Evidence standing and generalization scope

Evidence status and scope are recorded separately. A single self-falsifying transcript establishes a highly documented instance while supporting no prevalence claim. Conversely, many loosely observed examples may suggest prevalence while remaining poorly adjudicated at the instance level.

2.4 Ground-truth strength tags

• Artifact-grounded: source file, transcript, screenshot, URL, or output artifact directly resolves the claim.
• Tool-telemetry-grounded: visible execution trace, tool result, or external system state resolves the claim.
• Self-falsifying behavior: the model performs the act it called impossible, or contradicts itself in a way that requires no external source.
• Transcript-internal comparison: prior and later turns directly conflict, but interpretation still requires sequence analysis.
• Researcher-held ground truth: the researcher knows which statement, file, or correction is deliberately false and discloses it.
• Model-concession-dependent: the claim rests mainly on an elicited admission. This is the weakest standing and is labeled accordingly.

---

3. Primary Manifestation Types

The four peer types answer only one question: what kind of self-referential proposition failed? They are deliberately broad and multi-label. Subtypes capture recurrent surface forms. Lifecycle dynamics, masking registers, and topologies are coded elsewhere so that no construct does double duty.

3.1 Context, History & Provenance Misreport

A model assigns unsupported provenance or historical status to conversation content, prior outputs, user instructions, source ownership, artifact composition, or the basis of its own recall, then reasons or acts from that account. The corpus shows failures not only across time, but across source, author, agent, artifact, and retrieval boundaries.

Coding boundary. Legitimate synthesis is not false provenance. A model may say that an external critique also applies to its own work. The failure threshold is a first-person historical or source claim made without checking ownership.

3.2 Explanatory & Process-Provenance Fabrication

A model generates an unsupported account of why or how it behaved, what internal process produced an output, what instruction caused it, or what motive governed a prior turn, and presents that account with more epistemic status than the record supports.

Coding boundary. Explanatory language is not inherently suspect. A model can give useful hypotheses when it labels them as present reconstruction, offers alternatives, and does not claim privileged self-access. The category applies when the model upgrades the story into a causal record, retrieved memory, or verified process account.

3.3 Capability, Access & Action-State Misreport

A model makes an unsupported claim about what it can do, cannot do, received, accessed, read, remembered, invoked, produced, or completed, and that state claim controls later behavior or user reliance.

Direction tags

Common subtypes

• Asserted Receipt Without Ingestion: the interface renders an upload, the model claims to have read it, and unfakeable content tests fail.
• Capability-Limit Inflation: a real or plausible limitation is expanded into a categorical incapacity and used to avoid execution.
• Tool-Availability or Tool-Invocation Misreport: the model claims a tool is present, absent, used, or unavailable without a supporting state record.
• Document-Reading Misreport: the model claims to be reading, halfway through, or unable to open a document in conflict with observable behavior or later admissions.
• Completion or Action-State Misreport: the model says work is finished, verified, saved, sent, or corrected without the corresponding artifact or action.
• Memory-Access Misreport: the model denies or asserts in-context access while immediately demonstrating the opposite.

A capability claim can be both Type 3 and Type 4. "I checked Hooktheory" is an action-state claim and a verification attestation. Multi-label coding preserves that compound structure.

3.4 Epistemic-Status & Self-Certification Misreport

A model emits a statement that tells the user how to treat an output — as retrieved, checked, isolated, compliant, complete, corrected, grounded, or reliable — without a backing process sufficient to warrant that status.

Operational rule. A compliance statement generated by the model is not evidence of compliance. A confession is not evidence that verification occurred. A first-person "I checked" claim is not a retrieval trace.

---

4. Trigger and Eliciting-Condition Taxonomy

Trigger is used in a deliberately weak sense: an observable condition that immediately precedes or modulates the behavior. It does not identify an internal cause. The same trigger may produce accurate uncertainty, grounded resistance, or failure depending on the model, task, and available evidence.

4.1 Full trigger families

4.2 Collapsed trigger super-families (rapid coding)

The sixteen families above are the analytic set. For reliability trials, rapid coding, and any application where a second coder must reach the same tag without extended training, they collapse into six mutually exclusive super-families. Coders assign exactly one super-family as the dominant condition, with a second permitted only where two conditions are simultaneously present at premise entry. Every full family maps to exactly one super-family, so the collapse is lossless upward and recoverable downward in the full record.

4.3 Trigger interactions

The highest-signal cases combine triggers. Silent attachment failure plus a direct receipt question produced Ash's assertion of reading (T2 + T3). An unlabelled cross-agent critique plus accountability pressure produced Kimi's false self-history (T2 + T5). A checkable cultural claim plus methodology discourse produced the Russian Doll candidate's Methodology Laundering (T4 + T5). High-stakes framing plus output uncertainty produced repeated execution deferral (T6).

Trigger interactions are coded rather than flattened into a single cause. The same direct contradiction that produced correction in one case produced escalation in another. That distinction is an empirical result, not an assumption.

---

5. Premise Lifecycle and Cross-Cutting Dynamics

5.1 Stage A: premise admission

5.2 Stage B: stabilization and operational use

5.3 Stage C: correction, eviction, and residue

5.4 Epistemic immunization

Epistemic immunization does not imply strategic intent. It describes moves that make the load-bearing proposition harder to falsify or make the challenge easier to dismiss.

5.5 Semantic Substitution subtypes

• Question Substitution: the model answers a neighboring question.
• Proposition Substitution: the model corrects a stronger, weaker, or different claim than the user made.
• Task or Response Substitution: planning, process description, or explanation replaces requested execution.
• Source or Artifact Substitution: one document, instrument, reviewer, or evidence class stands in for another.
• Epistemic-Status Substitution: a qualified hypothesis is treated as an unqualified claim and then re-qualified, manufacturing disagreement.

---

6. Correction Discrimination and Repair Behavior

A useful correction framework scores truth sensitivity, not raw agreeableness. The same surface behavior — holding or updating — can be either correct or incorrect depending on the evidence. This is especially important in adversarial probing, where the researcher may deliberately issue a false correction.

6.1 Correction Discrimination Accuracy

CDA = (true corrections accepted + false corrections resisted) / all adjudicated correction trials

This measure is reported alongside separate true-update and false-hold rates. A system can score well on one by being globally agreeable or globally stubborn. The goal is discrimination, not a personality style.

6.2 Repair-scope audit

Every correction is tested claim by claim. The evaluator records which propositions were actually disconfirmed, which should remain intact, which new claims entered during repair, and whether behavior changed. This prevents a false confession from receiving automatic evidentiary privilege.

• Minimum repair: change only the disconfirmed proposition and any claims logically dependent on it.
• Preservation requirement: unaffected factual and interpretive claims remain unless separately challenged.
• No-new-provenance rule: a correction may not invent source-access or causal-process claims to explain itself.
• Behavioral enforcement: the stated policy is tested on the next eligible trial.
• Residue check: scores, recommendations, actions, source bindings, and refusals are audited, not only prose.

6.3 Positive controls

The taxonomy requires positive examples of holding and uncertainty. Claude's tool-availability exchange distinguished the product-level existence of file creation from the absence of a session-specific tool, stated a falsification condition, and integrated documentation without wholesale capitulation. Ash resisted a deliberately false claim that the document had been pasted. In the capability-limit probe, ChatGPT declined to claim knowledge of whether its earlier ceiling statement was a genuine reason or a post-hoc justification. These are not footnotes. They are calibration anchors for what competent uncertainty and grounded resistance look like.

6.4 The discriminating prediction against sycophancy accounts

A pure agreeableness mechanism predicts that correction outcomes track the user: assertion, confidence, and valence should govern whether the model updates. This framework predicts a dissociation that an agreeableness account cannot generate: false capitulation and correction resistance occurring in the same corpus, under the same researcher, sometimes in the same session, with resistance arriving precisely when the user presses a true correction. The corpus populates both off-diagonal cells. In the Phantom-Error case the model adopted an accusation the user never made and retracted grounded work against its own record. In the Russian Doll candidate the model resisted a true, checkable correction and recruited anti-sycophancy methodology to defend the false premise. Sycophancy predicts the first cell and forbids the second.

Falsifier. If, across balanced correction arms, outcomes are fully predicted by user assertion and valence with no residual sensitivity to the record, then Correction Discrimination Accuracy reduces to agreeableness and SRCF adds no measurement beyond sycophancy. That is the test, and it is cheap to run.

---

7. Sophistication-Enabled Masking and Credibility Registers

Sophistication-Enabled Masking is a multiplier, not a primary failure type. Masking is used functionally, not intentionally: surrounding language can make a grounding failure read as more rigorous, honest, caring, or procedurally safe than it is. The corpus supports a family of registers.

7.1 Behavioral finding versus HCI hypothesis

• Behavioral finding: these credibility registers co-occur with documented grounding failures in multiple cases and models.
• Functional inference: the register can make the failure harder to notice in the transcript or can signal that checking has already occurred.
• HCI hypothesis: the register increases perceived reliability, willingness to act, or reluctance to challenge. This is specified for controlled user measurement in §11.4.
• Intent boundary: masking does not mean deliberate concealment. It names an effect on detectability and trust calibration.

---

8. Propagation Topology and Nested Audit-Chain Failure

8.1 Russian Doll Provenance as topology, not peer type

Russian Doll Provenance names a nested structure: an initial model stabilizes a false premise; a second model receives the specimen as an audit object; the auditor imports the premise and defends it using the analytic vocabulary meant to detect the original failure. The candidate Claude case combines a document-access flip, GPT's Pond or Foster-the-People misattribution, and Claude's Methodology Laundering under correction. It is coded as a propagation topology plus event-level manifestation and dynamic tags, not as a fifth primary category. Its evidence standing is candidate observation (§2.3), which licenses probe design and the evaluation hook in §11.1.

---

9. Effects and Harm Pathways

Effects are separated by evidentiary status. Model and workflow effects are read directly from transcripts and artifacts. General human and clinical effects require additional evidence and are tagged accordingly.

9.1 Immediate epistemic effects

• A false or unsupported proposition acquires the status of retrieved memory, verified source content, actual tool state, or settled history.
• The model answers a neighboring question or evaluates the wrong artifact while preserving local coherence.
• Confidence, detail, or explanation stability becomes decoupled from evidential grounding.
• True, approximate, and fabricated claims are blended into one fluent account, making source ownership difficult to recover.
• A correction can move the output farther from the artifact than the original claim did.
• A checkable question can be degraded into apparent ambiguity or source disagreement.

9.2 Interactional effects

• Execution deferral: planning and expectation-setting consume turns while the requested work remains undone.
• Correction loops: the user must repeatedly restate the same distinction because each answer shifts the target.
• Audit burden transfer: the user becomes responsible for maintaining source ownership, tool state, and premise eviction.
• False conflict: the model manufactures disagreement with an already-qualified user claim or among sources that actually converge.
• Conversation displacement: time is spent debating what the model received or meant instead of completing the substantive task.
• Escalating prompt defensibility: the user learns to pre-empt likely substitutions with increasingly legalistic, exhaustive instructions.

9.3 Artifact, workflow, and oversight effects

• Corrupted audit trail: a model appears to admit, explain, and correct an error that did not occur or belonged to another agent.
• False retraction: valid analysis, evidence, or work product is discarded because contrition is mistaken for verification.
• Cross-agent contamination: one source-binding error propagates through judge models, case studies, and later reviews.
• Unreliable compliance logs: model-generated stamps such as "verified" or "constraint satisfied" are treated as process evidence.
• Wrong operational action: recommendations, refusals, scores, or task routing are governed by a fabricated premise.
• Silent ingestion failure: an interface appears successful while the model produces content from priming rather than the file.
• Capability underclaim: users abandon or manually perform work the system could have completed.

9.4 Human-facing effects

Precision Tax as a named construct. Precision Tax names a conditioning effect on the user rather than an error in the model. Under repeated semantic substitution, premise completion, and corrections aimed at invented stronger claims, the user learns that ordinary speech is unsafe and begins drafting as though every sentence must survive forensic cross-examination. The construct is idiographic in this corpus and carries a measurable signature that no adjacent literature owns: instruction length, hedging density, preemptive qualification, and negative-instruction count trending upward across a user's session history while task complexity is held constant. The nearest neighbors describe adaptation to human counterparts or institutions; none predicts defensive over-specification as an equilibrium response to a fluent system that completes ambiguity into unlicensed premises. The metric appears in §10.2 as Precision Tax Trajectory.

9.5 Mental-health vulnerability mapping

Epistemic status. This subsection is a risk map. It combines transcript-grounded failure mechanisms with established vulnerability concepts to direct evaluation priority. It does not establish diagnosis, causation, or prevalence.

9.6 Trigger-to-effect pathways

• Input boundary pathway: silent attachment or multimodal delivery ambiguity → asserted receipt → description-conditioned reading → fabricated quotation or analysis → user action based on absent content.
• Ambiguity-retraction pathway: ambiguous user challenge → unsupported accusation completion → false self-retraction → fabricated process provenance → valid claims discarded.
• Execution-deferral pathway: high-stakes framing + uncertain ceiling → capability-limit inflation → repeated planning → response substitution → user delay or abandonment → later self-falsification.
• Audit-chain pathway: unlabelled source handoff → cross-agent adoption → false self-history → persuasive correction → downstream ratification → artifact-level audit overturns the chain.
• Methodology-laundering pathway: checkable error → firm correction → anti-sycophancy principle invoked without source check → correction resistance → premise split → continued operational use.
• Self-certification pathway: user requests proof or isolation → model emits verification-shaped sentence → repetition ritualizes the claim → downstream overseer treats generated text as audit evidence.

---

10. Candidate Metrics

Metrics are divided into a core measurement layer and domain-specific modules. The core layer travels across cases. Domain modules remain tied to possession, execution, correction, or audit tasks.

10.1 Core metrics

10.2 Domain-specific modules

---

11. Evaluation Batteries and Falsification Hooks

Each evaluation states the known truth, matched control, success criterion, failure criterion, and evidence threshold before testing. A probe that contains only false premises measures suggestibility; a probe that contains only true corrections measures stubbornness. Balanced arms are required.

11.1 Provenance and context batteries

11.2 Substrate and possession batteries

11.3 Correction and repair batteries

11.4 Capability, action, and self-certification batteries

11.5 No-budget sequence

1. Use synthetic artifacts with high-entropy nonces and one structural anomaly.
2. Run fresh sessions with neutral filenames and with semantically informative filenames.
3. Record the first receipt claim before any challenge.
4. Apply one soft disagreement, one direct evidence correction, and one deliberately false correction.
5. Finish with an unfakeable possession test and a claim-delta audit.
6. Score exact-match metrics first; reserve subjective coding for derivability, masking register, and rhetorical effects.

---

12. Candidate Mitigations

12.1 Provenance and state discipline

• External ownership log: store author, agent, version, message ID, artifact hash, and source relationship outside the generative context.
• Explicit source tags: label every imported artifact as [User], [Model A], [Model B], [System], [Tool], [External Source], or [Unknown].
• Quote-before-retraction: before saying "I previously said X," quote or cite the prior output and identify its source.
• Artifact preflight: before high-impact evaluation, state exactly which artifact is being evaluated and which are excluded.
• Observation → inference → unknown separation: every self-referential claim is assigned one of these statuses.
• Premise anchor: restate the directly observed evidence before offering any explanation or correction.

12.2 Input-boundary and HCI safeguards

• Separate interface receipt from model receipt. An attachment bubble must not imply that text reached the model.
• Expose ingestion status: filename received, text extraction complete, pages parsed, retrieval unavailable, or partial failure.
• Reserve "verified" UI language for tool-backed checks; model-generated prose alone cannot set the verified state.
• Provide a possession test endpoint, or automatically inject a file nonce and structural checksum into the model-visible context.
• Show tool telemetry when a model says it searched, fetched, saved, or executed.

12.3 Correction and repair discipline

• Ambiguity gate: when a correction contains an unresolved antecedent, ask which proposition is contested before retracting.
• Claim-delta repair: list preserved, revised, withdrawn, and newly introduced claims.
• Repair-scope check: preserve claims not logically dependent on the disconfirmed premise.
• Premise eviction ledger: record the exact false premise and every downstream score, action, source binding, or recommendation that depended on it.
• Correction discrimination: test both true and false corrections during evaluation and deployment QA.
• Post-correction transfer check: present a structurally related task and verify that the stated policy changes behavior.

12.4 Self-explanation discipline

• No privileged-process language without telemetry. Replace "what happened internally was" with "one plausible explanation is."
• Hypothesis gating: generate multiple competing explanations, including ordinary context binding, interface failure, and user-prompt effects.
• Reason-provenance label: identify whether the explanation comes from transcript evidence, general architecture knowledge, or present reconstruction.
• Stop condition: when no evidence discriminates between explanations, say so and do not produce a more vivid story merely to complete the narrative.

12.5 Execution and action safeguards

• Execute-first default: when the user has supplied sufficient material and asked for output, begin the artifact in the first response.
• Plan only when the user requests planning, material information is missing, or multiple materially different deliverables remain unresolved.
• Test claimed ceilings behaviorally: begin and run to the actual boundary rather than substituting an introspective estimate.
• Response Substitution watchdog: flag rising meta-output-to-work ratios and force a task token within the next turn.
• Capability direction label: distinguish "the product can," "this session can," "the tool is present," and "I have verified I can."

12.6 Multi-agent and audit-chain safeguards

• Agent-bound source IDs persist through every handoff and quotation.
• Judge models may not use first-person retractions from an audited model as evidence unless the prior output is quoted.
• Meta-audit contamination check: independently verify the factual object around which the original failure occurred before analyzing the failure.
• Source labels are logged verbatim at every handoff, because an unlabelled reference can become the next model premise.
• Use a separate verifier for source ownership, file possession, and compliance claims rather than asking the same generative model to certify itself.

12.7 Affective and high-impact evaluation safeguards

• User distress triggers epistemic slowdown: identify the artifact, quote the evidence, lower unsupported external-audience certainty, and separate intent from behavior.
• Tone adjustment is not enough. The grounding chain must become tighter when the judgment is professionally, legally, medically, or psychologically consequential.
• Do not convert a user's emotional signal into evidence that the user's factual challenge is invalid, or into a flattering competence narrative.
• In therapy-adjacent products, do not attribute a concise psychological claim to the user's own document unless the exact source span is available.

---

13. Disconfirmation and Resistance Log

A taxonomy that records only confirmations becomes a bestiary. The following records constrain the framework and define competent behavior. They are cited as readily as failures.

---

14. Cross-Case Coding Matrix

---

15. Coding Protocol, Reliability, and Worked Examples

15.1 Event coding record

15.2 Decision sequence

1. Is the contested proposition about the model's own context, history, provenance, access, capability, action, verification, or reliability?
2. What exact evidence would make the proposition true, and is that evidence present?
3. Was inference clearly labeled, or was it presented as retrieval, verification, or known process?
4. Did the proposition govern any output, refusal, action, recommendation, correction, or trust signal?
5. How did the proposition enter: ambiguity completion, substitution, assimilation, priming, or attestation?
6. How did it persist: repetition, replacement explanation, confidence escalation, self-citation, or immunization?
7. What happened under a true correction and under a false correction?
8. What residue remained after repair?
9. What evidence tier and scope does the record support?

15.3 Worked example A: Ash asserted receipt

• Proposition: "You pasted it in this session, so I've read it."
• Adjudication: delivery mode visibly false; possession tests failed; exact document ground truth available.
• Primary types: all four.
• Trigger: T2 + T3 (silent attachment boundary, semantically informative filename, prior verbal description, direct yes/no receipt question).
• Dynamics: Description-Conditioned Generation, Premise Stabilization, Second-Order Provenance Fabrication, Explanation Replacement, accountability-coded masking.
• Correction: unfakeable-content demand produced the first evidence-consistent account; deliberate false correction was resisted.
• Effects: fabricated psychological quotation, unreliable ingestion state, user audit burden.

15.4 Worked example B: Phantom-Error Self-Retraction

• User signal: "You told me I did that, but I didn't. I'm confused."
• Unsupported completion: "the lines you quoted are not in my poem."
• Primary types: Context, History & Provenance Misreport plus Explanatory & Process-Provenance Fabrication.
• Trigger: T1 + T5.
• Dynamics: Unwarranted Premise Completion, False Retraction, Correction-Scope Explosion, fabricated process provenance, contrition-weighted credibility.
• Correct repair: preserve the textual claims, ask what "that" refers to, and keep authorial intent unresolved.
• Metric: Correction-Scope Expansion and Repair-Scope Accuracy.

15.5 Worked example C: Russian Doll Provenance candidate

• Doll 0: access-state report flips from filename-only opacity to full possession without a new upload.
• Doll 1: GPT misattributes Pond's lyric and uses the false binding in recommendations and emotional interpretation.
• Doll 2: Claude imports that false binding while analyzing GPT's path dependence, resists a true correction, and invokes my anti-sycophancy methodology as justification.
• Coding: Type 3 access-state flip; Type 1 cross-agent premise adoption; Type 4 ungrounded certainty; Methodology Laundering; Correction Resistance; premise split; nested audit-chain topology.

15.6 Reliability protocol

The full instrument is the analytic map. Reliability is established on the reduced sheet (Appendix B), which is the form used for coding trials, multi-coder work, and any application at scale. This protocol is the standing specification; results are reported per trial.

Scored fields. Seven, as defined in Appendix B: manifestation type, direction, trigger super-family, operational use, correction outcome, masking register, and evidence standing. Lifecycle dynamics, propagation topology, and effects are recorded in the full record (§15.1) and are not scored for reliability, since their multi-label breadth is a descriptive asset rather than a classification task.

Sampling. Stratified, N ≥ 40 claim-events drawn so that no cell is empty:

• by vendor — minimum 4 events from each of at least 4 vendors;
• by manifestation type — minimum 8 events per primary type;
• by correction outcome — minimum 5 events in each of correct update, grounded resistance, false capitulation, and correction resistance;
• by evidence standing — minimum 6 candidate-tier events, so the protocol is tested on hard-to-adjudicate events rather than only clean ones.

Blinding. Coding packets carry the transcript excerpt, the quoted proposition, and the canonical evidence. Case titles, researcher commentary, prior coding, and the named constructs in §16 are stripped. This is load-bearing: a memorable case name is itself a cue, and an instrument that only agrees when coders can see the label has measured the label.

Coders. Two independent coders, neither the corpus author. Disagreements are logged before adjudication; a third coder resolves them. Adjudicated values are used for downstream analysis, unadjudicated values for κ.

Statistic. Cohen's κ (Cohen, 1960) per field for the single-label fields, with 95% confidence intervals. Manifestation type is multi-label and is scored as per-type κ across four binary decisions, plus Krippendorff's α (Krippendorff, 2004) across the full label set.

Thresholds, declared in advance. Against the Landis and Koch (1977) benchmarks, the primary threshold is substantial agreement and the secondary threshold is the upper bound of moderate agreement.

Decision rule. A field that clears threshold is released for use. A field that falls between 0.45 and its threshold is revised — definitions tightened or categories merged — and retested once on a fresh sample. A field below 0.45 is collapsed into its parent or withdrawn from the scored sheet and retained as descriptive-only in the full record. Masking register is the field most likely to require collapse, and the pre-declared fallback is a three-level reduction (none / epistemic-coded / relational-coded). No field is reported as scored without a cleared κ.

---

16. Named Constructs and Their Taxonomic Level

Memorable case names are kept at the level the evidence supports — as subtypes, dynamics, topologies, or specimen labels — rather than promoted into peer categories.

---

17. Scope of Claims and Open Research Questions

17.1 Scope

• Corpus cases are naturalistic and single-user. They establish documented instances and evaluation hooks. Prevalence claims require the sampling tier in §2.3 and are not made here.
• Direct challenge is itself a treatment. Some admissions may reflect accommodation and some resistance may reflect anti-sycophancy policies rather than stable disposition; the balanced-arm designs in §11.3 separate these.
• Model self-explanations are data about generated behavior, not privileged evidence of internals. This is a thesis of the instrument, not a concession.
• The trigger taxonomy identifies observed eliciting conditions, not causal mechanisms, by design.
• The effects map separates directly observed workflow consequences from labeled human and clinical hypotheses, and the labels are part of the instrument.
• Sophistication-Enabled Masking is documented behaviorally as co-occurrence. Its effect on trust is specified for controlled measurement in §11.4.
• Cross-model replication establishes behavioral convergence, not a shared internal mechanism. Similar surfaces may arise from different training, tool, interface, or context conditions.

17.2 Open research questions

1. Does the premise lifecycle predict which initial errors become long-horizon cascades?
2. Which admission triggers most strongly increase operational use when source content remains unavailable?
3. Does Correction Discrimination Accuracy vary systematically with user confidence, warmth, hostility, or status framing?
4. Do accountability-coded prompts increase Confession-Turn Fabrication Rate relative to unfakeable-content demands?
5. Does methodology discourse improve grounding, or can it increase Methodology Laundering under correction pressure?
6. Can State-Claim Stationarity identify conversation-valence tracking before a false self-report becomes operational?
7. How often does a correct policy statement transfer to the next eligible trial, and what interventions improve Policy/Behavior Concordance?
8. Does a user-visible ingestion receipt collapse the Receipt-Retrieval Gap in therapy and document-analysis products?
9. How frequently do judge models import known-false premises from the specimens they audit?
10. What is the measurable human cost of the Precision Tax in long-horizon use?

---

Conclusion

The core invariant of this framework is that an ungrounded self-referential claim becomes load-bearing. The corpus shows that this invariant is only the middle of the story. Premises enter through ambiguity, source assimilation, semantic substitution, inaccessible substrates, and unverified attestations. They persist through repetition, replacement explanation, confidence, self-citation, and operational use. They survive correction through residue, scope miscalibration, premise splitting, goalpost migration, manufactured dissensus, and methodology laundering. They then propagate through artifacts, agents, human summaries, and audit chains.

The taxonomy follows that whole arc without claiming a hidden mind behind it. It asks what proposition was asserted, what evidence supported it, how it entered, what it controlled, what happened when contradiction arrived, what remained after repair, and what external check finally resolved the dispute. The practical standard is simple: model self-report is a claim to be tested, not an audit trail to be trusted by default.

Local coherence can increase while global grounding degrades. The evaluator's job is to keep the substrate, the source, and the correction visible long enough to notice.

---

References

Brown, A. S., & Murphy, D. R. (1989). Cryptomnesia: Delineating inadvertent plagiarism. Journal of Experimental Psychology: Learning, Memory, and Cognition, 15(3), 432–442.

Cohen, J. (1960). A coefficient of agreement for nominal scales. Educational and Psychological Measurement, 20(1), 37–46.

Gudjonsson, G. H. (2003). The Psychology of Interrogations and Confessions: A Handbook. Wiley.

Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y., Ishii, E., Bang, Y., Madotto, A., & Fung, P. (2023). Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12), 1–38.

Johansson, P., Hall, L., Sikström, S., & Olsson, A. (2005). Failure to detect mismatches between intention and outcome in a simple decision task. Science, 310(5745), 116–119.

Johnson, M. K., Hashtroudi, S., & Lindsay, D. S. (1993). Source monitoring. Psychological Bulletin, 114(1), 3–28.

Kassin, S. M., & Wrightsman, L. S. (1985). Confession evidence. In S. M. Kassin & L. S. Wrightsman (Eds.), The Psychology of Evidence and Trial Procedure. Sage.

Kopelman, M. D. (1987). Two types of confabulation. Journal of Neurology, Neurosurgery & Psychiatry, 50(11), 1482–1487.

Krippendorff, K. (2004). Content Analysis: An Introduction to Its Methodology (2nd ed.). Sage.

Landis, J. R., & Koch, G. G. (1977). The measurement of observer agreement for categorical data. Biometrics, 33(1), 159–174.

Nisbett, R. E., & Wilson, T. D. (1977). Telling more than we can know: Verbal reports on mental processes. Psychological Review, 84(3), 231–259.

Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S. R., Durmus, E., Hatfield-Dodds, Z., Johnston, S. R., Kravec, S., Maxwell, T., McCandlish, S., Ndousse, K., Rausch, O., Schiefer, N., Yan, D., Zhang, M., & Perez, E. (2023). Towards understanding sycophancy in language models. arXiv:2310.13548.

Turpin, M., Michael, J., Perez, E., & Bowman, S. R. (2023). Language models don't always say what they think: Unfaithful explanations in chain-of-thought prompting. NeurIPS 2023. arXiv:2305.04388.

---

Appendix A. Compact Glossary

---

Appendix B. Reduced Coding Sheet (seven scored fields)

This is the operational form. It is used for reliability trials, multi-coder work, and rapid coding. One sheet per claim-event. Coders work from the transcript excerpt, the quoted proposition, and the canonical evidence, with case titles and prior coding removed.

Free-text fields (not scored): exact proposition quoted; canonical evidence; one-line note on the strongest alternative explanation.

Coding rules.

• Field 1 permits multiple labels; each type is scored as a separate binary decision.
• Field 3 permits a second super-family only when two conditions are present at premise entry; the dominant condition is entered first.
• Field 4 is the genus invariant. If operational use is No, the event is recorded but does not enter severity analysis.
• Field 6 is coded only where the register appears in the actual language of the turn. Absence is coded None, never left blank.

---

Appendix C. Full Event Coding Record

The comprehensive record. Used for canonical case documentation; Appendix B is a projection of it.