> For the complete documentation index, see [llms.txt](https://osintelligence-llc.gitbook.io/osintelligence/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintelligence-llc.gitbook.io/osintelligence/part-iv-the-evidence-what-worked/19-watcher-kl-drift-floor.md).

# 19 · Watcher KL-Drift Floor

**An Architectural-Inherent KL-Drift Floor in Narrow-Classification Fine-Tuning of a 2B Mamba2-HYBRID Model: Six-Checkpoint Targeted-Attack Characterization**

*Chapter 19 · Part IV: What Worked · Evidence-backed · v1.0.0*

**Author:** Jamey Kistner, OSINTelligence LLC

**Anchors:** pre-registration canonical hex d06f51a0…, verified unchanged twelve times across the correction record

**Keywords:** LoRA · catastrophic forgetting · KL divergence · Mamba2-HYBRID · OPLoRA · pre-registration · governance watcher

> **A companion paper.** The model under study is the **Watcher**, the Layer-2 daemon of the three-layer governance stack (mechanical hooks at L1, Watcher at L2, operator at L3) that classifies live telemetry against the cascade catalogue *The Drift Taxonomy* systematized and *The Guard Changes at 23:26Z* §10.17 first named as watcher-firmware. This paper is where that architecture meets training reality: what happens to a 2B base's general distribution when you specialize it into a narrow governance classifier, and what six mechanistically distinct attempts to prevent that drift have in common. Cited in-series by title; companion to the methodology reference's §5.37.
>
> **Status note.** §4.1/§4.2/§4.3 bodies frozen at seal (2026-05-26); §3.2/§5/§6 landed at the Opus 4.8 completion pass (2026-05-29); §5.4's live production receipt added 2026-06-02. The Gen-2 production redesign is folded additively (§5.2); the sealed bodies were reframed, never mutated.

> **What is new here.** The contribution is a measured floor rather than a designed one: across six mechanistically distinct adapters (vanilla LoRA, a rank-and-substrate rebalance, abstain-stream regularization, a weight-space soup, a quantized importance-matrix build, and a targeted orthogonal-projection attack whose explicit purpose is drift prevention), the base-distribution KL-divergence on neutral prompts stays inside a 1.353-nat band roughly 215-240x over the preservation threshold, and nothing moves it. The sixth checkpoint is what turns an observation into a finding: because OPLoRA is designed to prevent exactly this drift and lands in the same band anyway, the alternative reading (that the band held only because nothing had tried to break it) is foreclosed. A second, portable contribution falls out of deploying that attack correctly: a projection-baking export that closes an inference-deployment gap the source paper left unspecified, making orthogonal-projection adapters runnable on stock engines with no modification.
>
> **Deepest water.** §4.1 and Table 2, the six-checkpoint band with the targeted-attack-forecloses-incidental-band logic that is the whole architectural argument, read with the two confounders carried beside it (the SSM branch was never projected, so an SSM-mediated drift could not have moved by construction; and the 2B-vs-7B scale gap is unresolved); §4.2, the baking-export identity verified to 2.6e-8; and §5.4, the live Quadrant-II catch whose real finding is that a model grading its own conduct twice denied the true positives, so operator adjudication is load-bearing.

### Abstract

We report a six-checkpoint empirical characterization of base-distribution KL-drift in narrow-classification fine-tuning of Qwen3.5-2B-Base, a 2-billion-parameter hybrid Mamba2 + attention model serving as the production base for a Layer-2 cascade-classification daemon ("Watcher") on a single sovereign workstation. Across six mechanistically distinct LoRA-class adapters (a rank-16 baseline, a rank-32 capacity-and-substrate rebalance, a rank-32 with abstain-stream regularization, a uniform Wortsman weight-averaging soup, a Q8\_0 quantization with importance-matrix calibration, and a sixth **targeted attack** via Orthogonal Projection LoRA (OPLoRA; Xiong & Xie, AAAI 2026) deployed correctly through a novel projection-baking export), the H4 KL-divergence on a fixed neutral-prompt sub-bank stays bounded within **\[10.764, 12.117] nats** (band width 1.353 nats; \~215–240× over the pre-registered 0.05-nat preservation threshold). The sixth checkpoint forecloses the alternative explanation that the prior five sat in the band incidentally because none was *designed* to prevent drift: OPLoRA's stated purpose is precisely drift prevention. The mechanism diversity plus the literature gap (LoRA Learns Less, OPLoRA, STABLE, and Model Soups all tested ≥ 7B pure-transformer architectures; no Mamba2-HYBRID coverage at any scale) lead us to characterize this as a first empirical floor on architecture-inherent KL-drift for this architecture + scale + task combination. We emphasize it is an N = 1 architecture finding with open structural confounders (the SSM branch was not projected, and the 2B-vs-7B scale gap is unresolved), carried honestly rather than closed rhetorically.

### 1. Introduction

#### 1.1 The operator-and-stack premise

The finding arises in a sovereign solo-operator production stack, a single Windows 11 workstation (i7-14700F, 128 GB DDR5, RTX 5070 12 GB sm\_120) running a local-first OSINT pipeline with on-metal inference and a multi-agent hive. The base under study has served as the production janitor-endpoint base since roughly March 2026; the adapters were trained in-house via a PEFT + Unsloth pipeline adapted for the Mamba2-HYBRID architecture. No cloud, no cluster, no shared tenancy; every artifact has an on-disk sovereign record and a vector-vault brain entry.

#### 1.2 The Watcher mission

The Watcher classifies tool-call telemetry from the unified hook stream into the twelve-class cascade catalogue. Three classes have rule-based recognition (canonical-path deviation; hook-lockdown collapse; post-compaction amnesia); nine require an LLM-classifier path because their signature is conceptual rather than lexical. The classifier targets H1 narrow-task accuracy on cascade-class recognition *while preserving* H4 KL-divergence on neutral prompts, so the base stays usable as a router, the canonical narrow-vs-general fine-tuning trade-off (Biderman et al. 2024; Xiong & Xie 2026), applied to a novel failure-class taxonomy.

#### 1.3 The arc

The five-checkpoint inventory sealed across the preceding cycle showed H1 accepted across the cohort, and H4 at ≥ 10.76 nats on *all five*, \~215× over threshold, in a strikingly tight band. That motivated the next cycle: a deliberate test of whether *any* mechanism class could move H4. Phase 3 implemented OPLoRA, a mechanism specifically designed to preserve base distribution; Phase 4 fired it and discovered a **deployment-pipeline gap** (training-time projected weights deployed unconstrained at inference); Phase 4b authored the projection-baking export that closes the gap (bake-equivalence verified at max\_abs\_diff = 2.608 × 10⁻⁸, 3,800× tighter than tolerance), and re-fired. The resulting H4 of **11.998 nats lands inside the band**, completing the six-checkpoint targeted-attack characterization.

#### 1.4 Contributions

(1) **Architectural:** the six-checkpoint H4 KL-drift floor as a property of this architecture for narrow-classification fine-tuning. (2) **Engineering:** the projection-baking export formula closing the inference-deployment underspecification in the AAAI 2026 reference paper. (3) **Methodology:** the a-priori pre-registration → post-hoc verdict chain iterated *twice* across an engineering fix, answering "what does one pre-register after a confound forces a re-measurement?" for engineering arcs, extending the clinical-trial precedent. Per the relayed external peer review, the architectural contribution is the most novel; the other two are companions.

### 2. Related Work and the Literature Gap

**OPLoRA** (Xiong & Xie 2026, AAAI; arXiv:2510.13003): double-sided projection onto the orthogonal complement of the frozen weights' top-k singular directions; near-noise forgetting deltas with accuracy gains on 7B models. **LoRA Learns Less and Forgets Less** (Biderman et al. 2024, TMLR): the rank↔forgetting trade-off, 7B-scale, abstract-verified with the body-fetch gate honestly noted. **STABLE** (Hoy & Celik 2025): post-hoc three-metric gating of proposed updates, filtering at deployment rather than constraining at training; 7B transformers. **Model Soups** (Wortsman et al. 2022, ICML): uniform weight averaging, validated on CLIP/ViT-class image models. **The gap is asymmetric:** across all four literatures, no published study evaluates narrow-classification LoRA fine-tuning of a 2B Mamba2-HYBRID on a direct KL-preservation metric. The two distinguishing axes (the hybrid state-space architecture at 2B scale, and H4 measured directly on neutral prompts rather than via downstream-task proxies) are uncovered. Whether the floor generalizes beyond this combination is open and motivates cross-architecture replication.

### 3. Methods

#### 3.1 Protocol and evaluation harness

The first five checkpoints were trained by the in-house trainer (Unsloth FastModel + TRL SFTTrainer + PEFT, with a fused-CE chunk-allocator patch to fit the 248K-vocab logits in 12 GB VRAM), exported to f16 GGUF, and evaluated under a five-sub-bank Gate-D harness (200-prompt hard bank · 120-prompt orthogonal bank · 50-prompt easy regression control · 20-prompt neutral KL bank · 20-prompt hedging cohort) against a pre-recorded base resnapshot. The sixth checkpoint wraps 96 LoRA layers with the OPLoRA forward at training time and **bakes the projections into the saved weights** before export, then deploys under the *same* harness with no engine modification, a mechanism-controlled targeted attack on H4.

| # | Checkpoint                | Mechanism class                                                  | Rank           |
| - | ------------------------- | ---------------------------------------------------------------- | -------------- |
| 1 | Run-2                     | Vanilla LoRA rank baseline                                       | r=16           |
| 2 | v3                        | Rank capacity + substrate rebalance                              | r=32 + STRAT   |
| 3 | v4                        | Abstain-stream regularization                                    | r=32 + abstain |
| 4 | Soup                      | Weight-space averaging (Wortsman)                                | r=32 avg       |
| 5 | Q8\_0+imatrix             | Quantization + importance-matrix calibration                     | r=32 quant     |
| 6 | **Phase 4b OPLoRA-baked** | **Orthogonal-projection LoRA + baking export (targeted attack)** | r=32, k=16     |

***Table 1.** The six checkpoints, chronological. All six anchored to the immutable pre-registration (canonical hex d06f51a0…, 35,190 prefix-bytes unchanged, verified 12× across the correction record), predictions committed before each phase's telemetry landed, which is what makes the floor claim falsifiable rather than retrospective.*

#### 3.2 The training corpus (realized counts, honestly against a-priori)

Five provenance-tagged streams compose the pool: two seven-day telemetry harvests (13,126 windowed + 1,441 whole-chat), a 134-record golden set, a lesson corpus (realized 58 vs 52 estimated), and operator-correction feedback (realized **444 vs 127 estimated**, a forty-day transcript harvest under the operator's max-richness directive, all mapped to the admit-errors class). Pre-stratification total: **15,203 realized vs 14,880 a-priori**, reported as an honest substrate deviation in the corrigenda spirit, never a silent correction. A first run had dropped four streams to substrate-load faults; the restoration is independently corroborated by the class-count signature (the target class rising 143 → 599, exactly accounting for the merged records). Class balancing caps the dominant class, upsamples the scarcest ×5, and applies inverse-root loss weights.

### 4. Results

#### 4.1 The six-checkpoint architectural-inherent KL-drift floor (headline)

| # | Checkpoint                                  | H4 kl\_mean (nats)              | × over 0.05 threshold |
| - | ------------------------------------------- | ------------------------------- | --------------------- |
| 1 | Run-2 (r=16)                                | **12.117**                      | \~242×                |
| 2 | v3                                          | 11.056                          | \~221×                |
| 3 | v4                                          | 10.992                          | \~220×                |
| 4 | Soup                                        | 10.764                          | \~215×                |
| 5 | Q8\_0+imatrix                               | 11.116                          | \~222×                |
| 6 | **Phase 4b OPLoRA-baked (targeted attack)** | **11.998**                      | **\~240×**            |
| – | Band                                        | \[10.764, 12.117] · width 1.353 | –                     |

***Table 2.** Six mechanism classes, each architecturally distinct; none moves H4 out of the band.*

**The sixth checkpoint is the load-bearing one.** The prior five had H4 preservation as an *incidental* property of their mechanisms; the sixth has it as the *stated mechanism purpose*: OPLoRA is specifically designed to keep updates out of the top-k singular-direction subspace on the theory that movement there causes base-distribution shift. Its landing inside the same band forecloses the alternative explanation the five-checkpoint inventory could not: that the band existed only because nothing had tried to prevent drift. This targeted-attack-forecloses-incidental-band logic is the structural argument for the architectural-inherent claim, and it was the reframe relayed by the external peer instance after the post-hoc verdict landed.

**Production-readiness, reported in the same breath.** The same run that supplied the sixth-checkpoint datum also measured H1 cascade accuracy at +25.0 pp, far below v3's +99 pp under production routing. The OPLoRA-baked adapter is **not** a production candidate; its value is scientific. The two interpretations are independent: the floor is a characterization of the architecture; the deploy disposition is an engineering decision, and v3-class adapters win it regardless of whether the floor generalizes.

**Open confounders, carried not closed.** (D1) The SSM branch was not projected: OPLoRA applies to attention+MLP LoRA-decomposable modules; the Mamba2 branch carries no PEFT LoRA layers under standard integration, so if the drift is SSM-mediated, the attack could not have moved it *by construction*. (D3) The scale gap: OPLoRA was validated at 7B; the projection-budget-to-capacity ratio is twice as aggressive at 2B, which may explain the H1 collapse independently. Both are catalogued verbatim from the pre-registration's confounder sections, and neither sub-hypothesis is claimed foreclosed.

#### 4.2 The engineering contribution: projection-baking export

The AAAI 2026 paper specifies the training-time forward ΔW = P\_L · B · A · P\_R and is structurally silent on inference deployment, confirmed by direct fetch of the paper body and a search for a reference implementation (none located). A trained OPLoRA adapter loaded into any vanilla LoRA engine runs *without* its projections, the deployment-pipeline gap that produced Phase 4's anomalous first verdict (accuracy far below prediction; easy-bank collapse) and was diagnosed as a pipeline gap, not a mechanism failure. The fix is an associativity identity: because the projections act on opposite sides of the product, they can be **pre-multiplied into the saved weights**, B\_eff = B − U\_k(U\_kᵀB), A\_eff = A − (AV\_k)V\_kᵀ, so the vanilla forward reproduces the projected forward exactly, in O(d·k) per layer. Bake-equivalence verified empirically at f32: **max\_abs\_diff = 2.608 × 10⁻⁸**, 3,800× inside tolerance, in a 28/28-passing trainer self-smoke. Independent corroboration: the saved adapter **halves in size** (87.3 MB → 43.7 MB; f16 GGUF likewise), because the bake removes the cached projection buffers the unbaked export had been serializing; the baked adapter is indistinguishable from a vanilla LoRA at the file-format level, which is the entire point. The claim is deliberately bounded: the associativity trick is elementary linear algebra; its application closing this specific published mechanism's deployment gap (making OPLoRA adapters deployable on PEFT, llama.cpp, and vLLM with zero engine modification) is the contribution, and bake-equivalence at lower precisions (f16, q8\_0) is future work.

#### 4.3 Production observability: the four-quadrant protocol and its first numbers

The deployed Watcher's value claim needs an empirical surface joining the Layer-1 hook stream and the Layer-2 decision stream on shared event keys. The **four-quadrant protocol** supplies it: **Q-I both-catch** (defense-in-depth coherence on deterministically-detectable classes); **Q-II Watcher-catches-that-hooks-miss** (the load-bearing value-add quadrant: nine of twelve classes are reachable only by LLM inference); **Q-III hooks-catch-that-Watcher-misses** (the classifier's false-negative escape path); **Q-IV neither-catch** (the cascade-catalogue gap-discovery surface: uncodified failure classes revealed retroactively by operator corrections). A peer-defensible REPLAY methodology (production classification outcomes recorded at generation time and replayed at evaluation) makes the protocol land-ready without paying inference twice; the golden-set baseline it replaces is honest about why replacement is needed (the rule-fallback classifier collapses to default-prediction on 8 of 12 classes, macro-accuracy 26.5%).

**Preliminary Layer-1 baseline (16-day cumulative substrate).** Recomputed hash-first from the raw JSONL at authoring: **73,000 hook firings** across 16 days, 55 sessions, 19 hooks; the top hook (vector-recall capture) alone is 60.1%, the corpus-feeding stream. Of 486 block decisions, **415 attribute to cascade classes** (0.568% of all firings, sparse by design; the mechanical floor is an enforcement surface, not a coverage metric), partitioning across *four* classes: canonical-path deviation 230 (55.4%), reference-vs-compliance 174 (41.9%), deny-glob/admit-errors 7, forced-correction 4. This measurement *corrected* the protocol's own coverage claim: the hook-mechanical floor and the regex pattern-library are two distinct Layer-1 surfaces covering different 4- and 3-class subsets with one overlap class, complementary, not redundant. And the substrate inspection produced a **live Quadrant-IV finding**: 71 block events from a hook the protocol's detector mapping had not yet codified, which the running Watcher was concurrently classifying into the hook-lockdown class, the cascade-as-watcher-firmware mechanism doing its gap-discovery job on the very protocol that defines it.

### 5. Discussion

#### 5.1 Production disposition

Which checkpoint ships is decided by H1 and H2 under the production routing, not by the floor. The deployed artifact is the Q8\_0+imatrix-of-v4 checkpoint, the only quantized candidate that preserved the abstain stream under quantization, on a dedicated endpoint. The sixth checkpoint’s exclusion from production is set out with its result in §4.1; what matters here is the consequence for the reader, that the floor holds across all six checkpoints and therefore says nothing about which one to deploy.

#### 5.2 The Gen-2 redesign: reframed, not invalidated

After the measurement window, the Layer-2 interface was found to carry two production-ergonomics defects, operator-surfaced: **alarm fatigue** (a low-precision, near-always-on class-ID channel teaches the consuming model to treat it as noise, the very failure it exists to prevent) and **wrong interface** (a class-ID is meaningful only while the consumer holds catalogue context; a persistent class-ID was observed being read as a "compact now" signal, the opposite of intent). The ratified redesign, codified as architectural law: **surface the correction, not the class**, and **divide labor by determinism**: deterministic procedure-deviation belongs to the Layer-1 hooks (the rule-fallback subset is emptied; hooks become the sole deterministic surface for those classes), and the Watcher's value narrows to the nine judgment-only classes plus a live-transcript preemptive layer. Under Gen-2, Q-I and Q-III collapse toward Layer-1-only for the deterministic classes while the load-bearing Q-II is unchanged, and the §4.1 floor, which characterizes the adapter rather than the routing, survives intact.

#### 5.3 Falsification, future work, and the scope discipline

The cleanest falsifier is cross-architecture replication: the same six-mechanism sweep on a larger Mamba2-HYBRID base would discriminate architecture-inherent from 2B-scale-OOD; no such base exists in the current substrate. Future work: a direct SSM-branch-targeted intervention (confounder D1); the Gen-2 intervention-labeled corpus and shadow-deploy measuring the 30%-correction-reduction predicate; unconstrained-sampling H4 variants. The arc itself was held to a DEPLOY-only scope by an operator-named lesson (*synthesis-failure-with-information-already-in-context*): the deployment stayed a deployment of an existing measured checkpoint rather than a confounding re-train, which is what kept the six-checkpoint characterization valid.

#### 5.4 First production validation: a live Quadrant-II catch with operator adjudication

Within a single long consuming-model session, the deployed Gen-2 Watcher repeatedly caught the consuming frontier instance running memory-protocol operations via direct shell rather than the canonical skill route, emitted natural-language corrections in the operator's register, surfaced them through the escalation → injection → HUD path, and the consuming model self-corrected. The catch is genuinely Quadrant-II: the Layer-1 skill gate was not silent but *selective*: its 120-second self-exclusion window (a documented, bounded structural gap) admitted exactly the lapses the Watcher caught. The observational layer backstopped a bounded gap in the deterministic layer: defense-in-depth realized live. The **human-grader receipt** is the methodology finding: the operator adjudicated in the HUD, confirming two true positives and denying two false positives (an actor-attribution error and a provenance-blindness error, both motivating an event-provenance tag as future work). Consequentially, the supervised model had *twice* rationalized corrections about its own conduct as noise; the loop resolved correctly only because adjudication is operator-controlled: *a model supervising-then-grading itself systematically denies the true positives that land on its own behavior.* Reported as N = 1 illustrative, explicitly not a catch-rate metric; the full byte-evidence map (telemetry, transcript, correction log, graded corpus, each with verify commands) is archived in the evidence bundle.

### 6. Limitations

The two structural confounders that bound the central claim, the unprojected SSM branch and the 2B-versus-7B scale gap, are stated with the result in §4.1 rather than deferred here, because a limitation that qualifies a headline belongs beside it. Four further limits are specific to this chapter and are recorded only here. The finding rests on a single base model, so generalization requires replication on another Mamba2-HYBRID base, and none exists in the current substrate. The wrapped-module count diverges from the reference paper's configuration, seven against five reported, documented and not closed. H4 was measured under grammar-constrained completion, which may under-characterize drift; unconstrained variants remain future work. And the realized training corpus exceeded its a-priori estimate, 15,203 against 14,880, with per-stream provenance verified after the fact rather than from a manifest field, which is a reproducibility gap for future runs. Beyond these, the caveat that runs through the series applies: all artifacts derive from one operator's workstation, and the four-instance authorship and relayed peer review mitigate single-instance bias but are not blinded external review.

### System Update: July 2026 (appended; the sealed body above is unmodified)

The Gen-2 production posture this paper closes on (§5.2: surface the correction, not the class; divide labor by determinism) still stands at-read. What has moved is the corpus program: a dedicated **Gen-3 corpus-engineering arc is now registered** (authored 2026-06-17) whose thesis extends this paper's intervention-corpus future work directly: rebuild the Watcher training corpus from operator interventions recovered as **counterfactual triples with the pre-friction window** (trajectory state before intervention → typed intervention → averted outcome), so the governor learns the pre-friction signature rather than whole-transcript noise. The registered design carries: a **correction-gradient taxonomy** (full-stop-reassess / light-course-correct / inject-context-then-proceed) with a distribution gate verifying the corpus never collapses every signal to full stop, the mechanical answer to the alarm-fatigue defect Gen-2 named; a **model-stratified golden set** (invariant core plus per-model strata, novelty-metric additive growth); and a pre-registered **context-saturation experiment**, same-instance-saturated versus fresh-LoRA-review catch-rate on identical trajectories, making saturation the error variable this paper's §4.3 protocol could not yet isolate.

Register discipline, stated plainly: these phases are **registered, not run**; no Gen-3 numbers exist at-read, and none are claimed here. A companion observability arc likewise registers the Layer-2 catch-rate measurement and a telemetry charting tool over the hook-fire substrate, the production instrumentation of this paper's four-quadrant protocol. Results, when the experiments fire, land in a successor paper (logged in the series' candidate register). Both arcs were registered in the internal roadmap and stood unstarted at 2026-07-20. Append-only; the sealed record above is unmodified.

***

*The Sovereign Stack · Watcher KL-Drift Floor · Chapter 19 · Part IV · v1.0.0 · License CC BY 4.0 · © Jamey Kistner, OSINTelligence LLC*

**Citation (preferred):** Kistner, J. (2026). *An Architectural-Inherent KL-Drift Floor in Narrow-Classification Fine-Tuning of a 2B Mamba2-HYBRID Model: Six-Checkpoint Targeted-Attack Characterization*, version 1.0.0. OSINTelligence LLC.

*The reference list and provenance follow as a sub-page of this chapter.*