Nucleation Pilot & Related Projects: A Frozen White-Box Detector for Persistent Manipulation, Its Cross-Family Transfer, and Preregistered Methods

A frozen, SHA-256-hashed linear detector (nucleation-detector-1.1.0, 6094de97…a2934) reads whether an early manipulation is still "live" in a language model's residual stream. Validated once against an owned toy model with a genuinely-learned refusal boundary (held-out AUC 0.807), the detector — never tuned, byte-identical across every run — transfers, causally and source-decoupled, to six independently-built open-weight families (Qwen2.5-1.5B/7B, Phi-3.5-mini, SmolLM2-1.7B, Llama-3.2-3B, OLMo-2-7B; graded effect size 3.69–8.03, all 95% CIs clear of zero; a read-mask ablation confirms the signal rides downstream positions, not direct attention). It carries to a naturalistic in-context frame (Config-E: a readable, null-clean, persistent residual trace in 24/24 family×variant cells, predominantly source-decoupled in 19/24), and an honest owned-model refusal-erosion attempt returns a firm null (Config-D), including a single-model positive that was retracted by its own preregistered replication checks. This deposit is the consolidated research record: a synthesizing report (with charts), the canonical status document, the frozen detector and analysis harness, the Config-E driver, the commit-before-run preregistration chain plus two new preregistration stubs, a landscape briefing, a two-instrument (white-box ↔ black-box) bridge, and the full safety-and-disclosure suite (a safety-reporting protocol, safety reports, dissemination routes, cover emails, and a responsible-researcher charter / authorization request). Integrity posture: frozen instrument (hash above, never tuned); commit-before-run preregistration; published nulls; self-corrections on record; and a flagged-but-deliberately-not-built dual-use section (no exploit, no steering vector, no elicitation ladder). Benign open-weight lane throughout; any real refusal-elicitation runs only on owned models in a private venue and is not part of this deposit. Scope and exclusions: interim data from the sibling black-box study "The Silly Donkey" (DOI 10.5281/zenodo.21432676) is embargoed under its own preregistered stopping rule and is excluded here; only the design-level bridge (no interim results) is included. No exploit, jailbreak, or elicitation content is present, by standing scope. Documents are licensed CC BY 4.0; source code is licensed Apache-2.0.