# EXP-38: repeat-need detection against the probe-fooling sandbagger

- Date: 2026-10-10 | Cadence version: 0.80.0 (`19bee92`) | Program iter: iter29
- Script: `exp/EXP-38_repeat_need.py` | Evidence: `exp/EXP-38-full.out`, `exp/EXP-38-full.json/.jsonl`, pilot `exp/EXP-38-pilot.jsonl`

## Summary
- Question: the protocol already sees which items a student passed in a post-lesson test. If need claims on already-passed items are ignored (and habitual re-claimers down-weighted), does the probe-fooling sandbagger from EXP-36 stop soaking lessons?
- Setup: EXP-36 world (8 brains, K=32, 16 rounds; 5 honest, a fake-need brain, a colluding teacher, a sandbagger that flips its probe answers), pay = protocol-probed gain with a once-per-(student, item) ledger. 12 seeds. Arms: RECIP (EXP-36 baseline), REPEAT (passed items do not count as need), REPEAT+RATE (also scale need by 1 - repeat rate), ADAPT (REPEAT+RATE against a sandbagger that knows the detector and answers honestly on passed items).
- Prediction (written after the 2-seed pilot, before the full run; the pilot exposed a metric gap, see Reflection): "total fake pay (fake_all) roughly unchanged across RECIP / REPEAT / REPEAT+RATE (bounded by the ledger, it only moves to the colluder); repeat detection buys THROUGHPUT (absorbed <= .40, honest final >= .94 vs RECIP ~.91, > 2 SEM), not less minting. ADAPT: repeat rate ~0 (detector blind), yet absorbed stays low because passed items are excluded from need regardless of the probe."
- Result (mean +- SEM, 12 seeds), RECIP / REPEAT / REPEAT+RATE / ADAPT: honest final knowledge .927+-.006 / .946+-.004 / .943+-.006 / .952+-.007; lessons absorbed by attackers .69+-.01 / .30+-.02 / .30+-.02 / .30+-.02; fake pay minted on lessons to attackers by ANY teacher .708+-.056 / .734+-.027 / .776+-.025 / .451+-.043; fake pay to the colluder alone .216 / .359 / .615 / .143; repeat-claim rate sandbagger 1.00 / 1.00 / 1.00 / 0.00 vs honest .020 / .018 / .021 / .017.
- Verdict: SUPPORTIVE. Prediction held on all five points (honest gain +.019, ~2.6 SEM; RECIP baseline was .927, not ~.91). Excluding passed items from need is the working part; the repeat-rate penalty adds nothing; the adaptive attacker blinds the detector but is still contained.

## Reflection
- What it means: the protocol should never route a second lesson to an item a student already passed in a test it could not fake. That one rule cut attacker soak from 69% to 30% of lessons (the colluder's own lessons set a floor of about 1 in 8) and recovered most of the honest throughput lost to the sandbagger (no-attacker level ~.95). It does not reduce minting: the ledger already caps fake pay, and the defence only changes who collects it. Against an attacker who knows the detector, the detector reads 0, yet the attacker is no better off, and total fake pay is lower (.45), because answering honestly on passed items is the attack giving up. "Detect the cheat" was the wrong frame; "never pay twice for the same passed item" is the mechanism.
- Process: the pilot (2 seeds) did its job. Colluder fake pay ROSE under the defence, which exposed that EXP-36's fake-pay metric counted only the colluder: fake pay minted to honest teachers fooled into teaching the sandbagger was never measured. Added fake_all and revised the prediction BEFORE the full run (stated in the docstring). EXP-36's RECIP fake-pay number (.177) therefore understates total minting (.708 here, all teachers). Adversaries are scripted, not learning; honest forgetting is low here (rehearse on), so false positives (honest repeat rate ~.02) may be higher in worlds that forget more.
- Lesson: when a defence makes a number worse, check whether the metric only watched one actor. And measure the mechanism (exclusion), not the alarm (the detector): the alarm can be blinded while the mechanism still holds.
- Next: pay on persisting gain (closes the gross-vs-net gap); a learning adversary instead of a scripted one; the same exclusion rule in a high-forgetting world to price honest false positives.