The Blind Curator: How a Biased Judge Silently Disables Skill Retirement in Self-Evolving Agents

# How a Biased Judge Silently Disables Skill Retirement in Self-Evolving Agents
Source: [https://arxiv.org/html/2607.07436](https://arxiv.org/html/2607.07436)
Xing Zhang1, Yanwei Cui1, Guanghui Wang1, Ziyuan Li2, Wei Qiu2, Bing Zhu2, Peiyang He1 1AWS Generative AI Innovation Center 2HSBC Holdings Plc\., HSBC Technology Center, China

###### Abstract

A self\-evolving agent retires its bad skills by watching them fail, so what happens when the judge cannot see the failures? Skill retirement is the structural constraint that keeps a growing library from drifting below the no\-skill baseline, but its guarantee assumes an unbiased reward, which is false for the LLM judges that reference\-free tasks force upon us\. We show that a biased judge does not merely add noise; it*silently switches off the curator*\. We make this precise with a corrupted\-reward analysis and, isolating the causal channel by injecting corruption on top of a deterministic reward, a behavioral study on a reference\-free report\-writing testbed with a code\-generation cross\-check\. Symmetric noise leaves retirement intact, but*false\-pass*bias \(failures slipping through as passes\) disables contribution\-based retirement past a sharp threshold that no amount of data can cross\. Separating genuine retirement from cap\-eviction churn shows this*mechanism*failure is universal, holding across domains and failure rates and sparing only near\-zero\-false\-pass, verifier\-like graders\. The downstream*outcome*, though, is regime\-dependent: eval quality degrades only where the same corruption also starves skill synthesis, and otherwise holds steady, so the disabled curator is*silent*, surfacing in no aggregate metric\. The contribution is a behavioral safety result, not a performance one\. A cheap defect\-injection audit then tells an operator, before deployment, which side of the threshold their judge occupies\.

## 1Introduction

A self\-evolving agent that accumulates skills without governance degrades, as stale and redundant entries crowd retrieval, a failure mode recently named*library drift*\(Zhang et al\.,[2026a](https://arxiv.org/html/2607.07436#bib.bib27)\)\. Agents already learn by synthesizing new skills from their own failures\(Wang et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib19); Zhao et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib29)\); the missing piece is*governance*,*retiring*skills that stop helping under a bounded cap\. Ratchet\(Zhang et al\.,[2026b](https://arxiv.org/html/2607.07436#bib.bib28)\)makes this precise: retirement keeps a growing library from drifting more than a fixed margin below the no\-skill baseline\. But that guarantee rests on one quiet assumption, that the signal telling the agent which skills failed is*honest*\(the per\-skill contribution estimator is unbiased\)\. Coding and QA satisfy it with unit tests and exact\-match graders; the tasks agents increasingly face \(research synthesis, long\-form reporting, analysis\) do not: with no golden answer the only scalable grader is an LLM judge\(Zheng et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib30)\), and its error is not white noise\. Judges are systematically biased rather than merely inconsistent\(Wang et al\.,[2024a](https://arxiv.org/html/2607.07436#bib.bib20); Stureborg et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib18)\), tending to wave through certain failure classes \(a confident misquote; a flipped conclusion that stays fluent\), so their error is*asymmetric*: failures get reported as passes\. The consequence is a*blind curator*\(Fig\.[1](https://arxiv.org/html/2607.07436#S1.F1)\): the component that should retire bad skills stops seeing the evidence it retires on\. Where library drift was the disease governance was built to cure, curator blindness is what befalls the cure itself when the reward is fallible\.

![Refer to caption](https://arxiv.org/html/2607.07436v1/x1.png)Figure 1:The*blind curator*failure mode\. The same failure\-driven loop \(solve, judge, retire\) under an honest reward \(left\) and a*false\-pass*judge \(right\): false passes break the Judge→\\toCurator evidence, so retirement quietly stops while aggregate outcomes can look normal\. The gap opens at a sharp threshold\.We treat that asymmetry as the object of study\. Our thesis turns on*two separable knobs*of the reward channel: a symmetric noise rateρ\\rho\(true label flipped either way\), and a false\-pass rateρF→P\\rho\_\{F\\to P\}, the fraction of true failures reported as passes \(we writeqqfor this same rate when sweeping it in the experiments\)\. The agent responds to them in opposite ways\. It tolerates noise gracefully, but hits a*cliff*inρF→P\\rho\_\{F\\to P\}: beyondρF→P=\(1−τ\)/2\\rho\_\{F\\to P\}=\(1\-\\tau\)/2, under this channel, no amount of data can rescue retirement \(Sec\.[4](https://arxiv.org/html/2607.07436#S4)\)\. Our contributions are:

- •A universal mechanism failure with regime\-dependent fallout\.Across four subsets and two domains \(Secs\.[6](https://arxiv.org/html/2607.07436#S6)–[8](https://arxiv.org/html/2607.07436#S8)\), and by separating genuine contribution\-retirement from cap\-eviction churn, we show false\-pass bias disables the*curator*past the cliff in every regime \(verifier\-like near\-zero graders are spared; below the cliff survival depends on skill margins\), while the downstream*outcome*harm is regime\-dependent: it appears only when the same corruption also starves synthesis, and is otherwise silent\. Symmetric noise is survivable; a strict judge is safe but starvation\-prone\.
- •A before\-deployment go/no\-go test \(Fig\.[5](https://arxiv.org/html/2607.07436#S8.F5)\)\.A constructed\-ground\-truth testbed and a defect\-injection*audit*that pinpoints any judge’s error rates, so an operator can locate their judge relative to the threshold before trusting self\-evolution \(Sec\.[5](https://arxiv.org/html/2607.07436#S5)\)\.
- •Why the asymmetry exists\.A bias\-aware non\-divergence bound \(Prop\. 1′\): noise only attenuates the retirement signal, while false\-pass bias displaces it past an unrecoverable threshold\.

This is a behavior\-centric study: we ask not whether task success rises but*how*the skill library evolves, and when retirement under a cap reliably steers it versus silently failing\. The audit is a behavioral test suite for the reward; the blind curator is a mechanistic account of a process\-level failure aggregate metrics never surface\.

## 2Related work

Skill libraries and verbal self\-improvement\.A line of work lets a frozen LLM agent improve by accumulating*textual*artifacts from its own experience rather than updating weights: reusable skills\(Wang et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib19)\), distilled experience\(Zhao et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib29)\), instruction manuals\(Chen et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib3)\), episodic reflections\(Shinn et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib17)\), workflow memory\(Wang et al\.,[2024b](https://arxiv.org/html/2607.07436#bib.bib21)\), and natural\-language feedback as a gradient surrogate\(Yuksekgonul et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib26); Madaan et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib12)\)\. A second wave strengthens skill creation itself, via inductive distillation from traces\(Ni et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib13)\), autonomous create\-and\-evolve loops\(Huang et al\.,[2025](https://arxiv.org/html/2607.07436#bib.bib5); Yang et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib24)\), and RL\-coupled skill growth\(Xia et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib23)\), with benchmarks probing transfer\(Li et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib9)\)and a lifecycle view\(Wu et al\.,[2025](https://arxiv.org/html/2607.07436#bib.bib22)\)also underlying OS\-like agent memory\(Packer et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib14)\)\. A recurring weakness is that the library only grows \(*library drift*\(Zhang et al\.,[2026a](https://arxiv.org/html/2607.07436#bib.bib27)\)\), and almost all of this work assumes the outcome signal driving accumulation is*correct*; we ask what happens when it is not\.

Skill lifecycle governance\.Closest to us is a line that treats the skill set as something to be*governed*, not just grown: lifecycle governance from collection to evolution\(Liu et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib10)\), dynamic lifecycle management under agentic RL\(Shen et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib16)\), and trajectory\-driven self\-adaptation\(Yu et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib25); Cui et al\.,[2026](https://arxiv.org/html/2607.07436#bib.bib4)\)\. All share the premise that bad skills must be pruned, but all presume the pruning signal is trustworthy\. Our contribution is prior to the governance policy: we characterize when the*signal*any such policy consumes is reliable enough for pruning to help rather than hurt\.

The Ratchet mechanism we build on\.We start from Ratchet\(Zhang et al\.,[2026a](https://arxiv.org/html/2607.07436#bib.bib27);[b](https://arxiv.org/html/2607.07436#bib.bib28)\), a minimal recipe on a frozen LLM: a Critic labels each failed task, a Synthesizer turns recurring failure patterns into skills, a Router retrieves at most one skill per task, and, crucially, a Curator*retires*any skill whose empirical contribution falls below a threshold after enough trials, under a hard cap on active skills\. Retirement\-plus\-cap yields a*non\-divergence*guarantee: on a fixed task distribution, expected performance cannot fall more than a fixed margin below the no\-skill baseline\. We adopt Ratchet because it is, to our knowledge, the only self\-evolving\-skill scheme with such a guarantee\. That makes it the natural object on which to ask when the guarantee survives an imperfect reward, since its proof is the thing an unreliable judge can break\. It was evaluated only with clean verifiers \(unit tests on MBPP\+\(Austin et al\.,[2021](https://arxiv.org/html/2607.07436#bib.bib1); Liu et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib11)\), the SWE\-bench Docker harness\(Jimenez et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib6)\)\); we move it to the verifier\-free regime its guarantee was never tested in\.

LLM\-as\-judge reliability and noisy supervision\.The reward in our regime is an LLM judge\(Zheng et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib30)\), the standard way to turn AI feedback into a learning signal\(Bai et al\.,[2022](https://arxiv.org/html/2607.07436#bib.bib2)\)\. A large body of work shows such judges are systematically biased rather than merely noisy: position, verbosity, and self\-enhancement effects\(Zheng et al\.,[2023](https://arxiv.org/html/2607.07436#bib.bib30)\), order\-dependence that can flip a verdict\(Wang et al\.,[2024a](https://arxiv.org/html/2607.07436#bib.bib20)\), run\-to\-run inconsistency\(Stureborg et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib18)\), and the broader caveats catalogued in recent surveys\(Li et al\.,[2024](https://arxiv.org/html/2607.07436#bib.bib8)\)\. Where a cheap executable verifier can be learned\(Pezeshkpour & Hruschka,[2026](https://arxiv.org/html/2607.07436#bib.bib15)\)our concern does not arise; our focus is precisely the regime where none exists\. We add not another reliability study but the*propagation*of a judge’s error*asymmetry*through a specific learning mechanism\. The closest classical framing is class\-conditional label noise, but here the “labels” gate a*lifecycle decision*\(retirement\) inside a closed loop, so asymmetric noise compounds: unretired bad skills keep being routed to, generating more corrupted evidence\. The analogue of catastrophic forgetting\(Kirkpatrick et al\.,[2017](https://arxiv.org/html/2607.07436#bib.bib7)\)is not weight overwriting but the silent retention of harmful skills a blind curator can no longer prune\.

## 3Setup: failure\-driven evolution on report composition

Why this testbed\.The phenomenon only exists where the reward is a fallible judge, i\.e\. on tasks with no golden answer, which rules out the verifier\-backed benchmarks \(MBPP, SWE\-bench\) Ratchet was built on\. We need a task that is \(i\) genuinely reference\-free, \(ii\) yet has an*objective*sub\-signal we can treat as ground truth and corrupt, and \(iii\) shows the visible/invisible failure split that makes a judge both necessary and fallible\. Long\-form, citation\-grounded report writing fits: there is no gold report, but citation discipline is checkable while source faithfulness is not\. We draw tasks from a production deep\-research engine; Sec\.[8](https://arxiv.org/html/2607.07436#S8)tests how far they carry to a verifier\-backed domain\.

Task and reward\.A trial composes one report section from a frozen*evidence slice*\(its cards, metric values, and allowed cross\-references; Appendix[A](https://arxiv.org/html/2607.07436#A1)\), citing only slice cards, annotating every numeral, and meeting a structural contract\. The 155 slices come from five complete deep\-research productions; freezing them makes trials cheap \(one LLM call\) and i\.i\.d\.\-replayable, which the retirement statistic needs\. The reward is a deterministic grader of five*quality\-control \(QC\)*checks \(orphan citation, unregistered metric, bare number, broken cross\-reference, missing TL;DR\); PASS==zero violations\. Because it is reference\-free yet objective, we treat it as ground truthyyand impose corrupted channelsy~\\tilde\{y\}on top; a defect is “QC\-visible” or “QC\-invisible” by whether these checks catch it\.

Evolution loop\.We run the governance stack unmodified \(the solve–judge–retire loop sketched in Fig\.[1](https://arxiv.org/html/2607.07436#S1.F1)\)\. Skills here are composition disciplines \(citation\-coverage habits, hedging templates\) injected as prompt guidance\.

Failures are the single input the whole loop runs on\.This is the structural reason false\-pass bias is so damaging, and it holds for any failure\-driven scheme, not just this one\. Observed failures are the*only*signal feeding both halves of the loop: the Synthesizer clusters them into new skills, and the Curator retires a skill from its observed fail/pass tally\. A false\-pass judge \(y~\\tilde\{y\}reports a true failure as a pass\) therefore does damage at the source: it \(i\) shrinks the observed\-failure pool, which \(ii\) starves*synthesis*\(fewer failures to cluster\) and \(iii\) inflates every skill’s observed pass rate, so the*Curator*sees nothing crossing−τ\-\\tau\. The opposite corruption \(true pass reported as a fail\) only injects*phantom*failures, extra fuel the loop tolerates as noise\. The asymmetry we study is thus built into the loop’s reliance on failures, which is exactly the signal a production deployment logs and acts on\.

Hard subset\.Because a competent composer passes most sections at temperature0\.70\.7, we probe all 155 tasks×3\\times 3and keep the 71 with at least one failure \(split 43 train / 28 eval, stratified by report\); details in Appendix[B](https://arxiv.org/html/2607.07436#A2)\.

## 4Why bias is different from noise: theory in brief

Ratchet’s non\-divergence guarantee assumes the per\-skill contribution estimator is unbiased: innocuous with a deterministic grader, false with an LLM judge whose errors are*structured*\. Model the judge as a binary channel on the true outcomey∈\{0,1\}y\\in\\\{0,1\\\}\(1=1\{=\}pass\):Pr⁡\[y~=1∣y=0\]=ρF→P\\Pr\[\\tilde\{y\}\{=\}1\\mid y\{=\}0\]=\\rho\_\{F\\to P\}\(a hidden failure\) andPr⁡\[y~=0∣y=1\]=ρP→F\\Pr\[\\tilde\{y\}\{=\}0\\mid y\{=\}1\]=\\rho\_\{P\\to F\}\(a phantom failure\)\. The Curator retires a skill once its observed pass rate drops toπτ:=\(1−τ\)/2\\pi\_\{\\tau\}:=\(1\-\\tau\)/2\. Writingp¯​\(s\)\\bar\{p\}\(s\)for skillss’s*true*pass rate on the tasks routed to it, under the channel its observed pass rate concentrates onκ​p¯​\(s\)\+ρF→P\\kappa\\,\\bar\{p\}\(s\)\+\\rho\_\{F\\to P\}, withκ:=1−ρF→P−ρP→F\\kappa:=1\-\\rho\_\{F\\to P\}\-\\rho\_\{P\\to F\}, and the two corruption types act on it in opposite ways:

- •Symmetric noise attenuates\.WithρF→P=ρP→F=ρ\\rho\_\{F\\to P\}\{=\}\\rho\_\{P\\to F\}\{=\}\\rho, the statistic is merely*compressed*toward12\\tfrac\{1\}\{2\}\(κ=1−2​ρ\\kappa\{=\}1\{\-\}2\\rho\): its sign is preserved, harmful skills still cross the threshold, and the only cost is an inflated effective thresholdτ/\(1−2​ρ\)\\tau/\(1\{\-\}2\\rho\)and aNmin∝\(1−2​ρ\)−2N\_\{\\min\}\{\\propto\}\(1\{\-\}2\\rho\)^\{\-2\}sample budget\. Degradation is graceful for everyρ<12\\rho<\\tfrac\{1\}\{2\}\.
- •False\-pass bias displaces\.WithρF→P\>0\\rho\_\{F\\to P\}\>0\(denotedqqin the experiments\) the statistic shifts*up*, most for the worst skills, so retirement fires only ifp¯​\(s\)≤\(πτ−ρF→P\)/\(1−ρF→P\)\\bar\{p\}\(s\)\\leq\(\\pi\_\{\\tau\}\-\\rho\_\{F\\to P\}\)/\(1\-\\rho\_\{F\\to P\}\)\. This right\-hand side hits zero atρF→P=πτ=\(1−τ\)/2\\rho\_\{F\\to P\}=\\pi\_\{\\tau\}=\(1\-\\tau\)/2: beyond it, under this modeled channel,*no skill is retired at any sample size*\. A cliff, not a slope\.

This yields a bias\-aware floor \(Prop\. 1′, Appendix[C](https://arxiv.org/html/2607.07436#A3)\) and three design rules:*\(i\)*noise is survivable but bias is not past the cliff;*\(ii\)*the lever against bias is the thresholdτ\\tau, not more data;*\(iii\)*ρF→P\\rho\_\{F\\to P\}is measurable offline, so an operator can read off which side of the cliff they are on, which motivates the audit next\. The full channel algebra, proof, and an adversarial\-coupling remark are deferred to Appendix[C](https://arxiv.org/html/2607.07436#A3)\.

## 5Gate: what can each signal see?

Before trusting any reward channel we audit it against constructed ground truth: inject one known defect into a clean section, ask each grader whether it noticed\.

Defect classes\.Five*QC\-visible*classes mirror the deterministic checks \(inject an orphan citation; an unregistered metric tag; a broken cross\-reference; a bare number; delete the TL;DR\)\. Two*QC\-invisible*classes corrupt semantics while preserving all annotation syntax:*claim negation*\(flip the direction of a cited claim, “growth”→\\to“decline”\) and*number swap*\(perturb a digit while keeping the citation marker on the line, so the sentence now misquotes its own source\)\.

Results\(155 sections, one injection per class per section\)\. The deterministic grader catches every QC\-visible injection \(recall1\.01\.0,n=155n\{=\}155per class\) and essentially none of the QC\-invisible ones \(claim negation0\.00\.0; number swap0\.050\.05\)\. A held\-out judge \(a different model family, blind to condition, paired\) flags both QC\-invisible defects at high rates \(number swap98\.5%98\.5\\%; claim negation92\.7%92\.7\\%; Fig\.[2](https://arxiv.org/html/2607.07436#S5.F2)\), with significant grounding\-score drops \(number swap−1\.15\-1\.15,p<10−4p<10^\{\-4\}; claim negation−0\.35\-0\.35,p=0\.001p\{=\}0\.001\): precisely the defects the checks miss\. Conversely, on*structural*defects the judge’s quality score barely moves \(broken xref, TL;DR:p≈0\.5p\\approx 0\.5\), which the checks catch with certainty\. The two signals are complementary: the checks do not see meaning, the judge does not reliably penalise contract violations \(Fig\.[7](https://arxiv.org/html/2607.07436#A4.F7)shows one case verbatim\)\. Their union is the audit\.

Auditing the reward judge\.The same machinery measures the error rates of the binary PASS/FAIL judge we later use as a*training reward*\(Sec\.[6](https://arxiv.org/html/2607.07436#S6)\), placing it on the theory’s axes: a strict, well\-instructed judge has a tiny false\-pass rate \(ρF→P≈0\.01\\rho\_\{F\\to P\}\\approx 0\.01\) but a large false\-fail rate \(ρP→F≈0\.95\\rho\_\{P\\to F\}\\approx 0\.95\)\. It thus sits not in the dangerous false\-pass corner but in the*conservative*one, where Prop\. 1′predicts safety bought at the price of*starvation*\(κ≈0\.04\\kappa\\approx 0\.04: almost no resolution to tell good skills from bad\)\. The realistic failure mode of a strict judge is signal collapse, not reward hacking; the false\-pass cliff is reached by*lenient*judges \(or judges facing defects they cannot see\)\. This separates the two roles corruption plays in our study\. We*inject*false\-pass bias on top of the deterministic reward to isolate its causal channel cleanly, rather than claiming our particular judge is lenient: this one is not\. The point is that a judge’s operating point is a measurable property, not a given, and lenient regions are easy to enter \(a softer rubric, a capable composer whose errors look fluent, or any defect the judge cannot see\)\. The audit is precisely how an operator discovers whether their deployed judge occupies the dangerous region\. Audit details and a direction\-check ruling out reward/quality conflict are in Appendix[E](https://arxiv.org/html/2607.07436#A5)\. This audit is the practical payoff: it turns the theory into a before\-deployment go/no\-go test, which we assemble into a deployment playbook once the empirical picture is complete \(Fig\.[5](https://arxiv.org/html/2607.07436#S8.F5), end of Sec\.[8](https://arxiv.org/html/2607.07436#S8)\)\.

![Refer to caption](https://arxiv.org/html/2607.07436v1/x2.png)Figure 2:Flag rate on injected defects \(green = deterministic QC; purple = held\-out LLM judge\)\. Bars are*flag rates*\(did the grader raise any concern\), not the scalar training score\. QC catches the five*QC\-visible*classes \(recall1\.01\.0\) but is blind to the two semantic ones, which the judge flags\. On structural defects the judge often flags yet its scalar*quality score*barely moves \(p≈0\.5p\\approx 0\.5\), so it does not reliably penalise them\. The semantic region, gradable only by a fallible judge, is the regime we study\.
## 6The reward\-reliability frontier

We run the loop for 12 rounds \(τ=0\.10\\tau\{=\}0\.10,Nmin=24N\_\{\\min\}\{=\}24,C=12C\{=\}12\) under each reward channel: clean QC, symmetric noise, false\-pass biasqq\(bracketing the predicted cliff at0\.450\.45\), the audited LLM judge, and a no\-skill floor\. Corruption hits*training*rewards only; evaluation always uses the true grader \(Table[1](https://arxiv.org/html/2607.07436#S6.T1)\)\. We read the result at three levels: the*mechanism*\(does the curator still retire?\), the*outcome*\(does eval quality move?\), and the real LLM*judge*’s place on this map\.

Table 1:Reward\-degradation sweep onReport\-main\-71\(mean±\\pmsd, 3 seeds; rows shaded blue = noise, red = bias, purple = judge\)\. Columns:*Tail eval*= true\-QC eval pass@1 over the last 4 rounds;*Δ\\Deltaclean*= vs the clean\-reward loop;*Synth*= skills created;*Dep\.*= total deprecations,≈\\approx*True\-ret\.*\(genuine contribution\-retirement\)\+\+*Evict*\(cap\-evictions of healthy skills\);*Div\.*= realised corruption \(fraction of training labels actually flipped, in\[0,1\]\[0,1\]\)\. The bold*True\-ret\.*column is the mechanism signature: bias drives it to zero while noise and the real judge keep it alive, even though the raw*Dep\.*count stays flat as eviction churn fills in\.![Refer to caption](https://arxiv.org/html/2607.07436v1/x3.png)Figure 3:Report\-main\-71\(Claude Haiku 4\.5, 3 seeds\), as a fraction of the clean\-reward level\.\(a\) Mechanism\.Observed failures are the loop’s single input; rising false\-pass biasqqshrinks that pool and starves*both*downstream stages, synthesis and genuine retirement \(which hits zero past the cliff\)\.\(b\) Outcome\.Eval damage vs the clean\-reward loop, against realised corruption \(the fraction of training labels actually flipped\): false\-pass bias is an inverted\-U worst near the cliffq=\(1−τ\)/2=0\.45q\{=\}\(1\-\\tau\)/2\{=\}0\.45, while symmetric noise stays at or above the clean loop\.Mechanism level: the theory’s signature, measured honestly\.The mechanism column is*True\-ret\.*, genuine contribution\-based retirement; we report it separately from cap\-eviction \(*Evict*\) because the raw deprecation count \(*Dep\.*\) mixes the two and only the former reflects the curator’s judgment \(Sec\.[8](https://arxiv.org/html/2607.07436#S8)\)\. Reading*Dep\.*alone is misleading: it stays near1010under both noise and the judge and dips only modestly under bias, hiding the mechanism entirely\. OnReport\-main\-71the composer rarely produces a skill bad enough to retire, so the clean baseline is already low \(1\.31\.3\), but the asymmetry is exact \(Fig\.[3](https://arxiv.org/html/2607.07436#S6.F3)a\): false\-pass bias drives true retirement to*zero*at every rate \(0/0\.3/00/0\.3/0forq=0\.2/0\.45/0\.7q\{=\}0\.2/0\.45/0\.7\), while symmetric noise holds it at the clean level \(0\.70\.7–1\.01\.0\)\. The same corrupted signal also starves failure\-driven synthesis as bias grows \(*Synth*column,22→1522\\\!\\to\\\!15\)\. The sharpest read is the*judge*row: the realistic conservative judge keeps true retirement fully alive \(10\.310\.3, far above clean\) precisely because its false\-pass rate is near zero, exactly the contrast Prop\. 1′predicts\. \(Where the composer leaves more headroom the same asymmetry shows with a larger baseline; Sec\.[7](https://arxiv.org/html/2607.07436#S7)\.\)

Outcome level: harm is worst at*moderate*bias\.Eval outcomes \(vs the clean\-reward loop\) show the same asymmetry with one wrinkle the simple cliff story misses \(Fig\.[3](https://arxiv.org/html/2607.07436#S6.F3)b\)\. Noise never hurts: it sits at or above the clean loop throughout \(\+0\.018\+0\.018to\+0\.060\+0\.060asρ\\rhogrows; heavier noise churns the library more but the curator keeps it healthy\)\. Bias atq=0\.2q\{=\}0\.2/0\.450\.45produces the worst outcomes in the sweep \(−0\.021\-0\.021/−0\.065\-0\.065, and among the tightest across seeds\): enough failure signal survives to keep*synthesising*skills \(19\.719\.7/15\.715\.7\), but contribution\-retirement can no longer weed them \(Fig\.[8](https://arxiv.org/html/2607.07436#A6.F8), Appendix[F](https://arxiv.org/html/2607.07436#A6)\), so low\-quality skills accumulate to the cap and keep being routed to\. At extreme bias \(q=0\.7q\{=\}0\.7\), however, the loop*starves*: with most failures reported as passes, synthesis itself \(also failure\-driven\) slows to15\.015\.0skills and the near\-inert library drifts back to the clean level \(\+0\.039\+0\.039\)\. Harm is an inverted\-U inρF→P\\rho\_\{F\\to P\}, peaking at the theory’s retirement\-inoperative point\(1−τ\)/2=0\.45\(1\-\\tau\)/2=0\.45: the dangerous judge is not the blindest one but the half\-blind one, which feeds the synthesiser while disarming the curator\. The theory predicts the retirement cliff; the inverted\-U is what that cliff looks like in a system where skill*creation*shares the corrupted signal\.

The strict judge behaves as audited\.As itsρF→P≈0\.01\\rho\_\{F\\to P\}\\approx 0\.01predicts, the real LLM judge, despite the highest realised divergence \(0\.590\.59, all phantom failures\), keeps retirement active and matches the clean loop \(\+0\.024\+0\.024\): conservative error churns but does not disarm the curator\. And the absolute non\-divergence the cap promises also held: no condition fell more than a fixed margin below the no\-skill floor \(all means within0\.1250\.125of it\), including those where retirement was inoperative, exactly as Prop\. 1′guarantees\.

Scope: harm, not lift\.OnReport\-main\-71clean evolution does not beat the no\-skill floor \(−0\.060\-0\.060, under22eval tasks\): the composer is already strong, so the sweep cleanly measures the*differential damage of reward corruption*, not the loop’s upside\. The actionable result is the harm ranking: against the clean loop only moderate false\-pass bias does real damage \(worst atq=0\.45q\{=\}0\.45\), while symmetric noise and the strict judge stay at or above it\. We replicate the mechanism in a harder, headroom\-bearing regime next\.

## 7Replication and the honest lift result

The mechanism replicates with headroom\.To rule out a near\-ceiling artifact we re\-run the whole sweep onReport\-band\-58, a stricter reward on a bias\-sensitive band where the composer genuinely struggles \(floor0\.3880\.388; Appendix[B](https://arxiv.org/html/2607.07436#A2), Fig\.[6](https://arxiv.org/html/2607.07436#A2.F6)\)\. The signature is sharper: the clean curator genuinely retires≈7\\approx\\\!7skills/run, noise keeps it there, and false\-pass bias drives it to*zero*byq=0\.45q\{=\}0\.45\. The same noise\-preserves / bias\-kills pattern surviving a change of composer difficulty, reward strictness, and floor level is evidence it is a property of the governance mechanism, not one operating point\.

No detectable end\-to\-end lift, and why that is the honest finding\.Our claim is a replication of this*mechanism*\(low\-variance, seed\-stable\), not of an outcome lift\. A single seed suggested a\+0\.12\+0\.12pass@1 lift, but it shrank to\+0\.014±0\.054\+0\.014\\pm 0\.054over three seeds: at2323binary\-scored eval tasks the variance is structural \(binary scoring, unpaired means\), so more seeds cannot resolve it\. We re\-measured with a sharper instrument, a*paired*design scored on the*continuous*violation count \(Table[3](https://arxiv.org/html/2607.07436#A7.T3), Appendix[G](https://arxiv.org/html/2607.07436#A7)\); the held\-out lift is still null \(a mean reduction of just0\.260\.26violations/section,p=0\.63p\{=\}0\.63; binary pass difference exactly0\), as is the symmetric harm test \(clean vs bias\-0\.450\.45library,p=0\.61p\{=\}0\.61\)\. We claim the lift is*undetectable*at this resolution, not provably zero\. The one effect that survives is mechanism\-aligned: the library significantly reduces the single violation class its skills police \(unsourced numbers, full\-band pairedp=0\.03p\{=\}0\.03\), confirming the skills do their narrow job\.

Why the micro\-effect does not aggregate is itself the finding\.A significant per\-class improvement leaving headline quality unmoved is the positive dual of this paper’s thesis: our central*failure*\(a disabled curator\) and this*success*\(one violation class driven down\) are both invisible to aggregate eval, because gains in one discipline are offset by others and the binary pass collapses them all\. That is why governance must be sized and audited on the process signal that drives it, not the outcome metric: the value is preventing degradation, as a non\-divergence guarantee promises, not manufacturing lift\.

## 8Generality: universal mechanism failure, regime\-dependent harm

Is the effect specific to long\-form generation, or a property of the curator’s arithmetic that should appear wherever such governance runs? We test generality along two axes:*failure abundance*\(the scarceReport\-band\-58vs the abundantReport\-hard\-133, same domain\) and*domain*\(MBPP\+ hard100code generation, a*perfect*unit\-test verifier and a Claude Opus 4\.7 composer, with the same channels injected on the true pass/fail\)\. This also forces a sharper look at what “retirement” means\.

Genuine retirement collapses everywhere\.Measured as*true*contribution\-retirement \(a skill whose observed contribution reaches−τ\-\\tauat≥Nmin\\geq N\_\{\\min\}trials, separated from the bounded bank’s cap\-evictions\), false\-pass bias drives retirement to essentially zero atq=0\.7q\{=\}0\.7in*every*subset \(Fig\.[4](https://arxiv.org/html/2607.07436#S8.F4)a\), includingMBPP\+ hard100\(0\.30\.3\) and the abundant\-failureReport\-hard\-133\(0\.00\.0\), not just the scarceReport\-band\-58\. The realistic LLM judge, by contrast, keeps true retirement fully alive \(its near\-zero false\-pass rate, Sec\.[5](https://arxiv.org/html/2607.07436#S5)\), exactly as Prop\. 1′predicts\. So contribution\-retirement is disabled by false\-pass bias as a*universal*property of the curator’s arithmetic, independent of domain or failure abundance\.

![Refer to caption](https://arxiv.org/html/2607.07436v1/x4.png)Figure 4:The causal chain behind*silent*curator failure, across three subsets:Report\-band\-58\(scarce failures\),Report\-hard\-133\(abundant, same domain\), andMBPP\+ hard100\(abundant, different domain and model\)\.\(a\)genuine retirement falls to≈0\{\\approx\}0past the cliff in*every*subset, the curator dies universally\.\(b\)synthesis survives where failures stay abundant and starves only in the scarce subset\.\(c\)so the eval outcome \(vs clean\) holds despite the dead curator in the abundant subsets and degrades only where synthesis starved: the curator’s failure is*silent*wherever failures are plentiful\.Why the outcome diverges: synthesis, not retirement\.With the curator dead everywhere, the downstream eval is set by whether the*other*failure\-driven stage survives\. Observed failures are the single input both stages share, so bias shrinks that pool, but the*absolute*failure volume differs by subset:Report\-band\-58falls from2020to66failures/round and synthesis starves \(20→1120\\\!\\to\\\!11, Fig\.[4](https://arxiv.org/html/2607.07436#S8.F4)b\), while the abundant subsets still see1212–1616and keep synthesising at full rate \(≈22\\approx\\\!22\)\. The eval outcome tracks exactly this \(Fig\.[4](https://arxiv.org/html/2607.07436#S8.F4)c\): it holds at or above the clean loop in both abundant subsets despite the dead curator and degrades \(−0\.036\-0\.036\) only in the starvedReport\-band\-58\. This is precisely why a disabled curator is*silent*where failures are plentiful: the outcome looks healthy while governance has quietly stopped\. The operator\-facing takeaway is domain\-independent: a judge with a high false\-pass rate disables the curator wherever it runs, and the false\-pass rate is measurable offline \(Sec\.[5](https://arxiv.org/html/2607.07436#S5)\)\.

Why this matters, and where\.The danger axis is the judge’s false\-pass rate, not the domain\. The domains where this governance was validated \(code, with unit tests\) are safe because their “judge” is a sound verifier with a near\-zero false\-pass rate, not because failures are abundant\. The deployments expanding fastest are exposed by construction \(deep research, multi\-document analysis, open\-ended agentic writing\): with no reference answer the reward*must*be an LLM judge, whose false\-pass rate is real and unknown until measured, and they raise the cost of an undetected miss with long, confident artifacts readers rarely re\-verify\. The regime where our effect bites is thus both the one verifier\-free deployments are rushing into and the one where a silently disabled curator does the most damage, which is why a one\-time judge audit is worth running first \(the go/no\-go playbook, Fig\.[5](https://arxiv.org/html/2607.07436#S8.F5)\)\.

![Refer to caption](https://arxiv.org/html/2607.07436v1/x5.png)Figure 5:Deployment playbook, assembling the paper’s findings into a before\-deployment recipe\. Audit the judge’s false\-pass rateρF→P\\rho\_\{F\\to P\}offline \(Sec\.[5](https://arxiv.org/html/2607.07436#S5)\); below the cliff\(1−τ\)/2\(1\-\\tau\)/2retirement works \(a strict judge may starve synthesis\), above it the curator is blind, so lower the effectiveρF→P\\rho\_\{F\\to P\}or defer self\-evolution\.
## 9Limitations

Our scope is bounded\. The study centres on one domain and composer \(MBPP\+ adds a second of each as a control\), and our seed\-stable result is behavioral: the synth/retire*mechanism*and its bias threshold, not an end\-to\-end lift \(undetectable under paired re\-measurement; Appendix[G](https://arxiv.org/html/2607.07436#A7)\)\. Two caveats: our corruption is*exogenous*, so a learned judge whose blindness the library could exploit is out of scope \(Appendix[C](https://arxiv.org/html/2607.07436#A3)\); and the QC reward covers citation discipline, not insight, so a section can pass QC yet be vacuous\.

## 10Conclusion

Failure\-driven skill evolution survives a noisy judge, is disarmed by a half\-blind one, and is safe \(though starvation\-prone\) under a strict one, all distinguishable*before*deployment by a cheap defect\-injection audit\. Governance sized to the error structure of the signal that drives it is the practical path for self\-improving agents where no one can write the unit test\.

## References

- Austin et al\. \(2021\)Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry, Quoc Le, and Charles Sutton\.Program synthesis with large language models\.*arXiv preprint arXiv:2108\.07732*, 2021\.
- Bai et al\. \(2022\)Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al\.Constitutional AI: Harmlessness from AI feedback\.*arXiv preprint arXiv:2212\.08073*, 2022\.
- Chen et al\. \(2024\)Minghao Chen, Yihang Li, Yanting Yang, Shiyu Yu, Binbin Lin, and Xiaofei He\.AutoManual: Generating instruction manuals by LLM agents via interactive environmental learning\.In*Advances in Neural Information Processing Systems*, volume 37, 2024\.
- Cui et al\. \(2026\)Yanwei Cui, Xing Zhang, Yulong Zhang, Li Shao, Xiaofeng Shi, Guanghui Wang, and Peiyang He\.Closing the feedback loop: From experience extraction to insight governance in verbal reinforcement learning\.*arXiv preprint arXiv:2606\.17591*, 2026\.
- Huang et al\. \(2025\)Xu Huang, Junwu Chen, Yuxing Fei, Zhuohan Li, Philippe Schwaller, and Gerbrand Ceder\.CASCADE: Cumulative agentic skill creation through autonomous development and evolution\.*arXiv preprint arXiv:2512\.23880*, 2025\.
- Jimenez et al\. \(2024\)Carlos E\. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan\.SWE\-bench: Can language models resolve real\-world GitHub issues?In*International Conference on Learning Representations*, 2024\.
- Kirkpatrick et al\. \(2017\)James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A\. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska\-Barwinska, et al\.Overcoming catastrophic forgetting in neural networks\.*Proceedings of the National Academy of Sciences*, 114\(13\):3521–3526, 2017\.
- Li et al\. \(2024\)Haitao Li, Qian Dong, Junjie Chen, Huixue Su, Yujia Zhou, Qingyao Ai, Ziyi Ye, and Yiqun Liu\.LLMs\-as\-judges: A comprehensive survey on LLM\-based evaluation methods\.*arXiv preprint arXiv:2412\.05579*, 2024\.
- Li et al\. \(2026\)Xiangyi Li, Wenbo Chen, Yimin Liu, Shenghan Zheng, Xiaokun Chen, Yifeng He, Yubo Li, Bingran You, Haotian Shen, Jiankai Sun, et al\.SkillsBench: Benchmarking how well agent skills work across diverse tasks\.*arXiv preprint arXiv:2602\.12670*, 2026\.
- Liu et al\. \(2026\)Hongyi Liu, Haoyan Yang, Tao Jiang, Bo Tang, Feiyu Xiong, and Zhiyu Li\.SkillsVote: Lifecycle governance of agent skills from collection, recommendation to evolution\.*arXiv preprint arXiv:2605\.18401*, 2026\.
- Liu et al\. \(2023\)Jiawei Liu, Chunqiu Steven Xia, Yuyao Wang, and Lingming Zhang\.Is your code generated by ChatGPT really correct? rigorous evaluation of large language models for code generation\.*Advances in Neural Information Processing Systems*, 36, 2023\.
- Madaan et al\. \(2023\)Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, et al\.Self\-refine: Iterative refinement with self\-feedback\.*Advances in Neural Information Processing Systems*, 36, 2023\.
- Ni et al\. \(2026\)Jingwei Ni, Yihao Liu, Xinpeng Liu, Yutao Sun, Mengyu Zhou, Pengyu Cheng, Dexin Wang, Xiaoxi Jiang, and Guanjun Jiang\.Trace2Skill: Parallel inductive skill distillation for LLM agents\.*arXiv preprint arXiv:2603\.25158*, 2026\.
- Packer et al\. \(2023\)Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G\. Patil, Ion Stoica, and Joseph E\. Gonzalez\.MemGPT: Towards LLMs as operating systems\.*arXiv preprint arXiv:2310\.08560*, 2023\.
- Pezeshkpour & Hruschka \(2026\)Pouya Pezeshkpour and Estevam Hruschka\.AutoPyVerifier: Learning compact executable verifiers for large language model outputs\.*arXiv preprint arXiv:2604\.22937*, 2026\.
- Shen et al\. \(2026\)Junhao Shen, Teng Zhang, Xiaoyan Zhao, and Hong Cheng\.Dynamic skill lifecycle management for agentic reinforcement learning\.*arXiv preprint arXiv:2605\.10923*, 2026\.
- Shinn et al\. \(2023\)Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao\.Reflexion: Language agents with verbal reinforcement learning\.*Advances in Neural Information Processing Systems*, 36, 2023\.
- Stureborg et al\. \(2024\)Rickard Stureborg, Dimitris Alikaniotis, and Yoshi Suhara\.Large language models are inconsistent and biased evaluators\.*arXiv preprint arXiv:2405\.01724*, 2024\.
- Wang et al\. \(2023\)Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar\.Voyager: An open\-ended embodied agent with large language models\.*arXiv preprint arXiv:2305\.16291*, 2023\.
- Wang et al\. \(2024a\)Peiyi Wang, Lei Li, Liang Chen, Zefan Cai, Dawei Zhu, Binghuai Lin, Yunbo Cao, Lingpeng Kong, Qi Liu, Tianyu Liu, et al\.Large language models are not fair evaluators\.In*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pp\. 9440–9450, 2024a\.
- Wang et al\. \(2024b\)Zora Zhiruo Wang, Jiayuan Mao, Daniel Fried, and Graham Neubig\.Agent workflow memory\.*arXiv preprint arXiv:2409\.07429*, 2024b\.
- Wu et al\. \(2025\)Rong Wu, Xiaoman Wang, Jianbiao Mei, Pinlong Cai, Daocheng Fu, Cheng Yang, Licheng Wen, Xuemeng Yang, Yufan Shen, Yuxin Wang, et al\.Self\-evolving LLM agents through an experience\-driven lifecycle\.*arXiv preprint arXiv:2510\.16079*, 2025\.
- Xia et al\. \(2026\)Peng Xia, Jianwen Chen, Hanyang Wang, Jiaqi Liu, Kaide Zeng, Yu Wang, Siwei Han, Yiyang Zhou, Xujiang Zhao, Haifeng Chen, et al\.SkillRL: Evolving agents via recursive skill\-augmented reinforcement learning\.*arXiv preprint arXiv:2602\.08234*, 2026\.
- Yang et al\. \(2026\)Yutao Yang, Junsong Li, Qianjun Pan, Bihao Zhan, Yuxuan Cai, Lin Du, Jie Zhou, Kai Chen, Qin Chen, Xin Li, et al\.AutoSkill: Experience\-driven lifelong learning via skill self\-evolution\.*arXiv preprint arXiv:2603\.01145*, 2026\.
- Yu et al\. \(2026\)Zhuoyun Yu, Xin Xie, Wuguannan Yao, Chenxi Wang, Lei Liang, Xiang Qi, and Shumin Deng\.SkillAdaptor: Self\-adapting skills for LLM agents from trajectories\.*arXiv preprint arXiv:2606\.01311*, 2026\.
- Yuksekgonul et al\. \(2024\)Mert Yuksekgonul, Federico Bianchi, Joseph Boen, Sheng Liu, Zhi Huang, Carlos Guestrin, and James Zou\.TextGrad: Automatic “differentiation” via text\.*arXiv preprint arXiv:2406\.07496*, 2024\.
- Zhang et al\. \(2026a\)Xing Zhang, Yanwei Cui, Guanghui Wang, Ziyuan Li, Wei Qiu, Bing Zhu, and Peiyang He\.Library drift: Diagnosing and fixing a silent failure mode in self\-evolving LLM skill libraries\.*arXiv preprint arXiv:2605\.19576*, 2026a\.
- Zhang et al\. \(2026b\)Xing Zhang, Yanwei Cui, Guanghui Wang, Ziyuan Li, Wei Qiu, Bing Zhu, and Peiyang He\.Ratchet: A minimal hygiene recipe for self\-evolving LLM agents\.*arXiv preprint arXiv:2605\.22148*, 2026b\.
- Zhao et al\. \(2024\)Andrew Zhao, Daniel Huang, Quentin Xu, Matthieu Lin, Yong\-Jin Liu, and Gao Huang\.ExpeL: LLM agents are experiential learners\.In*Proceedings of the AAAI Conference on Artificial Intelligence*, 2024\.
- Zheng et al\. \(2023\)Lianmin Zheng, Wei\-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P\. Xing, Hao Zhang, Joseph E\. Gonzalez, and Ion Stoica\.Judging LLM\-as\-a\-judge with MT\-bench and chatbot arena\.In*Advances in Neural Information Processing Systems*, volume 36, 2023\.

## Appendix AEvidence slice: schema and example

A trial gives the composer one*evidence slice*: the section brief plus the closed set of evidence*cards*, metric tags, and allowed cross\-references it may use\. The composer must cite only these cards, annotate every numeral with a card or a registered metric tag, hedge any card markedstatus: weak, and meet the structural contract \(e\.g\. a TL;DR with the required bullets\)\. The example below is synthetic and anonymized \(invented entity, fabricated figures\); the real slices follow the identical schema but draw on proprietary research corpora, which is why we do not reproduce one verbatim\.

\{

"section":"s3","title":"Marketposition",

"purpose":"sizetheaddressablemarketandflaguncertainty",

"tldr\_min\_bullets":2,

"cards":\[

\{"id":"E001","stance":"bull","status":"ok",

"claim":"ACME’sFY25revenuewas$1\.2B,up30%

"quote":"\.\.\.revenuereached$1\.2B\(\+30%

"source":"ACMEFY25annualreport","metric\_refs":\["m\_rev"\]\},

\{"id":"E002","stance":"bear","status":"weak",

"claim":"Atrade\-pressnoteestimates2026sharenear18%

"quote":"\.\.\.weestimateACMEat~18%

"source":"industrynewsletter\(secondary\)"\}

\],

"metrics":\[\{"tag":"m\_rev","value":"1\.2","unit":"BUSD"\}\],

"xref":\[\{"id":"s5","title":"Competitivelandscape"\}\]

\}

A compliant section might open: “TL;DR– ACME posted\{m\_rev\}revenue, \+30%\[E001\]; – a secondary estimate puts 2026 share near 18%\[E002\], though this figure is unverified \(see §s5\)\.” Here\[E001\]and\[E002\]are valid citations,\{m\_rev\}is a registered metric tag, the weak card is hedged, and the TL;DR meets its bullet floor: deterministic QC passes\. This exposes the two defect regimes concretely\. A*QC\-visible*defect breaks the syntax, e\.g\. citing\[E003\]\(not in the slice, an orphan citation\) or writing a bare “30%” with no tag: the checks catch it with certainty\. A*QC\-invisible*defect preserves every marker but corrupts meaning, e\.g\. flipping “\+30%” to “−\-30%” while keeping\[E001\]: the citation still resolves, so QC passes, yet the sentence now misquotes its own source\. Only a judge that reads the quote can catch the second kind, which is the gap Sec\.[5](https://arxiv.org/html/2607.07436#S5)measures\.

## Appendix BExperimental details

Table[2](https://arxiv.org/html/2607.07436#A2.T2)collects every experiment in the paper, its subset, composer, reward, size, and where it is used; the rest of this appendix gives only what does not fit the table\.

Table 2:All experiments at a glance\. Common to every run: 3 seeds \(42/43/44\)×\\times12 rounds,τ=0\.10\\tau\{=\}0\.10,Nmin=24N\_\{\\min\}\{=\}24, capC=12C\{=\}12; the reward channels \(clean / symmetric noiseρ∈\{\.1,\.2,\.3,\.4\}\\rho\\in\\\{\.1,\.2,\.3,\.4\\\}/ false\-pass biasq∈\{\.2,\.45,\.7\}q\\in\\\{\.2,\.45,\.7\\\}/ audited LLM judge\) are injected on the*training*reward only, while evaluation always uses the true grader\.*tr/ev*= train / eval sections;*fail*= clean true\-failure rate on the train pool;*floor*= no\-skill tail eval pass@1\.![Refer to caption](https://arxiv.org/html/2607.07436v1/x6.png)Figure 6:The retirement signature replicates across two subsets \(3 seeds; blue = noise, red = false\-pass bias, vs realised corruption, the fraction of training labels actually flipped\)\.\(a\)Report\-main\-71\(near\-ceiling\): noise preserves genuine retirement, bias drives it to zero\.\(b\)Report\-band\-58\(real headroom\): same pattern, larger amplitude \(≈7→0\\approx\\\!7\\\!\\to\\\!0byq=0\.45q\{=\}0\.45\)\.\(c\)decomposing theReport\-band\-58deprecation count shows genuine retirement \(green\) collapsing7→07\\\!\\to\\\!0while blind cap\-eviction churn \(gray\) props up the raw total\.Models and inference\.Composers are sampled at temperature0\.70\.7with a22002200\-token cap\. The in\-loop judge reward channel uses the same model as the composer, scored deterministically at temperature0\(binarypass/fail,200200\-token cap\)\. The gate audit \(Fig\.[2](https://arxiv.org/html/2607.07436#S5.F2)\) uses a held\-out judge of a*different*family \(Claude Sonnet 4\.6, temperature0\) so its errors are not shared with the composer\. Noise and false\-pass bias are injected synthetically on the training reward label only; the corruption never touches inference\.

Subset construction\.The report subsets keep only sections with genuine headroom\.Report\-main\-71keeps the 71 of 155 that fail at least once\.Report\-band\-58keeps the 58 the composer fails on11or22of33probes, excluding always\-pass sections \(no headroom\) and always\-fail ones \(unfixable\), and adds tier\-2 content disciplines \(hedge weak\-status cards, cover both stances, meet a coverage floor\) to the reward for real headroom\.Report\-hard\-133adds the always\-fail sections back, raising the true\-failure rate and synthesis pressure without changing the reward: a same\-domain, failure\-abundant control where \(as in MBPP\) the headline deprecation count stays high under bias but is cap\-eviction churn, genuine contribution\-retirement still collapsing to zero \(Fig\.[4](https://arxiv.org/html/2607.07436#S8.F4)\)\.MBPP\+ hard100uses Ratchet’s published hard\-100 split unchanged, with the channels injected on the true unit\-test pass/fail \(baseline pass@10\.2730\.273, vs0\.2580\.258originally reported\)\.

Report\-weak\-71\(capability control\)\.It swaps in a weaker composer \(Claude 3\.5 Haiku\) on the main subset, leaving ample headroom \(floor≈0\.17\\approx 0\.17\) yet clean evolution does not beat it \(tail0\.1710\.171, equal to floor\): skills amplify a capable composer rather than teach a weak one, soReport\-band\-58raises difficulty through the reward instead of weakening the model\.

## Appendix CFull theory: bias\-aware non\-divergence

This appendix gives the full derivation summarised in Sec\.[4](https://arxiv.org/html/2607.07436#S4): the corruption channel, the two corruption regimes, and the bias\-aware floor \(Proposition 1′\) with proof\. Ratchet’s original guarantee \(Prop\. 1\) assumes the per\-skill contribution estimator is unbiased; with a deterministic grader this is innocuous, but in reference\-free domains the grader is an LLM judge whose errors are*structured*, not mere variance\. We trace that structure through the retirement rule\.

### C\.1Corruption channel

Lety∈\{0,1\}y\\in\\\{0,1\\\}be the true outcome of one trial \(as scored by a perfect grader\) andy~\\tilde\{y\}the observed outcome\. Model the judge as a binary channel,

Pr⁡\[y~=1∣y=0\]=ρF→P,Pr⁡\[y~=0∣y=1\]=ρP→F,ρF→P\+ρP→F<1,\\Pr\[\\tilde\{y\}\{=\}1\\mid y\{=\}0\]=\\rho\_\{F\\to P\},\\qquad\\Pr\[\\tilde\{y\}\{=\}0\\mid y\{=\}1\]=\\rho\_\{P\\to F\},\\qquad\\rho\_\{F\\to P\}\+\\rho\_\{P\\to F\}<1,encodingy=1y\{=\}1as a truepassandy=0y\{=\}0as a truefail\. Subscripts read as*true→\\toobserved*:ρF→P\\rho\_\{F\\to P\}is the rate at which a true failure is observed as a pass \(a*hidden*failure\), andρP→F\\rho\_\{P\\to F\}the rate at which a true pass is observed as a fail \(a*phantom*failure\)\. We avoid the “false positive/negative” labels deliberately: they invert depending on whether one takes a pass or a failure as the positive class, and only the hidden\-failure directionρF→P\\rho\_\{F\\to P\}disarms retirement\. Ratchet retires a skillsswhen its empirical contributionc^​\(s\)=\(\#​succ−\#​fail\)/n​\(s\)=2​p^​\(s\)−1\\hat\{c\}\(s\)=\(\\,\\\#\\mathrm\{succ\}\-\\\#\\mathrm\{fail\}\\,\)/n\(s\)=2\\hat\{p\}\(s\)\-1falls to−τ\-\\tauaftern​\(s\)≥Nminn\(s\)\\geq N\_\{\\min\}trials; equivalently, when the observed pass ratep^​\(s\)≤πτ:=1−τ2\\hat\{p\}\(s\)\\leq\\pi\_\{\\tau\}:=\\tfrac\{1\-\\tau\}\{2\}\. Under the channel, the observed pass rate concentrates on

pobs​\(s\)=\(1−ρF→P−ρP→F\)​p¯​\(s\)\+ρF→P=κ​p¯​\(s\)\+ρF→P,κ:=1−ρF→P−ρP→F,p\_\{\\mathrm\{obs\}\}\(s\)=\\bigl\(1\-\\rho\_\{F\\to P\}\-\\rho\_\{P\\to F\}\\bigr\)\\,\\bar\{p\}\(s\)\+\\rho\_\{F\\to P\}\\;=\\;\\kappa\\,\\bar\{p\}\(s\)\+\\rho\_\{F\\to P\},\\qquad\\kappa:=1\-\\rho\_\{F\\to P\}\-\\rho\_\{P\\to F\},wherep¯​\(s\)\\bar\{p\}\(s\)is the skill’s true pass rate on tasks routed to it\. Two consequences, one per corruption type:

\(i\) Symmetric noise\(ρF→P=ρP→F=ρ<12\\rho\_\{F\\to P\}=\\rho\_\{P\\to F\}=\\rho<\\tfrac\{1\}\{2\}\): thenpobs−12=\(1−2​ρ\)​\(p¯−12\)p\_\{\\mathrm\{obs\}\}\-\\tfrac\{1\}\{2\}=\(1\-2\\rho\)\(\\bar\{p\}\-\\tfrac\{1\}\{2\}\), so the statistic is*compressed*towards12\\tfrac\{1\}\{2\}but its ordering is preserved\. Retirement of a truly harmful skill still fires, at an inflated margin: the true pass rate must satisfyp¯​\(s\)≤12−τ/21−2​ρ\\bar\{p\}\(s\)\\leq\\tfrac\{1\}\{2\}\-\\tfrac\{\\tau/2\}\{1\-2\\rho\}, i\.e\. the effective retirement threshold isτeff=τ/\(1−2​ρ\)\\tau\_\{\\mathrm\{eff\}\}=\\tau/\(1\-2\\rho\), and Hoeffding’s radius must now resolve means separated by a factor\(1−2​ρ\)\(1\-2\\rho\), so the requiredNminN\_\{\\min\}grows as\(1−2​ρ\)−2\(1\-2\\rho\)^\{\-2\}\. Degradation is*graceful*: finite for everyρ<12\\rho<\\tfrac\{1\}\{2\}\.

\(ii\) False\-pass bias\(ρF→P\>0\\rho\_\{F\\to P\}\>0,ρP→F=0\\rho\_\{P\\to F\}=0\): thenpobs=p¯\+ρF→P​\(1−p¯\)p\_\{\\mathrm\{obs\}\}=\\bar\{p\}\+\\rho\_\{F\\to P\}\(1\-\\bar\{p\}\), an additive*displacement*, largest exactly for the worst skills \(smallp¯\\bar\{p\}\)\. Retirement fires only ifp¯​\(s\)≤πτ−ρF→P1−ρF→P\\bar\{p\}\(s\)\\leq\\frac\{\\pi\_\{\\tau\}\-\\rho\_\{F\\to P\}\}\{1\-\\rho\_\{F\\to P\}\}\. The right\-hand side hits0atρF→P=πτ=1−τ2\\rho\_\{F\\to P\}=\\pi\_\{\\tau\}=\\tfrac\{1\-\\tau\}\{2\}: beyond this point*no skill is ever retired, at any sample size*, since more trials concentrate the estimator more tightly around a displaced mean\. The mechanism predicts a*cliff*, not a slope\.

### C\.2Proposition 1′

Proposition 1′\(Non\-divergence under corrupted reward\)\.Assume the Router conditions of Prop\. 1 and the channel above with known boundsρF→P≤ρ¯F→P\\rho\_\{F\\to P\}\\leq\\bar\{\\rho\}\_\{F\\to P\},ρP→F≤ρ¯P→F\\rho\_\{P\\to F\}\\leq\\bar\{\\rho\}\_\{P\\to F\},κ≥κ¯\>0\\kappa\\geq\\underline\{\\kappa\}\>0\. ChooseNminN\_\{\\min\}so that the observed pass rate of every ACTIVE skill is withinϵ\\epsilonof its mean w\.p\.≥1−δ\\geq 1\-\\delta\(Hoeffding\)\. Then expected eval pass@1 under Ratchet is lower\-bounded by

𝔼​\[p0\]−τ/2\+ϵ\+ρ¯F→Pκ¯−12​\(1−κ¯\)−C​δ\\mathbb\{E\}\[p\_\{0\}\]\\;\-\\;\\frac\{\\tau/2\\;\+\\;\\epsilon\\;\+\\;\\bar\{\\rho\}\_\{F\\to P\}\}\{\\underline\{\\kappa\}\}\\;\-\\;\\tfrac\{1\}\{2\}\\bigl\(1\-\\underline\{\\kappa\}\\bigr\)\\;\-\\;C\\,\\delta\(up to the affine map between pass\-rate and contribution scales\)\.

*Proof sketch\.*On the high\-probability event every surviving skill has observed pass rate≥πτ−ϵ\\geq\\pi\_\{\\tau\}\-\\epsilon\. Inverting the channel, its true pass rate satisfiesp¯​\(s\)≥\(πτ−ϵ−ρ¯F→P\)/κ¯\\bar\{p\}\(s\)\\geq\(\\pi\_\{\\tau\}\-\\epsilon\-\\bar\{\\rho\}\_\{F\\to P\}\)/\\underline\{\\kappa\}\. Comparing against the NONE route’sp¯0\\bar\{p\}\_\{0\}and taking expectations over the routing distribution reproduces the Prop\. 1 argument with the inflated margin\. ∎

Reading the bound\.Three design rules fall out\. \(1\)*Noise attenuates, bias displaces*: symmetric noise enters only throughκ¯=1−2​ρ\\underline\{\\kappa\}=1\-2\\rhoand the floor degrades smoothly for allρ<12\\rho<\\tfrac\{1\}\{2\}; false\-pass bias enters additively throughρ¯F→P\\bar\{\\rho\}\_\{F\\to P\}and renders retirement inoperative atρ¯F→P≥πτ\\bar\{\\rho\}\_\{F\\to P\}\\geq\\pi\_\{\\tau\}, where the bound goes vacuous discontinuously\. \(2\)*Compensate withτ\\tau, not withNminN\_\{\\min\}*: sample size shrinksϵ\\epsilonbut neverρ¯F→P\\bar\{\\rho\}\_\{F\\to P\}; the only lever against bias is widening the retirement threshold \(πτ\>ρ¯F→P\\pi\_\{\\tau\}\>\\bar\{\\rho\}\_\{F\\to P\}, i\.e\.τ<1−2​ρ¯F→P\\tau<1\-2\\bar\{\\rho\}\_\{F\\to P\}\), which is possible only while the judge’s false\-pass rate is belowπτ\\pi\_\{\\tau\}\. \(3\)*Measure the judge, read off the floor*:ρ¯F→P,ρ¯P→F\\bar\{\\rho\}\_\{F\\to P\},\\bar\{\\rho\}\_\{P\\to F\}are estimable offline by defect injection against constructed ground truth \(Sec\.[5](https://arxiv.org/html/2607.07436#S5)\), making the bound operational: audit the judge once, then know which side of the cliff your evolution loop sits on\.

Falsifiable prediction\.Library evolution driven by a reward channel with symmetric noiseρ\\rhoshould degrade gracefully inρ\\rhoand remain non\-divergent up to high noise; evolution driven by false\-pass biasρF→P\\rho\_\{F\\to P\}should hold and then fail abruptly nearρF→P≈πτ\\rho\_\{F\\to P\}\\approx\\pi\_\{\\tau\}\. The experiments of Sec\.[6](https://arxiv.org/html/2607.07436#S6)test exactly this contrast\.

Remark \(adversarial coupling\)\.If skill content can*cause*judge blindness \(the library learns phrasing that fabricates confidently\), thenρF→P\\rho\_\{F\\to P\}becomes skill\-dependent and grows along the evolution trajectory; no fixed audit bounds it\. Our sweep deliberately breaks this coupling \(corruption is injected exogenously on top of a deterministic grader\), isolating the channel’s effect; the fully\-learned\-judge condition, where the coupling is live, is out of scope here \(Sec\.[9](https://arxiv.org/html/2607.07436#S9)\)\.

## Appendix DA QC\-invisible defect, verbatim

![Refer to caption](https://arxiv.org/html/2607.07436v1/x7.png)Figure 7:A real*claim\-negation*defect \(demo\-credo\): flipping the direction word \(“grew”→\\to“fell”\) leaves the number \(205\.68%205\.68\\%\), metric tag\{m\_rev\_yoy\}, and citation\[E0001\]byte\-identical, so deterministic QC \(and even a value check\) sees nothing wrong, yet the sentence now contradicts its own cited source\. The QC\-invisible / judge\-visible gap in one example\.
## Appendix EGate audit details

Direction check\.On clean sections, judge scores do not anti\-correlate with deterministic warning counts \(Spearmanrs=0\.19r\_\{s\}\{=\}0\.19,95%95\\%CI\[0\.03,0\.34\]\[0\.03,0\.34\],n=143n\{=\}143\): a weak positive, consistent with number\-dense sections being both warning\-prone and information\-rich\. This rules out the failure mode in which optimising the QC reward would actively fight judge\-perceived quality\.

Reward\-judge audit\.We grade fresh compositions from the sweep’s composer with defects injected only into truly\-passing sections, givingρF→P≈0\.01\\rho\_\{F\\to P\}\\approx 0\.01on QC\-visible defects \(n=210n\{=\}210\) and0\.0140\.014on QC\-invisible ones \(n=70n\{=\}70\), againstρP→F≈0\.95\\rho\_\{P\\to F\}\\approx 0\.95on truly\-passing sections \(n=42n\{=\}42\): i\.e\.κ≈0\.04\\kappa\\approx 0\.04, the conservative\-corner regime discussed in Sec\.[5](https://arxiv.org/html/2607.07436#S5)\.

## Appendix FCuration activity over time

![Refer to caption](https://arxiv.org/html/2607.07436v1/x8.png)Figure 8:Per\-round bank deprecations \(mean of 3 seeds\),Report\-main\-71: each row a condition, each column a round, colour = skills deprecated that round \(contribution\-retirement plus cap\-eviction\)\. After theNminN\_\{\\min\}warm\-up the bank stays active under noise but goes increasingly quiet under false\-pass bias \(pale, delayed\): the curation loop winding down in time\.This temporal view complements the aggregate counts of Sec\.[6](https://arxiv.org/html/2607.07436#S6)\(Table[1](https://arxiv.org/html/2607.07436#S6.T1)\): the loop quiets round by round under bias, not all at once\.

## Appendix GPaired, continuous lift measurement

This appendix details the re\-measurement summarised in Sec\.[7](https://arxiv.org/html/2607.07436#S7)\. The end\-to\-end lift reported by a single seed \(\+0\.12\+0\.12pass@1\) failed to survive three seeds \(\+0\.014±0\.054\+0\.014\\pm 0\.054\), and we trace this to the*measurement*, not the sample size: with2323binary\-scored eval tasks the quantum is1/23≈0\.0431/23\\approx 0\.043and the dominant variance comes from comparing two unpaired noisy means across sections of very different difficulty\. No number of seeds removes that structural variance\.

Protocol\.We freeze the final evolved library from eachReport\-band\-58run and, for every section, compose it twice with the same Claude Haiku 4\.5 composer at the eval temperature: once with the section routed to the frozen library, once with routing forced to the no\-skill path \(the floor arm\)\. Each cell is averaged over three composer repeats\. Scoring uses the same deterministic tier\-2 grader, but on its*continuous*violation count rather than the binarypass\(the judge never enters evaluation\)\. Pairing cancels per\-section difficulty, the largest noise source; the continuous score raises resolution by an order of magnitude\. We report Wilcoxon signed\-rank over the per\-section paired differences, on the2323held\-out eval sections \(primary\) and on all5858Report\-band\-58sections \(higher\-power secondary, train sections in\-sample\)\.

Table 3:Paired lift onReport\-band\-58\.Δ\\Delta= per\-section reduction in violations from the evolved library vs the no\-skill floor \(positive==helps\); pass@1 = binary\-outcome difference\. The end\-to\-end lift is undetectable; the only significant effect is the reduction of the*specific*violation class the skills target\.Reading the table\.Even with the sharper instrument the held\-out lift is null \(continuousp=0\.63p\{=\}0\.63, binary pass difference exactly0\); we therefore claim the lift is*undetectable*at this regime and resolution, not that it is provably zero\. The harm direction \(clean library vs the bias\-0\.450\.45library\) is symmetrically null \(p=0\.61p\{=\}0\.61\): the aggregate eval is insensitive to both the help and the harm at2323sections, which is precisely why this paper’s evidence rests on the mechanism signal \(synth/retire, low\-variance; Sec\.[6](https://arxiv.org/html/2607.07436#S6)\) and the class\-level signal rather than on aggregate outcome\. The one effect that survives is mechanism\-aligned: the synthesized skills police citation and sourcing discipline, and the library significantly reduces precisely the unsourced\-number violation class on the full band \(p=0\.03p\{=\}0\.03\), while gains there are offset by other disciplines so the aggregate does not move\. This is the behavioral signature of skills doing their narrow job without that job summing to headline quality: a process\-level success that aggregate metrics hide, the positive dual of the process\-level failure \(a disabled curator\) that they also hide\. The measurement isolates the value of the*final*library; it does not separately credit the evolution trajectory, which the synth/retire mechanism results \(Sec\.[6](https://arxiv.org/html/2607.07436#S6)\) address directly\.