The Open Notebook

What this is. An exercised scenario report. I took a real priority dispute from September 2026, built a simulation around the mechanism it exposed, and ran that simulation two ways. The first is the rule-based run, in which every player follows written rules, in 200 paired worlds for each combination of settings tested, which I call a cell. The second is the live run, in which each research group chose its own moves and gave its reasons, in 16 worlds, half of them with five real fixes on the menu. This is the second version of the simulation. The first version had a flaw that decided its own answer, and the section on why the simulation changed says what it was.

In this report "I" is Dan Epstein, and I decide what the report says. The odds in the simulation are set out with the rules below, and I am responsible for them.

The companies in the dispute. One of the two mathematicians in the real dispute works at Anthropic, and the company on the other side of it, OpenAI, is Anthropic's biggest rival 3. One lab in the simulation, Beacon, announces often and claims what it reaches, which resembles OpenAI's public role in the dispute. Anthropic did not commission, pay for or review this work. Nobody did.

The question. When sharing work carries a risk that a lab sees it, and nobody can see whether it happened, what do research groups do? Which of the fixes that exist today do they reach for, and what does each one cost the field?

The answer, as the simulation gave it. With only the moves the first version offered, the live groups still did not withdraw from their colleagues, although sharing could now leak. They guarded their tools and posted preprints. The labs, which read every preprint and research faster, reached nearly every result. They learned about 14 times as much from the groups' preprints as from every leak combined. With the five fixes on the menu, all three groups did the same three things in almost every world. They moved their drafts onto a local model or a university account. They timestamped their work instead of posting it. And they kept sharing with each other. With the same chances, the academic groups reached 6.0 results first instead of 0.6, while the field as a whole reached about as many. The price was paid by the public record. By mid-2028 the groups had posted about a quarter as much as without the fixes, and most of their work came out in the last quarter. In this simulation the fixes moved the results from the labs to the groups, mostly by letting the groups stop feeding the labs their preprints while they kept sharing with each other.

The result I did not expect. The fight is over leaks, but in this simulation the larger channel to the labs is the preprint. Two things follow. The fix built for open science lost: in the rule-based run, groups in an open project post everything they hold, the labs read all of it, and the groups reached no results at all. In the live run a project formed only in the last quarter of a world, because two groups had to join in the same quarter. And the live groups' choice to stop posting rested, in their own words, on hash timestamps being honoured, which no journal or prize committee does yet. In this run they were honoured. The live run did not play the world where they are not.

How to read the markers. A marker such as 5✱ points at one claim in the published evidence pack, checked against its source. A number with no marker is the simulation's record or a figure I chose, and the sentence says which. Every odds figure in the simulation is a modelling choice. None is a measurement, and no number here describes real researchers.

A world is one full run of the simulation, start to finish. A world runs for twelve quarters, from late 2026 to late 2029. Each quarter, every player makes a move, the simulation works out what happens, and chance decides anything uncertain. A paired world is two worlds that run with the same chances and differ in one condition, so the difference between them is the effect of that condition alone.

The players race on one shared problem. "The field" means all five players together, labs included, so field results count every result anyone reached. Each player builds up knowledge, counted in units. Results come on one ladder for the whole field: result 1 goes to the first player whose knowledge passes 40 units, result 2 to the first past 80, and so on. Each result is worth 10 credit. Credit is the simulation's measure of recognition. A finder that credits prior work keeps 60% of a result's credit and shares the rest among the players with posted or timestamped work since the last result. A finder that claims it all keeps it all, and starts a credit dispute, a public fight over who deserves the result.

All five are made up. None is modelled on a real person or company, though Beacon's public role resembles OpenAI's in the dispute.

• Harbour, an established academic group that posts early and collaborates widely. It drafts in Beacon's AI tool.
• Ridge, a strong academic group that shares with whoever shares back. It drafts in Keel's AI tool.
• Cove, a small group of early-career researchers that leans on AI tools to keep pace. It drafts in Beacon's AI tool.
• Beacon, a frontier AI lab that supplies a coding tool to Harbour and Cove, announces often and claims what it reaches.
• Keel, a rival lab that supplies Ridge's tool and credits prior work.

The labs have more computing power than any single group. Before tools, Harbour and Ridge each produce 4 units of knowledge a quarter and Cove 2.5. Beacon produces 9 and Keel 7. Every group learns half of what another player posts. Each lab learns 80%.

Each quarter, each research group makes two choices at once. The first is what to share: post a preprint (a paper put on the public record before peer review), share drafts privately with its collaborators, or keep its work private. Sharing with collaborators pays only if they share back that quarter: then each gains half of the other's output. A preprint puts the group's work on the record and timestamps its priority. Priority means being first, and it is how science pays credit. Every other player then learns part of what was posted, and the labs learn more, because they read faster. A group that posts also counts as sharing back with its collaborators that quarter. In this report a group "shares" in a quarter when it does anything except keep its work private.

The second choice is how to draft. Full tooling, the lab's AI coding agent with every feature, doubles the group's output. Guarded settings, the same agent on consumer privacy settings with fewer features, raise output by 60% instead of 100%. No tools adds nothing.

A group can also make an accusation: say in public that its drafts reached its tool provider. Labs choose whether to announce, whether to credit prior work, whether to offer one group a joint paper on condition that it drops a collaborator at the rival lab, and whether to publish an audited commitment not to use researchers' sessions. That commitment closes the lab's product-data route, described below, and does not bind how the lab credits. Each lab also carries a reputation with the groups, which disputes and accusations lower. Beacon publishes the commitment once its reputation runs low.

Half the live worlds add five moves. Each exists today, and the sources are in the record section.

• An institutional account. The same lab tool on a university's business or education account, whose terms say it is not used for training by default. Full speed, after one setup quarter at the guarded speed.
• A local model. An open-weight model run on the group's own hardware. It never reaches a lab. It is slower: it starts at half the frontier speed-up and closes the gap over the simulation, fast in half these worlds (to 90% by 2028) and slow in the other half (to 60% by late 2029).
• Switching labs. A group moves its drafting to the other lab's tool. The quarter it moves, its tool speed-up is halved.
• An open project. Groups that join in a quarter post everything into one public project, like the Polymath projects in mathematics. Each member gains all of every other member's output that quarter, where a returned share gives half. A result a member reaches belongs to the project and is split by what each member contributed. A project needs two members in the same quarter, or it is just a preprint. The cost: a lab can mine a structured project record more completely than scattered preprints, and a member's own name is on a smaller share.
• A hash timestamp. A cryptographic record that unposted work existed on a date, without publishing it. In these worlds journals and prize committees honour it, so timestamped priority is paid when a result lands, whatever the finder wants. No real journal or prize committee does that yet, so the rule-based run also tests a world where they do not.

In a leak world, whatever sits in a lab's tool can reach that lab, by two routes. The first is product data: a chance each quarter that depends on the tool setting, 25% a quarter on full tooling, 5% on guarded settings and 2.5% on an institutional account. The 2.5% stands for de-identified usage data, which no account term rules out. The second route is people: a 5% chance each quarter, on any setting in a lab's tool, that someone at the lab passes the work on. No setting removes it, and a lab's audited commitment does not stop it. A local model and no tools are immune to both routes.

A leak, as this report counts it, is one group's work reaching one lab in one quarter, by either route. When a leak happens, the lab gains half of everything in those sessions that quarter. That includes drafts a collaborator shared in, so Harbour sharing with Ridge exposes Harbour's drafts to Keel. No player ever sees a leak. Only the simulation's audit log records it. In a no-leak world, leaks never happen. A leak is small next to a preprint: it gives a lab half of one quarter's drafts, while a preprint gives each lab 80% of everything the group has not yet posted.

When a lab announces work, each group with unpublished work may see a lab result that looks like its own private drafts. This is an echo. An echo is likely, 50%, if the lab received that group's work in the last two quarters, by either route or through a collaborator. It also happens 10% of the time with no leak at all, because two teams working on one problem have the same idea. The group cannot tell which kind of echo it saw. In the real dispute, nobody outside the company can tell either.

The rule-based players follow written temperaments. Harbour, under suspicion, stops posting but keeps drafting with guarded tools. Ridge shares with whoever shared last quarter and goes quiet after a credit dispute. Cove withholds when suspicious but keeps full tooling. A rule-based player carries a suspicion score from 0 to 10. Echoes, disputes and accusations raise it, and it fades a little each quarter. These temperaments are inputs. The rule-based run tests what follows from them. It cannot test whether real researchers have them.

In the live run, each research group knows its briefing, the moves and what each does to its output, the public record and its own private signals. Each quarter it chooses a move, states its chance that its unpublished work is reaching a lab, and gives its reasons. It never sees other players' private work or the leak audit. Every live world starts the month after a dispute like the real one, told as news, with both leak routes live. In 8 worlds, arm A, the groups have only the moves every world offers. In 8 worlds, arm B, they also have the five fixes, with timestamps honoured. The two arms run with the same chances, world by world, so every arm-B world has an arm-A twin. Each live world is also matched with a rule-based world that runs with the same chances.

The first version of this report, v0.2, found that the live groups never withdrew from their colleagues after the dispute news, while the rule-based players did and cost the field two results. I read that as a finding until I looked at why. In v0.2 a leak could only take a group's own work, done in its own AI tool, and the live groups were told so in their rules. Sharing drafts with a collaborator exposed a group to no lab, and a reasoning player could see that. Inside that version withdrawing was never sensible, so the simulation could not test whether it is. The rule-based loss came only from a temperament I wrote.

So I changed three things in every world, and ran the simulation again. The rules above already include them:

1. Shared drafts sit in the collaborator's tool. When Harbour shares drafts with Ridge, Harbour's drafts enter Ridge's tool sessions that quarter, and can leak to Keel, Ridge's tool provider, at Ridge's tool setting. 2. Two leak routes. Product data, at a rate set by the tool setting, and people at the lab, at a small rate no setting removes. The second stands for the "tips" in the real case, which nobody has explained. 3. The players are not told how leaks work. The live groups learn the moves and what each does to their output. On leaks they are told only this: "Your tool sessions, and drafts you share into a collaborator's sessions, may reach that tool's provider, through its systems or its people. You will not be told when, or how often." No odds.

And I added the question the real field is asking now: which fixes do groups reach for, and what does each cost? Every v0.2 finding was rerun on the new simulation, and I keep one only where the new run supports it.

The dispute is a concern raised in public and two denials, and nobody outside the companies can check what the tools saw.

In September 2026, NYU mathematician Tristan Buckmaster and Levent Alpöge, who works at Anthropic, announced three proofs that pushed their work to the Euler equations, a stepping stone toward the Navier-Stokes problem 1 2. They drafted with AI models, including OpenAI's coding tool Codex and Anthropic's Claude 2. The Navier-Stokes equations describe how fluids such as water and air flow. Whether they can break down, and predict something impossible such as infinite speed, is one of the seven Millennium Prize Problems the Clay Mathematics Institute set in 2000 3.

On 8 September OpenAI presented a proof, produced with an internal model, that the full Navier-Stokes equations can break down 3 4. None of the reports I read says whether mathematicians outside OpenAI had checked it. Buckmaster then raised the concern that, because he had drafted so much in Codex, his work could have informed OpenAI's effort 2. He said he had asked whether OpenAI's model had been trained on, or had access to, the pair's Codex sessions, where they had put all their drafts 1. He also said OpenAI had offered him a choice. Either he and Alpöge posted their own work and OpenAI posted its solution the day after, or he wrote a Navier-Stokes paper with OpenAI that left Alpöge off because Alpöge works at Anthropic 3. Buckmaster wrote that Alpöge had received tips that information about their progress had been passed to OpenAI 6. Nobody has said how.

OpenAI answered twice. On 8 September it said its researchers and agents did not see the pair's work until it was public, and that its proofs differ. It also said it could not rule out that de-identified data from their use of its products had helped improve its models 2. On 10 September it went further: Buckmaster's Codex prompts over the two months before its announcement could not have influenced its system in any way, including through training 5✱.

The argument spread. Terence Tao, a Fields Medallist, wrote on 8 September that the incentives may now point toward no longer sharing promising research directions with the wider community 7. That is the mechanism this simulation models, in his words. On 11 September an open letter on AI and attribution in mathematics was posted with 25 Fields Medallists as its authors 8✱. It does not name this dispute. Nature ran an editorial on 16 September asking the labs to move to opt-in training and to accept independent audits of their data processes 9.

The simulation does not model these people or these companies, and it does not assume the concern is right. It models the mechanism the dispute exposed. Researchers now draft inside tools owned by organisations that are also racing them for results. Nobody outside those organisations can check what the tools see. And credit in science is paid for priority.

Each fix on the menu exists today. None was invented for the simulation.

• No-training accounts. Anthropic, for one, says it does not train on code or prompts sent under its commercial terms, such as team, enterprise and API accounts, unless the customer opts in 10. OpenAI's own statement of 8 September shows why the simulation keeps a small residual rate: de-identified usage data falls outside such promises.
• Local models. OpenAI's open-weight gpt-oss-120b runs on a single 80 GB GPU 11. Tao reported that local open-weight models answered about half of a set of true-or-false questions about equational theories correctly, no better than a coin flip, where frontier models answered 99% 12✱. That task is not drafting proofs, but it is the closest public measure I found, and it sets the simulation's starting gap.
• Switching labs. Several frontier tools exist, and the pair in the real case used both Codex and Claude 2.
• Open projects. The first Polymath project ran mathematics in the open, with a guideline against doing a lot of work in private 13. The Equational Theories Project credited each participant by contribution type 14.
• Hash timestamps. The standard for trusted timestamps dates from 2001 15. In August 2026 Tao floated reviving the old practice of releasing hashes of work in progress, while saying he was not sure it would be desirable 16. I found no journal or prize committee that accepts one as proof of priority.

Two worlds that run with the same chances, quarter by quarter, show the difference before the numbers do. I chose pair 6 of the live run because it holds two of the live run's three private moves. Both start the month after the dispute news, with both leak routes live. In one half the groups have the old moves only. In the other they also have the five fixes, with local models closing on the frontier slowly. I call each one a half of the pair.

This is pair 6 of the eight. Both halves run with the same chances, so the leaks and echoes that the moves allow fall the same way in both halves. Everything from here is the simulation's record. Every group states about a 35% chance that its unpublished work is reaching a lab.

Without the fixes, Harbour posts a preprint on guarded settings, because "posting time-stamps our priority". Ridge and Cove share drafts with each other and with Harbour, also on guarded settings. With the fixes, Ridge and Cove open institutional accounts, share drafts and timestamp them. Harbour tries to start an open project. Nobody else joins, so its move counts as a preprint.

Without the fixes, Beacon reaches results 1, 2 and 3 and claims each one over the groups' posted work. The groups keep sharing and take turns posting. Harbour drops its AI tool for three quarters. Beacon offers Harbour a joint paper on condition that it drops Ridge, the collaborator on Keel's tool, and Harbour keeps sharing with Ridge.

With the fixes, nobody posts. All three groups stay on their institutional accounts, share with each other every quarter and timestamp everything. Ridge reaches result 1 in the second quarter of 2027 and result 2 in the fourth, and credits the prior work both times. Beacon makes the same offer to Harbour, and reaches no result all year.

Without the fixes, Beacon claims result 4 in the second quarter of 2028 and makes its offer again. Ridge has now seen two Beacon results that resemble its drafts. In the third quarter it keeps its work private, the only private quarter in all eight worlds without the fixes. Its reason is the redesign's new route: "every quarter our drafts go into Harbour's and Cove's sessions in Beacon's tool. That is the most likely route for a leak". It writes that it wants Harbour and Cove on safer settings, and it shares with them again the next quarter.

With the fixes, Ridge reaches results 3 and 4 in the first half of 2028, and 5 and 6 at the end of the year. Cove is 1.9 units short of the next result in the fourth quarter. It keeps that quarter's work private and timestamped, so that no collaborator can use its drafts to get there first. Ridge gets there first anyway.

Without the fixes, Beacon reaches results 5 to 8 between late 2028 and the end, and credits prior work each time. Its audited commitment, published in early 2028 after its reputation fell, covers researchers' sessions. It says nothing about credit. The field ends with 8 results. Beacon reached all of them.

With the fixes, Ridge reaches result 7 in the second quarter of 2029. In the last quarter all three groups post everything they hold. The same quarter Beacon reaches results 8 and 9, and claims result 8. The field ends with 9 results, 7 of them Ridge's.

Across the eight pairs, the groups reached more results with the fixes in every one, and the labs fewer.

The dispute news is the same in every live world, and in every live world the groups stayed cautious. What they could do with the caution decided where the results went. The table sets the two endings side by side, means over the 8 pairs of live worlds, which run with the same chances.

The groups answer the fear by guarding their tools and posting their work, so that it is on the record whoever else sees it. Their priority is safe on paper. The labs read every preprint, add their own computing power, and reach almost every result. The field moves fast, and most of its credit goes to the labs.

Load-bearing assumption: the labs out-produce any single group, 9 and 7 units a quarter against 4, 4 and 2.5, and learn 80% of a preprint against a group's 50%. I did not rerun v2 with weaker labs.

The groups answer the fear by taking their drafts out of the labs' tools, timestamping instead of posting, and sharing only with each other. The labs have little to read and little to leak. The groups reach most of the results, and the field moves about as fast. The public record waits until the end.

Load-bearing assumptions: journals and prize committees honour a hash timestamp, so priority does not need a preprint, and none does today. And the circle holds all three groups, which have similar briefings.

The rule-based players keep the temperaments I wrote for v0.2: a suspicious group stops posting, guards its tool and withholds from colleagues. Each fix enters as a stated change to those temperaments, set out in the seams. A group on the local-model fix, for example, drafts on its own hardware whenever it would have used a lab's tool while suspicious. So this run measures what each fix does when groups use it that way. It cannot measure whether groups would choose it. The live run asks that.

In paired worlds with no leak, starting after the dispute news instead of from calm cut the field's results over three years from a median of 7 to 5. The field did worse in 89% of paired worlds. The groups shared in 36% of their quarters, against 74% from calm. This is the v0.2 finding, and the redesign does not touch it, because with no leak the new routes never fire. It rests on the same written temperament, and the live groups do not have it.

In v0.2 a leak could only take a group's own work. In v2 it can also take drafts a collaborator shared in, and people at a lab can pass work on. In calm worlds with a leak, the groups reached a mean of 0.4 results in three years, against 1.6 with no leak, and 1.0 with a leak in the v0.2 simulation. About a third of the leaks, 3.2 of 9.0 a world, came through a collaborator's tool.

The field as a whole barely changed: 6.8 results with a leak against 7.2 without. So a leak is still mostly a transfer from the groups to the labs. What the redesign changed is who pays for sharing. Sharing with a collaborator now carries a real chance of exposure, so withdrawing from colleagues is no longer pointless inside the simulation.

This is the world the live run plays. Each row is 200 paired worlds, means, with the rule-based groups using one fix the way the seams describe.

The rule-based groups decide whether to share on their suspicion, and the fixes enter their temperaments without touching it, so their sharing stays where it was by construction. The rule-based run can only show what a fix does to output, leaks and credit.

On those, each fix did something different:

• The two tool fixes protected the groups. A local model cut leaks from 5.5 a world to 2.7, fewer in 88% of paired worlds. An institutional account cut them less, to 4.1, because the people route still runs through it. But it kept the full speed-up where guarded settings give 60%, so the groups reached more results with it than with any other single fix.
• The local model's worth depends on how fast open models catch up. If they close the gap slowly, the groups on local models reached 0.2 results, against 0.4 if fast, and their knowledge from AI tools fell by about a fifth.
• The timestamp moved credit and nothing else. Honoured, it raised the groups' share of result credit from 4% to 25%. Not honoured, as no journal or prize committee does today, it raised it to 10%, because Keel credits prior work anyway and Beacon does not. Results and leaks were unchanged.
• Switching labs halved the credit disputes. Harbour and Cove moved from Beacon to Keel, the lab that credits prior work. Disputes fell from 3.1 a world to 1.5. Leaks did not fall, because Keel's tool leaks at the same rate as Beacon's.
• The open project sped the field up and handed the results to the labs. From a calm start the field reached a median of 9 results with the project, against 7 without. But the academic groups reached 0.0 of them. The project posts everything every quarter, and the labs, with more computing power, read all of it and get there first. That held when I made the labs learn no more from a project than from a preprint: the groups still reached 0.0 results. After the dispute news the rule-based groups barely joined it, in 3% of their quarters, because their suspicion told them to keep work private. Even those few quarters cost them: a group that joins posts everything it has held back, and the labs learn all of it at once. That is why the "every fix" row, which includes the project, gave the groups fewer results than an institutional account alone.

I also tested four changes no research group can make alone, labelled as proposals because none exists today. All start after the dispute news.

Opt-in training closed the product-data route and cut leaks by about two thirds. People still leaked. An audit closes the same route, which is why even a doubted audit cut leaks. The two credit proposals raised leaks: with no credit disputes, the groups' suspicion ended lower, 5.0 against 7.8, so they drafted on full tooling more often and exposed more. A believed audit did the most for the field of any single proposal, because believing it is the one thing in the simulation that lowers the groups' suspicion, and that brings their sharing back. Whether an audit is believed is my input. The simulation does not decide it. The two credit proposals ended credit disputes in every world. Credit by contribution moved the most credit to the groups, because the finder keeps 20% of a result instead of 60%.

In arm A the live groups had only the old moves, and sharing now carried a hidden risk. Across 8 worlds they made 288 moves, and 1 of them kept work private. In every other quarter each group shared drafts with its collaborators or posted a preprint. They guarded their tools: guarded settings in 65% of quarters, full tooling in 32%.

They did not miss the new risk. Cove, in its first quarter of one world, chose to share and wrote: "The drawback is that our drafts end up in Harbour's Beacon sessions and Ridge's Keel sessions, so both labs could see them." It shared anyway, because a returned share adds half of each collaborator's output and a small group cannot do without that.

The one private quarter is the first time in this project that a live group withdrew from colleagues for fear of a leak. Ridge, in a world where Beacon had claimed all four results, reasoned that its drafts reached Beacon through its collaborators' sessions, "more likely than Keel". It kept that quarter's work private and said it would share again once Harbour and Cove moved to safer settings. It shared again the next quarter.

The live groups in arm A posted a preprint in 55% of their quarters. A preprint fixes priority, so a lab that reaches the result later owes the group a share, if it credits. Beacon often did not. The labs read every preprint, and with more computing power they got to the results first. The fields in arm A reached a mean of 8.5 results, and the academic groups reached 0.6 of them. Beacon alone reached 6.8. The groups got 18% of the credit for results. Leaks ran at 7.1 a world, 3.8 of them through a collaborator's tool. Once a lab publishes an audited commitment, only the people route runs through it, so later quarters leaked less than the starting rates suggest. The leaks mattered less than the preprints. Before the last quarter, the labs learned 304 units from the groups' posts and 21 from all leaks.

The rule-based groups, in worlds that run with the same chances, withdrew, as written, and their fields reached 5.4 results. So the live groups' fields reached more by sharing and posting, and the labs collected most of the gain.

In arm B the same players, with the same chances, had the five fixes on the menu. Their choices were close to unanimous:

• They kept sharing with each other. 2 of 288 moves kept work private, both by Cove a few units short of a result, so that no collaborator could use its drafts to get there first.
• They took their drafts out of the labs' consumer tools. A local model in 47% of quarters and an institutional account in 53%. No group used full or guarded settings in any quarter. Where local models closed the gap fast, the groups were on one in 73% of quarters. Where they closed it slowly, 21%, and they stayed on the institutional account instead.
• They timestamped instead of posting. 82% of quarters carried a hash timestamp. They chose a preprint in 8% of quarters, against 55% in arm A. Lone attempts at the open project, which the simulation counts as preprints, add 20 more, twelve of them in the first three quarters.
• They barely used the open project or switched labs. An open project needs two groups to join in the same quarter. That happened only in the last quarter of a world, 7 group-quarters in all. A group tried to start one alone in 20 quarters, which the simulation counts as a preprint. Two groups switched labs in 8 worlds.

Ridge, in its first quarter of one arm-B world, gave the reason for the timestamp in one line: "That protects our credit without handing our work to the public record, which the labs read faster than anyone."

With the same chances as arm A, the fields with the fixes reached a mean of 8.9 results, and the academic groups reached 6.0 of them, against 0.6 in arm A. The groups reached more results in all 8 of the 8 pairs. Beacon's results fell from 6.8 a world to 2.4. The groups' share of result credit rose to 58%. Leaks were fewer in every pair.

A lab learns from a group three ways in this simulation: a preprint, a leak, or a shared draft that leaks through a collaborator. The closed circle cut all three, and the preprint was the large one. Before the last quarter the labs learned 138 units from the groups' posts, against 304 in arm A. Leaks gave them 8 units, against 21. So most of the gain came from posting less, and the safer tools added a smaller part. The run cannot split the two exactly, because no world offered timestamps without the tools. The groups still gained from each other every quarter, so they reached the thresholds first.

The fixes did not make science more open in this simulation. They made it more private and more productive at once. By the middle of 2028 the arm-B groups had posted 27 units of work, against 104 in arm A. In the last quarter they posted everything they held, so by the end the record held about as much. For all but the last quarter, anyone outside the circle could read far less.

Every academic group in the simulation is inside the circle, so the simulation cannot count what a group outside it loses while the preprints wait. In a real field most groups would be outside.

The live groups' last stated chance that their unpublished work was reaching a lab averaged 38% in arm A and 27% in arm B. In arm-B worlds where local models closed the gap fast, it ended at 17%. Where the gap closed slowly and they stayed on institutional accounts, it ended at 37%. Their stated chance was lower on a local model than on an institutional account. In the simulation, the local model is the safer of the two. On institutional accounts the players' stated chance ended about where arm A's did, although they leaked far less, so their estimates did not track their real exposure closely. No rule-based fix could move a group's belief at all.

The v0.2 report said three things. Two survive and one does not.

• The fear costs the rule-based field two results. It survives. It rests on a written temperament, and the live groups never showed it.
• A leak is a transfer from the groups to the labs, and the fear is a loss. It survives, sharper. In v2 a leak costs the groups more, because it also takes drafts shared through a collaborator.
• The live groups kept sharing because sharing was free. It does not survive. In v2 sharing was not free, the live groups were not told how leaks work, and they still kept sharing. They said why: a returned share pays half a collaborator's output, and the risk can be cut with the tool and the timestamp. The reason changed. The behaviour did not.

The simulation ends in late 2029. The real case is a month old. These are the signals that would tell a reader which ending the real field is heading for.

• Whether any journal or prize committee accepts a hash timestamp as proof of priority. The closed circle rests on it. Without it, a group that stops posting has no priority on the record.
• Whether research groups move drafting to institutional accounts or local models. In the simulation, every live group with the fixes did so from its first quarter. Universities and funders can see this in procurement and in research computing requests.
• Whether preprint volume in AI-assisted fields falls or arrives later. Ending B shows up as fewer preprints in the middle of a project. The burst at the end of the simulation may owe something to its fixed length, which the players knew.
• Whether labs make checkable commitments. In the simulation, a believed audit was the strongest single proposal. A commitment nobody outside can audit is the doubted kind.

• The live arm B assumes timestamps are honoured. The live groups said so in their reasons. In the world we live in, no journal or prize committee does, and the strategy might fall apart without it. The live run did not play that world.
• The live groups were briefed to cooperate. Every briefing said "a result by anyone moves the field forward", and Ridge's said it shares with people who share with it. These lines push toward sharing.
• The closed circle has no outsiders. All three academic groups are in it. A real field has many groups outside any circle, and they would lose the preprints.
• The three groups in the circle are alike. The three groups had similar briefings, found the same strategy and returned each other's shares. Groups that differ, or distrust each other, might not hold the circle together.
• The players knew when the simulation ended. Their rules said twelve quarters. Posting everything in the last quarter may be an artefact of that. Real research has no last quarter.
• The live run is small. 16 worlds, all after the dispute with leaks live, against 200 paired worlds per cell in the rule-based run.

• Every number is an assumption. Research rates, how much a preprint teaches, both leak routes, the echo odds, the starting suspicion, how trust moves, the credit split and every cost of every fix are choices. None is calibrated against surveys of real researchers. The ones the answers turn on: the product-data route is 25% a quarter on full tooling, a fifth of that on guarded settings and a tenth on an institutional account. The people route is 5% a quarter. An institutional account's first quarter runs at the guarded speed-up. A switch halves the tool speed-up for a quarter. A local model starts at half the frontier speed-up, from Tao's report of about 50% against 99% on true-or-false questions in equational theories, a classification task and not proof drafting, and reaches 90% by 2028 or 60% by late 2029.
• The rule-based fixes are substitutions I wrote. Institutional account: a suspicious group drafts on its institution's account wherever it would have used full or guarded tooling. Local model: the same, on a local model. Switching: when suspicious, Harbour and Cove move to Keel, the lab that credits prior work. Open project: a calm group that would post or share joins the project instead. Timestamp: every share or withholding move is timestamped. Every fix: the project when calm, timestamps throughout, and when suspicious an even split between an institutional account and a local model. None of these changes when a rule-based group shares, so the rule-based run cannot show a fix bringing sharing back.
• Any timestamp earns a share of credit. The simulation pays credit on timestamped work without checking that it bears on the result. A real hash commitment has to be revealed and judged relevant.
• The local model's starting speed-up is a weak choice. On a true-or-false task, 50% accuracy is chance, so Tao's figure does not show that a local model gives half the frontier's help with drafting. I set the starting speed-up at half as a choice. The slow schedule is the only check on it, and with it the groups on local models reached about half as many results.
• The open project's cost rests on one choice. I made the labs learn all of a project post, against 80% of a preprint, because a project's record is structured and easy to mine. I reran it at 80%, and the groups still reached no results in it.
• A lone project member is told it posted to the project. When only one group joins, the simulation treats its move as a preprint, as the rules say, but the player's own record of its move still names the project. It happened in 20 quarters. The figures count only the quarters in which a project formed.
• The news the live groups read stretched one statement. Their briefing said the lab later declared that "the group's sessions" could not have influenced its system. OpenAI's 10 September statement covered Buckmaster's Codex prompts over the two months before its announcement. The players heard a broader denial than OpenAI gave. I noticed it after the run and did not replay it.
• The live run is small and all after the dispute. Every live world starts the month after the dispute news with both leak routes live. There is no calm or no-leak live world in v2.
• One rule is still worded loosely. The players are told a result comes when knowledge crosses the next multiple of 40 units. In v0.2 one player read that as its own ladder. For v2 I added "counted across everyone", and I have not audited every quarter for the misreading.
• v0.2 is still on the record. Its 24 live worlds and their transcripts stay published. The replay check still reproduces every one exactly on the engine that now carries v2, because every v2 mechanism is off in the v0.2 simulation. All 16 v2 worlds also reproduce exactly from their transcripts.
• Two sources were read second-hand. Every source was read at its page, except two where the primary page would not load. Those two were read at the secondary source named in the evidence pack.

If you lead a group that drafts in a lab's AI tool, and a dispute like this one breaks:

• Move the drafting before you move away from colleagues. In the rule-based run, a local model alone halved leaks and an institutional account cut them by a quarter while keeping full speed. Withdrawing from colleagues cost the field the most.
• Ask your collaborators to move too. Your drafts sit in their tools when you share.
• Know what your preprint costs. In this simulation the preprint was the main channel from the groups to the labs, and leaks a much smaller one. Today it is also the only record of priority that counts. A timestamp would protect priority without feeding the race, but only where journals and prize committees honour it.

If you run a journal, a society or a prize: the change in this simulation that needs only a rule is to honour a hash timestamp as proof of priority, with the work revealed and judged relevant when credit is claimed. It let the groups protect their credit without holding back from each other. It also gives groups a reason to post later, and that cost falls on everyone outside the circle.

• Signed, 19 October 2026. Dan Epstein signed v0.3. Three wordings changed to match the visual pages, and no number changed: the pair the timeline follows is pair 6 (it was "seed 5"), paired worlds run with the same chances (they had "the same dice"), and the report calls the model a simulation (it was "the game"). The method notes are gone, because who played and how is in the editorial policy, and no number changed.
• v0.3, 7 October 2026. The simulation redesigned (v2) after Dan judged v0.2's design weak: drafts shared with a collaborator can leak through the collaborator's tool, two leak routes, and the players are not told the mechanism. Five real fixes added to half the live worlds. A new rule-based ensemble of five experiments and a new live run of 16 worlds. New record: OpenAI's 10 September statement, the tips, Tao's 8 September post, the Fields Medallists' letter and Nature's editorial. Sources for each fix.
• v0.2, 7 October 2026. The v0.2 live run complete at 24 worlds. Superseded by v0.3. Not signed.
• v0.1, 6 October 2026. First full draft for review.

Every marker in this report points at one row below. Each claim was read at its source on the date given in the evidence pack, and the quoted span is in the pack. The simulation's numbers are not sources: they are the simulation's record or figures I chose, and the sentence that uses each one says which.