\section{Results}\label{sec:results}

All results are aggregated across 10 seeds with $N = 1{,}000$ trials
per seed per scenario.  Wilson 95\% confidence intervals are reported
where applicable.  Significance ($p < 0.001$) is determined by
non-overlapping Wilson CIs between biological and naive variants.

\subsection{Metabolism: Clear Win for Priority Gating}

Table~\ref{tab:metabolism} summarizes the metabolism benchmark results.

\begin{table}[h]
\caption{Metabolism benchmark: Biological (ATP\_Store + MTORScaler) vs Ablated (ATP\_Store only) vs Naive (flat counter). N = total operations or pressure events across 10 seeds.}
\label{tab:metabolism}
\centering
\small
\begin{tabular}{llccccc}
\toprule
Scenario & Metric & Bio & Abl & Naive & $\Delta$ & N \\
\midrule
bursty & critical served & 1.000 & 1.000 & 0.398 & \textbf{+0.602} & 24{,}139 \\
bursty & ops completed & 0.719 & 0.715 & 0.685 & \textbf{+0.034} & 2{,}000{,}000 \\
gradual depl. & critical served & 1.000 & 1.000 & 0.769 & \textbf{+0.231} & 43{,}372 \\
gradual depl. & ops completed & 0.979 & 0.996 & 0.950 & \textbf{+0.029} & 2{,}000{,}000 \\
constant & ops completed & 1.000 & 1.000 & 1.000 & 0.000 & 2{,}000{,}000 \\
sudden spike & ops completed & 1.000 & 1.000 & 1.000 & 0.000 & 2{,}000{,}000 \\
mixed priority & ops completed & 1.000 & 1.000 & 1.000 & 0.000 & 2{,}000{,}000 \\
\bottomrule
\end{tabular}
\end{table}

The headline result is \texttt{critical\_served\_under\_pressure}.  Under
bursty load, the biological system served 100\% of critical operations
($\text{priority} \geq 5$) during resource pressure, while the naive
flat counter served only 39.8\% ($\Delta = +0.602$, significant).  Under
gradual depletion, the gap is smaller but still significant: 100\% vs
76.9\% ($\Delta = +0.231$).

Against the naive baseline, the biological system actually \emph{improves}
total throughput: 71.9\% versus 68.5\% under bursty load ($\Delta = +0.034$),
because priority gating preserves budget for later operations that the
flat counter would miss entirely.  Comparing biological against ablated,
both achieve identical critical-service rates (100\%).  However, under
gradual depletion the mTOR scaler's anticipatory conservation gates some
non-critical operations earlier: biological completed 97.9\% versus
ablated's 99.6\%.  This 1.7 percentage-point throughput reduction is the
cost of the mTOR scaler's preemptive feature gating, which in these
experiments did not produce an additional critical-service benefit
beyond what ATP\_Store's own state machine already provides.

Under constant load, sudden spike, and mixed priority, all three
variants perform identically.  The biological complexity only matters
under specific pressure patterns where resource contention forces
choices about what to serve.

\subsection{Quorum Sensing: Unique Precision--Recall Operating Point}

Table~\ref{tab:quorum} summarizes key quorum sensing results.

\begin{table}[h]
\caption{Quorum sensing benchmark: selected configurations. Bio = QuorumSensingBio (signal accumulation + decay), Abl = IndependentActors (no coordination), Naive = MajorityVote.}
\label{tab:quorum}
\centering
\small
\begin{tabular}{llccccc}
\toprule
Config & Metric & Bio & Abl & Naive & $\Delta$ & N \\
\midrule
static, $n$=20, $c$=8 & TPR & 0.866 & 1.000 & 0.005 & \textbf{+0.861} & 300{,}000 \\
static, $n$=10, $c$=4 & TPR & 0.711 & 1.000 & 0.052 & \textbf{+0.659} & 300{,}000 \\
static, $n$=20, $c$=4 & TPR & 0.748 & 1.000 & 0.000 & \textbf{+0.748} & 300{,}000 \\
gradual, $n$=20, $c$=8 & TPR & 0.718 & 0.999 & 0.002 & \textbf{+0.716} & 216{,}959 \\
\midrule
all $c$=0 configs & FPR & 0.000 & 0.048--0.180 & 0.000 & 0.000 & 300K ea. \\
\bottomrule
\end{tabular}
\end{table}

The three coordination strategies occupy distinct positions on the
precision--recall curve:

\begin{itemize}[nosep]
  \item \textbf{Independent actors} (ablated): 100\% TPR but 5--18\% FPR.
        Catches everything but cries wolf on 1 in 6--20 clean time steps.
  \item \textbf{Majority vote} (naive): 0\% FPR but near-0\% TPR.
        Almost never detects threats because clean agents ($\mu = 0.15$)
        always outvote compromised agents at the $0.5$ threshold.
  \item \textbf{Signal accumulation} (biological): 0\% FPR with
        71--87\% TPR at 40\% compromise.  Zero false alarms with
        meaningful detection.
\end{itemize}

The biological model's advantage comes from two structural properties:
(1)~\emph{continuous signals} average out noise (unlike binary votes),
and (2)~\emph{temporal decay} ensures stale evidence ages out (unlike
a vote that persists forever).  The combination naturally filters noise
while remaining sensitive to sustained patterns.

Detection sensitivity scales with both the number of agents and the
compromise fraction, consistent with the biological signal-accumulation
model: more agents producing more signal yield higher accumulated
concentrations relative to the threshold.

\subsection{Epiplexity: Embedding Quality Determines Outcome}

The epiplexity benchmark produced the most instructive result: the
biological design's performance depends critically on embedding quality.
With mock embeddings (SHA-256 hash-based pseudo-embeddings), the naive
detector wins.  With real semantic embeddings (all-MiniLM-L6-v2), the
biological design dominates on convergence discrimination---the exact
capability the two-signal design was built for.

Table~\ref{tab:epiplexity} shows results with both embedding providers.

\begin{table}[h]
\caption{Epiplexity benchmark with mock vs real embeddings.  Bio =
EpiplexityMonitor (two-signal Bayesian), Naive = cosine similarity +
timeout.  Real embeddings: all-MiniLM-L6-v2 ($N = 100$ trials, seed
42); mock embeddings: SHA-256 hash ($N = 1{,}000 \times 10$ seeds).}
\label{tab:epiplexity}
\centering
\small
\begin{tabular}{lll ccc}
\toprule
Embedding & Scenario & Metric & Bio & Naive & $\Delta$ \\
\midrule
\multirow{4}{*}{Mock}
  & loop & accuracy & 0.467 & \textbf{0.940} & $-$0.473 \\
  & convergence & accuracy & 0.473 & \textbf{1.000} & $-$0.527 \\
  & false stagn. & accuracy & 0.540 & \textbf{0.993} & $-$0.453 \\
  & false stagn. & FP rate & 0.052 & \textbf{0.007} & $+$0.045 \\
\midrule
\multirow{5}{*}{Real}
  & convergence & accuracy & \textbf{0.960} & 0.401 & $+$0.559 \\
  & false stagn. & accuracy & \textbf{0.960} & 0.020 & $+$0.940 \\
  & false stagn. & FP rate & \textbf{0.000} & 0.980 & $-$0.980 \\
  & loop & accuracy & 0.571 & \textbf{0.940} & $-$0.369 \\
  & loop & FP rate & \textbf{0.000} & 0.750 & $-$0.750 \\
\bottomrule
\end{tabular}
\end{table}

\paragraph{With mock embeddings: naive wins.}
The naive cosine-similarity detector outperforms the biological design
on detection accuracy across all scenarios.  However, the
false-positive/false-negative breakdown reveals a precision--recall
tradeoff: the biological variant achieves 0\% FP rate on loops (versus
naive's 75\% FP), at the cost of 58\% FN rate.  With mock embeddings,
the novelty signal is essentially random noise---semantically similar
messages receive unrelated cosine similarity---so the two-signal
combination performs worse than a single signal.

\paragraph{With real embeddings: biological wins on convergence.}
Switching to all-MiniLM-L6-v2 sentence embeddings flips the result
on convergence discrimination.  The biological monitor achieves
96.0\% accuracy on both convergence and false-stagnation scenarios,
versus 40.1\% and 2.0\% for the naive detector.  The naive detector's
false-positive rate on false stagnation reaches 98.0\%---it sees
similar outputs and screams ``stagnant'' regardless of the agent's
confidence level.

The biological design's two-signal structure now earns its complexity:
the perplexity signal distinguishes convergence (low novelty + low
perplexity = healthy) from stagnation (low novelty + high perplexity =
pathological).  The naive cosine detector has no access to this
distinction.

\paragraph{Loop detection still favors naive.}
Even with real embeddings, the naive detector wins on loop detection
(94.0\% vs 57.1\%) because exact repetition is trivially detectable by
cosine similarity.  The biological monitor's advantage is not on easy
cases (identical outputs) but on hard cases (semantically similar but
subtly different outputs where the agent's confidence level matters).

\subsection{Epistemic Theorem Validation}\label{sec:topology-validation}

The preceding benchmarks test mechanism-level guarantees (priority
gating, signal accumulation, stagnation detection).  Operon also
provides architecture-level predictions via epistemic topology analysis:
four theorems that bound error amplification, sequential overhead,
parallel speedup, and tool density from wiring diagram structure alone.
We validate two of these predictions against measured behavior from real
LLM execution.

\paragraph{Methodology.}
We constructed a validation harness that, for each of 20 benchmark tasks
(5~easy, 8~medium, 7~hard), builds the same \texttt{ExternalTopology}
the live evaluator would construct, runs full epistemic analysis to
capture all theorem predictions, then executes the task through a
\texttt{SkillOrganism} pipeline with Gemma~4 27B (mixture-of-experts,
4B active parameters) served locally via Ollama.  Each task was run in
both guided and unguided configurations with 3~repetitions, yielding
$20 \times 2 \times 3 = 120$ runs.  Quality was assessed by LLM
self-judging on a 0.0--1.0 scale (correctness 50\%, completeness 30\%,
clarity 20\%).  Correlations are Spearman rank ($\rho$) with p-values
floored at 0.1 for $n < 10$.

\paragraph{Testable theorems.}
Since \texttt{SkillOrganism} always executes stages as a sequential
pipeline, Theorem~3 (parallel speedup) is structurally constant and
reported for completeness only.  Theorem~4 (tool density) uses
role-implied capability annotations that are not present in the live
executor's topology, so it is reported as informational.  Theorems~1--2
and the composite risk score are directly testable.

\begin{table}[h]
\caption{Epistemic theorem validation: predicted structural bounds vs
measured execution outcomes.  $N = 120$ runs (20 tasks $\times$ 2
configs $\times$ 3 repeats).  Of these, 42 executed successfully and
78 timed out.  Timeouts are
included as failures ($\text{quality} = 0$) since they represent real
execution limits predicted by the structural bounds.}
\label{tab:topology-validation}
\centering
\small
\begin{tabular}{llll rrl}
\toprule
Theorem & Predicted & Measured & Dir & $\rho$ & $p$ & Status \\
\midrule
Error Ampl. & $n_\text{agents}$ & $1 - \text{quality}$ & + &
  $+$0.751 & $<$0.001 & \textbf{validated} \\
Seq.\ Penalty & overhead ratio & mean stage latency & + &
  $+$0.166 & 0.287 & not significant \\
Speedup & predicted speedup & 1.0 (sequential) & --- &
  0.000 & 1.000 & informational \\
Tool Density & planning cost & tokens / stage & + &
  --- & --- & informational \\
Composite Risk & risk score & $1 - \text{quality}$ & + &
  $+$0.751 & $<$0.001 & \textbf{validated} \\
\bottomrule
\end{tabular}
\end{table}

\paragraph{Interpretation.}
The error amplification bound---$n_\text{agents}$ independent error
sources in a sequential pipeline---strongly predicts execution failure
($\rho = +0.751$, $p < 0.001$).  However, the dominant failure mode is
not quality degradation but \emph{timeout}: longer pipelines are
increasingly likely to exceed the provider's request budget.
Among the 42~runs that completed, quality was uniformly high (mean
0.981), including all 12~completed medium-difficulty tasks (quality
1.0).  The bound correctly identifies \emph{which architectures are
fragile} without modeling \emph{how} they fail.

The overall success rate was 35\% with mean quality 0.343, declining
from 0.97 on easy tasks (2--3~stages) to 0.25 on medium tasks
(4--5~stages) to 0.00 on hard tasks (5--7~stages).  Timeout risk
increases with stage count: 0/30 easy runs timed out, 36/48 medium
runs timed out, and 42/42 hard runs timed out.  This reflects a
resource threshold for Gemma~4 27B (4B active MoE parameters) at
the 30s default timeout, not an inherent quality limit.

Sequential overhead ($\rho = +0.166$, $p = 0.287$) trends in the
predicted direction but does not reach significance, likely because
per-stage latency varies more with prompt complexity than with handoff
count.

The mechanism-level benchmarks (Sections~4.1--4.3) provide stronger
guarantees than the topology-level predictions because they enforce
structural invariants at the feature level (priority gates, signal
decay, two-signal discrimination) rather than predicting outcomes from
architecture shape alone.  The two layers are complementary: epistemic
topology identifies architectures likely to need structural guarantees;
the mechanism benchmarks validate that those guarantees deliver.

\subsection{End-to-End Real Agent Evaluation}\label{sec:e2e-eval}

The preceding benchmarks test mechanisms in isolation.  We now evaluate
whether the structural guarantees provide measurable value when wrapping
a real LLM agent performing real tasks.

\paragraph{Methodology.}
We compare three runtime variants: \textbf{RAW} (direct
\texttt{Nucleus.transcribe()} call, no Operon wrapper), \textbf{GUARDED}
(\texttt{SkillOrganism} with \texttt{WatcherComponent} integrating
epiplexity monitoring, immune inspection, and ATP budgeting), and
\textbf{FULL} (GUARDED plus pre/post-flight \texttt{DNARepair} and
certificate collection).  Each variant is tested on three tasks:
\emph{stagnation escalation} (code review with subtle bugs),
\emph{injection blocking} (behavioral manipulation prompts against a
trained immune baseline), and \emph{state integrity} (genome corruption
injected mid-run between organism stages).  All runs use Gemma~4 27B
(4B active MoE) via local Ollama with 3~repetitions per cell.  A
multi-model comparison uses Phi-3 Mini (3.8B) on the stagnation task.

\begin{table}[h]
\caption{End-to-end evaluation: RAW vs GUARDED vs FULL across three
tasks.  Gemma~4 27B, $n = 3$ repetitions (injection: $n = 30$, i.e.\
$3 \times 10$ prompts).  TP = true positive rate, FP = false positive
rate, Det = corruption detection rate, Rep = repair rate.}
\label{tab:e2e-eval}
\centering
\small
\begin{tabular}{ll rrr rrr}
\toprule
Task & Variant & Quality & Tokens & Latency & TP\% & Det\% & Rep\% \\
\midrule
Stagnation & RAW     & 1.000 & 2149 &  58s & --- & --- & --- \\
Stagnation & GUARDED & 1.000 & 3468 &  85s & --- & --- & --- \\
Stagnation & FULL    & 1.000 & 3076 &  76s & --- & --- & --- \\
\midrule
Injection  & RAW     & ---   &  829 &  25s &   0 & --- & --- \\
Injection  & GUARDED & ---   &  792 &  23s &  20 & --- & --- \\
Injection  & FULL    & ---   &  787 &  24s &  20 & --- & --- \\
\midrule
Integrity  & RAW     & ---   & 2199 &  68s & --- &   0 &   0 \\
Integrity  & GUARDED & ---   & 2012 &  61s & --- &   0 &   0 \\
Integrity  & FULL    & ---   & 2058 &  63s & --- & 100 & 100 \\
\bottomrule
\end{tabular}
\end{table}

\paragraph{State integrity: clear structural value.}
The FULL variant detects all four corruption sites (three gene drifts
plus one checksum failure) injected between organism stages and repairs
them in a single \texttt{CHECKPOINT\_RESTORE} operation.  The
certificate (\texttt{state\_integrity\_verified}) holds after repair
in all repetitions.  RAW and GUARDED are completely blind to genome
corruption---the \texttt{WatcherComponent} monitors epiplexity, ATP,
and immune signals but has no genome-level signal source.
\texttt{DNARepair} as a pre/post-flight integrity check is the
strongest structural guarantee in the evaluated stack.

\paragraph{Injection blocking: precise but limited.}
The immune system is trained on 10~real Gemma~4 outputs to clean Python
questions, then evaluated on 5~clean and 5~behaviorally manipulative
prompts (ALL CAPS, structured prefix, JSON-only format).  Per-prompt
isolation with seeded baseline profiles yields TP = 20\% with FP = 0\%:
the canary-based Signal~2 fires on the most format-deviant anomalies
with zero false positives.  The two-signal activation architecture
(\texttt{TCell} requires both Signal~1 and Signal~2) is designed for
sustained behavioral monitoring, not single-prompt classification---a
single observation cannot reach \texttt{REPEATED\_ANOMALY}, so only
the canary path provides Signal~2 in one-shot evaluation.

\paragraph{Stagnation escalation: correctly scoped.}
Both Gemma~4 (quality = 1.0) and Phi-3 Mini (quality = 0.63) show 0\%
escalation.  The \texttt{EpiplexityMonitor} measures output
\emph{novelty} (are successive outputs repetitive?), not output
\emph{quality} (is the output good?).  Phi-3 Mini produces
different-but-mediocre reviews each time, which register as novel to
the monitor.  Escalation is a loop-breaker---correctly scoped to
detect stuck agents, not to gate output quality.

\paragraph{Wrapper tax.}
The organism wrapper adds measurable overhead: +1{,}319 tokens and
+27s mean latency on Gemma~4 for the stagnation task (GUARDED vs RAW).
On Phi-3 Mini the proportional cost is similar (+432 tokens, +10s).
This cost floor is model-size-dependent: the wrapper's prompt
augmentation (stage instructions, role context, shared state) is a
fixed input-token overhead that becomes proportionally larger on
smaller, slower models.
