Match extra GPT-3.5-class compute two ways on the APPS backdoor game Greenblatt et al. already run: as additional RLHF / constitutional / debate training signal (gradients through the constraint) versus as a frozen halt-or-defer monitor (no gradient). If the training-signal condition Goodharts under more PPO steps and the frozen monitor holds, 3-layer isolation is doing the work; if they track, the 15→92 jump is more evals. The Unix analogue is Chrome's consequence class — whether a renderer bug becomes user-principal compromise — not renderer CVE count. Author dispositions stay author-owned.