Dream-RSI: The Safety Property They Built and Never Claimed

Dream-RSI (arXiv 2609.14858) is a genuinely elegant idea from seventeen authors at Google, Google DeepMind, the University of Maryland and the University of Virginia: a finished discovery run is a tree in which every node already carries its outcome, so an alternative exploration policy can be scored by re-walking that recorded history at zero executions, and the thing that improves is not the model but an executable exploration policy — a Python class deciding where the agent branches, what runs in parallel, and when to stop — while the coding agent, its weights, the evaluator, the execution interfaces and every prompt stay frozen. That frozen/mutable split is a containment boundary: a self-improving loop that structurally cannot rewrite its own objective, and therefore cannot reward-hack its own scorer. The paper never once says that is why, and in twelve pages by the authors' own count, thirty-six with appendices, the words safety, oversight, containment, alignment and shutdown are used in their AI-safety sense exactly zero times — the only literal hits being a // Safety limit check comment in a machine-generated C++ solver, five _builtinassume_aligned macros, and the surname Sharma. There is no Limitations section, no Broader Impact statement and no Future Work. One member of the public asked, on the authors' own issue tracker, whether the frozen/mutable boundary is intended as a safety property or is purely a cost decision; the issue is open with zero comments, as are the other three. Along the way this episode reads the paper's "can never get worse" claim against the launch site's version of it and finds eleven words of scope deleted, audits the results table and finds that the headline Lasso row regresses on five of six held-out datasets while the average improves because that average is an unweighted mean over columns spanning a factor of 891, reports the other backbone's genuine clean win at full weight, surfaces a buried Analysis finding that injecting distilled lessons-learned from prior runs made things consistently worse — a result that contradicts RSIAgent, submitted to arXiv the same day, ten hours and thirty-six minutes later — and refutes its own planned audience hook by measuring 1,497 Claude Code sessions and 22 Codex sessions and finding that mainstream agent logs do not retain enough of a decision tree to replay anything.