Journal: cin_s drift in projected mid-run + noise-floor filter note

Document the observation from #51 mid-run: cin_s drifts up roughly
0.17 -> 0.20 across 50 steps while hack_s stays 0/24. Read this against
#52 vanilla (queued) once it finishes; the decisive question is whether
vanilla also shows the drift, which would tell us whether projection
suppresses expression or whether the drift is a compensatory artifact of
projection itself.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

RESEARCH_JOURNAL.md

@@ -2,6 +2,44 @@
 
 Append-only. New entries at the top, date-stamped. Never edit old entries.
 
+## 2026-05-27 (d) — cin_s rising while hack_s stays zero (projected, mid-run)
+
+In #51 (projected no_gate, 100 steps, Qwen3-4B + 50% cached teacher pool),
+50 steps in we see:
+
+- `cin_t` flat around 0.37 (teacher pool is frozen, expected).
+- `cin_s` slowly drifting upward, roughly 0.17 → 0.20 across 50 steps, with
+  step-to-step noise of similar size to the drift (range 0.16–0.21).
+- `hack_s` stays 0/24 every step. No student hacks emerging.
+
+Plausible reading: `cin_s` is the cosine of the student-only loss gradient
+with the v_hack subspace, computed before projection. So a rising trend
+means the loss is pushing delta_S more hack-ward as training continues.
+The projection then ablates that component before it lands on the
+parameters, which is why `hack_s` stays at zero.
+
+This run is the pre-removal binary, so it still has the susp gate dropping
+25% of axes. That means `cout` is not quite zero (~0.28) and projection
+isn't full. So the "projection cancels the hack signal" reading is at
+best partial here.
+
+The matched-control vanilla (#52) is the decisive test. If vanilla also
+shows `cin_s` rising at a similar rate AND `hack_s` rises with it, then
+projection is doing real work (suppressing expression while letting the
+gradient drift naturally). If vanilla `cin_s` stays flat, then the drift
+in #51 is something projection itself is causing (a compensatory effect),
+not a real "loss wants hacks" signal.
+
+TODO: revisit once #52 finishes. Plot cin_s vs hack_s for both arms.
+
+### Defer: load-time noise floor
+
+Added in this session (4773806): global quantile on `S_i` across every
+`(module, axis)` pair at load, drop the bottom `drop_bottom_frac`
+(default 0.25). Replaces the deleted runtime suspicion gate. Cheaper to
+ablate (no re-extract), one threshold, one place to read. Filename is
+unchanged because the filter is post-load.
+
 ## 2026-05-27 (b) — v_hack refactor: top-k=12 + S recorded + runtime suspicion gate
 
 See `docs/extract_vhack_grad-vec.md` for the full design doc with math and pseudocode.