A reachable-state separation between attention compression and its certificates

Does a certificate’s refusal reflect the model’s sensitivity or information lost by the proof? At a 7,168-token prompt in frozen SmolLM2-135M, we find a separation between the two. First, the specified centroid/coordinate-box and scalar-envelope certificate still refuses tenfold grouping after replacing its global readout gain with a sound local enclosure. Exact packing witnesses require at least 28.88% of dense final-layer interactions, even with optimal allocation between heads. Second, a concrete tenfold grouping has a checked one-intervention sequence total variation of 1.148 × 10⁻⁵, and a probability-weighted checker permits repeated interventions with a 1,024-token sequence guarantee below 0.000924. The passing checker evaluates the dense reference and is slower than dense decoding. Code, replay data and supporting material: https://github.com/SamMausberg/attention-reachable-public-replay