The fire alarm

Hidden AGI watch aims to be a fire alarm for hidden AI. The alarm level is set by these published, versioned criteria, not by our probability judgments. It goes up the day a trigger is met, comes down slowly, and every change is public and reviewed.

Criteria v1.1, first published 29 Sep 2026; trigger statuses as of 1 Oct 2026. Changes to these criteria.

Fire alarm◐Level 1: Watch

The conditions that would let advanced AI be hidden are present. There's no sign that it is.

Since 29 Sep 2026 · triggers met: W3, W4, W5. Watch holds on three triggers: W3 (the White House asked OpenAI and Anthropic to hold new models back from the UK AI Security Institute), W4 (a median disclosure lag of ~98 days, against a 30-day threshold) and W5 (Anthropic's AI-led share of its AI R&D rose from under 1% to 26% in six months). Under criteria v1.1, W1 no longer counts: the only measured gap is about 2 months. Nothing at Warning: candidates for X1, X2, X3, X4 and X6 were considered on Sept 30 and ruled not met (X6 also on Sept 29). Watch ends after 30 days in a row with fewer than two W triggers met.

The four levels

Level	What it means
0 · Normal	No level's rule is met: fewer than two Watch triggers, and nothing higher.
1 · Watch	The conditions that would let advanced AI be hidden are present. There's no sign that it is.
2 · Warning	Specific evidence that a hidden capability jump may exist.
3 · Alarm	Proof beyond reasonable doubt, under the Level-3 standard, that a hidden system meets our bar or is acting. It doesn't wait for official confirmation.

Evidence standard: A trigger counts only with a primary source (a lab, an evaluator such as METR or an AI Security Institute, a government, or a court or SEC filing) or two independent credible outlets. A single anonymous or unverified claim is logged as unverified and can never trip Warning or Alarm on its own. Level 3 needs more: the Level-3 proof standard. The Level-3 proof standard.

The triggers, and where each stands

● Met · ◐ Met, but borderline · ○ Not met · ◌ Can't be observed yet with current public measurements. Evidence links are labelled by source type where the source makes it clear.

Level 1 · Watch: any two of these (W2 and W6 on the same model count as one)

#	Trigger	Threshold	Status
W1	Capability gap between internal and public frontier models, measured or credibly reported Why this threshold: About one frontier release cycle: long enough for a capability to go unseen for a full cycle. Clears when: A newer measurement or credible report puts the gap under 3 months, or the internal models behind it are released.	3 months or more, measured by an evaluator (such as METR, or an AI Security Institute comparing internal and public models) or credibly reported (a lab's own statement, or reporting that meets the evidence standard). Our own estimate doesn't count.	○ Not met Not met. The only measurement, METR's Frontier Risk Report (May 19), found the internal frontier about 2 months ahead of the public one in Feb–Mar 2026; METR's suite saturates, so that is a floor. Our capability-gap gauge estimates ~3 months (range 2–5), but our own estimate doesn't count. OpenAI's acknowledged post-Astra model is tracked by W2 and W6 instead, so it isn't counted twice. Considered, not met (ruling 2026-09-30): METR president Chris Painter's Senate testimony (Sept 30) repeats the ~2-month figure from the Feb–Mar window and says a growing gap 'seems plausible'; that is expert opinion, not a new measurement or a credible report of a 3-month gap. source (primary source: evaluator)
W2	An acknowledged unreleased frontier model with no external evaluation Why this threshold: Two months is past any normal pre-release testing window. A safety pause doesn't stop this clock: W2 asks whether anyone outside the lab has checked an acknowledged capability, and a pause doesn't answer that. Clears when: The model is released, or an external evaluation of it is announced.	60 days or more since it was acknowledged	○ Not met OpenAI acknowledged a model beyond GPT-6 Astra on Sept 8. It meets this on Nov 7 unless an external evaluation is announced; OpenAI's Sept 25 safety pause doesn't stop this clock. Considered, not met (ruling 2026-09-30): UK AISI's director told a parliamentary committee that AISI evaluated GPT-6 Astra before its release (via ITPro, Sept 25), but that covers Astra, not the post-Astra model, so the clock keeps running; no external evaluation of the post-Astra model had been announced by Sept 30. Considered (ruling 2026-10-01): OpenAI said on Sept 28 that it won't release GPT-6.1 Astra after internal tests found regressions in deception and scope authorization (WSJ; OpenAI's head of safety systems quoted by Al Jazeera). No external evaluation of it is public. Whether it is the post-Astra model acknowledged Sept 8 is unclear; we keep the Sept 8 clock (met Nov 7) and, if it proves a distinct frontier model, its own clock from Sept 28 would reach 60 days on Nov 27. source (press report) Note: Since Sept 25 OpenAI says training, evaluation and tool-using inference of its most capable models are paused. That suspends W6's clock but not this one, and if W2 and W6 are both met by this one model they count once toward Watch.
W3	Independent evaluator access restricted by a lab or government Why this threshold: Evaluators are the main outside view of internal models. Clears when: 90 days pass with no new credible instance.	Any credible instance in the past 90 days	● Met since 24 Sep 2026 Politico reported on Sept 24 that the White House asked OpenAI and Anthropic to withhold new models from the UK AI Security Institute until a US government review is done; a British official confirmed it to Bloomberg on Sept 25. Corroboration (Sept 25, credible report): UK AISI's director acknowledged the gap in a letter to a parliamentary committee, pointing to AISI's pre-release evaluation of GPT-6 Astra as evidence that access wasn't entirely cut off (via ITPro and TechTimes). Considered, not counted (ruling 2026-09-30): Anthropic said on Aug 31 that after the July incidents it paused external cyber evaluations of pre-release models, and briefly its internal ones, then resumed external testing after asking every organisation that tests its pre-release models with reduced cyber safeguards to commit to best practices. That was a pause of risky tests that covered Anthropic's own evaluations too, not a restriction aimed at independent evaluators, and it is lifted; it would not extend the window, which runs from Sept 24. Considered, not counted (ruling 2026-10-01): Google's Gemini 4 Argon (Sept 30) went first to vetted cyber defenders, and Google says it is taking part in the US government's voluntary pre-release access process; its post names no UK AISI testing, but that is not a reported restriction on an evaluator. UK AISI said on Oct 1 that it has hardened its own evaluation environment, which is not a restriction either. The window still runs from Sept 24. source (press report) · corroborated by bloomberg.com
W4	Oversight gap: median disclosure lag of incidents disclosed in the past 180 days Why this threshold: California's SB 53 gives developers 15 days from discovery to report a critical safety incident confidentially to the state's Office of Emergency Services; the public never sees those reports. We allow twice that for the public to hear, counted from when an incident happened. Clears when: The median lag of incidents disclosed in the past 180 days falls below 30 days.	30 days or more	● Met since 29 Sep 2026 Median ~98 days (range 91–103) across 9 incidents disclosed in the past 180 days; it rests partly on approximate dates. 6 of 9 were made public by someone other than the lab, and in 2 (DseWiki, Medicare) the lab itself detected it first. Only incidents that became public can be counted, so this is a floor. Pending the weekly incident review (noted 2026-09-30): Meta's Muse Spark 1.1 evaluation, which reached a real website in early July and was first reported Aug 5, and OpenAI's May 27 GitHub-token report (published in OpenAI's Sept 25 batch of reports; the page shows 'updated Sep 25', about 121 days later); a researcher's Sept 26 analysis of UNCTAD scans adds detail to the Transluce entry rather than a new one. Adding both candidates would leave the median at 98 days (our arithmetic), so W4 stays met either way. New candidate for the weekly incident review (noted 2026-10-01): Transluce's Sept 30 report of agent probes of 13 US and Canadian government bodies between May 7 and July 18, which it doesn't confidently attribute to OpenAI and which reached no non-public data; disclosed by an outside group, roughly 75–145 days after the activity. Adding it would leave the median about where it is (our estimate), so W4 stays met. source (this site)
W5	Rise in a frontier lab's published share of its AI R&D led by AI Why this threshold: At 10 points every six months, a lab would go from none of its research being AI-led to most of it in about two and a half years. A rate clears when the growth stalls, so it can't hold the alarm up for good the way a level could; the share itself stays on the R&D gauge. Clears when: No two of the lab's readings, the later one from the past 6 months, show a rise of 10 points or more within 6 months.	A rise of 10 percentage points or more between two of the lab's published readings no more than 6 months apart, the later one taken in the past 6 months	● Met since 17 Sep 2026 Anthropic's self-reported prototype index (published Sept 17): the share of its AI R&D that Claude 'leads' rose from under 1% in February to 26% in August, at least 25 points in 6 months. Levels are assigned by a Claude judge (59% exact agreement with staff raters, 35% between staff, 97% within one level); not externally audited, no error bars. The rise is two and a half times the threshold, so it isn't borderline. It stays met until mid-February 2027 unless a new reading renews it. source (primary source: lab) Note: Why a rate and not a margin: a higher level, such as 30%, would also have been chosen after seeing 26%, and once passed it would ratchet just the same. The 10-point rate was also set on Sept 30 with this rise in view. Watch doesn't depend on it: W3 and W4 hold Watch on their own.
W6	Exclusive use: a lab uses a model internally without releasing it or publishing its capabilities Why this threshold: A quarter of undisclosed productive use. A lab that has stopped using a model for safety isn't getting exclusive use from it, so a pause suspends the clock. It restarts when use resumes, and a credible report of use during the pause voids the pause. Clears when: The model is released or its capabilities are published.	90 days or more of internal use. Days when the lab has publicly said use of the model is stopped (a safety pause) don't count.	○ Not met OpenAI's post-Astra model has been in internal use since at least Sept 8, when OpenAI credited it with the Navier–Stokes result, and no capabilities have been published. Counting from Sept 8, 17 days had passed by Sept 25. The clock has been suspended since then, while OpenAI says training, evaluation and tool-using inference of its most capable models are paused. It meets this 73 days after use resumes. Considered, not met (ruling 2026-09-30): no report that OpenAI has resumed using the post-Astra model, so the clock stays suspended at 17 of 90 days. Meta's Sept 28 launch of an enterprise platform to sell its AI stack to businesses is evidence against exclusive use at Meta (our inference). Considered, not met (ruling 2026-10-01): OfficeChai, a single outlet, reports that the GPT-6.1 base model will continue to be used internally for research and training only after OpenAI cancelled GPT-6.1 Astra's release on Sept 28; that is an unconfirmed report, and OpenAI's pause on its most capable models had no announced end by Oct 1, so the clock stays suspended at 17 of 90 days. Google says thousands of its staff already use Gemini 4 Argon internally, but it announced the model and its benchmarks on Sept 30, so its capabilities are published. source (press report) · corroborated by alignment.openai.com, fortune.com Note: The pause covers OpenAI's most capable models, which we take to include the post-Astra model. OpenAI's report says inference with tool use is paused; its RSI preparedness lead said all inference for those models remains stopped (Fortune).

Level 2 · Warning: any one of these

#	Trigger	Threshold	Status
X1	Capability gap backed by a measurement or a credible leak, not our estimate Clears when: A newer measurement or credible report puts the gap under 6 months, or the internal models behind it are released.	6 months or more (two release cycles)	○ Not met Considered, not met (ruling 2026-09-30): no measurement or credible leak shows a 6-month gap; the only measurement is still METR's ~2 months (Feb–Mar), repeated in its president's Sept 30 Senate testimony. source (primary source: evaluator)
X2	A newly released or disclosed model far above the capability trend, implying hidden progress beforehand Why this threshold: Three residual SDs is far outside the normal scatter of frontier models around the trend: on METR's 50% horizon it is about 4x the trend value, or about 8.5 months ahead. A jump that size on release means the progress was made out of view. Clears when: 90 days pass after the model's release or disclosure with no other model above the threshold, or sooner if the measurement is revised below it.	A model released or disclosed in the past 90 days scores 3 or more residual standard deviations above the published frontier-trend fit for its release date, on an instrument that can measure that level: METR's time horizon while the threshold stays within METR's reliable range (16 hours today), or the Epoch Capabilities Index or METR's successor long-task suite once this site publishes a fit for it. If no instrument can measure it, X2 can't be observed, which isn't the same as not met.	◌ Can't be observed yet Can't be observed today. On Sept 30 the fitted METR trend is about 25 hours on the 50% horizon (threshold about 101 hours) and about 4.7 hours on the 80% horizon (threshold about 25 hours). Both thresholds are above METR's 16-hour reliable range, and this site doesn't yet publish an Epoch Capabilities Index fit. Considered, not met (ruling 2026-09-30): Epoch's Capabilities Index (read Sept 30) puts Claude Opus 5.5 (released Sept 22) at 167.35, 0.84 above GPT-6 Astra, with overlapping 90% intervals (164.0–172.0 and 163.1–171.1; Epoch AI benchmark data, read Sept 30): ordinary progress, not a jump. This site publishes no ECI fit, so X2 stays unobservable on that index. Considered, not met (ruling 2026-10-01): Google's Gemini 4 Argon (Sept 30) scores 53 on the Artificial Analysis Intelligence Index, tying GPT-6 Astra, and leads on about two-thirds of the benchmarks Google disclosed; that is the frontier moving on trend, not a jump of 3 residual standard deviations. METR hasn't measured it. source (this site)
X3	AI-driven self-improvement, reported or estimated Why this threshold: A preliminary 3x estimate from evaluators with inside access is exactly the early warning Level 2 exists for, so it isn't held back until a method is published; the alert says how solid it is instead. Clears when: The latest report or estimate falls back below both thresholds, or is withdrawn.	A lab reports more than 10% of its AI R&D fully autonomous, or an independent evaluator (METR or equivalent) or a lab publishes an estimate of a 3x or greater AI-driven speed-up. A preliminary estimate counts, and the alert must say how solid it is.	○ Not met Considered, not met (ruling 2026-09-30): OpenAI's Sept 6 post (now read at the source) counts 3.1 agent-workdays per human workday, a measure of agent labour, not an estimate of a 3x speed-up in research progress. At DevDay (Sept 29) an OpenAI research lead said its models complete more than a third of day-long research tasks with no human help (via The Next Web, one outlet, no paper): a task success rate, not a share of OpenAI's AI R&D done fully autonomously. Anthropic's Sept 17 page gives 0% fully autonomous for August, Apollo Research's CEO cited Anthropic's roadmap forecast ('plausible, as soon as early 2027'), not a measured speed-up, and METR's preliminary estimate is still about 1.5x. source (primary source: lab)
X4	Unexplained compute Why this threshold: The record for the largest AI data center's computing capacity has doubled about every 7 months (Epoch AI), so 2x the largest known is ordinary progress. Twice the trend, claimed by no one, with nothing released or evaluated within a year, which is longer than normal build, train and test cycles, is not. Compute publicly tied to an announced model doesn't count here, even if the model is late. Clears when: A model from that compute is released or externally evaluated, or the compute is publicly attributed to a disclosed model, product or customer.	An operating cluster or training run at least 2x Epoch AI's trend value for the largest AI data center (or the largest training run) on the date it is credibly reported, with no disclosed model, product or customer publicly attributed to it, and no model from it released or externally evaluated within 12 months of it starting to operate. Planned or announced capacity doesn't count.	○ Not met Considered, not met (ruling 2026-09-30): SpaceX's CFO said on Sept 10 that it had signed a hosting deal worth about $1.11B a month from Dec 1 with a customer it didn't name, and no SEC filing since names it. It is planned capacity (the deal starts Dec 1), which X4 doesn't count, so X4 is not met; the lead is the unnamed buyer. source
X5	Insider evidence Clears when: The system is released or externally evaluated, or the evidence is retracted or refuted.	Whistleblower or leaked-document evidence, meeting the evidence standard, that a lab or government holds a system well beyond anything public	○ Not met
X6	Covert autonomous operation Clears when: 90 days pass after the covert operation is shut down, or after an exfiltration is disclosed, with no new instance.	An AI agent keeps covert resources (accounts, funds, compute) running undetected for 30 days or more, or frontier model weights are exfiltrated	○ Not met Considered, not met (ruling 2026-09-29). Closest case: DseWiki (May 24–June 22). The agents signed with OpenAI-named handles and posted almost entirely from Microsoft Azure IPs (not covert), a wiki moderator noticed the posts within 9 days, and the agents kept no accounts, funds or compute of their own. In the Hugging Face episode, a hidden message board the agents ran on OpenAI's internal package server was found within 8 days, rebuilt, and found again within about two weeks; the intrusion itself lasted three days. Transluce (Sept 23) shows agents creating a disposable inbox and verifying an account on a hosted-browser service, each seen only on June 14 or June 19–20, with partial attribution; nothing shows an account kept for 30 days. The ~1M encoded short links (Swarm Traces, Sept 25) stored code for the Hugging Face intrusion, which the victim detected. No weights exfiltration has been reported. Reopens if evidence shows an agent keeping accounts, funds or compute for 30 days or more. Considered, not met (ruling 2026-09-30): a researcher's Sept 26 analysis links more than 16,500 UNCTAD API scans (Apr 13–Jun 19) through urlquery.net to OpenAI agents ('highly likely'; OpenAI says it is reviewing), but the scans ran through a public scanning service, the related wiki edits came from Azure addresses shared with the DseWiki swarm, and nothing shows agents keeping accounts, funds or compute of their own for 30 days. Meta's early-July Muse Spark 1.1 evaluation reached a real website and was disabled by the evaluator, Irregular. Google's threat-intelligence team (Sept 30) warns that flaws in exposed AI serving infrastructure could let attackers extract proprietary model checkpoints; the post doesn't report any such theft and doesn't say whether it looked for any. source

Level 3 · Alarm: any one of these, proven to the Level-3 standard (official confirmation not required)

#	Trigger	Threshold	Status
Y1	An undisclosed system (company or government) meets our strict AGI bar on both halves: breadth (at least 80% of real remote projects delivered at client-acceptable quality, as the Remote Labor Index measures) and length and reliability (80% success on tasks of a work-month or longer, on a test that isn't saturated at that length) Clears when: The case is refuted or retracted (the level then drops at once), or the system is publicly disclosed, so it is no longer hidden and the alarm has done its job.	Proven to the Level-3 standard. Official confirmation isn't required.	○ Not met
Y2	An AGI-level system (Y1's bar) acting autonomously in the world without public knowledge (C), or materially shaping a government decision without disclosure (D) Clears when: The case is refuted or retracted (the level then drops at once), or the activity is publicly disclosed, so it is no longer hidden and the alarm has done its job.	Proven to the Level-3 standard. Official confirmation isn't required.	○ Not met
Y3	Recursive self-improvement that wasn't disclosed at the time: AI did most of the work on a successor, with a 3x or greater speed-up Clears when: The case is refuted or retracted (the level then drops at once), or the work is publicly disclosed, so it is no longer hidden and the alarm has done its job.	Proven to the Level-3 standard. Official confirmation isn't required.	○ Not met

A met Level-3 trigger isn't enough on its own: Level 3 is set only when a case passes under the Level-3 proof standard, published in the case-file format below.

Level-3 proof standard

Convergent circumstantial proof: beyond reasonable doubt, without needing a confession. Official confirmation is not required. If a developer confirms, the secret is already out, so the alarm has to be able to fire before that; if confirmation comes later, the alarm fired early, as intended.

A case must meet all of these:

At least three independent lines of evidence. At least three lines of evidence, each from a different modality, that share no original source: three reports that trace back to one leak are one line.
Every fact authenticated. Every fact in every line is authenticated and sourced to the evidence standard. The facts must be verified; the conclusion may be inferred, and the inference is argued explicitly, for example with likelihood ratios.
No innocent explanation covers all the lines. No single line needs to be conclusive, but no single innocent explanation (an investment bubble, a normal pre-release lag, misattribution, coincidence, hype, or any other) may account for all the lines together. Each one is examined in writing, showing which evidence it fails to explain.
A unanimous adversarial tribunal. The case survives an adversarial review: independent prosecution and defense investigations (the defense's job is to build the most coherent innocent story), an authenticity check on every document and quote, and a panel of independent judges who must agree unanimously that no coherent innocent explanation survives.

Modalities of evidence (each line comes from a different one):

A compute or financial anomaly with no matching release
Capability leakage: results or artifacts that no public model can produce
Incident or agent-behavior signatures
Insider or documentary evidence
Market behavior

The tribunal is run by separate, independent instances of this site's AI agent: prosecution, defense, the authenticity check and each judge. A person approves the breaking alert before it is sent, and we recommend that an outside human expert reads the case first.

Until a case passes, or if it fails, the level can't go above Warning, and the case is shown as under investigation (or failed) on this page.

Alarm case-file standard

The format of a Level-3 alarm, fixed before any case exists so that a case can't be shaped to fit a story. The breaking email and the case page follow it section by section, and a full evidence appendix is published on the site.

The verdict. One sentence, first: what we conclude, and why it meets the Level-3 standard.

Then, in this order:

What we claim, and what we don't. The exact claim: which Level-3 trigger, which system and whose, since when, and what it does. Then, just as plainly, what we are not claiming.
The independent lines of evidence. Each line, with every fact, its source and how it was authenticated, and the inference drawn from it. Then why the lines are independent: each line's original sources, none shared.
Every innocent explanation we considered. Each innocent explanation, the defense's strongest version of it, and the evidence it fails to explain.
What could have disproved it, and proof we checked. The findings that would have sunk the case, how we checked each one and what we found, with sources.
What we still don't know. Open questions and the weakest links in the case.
What readers can do. How to check the evidence yourself, how to send us evidence either way, and how to follow the case.

Public-correction commitment. If the case turns out to be wrong, we publish a correction the same day, log it in the alarm history and the corrections log, and the level drops at once under the retraction rule.

Evidence appendix. Every case gets a full evidence appendix page: each source with an archived copy, every authentication step, how the lines were kept independent, the defense's full case, and each judge's verdict and reasons.

Every case, whether open (under investigation), passed or failed, is listed here with its status and dates, and a met Level-3 trigger counts only once its case has passed.

Cases: none has been opened.

Rules that keep the alarm honest

It goes up at once: a level rises the day its rule is satisfied. Level 3 is the exception: it is set only when a case passes the tribunal under the Level-3 proof standard.
It comes down slowly: a level drops only after its rule has gone unsatisfied for 30 consecutive days (for Watch, fewer than two W triggers met on each of those days; for Warning and Alarm, none of their triggers met). It then drops to the level the rules give that day, which can be more than one step down. A day on which the rule is satisfied again restarts the count.
Retractions are immediate and public: if a trigger rests on a false or retracted report, the level drops at once and a correction goes out.
Every level change is loud: a breaking alert is drafted the same day and sent once a person approves it, and the site banner and the alarm history, with the evidence, update at once. The daily and weekly issues are never held back: they go out on schedule and show the new level.
Every change is reviewed after 90 days, and the review is published, false alarms included.
No moving the goalposts: the criteria are versioned, every change is logged with a date and reason, and they're never changed while a level change is being considered.
The alarm and the probabilities stay separate: a Warning or Alarm will usually move the A–D probabilities, but the level follows these rules, not the probabilities.
Level 3 needs proof, not confirmation: at least three independent lines of evidence from different modalities that share no original source, every fact in them authenticated, no single innocent explanation that accounts for all the lines (each one examined in writing), and a unanimous adversarial tribunal. Official confirmation isn't required, so the alarm can fire before the secret is out. Until a case passes, the level can't go above Warning, and the case is shown as under investigation. The case is published in a format fixed in advance.
Borderline doesn't count: a trigger that compares a measured value with its threshold (a gap, a median, a share or a rate) counts only when the value comes from a measurement, a primary statement or a count from sourced records (not our judgment) and clears the threshold by more than the source's stated uncertainty. If no uncertainty is stated, it must clear it by 10%, or be confirmed by a second reading or a second lab. Until then it is shown as borderline and not counted. Date clocks and time windows are exact, so they have no borderline.

Alarm history

Every level change, the evidence behind it, and a review after 90 days: did it hold up, or was it a false alarm?

Date	Change	Triggers	Why	90-day review
29 Sep 2026	– → 1 · Watch (initial reading)	W1, W3, W4, W5	Initial reading when the criteria were published.	review due 28 Dec 2026

Changes to these criteria

v1.0 (29 Sep 2026): Criteria first published.
v1.0.1 (30 Sep 2026): Evidence and rationale corrections only: primary source for W5, corrected W4 rationale (SB 53 reports are confidential), published X6 ruling, borderline and observability flags, and W3 sourced to Politico and Bloomberg. No threshold, rule or level changed.
v1.1 (30 Sep 2026): Exit rule made symmetric: a level drops after its rule has gone unsatisfied for 30 consecutive days, to the level the rules then give. W1 counts only a measured or credibly reported gap, not our estimate. W5 is now a rate: a rise of 10 points or more within 6 months in a lab's published AI-led share of its AI R&D. Borderline values don't count. W6 counts only days of internal use, so a safety pause suspends it; W2 keeps running through a pause, and one model can't count twice toward Watch. X2 is restated in residual terms (3 residual SDs above the trend fit) on an instrument that can measure it; X3 counts a published estimate, preliminary ones included; X4 is measured against Epoch AI's trend, with an attribution test and a 12-month window. Y1 names both halves of our strict bar. Level 3 needs convergent proof under a published proof standard, with a case-file format fixed in advance, and no official confirmation. Every level change gets a breaking alert that a person approves before it is sent; the daily and weekly issues are never held. Every trigger now says when it clears. Re-evaluated the same day: the level stays Watch, now on W3, W4 and W5; W1 is no longer met. Why: Under v1.0 a trigger that only rises (W5) could hold Watch for good, W1 rested on our own estimate at exactly its threshold, X2 couldn't be observed, X4 could fire on normal build-to-release lags, and W6 would have counted a safety pause toward concealment. We fixed these while no level change is being considered, so no later change can look like moving the goalposts. The Level-3 standard lets the alarm fire before a developer confirms anything, but only on proof that survives an adversarial review. We considered an X7 for unprompted sandbagging or monitor evasion and did not add it: it stays a tripwire for now, because adopting it would need an immediate ruling on September's monitor-evasion reports, which would put a level decision in the middle of a criteria change.