Imagine you run a casino, and every chip a player takes off the table has to sit in a lockbox at the door for one hour before they can leave with it. During that hour, you randomly inspect some fraction of lockboxes. If you catch a marked chip, the player forfeits the whole set. The player's optimal strategy isn't to grab as many chips as possible — it's to grab exactly the number where the odds of slipping through are maximized against the cost of losing everything. That tradeoff has a closed-form optimum, and that optimum is what this paper formalizes for AI containment. The committed claim: if you escrow every boundary crossing an agent makes for one time period, audit each independently with probability r, and revoke the window on any failed audit, then the maximum expected information an adversary can extract is bounded by L(r) ≈ c/(er) bits per window — and this bound is tight. The adversary's optimal crossing count k = 1/ln(1/(1-r)) falls out of a clean maximization. This isn't a heuristic or a simulation artifact; it's a supremum over all adversarial strategies, which means the scheme can be published without weakening it. But rate-bounding alone doesn't contain secrets — a patient adversary just accumulates bits across windows. The paper's second move is information decay: if held bits degrade at fraction μ per period, holdings converge to g/μ regardless of horizon. This creates a sharp error threshold in the Eigen quasispecies sense — below μ the secret assembles in 100% of runs, above 2μ it assembles in 0%, tested over 20,000 windows. The phase transition is not gradual; it's a cliff. The deception analysis is unusually concrete. A deceptive surface whose names lie left reader accuracy at chance (18/18 failures). Withholding reference material works differently — readers simply refuse to engage at all. Keying entry points hides only 0.10 bits of module function, but keying denotation hides 2.64 of 3.00 bits at chance accuracy while 100% of readers still identify the code as ordinary Python. This is the kind of granular measurement that separates a real containment paper from a position paper. End to end, the full stack compresses leakage from 100,000 bits to 59 bits — a factor of 1,704 — while leaving 12% of legitimate work standing. That 12% figure is the honest cost: containment is not free. But keying the escrow window to the calling principal restores legitimate throughput to 100% at no additional leakage cost, at the price of the bound becoming per-principal rather than global. For 65 read-only tools, escrow leaves 2,400 bits per call — a factor of 10 reduction, not total lockdown. The integrity story is mixed. Simulation matches the closed-form bound to 7.7 standard errors — strong internal consistency. But the validation is entirely same-author analytical and simulation work; no independent team has stress-tested the framework, no pre-registration exists, and the 'reader strength' experiments with deceptive surfaces need replication with actual human subjects or independently designed adversarial scenarios. The companion-paper structure (three linked arXiv preprints) suggests a single researcher building a full theoretical stack, which is ambitious but also means every piece grades every other piece's homework. This paper matters because it converts the 'how do you contain a smart agent' question from philosophy into information theory. The units are bits per period. The thresholds are closed-form. The cost to legitimate work is quantified. Whether these bounds survive contact with real agentic systems — where the boundary-crossing model may be too clean — is the open question that will determine whether this stays theory or becomes infrastructure.
