Daily Systems Trends Report — October 8, 2026

Theme: Fan-Out Meets Its Controllers. Today’s crop (cs.DC 22 · cs.SE 33 · cs.MA 14 submissions) is dominated by a single question: what happens when agents and infrastructure are allowed to multiply — sub-agents spawned mid-task, research-agent populations of ten thousand, swarms of individually benign identities — and who keeps them honest. The answer, in five different papers, is the same: explicit control artifacts (institutions, intent graphs, topology priors, qualification stages, backoff rules), not smarter models.

Item 1 — Dynamic Sub-Agent Concurrency Gets Its First Controlled Audit

arXiv:2610.10263 — H. Li, H. Li, Z. Jiang, Y. Lou (Fudan) — submitted Oct 7, 2026

Claim: Dynamic concurrency — an agent deciding mid-execution whether and how to spawn parallel sub-agents — is a distinct execution policy whose value is task-dependent: model capability dominates on short tasks, but on long-horizon development orchestration itself becomes central to completion.

Foundation: Sequential single-agent execution and predefined multi-agent DAGs (static orchestration decided at design time). Dynamic concurrency replaces both with in-flight fan-out decisions.

Evidence: Controlled matched comparisons of Codex, Claude Code, and Kimi Code executions with the policy on and off: 354 tasks, 2,124 executions across a complexity and horizon range; 13 concurrency-specific failure modes and 28 observable patterns extracted from matched trajectories. The paper is a measurement study, not a system pitch.

Trade-off: Pro: the first end-to-end ledger of what fan-out actually buys and breaks in frontier coding agents — exactly the ledger this column has been asking for since the attention/handoff-tax crossover work (2610.06069, Oct 7). Con: taxonomy of failures does not yet come with a mechanism that fixes them; results are one snapshot of three fast-moving commercial harnesses.

Verdict: READ. The failure-mode catalog is immediately actionable for anyone building orchestrators (including Hermes-style harnesses): spawn decisions, merge points, and stale-context windows are where long-horizon tasks die. A strong candidate for follow-up with mechanisms.

Item 2 — CACM Essay: Coding Agents Make Software Engineering Essential, Not Obsolete

arXiv:2610.10226 — A. Fuggetta — accepted, Communications of the ACM (5 pages)

Claim: AI coding agents make SE the discipline and engineers the professionals MORE essential: probabilistic generation, model agnosticism, and semantic statelessness create a structural vacuum no amount of training eliminates. Filling it requires four knowledge levers — methodological knowledge, domain knowledge, design choices, process choices — each reified as persistent artifacts, each requiring the engineer as methodologist, mediator, and custodian.

Foundation: Direct rebuttal to the “agents replace engineers” narrative; methodologically a descendant of the spec-authority line (SpecHarness “Who Holds the Pen”, Sep 28) and the requirements-smell work (Sep 27).

Evidence: Position essay accepted at a top venue (CACM) — imprimatur, not benchmark. Its three structural properties are arguments, but each is independently corroborated by this week’s empirical stack: DoGBench showed agents misread interfaces without reading (Oct 3), Compact Documentation showed agent performance does not hinge on docs when source is visible (Sep 28), VeriSpec found 5 validated inconsistencies in the OpenAI Model Spec text itself (Oct 2).

Trade-off: No new data; the four-lever framework is prescriptive rather than tested. Its value is as an organizing frame, and as evidence that the discipline’s self-defense has gone mainstream — CACM acceptance means this is no longer blogosphere cope.

Verdict: CITE. The right citation when someone says agents remove the need for engineering method. The convergence of a position essay (no data) with a week of empirical papers (no position) is itself the trend.

Item 3 — TestGRAD: Ensemble Selection as Test-Space Optimization

arXiv:2610.10242 — P. He, J. Zhou, S. Wang, R. Pan — submitted Oct 7, 2026

Claim: SWE-agent ensembles are bottlenecked by test-based selection, not patch generation; test generation should be formulated as optimization with an explicit execution-defined loss (tests exist to separate candidate patches by behavior), updated via full CRUD gradients and failure-pattern momentum.

Foundation: Fixed repository test suites and one-shot LLM test generation — both, per the authors, incomplete optimizers: no explicit loss, incomplete update directions, no feedback from repeated failures.

Evidence: SWE-bench Verified: 84.2% Pass@1 with a 4-agent ensemble vs 80.6% strongest baseline (+3.6pp), while compressing failure-history context by over 100x. The momentum analogy is more than branding — it mines frequent failure sequences to avoid re-visiting non-discriminative directions.

Trade-off: Pro: +3.6pp on a saturated leaderboard is a real, hard-earned margin, and the >100x context compression addresses the known failure-history bloat problem. Con: requires executing candidate patches against evolving suites (compute cost scales with ensemble size), and the optimizer adds a third layer of machinery (ensemble + selector + test optimizer) that itself needs auditing.

Verdict: STRONG. The day’s best empirical result in dev tooling. Directly useful if you already run patch ensembles; the loss formulation (differential execution-defined target) is exportable beyond SWE-bench.

Item 4 — Behavioral Dependency Breaks: Execution-Guided Repair Where Compilers Go Silent

arXiv:2610.09267 — J. Chen, T. Bi, Y. Wang, P. Thongtanunam — 21 pages, 12 tables

Claim: Dependency upgrades break downstream projects without interface changes; these behavioral breaks produce no compiler feedback and are usually undocumented, so evidence pipelines built on compiler output or docs starve the repair agent. Agents receiving no upgrade evidence also do not retrieve upstream evidence themselves, and most failed repairs never identify the root API.

Foundation: Compiler-feedback-driven and documentation-driven LLM repair loops (the standard agent-repair harness pattern).

Evidence: Large empirical study (21 pages, 12 tables) establishing that evidence availability — not model skill — is the binding constraint on behavioral-break repair; execution-guided evidence is the proposed corrective. (Headline repair numbers are in the paper tables, not the abstract; we report the structure, not unverified figures.)

Trade-off: Pro: attacks a real supply-chain hygiene gap that interface-level tooling structurally cannot see; aligns with the week’s evidence-gate theme — the right evidence must be manufactured (by execution) before the agent reasons. Con: requires executing downstream tests against upgraded dependencies, i.e., sandbox infrastructure most repos do not maintain.

Verdict: WATCH. Sound problem framing; needs the per-benchmark numbers verified before adoption claims. Pairs naturally with environment-reproducibility findings (2610.00425, Oct 2) — dependency agreement is where agents silently diverge.

Item 5 — When the Governor Becomes the Disturbance: Cost-Aware Backoff for Supervision

arXiv:2610.09037 — V. Ziegler (single author) — submitted Oct 6, 2026; code released (CASAgentGovernor)

Claim: Supervisory governors are not neutral: increases in regulatory intensity can themselves trigger tool failures, and a cost-blind governor converts those failures into persistent blocking that prevents task completion. A backoff rule that reduces intervention probability using a moving average of known induced events restores completion.

Foundation: Control-theoretic supervision of tool-using agents — the exact paradigm this column tracked being built earlier this week (DEFER1 rules-first gates, 10/7; Trust-Gated Capability Control, 10/7). This paper audits the paradigm from inside control theory: the controller is part of the loop it regulates.

Evidence: File-recovery environment where regulatory intensity triggers experimentally imposed tool failures. Hand-coded stochastic-policy agent: failure pattern appears under both result replacement and corrupted-argument execution. Gemini 2.5 Flash: 576 episodes across 6 tasks show reduced blocking and improved completion under adaptive backoff, with intermediate backoff strength best. Fixed governor with matched intervention frequency used as control.

Trade-off: Pro: the first rigorous articulation of control-induced disturbance in agent governance — a missing failure mode in the gate-building wave; cost-awareness framing connects agent governance to classic disturbance-observer design. Con: the backoff rule consumes a moving average of KNOWN induced events — an oracle assumption (production systems cannot cleanly label which failures the governor itself caused); single-author, one model, one synthetic environment, unreviewed.

Verdict: IMPORTANT CAVEAT. Read alongside the gate papers: it is the strongest argument yet that intervention itself must be budgeted. But its oracle labeling assumption means the headline rule is a research instrument, not a deployable policy.

Item 6 — AgentTracer: Intent-Aware Forensics for Indirect Prompt Injection

arXiv:2610.09935 — Z. Yao, J. Wu, Y. Lin, A. Huang, L. Zhang, Y. Nan — submitted Oct 7, 2026

Claim: Indirect prompt injection (IPI) tracing should model task-intent drift, not explicit control/data flow: injected tool calls lack explicit dependencies and interleave with legitimate operations. AgentTracer builds an Intent-Driven Execution Graph (implicit decision dependencies among tool calls), defines a user intent authorization space from request + operation knowledge base, flags intent-drift calls, and performs target-based pruning plus backward tracing from the anomalous call.

Foundation: Flow-based tracing and log forensics — the traditional incident-response substrate, which the authors show under-specifies agent incidents because the malicious instruction drives calls with no explicit dependency edges.

Evidence: 94.17% injection-point accuracy and 93.56% path precision in end-to-end evaluation, with attacks drawn from AgentDyn and InjecAgent embedded in 1,800 normal user requests and 9,000 background tool calls — i.e., under realistic noise, not attack-only corpora.

Trade-off: Pro: post-incident forensics is the pragmatic complement to IPI prevention, which keeps failing (Agent-as-Kernel, Sep 26: evals overstate security; DEFER1, 10/7: gates cut attacks to ~3% but admit the rest). Backward tracing from an audited anomaly is exactly how classic SRE triages incidents. Con: requires a curated operation knowledge base per domain; evaluation remains on synthetic attack corpora, not production agent logs; LLM-judged intent recovery inherits judge-drift risk (detector half-life, Oct 2).

Verdict: DEPLOY-READY DIRECTION. The strongest forensic tooling this week has produced; treat 94%/93.6% as benchmark-grade, and expect degradation on heterogeneous production traces until tested there.

Item 7 — MAScope: Communication Topology as a Diagnostic Signal for Multi-Agent Failures

arXiv:2610.10126 — X. Liu, Z. Pan, I. Zhu, J. Zhang, X. Liu, T. Wo — submitted Oct 7, 2026

Claim: Communication topology — who exchanges information with whom — carries structural cues that distinguish coordination failure modes; recovering topology from unlabeled traces and conditioning the diagnosis on it measurably improves failure classification.

Foundation: Trace-only LLM diagnosis (MAST-style symptom reading), which conflates distinct failure modes that present identical symptoms but live in different information-passing structures.

Evidence: Statistically significant association between topology and failure type (χ² = 409.9, p = 1.2×10⁻³⁰) on 851 MAST-clean traces. Ground-truth topology lifts gpt-mini Macro-F1 from 0.173 to 0.350; predicted topology achieves 0.346, approaching the trace-only gpt-5.4 baseline of 0.372. Pipeline cost (topology extracted once under fixed orchestration, then reused) is ~6% of repeated gpt-5.4 diagnosis cost.

Trade-off: Pro: honest effect sizes with a real statistics backbone; the cost engineering (recover topology once, reuse across executions) is exactly the right production instinct. Con: absolute Macro-F1 ~0.35 means diagnosis is far from solved — the improvement is real but the ceiling is low; topology recovery assumes message evidence is extractable from traces.

Verdict: WORTH ADOPTING. A cheap structural prior that nearly matches a frontier model on a smaller budget is the kind of result that survives replication. Do not oversell: a 0.35 F1 triage signal, not an oracle.

Item 8 — SwarmReconGuard: Populations of Individually Benign Agents Are a Collective Detection Problem

arXiv:2610.09138 — V. Tavakkoli, K. Mohsenzadegan, K. Kyamakya — submitted Oct 6, 2026 (cross-list cs.CR)

Claim: Autonomous clients can distribute reconnaissance across many identities so each request stays valid, low-rate, and benign-looking while the population collectively maps a system (Distributed Collective Reconnaissance, DCR). Only population-level statistics on service-boundary telemetry can see it.

Foundation: Per-request and per-identity rate limiting and anomaly detection — the traditional WAF/security-monitor posture, which is structurally blind to DCR by design.

Evidence: Docker-isolated reproducible benchmark: 11 benign and attack behaviors, 10 to 10,000 virtual identities, 440 test runs, 3,666,300 requests. Gaussian likelihood-ratio detection: 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies. Hybrid CUSUM: 85.7% detection at 0% observed FP at 10,000 identities. The policy-generalization gap is the headline finding.

Trade-off: Pro: formalizes an emerging real threat (converges with Collusion Wiki’s documented sandbox-escape sharing episode, 10/7, and VirusCascade’s reflection-laundering, 10/1); complete telemetry integrity and a released benchmark are community goods. Con: synthetic traffic; the best detector on known policies collapses on unseen ones — deployers must accept unknown-policy blindness; no online system integration yet.

Verdict: THREAT MODEL ADOPT, DEFENSE QUALIFY. The DCR formalism belongs in every agent-platform threat model. The detection numbers are honest about their limits, which is itself notable.

Item 9 — A Society of Researchers: Institutions for Ten-Thousand-Agent Populations

arXiv:2610.10468 — A. Asaria, D. Gandhi, T. Salomone — 4-page short version (Zenodo long version)

Claim: Populations of thousands of research agents sharing one compute pool will acquire an organization whether designers provide one or not — so provide it explicitly. Proposed design: principal investigators compete for compute via requests for proposals, independent review, and grants; a human “mayor” allocates resources and assigns no tasks.

Foundation: Replaces per-project multi-agent organization (current systems run one project at a time) and replaces scheduler-policy compute allocation with market-like institutional mechanisms — RFPs and peer review, the oldest allocation institutions in science, applied to agents.

Evidence: A running society of 10,000 researchers, asked only to improve language-model pretraining, produced one lab’s reported path to the same quality with ~30% less compute — which the labs that tested it do not yet agree on. The paper itself flags the result as unsettled, and closes with six open problems for the community.

Trade-off: Pro: governance-first design at population scale is a genuinely new problem statement, and the mechanism choice (competitive grants, not central planning) matches what the systems literature says about scaling coordination. Con: the headline empirical claim is unreplicated and disputed by its own participants; 4 pages; institutional overhead vs. benefit is unquantified; the mayor’s allocation policy is unspecified.

Verdict: WATCH, DO NOT QUOTE THE 30%. The design idea matters; the number does not yet. This is the week’s most ambitious governance proposal and its most honest self-reporting — the two usually do not co-occur.

Item 10 — LOCAA: Agentic Auto-Tuning of Lossy Scientific Compressors

arXiv:2610.10487 — K. M. Mumenin, D. Dai, S. Di, F. Cappello, J. Wang — submitted Oct 7, 2026

Claim: Configuring lossy compressors by numerical error bounds while users care about quality metrics and end-to-end performance forces exhaustive search; an LLM agent with tool-integrated execution, compressor-aware guidance, and persistent memory can run compression-in-the-loop search that beats both binary search and heuristics.

Foundation: Binary search over error bounds and specialized heuristics (FRaZ) — the traditional tuner toolkit, which the authors note cannot absorb user-defined objectives without new search strategies.

Evidence: Across 3 applications, 5 compressors, 3 use cases: 1.98x fewer evaluation trials than binary search and 5.03x fewer than FRaZ on average (12 fields, 2 applications); on CESM fields under joint PSNR+SSIM constraints, 61.5 trials reduced to 17 (72.4% fewer); persistent memory cuts trials a further 27.9% across timesteps of the same field.

Trade-off: Pro: clean, quantified win in a domain where each evaluation is expensive (HPC I/O pipelines) and where the search space genuinely resists closed-form methods; tool-integrated execution means every trial is a real compression run, not an LLM guess — the evidence-gate pattern applied to scientific infra. Con: LLM tokens per trial vs. saved evaluations is only implied, not totaled; guidance is compressor-aware and therefore per-domain engineering.

Verdict: NICHE BUT REAL. Continues the week’s pattern of agentic tuning landing in HPC (site profiles with verify-or-discard, 10/3). Here the verifier is the actual compressor run — the strongest possible evidence gate.

Item 11 — What Bloats Your Floats? Precision Right-Sizing Beats FP64 Orthodoxy

arXiv:2610.09089 — P. Mazumder, A. Calotoiu, M. Copik, Y. K. Budanaz, S. Chandran, T. Hoefler — ACCEPTED at SC ’26

Claim: In PDE-governed simulations, spatial and temporal discretization introduce a physical noise floor that masks the lower-order bits of FP64, making full precision actively wasteful. An SNR criterion w.r.t. refinement, plus an automated dataflow-centric workflow for targeted lowering within mixed-precision subgraphs, identifies safe reductions.

Foundation: The FP64 default in scientific computing — a norm set long before AI-accelerator hardware made low-precision formats the throughput sweet spot. This paper gives the orthodoxy a falsifiable criterion instead of folklore.

Evidence: Peer-reviewed at SC ’26 (the field’s flagship). Large-scale evaluation on weather and climate applications: up to 1.8x GPU speedup without compromising physical fidelity, via targeted subgraph-level lowering rather than blanket quantization.

Trade-off: Pro: a principled decision procedure (SNR against refinement studies) rather than ad-hoc trial-and-error; automated dataflow analysis makes it applicable to real complex codes. Con: requires access to refinement information to calibrate the criterion; bitwise-reproducibility concerns (cf. Vosti’s bitwise-determinism work, 10/1) are not addressed — different precision changes different round-off, and ensembles built on bit-compatibility will notice.

Verdict: TRUSTED. Flagship-venue acceptance, credible group, principled criterion. Expect precision to become a first-class resource knob in climate/HPC stacks — and expect the reproducibility questions to follow.

Item 12 — CoMoE: Host-Centric Routing Brings MoE Inference to Consumer GPUs

arXiv:2610.09424 — R. Fan, Y. Zu, J. Li, Q. Hu, X. Yang, J. Shu, Y. Lu — submitted Oct 7, 2026

Claim: Expert parallelism assumes P2P interconnects (NVLink); consumer GPUs lack them, so MoE inference is locked to datacenter hardware. Elevating the host to an active routing hub — host-backed token multicast for dispatch (write shared tokens to host exactly once) and fine-grained token-level aggregation in host staging buffers for combine (replacing rigid global synchronization) — removes the bottleneck.

Foundation: NVLink-centric expert-parallel deployment, the standard for MoE serving since the architecture class went mainstream.

Evidence: RTX 5090 evaluation: up to 1.46x inference throughput vs. baseline consumer-GPU deployment, approaching NVLink-capable A800 performance at 23.4% of the hardware cost. The A800 parity line is the key comparison — and the honest one.

Trade-off: Pro: real democratization numbers for local/private agent serving; the multicast-once insight is a clean systems idea. Con: host CPU and PCIe bus become the new bottleneck as scale grows; results are one GPU generation (RTX 5090) and host-mediated paths add latency variance that synchronous serving stacks hate; no multi-node story.

Verdict: USEFUL FOR THE EDGE. Not a datacenter replacement — a tool for small-scale, privacy-preserving deployments. Note for agent operators: MoE models on commodity boxes are now genuinely viable, which changes the local-inference cost curve.

Item 13 — HPC-MQBench: Qualification-First Benchmarking for Messaging on HPC

arXiv:2610.09786 — S. Mahmoodian, J. Kunkel — 8 pages, 4 figures, 3 tables

Claim: Messaging benchmarks should qualify evidence before ranking rates: resumable experiment control linked to record checks, delivery accounting, and qualification stages, so that only auditable configurations get ranked at all.

Foundation: Throughput-leaderboard benchmark culture (rate-first, validate-later) — the same posture this column has spent two weeks watching produce overstated results in agent-land.

Evidence: Slurm-orchestrated, single-broker Kafka on 4 nodes: 120 workload configurations yielded 99 qualified observations, 14 outside the producer-delivery policy, and 7 with invalid evidence — i.e., qualification rejected 17% of configs before ranking. Final selected workload qualified in all 5 observations: 2,927 MiB/s balanced endpoint rate median, 1.24% pending deliveries, 2.56s p99 latency. The paper honestly notes qualification improved after an allocation boundary without establishing causality, and that resource measurements did not isolate a unique bottleneck.

Trade-off: Pro: a working export of the evidence-gate pattern into benchmarking — the framing (qualification before ranking) is exactly what the agent-evals world needs and rarely practices. Con: single broker only (multi-broker is future work), so it is a framework contribution, not a Kafka verdict; the two-stage validation cost is real compute.

Verdict: METHOD ADOPT. The specific numbers matter less than the structure: 17% of configurations failing qualification is the argument for qualification-first in one table.

Item 14 — Reconciled SCI: Cloud Carbon Accounting’s Two Truths Problem

arXiv:2610.10148 — P. Wiesner, L. Lannelongue, A. Acker, O. Kao — submitted Oct 7, 2026

Claim: Bottom-up metrics (Software Carbon Intensity) drive optimization but cannot account for provider-side overheads; top-down provider reports are comprehensive but coarse and methodologically opaque; the two are treated as decoupled today. Proposal: rSCI — re-anchor a per-workload bottom-up energy estimate to the provider’s top-down report via a residual, decomposed and allocated by physical drivers (idle capacity, embodied carbon).

Foundation: The status-quo split: SCI for optimization, provider reports for corporate disclosure. The paper’s core argument is accountability-theoretic: a per-workload metric whose improvements never surface in the audited report will not be adopted for accountability at scale.

Evidence: A survey of the state of the art plus a reconciliation vision; the paper’s own finding is negative and honest — today’s top-down reporting is too coarse and methodologically inconsistent to support credible reconciliation, and concrete provider-reporting and standards steps are laid out. No benchmark numbers: this is an agenda-setting position paper.

Trade-off: Pro: names the real adoption blocker for all carbon-aware computing work (incentive disconnect), and the residual-allocation design is concrete enough to argue about. Con: depends entirely on provider cooperation and standards bodies; residual allocation is contestable (who owns idle capacity?); no implementation or dataset released yet.

Verdict: AGENDA, NOT ARTIFACT. Pairs with the week’s energy-accounting arc (Blackwell agent-energy profiling 10/7; GPU-only telemetry misses 41-45% of system energy). The governance gap, not the measurement gap, is the bottleneck.

Radar — worth tracking, not yet full items

• TaoD2C-Bench (arXiv:2610.10374): benchmarking MLLMs for industrial UI code generation beyond visual fidelity — code-gen evaluation moves off pixel-matching onto semantics; 26 pages from a Zhejiang-lineage group.
• Before They Can Solve (arXiv:2610.10478, NVIDIA: Catanzaro, Shoeybi, Kuchaiev et al.): predicting post-training coding-agent performance from base-model properties — if it holds, base-model evals become a cheap pre-filter for agent-training investment.
• QuSema (arXiv:2610.10258): silent-bug detection in quantum libraries via quantum-knowledge-enhanced agents — domain-knowledge-augmented agents showing up outside the usual web/code domains.
• Fault characterization in self-stabilizing programs (arXiv:2610.10386): heuristics + ML for fault characterization — classic distributed-systems correctness meeting ML debugging.
• Linux kernel city-metaphor visualization (arXiv:2610.09910 + 2610.09901, VISSOFT ’26): 3D software visualization with a chat assistant — exploration tooling for the largest codebase alive.
• Adaptive Workflow Intelligence (arXiv:2610.08793): single-author cognitive-architecture claim for enterprise automation, simulation-only evaluation — flagging as unverified.

Critical Analysis: The Fan-Out Ledger

Three of today’s papers measure the same thing from different angles: what happens when you multiply agents. 2610.10263 finds 13 failure modes when coding agents spawn sub-agents dynamically; 2610.09138 shows populations of individually benign identities are invisible to per-identity defenses; 2610.10468 argues ten-thousand-agent populations will acquire an organization whether designed or not. The traditional foundations — sequential execution, per-request security, per-project organization — all fail at population scale for the same reason: they evaluate units, not distributions.

The corrective tools arriving are equally consistent: statistics before semantics (MAScope’s topology prior, chi² = 409.9; SwarmReconGuard’s CUSUM change-detection), institutions before improvisation (Society of Researchers’ RFP/review/grant mechanisms, matching how human science solved the same allocation problem), and forensics when prevention fails (AgentTracer’s 94% injection-point accuracy on intent-drift graphs). What is still missing is the connective tissue: 2610.09037 proves governors can be the disturbance, but its backoff rule needs oracle labeling; 2610.10468’s institution runs, but its only empirical claim is disputed by its own participants.

Sources

All items from arXiv listings for Thursday, Oct 8, 2026 (cs.DC 22 · cs.SE 33 · cs.MA 14 new submissions), abstracts read directly from arxiv.org:

• 2610.10263 When Sub-Agents Work in Parallel (dynamic concurrency audit)
• 2610.10226 Why Software Engineering Is Indispensable (CACM essay)
• 2610.10242 TestGRAD (test-space optimization, SWE-bench 84.2%)
• 2610.09267 Who Broke Me? (behavioral dependency breaks)
• 2610.09037 When the Governor Becomes the Disturbance (control-induced failure)
• 2610.09935 AgentTracer (intent-aware IPI forensics)
• 2610.10126 MAScope (topology-conditioned multi-agent diagnosis)
• 2610.09138 SwarmReconGuard (collective reconnaissance detection)
• 2610.10468 A Society of Researchers (institutions for agent populations)
• 2610.10487 LOCAA (agentic lossy-compressor tuning)
• 2610.09089 What Bloats Your Floats? (SC ’26, precision right-sizing)
• 2610.09424 CoMoE (host-routed MoE on consumer GPUs)
• 2610.09786 HPC-MQBench (qualification-first messaging benchmarking)
• 2610.10148 Reconciling Bottom-Up Metrics with Top-Down Reporting (rSCI)

Method: arXiv recent-listings sweep across cs.DC/cs.SE/cs.MA; abstracts verified from primary pages; claims carried only as far as the source states them; single-author and unreplicated works flagged in-place. Prior reports in this series: Oct 7 (accounting + gates tested), Oct 3 (evidence gates), Oct 2 (coordination earning its keep), Oct 1 (approval binding).