Salvinian Station

Hey guys! I use Google Gemini's Deep Research agent quite a bit -- but like anything AI, there are critical failure points and things to know -- and I just wanted to know how to better use it.

So I've been running a whole series of tests and just learning as much as I can about how it works. So much out there. But nothing quite like what I've put together here. This is

THE DEEP RESEARCH PROMPT PROTOCOL, VERSION 3.0

The Deep Research Prompt Protocol — v3.0

A working method for commissioning Gemini Deep Research

Supersedes: v1.0, v2.0
Evidence base: Agentic Deep Research Prompt Influence.md (Track A), Agentic Systems Evidence Assessment.md (Track C), Gemini Deep Research Capabilities Assessment.md (Track D)
Companion instruments: Citation_Spot_Check_Protocol.md, Deep_Research_Test_Battery.md
Date: 2026-08-03

────────────────────────────────────────

Reading this document

Claim codes. Every recommendation here traces to a specific researched claim. The prefix says which investigation it came from.
Evidence tiers. Used throughout, and required of any research this protocol commissions.
Recurring terms.

• IKD — Intrinsic Knowledge Dependence. Agents retrieve well on material they encountered in pre-training and degrade sharply outside that boundary, often failing to use retrieved evidence they cannot cross-check against internal weights. Bluntly: they tend to use search to confirm what they already know.
• Context rot. As tool output and page content accumulate over a long run, instructions given early fall out of the model's effective attention.
• Citation laundering. Attaching a real, reachable, topically relevant source to a specific claim it does not actually warrant.
• Granularity dilemma. Forcing finer citation (sentence-level) degrades attribution quality compared to coarser citation (section-level), because models can localize evidence to a chunk but not to exact claim boundaries.
• ICC — Intraclass Correlation Coefficient. A reliability statistic. Used here to separate variance caused by genuine task difficulty from variance caused by agent inconsistency.
• RLHF / DPO. Post-training alignment methods. Both reward assertive-sounding output, which degrades a model's confidence calibration.
• The plan gate. The moment a research agent shows you its proposed plan and waits for approval before executing.
• The seed. The opening prompt that produces that plan.

────────────────────────────────────────

The governing finding

Eleven assumptions across two protocol generations have now been researched. Eight were contradicted. The failures are not random — they share one shape.

The agent cannot report reliably on itself.

• It cannot calibrate its confidence. Self-assigned confidence runs ~26% higher on its own output than on neutral text, and alignment training (RLHF/DPO) pushes stated confidence into the top bins regardless of accuracy.
• It cannot attribute its sources. Citation recall around 51.5%, precision around 74.5%, with 3–18% of citations in modern agentic output failing to support the claim attached to them. Attribution is less reliable than stated confidence.
• It cannot verify its own work. A plan step labeled "verify," executed by the same loop, is mechanically indistinguishable from ordinary retrieval and tends toward confidence reinforcement rather than error detection.
• It cannot be instructed into exhaustiveness. Stopping is governed by compute budget and fixed depth limits, not by instruction.
• It cannot be averaged into correctness. Errors are systematically correlated across runs — an ICC of 0.621–0.664 means most of the variation between runs comes from how hard the task is, not from the agent rolling different dice. Two runs intersected produce the same blind spot twice.

Everything v1.0 and v2.0 got wrong came from asking the agent to police itself in a new costume. Confidence tags, source counts, termination clauses, verification steps, replication — all the same error.

Reliability comes from four things, none of them inside the agent:
That is the whole protocol. Everything below is application.

────────────────────────────────────────

Evidence status of every element
────────────────────────────────────────

PHASE 1 — The Seed

Revised understanding. v2.0 said the seed's only job was producing a good plan. A natural experiment says otherwise: two commissions were run with the seed alone, no plan-gate intervention, and both produced faithful plans and strong reports. The seed carries more than v2.0 credited.

But N1(b) — the finding that a constraint sitting inside a plan step binds better than the same constraint stated globally — pulls the other way. Both are true, and the resolution is deliberate duplication: state constraints in the seed so they shape the plan, then restate them at the gate attached to the steps that must honor them. This is not redundancy to be trimmed. It is the protocol.

Block 1 — COMMISSION

One sentence naming the deliverable and the decision it serves. The planner builds its decomposition from this; a topic yields a topic-shaped plan, a deliverable yields a deliverable-shaped plan.

Block 2 — BOUNDARY
Never state an expected count. Numerical anchors are honored in 22–61% of cases and no mitigation reliably removes them. A stated count pads the list when the true set is smaller and truncates it when larger.

Block 3 — CHAIN
The plan that comes back is what executes. If the chain isn't recognized here, you get parallel buckets instead of a chain.

Block 4 — SOURCE POLICY
Restate the relevant part of this at the gate, bound to individual steps. That is where it actually binds.

Block 5 — RETRIEVAL PRIORITY (provisional, pending B5)
Addresses Intrinsic Knowledge Dependence — agentic search performs well on material seen in pre-training and degrades sharply outside its knowledge boundary, often failing to use retrieved evidence it cannot cross-check internally. Costs nothing; the failure it targets is severe.

Block 6 — EVIDENCE TIERING

Not a confidence self-assessment. A classification of source type, which is checkable.
This survives where confidence tagging died because it asks what kind of thing is this source, not how sure are you. The answer is verifiable by opening the link. Track A and Track C both honored this and it was the single most useful property of both reports.

────────────────────────────────────────

PHASE 2 — The Plan Gate

Rebuilt. v2.0 said pruning reallocates compute to surviving steps. N1(a) contradicted this: depth and breadth are fixed per step, so removing a step simply spins up fewer search threads and shortens the run. The surviving steps do not get deeper. That rationale is dead.

The gate survives for two real reasons: scope control and constraint attachment.

What the gate is actually for

Scope control. Every step spends compute and can introduce drift. Removing a step removes its queries. Prune for focus, not for depth. If you want depth, that lives in API depth/breadth parameters, not in plan structure.

Constraint attachment. This is now the highest-value edit available. A constraint sitting inside a plan step is positioned adjacent to the tool call it governs, and escapes the attention decay that erodes anything stated in the opening prompt.

The four checks

1. Dependency depth. Does the plan's shape match the question's shape? A chain flattened into parallel buckets will run flat.
2. Smuggled assumptions. "Identify the advantages of X" has concluded X has advantages and will retrieve accordingly.
3. Drift. Is any step wandering into adjacent territory that will eat budget without serving the commission?
4. Bare source language. "Search the web" commits to nothing. Every step that matters should name its source classes.

Edit patterns
That second pattern is the protocol's strongest single move. Attach the constraint to the step, not to the preamble.

What no longer belongs here: adding a "verify, then synthesize" terminal step. Per N4, a verification step executed by the same loop is mechanically identical to another retrieval pass — the model reviewing its own output tends to reinforce it rather than catch errors. Verification requires a separate agent. See Phase 5.

Output contract placement

Deliver the output contract at plan approval. It is the last position before synthesis and the only surviving one — the seed is too early (context rot) and post-hoc is too late (re-synthesis loses content).
The citation reversal. v2.0 demanded claim-level citation on every number and date. That was harmful. This is the granularity dilemma: forcing sentence-level attribution degrades attribution quality by 16–276% versus coarser granularity, because models can localize evidence to a document or chunk but not to exact claim boundaries. Demanding precision they cannot deliver yields confident false mappings. An honest coarse pointer beats a precise wrong one — ask for section-level attribution and do the precision work yourself, externally.

Keep the "Unprompted findings" section. It produced Intrinsic Knowledge Dependence in Track A and the files-only restriction in Track D — in both cases more valuable than anything explicitly asked for.

────────────────────────────────────────

PHASE 3 — Reading and External Verification

Read in this order:

1. Evidence Gaps first, before the prose can persuade you the picture is complete. Note that ownership bias means the agent will understate its own gaps; treat this as a floor.
2. The tier tags — scan for [ADJACENT] and [VENDOR-CLAIMED] doing load-bearing work.
3. Unprompted findings — often the highest-value section.
4. Boundary Cases — near-misses are frequently the interesting ones.
5. Tables — where collation and de-duplication succeed or fail. Look for the same entity twice under different names.
6. Prose last — most persuasive, least verifiable.

Then run the spot-check. This is not optional and it is not a formality; it is the only reliability signal in the entire protocol that does not originate inside the agent. Full method in Citation_Spot_Check_Protocol.md. In brief: stratify toward load-bearing claims, write down what the source would have to say before opening it, and score PARTIAL honestly — a real source attached to a claim it doesn't warrant is the dominant failure mode and it looks correct on arrival.

Standing rule: any figure that leaves a report and enters an archive file, an essay, or a conversation with another person gets verified first. Not the whole report — the specific figure being carried forward.

────────────────────────────────────────

PHASE 4 — Interrogation

Follow-ups hit a routing decision: answer from accumulated context, or return to the web. Control it by splitting follow-ups by intended route.

Type A — Retrieval (provisional, pending B3)

Must carry an explicit tool command.
Type B — Additive only

Requests that add structure without restructuring content. Do not ask for reformatting or condensation. Per N5, zero-retrieval re-synthesis drops entities, collapses epistemic qualifiers into absolute assertions ("preliminary studies suggest 10–15%" becomes "studies prove 15%"), and degrades knowledge density — precisely the granular detail worth keeping. If the structure is wrong, fix it at the next plan gate rather than rewriting the report you have.

What moved out of Phase 4

The adversarial steelman pass — asking the agent to build the strongest case against its own conclusion. It remains the highest-value follow-up, but N4 says a critique produced by the same loop tends toward confidence reinforcement rather than genuine self-attack. It belongs in Phase 5, run by a different model.

────────────────────────────────────────

PHASE 5 — Architectural Verification

Replaces v2.0's replication rule, which is dead. Per N2, running the same commission twice and intersecting the results does not filter noise — it reproduces the same systematic blind spots and inflates confidence in incomplete data. Errors track the semantic boundaries of the base model, so the same gaps recur every run rather than varying randomly.

Two mechanisms, both requiring separation from the original agent:

Cross-model adjudication. Put the same commission to a different engine — a different vendor, a different base model. Disagreement is the signal. Agreement across genuinely different architectures is worth something; agreement between one agent and itself is worth nothing.

Adversarial pass by a separate agent. Hand the completed report to a different model and ask it to build the strongest case against the central conclusion from fresh sources, without balancing. A single report has no opponent; its synthesis converges on whatever retrieval surfaced.

Reserve both for work whose conclusions you intend to act on or publish from.

────────────────────────────────────────

The Notebook Layer (Gemini-specific)

A notebook holds two retrievable corpora: attached sources, and the contents of prior chats within it. Both are available to a Deep Research run launched inside the notebook, which also searches the open web. Grounding shapes the plan, not merely the retrieval that follows it — so notebook contents direct the investigation rather than decorating it.

Capacity (AI Pro): 500 notebooks, 300 sources per notebook, 500k words and 200MB per source. A 150-document archive slice fits comfortably. Free and Plus tiers hard-reject past 50 and 100 sources respectively.

Custom instructions: 10,000 characters, persistent across every chat and run in that notebook. Whether they survive a long run is unverified — the context-compaction claim that would protect them is documented for the Antigravity harness and bridged to Deep Research by shared-runtime inference. Until confirmed, do not rely on notebook instructions to carry an output contract. Restate at the gate.

Chat history can be unchecked to exclude it from retrieval. This is the built-in remedy for the heavy-notebook failure below.

Files-only mode (API, shipped May 2026) disables web search entirely. This is the only hard precedence guarantee available — there is no systemic rule making private sources override conflicting web sources, and prompt-level instruction to prefer them is the same class of unreliable self-direction as everything else in the governing finding.

The weight problem

Notebooks degrade as sessions accumulate. The retrieval payload grows until it displaces the live user turn, and the model responds fluently to accumulated history while ignoring what you typed. Observed at roughly a dozen sessions over five weeks.

The failure is silent. Output stays articulate, on-theme, and in your own vocabulary. Nothing errors.

• Control-prompt any established notebook before trusting it. Ask something with an unmistakable answer.
• Uncheck chat history when it isn't needed for the query.
• Distill and reset when a notebook goes heavy: export the chats, distill to a single source document, start fresh with that document as the only Source.
• Run all tests in a light notebook. A heavy one produces false negatives that look like capability limits.

────────────────────────────────────────

Outstanding Tests and Checks

Nothing below is settled. Priority order.

1. Citation spot-check — instrument ready, not run
Method: Citation_Spot_Check_Protocol.md. Targets: the two reports in hand. Produces your own PARTIAL + UNSUPPORTED rate on load-bearing claims, which should govern how much verification every future report needs.
Blocks: trusting any figure in v3.0's evidence base.

2. N3 magnitude transfer — cross-model check
The 51.5% recall / 74.5% precision figures come from a 2023 generative-search-engine study, pre-agentic. Direction is well-supported; magnitudes may not transfer. Run against a different engine than Gemini, per Phase 5.
Blocks: knowing how hard to distrust attribution.

3. B5 — IKD override efficacy
Does the retrieval-priority block actually improve recall on material published outside the model's knowledge boundary? Two arms, one question requiring facts from the last 60–90 days.
Blocks: Block 5's status. Highest-value potential addition remaining.

4. B1 — Termination language
Does prompt text move stopping behavior at all? Two arms — "search briefly and stop" vs. maximum-depth language. Measure compute expended (runtime, source count, step count), not item count.
Blocks: whether any residual termination language is worth keeping.

5. Notebook custom-instruction persistence — new
Does a 10,000-character notebook instruction set survive a full Deep Research run? Put an unmistakable formatting requirement in notebook instructions only — never in the prompt — and check adherence at the end of a long report.
Blocks: whether the notebook layer can host the standing protocol. If yes, most of the positioning problem dissolves.

6. B3 — Explicit-retrieval follow-ups
Does an explicit search command force new retrieval where a plain follow-up doesn't? Check whether new citations appear.
Blocks: Phase 4 Type A.

Retired

• B4 — run-to-run variance. Answered by N2: errors are systematically correlated, not stochastic. No test needed.
• B2 — whether forced tagging drives deeper retrieval even when the tags themselves are junk. Largely mooted. C1 and N3 together kill self-tagging as an output signal, and evidence tiering (Block 6) replaced it on different grounds. Low priority.

────────────────────────────────────────

When not to use this tool

• Single-fact lookup. Five seconds of search beats twelve minutes of confident synthesis.
• Confirming something you already believe. Retrieval converges on the frame supplied. If the conclusion is in your prompt, invert it and research the opposite.
• Genuinely novel or very recent material. IKD degrades performance sharply outside the knowledge boundary. Retrieval may be fresh while synthesis quietly isn't.
• Answers behind paywalls, logins, or unindexed archives. Confident report, invisible gap.
• Anything requiring primary data collection. It cannot run a survey, call a source, or read what isn't online.

────────────────────────────────────────

The one-line version

Write a seed good enough to produce a working plan; attach every constraint that matters to the plan step it governs; deliver the output contract at approval and never after; ask for coarse attribution rather than precise fiction; and get your reliability from your own eyes and a second model, because the agent cannot audit itself and every protocol version that assumed otherwise was wrong.

Let's talk about this! Seems useful. It's a lot of work, but when you know what you want to research, you provide your own prompt to an AI collaborator, and then direct it to apply the protocol and produce an enhanced version of your prompt that will follow the protocol and you'll get better results!