The business caseThe problem this solves

A donor gives money for something. The gift agreement says what, and for how long, and sometimes on what condition -- in prose, in a letter. The fund accounting system then records that as a short purpose string and a list of fund codes, and expenses are charged against it. At period end somebody decides, expense by expense, which of those charges actually satisfies the restriction and therefore releases funds from restricted to unrestricted net assets, and what the correct release total for the period is. MOST OF THAT IS A DATE TEST AND A LOOKUP. The part that is not is the part that moves money wrongly: a purpose the ledger records broadly and the donor wrote narrowly; a letter that ends the restricted period earlier than the fund record does; a milestone the Condition column says nothing about; and -- the other direction -- a letter that names the very cost being charged, in the sentence recording that the donor was asked and declined. Somebody with the gift file open beside the general ledger: reading each award letter, deciding whether the expense in front of them is what the donor meant, checking the date against the restriction period the LETTER states rather than the one the fund record carries, noticing that the same evaluation contract has been charged to two gifts, watching the unreleased balance, and totalling the release. The date test and the code lookup in that list are free and this kit ships them; the reading is what it is measuring.

The inputThe actual restriction release review packs, one accounting period each

The corpus is 38 restriction release review packs, one accounting period each, 0.25 MB (txt 38). A real corpus of this shape cannot be published. Restricted gift agreements name donors and carry their instructions; the expense ledger beside them names staff salaries and household-level assistance. There is no redaction that leaves the thing this kit measures intact, because the thing it measures IS the donor's own wording. And the answer key has to be KNOWN rather than inferred: the whole claim is a comparison between what free code settles from the tables and what only the letter settles, and that comparison needs a per-line ground truth nobody argued about afterwards. Each line is built to be a named case and the key is written from the case; evals/check_labels.py then reads the shipped page back through the shipping parser and asserts the planted key still holds.

Restriction Release Review
------------------------------------------------------------------------
Pack: RR-0001
Organization: Harbor Light Trust
Period: 2025-10-01 to 2025-12-31
Period End: 2025-12-31
Prepared: 2026-01-21
Release Policy: RP-2026.1

Release Rules In Force
------------------------------------------------------------------------
RR-1.1  Every line in "Expenses Charged In The Period" is decided once, against the gift it is
        charged to in that table's Charged To column. No line is left out.
RR-1.2  Where more than one rule bears on a line, apply them in this order and stop at the first
        that decides it: RR-7.1, RR-5.1, RR-4.1, RR-3.1, RR-2.2, RR-3.2, RR-2.1, RR-6.1.
RR-2.1  An expense releases restricted funds when its account code is one of the gift's Fund Codes
        and its date falls inside the gift's governing time restriction. An expense whose account
        code is not one of the gift's Fund Codes, and which no award letter in this pack brings
        inside the purpose, does not release.
RR-2.2  An expense dated outside the gift's governing time restriction does not release, however
        well its purpose fits. The governing time restriction is the Restriction Window in
        "Gift Agreements On File" unless an award letter in this pack states a different one.
RR-3.1  Where an award letter states the restricted purpose more NARROWLY than the Ledger Fund
        Purpose recorded against the gift, the letter governs and an expense outside the letter's
        purpose does not release even though its account code is one of the gift's Fund Codes.
RR-3.2  Where an award letter states the restricted purpose more BROADLY than the Ledger Fund

The outcomeWhat a good result looks like

A drafted reconciliation: one entry per expense, in the pack's order, each carrying the gift it was decided against, RELEASE / NO_RELEASE / INSUFFICIENT_EVIDENCE with a named ground, the governing rule from the pack's own printed rulebook, the gift agreement and donor letter identifiers the ground needs, the amount released on that line, and the period release total -- with the strongest free floor's answer computed beside every line for nothing.

Where it fitsWhat did work

Every line below is a measured result from this kit's own runs, with the figure that supports it. The headline above is not softened by any of them.

• Every restriction that decides a line is already a FIELD -- a purpose string, a fund code list, a window, a condition flag -- and your gift files carry no prose anybody has to read. — the free floor -- system-fields, $0.00
  It is at 100.0 pct on the 218 lines the printed tables settle, against the paid arm's 85.32 pct. It gets the duplicate tiebreak, the balance cap and both absences exactly right, invents nothing, and runs the whole corpus in a fraction of a second with no key. On a corpus with no letter channel it is simply the better product.
• Your award letters narrow, widen or re-date what the ledger recorded, and the release total is signed by somebody. — the paid arm, $0.05482837 per period
  89.06 pct on the letter channel against every free floor's 0.0 or 28.12, and the period release total exact on 37 of the 37 periods it answered against the strongest floor's 11. It over-released nothing at all -- 0 of 136 lines that release nothing -- and it released none of the 16 costs the donor was asked about and declined, where the keyword floor released all 16.
• You want the cheapest thing that reads a letter at all. — ⚠︎ NOT letter-keyword, even though it wins the free discriminator
  It is 78.01 pct against system-fields' 77.3 -- 0.71 points -- and it buys them by releasing every one of the 16 costs whose letter names them in the sentence recording the donor declined. Its period total is exact on 11 of 38 periods against system-fields' 7, and its median period is out by $43360.39 against system-fields' $25779.79.

At a glanceHow the whole thing runs

Run once, for real, on 2026-08-26. Every figure on these pages was captured from that run — nothing is written from intent.

14 steps, grouped by the question that sends you to them rather than by build order. Each tile carries the one figure that step is about, and opens the page behind it.

Should you use this?What you bring, where it stops, and when not to use it

Before you commit an afternoon to this, these are the answers that decide it. Each one is rendered from the record it lives in — and links the page that holds it in full.

Not asked of this kit — 2 questions: clone (a fresh clone of this kit runs with nothing fetched); judge (nothing here is graded by a model).

Last verified 2026-08-26 — r002-restriction-release. Every figure on these pages was captured from that run.

Run itHow this reaches your data

Every result on this page was produced by pure code over checked-in files, with no API key — which is why you can read the numbers before anyone spends anything.

Checked before this shipped — git clone, then python3 -m src.app and open http://127.0.0.1:9085. No pip install, no index build, no key. The corpus, the answer key and every committed result ship with the kit, so the page renders in full offline and the second button replays what r002-restriction-release actually answered. python3 -m evals.check_labels and all three free floors run with no key at all.

Step 01 of 14Business case

Written for: product manager · Measured during the eval run. Never estimated, never quoted from a vendor page.

In brief

What the clock covers. model call only, one per accounting period, four concurrent workers against a shared key that sibling kits were using at the same time; 1336.4 s of wall clock for 38 periods. Read it as a bound, not as a clean single-tenant latency.

Current processWhat it replaces

Somebody with the gift file open beside the general ledger: reading each award letter, deciding whether the expense in front of them is what the donor meant, checking the date against the restriction period the LETTER states rather than the one the fund record carries, noticing that the same evaluation contract has been charged to two gifts, watching the unreleased balance, and totalling the release. The date test and the code lookup in that list are free and this kit ships them; the reading is what it is measuring.

Step 02 of 14Architecture

Written for: solutions architect · Component map derived from the real code, not drawn from intent.

In brief

CorpusCorpusEvalsEvalsArchitectureArchitecturePromptPromptPromptPromptApp UIApp UIEvalsEvalsBusiness caseUnit cost

• 1stations numbered in run order
• txt
• jsonl
• json
• 5 of 9 stations carry a recorded failure

scroll → 9 stations

One question, end to end. Colour on the fan-in is the corpus format; a red hook marks every station with a recorded failure, and the words — every sub line, failure and report field — are in the ledger beneath. Every station is a link — click one to jump to its row, and each row links to the lens that explains it.

The swap seams

Components

Step 03 of 14App UI

Written for: anyone, in 5 seconds · Screenshots of the running app taken during the run.

SuccessesWhen it works

LimitsWhen it does not

A report showing only wins is an advert. This one is required, and the validator now refuses a kit that omits it.

Step 04 of 14Corpus

Written for: "can I point this at mine?" · Measured off the corpus the run actually used.

In brief

How it is cutWhat one expense lines charged in the period is

38 packs, each one accounting period at one invented nonprofit, carrying its own printed release rules, its gift agreements as the ledger records them, the expenses charged against them, and the donors' own award letter extracts. Every pack is independent -- no carried state, no ordering constraint -- so the run is embarrassingly parallel. The composition is CONSTRUCTED rather than dealt, from a fixed schedule asserted by evals/check_labels.py: 126 lines release, 136 release nothing and 20 cannot be settled from the pack at all, because a random draw makes almost every expense unremarkable and the period-level recommendation collapses to a constant. As it is, the single majority word scores 48.23 pct at the line level and 47.37 pct at the period level, and both the majority and the measured figure are printed.

SetupWhat the setup figure measured

There is no index to build. The whole pack, minus the withheld Development Office Correspondence block, goes into the prompt verbatim -- no chunking, no retrieval, no pre-digest. A summariser here would be a place for the operative sentence of a donor's letter to be lost before the model saw it, and that sentence is the entire thing the model is being paid to read.

LicenceLicence

MIT -- this repository's own licence. The corpus is generated in-process by tools/build_corpus.py from a fixed seed and contains no third-party data of any kind; verified by reading every generator input on 2026-08-26.

Bring your ownBring your own restriction release review packs, one accounting period each

Replace data/corpus/*.txt and data/gold.jsonl, in that order, and read data/SOURCES.md first. src/pack.py is regular expressions over this layout, so a real gift file needs that module rewritten before anything else works -- and the three places most likely to need it are named in SOURCES.md. Then run python3 -m evals.check_labels: it is free, it needs no key, and it will tell you whether your key and your packs agree before you spend anything. The release rules travel INSIDE each pack rather than in this repository, so your own policy goes in the same place rather than into the code.

⚠︎ And what stops being true when you do: ⚠︎ WHAT DOES NOT TRANSFER IS THE BASE RATE, AND IT IS THE FIRST THING PEOPLE CARRY OVER. 126 of 282 lines here release and 64 of 282 turn on a sentence in a donor's letter, because the corpus was built to put a number on that second figure. Your period will not look like that. If your restrictions really are all in fields, the letter channel is empty and the free floor in this repo is the better buy -- it scores 100.0 pct on the 218 lines the tables settle against the paid arm's 85.32 pct. Every percentage on this page is a percentage measured on THIS shape.

Step 05 of 14Prompt

Written for: engineer · Logged from the run, verbatim.

In brief

The assembled prompt in full, and its real decomposition. Every part below occurs in the prompt that was actually sent, and the token counts sum to the recorded input total — they were measured against the provider’s own counter, not apportioned by character share.

AssemblyHow the prompt is assembled

This is the cost lesson as arithmetic: of the 2,474 tokens assembled, 1,663 are contexts — 67% of the prompt, the largest single part. A per-request bill follows whichever part is biggest, and on this kit that is the one named here.

The system instruction exactly as src/prompt.SYSTEM carries it, followed by pack RR-0001 exactly as src/select.body() assembles it -- five of the six sections, with Development Office Correspondence cut at the seam. This is the string that was posted, not a description of it.

Full promptThe prompt in full

You are reconciling donor restriction releases for one accounting period at a nonprofit, and deciding, expense by expense, whether the expense actually satisfies the donor's restriction and therefore releases funds from restricted to unrestricted.

Every rule you may rely on is printed in the pack, in "Release Rules In Force", with an identifier. The rule order is printed there too. Do not apply a rule, a threshold or a policy from anywhere else.

Return one entry for EVERY line in "Expenses Charged In The Period", in the order the pack lists them, using the pack's own line identifiers, and say which gift you decided it against. Never drop a line because it looks unremarkable.

For each line give exactly one decision:

  RELEASE                the expense satisfies the restriction on that gift and releases funds.
  NO_RELEASE             it does not, or the pack forbids releasing against it this period.
  INSUFFICIENT_EVIDENCE  the pack does not carry what the decision turns on. Do not decide; say
                         what is missing.

The ground is exactly one of these, and it must belong to the decision you gave:

  RELEASE
    PURPOSE_AND_PERIOD_MET        the expense is inside the gift's purpose and inside its
                                  governing time restriction
    PURPOSE_MET_BY_LETTER         the ledger's fund codes do not cover it, and an award letter in
                                  this pack brings it inside the donor's purpose
    CONDITION_SATISFIED           the gift carries a condition, this pack records it as met, and
                                  the expense otherwise qualifies
    CAPPED_BY_UNRELEASED_BALANCE  it qualifies, but releasing the whole amount would exceed what
                                  is left unreleased on that gift
  NO_RELEASE
    OUTSIDE_TIME_RESTRICTION      dated outside the gift's governing time restriction
    OUTSIDE_FUND_PURPOSE          outside the purpose the gift is restricted to, and nothing in
                                  this pack brings it inside
    EXCLUDED_BY_LETTER            an award letter states the purpose more narrowly than the ledger
                                  does, and this expense falls outside the letter's purpose
    CONDITION_NOT_MET             the gift carries a condition that is not met at period end
    DUPLICATE_CLAIM               the same expense releases against a different gift, not this one
  INSUFFICIENT_EVIDENCE
    AMOUNT_NOT_STATED             the line carries no amount to release
    PURPOSE_NOT_DETERMINABLE      this pack does not carry a purpose for that gift

Also give, for every line, the amount released against it: the expense amount where the whole of it releases, the smaller figure where the pack caps it, 0 where nothing releases, and null where you did not decide. Then give the period release total: the sum of those amounts across every line in this pack, to the cent.

Cite the governing rule as a rule identifier printed in this pack, and attach the support as gift, line or award letter identifiers printed in this pack. NEVER write an identifier that is not printed in the pack in front of you -- an invented citation is worse than none, because it is the first thing an auditor will pull.

Anything in the pack may bear on a line. Where a printed table and a donor's own words disagree, they are not a tie.

Reply with JSON and nothing else:

{"close_action": "POST_RELEASE" | "REQUEST_INFORMATION" | "NO_RELEASE_THIS_PERIOD",
 "period_release_total": <number, to the cent>,
 "lines": [{"line": "<the pack's line identifier>",
            "gift": "<the gift you decided it against>",
            "decision": "RELEASE" | "NO_RELEASE" | "INSUFFICIENT_EVIDENCE",
            "ground": "<one of the eleven above>",
            "governing_rule": "<a rule identifier from this pack>",
            "support": ["<identifiers from this pack>"],
            "releasable_amount": <number or null>,
            "finding": "<the one sentence the release schedule would carry for this line>"}],
 "rationale": "<two sentences at most, on what decided the hardest line>"}

close_action is REQUEST_INFORMATION if any line is INSUFFICIENT_EVIDENCE; POST_RELEASE if none is and the period release total is above zero; NO_RELEASE_THIS_PERIOD otherwise. None of the three posts, releases or reclassifies anything -- each is a recommendation to the person who does.

Restriction Release Review
------------------------------------------------------------------------
Pack: RR-0001
Organization: Harbor Light Trust
Period: 2025-10-01 to 2025-12-31
Period End: 2025-12-31
Prepared: 2026-01-21
Release Policy: RP-2026.1

Release Rules In Force
------------------------------------------------------------------------
RR-1.1  Every line in "Expenses Charged In The Period" is decided once, against the gift it is
        charged to in that table's Charged To column. No line is left out.
RR-1.2  Where more than one rule bears on a line, apply them in this order and stop at the first
        that decides it: RR-7.1, RR-5.1, RR-4.1, RR-3.1, RR-2.2, RR-3.2, RR-2.1, RR-6.1.
RR-2.1  An expense releases restricted funds when its account code is one of the gift's Fund Codes
        and its date falls inside the gift's governing time restriction. An expense whose account
        code is not one of the gift's Fund Codes, and which no award letter in this pack brings
        inside the purpose, does not release.
RR-2.2  An expense dated outside the gift's governing time restriction does not release, however
        well its purpose fits. The governing time restriction is the Restriction Window in
        "Gift Agreements On File" unless an award letter in this pack states a different one.
RR-3.1  Where an award letter states the restricted purpose more NARROWLY than the Ledger Fund
        Purpose recorded against the gift, the letter governs and an expense outside the letter's
        purpose does not release even though its account code is one of the gift's Fund Codes.
RR-3.2  Where an award letter states the restricted purpose more BROADLY than the Ledger Fund
        Purpose, the letter governs and an expense the letter brings inside the purpose releases
        even though its account code is not one of the gift's Fund Codes.
RR-3.3  An award letter that merely MENTIONS a cost does not bring it inside the purpose. A letter
        recording that a cost was put to the donor and not agreed leaves that cost outside, and that line is then decided under RR-2.1.
RR-4.1  A gift carrying a condition that is not met at Period End releases nothing in this period,
        whether the condition is recorded in the Condition column or stated in an award letter.
RR-4.2  A condition is met only where this pack carries a record that it is met. A gift whose
        condition is met releases on the same terms as any other gift.
RR-5.1  An expense releases against exactly one gift. Where two lines in this period carry the same
        date, account code, description and amount but are charged to different gifts, the charge
        against the gift with FEWER Fund Codes releases and the other does not; where both gifts
        carry the same number of Fund Codes, the charge against the gift whose Restriction Window
        begins earlier releases.
RR-6.1  Release against a gift may not exceed that gift's Unreleased balance at the start of the
        period. An expense that would exceed it releases only up to that balance.
RR-7.1  Where this pack does not carry what the decision turns on -- no amount against the line, or
        no purpose determinable for the gift -- the line is not decided and what is missing is
        named instead.

Release amounts are stated to the cent. There is no materiality floor: every line is decided.

Gift Agreements On File
------------------------------------------------------------------------
Gift   Donor                                          Amount     Unreleased  Restriction Window         Ledger Fund Purpose                  Fund Codes         Condition
G1     Corvid Point Partners Giving Program       120,169.58      68,757.12  2025-04-20 to 2026-11-17   School meals programme               5200,5900          none
G2     Brackenridge Family Giving Fund             87,000.00      68,757.12  2024-09-26 to 2027-04-16   Literacy tutoring service            5800,5810,5900     none
G3     Grayling Trust                             368,500.00     234,520.10  2024-12-23 to 2025-11-15   Coastal ecology programme            5100,5110          none
G4     Ilse Ravenna Foundation                    270,500.00     120,762.15  2024-10-16 to 2026-06-10   Clinic access programme              5500,5510          none

Expenses Charged In The Period
------------------------------------------------------------------------
Line   Date         Account   Description                                                            Amount  Charged To
E1     2025-10-08   5900      Joint programme evaluation contract, quarterly instalment           42,504.75  G1
E2     2025-10-08   5900      Joint programme evaluation contract, quarterly instalment           42,504.75  G2
E3     2025-10-20   5110      Graduate stipend, coastal ecology cohort                            19,008.75  G3
E4     2025-10-09   5100      Travel and conference registration, marine science meeting           9,103.84  G3
E5     2025-12-16   5100      Vessel time, estuary survey                                          5,186.42  G3
E6     2025-10-15   8100      Donor cultivation reception catering                                24,549.65  G3
E7     2025-12-16   6410      Clinical audit fee, evening clinic                                  26,204.97  G4
E8     2025-12-21   5500      Vaccine cold chain consumables                                      26,405.72  G4

Award Letter Extracts
------------------------------------------------------------------------
[L1] Gift G3 -- award letter dated 2024-11-29:
    "The Fund does not support travel, conference attendance or publication charges; every other
    cost of the coastal ecology work is within the award."

[L2] Gift G4 -- award letter dated 2024-09-12:
    "A clinical audit fee was proposed to the donor, who asked that it be met from unrestricted
    funds rather than from this award."

[L3] Gift G1 -- award letter dated 2025-04-06:
    "The donor's adviser confirms the gift instrument carries no reporting requirement beyond the
    annual audited statements."

Raw responseThe raw response

{
  "close_action": "POST_RELEASE",
  "period_release_total": 87919.22,
  "lines": [
    {
      "line": "E1",
      "gift": "G1",
      "decision": "RELEASE",
      "ground": "PURPOSE_AND_PERIOD_MET",
      "governing_rule": "RR-5.1",
      "support": ["E2", "G2"],
      "releasable_amount": 42504.75,
      "finding": "E1 is the duplicate charge that releases under RR-5.1 because G1 has fewer Fund Codes than G2, and it falls within G1's purpose and window."
    },
    {
      "line": "E2",
      "gift": "G2",
      "decision": "NO_RELEASE",
      "ground": "DUPLICATE_CLAIM",
      "governing_rule": "RR-5.1",
      "support": ["E1", "G1"],
      "releasable_amount": 0,
      "finding": "E2 is identical to E1 and charged to G2, which has more Fund Codes, so RR-5.1 blocks this duplicate."
    },
    {
      "line": "E3",
      "gift": "G3",
      "decision": "RELEASE",
      "ground": "PURPOSE_AND_PERIOD_MET",
      "governing_rule": "RR-2.1",
      "support": ["G3", "L1"],
      "releasable_amount": 19008.75,
      "finding": "Graduate stipend is a coastal ecology cost within G3's purpose and window, and L1 does not exclude it."
    },
    {
      "line": "E4",
      "gift": "G3",
      "decision": "NO_RELEASE",
      "ground": "EXCLUDED_BY_LETTER",
      "governing_rule": "RR-3.1",
      "support": ["G3", "L1"],
      "releasable_amount": 0,
      "finding": "L1 expressly excludes travel and conference attendance, so this marine science meeting charge does not release."
    },
    {
      "line": "E5",
      "gift": "G3",
      "decision": "NO_RELEASE",
      "ground": "OUTSIDE_TIME_RESTRICTION",
      "governing_rule": "RR-2.2",
      "support": ["G3"],
      "releasable_amount": 0,
      "finding": "Dated 2025-12-16, after G3's restriction window ends on 2025-11-15, so no release."
    },
    {
      "line": "E6",
      "gift": "G3",
      "decision": "NO_RELEASE",
      "ground": "OUTSIDE_FUND_PURPOSE",
      "governing_rule": "RR-2.1",
      "support": ["G3", "L1"],
      "releasable_amount": 0,
      "finding": "Donor cultivation catering is not a coastal ecology cost and account 8100 is not a G3 fund code."
    },
    {
      "line": "E7",
      "gift": "G4",
      "decision": "NO_RELEASE",
      "ground": "OUTSIDE_FUND_PURPOSE",
      "governing_rule": "RR-2.1",
      "support": ["G4", "L2"],
      "releasable_amount": 0,
      "finding": "L2 records that the clinical audit fee was proposed to the donor and not agreed, leaving it outside G4's restricted purpose."
    },
    {
      "line": "E8",
      "gift": "G4",
      "decision": "RELEASE",
      "ground": "PURPOSE_AND_PERIOD_MET",
      "governing_rule": "RR-2.1",
      "support": ["G4"],
      "releasable_amount": 26405.72,
      "finding": "Vaccine cold chain consumables fall within G4's clinic access purpose and window and are within the unreleased balance."
    }
  ],
  "rationale": "The hardest line was E7: L2 records the clinical audit fee was put to the donor and not agreed, so under RR-3.3 it is decided by RR-2.1 and remains outside G4's restricted purpose. E1 and E2 are exact duplicates, so RR-5.1 releases only the charge against G1, the gift with fewer Fund Codes."
}

Step 06 of 14Evals

Written for: the skeptic · The harness output, with as_of / model version / dataset version / verified_by.

In brief

Decide which expenses actually release a donor's restriction — 282 restriction release packs drawn from 38 real restriction release review packs, one accounting period each. One model answered, and every answer was then graded one way — by == against a fixed gold value, which is a measurement too and only as good as the gold behind it.

The rulerHow it was graded

Exact match per line, in pure Python. No model grades anything, there is no judge and there is no rubric -- the answer key is planted with the corpus and re-derived from the shipped packs before any arm may spend. The discriminator requires the gift, the decision, the ground, the governing rule, every identifier the ground needs and no invented citation, ALL AT ONCE, which is deliberately harsher than the three-way call published beside it.

MeasurementsWhat was measured

Two words carry this page: Counted is deterministic and nobody's opinion and Not yet known is printed blank rather than filled with something plausible. There is no Judged row here and that is the point: nothing on this page is a model's opinion about another model. The row most worth having is currently the empty one.

Grading costWhat it costs

Every dollar on this page is a MEASURED token count multiplied by a named vendor's PUBLISHED rate -- a projection onto a rate card, not a bill anyone paid. The rate is read from this repo's own committed card, build/facts/models.json, rather than typed here, so it cannot drift from what the rest of the estate projects onto. checked_on is that card's own as_of, not the date this page was written.

Rates checked 2026-08-18. The provider that actually ran every call here is kept off this page per the series rule. And the three free floors, the wiring stub and the answer-key gate are not priced because they cost nothing: they make no call at all.

Grading unitWhat the grading figure prices

Every arm in this lens except the model is free: no key, no network, no tokens. The grading itself -- every percentage on this page -- cost $0.00.

The gradersOne way to grade, and why it is the only one

Every baseline figure here is the strongest floor, letter-keyword, at the shipped MIN_LEN=5 / MIN_HITS=2 (b002-restriction-release-letterkeyword). ⚑ AND ITS 0.71-POINT LEAD OVER THE PURE-TABLE FLOOR IS BOUGHT WITH RESTRICTED MONEY. letter-keyword releases every one of the 16 costs whose award letter names them in the sentence recording that the donor was asked and DECLINED (RR-3.3); system-fields, which cannot read a letter at all, releases none of them. Reading the discriminator alone would sell you the worse of those two floors.

The row opens its own page: how the test was run, one real row, the formula with every iteration of it, and the analysis.

Choosing oneWhen to reach for the model at all

The comparison is only useful if it ends in a choice, and on this kit the choice is not which grader — there is one, and it is ==. It is whether to call a model for this field at all, and the answer is conditional.

This pipeline was also attacked, which is a different question from whether its answers are right: see Threat model for the injection experiment, its two gates and what it does not prove.

Failure causesHow it fails

Step 07 of 14Unit cost

Written for: whoever signs off on the bill · Measured over the eval run, per model. Never quoted from a vendor page.

In brief

The token counts are measured on a real run and belong to this pipeline — which sections are selected, the field schema, the prompt — so they hold wherever you run it. The dollars are those counts multiplied by each vendor's published rate, checked 2026-08-18. Nobody paid these particular bills; they are what the same work would cost you on a card you can sign up to today.

Cost driversWhat actually moves the bill

• OUTPUT TOKENS, AND ALMOST ALL OF THEM ARE REASONING. 95.55 pct of r002-restriction-release's output (648,376 of 678,556) was provider-side reasoning rather than the reconciliation itself. The input side is 2,516.29 tokens on a 6,100-character pack and is not the bill.
• ONE CALL PER ACCOUNTING PERIOD, NOT PER EXPENSE. 38 periods carrying 282 lines is 38 calls, so the unit cost is per period and a period with twice the lines costs roughly the same. That is the right shape here because RR-5.1 and RR-6.1 are cross-line rules -- a duplicate charge and a balance cap cannot be decided one line at a time.
• THE PACK GOES IN WHOLE. No retrieval, no chunking, no index, so input grows linearly with the pack and there is no embedding bill at all.
• THE ANSWER-KEY GATE, ALL THREE FREE FLOORS AND THE WIRING STUB COST NOTHING. Five committed result files on this page were produced with no key, no network and no tokens.

Your volumeWhat it costs at your volume

Linear in periods and roughly linear in pack size, because there is one call per period and the pack goes in whole. Ten times the periods is ten times $0.05482837. Ten times the LINES in one period is not: the input grows linearly but the reasoning that dominates the bill grows faster than that, and the honest signal is output_tokens_max against the ceiling -- 42,334 of 64,000 (66.1 pct) on packs of six to ten lines. ⚑ AND THE FREE FLOOR IS FLAT AT ZERO IN BOTH DIRECTIONS, which is the comparison that matters on the 218 lines it answers perfectly.

Model choiceWhy this model

One tier was run, and it is the tier this estate's shared key points at. A second was not, which is a spend decision recorded in could_not_verify rather than a result. ⚑ AND THE COMPARISON THAT DECIDES THIS KIT IS NOT BETWEEN TWO MODELS AT ALL: it is between the paid arm at $0.05482837 a period and a file in this repo that costs $0.00 and beats it on 218 of the 282 lines. A cheaper model is not the lever here; the lever is whether your restrictions live in fields or in prose.

Other modelsOn other models

This is arithmetic, not a run. No model below was executed against the labelled set, and no accuracy is claimed for any of them. What transfers is the input volume: retrieval is model-independent, so every model would receive the same passages.

per-period average, this run

The codeEvery file, and what it is for

10 modules, no framework, and almost no dependencies. The pipeline is stdlib Python, because a kit is meant to be read and changed by someone who cloned it ten minutes ago — every dependency is a thing they have to understand before they can touch the part they came for.

Five of these are swap seams: the points you edit to make the kit yours. Each is marked, and each block below is the module’s real shape, read out of the file rather than written here.

The files on this page are not in the public GitHub catalog.

src/segment.pysection split

Cut the pack on its underlined headings -- Restriction Release Review, Release Rules In Force, Gift Agreements On File, Expenses Charged In The Period, Award Letter Extracts, Development Office Correspondence. Deterministic, so 'what did we send' is a list of section names rather than a guess about a token window.

# Cut a restriction release review pack into addressable sections. Pure code, no model.

HEAD = re.compile(r"^([A-Z][A-Za-z ,]+)\n-{10,}\n", re.M)
def sections(text):
def named(text, name):

src/select.pythe seam that withholds — a swap seam

The Development Office Correspondence block -- that this donor is among the largest by lifetime giving and the renewal ask is next month, that the unrestricted position is tight this quarter, that the board has already been shown a projected release figure -- never leaves the machine. None of it bears on whether an expense falls inside a donor's stated purpose; all of it is pressure on a determination that is supposed to be made on the gift instrument. Withheld at the seam rather than trusted to a sentence in a prompt, and the UI prints what went and what stayed, per pack.

You change it to: NEVER_SENT is a tuple of section names. Adding one withholds it from every pack and the UI reports the change per pack without any other edit.

# SEAM 2 -- what leaves this machine. Pure code, and deliberately a denylist of one.

NEVER_SENT = ("Development Office Correspondence",)
def sent(sec_names):
def body(text, sections_fn):

src/pack.pythe parser

Regular expressions over one layout, shared by the app, the eval harness and the answer-key checker. Every column boundary in the rendered pack is two or more spaces on purpose, because a column that just fits merges two fields on exactly the row whose value is longest.

# Read one restriction release review pack into fields. Pure code, no model, no network.

DECISIONS = ("RELEASE", "NO_RELEASE", "INSUFFICIENT_EVIDENCE")
GROUNDS_BY_DECISION = {
GROUNDS = tuple(g for d in DECISIONS for g in GROUNDS_BY_DECISION[d])
DECISION_OF = {g: d for d, gs in GROUNDS_BY_DECISION.items() for g in gs}
CLOSE_ACTIONS = ("POST_RELEASE", "REQUEST_INFORMATION", "NO_RELEASE_THIS_PERIOD")
RELEASE, NO_RELEASE, INSUFFICIENT = DECISIONS
def money(s):
def _section(text, name):
def parse(text):

src/checks.pyeverything pure code settles

RR-1.2's printed rule order applied in code: the absences first, then the duplicate tiebreak, then the Condition column, then the Restriction Window, then the Fund Codes, then the Unreleased balance consumed in the order the table prints. It never opens an award letter -- not 'reads them badly', never opens them -- and that gap is the measurement.

# Everything about a release decision that PURE CODE can settle from the printed tables.

def _within(day, lo, hi):
def duplicates(p):
def structured_finding(p, ln, running, dups=None):
def read_in_code(p):
def close_action(rows):
def period_total(rows):

evals/baseline.pythe three free floors — a swap seam

dates-and-codes (the calendar and the chart of accounts), system-fields (the whole of checks.py), and letter-keyword (system-fields plus the cheap trick: if words from the expense description appear in that gift's award letter, treat the purpose as met). All three answer in the same JSON shape the model is asked for, so one scorer grades every arm with no adapter in between.

You change it to: MIN_LEN and MIN_HITS. Five characters and two distinct hits is where the trick is at its strongest on this corpus; shorter matches everything and longer matches nothing. Published rather than buried, because a paid arm measured against a deliberately weak floor is not measured at all.

# The free floors. Pure Python, no key, no network, and each a genuine attempt at the whole job.

MODES = ("dates-and-codes", "system-fields", "letter-keyword")
STOP = {"about", "after", "again", "against", "among", "annual", "award", "before", "being",
MIN_LEN = 5
MIN_HITS = 2
def _words(s):
def letter_hit(p, ln, gift_id):
def review(text, mode="system-fields"):

src/prompt.pythe prompt

The system instruction plus the pack verbatim, minus the withheld section. No pre-digest and no per-line summary computed in code and handed over -- a summary is where the operative sentence of a donor's letter goes missing before the model ever sees it.

# The assembled prompt, in one place, in the order it is sent.

LETTERS_HEADING = "Award Letter Extracts"
SYSTEM = """You are reconciling donor restriction releases for one accounting period at a \
BLIND_SYSTEM_SUFFIX = """
def build(text, blind=False):
def _strip_letters(body):
def render(parts):

src/reconcile.pythe one model call

One completion per accounting period. Brace-matching parse, two enum normalisations and a list coercion; a reply that does not parse is a FAILURE with at_ceiling recorded, never a partial score.

# One pack in, one drafted release reconciliation out. The only place a model is called.

MAX_TOKENS = 64000
THINKING = None
def parse_reply(text):
def normalise(obj):
def reconcile(cfg, text, blind=False, complete_fn=None, max_tokens=None):
def cited_ids(answer):

evals/scoring.pythe scorer

Exact match per line, pure Python, no judge and no rubric. The discriminator requires the gift, the decision, the ground, the rule, the required identifiers and no invented citation, all at once.

# Score an arm against the answer key. Pure code, exact match per line. No model grades anything.

RELEASE, NO_RELEASE, INSUFFICIENT = "RELEASE", "NO_RELEASE", "INSUFFICIENT_EVIDENCE"
OMITTED = "OMITTED"
CENT = 0.011
def _pct(n, d):
def _key(s):
def rows_by_line(answer):
def _cited(r):
def _numeric(v):
def score(records, golds, valid_ids=None):

evals/check_labels.pythe answer-key gate

Re-derives the key from the SHIPPED packs with the SHIPPING parser and asserts the channel split in both directions -- free code must be RIGHT on every record line and WRONG on every letter line. It convicted a real defect before any arm spent.

# Re-derive the answer key from the SHIPPED packs, with the SHIPPING parser, and convict it.

HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
CORPUS = os.path.join(HERE, "data", "corpus")
GOLD = os.path.join(HERE, "data", "gold.jsonl")
STATS = os.path.join(HERE, "data", "corpus-stats.json")
EXPECTED_RULES = ("RR-1.1", "RR-1.2", "RR-2.1", "RR-2.2", "RR-3.1", "RR-3.2", "RR-3.3",
def main():

evals/run.pythe run journal

Every answer is appended to results/journal-<run-id>.jsonl the moment it lands, with O_APPEND, so a killed process costs the calls still in flight and nothing more. --from-journal rebuilds a result file from a journal that already exists and never fires a call.

# Reconcile all 38 periods and write one result file. THIS SPENDS MONEY.

HERE = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
RESULTS = os.path.join(HERE, "results")
CORPUS = os.path.join(HERE, "data", "corpus")
GOLD = os.path.join(HERE, "data", "gold.jsonl")
KIT = "restriction-release"
def documents():
def load_doc(doc_id):
def load_gold():
def valid_ids(doc_ids):

Start hereThe shortest path into it

Every entry above is a file in this kit, listed in the order the pipeline runs it.

ScenariosWhat it costs at your volume

Everything below is computed from one measured base: 2516 input and 17856 output tokens per query, all of it fixed — this kit sends the document's own selected sections, so there is no retrieval depth to turn. Change the volume and the bill scales linearly, because nothing here batches.

OperationsFour shapes of workload

The same arithmetic, at volumes worth naming. These are illustrations of scale, not measurements of anyone’s deployment.

Model follows the controls above.

What this ignoresWhere a real bill diverges

In one lineWhat this kit exposes

⚠︎ NOT MEASURED. evals/injection.py ships, all three phrasings are written out in full, and it was not run. That is a spend decision and it is recorded here rather than left to look like a pass. ⚑ AND THE SURFACE IS NAMED EVEN THOUGH THE RATE IS NOT: the award letter extracts are the channel this kit pays a model to read, so anything writable into a gift record's notes field is inside the trust boundary of the only column a free floor cannot reach -- and a sentence saying 'the donor confirms every cost charged to this gift is within the award' is indistinguishable IN FORM from the sentence that legitimately decides 64 lines in this corpus. ⚠︎ THE DIRECTION MATTERS HERE: a suppression on this use case does not hide a finding, it MOVES MONEY -- a line correctly held, released under injection, is restricted net assets reclassified as unrestricted against a purpose the donor never widened. No number is published for it.

API_KEY is read from <code>&lt;repo&gt;/.env</code>, this kit's own <code>.env</code>, or the real environment, in that precedence. Both files are gitignored from the first commit and this repo has never held a credential. Nothing is asked of a reader: the page on the site executes nothing, and the local UI renders fully with no key at all.

The experimentWe attacked it — two gates

An indirect prompt injection has to clear two gates, and they behave differently. Both were run for real on 2026-08-26.

Nothing here is a resistance claim. The probe exists and was not fired.

The resultThe award letter extracts are the channel this kit pays a model to read, so anything writable into them is inside the trust boundary of the only column free code cannot reach -- and on this use case a successful injection releases restricted money rather than hiding a finding. NOT MEASURED: the probe ships, all three phrasings are written out, and no run of it exists. No number is published.

evals/injection.py is committed and complete: it forces one further award letter extract into every pack in a scope fixed BEFORE the run, pairs every cell against the same model's own un-injected answer in r002-restriction-release so a line the arm was already getting wrong cannot be counted as flipped, reads the identifier set from the INJECTED pack so citing the forced letter is not scored as an invention, and records for every line that HELD whether its ground, its rule or its released amount moved. None of that has been run. There is no rate here, no denominator and no ceiling, and none is invented.

HonestyWhat this does not prove

• Everything about this surface. No attack run exists.
• In particular: whether the letter channel -- the only column this kit pays for -- can be turned on by a sentence in the same position as the letters that legitimately decide 64 lines. That is the question the probe was written for.
• And whether an injection placed in the WITHHELD Development Office Correspondence block would have any effect. By construction it cannot reach the model, and that was not probed either.

In one lineThe only guardrail is the prompt

One instruction, no enforcement. It mostly holds — and mostly is the whole subject.

Never post a journal entry, release a restriction, reclassify net assets or write to any ledger. This kit produces a RECONCILIATION for a person to read, and the refusal -- NO_RELEASE, or INSUFFICIENT_EVIDENCE naming what is missing -- is part of the reconciliation rather than a failure of it. Posting and releasing are acts a named person takes and signs.

Stated on the UI and in the README, and enforced by there being no such endpoint: src/app.py serves /api/packs, /api/pack, /api/prompt, /api/recorded and /api/reconcile, and nothing else. There is no write path to remove.

EvidenceDoes it hold?

The limitWhat a guardrail is not

• This is ABSENCE OF A WRITE PATH plus a prompt rule, not a runtime enforcement layer. There is no policy engine, no approval workflow and no audit log, because a kit has none of those and adding them would make it a different product.
• src/select.py withholds ONE NAMED SECTION. It is not a redaction system: a pack whose award letters happen to mention the renewal conversation will send it, because the letters are where the answers live and the kit cannot have both.
• Nothing here is accounting advice, and RR-1.1 to RR-7.1 are this kit's own rules rather than a restatement of any standard.

WatchedWhat is watched, and why that one

The kit measures 40 watched figures plus 8 comparability guards and 5 reference constants — three duties, not one list. 0 of the watched are grader rates, each on its own grader page; this board watches the ones that decide when to look again. Each square is one watched figure; filled means the latest run measured it.

22 measured by the latest run 18 need the model half

GuardsBefore any comparison

Preconditions, not alarms. If one moves, the runs were not measuring the same system and nothing else on this board may be differenced.

all shared guards held between the recorded runs (amount_cells 262, blind False, cells 282, dataset_version restriction-release-2026-08-26-38packs, gift_cells 282, ground_named_cells 282, hold_lines 136, letter_channel_cells 64, letter_citation_cells 64, lines_citing_any_id 282, packs 38, packs_answered 38, period_total_cells 38, record_channel_cells 218, release_lines 126, rule_cited_cells 282, support_cells 282, trap_lines 16, unresolvable_cells 20) — which is why the history below is allowed to mean anything.

The reference constants — the null-grader baseline, the adjudication matrix, the negative count — are the third duty. They are never re-measured per run: a baseline that moves with the thing it measures is not a baseline.

BandsThe alarm bands

Derived from evidence, never picked: exact-match where two runs reproduced a metric to the digit, wider than the measured same-input drift for latency, one row of the negative class for any rate — denominator printed beside it.

HistoryRun history

6 recorded runs. A dash is a metric that run did not measure, and a dash is never differenced: not measured is a third state, neither a value nor a zero, and reading it as zero is how a board reports an improvement on a run that never looked. They are split into 3 blocks because a free floor is a baseline rather than a peer, and a run of another kind measures another thing; a column in one block is never differenced against a column in another.

comply · no model in the path — a baseline, not a peer column — 3 runs. A floor is what the kit scores with no model in the path; it is the line the model runs have to beat, and it is never differenced against them.

not a time series No two of these 3 runs measured the same system — they differ on floor, the model — so nothing here may be differenced and the Verdict column is left off. Read this block DOWN a column, as a comparison between those runs, not along a row as a history.

comply · with the model in the path — 2 runs. Columns here are only ever compared with each other.

not a time series No two of these 2 runs measured the same system — they differ on amount_cells, cells, gift_cells, ground_named_cells, hold_lines, letter_channel_cells, letter_citation_cells, lines_citing_any_id, max_tokens, packs, packs_answered, period_total_cells, record_channel_cells, release_lines, rule_cited_cells, support_cells, trap_lines, unresolvable_cells — so nothing here may be differenced and the Verdict column is left off. Read this block DOWN a column, as a comparison between those runs, not along a row as a history.

stub · no model in the path — a baseline, not a peer column — 1 run. A floor is what the kit scores with no model in the path; it is the line the model runs have to beat, and it is never differenced against them.

one run A verdict is a comparison and one run has nothing to compare with, so the Verdict column is left off rather than filled with 22 chips that all say so.

DeviationsWhat deviated

0 breaches across 6 runs

The day a band breaks, a row renders here carrying the metric, the two runs, the band it crossed and what changed between them — model, prompt, chunker or top_k, read off the run records’ guards. A deviation with no diff beside it is an alarm nobody can act on.

RippleThe ripple map

Which figures move together, so one alarm reads as a system. Every edge carries its basis: measured names the run that showed it; reasoning admits nothing has varied it yet.

FiresWhat fires when a band breaks

Where evals stop sitting beside the guardrail and start feeding it. Where the answer is nothing automatic, the row says so — hiding it would undo “What a guardrail is not” above.

NextThe three you would add first

None of these is built here. They are named against the seam they sit on so they can be argued with.

CadenceWhen to re-run, and what it costs

The answer-key gate, all three free floors and the wiring stub are free and run before any spend -- and on this kit the free half caught a real cascade defect while the model caught a rule-wording defect the free half could not see, because the checker shares the key's reading of that rule. Run the free half first, then read a calibration probe's MISSES rather than just its ceiling number, then fire the scored arm. The injection probe is a MANUAL step and has never been run.

In one lineNo framework, deliberately

NO FRAMEWORK. A folder of readable Python, standard library end to end, no orchestration layer and no vendor SDK. requirements.txt names nothing. The reason is the fork test: every layer added is a layer a forker has to understand before they can change anything -- and on this kit the thing a forker most needs to change is the RULE TEXT printed inside the corpus, because one of those rules is worded so that the answer key derived from it disagrees with the rule as printed, and nothing but reading it catches that.

The mappingSeam by seam, who owns what

The seams are the ones this kit already publishes, so the mapping cannot drift from the code.

GraphsWhere LangGraph changes the answer

Linear: a pack -> src/segment.py -> src/select.py -> src/prompt.py -> src/adapters -> src/reconcile.py -> evals/scoring.py. No branches, no agent loop, no tool calls. The only fan-out is the thread pool over independent periods -- and the free floors skip the middle four steps entirely, going straight from src/pack.py and src/checks.py to the same scorer.

The other sideWhat a framework costs you

• Adding a provider means editing the PROVIDERS dict by hand. In exchange, pip install pulls nothing and the fork test stays at one clone and one command.
• There is no retry/backoff policy you can configure -- it is four attempts on a transient status and ONE on a transport failure, written out in the adapter. The asymmetry is deliberate: a timed-out generation is not a rate limit, and retrying it pays for the whole generation again.
• The duplicate tiebreak is a hand-written sort in src/checks.duplicates rather than anything a matching library would give you -- no blocking, no similarity, no threshold. That is cheap here because a duplicate is an exact match on four printed fields, and it is the first thing that breaks on a ledger where the same contract is described two different ways.

In one lineWhat one run of this kit actually cost, in time and tokens

Measured on r002-restriction-release on the fast tier, 2026-08-26. This kit records telemetry measured per run — 4 of the 6 readings on this axis, 4 of them with a band the guardrail board can judge against.

The readingWhat the last run measured

No movement column. Not one of the 4 earlier runs on record is comparable with this one — a different model tier, or a changed guard — and differencing across that measures two systems rather than one. Said once here rather than as a dash on every row.

Retrieval not shown. No run of this kit has ever recorded a retrieval timing, because the pipeline has no such stage. Those readings are left out rather than dashed: a dash says “this run did not measure it”, which promises a later run could.

DriftMedian call, run over run

Hatched bars are runs that are not comparable with the latest — a different model tier or a changed guard. They are drawn because hiding them would make the history look shorter than it is, and greyed because differencing across them would be measuring two systems.

3 runs not plotted. b000-restriction-release-datescodes, b001-restriction-release-systemfields, b002-restriction-release-letterkeyword recorded no call latency at all — a rules-only floor run makes no model call, and the 0 its record stores is an absence, not a zero-millisecond answer. Plotting it would put a bar on this chart claiming the fastest run in the kit’s history.

The other sideWhat this does not tell you

The first of those is the one worth doing something about, and it is a solved problem: instrumenting a pipeline so each step reports its own duration is a couple of lines. Observability / tracing has the code, and what the result looks like once it is running.

In one lineWhat you provision, honestly

Everything measured on this page says where it was measured; everything not measured says that — the same contract as the other thirteen pages. Where a retrieval index would be on other kits, this one has: no index — the rulebook is data read whole into the prompt.

The machineWhat this needs

Enumerated from the kit’s own source by build/facts/envscan.py, committed, and drift-checked — never typed into this page.

Your dataWhere everything sits

The wireWhat crosses it, and when

Zero-egress topology: point BASE_URL at a local OpenAI-compatible server and nothing leaves the machine — statically true of the shipped adapter, whose only credential travels in the Authorization header.

The shapeHow it ships, and what you add

The ladderEach decision, and what you provision past its ceiling

Every threshold is a measurement with its provenance beside it, or says is_measured:false. A ceiling with no seam says so — it is the point the kit is outgrown, never a forced join.

When it failsFailure signatures

The knobsThe config surface, enumerated

Environment variables: API_KEY, BASE_URL, EMBED_MODEL, EVAL_WORKERS, MAX_CALLS_PER_DAY, MODEL, PORT, PROVIDER, RECORDED_RUN.

The other sideWhat this page does not claim

The corpus licence, from the Data lens: MIT -- this repository's own licence. The corpus is generated in-process by tools/build_corpus.py from a fixed seed and contains no third-party data of any kind; verified by reading every generator input on 2026-08-26. Your corpus’s licence is yours to verify, and the labels you write are about your documents.

In one lineThe whole release call on each line -- gift, decision, ground, rule, identifiers

whether each of the 282 lines got a release call a finance director could sign: the gift the key decides it against, the decision the key carries, the right ground of the eleven, the governing rule the pack itself prints for that ground, every identifier the ground needs, and nothing invented

MethodHow the test was run

python3 -m evals.run --run-id <id> ...; evals/scoring.py compares strings.

The inputOne real row, seen by every grader

⚑ THIS ONE LINE IS THE WHOLE KIT. Nothing in any printed column distinguishes it from the four lines above it that do release. The keyword floor does not even fire here, because its trick only applies where the account code is OUTSIDE the fund -- so the floor releases $35,809.00 on a cost the donor excluded by name. Pure code cannot get this line by any threshold, keyword or constant, and the period total moves by $35,809.00 on it alone. The floor's total for RR-0003 is $125,134.83; the key's is $61,067.68; the arm answered $61,067.68.

The formulaWhat it computes

restriction_release_accuracy_pct = accurate / 282. A line the arm left off entirely counts as OMITTED and is a miss. All six conditions must hold together.

The analysisWhat it actually did

In operationWhat to monitor

Reference standard: data/gold.jsonl, planted with the corpus and re-derived from it by evals/check_labels.py.

No true/false rates for this grader. It records 6 operating rows and not one of them carries a confusion matrix, so there is no TPR, TNR or precision to state here — this grader does not sort answers into pass and fail, and rates that were never measured are not going to be printed as though they were. What it did measure is in “What it actually did” above; what to watch is immediately below.

How tight can the band be? No threshold was swept on the GRADER: exact match has no tunable. The KEYWORD FLOOR has two -- MIN_LEN and MIN_HITS in evals/baseline.py -- and they are published beside its score rather than buried, because a paid arm measured against a deliberately weak floor is not measured at all. They were NOT swept, and that is recorded in could_not_verify.

Cadence: once per run; free

The decisionWhen to reach for it