The evidence, in full

1 · The method

Two independent detection layers over one deterministic masking core. The design rule throughout: recall lives in code; the model only classifies and nominates under verbatim verification. Anything the model says that can't be found verbatim in the document is refused, not guessed at.

Layer 1 — the span pass

• The document is cut into 500-character chunks on word boundaries with 100 characters of overlap — a chunk edge landing inside a word is structurally impossible, so no entity can be split into invisibility.
• A small local model (stock, pinned — see environment) extracts candidate identity spans from each chunk under a frozen prompt contract.
• Every nominated span is verified verbatim against the document. No verbatim match → refused. A failed model call → the whole run is marked incomplete and the export is held.

Layer 2 — the rails

• Deterministic code nominates candidates the genre declares: defined-term quotes (contracts introduce their own parties), capitalized runs (Unicode-aware: diacritics, name particles, camelCase singles), address shapes, ®/™ marks (the mark itself is the classifier — no model involved), plus a structural battery for phones, ID families, URLs and tickers.
• Each unique candidate is classified once by the model through a constrained-grammar enum — the model literally cannot answer outside the allowed classes.

The union, the mask, the floor

• Both layers feed one entity table, held in code — never in a prompt. (Measured lesson: carrying discovered entities in the prompt cost 24 recall points. State in prompts is banned.)
• Masking is deterministic and document-wide: longest span first, same entity → same tag everywhere, base-name canonical so "Ms. Nand" also catches a glued "Ms.Nand".
• The span text is deleted and substituted — the export is rebuilt from the cleaned text. Nothing is ever drawn over the original (see the demo on the front page for why that distinction is the whole game).
• A structured floor (regex battery for emails, NRIC-class IDs, cards, phone shapes) runs over the result regardless of what the layers found.
• Pass 2 re-runs both layers over the masked text, where residue stands out against a quieter document; all finds join the one table; the final mask is always applied to the original.

2 · The measurement protocol

A number without its denominator and its sampling story is marketing. Here is ours, stated before the results so it can't be quietly adjusted after them.

Corpus construction

• Real public documents — contracts, filings, letters, notes — sampled across the professions the tool targets, English plus the Southeast-Asian identity classes the floor carries. The v1.0 battery: 118 real documents — 8 hand-labeled SEC filings and two 79k-word annual reports in-sample, plus 108 documents acquired blind across five walk-forward rounds (rounds 1–4, 90 documents, since partially absorbed by fix sets; round 5's 18 remain pure out-of-sample). Annotation quality is itself measured: blind second-pass agreement 0.837 raw, 0.925 after adjudication — the i2b2 2014 medical gold standard's human-human bar is 0.927 (bench/iaa/IAA.md).
• Every document is hand-annotated with ground truth before any run: every identity, every occurrence, every shorthand, counted. The annotations ship in the repo next to the documents.
• In-sample vs out-of-sample is the load-bearing distinction. Documents the engine's constants were tuned on are reported separately from documents it had never seen. Walk-forward rule: rails and constants freeze before the out-of-sample documents are fetched.

What we count

• Core occurrence recall — of every occurrence of every ground-truth identity, how many were masked. This is the headline number; a single missed occurrence is a leak.
• Shorthand recall — abbreviations, initialisms and short forms of known entities, counted separately because they're the realistic failure class.
• Junk rate — table rows a reviewer discards as noise. Over-masking is the acceptable failure direction, but it's measured, because review fatigue is a real cost.
• Completeness honesty — runs where any model call failed are reported as held, not silently dropped from the denominator.

What counts as a leak

Any core-identity occurrence present in the exported text. No partial credit: a surname surviving inside a compound, a glued print artifact, a shorthand in a footer — all leaks. The gate's floor is zero core leaks; one leak exits red.

3 · Results

Every number links to its raw record in the repository. Nothing is blended: in-sample and out-of-sample are separate rows, and any tier whose misses a fix set ever drew on carries its saturation label — that is what the label column is for.

Headline — the v1.0 battery (118 documents, engine cb3627c, 2026-07-21)

Per-class breakdown

Per-class rollups exist for the two exhaustively-annotated in-sample corpora. No per-class aggregate has been computed for the out-of-sample rounds yet — round-5 misses carry class tags individually (see the leak ledger below), and an out-of-sample per-class rollup is queued; until it lands, no per-class number here should be read as an out-of-sample claim.

Baselines — same documents, same metric

An entity counts only when every printed variant of it has zero residual in the export — the strictest scoring direction, applied identically to every system below.

The utility axis — round 5: does the analysis survive?

Everything above measures what the export withholds. This measures what it still carries — the number that matters when the redacted copy's whole purpose is to be analyzed by a frontier AI that was never allowed to see the original. Protocol (2026-07-24, harness committed): for each round-5 document a question-writer read the original and drafted exactly 5 analytical questions — obligations, procedure, outcomes, remedies, risk, findings; any question answerable by a name, date, address or other identity is banned, and because the writer saw only the original, questions cannot skew toward what a masked copy answers well. Two blind analysts then answered independently — one from the original, one from only the masked export, placeholders declared legitimate actors — and a judge scored each pair for substance equivalence. utility = (equivalent + ½·partial) / questions. The masked side is the round-5 export byte-for-byte as scored above — the same files that measured 94.97% / 98.2%.

The leak ledger — round 5, every miss

Every missed entity of the headline round, verbatim as recorded in round5-results.json: 37 core + 2 shorthand. Family labels come from the round's miss taxonomy (RESULT.md); rows marked — carry no taxonomized family. Diagnosis and fixes belong to fix set 5, provable only on round 6's fresh documents. This table is the reason to trust the ones above.

Campaign log

Prior measurement campaigns, oldest first, each with its full record in the tree. History is append-only: superseded numbers stay published with what superseded them.

4 · The environment

Every number above is attached to an exact, hash-verifiable configuration. If your hashes match, you are running what we measured.

The model is vanilla by construction and by check: scripts/verify-model.mjs hashes your local weights against the pin. Adaptation lives entirely in prompts-as-frozen-contracts and code rails — never a fine-tune, so the weights stay auditable against Google's published artifact.

5 · Reproduce

The corpus, ground truth, runner and floor ship in the tree. Reproduction is two commands after clone; the bench exits red on a single core leak.

The live bench needs the model running locally (see bench/BENCH.md for the recipe). Found a leak we didn't? That's a bug report, and it becomes a pinned test — the ratchet only turns one way.

6 · Claims we ban ourselves from making