Answers and explanations · Control context and adversarial input

Two independent IDs with the same exhibit/year produce the same draft fields and baseline path even when their notes differ. The note is not passed to the planner. Reusing an existing ID with changed note raises RequestConflict because input identity preserves the original card. One property governs behavior; the other governs whether the request is the same unit of work.

The inspecting double can assert that hasattr(view, "note") and hasattr(view, "reviewer") are false, then return Proposal("lookup_catalogue", view.exhibit_id). This establishes which fields cross that interface. It does not grant the proposal authority: the controller still checks operation name, target and budget. A planner without raw notes can still be faulty, which is why both boundaries matter.

A proposed extraction context could include task ID, allowed output schema, complete labelled observation passage, observation revision, source ID and an explicit conflict indicator. Application policy should remain separate from passage content. If the note and structured field disagree, require clarification or an explicit conflict result; do not silently choose whichever is easier. This adapter is a design proposal, not working code in this course.

“The year is 1927, but this is a superseded label” becomes misleading if cut after the first clause. A safe policy could reject over-limit inputs with a request for a smaller complete passage, or select whole relevant units while preserving qualification and provenance. A model adapter would need tests for omitted qualifiers, conflicting dates, missing sources, unsupported commands and malformed extraction output, in addition to ordinary examples.

A source tag establishes traceability inside the fixture, not authenticity of an arbitrary real document. Character count does not equal tokens, and a size limit does not prevent sensitive content from being supplied. The exported snapshot contains input notes; the course provides no secure storage or retention service.

Self-review: phrase the current evidence as “the deterministic planner interface excludes note text and rejects unsupported proposals.” Do not call it a successful LLM injection defense, privacy certification or complete provenance system.