The gate that refuses "under duress" is the cheap win [5]. Any comparison strict enough to reject an added clause will reject that one. The expensive part of this design sits on the other side of the interaction, in what the store says when it holds nothing, and that is where the author says he was nearly caught out.
He calls the post the honest version and points at a night before publication when the thing lied to him [14]. The concrete fix he attaches to that stretch is the refusal redirect: an abstention that names the grounded terms it does hold and the next action worth taking, instead of a bare no [11][13]. His reasoning is that most callers are agents, and an agent cannot browse the store to work out a better question, so a flat refusal is where the exchange dies [12].
Look at what the repaired path is doing. The abstention reports that two claims about Dana Kim exist and lists the terms they ground on [11]. That is an assertion about the contents of the store, and unlike an admitted claim it does not arrive with a document hash and a byte range [8]. The admit path is audited. The refusal path is prose about the audit. My reading is that if a system of this shape tells its user something the user cannot check, it will be there.
The verify output hints at the same seam. Success prints one of one receipts checkable and verified; the failure case prints zero of one checkable, then FAILED [9]. "Checkable" is carrying weight. A receipt whose source document has gone missing is neither verified nor caught, and that counter is the only place the distinction surfaces.
His diagnosis, that the component doing the hallucinating is also the one keeping the record [17], is what puts the check at write time rather than in a read-time reranker or LLM judge [7]. The security claim follows from placement: there is no model and no prompt on the deciding side, so injection and jailbreaks find nothing to persuade [3][6].
That leaves the write contract as the thing that decides whether anyone else can use it. A claim has to arrive with the exact text it grounds on [4], and the receipt is a document hash plus a start and end offset [8], 71 bytes wide in the published example [1]. A retrieval stack that hands the model reranked paraphrase has nothing to give that function. What it buys is provenance that can go red on purpose, rather than a chunk pointer that keeps looking fine after the underlying text drifts [9][10].
