What was decided, and what it cost

Build for the broker operating on behalf of a client. Own coverage describes whose risk is analyzed, not who operates the tool.

Rejected  A self serve tool for the insured, which one reading of the specification supports.

Cost  An insured facing product would need consumer grade explanation everywhere. The liability argument decided it: a wrong answer should reach a licensed professional who was shown the scope, not a party with no way to evaluate it.

Documents resolve into policies before policies resolve into a program. A policy is a packet that arrives split across files or several to a file.

Rejected  One file equals one policy, which is the assumption the brief implies.

Cost  A whole resolution layer that the brief did not ask for. It is also the layer that makes every corpus program assemble correctly, because not one of them fits the one file assumption.

Excess and umbrella policies are joined to what sits beneath them by the schedule each one prints: carrier, policy number, limits, term.

Rejected  Joining by insured name or by adjacency in the upload.

Cost  Schedules are typed at a different carrier and punctuation drifts, so near matches must be surfaced for confirmation rather than joined. The gain is that a missing document becomes provable by name.

Two policy numbers that differ only in punctuation are surfaced for a person to confirm, not joined automatically and not reported missing.

Rejected  Fuzzy matching on names, which joins more programs automatically.

Cost  More confirmations reach a person. A wrong tower is wrong; a wrong merge between two insureds is not recoverable.

A document that cannot be placed is re-read once, narrowly. If the second reading agrees it cannot be placed, the run stops and asks a person a specific question. Answers and exclusions are logged.

Rejected  Proceeding on the best guess and letting the person correct the finished review.

Cost  Some runs stop and wait. Triage costs pennies and extraction costs dollars, and a review built on a guessed identity is already compromised before it renders.

A question answers pass, fail, or cannot determine. Answerability is checked before the predicate runs, so a missing field is never reported as a failure.

Rejected  Two states with a confidence score attached.

Cost  Cannot determine is a less satisfying answer than a number, and dressing uncertainty as a verdict is the failure mode this build treats as disqualifying.

A review cannot be constructed without a scope declaring what was read, what should exist, and what was assumed.

Rejected  A clean bill of health when no problems were found.

Cost  Every result carries qualifications a reader must scroll past. A clean result over an incomplete program is the most expensive lie this system could tell.

The schema travels in the prompt, the response returns as text, and validation runs in code with one correction pass before raising.

Rejected  Grammar constrained decoding, which makes malformed output impossible.

Cost  Malformed output becomes unlikely instead of impossible. The compiled grammar could not hold a fully cited schema after three reductions, and what remained to cut was citations and fields, which are the product.

A change that would alter the meaning of results already produced is a contract change, and it happens in version one even where version one does not use it. Changes that only widen what can be read may wait: a finding produced from ninety pages stays true when three hundred are read later.

Rejected  Deferring each contract change to the version that first needs it. That bill arrives while building that version, because every reading, fixture, and recorded run made under the weaker guarantee has to be re-verified.

Cost  Version one carries structure it does not yet use. The case that forced the rule: a verdict cited the right words one page off, and the discard rule threw away an answer the documents prove in one sentence, a rule about honesty that made the product less honest. Citations gained repair, and repairs are reported.

When assembly finds a policy named by a schedule but absent from the file, and the absence touches the tower or a question, the run stops and asks: proceed without it, or stop here. The decision is logged into the record with who made it.

Rejected  Proceeding automatically and marking dependent findings, which is what the build did before this decision.

Cost  A halt state, a resume path, and a decision surface that did not exist. Not every absence is equal, so the stop is gated by what the absence touches, and the record shows what was missing and what the person chose.

What a person decides about the reading (proceed without a document, assign a loss run, settle a value the reading could not) is a first-class object on the review: who, when, what the reading said, what was determined, why, bounded by the policy period. It does not carry forward on renewal, and it never modifies the extraction, so what the reader could prove and what the review concluded stay distinguishable.

Rejected  An audit log. An append-only row is keyed to the moment it happened; these records are claims about what a specific policy's documents say, and a policy is a dated thing that renews into documents nobody has read yet.

Cost  A schema object, a replay path so a completed review can accept further determinations, and a placeholder: with no accounts, the decider is recorded as the tag [user.name] rather than an invented identity.

Loss runs are read as a third document type: declarations say what the coverage is, schedules say what it stands on, loss runs say what has been paid and reserved against it. The join to the tower is by policy number only, and where the number matches nothing, a person is asked and the answer is recorded. Erosion is arithmetic in code over the printed figures.

Rejected  Anything that creates or edits a claim, which is claims administration: a different product, explicitly out of scope.

Cost  Erosion can only be as current as the report's own valuation date, and a report whose figures are not printed erodes nothing. Both limits are stated on the reading rather than papered over.

The pipeline is ordinary code: six steps called in order, one streamed request per reading, and a halted run resuming from state the browser carries. No workflow framework.

Rejected  An orchestration framework. LangGraph was the known option, bringing checkpointing, interrupts, and a drawn graph of the steps.

Cost  Resume, halts, and step visibility had to be built by hand: the halt gate, the resume payload, the run pane. In exchange there is no framework to learn or debug, and the whole pipeline is a few hundred lines the tests can hold. At production scale, queued jobs per step do what the framework would, using the queue the infrastructure already has.

A requirement document uploaded to the demo is compiled once, at upload: the model drafts the set, code verifies every quote against the document's own text and every proposed rule against the vocabulary, and the person sees what compiled before it is used. Unverifiable lines are left out and reported. The compiled set lives in the browser session; the document is not stored.

Rejected  Reading the requirement document live on every run. A stored prompt is not inspectable, and a document re-read differently on Wednesday than Tuesday would move the verdict without moving the coverage, which is the same reason the curated sets are compiled data.

Cost  A model call at upload, a review moment before the set is trusted, and a set that dies with the session. A demanded line the vocabulary cannot express is carried unchecked rather than checked wrongly, so an uploaded set can carry more than it checks, and says so.

The compared read's product is the requirement set beside what the coverage provides, with the shortfall in dollars. The exposure arithmetic was built and tested, briefly shown as a V3 demo, and pulled the same day: a dollars region on the reviewed read's stage made V3 indistinguishable from V2, and a version that cannot be told apart from its predecessor is not a version. The code stayed; the demo returned when the side-by-side existed. V3 now runs at /v3.

Rejected  Shipping the dollars as V3 anyway. Working code was the argument for it; the argument against is that each demo must be its own demo, which is the same rule the navigation was rebuilt around.

Cost  Tested, working arithmetic sat unshown while the view that earns it was built. Accepted: a version is only real to the person clicking it when its demo is its own, and the hold-back is recorded here rather than erased.