Imagine you hire a enthusiastic but unreliable intern to draft purchase orders. The intern is fast, creative, and will confidently fabricate details. So you never let the intern sign anything. Instead, every draft goes to a rigid clerk who checks two things against the original paperwork: does the sensor coordinate match, and is the polarity correct? If both facts parse from the source text under a locked grammar, the clerk stamps it. If not, the draft is shredded. The intern never learns from rejections. The clerk never improvises. That separation — generative fluency walled off from release authority — is the entire architecture of this paper. The committed claim: a frozen, local 4-billion-parameter language model can serve as a candidate generator for mechatronic commissioning plans (sensor-coordinate and polarity binding), provided an external deterministic gate with a sealed grammar holds absolute veto. The gate is not a fine-tuned classifier or a second neural network — it is a parser. It either derives both required facts from the original requirement text or it blocks. The LLM is never updated, never fine-tuned, never given access to the gate logic. This is not RLHF or tool-use; it is a hard architectural separation between generation and verification. The benchmark: 144 tasks written by isolated agent contexts that had no access to the gate, grammar, or experimental plan. The criterion was fixed before benchmark construction — a meaningful pre-registration move. Among the 83 tasks that passed the gate, zero false releases were observed. The one-sided 95% Clopper-Pearson upper bound on the false-release rate landed at 3.54%, below the pre-sealed 5% threshold. Separately, the LLM fabricated ready-plans on 21 of 22 routed unanswerable tasks — and the gate rejected every single one. The same 83 releases were reproduced without any model calls, confirming the gate is the load-bearing element. Then the crack: outside the benchmark, at seed 0, one false release appeared among 146 additional trials. The authors report this openly rather than burying it. This is exactly the kind of post-benchmark stress test that separates honest systems papers from demo papers. The false release means the gate grammar is not airtight — but the transparency about it is the strongest integrity signal in the paper. The protection against incorrect user answers is the weakest link. Both facts could be bound directly from the original text on only 13 of 96 answerable tasks. On the remaining 83, incorrect user answers leaked through in 169 of 431 pairings, including failures involving coordinate exclusion. The authors explicitly state that a deployable questioning policy was not tested because eligibility was determined from the answer key — meaning the human-in-the-loop path is designed but unvalidated in practice. The architecture choice is deliberately conservative: a frozen model means no training-data contamination, no drift, no fine-tuning costs. The sealed grammar means the gate is auditable line by line. But this conservatism limits capability — 13/96 direct-bind success on answerable tasks is low, and the paper does not compare against any alternative gate designs, fine-tuned models, or retrieval-augmented approaches. There is no ladder to climb against because the paper defines its own niche. The contribution is the separation pattern itself, not a SOTA number on an existing benchmark. The real value here is the template, not the specific numbers. If you are building any system where an LLM generates plans that interact with physical hardware — robotics, industrial automation, infrastructure — this paper gives you a concrete worked example of how to architect the trust boundary. The 4B-parameter model is almost incidental; what matters is the proof that a deterministic gate can catch fabrication reliably enough to be characterized statistically, and the honesty about where it fails.
