What did it leave out?

Deleting is checkable. Generating is not.

You paste a forty-page agreement into a model and ask it to keep what matters. It returns a tighter page and a number: 0.62, the fraction that survived.

Two years later a dispute turns on one clause, and somebody asks what the model left out. If words were removed, the answer is a diff: here is the sentence, here is the gap. If words were written, the answer is prose that reads well and cannot be checked against anything, because a sentence that was never in your document has no address in it.

Both operations get called summarising. Only one leaves evidence, and that decides which shortcut you may take before an action nobody will review.

One word, two operations

Extraction selects: every surviving word has an address in the input. Abstraction writes: the sentence is conditioned on the source but does not occur in it, and it reads exactly like the ones that do.

That is the first problem. The file does not declare which operation made it. There are hints: a hard extractive pass returns a token scaffold, while an abstractive summary comes back as clean prose, which is why it passes for the source. But a hint is not a record. A mild extraction can read almost like prose, a summary can be written in fragments, and neither you nor the next model can look at the bytes and say which ran. Style is evidence about the process, not a statement of it.

What a deletion lets you prove

When the output comes from the input by deletion alone, the check is mechanical: hash both, walk the strings once, confirm every output byte appears in order. No vendor, no model, no judgement.

Independent. It consults the bytes, not our score.

Decidable. Yes or no, not 0.83. A threshold can be argued with; containment cannot.

Durable. Bytes and a signed record are enough in five years, after the service, the model and the vendor are gone.

Fails closed. Insert one word that is not in the source and the claim collapses.

That turns "the model summarised our contract" into something a third party can test. The example went in at 2,344 characters and came out at 1,743, every surviving byte in the original. The numbers and the call are on the record page; this post is about why they matter.

What a number cannot tell you

Containment says nothing was invented. It says nothing about whether the surviving words still carry the claims that mattered. A subset can be the wrong subset.

In the example, the clause that dated a screening record lost its date: the output keeps "refreshed" and drops "the previous night". Defensible as compression, wrong as evidence: the vintage was the whole case.

Removal is never neutral: deciding what a reader will not see is a decision about what they can conclude. The check makes that visible; it does not make it right.

So the product reports a second thing, how much of the meaning survived. A model reads the output against the source, section by section, and reports the average, the worst section and how many fell below a threshold. On the example that was 0.983, worst 0.9317 over 29 sections, none below. It says the deletion cost little. It does not say the right thing was kept.

It measures meaning rather than length, and it discloses its failures: the engine tried 0.7, the check refused the result, and the record shows the retry and the fatter ratio. A tool that hides its failed attempts is showing you its best case.

It is not containment, not a decision: the threshold is policy and the model is another sampler. It is the best available account of what a deletion cost, and still an account.

Where the check dies

An invented sentence has no address, so the only check is a judgement about meaning made by reading both texts together. That is the work compression was meant to avoid, and the judge is usually another model of the same class as the one that wrote the sentence. A score from that arrangement measures agreement between two systems, not evidence about the world: it can be high while the output is wrong.

Certificates do not repair it. A proof that the output is supported by the source is a proof inside some formalisation of support, and that formalisation was a choice. Jessica Hullman makes the same move about proof in science: verification certifies the artifact, not the understanding behind it.

Our own service is not exempt: one transform rewrites JSON structure instead of deleting, and on those calls the record says so. The moment an operation stops being a deletion, the evidence changes kind.

The objection worth taking seriously

Abstractive summaries are better for people. A token skeleton is hard to read, and no receipt field certifies readability.

The argument was never "never generate". Generation is right when a person reads the result and decides: the human is the check. The boundary is not the model's skill but whether a person sits between the output and its consequence.

Where nobody reads it first, the only defence left is an artifact someone else can check later. That is the narrow claim here, and enough to draw a line through an agent pipeline.

Three questions for any transformation

Two yeses and one no is a workable system. A no on the first two, with nobody reading, is how a team ends up with an incident it can describe but not defend.

The preflight post covers where such a gate goes; this one covers why it can exist.

The record

One side can produce a diff and say what was lost. The other can only argue that its paragraph is faithful. The first has an answer.

The transformation record holds the input, the output, the request, the receipt and the verifier's answer on one page, with the field detail and the retry. Checking it needs no account or API key.

Written with an LLM drafting assistant. The incident memo is a composite, not a customer story. Its numbers come from a live verified call on 2026-11-05 and were re-checked with the public verify endpoint.