Paper deep dive
Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses
Mike Helwig
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/11/2026, 4:34:09 AM
Summary
The paper introduces Rosetta, a system for recovering column semantics in undocumented data warehouses by reconstructing metadata from values alone. It employs a verification harness combining a deterministic profiler (extracting structural evidence like value fingerprints and checksums) with a language model. The core contribution is a 'competence detector' that uses deterministic evidence to govern whether the system commits to a semantic interpretation, rather than amplifying the model's prose quality. This approach achieves higher accuracy on committed columns (0.475) compared to using the model directly (0.223) and enables calibrated abstention at query time, maintaining 86% execution accuracy over 59% coverage in opaque schema scenarios, significantly outperforming naive translators.
Entities (10)
Relation Signals (10)
Verification Harness → contains → Deterministic Profiler
confidence 95% · a deterministic profiler extracts structural evidence... the model proposes semantics
Rosetta → evaluatedon → BIRD
confidence 95% · Against human documentation on 680 paired columns across eleven BIRD databases
Rosetta → evaluatedon → SPIDER
confidence 95% · On a stripped-schema Spider study... our gate answers selectively at 86% accuracy
Verification Harness → function → Competence Detector
confidence 95% · The deterministic layer is a competence detector, not a competence amplifier
Rosetta → uses → Verification Harness
confidence 95% · We present Rosetta, which places a language model inside a verification harness
Rosetta → abstainson → NDC
confidence 90% · abstains on all 44 NDC drug codes
Rosetta → achievesaccuracyon → BIRD
confidence 90% · the harness delivers metadata that is 0.475 accurate on the 42% of columns it commits to
Rosetta → achievesaccuracyon → SPIDER
confidence 90% · our gate answers selectively at 86% accuracy over 59% coverage
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Text-to-SQL benchmarks ship schemas whose column names already say what the columns mean. Production warehouses are the inverse: cryptic identifiers, partial or absent documentation. We address the problem they pose first: recovering what columns and values mean from the data itself. Rosetta places a language model inside a verification harness: a deterministic profiler extracts structural evidence (value fingerprints, a 26-pattern library, checksum verdicts), the model proposes semantics conditioned on that evidence, and every fact carries provenance and a confidence bounded by its evidence class. Against human documentation on 680 paired columns across eleven BIRD databases, identifiers destroyed, the harness delivers metadata that is 0.475 accurate on the 42% of columns it commits to, against 0.223 on 94% for the same model used directly. Restricted to the 283 columns where both arms speak, the harness writes no better prose than the model alone; the gain is selection: deterministic evidence governs whether the system speaks (coverage +0.257 [0.128, 0.378]), not how well. The deterministic layer is a competence detector, not a competence amplifier. A backbone swap bounds the claim: the prose finding reproduces, but prompt-requested abstention does not transfer; a code-enforced commit gate (predictions registered first; measured on a third backbone and held-out databases) makes no-evidence coverage 0.000 on every backbone. On a blind i2b2 clinical warehouse Rosetta decodes 95.5% of 134 real ICD-9 codes from values alone and abstains on all 44 NDC drug codes. The catalog supports calibrated abstention at query time: under full schema opacity a naive translator falls from 0.92 to 0.42 execution accuracy while our gate answers at 86% accuracy over 59% coverage. Negative results are reported plainly, including that our own authority ladder is not the mechanism behind the headline.
Tags
Links
- Source: https://arxiv.org/abs/2608.07946v1
- Canonical: https://arxiv.org/abs/2608.07946v1
Trouble viewing inline? Open PDF directly →
Full Text
235,999 characters extracted from source content.
Expand or collapse full text
Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses Mike Helwig Independent Researcher USA mike@m6online.com Abstract Text-to-SQL benchmarks ship schemas whose column names al- ready say what the columns mean. Production warehouses are the inverse: decades of accretion leave cryptic identifiers (pms_- legacy.t_resv.amt_minor) beside clean marts, with documenta- tion that is partial, stale, or absent. This paper addresses the prior problem such warehouses pose: recovering what the columns and their values mean, from the data itself. We present Rosetta, which places a language model inside a verification harness: a deterministic profiler extracts structural evi- dence (value fingerprints, a 26-pattern library, checksum verdicts), the model proposes semantics conditioned on that evidence, and every resulting fact carries provenance and a confidence bounded by the class of evidence supporting it. We measure the reconstruction directly, against documentation written by other people, and the headline result is about selec- tion, not prose. Stripping identifiers from BIRD’s databases and scoring recovery against their human-authored column documen- tation (799 columns; 375 name expansions, 653 descriptions, 278 code-to-meaning tables), we compare three arms on identical in- puts: statistical semantic-type detection with no language model, a language model shown the column and its values, and Rosetta. Across 680 paired columns in eleven databases with identifiers destroyed, the harness delivers metadata that is 0.475 accurate on the 42% of columns it commits to, against 0.223 on 94% for the same model used directly: a catalog that can be trusted where it speaks, where one that guesses everywhere cannot be trusted anywhere. A control isolates what the direct baseline was really using: with identifiers visible it scores 0.752, with them destroyed 0.074. The statistical arm, covering all columns, recovers almost nothing even on its natural value-domain facet (0.030 against the harness’s 0.292); both language-model arms beat it with intervals excluding zero under a cluster bootstrap over databases. The mechanism, located precisely: restricted to the 283 columns where both arms speak (an identical question set, so prose is all that differs), the harness writes no better metadata than the lan- guage model alone, and on two facets measurably worse (paired differences−0.033 /−0.088 /−0.043, the latter two excluding zero; a blinded judge agrees at−0.038). The gain is selection: recomput- ing the deterministic evidence for every column shows it governs whether the system speaks (coverage 0.550 with structural evidence versus 0.293 without, +0.257 [+0.128, +0.378]) but not how well it speaks (+0.090, p = 0.071). The deterministic layer is a competence detector, not a competence amplifier. Re-running both arms on a second backbone bounds the claim: the prose finding reproduces almost exactly, but the selection behaviour does not transfer intact: on Claude Sonnet 4.6 coverage rises from 0.422 to 0.823 (the same model naked: 0.984, so a sixteen-point abstention margin sur- vives where fifty-two had been) and the evidence-tracking gap is no longer detectable, because the shipped system requests abstention in a prompt rather than enforcing it in code. The final study closes that gap: a commit gate keyed on the grounding tier (implemented only after six predictions were registered, then measured on a third backbone and on held-out databases) refuses ungrounded prose in code, making no-evidence coverage 0.000 on every backbone with recall-when-claimed undegraded, at a measured coverage cost we report. Because content-token recall is a lexical proxy, we validate it rather than assert it: 180 blinded judgements track the token metric at Spearman휌= 0.642, reproduce the arm ordering and widen it, a second rater from a different model family agrees with the judge at휅= 0.737, and the advantage survives controls for verbosity (the winning arm writes fewer words). On a blind i2b2 clinical ware- house it decodes 95.5% of 134 real ICD-9 codes from values alone, and abstains on the NDC drug codes rather than inventing them, deciding, per value, which code systems it is in a position to de- code. The reconstructed catalog then supports calibrated abstention at query time: on a stripped-schema Spider study (11 databases, 1,082 execution-labeled questions) a naive translator degrades from 0.92 to 0.42 execution accuracy under full opacity while our gate answers selectively at 86% accuracy over 59% coverage, with coverage that tracks difficulty. We report what fails as carefully as what works, including three analyses establishing that our own authority ladder is not the mech- anism producing the result, a naive-plus-abstention baseline that matches us on toy schemas, and an evaluation-harness bug we caught, fixed, and re-ran at larger scale before claiming the stronger result. 1 Introduction The dominant academic framing of natural-language interfaces to databases treats the schema as a solved input. Spider, BIRD, and similar benchmarks present a database whose tables and columns already carry human-meaningful names, whose foreign keys are declared, and in which each business concept maps to a single canonical column. Under that assumption, the remaining problem is translation: mapping an English question to SQL given a known, clean schema. The field has made rapid progress on translation, and contemporary LLMs are very good at it. This paper begins from a different empirical premise. In a pro- duction enterprise warehouse, the schema is not a clean input; it is the principal source of difficulty. Such warehouses are the 1 arXiv:2608.07946v1 [cs.DB] 8 Aug 2026 Helwig product of decades of organizational accretion. They contain cryp- tic, machine-generated, or legacy column identifiers (t_92.o_- 4 ,pms_legacy.t_resv.amt_minor) sitting directly beside well- documented analytical marts. Foreign keys are frequently unde- clared. Documentation, when it exists at all, is partial, stale, or internally contradictory. Multiple physical columns often encode the same business concept with conflicting semantics. In this regime, a naive LLM does not fail loudly; it fails confidently. Given a ques- tion and a forest of cryptic columns, it emits syntactically valid, plausible-looking SQL that joins the wrong tables or projects the wrong column, and it returns an answer with no signal that the answer is untrustworthy. We reframe the problem accordingly: the bottleneck is not LLM quality, it is metadata quality. The right system for an- swering questions over an undocumented warehouse is therefore not primarily a better translator. It is a system that (1) reconstructs the missing metadata from the warehouse’s own data and any avail- able documentation, (2) knows what it does not know and bounds its confidence in every reconstructed fact, and (3) refuses honestly when grounding is insufficient, rather than emitting a confident wrong answer. In the project’s own framing, "text-to-SQL is the visible demo; the catalog is the product." Put plainly: the aim is not to out-guess a naive LLM but to stop guessing when guessing is unwarranted, answering only what it can ground, and routing the rest to confirmation or refusal rather than asserting it. This reframing has three consequences that organize the rest of the paper. First, metadata reconstruction must happen before query time and must be auditable: each reconstructed fact needs a provenance trail (which model, which prompt, which evidence, which confidence). Second, confidence cannot be a free-floating LLM self-report; it must be bounded by the authority of the evidence that supports it: a checksum that proves a column contains valid IBANs is strong evidence about what kind of value the column holds, but it is not, by itself, evidence about the column’s business name, and the system must encode that distinction. Third, abstention must be a first-class, calibrated outcome: a refusal that correctly withholds a wrong answer is a success, not a failure, and the decision to refuse must be reproducible and resistant to prompt injection. We present Rosetta, a system embodying these commitments, and we are careful never to conflate the two registers in which we report it: external studies against documentation and labels authored by other people (Sections 5.2, 5.3, 5.4, 5.6 and 5.7), which carry the paper’s claims, and an internal multi-tenant case study (Section 5.5) that demonstrates the running system’s breadth, hardening and operability but which we treat as suggestive, never as proof. We make four contributions: (1) A measurement of metadata reconstruction against third-party documentation (Sections 5.2–5.4), which is the paper’s primary result. Prior work on recovering col- umn semantics reports either statistical semantic-type ac- curacy on a fixed type vocabulary or end-task accuracy on clean schemas; we instead destroy identifiers on BIRD’s databases and score what a system recovers of the bench- mark authors’ own prose documentation (expanded field names, business descriptions, and code-to-meaning tables) across 799 columns. Three arms on identical inputs sepa- rate the contributions of pattern classification, a language model, and the verification harness (delivered field-name recovery 0.011 / 0.223 / 0.475, every difference against the statistical baseline excluding zero under a cluster bootstrap over databases), and a paired re-analysis then locates that advantage in selection rather than in description quality (Section 5.2.1), a correction to our own earlier reading. Be- cause that metric is a lexical proxy, we validate it against blinded judgements of meaning recovery and a second rater (Section 5.3), and we test transfer on a blind i2b2 clinical warehouse whose values are opaque codes (Section 5.4). (2)An LLM inside a verification harness (Sections 4.1–4.2): a three-tier deep profiler whose LLM component is me- chanically prevented from asserting an unverified match, over an ordered grounding-tier ladder in which each tier records the strongest class of evidence behind a fact and caps its confidence accordingly. Every reconstructed fact carries a provenance trail: which model, which prompt, which evidence, which confidence. We present the ladder as the system’s auditability mechanism rather than as its accuracy mechanism, and we report in Sections 5.8 and 5.8.1 that, at its current weighting, it contributes little to the routing decision itself. (3)Calibrated abstention over the reconstructed catalog (Sections 4.3, 5.6 and 5.7): the route (answer / confirm-first / refuse) is pure thresholded arithmetic over a feature vec- tor, the LLM contributing features but never deciding the route. On a stripped-schema Spider study with a matched naive baseline (11 databases, 1,082 execution-labeled ques- tions, database-clustered intervals), naive execution accu- racy degrades 0.92→0.42 under full opacity, a ~58% silent- error rate, while the gate answers selectively, 86% accu- racy [CI 78–93%] over 59% coverage with coverage that tracks difficulty; the routing score discriminates (normal- ized AURC 0.26) and is calibratable (ECE 0.088→0.026). A BIRD breadth study (Section 5.7) shows the pattern sharp- ens on real, harder schemas: cold reconstruction still does not out-generate naive, but the naive model’s own confi- dence goes worse-than-random under full opacity while the grounded gate still discriminates. (4)Negative results reported at the same resolution as the positive ones, and a frozen experimental record (Section 5.12) that regenerates every number in this paper from com- mitted data. We report that a cheap naive-plus-abstention baseline matches our gate on Spider’s toy schemas (Sec- tion 5.6); that a learned selector over generic signals out- ranks and out-calibrates our authority score, which adds no incremental discrimination (Section 5.8.1); that our re- construction advantage comes with a higher contradiction rate when the system does speak (Section 5.3); and that an evaluation-harness bug in an earlier version of the Spider study inflated a prior verdict, which we found, fixed, and re-ran at larger scale (Section 5.1). Throughout, we distinguish measured results, produced by an actual run of the system, from proposed experiments that have 2 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses not been run. We hold ourselves to the rule that every empirical number in this paper is traceable to an internal measurement, and that no experiment is described as completed unless it was. Scope and non-claims. To keep the contribution unambiguous, we state at the outset what this paper does not claim. First, we do not claim state-of-the-art text-to-SQL execution accuracy: on clean schemas a naive LLM equals or exceeds our raw generation, and cold reconstruction does not out-generate it even on the harder BIRD schemas. We measure and report this rather than hide it. Sec- ond, we do not claim universal or model-agnostic calibration: our routing score is calibrated per deployment by fitting a post-hoc iso- tonic map against observed outcomes, its calibration is non-uniform across databases (Section 6), and we demonstrate it on Spider and BIRD rather than proving it transfers to an arbitrary warehouse or model. Third, we do not claim a proven reconstruction-quality lift on real enterprise warehouses: the evidence that better metadata raises delivered accuracy is internal, small-bank, and suggestive (Section 5.5), and our external studies strip documentation from public schemas rather than measuring a live production catalog. Fourth, and most consequential for how this paper should be read, we do not claim that the authority ladder is the mechanism that produces the abstention. Three independent analyses say otherwise (Sections 5.8 and 5.8.1): a leave-one-component-out re-scoring finds execution grounding load-bearing and catalog confidence carry- ing coverage rather than ranking; a generator-fixed router matrix finds the authority features add no incremental discrimination over generic signals; and a direct re-bootstrap ablation that removes ev- ery tier ceiling changes the delivered outcome on one of forty-one paired questions. We report this because we measured it, and it revises our own prior framing. What we do claim is correspondingly narrow, and it is exter- nally validated. First and primarily: given a column stripped of its name and documentation, the metadata this architecture delivers recovers more of what human authors wrote than that of either a statistical semantic-type detector or the same language model used directly, because it is the only one of the three that declines when it cannot ground an answer, and because that declining is driven by the deterministic evidence rather than by the model’s self-report. We are explicit that this is a selection advantage: on columns where the baseline also speaks, it writes metadata of the same quality (Section 5.2.1). The claim is measured against documentation we did not write, on schemas we did not choose, with intervals that resample databases rather than columns, and with the scoring metric itself audited rather than assumed. Second: over the resulting catalog, the system delivers calibrated abstention at query time (answering selectively, with coverage that tracks difficulty, converting a naive model’s confident silent errors into auditable refusals) on Spider, sharpening on BIRD. Two prop- erties of how it does so are the durable contribution rather than the tiering itself: the decision requires no outcome labels (the learned selectors that outrank our score in Section 5.8.1 all need execution- labeled data that an undocumented warehouse cannot supply), and it is auditable and deterministic: every routed answer carries the provenance of the facts it rests on, and the LLM contributes features but never arbitrates the route. 2 Related Work Text-to-SQL and benchmarks. The modern text-to-SQL literature is anchored by cross-domain benchmarks that supply clean schemas. Spider [28] established the cross-database generalization setting, and BIRD [16] extended it with larger, noisier real-world databases and an execution-accuracy metric while still providing curated schema metadata. The methods evaluated on these benchmarks have advanced from early neural sequence-to-sequence and sketch- based parsers [27,31] to LLM prompting and agentic pipelines that decompose linking, generation, and self-correction [6,22]. Our work is positioned against the schema assumption common to all of them: we treat the schema itself as degraded and the reconstruction of its semantics as the central task. We are not aware of a published benchmark that systematically strips schema documentation and measures the resulting degradation as a function of reconstruction effort; we construct such a mangler and report a Spider study with it (Section 5.6). Schema linking. A substantial line of work treats schema link- ing (aligning question tokens to the correct tables and columns) as the hard sub-problem of text-to-SQL, inserting explicit link- ing or grounding stages between the question and SQL genera- tion: intermediate-representation parsers [10], relation-aware joint question–schema encoders [25], and ranking-based decoupling of linking from skeleton generation [15]. Our deep profiler and grounding gate can be read as an aggressive form of schema-linking infrastructure that operates before any question arrives: rather than linking a question to a clean schema, we first reconstruct a semantic catalog over a cryptic schema, then link against the reconstructed catalog. The distinction is that our linking evidence is bounded by an explicit authority tier. Selective prediction, abstention, and calibration. Treating abstention as a first-class outcome draws on the classification-with- reject-option tradition [3] and its agnostic-setting generalization [4], and on selective prediction for deep networks [7,8], which we adopt together with the risk-coverage curve and its area (AURC) as the correct lens for evaluating a system that may abstain. In the LLM setting, a growing body of work studies whether models "know what they know" and when they should decline to answer [14,26]. Our routing layer implements a three-way generalization of accept/reject: answer, confirm-first, refuse. Its confidence is turned into a probability by per-layer post-hoc calibration: we fit isotonic regression [29] against outcome labels recovered from event lineage, in the tradition of probability calibration for classifiers [9,18,21], and report the Brier score and expected calibration error. Abstention and selective prediction for text-to-SQL: the closest work. Reliability-oriented text-to-SQL is an active and very recent line, and we position against it directly. Closest is RTS (Reliable Text-to-SQL with Adaptive Abstention) [2], which makes abstention first-class by applying conformal prediction to an LLM’s schema-linking hidden states and adds human-in-the-loop inter- vention, validated on BIRD. Post-hoc calibration of text-to-SQL confidence has likewise been studied directly: multivariate Platt scaling over sub-clause-frequency features produces well-calibrated query-level confidence across Spider and BIRD [17]. And a con- current selective-prediction study surveys the natural correctness 3 Helwig signals (self-consistency, executability, log-probabilities, schema- relevance, learned verifiers, and LLM-judge ensembles), finding that black-box judge ensembles dominate and that fine-tuned veri- fiers fail to transfer to unseen schemas [23]. Rosetta differs from all three along one axis they share: each estimates uncertainty over an available (if noisy) schema at query time. Rosetta is not the first text-to-SQL system to abstain. It is, to our knowledge, the first system to reconstruct missing warehouse metadata into an authority-bounded fact graph and propagate that evidence authority into deterministic selective query answering under controlled schema opacity. Concretely: where RTS abstains dur- ing schema linking on schemas that are present, Rosetta reconstructs absent metadata before any question arrives, attaches provenance and an explicit authority ceiling to each reconstructed fact, and routes with a black-box-compatible deterministic rule in which the LLM contributes features but never arbitrates the route, targeting opaque physical schemas and metadata quality rather than link uncertainty over a readable one. The calibration and correctness- signal baselines [17,23] also define the comparison set that our fair-baseline study (Section 5.6) begins and that a full main-track evaluation would complete against Rosetta’s authority-grounded score. Data catalogs, discovery, and profiling. Reconstructing se- mantics from values connects to data profiling (cardinality, value distributions, pattern and dependency detection [1], including scal- able inclusion-dependency discovery [20], platforms that indus- trialize it [19], and the selection of true foreign keys from among discovered dependencies [24,30]) and to enterprise data-catalog and data-discovery systems that organize and surface warehouse metadata at scale [5,11], including learned semantic-type detec- tion from column values [13]. Our contribution relative to that tradition is not the profiling primitives but their composition into an authority-tiered, confidence-capped fact graph that feeds a cali- brated router, and the use of checksum-validated structural patterns to bound (rather than merely produce) semantic confidence. Every reference in this paper was verified against Crossref, arXiv, and Semantic Scholar (each entry resolved to a real work), and we situate the contribution against the named benchmarks and systems above; the external evaluation of Section 5.6 is designed to test it on stripped public schemas, not only our own fixtures. 3 Problem Formulation Let a warehouse푊consist of schemas, tables, and columns. Each column푐has a physical identifierid(푐)(possibly cryptic), a popula- tion of values푉(푐), and an unknown true semantic concept휎 ∗ (푐) drawn from a business ontology (e.g., "guest folio amount in minor currency units"). The available documentation퐷is a partial, possi- bly contradictory map from a subset of columns to natural-language descriptions; in the worst case 퐷=∅. Metadata reconstruction. The reconstruction task is to pro- duce, for each column, an estimated concept ˆ 휎(푐)together with a calibrated confidence푝(푐) ∈ [0,1]and an authority tier휏(푐) that records the strongest class of evidence supporting ˆ 휎(푐). The tier is not a free parameter: it caps the confidence, so that푝(푐) ≤ cap(휏(푐)). A reconstruction is committed to the catalog only if its tier reaches an auto-commit threshold; otherwise it is enqueued for human review. Question answering with abstention. At query time the sys- tem receives a natural-language question푞. It produces a candidate SQL program푠, executes it (or determines it cannot safely execute), and must select a route 휌(푞) ∈ answer, confirm_first, refuse. Let푦(푞) ∈ answerable, ambiguous, out-of-scopebe the (la- tent) ground-truth disposition of the question. The evaluation does not score SQL string equality. It scores route accuracy, whether 휌(푞)matches the disposition the question deserves, together with auxiliary measures (column퐹 1 , execution-result match where a canonical query is available, and a continuous confidence score). Crucially, refuse is a correct route for out-of-scope or insufficiently grounded questions; a system that answers them is wrong even if the SQL is syntactically fine. Selective-prediction view. The routing problem is a selective- prediction problem with an extra rung. A confidence score 푧(푞) is computed for each question; thresholds(푡 refuse ,푡 confirm )partition the score axis into refuse / confirm-first / answer regions. Sweeping the thresholds traces a risk-coverage trade-off: lowering coverage (answering fewer questions) should lower risk (error rate on an- swered questions). The design goal is a confidence score that is monotone in correctness, so that abstention is well-behaved. Estab- lishing this property empirically with risk-coverage curves is the subject of Sections 5.1 and 5.6. An early attempt to read it off pooled historical logs was inconclusive, and, we later found, corrupted by an evaluation-harness bug (Section 5.1), but the controlled external measurement on 1,082 execution-labeled Spider questions shows the raw score both discriminates correct from incorrect (normalized AURC 0.26, CI excluding random) and is calibratable (ECE 0.088 →0.026), and the pilot (Section 5.6) turns that into a demonstrated selective-prediction advantage: the gate answers selectively, with- holding the questions it would most likely get wrong, rather than abstaining wholesale. 4 Method Rosetta is organized around a single principle: the LLM con- tributes features and candidates; deterministic, auditable machinery makes the decisions. This applies both to reconstruc- tion (where an LLM may propose a column’s meaning but may not assert a match without mechanical proof) and to routing (where the LLM may generate SQL and critic verdicts but may not choose the route). The design rules this section instantiates are distilled, with their measured boundaries, in a companion methodology pa- per [12]. The following subsections describe the four load-bearing components. All component descriptions are code-verified against the implementation; file paths are given for reference. 4.1 The authority-tiered fact graph The spine of reconstruction is an ordered grounding-tier lad- der (rosetta/grounding/tiers.py, aGroundingTier IntEnum). Each tier names a class of evidence and carries an L2 confidence cap. The committed confidence of any reconstructed fact is 4 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses 푝(푐)= min raw_L2(푐), cap(휏(푐)) , so that the authority of the evidence mathematically bounds the confidence, regardless of how confident the underlying model claims to be. The ladder is: A subtle but load-bearing design choice is that PATTERN_VAL- IDATED (tier 4, checksum-backed) is deliberately floored below DOC_CITED_STRONG (tier 5). The system’s own design note states the rationale: "checksum math doesn’t admit coinci- dence" (a column whose values pass the IBAN mod-97 check almost certainly contains IBANs), but a checksum only proves what kind of thing the values are; it does not tie the column to its business name. A strong documentation citation, by contrast, asserts the name. Confidence in what a column means for the business is there- fore capped higher by a strong doc cite than by a checksum, even though the checksum is "harder" evidence about value structure. Encoding this distinction in the tier order is precisely the kind of bounded-authority reasoning that prevents over-confidence. A scoring functiontier_for_score()maps a raw score to a tier through default score bands, with three outcome-driven short- circuits: an explicit human acceptance routes to tier 7; three ac- cepted downstream queries route to tier 6; and a checksum-backed pattern match floors the tier at 4. Hardening in the gate (_has_sme_- affirmation) requires that an SME affirmation be value-specific and still live (the predicate matches the exact value and requires that the fact has not been superseded), which fixes an earlier bug in which any past human acceptance allowed unrelated new guesses to inherit the 1.00 SME tier. 4.2 The deep profiler: Tiers A→ B→ C Reconstruction evidence is produced by a three-tier deep profiler (rosetta/metadata/deep_profiler/, orchestrated byDeepPro- filer.profile()), structured so that cheaper, more deterministic evidence is exhausted before more expensive, less certain evidence is invoked. Tier A: structural fingerprint (fingerprint.py) is determin- istic and uses no LLM. Over up to 5,000 sampled values per column it computes a ColumnFingerprint: length distribution, character- class ratios, delimiter and case profile, longest-common-prefix / suf- fix coverage, per-character Shannon entropy, numeric summary sta- tistics (min, max, median, 5th and 95th percentiles), a Benford first- digit KL divergence when푁 ≥30, a monotonicity test (≥70% step-1 increments flags an auto-increment), cardinality ratio, sentinel- value candidates, and a one-level recursive segment fingerprint for composite codes. This is the structural substrate everything else reasons over. Tier B: pattern library (patterns.py,DEFAULT_PATTERNS) consists of roughly twenty-five defaultPatternSpecs (approxi- mately twenty-six counting variants), each gated by the Tier-A fingerprint. The key mechanism is checksum promotion: a pat- tern whose values pass a checksum is promoted to≥0.95 confi- dence withdetails="checksum": True; a regex-only match is capped at 0.85; a fingerprint-heuristic match at 0.70. Checksum validators (checksums.py) implement Luhn, ISBN-10/13, EAN-13, UPC-A, IBAN mod-97, and mod-11. The library is intentionally tenant-agnostic (it matches structure, not domain strings), which is why it generalizes across verticals. Tier C: rule-verified LLM namer (pattern_namer.py) fires only when no Tier-B pattern matches and naming is enabled, i.e., for genuinely cryptic columns. The LLM proposes a triple(pattern_- name, semantic_type, verification_regex). This proposal is mechanically verified before acceptance: the regex must compile, must not be one of a set of trivial/degenerate regexes, and mustfullmatchat least 90% of the sampled values. The LLM is thereby never permitted to assert a match; it may only propose a hypothesis that the system then mechanically confirms or rejects against the data. The effectiveness of this stage is illustrated by a measured zenith run in which cryptic columns with no semantic match dropped from 66 to 2, a 64/66≈ 96.9% recovery. These tiers feed aDeepPatternAttester(grounding/attesters/ deep_pattern.py ): a bucket match plus checksum yields asup- ports@0.95attestation with apattern_validated_candidate code that floors the grounding tier at 4; conversely, a bucket mis- match against a checksum-backed match yieldscontradicts@0.95: when the system has proof, it uses that proof both to support and to refute. 4.3 Calibrated routing: answer / confirm-first / refuse At query time the candidate answer is scored by a Layer-4 (L4) score (prediction/layer4_result.py), a clipped linear sum of Layer4Featureswith weights pinned by a snapshot test and an- notated with provenance. The heaviest positive contributors are execution_ok(0.20),link_calibrated_probability(0.20), and catalog_entry_mean_confidence(0.18); the heaviest penalties are amagnitude_cohort_outlier_penalty(−0.30, the single largest term) and arow_count_implausible_penalty(−0.15). The cata- log confidence term is exactly the bounded reconstruction con- fidence from Section 4.1, so the authority ladder propagates di- rectly into the routing score: an answer that depends on a weakly grounded column carries that weakness into its route. The route is pure thresholded arithmetic (consumption/ answer_formatter.py). If execution did not succeed, the route is refuse. Otherwise, if the score is below the refuse threshold the route is refuse; if it is below the confirm threshold the route is confirm-first; otherwise it is answer. The thresholds are mode-dependent: a rule- based decision tree (detect_mode, no ML) classifies the question’s grounding regime and selects aQueryPolicy: DOCUMENTED_- STRONG (0.60 / 0.20), AMBIGUOUS_DOC (0.60 / 0.05), or CRYP- TIC_LEGACY (0.65 / 0.20). The central thesis, which we state plainly because it drives the system’s auditability and prompt-injection resistance, is that the LLM contributes features, never decides the route: the linker reranking, the generated SQL, and the critic verdict all enter the score as features, but the route is a deterministic function of the score and the thresholds. Calibration (prediction/calibration.py) fits a per-layer iso- tonic regression that maps raw scores to empirical correctness. Out- come labels are recovered by joining predictions to downstream events through event lineage: an L2 commit to acommit_reviewed event, a grounding decision to areview_queuestatus, an L4 answer to a thumbs rating on the delivered answer. The calibrator requires 5 Helwig Tier NameCap Meaning 0INTERPRETER_ONLY0.50LLM inferred meaning from the column profile alone 1PATTERN_CONFIRMED 0.60profile matches a known regex shape 2DOC_CITED_WEAK0.70a 0.30–0.80 documentation snippet was cited, graded only "related" 3SIBLING_CONSISTENT0.75sibling columns are uniformly consistent 4PATTERN_VALIDATED0.85checksum-backed structural match (Luhn / IBAN / ISBN / EAN / UPC) 5DOC_CITED_STRONG0.90a ≥0.80 snippet directly asserts the meaning and "supports" it 6QUERY_VALIDATED0.95 ≥3 downstream queries accepted the column with no rejections 7SME_AFFIRMED1.00a human reviewer explicitly accepted the value at least fifty samples and is stored as a fifty-one-point grid in an append-only weights table. Until recently this calibrator was fitted but never applied (the serving predictor loaded only the heuristic- weights row andapply_calibratorhad no caller), so the served score was always the raw weighted sum; it is now wired into serv- ing (Section 5.1). Whether that score is monotone-in-correctness enough for clean risk-coverage curves is no longer open: on 1,082 execution-labeled Spider questions (Section 5.1) the raw score dis- criminates correct from incorrect well (normalized AURC 0.26, CI excluding random) and an isotonic map makes it well-calibrated (ECE 0.088→0.026); the earlier "weak discrimination" verdict was an artifact of the harness bug of Section 5.1, which had pinned the execution_ok feature to a constant. Advisory signals adjust the score without unilaterally flipping the route. A critic, invoked only in the ambiguous band, maps its verdict to an additive adjustment (accept→+0.18·conf, reject→ −0.25·conf, uncertain→−0.05) that becomes a feature before scor- ing. A family of independent advisory penalties (_penalized_l4: critic-reject, structural, magnitude, result-sanity, per-trap-code, and weak-self-confidence) can deepen a low score but is governed by a strict invariant: advisories can neither manufacture nor rescue a refuse; they are clamped so they can only push a score further down from below the refuse threshold, never lift it across. Sym- metric bonuses exist for trivially-correct aggregates and evidence consensus. Two decisive escalation paths remain inside the score machinery: a soft-pin that deterministically forces confirm-first, and a forces-refuse path reserved for catastrophic-PII findings (SSN, credit-card, medical-record), which alone may override confirm- first to refuse; soft PII remains advisory only. A trap detector (consumption/trap_detector.py) supplies many of these advisory penalties through 28KNOWN_TRAP_CODES, each a pure function of the question, the SQL, the linked entities, and the foreign-key edges, with no tenant-specific strings, which is again why the detectors generalize across domains. A last-line SQL guard (connectors/_sql_guard.py) enforces single-statement read-only execution via a leading-verb allow-list, a single-statement check, and an abstract-syntax-tree root check that blocks theWITH cte ... DELETE CTE-DML escape, failing closed on any ambiguity. 4.4 Human-in-the-loop proposals Reconstruction is not fully automatic by design. The grounding gate (rosetta/grounding/gate.py) runs up to seven attesters concur- rently: Profile, Doc, Sibling, Contradiction, and Usage (the original five), plus optional QueryLog and DeepPattern, each returning an AttestationResultwith a verdict in supports, related, contra- dicts, uncertain, skipped. The gate assembles these into a feature vector consumed by a linearGroundingPredictorwhose strongest positive weights are the document signal (0.22) and the deep-pattern signal (0.18). The auto-commit rule is explicit: if the resulting tier reaches the auto-commit tier (default SIBLING_CONSISTENT / 3), the fact is committed at its capped confidence; otherwise it is enqueued to areview_queuefor human adjudication. A human SME who accepts a value lifts it to tier 7 (cap 1.00). The only path to maximal confidence thus runs through a human, and every commit- ted fact carries full provenance (model, prompt version, evidence reference, tier, build identifier), the property that makes the catalog auditable and the eval’s per-fact attribution possible. This pathway also frames one of the paper’s suggestive internal findings (Section 5.5, on a small single-tenant bank with an unpaid- human confound): an automated LLM-team pre-flight that plays the SME role can reconstruct more of the catalog, at lower cost, than a human SME, and, as a reproducible negative result, stacking a human on top can regress accuracy. The four enterprise "levers" of the platform (authentication/RBAC, a uniform multi-warehouse connector layer, an on-premise egress agent that keeps warehouse credentials inside the customer net- work, and an incremental streaming-delivery mode) are built and default-inert. They are orthogonal to this paper’s thesis and are noted only because the routing and grounding machinery operates uniformly across DuckDB, Postgres, Snowflake, and BigQuery con- nectors behind a single abstraction. We claim no accuracy results for these levers; their adversarial hardening passes are software- robustness, not text-to-SQL accuracy. 5 Evaluation The evaluation is organized around the system’s product rather than its demonstration. Section 5.1 describes the apparatus: the schema mangler, the scorers, and a harness bug we caught and re-ran around. Sections 5.2–5.4 are the paper’s primary result: how much of a column’s meaning the system recovers from values alone, whether the metric that says so is measuring meaning at all, and what happens on a real coded clinical warehouse. Section 5.5 is an internal multi-tenant case study of the running system, reported as a case study and never as proof. Sections 5.6–5.11 evaluate what the reconstructed metadata is for (question answering with cali- brated abstention), including three analyses that revise our own prior account of the mechanism. Section 5.12 records the frozen experimental record. 6 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses We separate cleanly what has been measured from what re- mains proposed, and every measured number traces to an actual run: internal (Section 5.5) or external (the reconstruction study of Section 5.2, the Spider study of Section 5.6, and the BIRD breadth study of Section 5.7). The experiments still described as proposed within Section 5.7 (finer severity grids and further held-out tenants) must not be read as results. The external numbers are backed by a committed experimental record:papers/EXPERIMENTS.mdties each figure to its raw-data file underpapers/data/and the exact command that regenerates it, and the calibration and discrimina- tion analyses re-run for free from the committed 1,082-sample execution-labeled dataset. 5.1 Experimental apparatus: the mangler, the scorers, and a bug we caught Every study in this section depends on three pieces of apparatus, so we describe them before any result rests on them: a schema mangler that removes documentation from a database without touching its data, scorers that measure what a reconstruction recov- ered, and a risk-coverage analyzer for the query-time studies. We also record here an evaluation-harness bug that corrupted an earlier verdict, because every later section inherits the corrected harness. (Code:rosetta/eval/schema_mangler,reconstruction_recall, risk_coverage.py, each with unit tests; CLIs under scripts/.) The schema mangler (P1) is built.rosetta/eval/schema_- mangler.pyconverts a documented schema into a stripped one at a chosen severity: it renames tables and columns to opaque iden- tifiers, deletes comments, and drops declared foreign keys, while preserving the data and emitting an original↔mangled name map so gold queries can be re-expressed. It is deterministic under a seed, severity-monotone (higher severity removes a strict superset of signal), and unit-tested for name-map round-tripping and value preservation. We have now pointed it at actual Spider databases and run the external pilot reported in Section 5.6, and extended it to BIRD’s real-world schemas (Section 5.7); the full Spider dev set remains the breadth item of Section 5.7. Reconstruction token-recall (P3) is measured.rosetta/ eval/reconstruction_recall.pyscores the system’s reconstructed column descriptions against theground_truth.jsongolden vo- cabulary: expected tokens are drawn from each column’s concept, semantic type, unit, and value-domain labels, and recall is |expected ∩reconstructed| / |expected|, the fraction of expected tokens the reconstruction recovers. On the two fully-bootstrapped tenants that carry golden files, macro token-recall is 0.774 (micro 0.733) on carenexus (40/40 columns) and 0.560 (micro 0.585) on zenith (32 columns), for a macro mean of 0.667. The zenith figure is hon- estly dragged down by 8 of its 32 golden columns that carry no live catalog description at all: a genuine reconstruction gap, not a scoring artifact. This is a direct, routing-independent measure of reconstruction quality, and it is now a real number rather than a promise. Risk-coverage (P4): the analyzer is built.rosetta/eval/ risk_coverage.pycomputes selective-prediction (risk-coverage / AURC) curves from logged (score, outcome) pairs. Read off pooled historical logs, the raw score was inconclusive as an abstention signal: the execution-labeled slice was thin (N=39) and confined to the answered region, while a larger pooled view was contaminated by question duplication across runs, so we did not rely on it. The decisive measurement needs execution-correctness labels spanning the full confidence range (including refused questions), on a dedu- plicated set, with the isotonic map fit before scoring. That is exactly what the controlled Spider study below supplies; the pooled-log negative is reported only as the motivation for running it. The apparatus now exists; the task was to run that measurement correctly, which surfaced a bug that had been silently corrupting it. A harness bug had been suppressing these measurements; fixing it makes the controlled study both larger and stronger. The setup was in place: the isotonic calibrator, fitted but never applied (the servingLayer4Predictorloaded only the heuristic- weights row andapply_calibratorhad no caller), is now wired into serving with a raw fallback and tests; and the Spider harness logs(ℓ raw 4 , features, execution-correct)for every question regard- less of route. But the first harvest ran the in-process/askpipeline against the wrong warehouse.reconstruct_and_askbuilds its DuckDB connector through the same tenant→path resolver the production endpoint uses, and that map is injected per subprocess during bootstrap, not into the in-process harness, so the connector silently fell back to the global default warehouse. Every predicted query then failed toEXPLAINagainst a schema it could not see, pinning theexecution_okfeature to 0 and firing the implausible- row-count penalty: a uniform≈0.35 suppression ofℓ 4 on every question, independent of SQL quality. The symptom was hiding in plain sight in the numbers we first reported: the samples spanned onlyℓ 4 ∈ [0.0,0.48](that 0.48 ceiling is the suppression) and the gate "never answered." We found it, fixed it (the in-process har- ness now injects the tenant→warehouse mapping exactly as the resolver expects; the fix carries unit tests), and re-ran the entire study at larger scale. The latent-SQL-accuracy figures of Section 5.6 are unaffected (they execute through a direct connection that bypasses the connector), but the routing and confidence-calibration numbers change substantially, in the system’s favour. The corrected study spans 11 Spider databases×3 severities ×3 reconstruction conditions (cold, oracle-documented, SME- affirmed): 1,082 execution-labeled samples (base correct-rate 0.617), evaluated out-of-fold (5-fold CV) with 95% confidence intervals from a cluster bootstrap over databases, the honest sampling unit, since questions within a database share a schema and a bootstrap. The architecture’s predicted split-verdict holds, now with real signal on both axes: •Discrimination (doesℓ 4 rank correct above incorrect?). Rawℓ 4 now ranks well: AURC 0.163 against a random reference of 0.383 and an oracle of 0.085, a normalized AURC of 0.259 (95% CI 0.161–0.346), capturing≈74% of the available ranking signal, with the interval excluding the worse-than-random region decisively. The contrast with the 0.809 we reported on the suppressed data is itself the di- agnosis:execution_okis a genuine discriminator (AUROC 0.650) that the bug had pinned to a constant, so it could carry no signal at all. The three deployed routes come out cleanly monotone in both confidence and accuracy: refuse (meanℓ 4 0.086, 1 of 159 actually correct), confirm-first (0.589, 41% correct), answer (0.770, 86% correct). That is 7 Helwig the ordering a calibrated gate must produce. One correction to our own prior claim: the "re-weight toward generator- self-confidence and linked-entity-count" lever that doubled discrimination on four databases does not survive to eleven (linked-entity-count’s univariate AUROC falls from 0.77 to 0.60 and the two-feature refit underperforms the full raw score); it was a small-sample artifact and we retract it. The raw score discriminates well as-is. •Calibration (does a score of 0.6 mean푃(correct)=0.6?). Rawℓ 4 is moderately miscalibrated (Brier 0.144, ECE 0.088); the out-of-fold isotonic map fixes it decisively: Brier 0.144 →0.128, ECE 0.088→0.026. A served threshold now carries an honest probability. We do not install this Spider-fit calibrator into production: it is fit on a single benchmark distribution, and the honest deploy- ment fits on production execution labels, which the now-wired path makes routine. What matters is the measurement: on a controlled, execution-labeled, eleven-database set with confidence intervals, the reconstruction gate’s confidence both discriminates correct from incorrect (normalized AURC 0.26, CI excluding random) and is calibratable (ECE to 0.026), the two properties the abstention guarantee of Section 4.3 rests on. We had previously reported dis- crimination as "only weakly present"; that verdict was an artifact of the suppressedexecution_ok, and we report the correction in full because catching and fixing our own evaluation bug, then re- running at larger scale before claiming the stronger result, is part of the evidence, not a footnote to it. 5.1.1 What a re-run reproduces, and what it does not. Several re- sults in this paper compare corpora produced weeks apart, so we measured the noise floor beneath those comparisons rather than assuming one. Two facts have to be kept apart, and conflating them is easy. The system wraps every model call in a response cache keyed onsha256(prompt + model + prompt version + schema). An unchanged prompt therefore returns the stored bytes, and a cross- run comparison made with the cache enabled measures cache hits, not model stability. We confirm this rather than assert it: re- running arm A over three databases with the cache on reproduces the committed corpus on 96 of 96 columns, byte for byte, with zero abstention changes. The practical consequence is the useful one: when a re-run does differ, the difference is attributable to changed inputs, never to sampling. To measure the model itself we bypass the cache entirely and run arm A twice over identical inputs: The model rewords constantly and decides consistently. Only 38.5% of predictions come back byte-identical, so the prose is genuinely nondeterministic; yet the speak-or-abstain decision moves on a single column in ninety-six, and aggregate recall repro- duces to±0.001. That asymmetry is worth stating plainly because it is the property the architecture depends on: what the system commits to a catalog is far more stable than the sentences it writes. It also gives every effect in this paper a scale to be judged against. An aggregate difference of a few thousandths is indistinguishable from re-running the same experiment twice; the differences we re- port as results are one to two orders of magnitude larger. We use this explicitly in Section 5.2, where a corpus re-run moved arm C’s de- scription recall by +0.027, above this floor, and therefore attributable to the code change rather than to sampling. (Harness:scripts/ recon_llm_nondeterminism.sh,scripts/recon_nondetermin- ism_analysis.py; data: papers/data/nondeterminism.json.) 5.2 Reconstruction fidelity: a three-way comparison against human documentation This section measures the system’s actual product, the reconstructed metadata itself, and it is the paper’s primary quantitative result. Everything after Section 5.5 evaluates what the system delivers at query time once that metadata exists; here we ask the prior question of whether the metadata is any good. The task, and why it is cleanly posed. Given a column stripped of its name and documentation, recover what the field means and what its values mean, from the values alone. BIRD ships human- written per-column documentation (database_description/*.csv) that maps directly onto those targets:column_nameis the expanded field name,column_descriptionthe prose semantics, andvalue_- descriptionthe code-to-meaning table. Across the eleven mini- dev databases that is 799 columns, of which 375 carry a genuine name expansion, 653 a description, and 278 a value-domain decode table. Our schema mangler destroys identifiers while prov- ably leaving the data untouched (Section 5.1), so the values are the input and the withheld human labels are the ground truth, authored by the benchmark’s curators, not by us. Three arms, identical inputs. (A) LLM-direct, the obvious practitioner approach: show a language model the column, its type, its sibling columns and its most frequent values, and ask what it means. (B) Deterministic, the system’s own pattern/checksum layer (structural fingerprint plus pattern library) with the LLM removed: no learning. Published semantic-type detectors (Sherlock and its successors) predict from closed type vocabularies and structurally cannot emit this task’s targets (free-text name expansions, descrip- tions, decode tables), so no published detector runs on this task unmodified; arm B is a floor by construction on the prose facets (it emits labels, not sentences) and a meaningful baseline on semantic- type and value-domain recovery. (C) Rosetta, the full verification harness. Arms A and C receive the same model, the same frequency- ordered sample budget, and the same mangled identifiers. Scoring credits abstention rather than punishing it. Content- token recall alone would score an honest "purpose unclear; recom- mend SME review" identically to a confident wrong description, which rewards guessing and would bias the measurement toward exactly the behaviour we argue against. We therefore report cov- erage (the fraction of columns where an arm makes a substantive claim) and recall-when-claimed separately, and audit each arm’s abstentions against what the other arms managed on the same columns. Columns inside a database share a schema, a domain vocabulary, a curator and a documentation style, so the database, not the column, is the unit of resampling. All intervals below are 95% cluster bootstraps over databases (2,000 replicates), and every arm pair is evaluated on the same resampled databases in each replicate, which makes the interval on the difference a properly paired one. 8 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses cache enabled (control) cache bypassed byte-identical prediction 96 / 9637 / 96 abstention decision flips01 / 96 mean macro recall0.219 / 0.2190.211 / 0.212 mean per-column |Δ recall| 0.0000.021 (2,000 paired resamples, seed 0; p-values from the bootstrap distribu- tion.) The full program consumed≈105M tokens over≈55,000 calls, $281 total;≈$0.0027 per reconstructed column; per-call latency p50 5.3s / p99 57.1s, wide catalogs≈8 minutes end-to-end. 680 columns paired across all eleven of BIRD’s mini-dev databases, identifiers destroyed. Both language-model arms beat the statistical baseline decisively; the two language-model arms do not separate cleanly. Against arm B, every difference on every facet excludes zero (A−B: +0.212 / +0.183 / +0.175; C−B: +0.464 / +0.270 / +0.261; all p≤0.001). The comparison between the harness and the LLM-direct baseline is positive on all three facets but only one interval excludes zero: name expansion +0.252 [−0.004, +0.414] (p = 0.057), description +0.087 [−0.034, +0.164] (p = 0.131), value domain +0.087 [+0.010, +0.199] (p = 0.032). We state that plainly because an earlier draft of this paper re- ported all three C−A intervals as excluding zero, on a ten-database corpus. Adding the eleventh database (student_club) moved two of them across the threshold. That database is an outlier in the direction that matters: its columns (first_name,t_shirt_size, city) are close to self-describing from values alone, so arm A scores 0.592 on description there against 0.00–0.27 everywhere else. Noth- ing was re-tuned; the sample simply got one database larger and less favourable. Per-database spread is wide throughout (Rosetta’s name-expansion recall ranges 0.00 to 0.83), so the aggregate is not uniform and some databases contribute nothing. A sensitivity check recomputes every pairwise interval two more ways from the committed per-column data: BCa in place of percentile, and an exact 2^11 cluster sign-flip permutation whose statistic weights databases equally rather than by column count (scripts/recon_sensitivity.py,papers/data/recon_sensitiv- ity.json). The arm-B comparisons are robust: all six BCa intervals still exclude zero, and the exact test rejects in five of six (C−B name expansion sits at p = 0.0625 on the nine databases carrying that facet). The C−A comparisons are method-dependent in ex- actly the direction this section already argues: value domain still excludes zero under BCa but the equal-weight exact test retains it (p = 0.35), so the C−A advantage is concentrated in the column-heavy databases rather than uniform across them, one more reason the paper’s claim rests on selection, not on prose superiority. The full per-database breakdown of the description-facet differ- ence (both-claim columns; positive favours the harness;−0.347 at student_clubto +0.071, eight of eleven at or below zero;scripts/ recon_perdb_ca.py, papers/data/perdb_ca.json): One methodological check belongs with that admission. The ten-database corpus had been assembled over several days, during which the profiler changed (a determinism fix in delimiter detection, and a new structural matcher), so the eleventh database was not merely an addition: it was also the only one produced by the current code. Attributing the change to the database while the code had also moved would have been an error, so we re-ran all eleven databases on one code version and compared like with like. On the same ten databases, old code against new, arm C’s description recall moves +0.027 [+0.006, +0.054] and coverage does not move at all (0.389 →0.389). The code change is real, small, and points upward, the opposite direction from the drop above, so it cannot explain it. The eleventh database can, and does. Every arm-C number in this paper comes from the single re-run corpus. Section 5.2.1 argues that this is the expected outcome rather than a weakened one, because recall-when-claimed compares arms over different column sets, and the harness’s real contribution is visible only once that confound is removed. The ordering is monotonic on every facet and has held as the sample grew through 85, 206, 366, 437, 632 and 680 paired columns. Two things follow immediately. First, pure pattern classifica- tion recovers almost nothing of human-written semantics: it can report "categorical enum, five distinct values" but not "district status: Active, Closed, Merged, Pending". Second, the language model supplies the semantic content (B→A). What the harness adds on top of the language model is a subtler question than the table suggests, and the next subsection is devoted to answering it correctly, because our own first reading of these numbers was wrong. 5.2.1 The advantage is selection, not description, and we can show it. Read naively, the table says the harness roughly doubles field-name recovery (0.223→0.475). That reading is wrong, and a reviewer would be right to suspect it: the two arms are averaged over different column sets. Arm A speaks about 640 of the 680 columns and arm C about 287, so "recall when claimed" rewards an arm for declining exactly the columns it would have scored badly on. The comparison that removes this is the paired one: restrict to the 283 columns where both arms speak (an identical question set, so prose is the only thing that can differ) and compare per column. On common ground the harness does not write better meta- data: it writes measurably worse. On the eleven-database corpus two of the three differences now exclude zero, where on the ten- database corpus all three were negative but none were significant. This is not an artifact of the lexical metric: on the subset of the Section 5.3 validation sample where both arms speak, the blinded judge scores them 0.513 (A) against 0.474 (C), a paired difference of−0.038 across 26 columns. That judged subset is small and its interval is wide ([−0.213, +0.120]), so it corroborates the direction rather than establishing it independently; the token metric, on eight times as many columns, is what carries the result. Two measures of different kinds agree that the harness’s prose is not better. The entire measured advantage therefore comes from which columns the system agrees to describe. That is a selection effect, and stated plainly, it is also the point of the architecture, so we tested it directly rather than assuming it. We recomputed the deterministic 9 Helwig armcoverage name expansiondescriptionvalue domain B: statistical, no LLM 1.0000.011 [0.000, 0.028]0.061 [0.036, 0.096]0.030 [0.004, 0.081] A: LLM-direct0.9410.223 [0.075, 0.415]0.244 [0.165, 0.330]0.205 [0.169, 0.247] C: Rosetta0.4220.475 [0.176, 0.619] 0.330 [0.257, 0.390] 0.292 [0.195, 0.422] databasenΔ description (C−A) california_schools26 -0.001 card_games44 +0.018 codebase_community18 -0.130 debit_card_specializing 2+0.000 european_football_216 -0.111 financial13 -0.077 formula_123 -0.043 student_club36 -0.347 superhero9+0.000 thrombosis_prediction7+0.071 toxicology9-0.056 facetarm A arm C paired differencen name expansion 0.5180.486 −0.033 [−0.135, +0.025]46 description0.4230.335 −0.088 [−0.192,−0.005] 203 value domain0.3370.294 −0.043 [−0.074,−0.009] 106 evidence for all 680 columns (structural fingerprint plus pattern library, no language model, free) and mapped each column to the tier its evidence would justify: a checksum-backed proof toPAT- TERN_VALIDATED, a structural hit toPATTERN_CONFIRMED, nothing toINTERPRETER_ONLY. BIRD splits almost evenly: 342 columns with structural evidence, 338 without, and no checksummable identifiers at all, so the ladder’s top rung remains untested here. The result separates cleanly into a positive and a null: •Evidence governs whether the system speaks. Arm C’s coverage is 0.550 on columns with structural evidence and 0.293 on columns without, a gap of +0.257 [+0.128, +0.378], whose interval excludes zero. Arm A, which never sees the evidence, barely moves (0.980→0.902). The ab- stention decision tracks the evidence, which is precisely the "knows what it does not know" property the architec- ture claims, measured here at the level of individual facts rather than whole questions. This is the one C-versus-A effect in Section 5.2 that survives the eleventh database intact, and it is the one the architecture actually predicts. It does not, however, survive a change of backbone intact: on Claude Sonnet 4.6 the same pipeline speaks on 82% of columns (the naked arm on that backbone: 98%) and the evidence-tracking gap is no longer detectable (−0.089, interval spanning zero). Section 5.2.8 reports that in full; the short version is that the shipped system requests absten- tion in a prompt rather than enforcing it in code, so in the default configuration the property holds only for a model disposed to volunteer uncertainty (the tier gate reported there enforces it, on every backbone, when enabled). Read the paragraph above as conditional on that. • Evidence does not detectably improve what it says. On the paired subset, the extra advantage the harness gains from columns where the profiler had something to say (over and above the general easiness of those columns, which arm A measures on the same columns) is +0.090 [−0.006, +0.172], p = 0.071. We cannot distinguish it from zero. The honest conclusion, and the one the measurements support, is that the deterministic layer is a competence detector, not a competence amplifier, and, per Section 5.2.8, one whose detection is, in the default configuration, reported by the model rather than enforced by the system (the tier gate reported there enforces it when enabled). It is good at recognising which columns it is in a position to describe, and that recognition is worth a great deal operationally: a catalog whose entries are 0.475 accurate on 42% of columns is more useful than one that is 0.223 accurate on 94% of them, because the second kind cannot be trusted anywhere. But the harness is not making the language model a better reader of values, and we no longer claim it does. This also revises the mechanism account we gave in earlier drafts a second time: the evidence in the writer’s context is doing its work mainly on the decision to abstain, not on the prose. Read that against the rest of the paper and it is consistent rather than deflationary. It is the same selective-prediction result the query- time sections report, arriving one layer earlier: at the fact, not the question. 5.2.2 The second artifact class: rebuilding the join graph. Everything above measures columns. The system’s output is not only columns: it also emits a foreign-key graph, hierarchies, metric expressions and a glossary, and a paper that claims to reconstruct warehouse metadata should not evaluate one artifact class and imply the rest. We therefore measure the join graph, which has the cleanest ex- ternal ground truth in the entire benchmark: BIRD’s SQLite files declare their foreign keys, soPRAGMA foreign_key_listis a gold edge set we did not author, and scoring is an exact set compari- son with no judge, no token overlap and no argument about what "correct" means. The reconstruction under test rebuilds the graph from names and declared types only (no DDL, no data scan) using name- stem matching, pluralisation, compound-stem fallback and type- family rejection. We measure two conditions. Undeclared keeps column names and removes the FK constraints: this is the enterprise case our introduction describes, where "foreign keys are frequently undeclared". Destroyed additionally mangles identifiers at severity 1.0, as in the column study. Pooled over the ten BIRD databases that declare foreign keys. Precision is 1.000 in every database (49/49; exact 95% CI [0.927, 1.000]; recall 49/103, CI [0.376, 0.576]). Across 49 proposed edges the system does not invent a single false join. That is the same behaviour the column study found and the same behaviour the value-decoding study found: it proposes where the evidence is unambiguous and stays silent otherwise. For a catalog that a 10 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses conditiongold edges proposed precision recall F1 undeclared 103491.0000.4760.645 destroyed1030—0.0000.000 query planner will join on, a false edge is far more damaging than a missing one, so this is the right side of the trade to be on. Recall is bimodal rather than mediocre, and the split is entirely ex- plained by naming convention. Where the schema encodes the tar- get table in the key name, recovery is near-total:financial1.000, formula_10.947,toxicology0.800,superhero0.727,codebase_- community0.615. Where it does not, recovery is zero, and inspection shows exactly why:card_gamesjoins onuuidandsetCode,cal- ifornia_schoolsonCDSCodeandcds,student_clubonlink_- to_member andlink_to_major, andeuropean_football_2on eleven positional columnsaway_player_1. . .away_player_11 pointing atPlayer. A key whose name does not mention its target cannot be recovered by stem matching, and, we assumed when first writing this section, not by reading names at all. The head-to-head of Section 5.2.10 falsified the stronger form of that sentence: a language model given the same names and types re- coversforeign_data.uuid → cardsand every other gold edge, because understanding whatsetCodemeans is not the same op- eration as matching its stem (with the caveat, noted there, that these are public benchmark schemas a frontier model has plausibly seen in training). What survives is the narrower and more useful statement: name-stem matching is the wrong tool for these edges, inclusion-dependency analysis over the values [20] is the right one, and Section 5.2.10 builds exactly that verifier. The destroyed condition is 0.000 by construction and we report it to bound the claim honestly: name-based join inference con- tributes nothing on a genuinely opaque schema. The column- level reconstruction degrades gracefully under mangling; the join graph does not degrade, it disappears. Any claim that this system reconstructs a warehouse whose identifiers are meaningless must therefore be read as a claim about columns and values, not about the join graph. Measuring this class also repaid its cost immediately, which is an argument for measuring the remaining three. The first run scored recall 0.223 with six of ten databases at exactly zero. The cause was that stem extraction recognised only snake_case (district_- id ) and not camelCase (circuitId,UserId,PostId), on both the source and the target side of the lookup, sofinancialscored a per- fect 1.000 whileformula_1scored 0.000 for a purely orthographic reason. Real warehouses are not uniformly snake_case, and the fix (with the full suite re-run) took pooled recall from 0.223 to 0.476 andformula_1from 0.000 to 0.947. That defect had been latent in shipped code and no column-level experiment could have surfaced it. Hierarchies, metric expressions and the glossary remain un- measured against external ground truth, and we count that as the largest outstanding gap in this paper rather than as future work. (Harness:scripts/recon_fk_graph.py; data:papers/data/fk_- graph.json.) 5.2.3 The promotion path: confidence bounded by arithmetic. The architecture’s central commitment is that a claim’s storable confi- dence is a function of the strength of the proof behind it, not of a model’s self-assessment. Six of the twenty-six matchers are settled by check-digit arithmetic (Luhn, ISBN-10, ISBN-13, EAN-13, UPC-A and IBAN mod-97), and only those can unlockPATTERN_VALIDATED. Neither BIRD nor i2b2 contains a checksummable identifier, so ev- ery measurement reported so far was produced with that machinery dormant. The mechanism has been argued for and never shown. This shows it. The design is a matched pair, which is what makes it a demon- stration rather than an assertion. For each code system we build two columns that are indistinguishable by shape (identical length, character classes, prefix structure and cardinality), differing only in whether the check digit is arithmetically correct.4539567890123410 passes Luhn;4539567890123419does not, and differs in nothing else. A system whose confidence tracks surface form must treat these identically. A system whose confidence tracks proof must separate them. 6 of 6 valid columns promote; zero of 6 corrupted columns do. The separation is produced entirely by arithmetic the system performs on the values: there is no signal in the names, the types, the lengths or the distributions that distinguishes the two sides. The corrupted columns are also instructive in how they fail. The corrupted 13- and 12-digit numeric columns are not rejected out- right; they fall through to a structural phone-number matcher and settle atPATTERN_CONFIRMED, confidence ceiling 0.60. The system still says something true about them (they are fixed-width numeric strings), but at an authority that cannot reach the checksum tier no matter how confident the matcher is. Degradation, not silence, and the ceiling is what enforces it. Sweeping the fraction of corrupted values locates the gate pre- cisely. The checksum matchers require a 0.95 pass fraction, and the behaviour steps exactly there: Promotion survives 5% contamination and is withdrawn at 6%: a threshold on evidence strength, not a graded opinion. A warehouse column with a handful of bad rows still earns the tier; one where the arithmetic broadly fails does not. This is the clearest statement we can make of the property the whole architecture is organised around: the tier is not a descrip- tion of how sure the model feels, it is a record of what was proved. It is also the first time the top rung of the ladder has been exercised in this paper, and it is worth being explicit that this corpus is synthetic by necessity: the public benchmarks that supply our other ground truth simply do not contain checksummable identi- fiers. What it demonstrates is that the mechanism works and binds; what it cannot demonstrate is how often real warehouses offer it the opportunity. (Harness:scripts/checksum_promotion_study.py, locked bytests/unit/test_checksum_promotion.py; data:pa- pers/data/checksum_promotion.json.) 11 Helwig code systemvalid check digitscorrupted check digits Luhn / payment card PATTERN_VALIDATED (cap 0.85) INTERPRETER_ONLY (cap 0.50) ISBN-10 PATTERN_VALIDATED (0.85) INTERPRETER_ONLY (0.50) ISBN-13 PATTERN_VALIDATED (0.85) PATTERN_CONFIRMED (0.60) EAN-13 PATTERN_VALIDATED (0.85) PATTERN_CONFIRMED (0.60) UPC-A PATTERN_VALIDATED (0.85) PATTERN_CONFIRMED (0.60) IBAN PATTERN_VALIDATED (0.85) INTERPRETER_ONLY (0.50) corrupted fraction 0% 2% 4% 5% 6% 10% 25% 100% tier44440000 We then measured that opportunity on public tabular data, and the registered prediction was wrong. Before the scan we predicted checksummable columns would be a low-single-digit percent of columns, concentrated in financial and operational tables, with a meaningful minority of tables carrying at least one. The scan, 2,996 tables and 39,157 scanned columns from two corpora fetched by declared rules with no topical steering (1,500 Socrata open- government datasets walked in the discovery API’s own order; 1,496 GitTables tables from GitHub-scraped CSVs, capped at 25 per topic), every column run through the system’s own matcher layer, found 3 checksum-backed columns (0.008%) in 3 tables (0.10%), all three genuine Luhn-valid identifier schemes (two county property-tax account-number columns, one business-registry num- ber). Two orders of magnitude below the prediction. The honest in- terpretations are two, and they cut differently: either checksummed identifiers are simply rare in tabular data at large, or open portals redact precisely the identifier classes the rung certifies (payment cards, bank accounts, national identifiers are exactly what publish- ers strip before releasing a table), in which case the scan bounds the rung’s reach on public data while enterprise prevalence, where those columns live under access control, remains unmeasured. We cannot distinguish these from the outside; either way, the top rung is a narrow instrument in the wild and this paper’s claims do not depend on it being common. (Harness:scripts/checksum_preva- lence_scan.py,scripts/prevalence_fetch_corpora.py; data: papers/data/checksum_prevalence.json.) A reviewer-prompted diagnostic (post-hoc, and labeled as such in the registry) then tested whether the near-zero is manufactured by transit damage: leading-zero loss from numeric round-tripping (which spares payment-card numbers alone, explaining three-of- three Luhn survivors), delimiter formatting, and mixed ISBN edi- tions. Every column was re-validated under damage-reversing nor- malizations, with a degeneracy screen the first pass proved neces- sary: an unconstrained zero-pad "repairs" sparse numeric columns to ISBN-10 by the thousand, because all-zero strings satisfy the check arithmetic trivially, so the constrained pass restores at most three zeros, into identifier-like columns only, and the screen is recorded in the harness rather than silently applied. The finding refines the conclusion without flipping it. Two county assessment- number columns repair to 1.0 validity under mod-11 arithmetic once their leading zeros are restored: genuine check-digited identi- fiers damaged in transit, the predicted mechanism observed. (The validator that fires is the ISBN-10 one, because the ISBN-10 check is mod-11 arithmetic; what the checksum certifies is the identi- fier’s arithmetic class, never its business name: the Section 4.1 tier-order distinction, met in the wild. Nothing here calls a parcel number an ISBN.) Six further genuine identifier columns (one ISBN, five UPC) sit dirty below the gate at 0.60–0.85 validity, correctly refused by a 0.95 certification rule, exactly as the contamination- boundary study says they should be. Counting every clean, repaired and dirty case as opportunity raises prevalence to 11 of 39,157 columns (0.028%), still two orders of magnitude under the reg- istered prediction, but with eight of those eleven damaged or dirty: in open data the rung’s scarcity is part redaction, part disre- pair, and its clean hits understate the check-digited identifiers ac- tually present. (scripts/checksum_prevalence_diagnostic.py, papers/data/checksum_prevalence_diagnostic.json.) 5.2.4 The third artifact class: categorical rollups. A rollup hierarchy asserts containment (every school sits in exactly one district, ev- ery district in exactly one county), so a question grouped at the broad level can fan out to the narrow one. A wrong rollup is more costly than a wrong description, because it silently produces wrong GROUP BYresults rather than merely unhelpful documentation. The miner therefore gates on a≥2×cardinality amplification be- tween adjacent rungs, whose stated purpose is to reject synonym pairs likestatus_code/status_name, which are aliases rather than a hierarchy. That guard is the part we can test cleanly, because the data settles it. Two columns are an alias when they stand in bijection (same distinct count, each value of one determining exactly one value of the other), and a bijection is objectively not a containment relationship. Across the BIRD databases we find 22 such pairs, includingCounty Code/County NameandmcmId/mcmName. The miner mints none of them: alias rejection is 22 of 22. The false-positive guard the design depends on does what it claims. Recall is a different matter, and we report a methodological fail- ure rather than a number. Our first attempt derived gold hierarchies statistically (any functional dependency with≥2×amplification) and produced 558 "hierarchies" across eight databases. Inspection shows why that is not ground truth: a functional dependency is necessary but not sufficient for containment, and in a wide table with limited rows spurious dependencies are everywhere. The set was dominated by pairs likeAdmEmail2 → AdmEmail3andartist → colorIndicator, which hold arithmetically and mean nothing. A recall figure against that set would be meaningless, so we do not report one. 12 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses Against hand-identified genuine hierarchies the picture is partial and we state it as such. Of four semantic rollups present in the data, the miner recovers two (City → CountyandDistrict Code → County Codeincalifornia_schools) and misses two:District → County in theschoolstable, andleague_id → country_id ineuropean_football_2, the latter by design, since FK-suffixed columns are excluded from categorical rollup levels and belong to the separate FK-chain path. Measuring this class also repaid its cost the same way the join graph did. The first run proposed zero rollups on every database, be- cause both heuristics (curated ladder matching and stem grouping) test underscore boundaries, while BIRD writes its columnsCounty CodeandcolorIndicator. A component cannot find a geographic ladder it cannot tokenise. Normalising identifiers (camelCase split- ting, spaces and hyphens folded to underscores) before matching is what allows the existing rules to apply to the schemas they were de- signed for, and it is the second time in this paper that a snake_case assumption had silently disabled a shipped component on realistic input. The honest summary for this class is therefore: the guard against fake hierarchies is demonstrated; the recall against real ones is not yet measurable at scale, and building a trustworthy gold set of semantic hierarchies, rather than statistical ones, is the work that would settle it. (Harness:scripts/recon_hierarchies.py; data: papers/data/hierarchies.json.) 5.2.5 What the tables mean. Our claim is that the system recovers what the tables, columns and values of an undocumented ware- house mean. Columns and values had reconstruction paths and both are measured above. Tables did not: table entities were created at bootstrap as structural anchors and nothing ever said what they were. The clause had no implementation behind it, which is why no experiment had found it. We built the path (rosetta/metadata/ table_describer.py) and measured it here. The design follows from the setting. A table is identified by what it contains and how it is connected, not by its name, because in an undocumented warehouse the name ist7. The describer therefore sees the table’s columns with whatever the profiler and description writer already established about each one, the foreign- key neighbourhood (which is what separates a dimension (pointed at by many tables) from a fact table (pointing at several, carrying measures) from a bridge), the row count, and a few sample rows. It is asked for the entity and the grain, since "one row per order" and "one row per order line" are different tables and a consumer that confuses them writes wrong SQL. When the evidence does not identify the entity it is instructed to return nothing, and an abstention commits no fact at all, so a consumer can never read a blank claim as a claim. Setup mirrors the column study: table names and column names are both destroyed at severity 1.0, so the system sees t3.c0 ... t3.c9and must work out that it is looking at a list of racing circuits. Ground truth is the real table name, which BIRD’s authors chose and we did not. Because a table name is a label rather than prose, and often an acronym, as with California’sfrpm(Free and Reduced Price Meals), content-token recall is a poor primary metric here: a reconstruction reading "public school statistics" is substantially right and scores exactly 0.0 against the tokenfrpm. We therefore keep token recall as a conservative floor and add a blinded judge that sees the real table name and real column names as its reference. Three quarters of the tables are correctly identified with every identifier destroyed. Restricted to the tables where it does speak, the layered arm identifies the entity in 50 of 55 spoken tables (90.9%, exact 95% CI [0.800, 0.970]) and is judged outright wrong on 1 of 55 (1.8%); the flat arm, 85.7% and 5.4%; the unconditional 51 of 67 (0.761, CI [0.641, 0.857]) stands beside the conditional figures. The gap between token recall (0.59–0.66) and judged identification (0.75–0.76) is the acronym penalty behaving exactly as predicted, and reconfirms the Section 5.3 finding that this metric family un- derstates. The layering hypothesis, which was the reason to build it this way, is not supported. We expected that identifying a table would be substantially easier once its columns had been identified. Paired across the 67 tables the judged difference is +0.045, with 60 tables tied, 4 better under layering and 3 worse: a wash, not an effect. Structural evidence alone (declared types, distinct counts, the foreign-key neighbourhood and a handful of sample values) already carries nearly all of the identifying signal, and the reconstructed column prose adds little on top of it. We report this because we predicted the opposite. It is also consistent with the theme of Section 5.2.1: the deterministic layer establishes what is knowable, and the language model’s prose is not where the leverage lives. One caveat on the abstentions, which we record rather than smooth over. The judge scored the 23 abstaining rows at a mean of 0.43 rather than 0.0, meaning a minority of tables the system declined to name were ones a judge could still partly identify from the reference: the abstention is conservative rather than perfectly calibrated at this level. (Harness:scripts/recon_table_seman- tics.pyandscripts/recon_table_judge.py, capability locked bytests/unit/test_table_describer.py; data:papers/data/ table_semantics.json.) 5.2.6 The fifth artifact class: PII that follows the values. The glossary’s design commitment is that a column’s PII class derives from what the profiler proved about its values, not from a guess at its name. This is worth testing rather than asserting, because name-based PII detection fails in both directions and both failures are expensive: a column calledcustomer_reffull of live card numbers is a compli- ance incident, while a column calledcredit_card_noteholding free text is a false alarm that teaches people to ignore the flag. We test it with the same matched contrast used for checksum promotion, constructing columns where the name and the values de- liberately disagree. Deceptive-name columns are calledcredit_- card_number,email_address,ssnandcustomer_ibanbut con- tain ordinary integers or free text. Innocent-name columns are calledc7,field_3andt2_c11and contain genuine Luhn-valid pay- ment cards, real-format email addresses and mod-97-valid IBANs. Classification runs the shipped path: the profiler assigns aseman- tic_typefrom the values, and the glossary maps that to a PII class. 7 of 7. Four deceptive names correctly not flagged, three inno- cent names correctly flagged. A name-based classifier scores zero on both halves of that table. Measuring this class also found a defect with a real safety conse- quence, and it is the third instance in this section of the same failure 13 Helwig armtables token recall identified related or better abstained flat (structure only)670.5900.7460.8360.164 layered (+ reconstructed column facts)670.6570.7610.8660.179 casecolumn name shownsemantic type from values PII class deceptive credit_card_number (no match)none deceptive email_addresscategorical:enumnone deceptive ssn(no match)none deceptive customer_ibancategorical:enumnone innocent c7identifier:payment_card credit_card innocent field_3emailemail innocent t2_c11identifier:ibancredit_card mode. The deep profiler labels a Luhn-validated columnidenti- fier:payment_card; the glossary keyed its PII map oncredit_- card ; nothing translated between them. A column the system had proved by check-digit arithmetic to contain payment cards was recorded as carrying no PII, because two modules that were each individually correct disagreed on a string. The same held foridentifier:iban. Before the fix the innocent-name row scored 1 of 3; after it, 3 of 3. Like the camelCase blind spot in the join heuristics and the snake_case assumption in the rollup miner, this was invisible to every component-level test and only an end-to-end measurement exposed it. Measuring the class also exposed dead configuration and let us close it. Of the four PII classes the glossary declares,ssnwas un- reachable (no pattern in the library emitted it), so the class existed in the map and could never be assigned. We added a matcher. An SSN carries no check digit, so it can never be checksum-backed; what it has is the SSA’s published never-allocated ranges (area 000, 666 and 900–999; group 00; serial 0000), which roughly one in eight random nine-digit strings violates. The matcher therefore sits atPATTERN_- CONFIRMED , never atPATTERN_VALIDATED, and is deliberately con- servative: nine-digit strings are everywhere in a warehouse, and it is ordered after the autoincrement matcher so that a monotonic sequence key is claimed as a surrogate key rather than flagged as a Social Security Number. All four declared PII classes are now reach- able from value evidence, and a regression test asserts that equality so a future declared-but-unproducible class fails the build. (Har- ness:scripts/glossary_pii_study.py, locked bytests/unit/ test_glossary_pii_from_values.py ; data:papers/data/glossary_- pii.json.) 5.2.7 Metric expressions, and where this component does not transfer. The last of the five components mines metric expressions, ag- gregation templates carrying arequired_filterand a nullability rule, from column descriptions. The safety property is the filter: an aggregate that silently drops a stated condition returns a confident wrong number, which is the same class of harm as a bogus rollup. We measured it and the result is negative, so we report it as such. Run over all 682 BIRD column descriptions, real prose written by the benchmark’s authors, the deterministic miner fires on 3. All three are thecalifornia_schoolsadministrator columns, whose documentation reads "Only active and pending districts and schools will display administrator information." That is a genuine filter- bearing statement, and the detector is right to notice it. What it emits is not usable:status IN (’active’), which both truncates a two-value condition to one (dropping pending) and references a status column that does not exist in the schema. Precision of the emitted clause is 0 of 3. Estimating recall needs care. Scanning the same descriptions for condition words (only, excluding, unless, must be, except) flags 21 of 682, and the miner’s 3 hits lie inside that set, but inspecting the other 18 shows most are not aggregation filters at all. "If the card is only available in online game variations" is a definition of a boolean column, not a condition on a sum. The honest reading is that BIRD’s column documentation is a corpus of column definitions, not of metric semantics, and the phrase genre the miner was built for ("revenue counts only completed transactions") is largely absent from it. That gives two distinct conclusions and we separate them. First, on the evidence available, this component does not transfer to real benchmark prose: it is nearly silent, and when it does speak the clause it produces would not execute. Second, the test is a weak one, because the corpus does not contain much of what the miner exists to find. What it would take to settle the question is a corpus of genuine warehouse metric documentation, which the public benchmarks do not supply and which we do not have. We therefore record metric expressions as the least validated of the five artifact classes, with a measured precision failure on the only real prose we could point it at, and we do not claim the component works. It is the clearest remaining piece of unfinished evaluation in this paper. The abstentions target the hard columns; the claim is stated with the base rate that number needs. (An earlier draft quoted 370/38/89.7% from the superseded ten-database corpus, with- out threshold or base rate; the figures below are recomputed on the final corpus byscripts/recon_abstention_audit.py.) Of the 393 columns Rosetta declined, arm A describes 44 adequately (ade- quate = max per-facet content-token recall≥0.34): 88.8% correct-to- abstain. That rate needs its base: arm A is adequate on only 26.9% of all 680 columns, so a random abstainer would score 73.1% on this metric. The informative comparison is conditional: arm A achieves adequacy on 11.2% of the columns Rosetta declined against 48.4% of the columns it spoke on. The system is not merely quieter; it is quiet in the right places, and the margin over chance is seventeen points, not ninety. 14 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses A control that isolates what the baseline was actually using. Run with identifiers visible, the LLM-direct arm scores 0.752 / 0.597 / 0.296 across the three facets; with identifiers destroyed it falls to 0.074 / 0.149 / 0.243. Its apparent competence rests almost entirely on readable column names rather than on the data, and the one facet that barely moves is value-domain recovery, which is the only one grounded in values rather than nomenclature. Undocumented warehouses are precisely the regime where that support is absent. The coded-warehouse case, quantified. BIRD’s schemas are conventional; the sharper test is a warehouse whose values are opaque codes. We reconstruct the blind i2b2 clinical warehouse described in Section 5.4 (75 columns, decoder withheld) and score the fact table’sconcept_cdagainst the i2b2 ontology it does not contain: 400 most-frequent codes, all externally decoded. The result separates two things the phrase "recover what the values mean" conflates. The system identifies the code systems: from values alone it reports that the column carries vocabulary-prefixed codes, namingICD9:for diagnoses andNDC:for medications. Those two are 2 of the 11 vocabularies present (recall 0.18 unweighted) but account for 375 of the 400 codes, 94% by volume; the missed nine are small demographic and PHI vocabularies. The column description it writes does not recover code-level meanings: that ICD9:493.90denotes asthma is essentially absent from the prose (recall 0.008). We flagged that as a measurement of a task the system was not set, since the description writer is asked for two to four sentences of column semantics and never for an enumerated decode table. We have since set the task properly, and the caveat was justified: Section 5.4.1 reports that when asked for a decode table the same machinery decodes 95.5% of 134 real ICD-9 codes, and abstains on the NDC drug codes rather than inventing them (44 of 44 prefixed, 43 of 44 stripped). Where the advantage actually comes from, and where it does not. Across 680 BIRD columns and the 75-column i2b2 clinical warehouse of Section 5.4, no description fact ever committed above the lowest grounding tier and no checksum-backed match occurred. We chased this to its root, and the explanation is architectural rather than statistical: the description-writing path, as shipped, cannot emit a higher tier, because it stampsINTER- PRETER_ONLYand caps confidence at that tier’s ceiling uncondi- tionally, without consulting the attesters (under the tier gate of Section 5.2.8 it records the evidence-derived tier instead). Strati- fying description accuracy by grounding tier is therefore not an informative measurement in the default configuration, a fact we es- tablish rather than assume, having re-grounded all 75 i2b2 columns against a corrected profiler and observed an unchanged, uniform tier-0 distribution. The deterministic layer nevertheless earns the gap between arms A and C, just not through the authority ladder. The profiler’sse- mantic_type and pattern-match payload are supplied to the de- scription writer as evidence in context; the tier ladder governs a different fact flow. So the measured advantage (0.201→0.457 on field names) is attributable to deterministic structural evidence conditioning the language model, not to confidence capping. That is a narrower and more accurate account of the mechanism than we previously gave, and it is what the measurements support. Investigating the i2b2 case also exposed three concrete profiler defects, all now fixed: an epoch matcher that read dense surrogate- key blocks as timestamps; a segmentation stage requiring a delim- iter at a fixed character offset, which made variable-length-prefix codes (ICD9:493.90,NDC:00005306343) unsegmentable; and a composite- code matcher that structurally could not represent a controlled- vocabulary prefix joined to a high-cardinality payload. The cor- rected profiler recognises the coded columns it previously could not see. A fourth defect surfaced while building the evidence analysis of Section 5.2.1, and it is the most embarrassing of the four be- cause of what we had been calling this component. The delimiter scan iterated afrozensetof punctuation characters, and CPython randomises string hashing per process, so the resulting profile’s insertion order varied between runs, and every consumer that re- solved a tie by "first" inherited it. A layer the paper repeatedly calls deterministic was returning a different answer on about 11% of columns depending on the process it ran in, flipping the winning pattern on 1–2%. We found it because a re-run of the evidence analysis moved a result by one column. The scan is now sorted, segmentation ties break on the character itself, and a regression test runs the builder in subprocesses under four dif- ferentPYTHONHASHSEEDvalues and fails if the fingerprint differs. Re-running arm B on the corrected profiler changed 6 of 685 rows (0.9%) and moved no reported figure at three decimal places; the arm-C predictions were generated before the fix and therefore carry a little more run-to-run noise than a re-run would, which we note rather than hide. Whether evidence should also condition the prose itself, beyond gating which prose commits, remains unmeasured. The commit-gating half is no longer open: Section 5.2.8 keys the de- scription path on the published evidence instrument and measures the delivered-accuracy consequence directly (recall-when-claimed improves on two backbones, flat on the other two corpora). What is still unmeasured is whether feeding the attesters’ evidence into the writer would make the committed prose better, rather than only better-selected. 5.2.8 A second backbone: what transfers, and what turns out to be the model. Every number above comes from one model family. That leaves the paper’s central claim underdetermined in a way no amount of additional BIRD databases would fix: nothing so far dis- tinguishes the architecture produces this result from Gemini produces this result. We ran the whole comparison again on a second back- bone to find out, and the answer is genuinely split. (Denominator note: the swapped arms export slightly different column sets, so the transfer comparisons pair on the 684 columns the Sonnet arms share, where the primary corpus pairs 680: different intersections, not drift.) Which of the five artifact classes this can even affect. Be- fore running anything we established where a change of model can reach, because a transfer study over column descriptions alone would say nothing about four fifths of the contribution. Auditing the components that produce each class: the join graph (rosetta/joins/), the categorical rollups (rosetta/hierarchies/), the glossary and PII classification (rosetta/glossary/bootstrap.py) and the met- ric miner (rosetta/metrics/description_miner.py) contain no 15 Helwig model call at all: they are name-stem matching, containment tests, pattern verdicts and rule-based mining. Those four classes are there- fore backbone-invariant by construction, and the join precision of 1.000, the 7/7 PII classification and the 22/22 hierarchy guard reported above hold for any backbone without needing to be re-run. One qualification on the fourth: the metric miner is invariant as measured here because we pointed it at BIRD’s own annotator prose rather than at reconstructed text; deployed against descriptions this system wrote, it would inherit whatever variability those carry. Exactly three outputs are model-produced and so can transfer or fail to: column descriptions, table descriptions (Section 5.2.5) and value decoding (Section 5.4). We measure all three; this subsection reports the first, and Section 5.2.9 the other two. Design. Arms A and C were re-run end to end on AWS Bedrock with Claude Sonnet 4.6, chosen deliberately as a model in the in- cumbent’s class, because a weaker model degrading would tell us almost nothing while a comparable model diverging tells us a great deal. All four LLM-backed components (generator, critic, interpreter, attester) were switched together; leaving any on the original backbone would have produced a "transfer result" that was mostly not transferred. Arm B needs no counterpart: it uses no language model at all, so it is invariant across backbones by construction, and the same arm B anchors both columns of the table below. Both arms moved together for the same reason: comparing arm C on one model against arm A on another changes the archi- tecture and the model at once, and any difference could be either. The scoring harness, the prompts and the deterministic profiler are byte-identical between the two runs; the only thing that changed is the model. What transfers is the part with no model in it. Both language- model arms beat the statistical baseline decisively on both back- bones, on every facet, with every interval excluding zero: the value of a language model over pure pattern classification is not a prop- erty of one vendor. So is the paper’s central honesty finding: on the columns where both arms speak, the harness writes no better prose than the plain model, and on two of three facets measurably worse. The agreement is close to exact across backbones (−0.033 / −0.088 /−0.043 against−0.021 /−0.084 /−0.024), which is stronger evidence for that claim than either run alone. The null interaction (deterministic evidence does not improve description quality) also holds on both. What does not transfer is the selection behaviour, and that is the claim Section 5.2.1 rests on. Arm C’s coverage nearly dou- bles, from 0.422 to 0.823. The evidence-tracking gap that we called "precisely the knows-what-it-does-not-know property" goes from +0.257 with an interval excluding zero on Gemini to−0.089 with an interval spanning zero on Sonnet: no longer detectable, though not demonstrably inverted. And the paired comparison this paper insists on everywhere else belongs here too: on the same backbone, the naked arm’s coverage is 0.984, so the harness still withholds sixteen points more than the model alone, where on Gemini the margin is fifty-two points (0.941 against 0.422). The selection be- haviour is degraded, not erased, but what remains is no longer evidence-correlated, and with it goes the C−A advantage: arm C no longer beats arm A on any facet and is worse on description (−0.064, CI [−0.141,−0.018] excluding zero). This is not a scoring artifact, and we checked before be- lieving it. Abstention is detected by matching referral language, and that vocabulary was derived from Gemini’s phrasings: a sec- ond model that declines in different words would be scored as claiming, manufacturing exactly this result. Three checks rule it out. The detector does fire on Sonnet, 123 times, on the same canonical phrases. Inspecting the zero-recall claims shows gen- uine assertions rather than disguised declines:tags.Iddescribed as a day-of-month,hero_attribute.hero_idas an hour of day, Player.heightas a body weight in kilograms. Hedged in word- ing ("suggesting", "may represent") but committal in content, and wrong. And widening the rule to count every hedged partial decline in either corpus leaves the gap intact: the coverage difference is +0.400 under the strict rule the paper uses throughout and +0.245 under the broad one. The interpretation is a design finding, not only an eval- uation one. The deterministic layer is identical across the two runs: arm B is unchanged, and the recomputed evidence splits the columns 344/340 against 342/338. What differs is what each model does when handed the same evidence: one declines, the other spec- ulates. Two things have to be separated to say why, and we ran them together in an earlier draft: •Who decides to abstain. The model, in every path in this system. Abstention is a property of the text it returns (referral prose for a column, an emptyentityfield for a table), never a verdict the code reaches from the evidence. •What happens once it has abstained. Here the paths differ. The table describer enforces it:describe_tablere- turnsNoneand commits nothing, so an undetermined table is left undescribed. The column path does not: the referral sentence is committed as the column’s description, which is why every abstention in the corpus is prose rather than a withheld fact (Section 5.1.1). The transfer failure is located in the first of these, not the sec- ond. A model that never declines is never gated, however faithfully the code would have honoured a decline, so the table path’s en- forcement, real as it is, would not have rescued this result either. The honest statement of the Section 5.2.1 finding is therefore nar- rower than we first wrote it: the deterministic layer detects competence only when the model volunteers that it lacks it. The remedy follows from the distinction and is specific rather than vague: move the decision into code, refusing to commit a prose claim whose grounding tier isINTERPRETER_ONLY, instead of asking for that judgement in a prompt. An earlier draft flagged this as the pa- per’s most actionable finding and deliberately left it unimplemented, because building it after seeing which backbone it rescues would have been fitting the architecture to the evaluation. We have since implemented it under a protocol that removes that objection: six predictions registered before implementation, then measurement on the swap backbone, on a third backbone the gate had never seen (Claude Haiku 4.5), and on held-out databases no study had touched. The remainder of this section reports the result. The scorecard, so the registration can be audited rather than taken on trust (verbatim predictions with the commit hashes that record them, together with the program’s earlier registrations including its failures, are in papers/REGISTRATIONS.md): 16 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses Gemini 3.1 ProSonnet 4.6transfers? arm C coverage0.4220.823no A− B (name / desc / value) +0.212 / +0.183 / +0.175+0.203 / +0.198 / +0.194 yes, all excluding zero C− B+0.464 / +0.270 / +0.261+0.221 / +0.134 / +0.196 yes, all excluding zero C− A+0.252 / +0.087 / +0.087+0.017 /−0.064 / +0.002 no both-claim C− A−0.033 /−0.088 /−0.043 −0.021 /−0.084 /−0.024 yes coverage tracks evidence +0.257 [+0.128, +0.378] −0.089 [−0.215, +0.025] no evidence improves prose+0.090 (p = 0.071), null −0.009 (p = 0.563), null yes, null on both # registered prediction (compressed)outcome 1 Sonnet gate-ON coverage drops toward the evidence-licensed fraction; evidence-tracking gap returns positive confirmed (0.823→ 0.392; the gap half holds by construction, stated pre-run) 2 Haiku gate-ON tracks evidence identically; gate-OFF coverage stays backbone-dependent confirmed (OFF 0.422/0.759/0.823; ON no-evidence 0.000 everywhere) 3 Gate ON restores NDC abstention on swap backbones confirmed (0/25/43-of-44 prefixed→ 0/44, both conditions) 4 Recall-when-claimed does not degradeconfirmed (flat on Gemini and held-out; improves on Haiku and Sonnet) 5 Held-out per-100 falsehood advantage reproduces in direction confirmed (+3.69 [+1.58, +6.52]) 6 Registered risk: correct claims withdrawn; cost accepted and reported confirmed, cost quantified (99–295 withdrawn; adequacy split below) From the same discipline and reported at the same strength: the checksum-prevalence prediction of Section 5.2.3 was falsified (low-single-digit percent predicted, 0.008% measured), and two earlier registered predictions also missed (the layering hypothesis of Section 5.2.5; the FK-verifier prediction of Section 5.2.10, which failed favourably). The sensitivity check of Section 5.2 and the transit-damage diagnostic of Section 5.2.3 were checks run without registrations, and the registry labels them as such: its credibility is precisely that it contains the misses and marks the post-hoc work. The gate, as built. A prose claim (column description, table description, value decode) proposed atINTERPRETER_ONLYis re- fused by code at theFactCommitterchoke point every write path traverses: the fact still commits, with full provenance, but its value is a canonical refusal record the coverage analysis scores as an ab- stention. The table path refuses before the model is called; a decode claim is licensed by a vocabulary registry (published, compositional taxonomies such as ICD-9 are licensed; registry-assigned keys such as NDC are not) plus a shape rule that refuses flat all-digit payloads of eight or more digits. The decision consults the flag, the attribute, the tier and the actor (never the model’s text) and ships default-off, so every other number in this paper reproduces unchanged. One implementation lesson was itself a measurement: keying the tier on the deep profiler’s full-column report makes the gate near-vacuous (it reaches a verdict on 31 of 31superherocolumns where the published evidence instrument reaches one on 10), which is the Section 5.8.1 wrong-lever category error relocated, so the tier keys on the published instrument, and a live end-to-end run reproduces the transform’s output column-for-column. Why most gate-ON numbers are exact replays, and which are not. The gate never touches a prompt: no prompt in this pipeline consumes committed description prose, and the gate only transforms what is committed afterwards. A gate-ON run therefore makes byte-identical model calls, and its corpus is a determinis- tic transform of the gate-OFF corpus: prose where the instrument reached a structural verdict, the refusal record where it did not. We computed the gate-ON corpora as replays of the three frozen gate-OFF corpora, and verified the equivalence live: one database re-run end to end with the gate on (superhero, Sonnet) matches the transform exactly, ten prose commits atPATTERN_CONFIRMED and twenty-one refusal records atINTERPRETER_ONLY, the same columns in each set. The Haiku corpus and the held-out corpora are new live runs; their gate-ON versions are replays of them. What the gate enforces and what it costs, stated separately. With the gate on, coverage on no-evidence columns is 0.000 on every backbone by construction. We registered before running that this half of the prediction would hold mechanically once the decision was in code, so we report it as an enforced property, not a finding. What the runs measure is the price and the transfer. The price: the evidence instrument licenses 50.3% of dev columns, and the gate withdraws 99–295 claims per backbone (including cor- rect ones, the registered risk), yet recall-when-claimed never degrades: flat on Gemini and on held-out data, improving on both speculating backbones, because what the gate removes is dispro- portionately the low-quality speculation. The skeptic’s number, stated directly rather than implied: the withdrawn set scores worse than the retained set on the speculating backbones, withdrawn re- call 0.168 vs retained 0.257 on Sonnet (retained-minus-withdrawn +0.089 [+0.032, +0.148]) and 0.111 vs 0.248 on Haiku (+0.137 [+0.053, +0.210]), while on the abstaining backbone and the held-out cor- pus the two sets are statistically indistinguishable (Gemini 0.348 vs 0.333,−0.015 [−0.097, +0.037]; held-out 0.334 vs 0.325,−0.009 [−0.093, +0.196]): where the model speculates, the gate cuts junk; where the model already declined the junk itself, the gate’s cost is real coverage of equally-good claims. The class asymmetry is itself 17 Helwig backbone (arm C, severity 1.0)coverage OFFcoverage ONrecall-when-claimed OFF→ ON (diff, 95% CI)claims withdrawn Gemini 3.1 Pro (11 dev DBs)0.4220.276 [0.211, 0.350] 0.338→ 0.333 (−0.005 [−0.031, +0.013])99 Haiku 4.5 (11 dev DBs)0.759 [0.704, 0.821] 0.336 [0.279, 0.395] 0.173→ 0.248 (+0.075 [+0.030, +0.121])289 Sonnet 4.6 (11 dev DBs)0.8230.392 [0.328, 0.463] 0.210→ 0.257 (+0.047 [+0.017, +0.081])295 Gemini, held-out (4 train DBs) 0.461 [0.359, 0.568] 0.258 [0.175, 0.303] 0.328→ 0.325 (−0.003 [−0.042, +0.066])52 informative about where evidence discriminates: on the decode path the gate cuts with perfect selectivity (44/44 unlicensed refused, zero licensed decodes withheld), while on the column path it pays in correct claims: a vocabulary registry is a sharper license than a structural-evidence verdict. The transfer: gate-OFF coverage is a property of the model’s disposition (0.422 / 0.759 / 0.823 across three backbones, a 0.401 spread), while gate-ON coverage compresses that spread to 0.116, not to zero, and honestly so: the gate is a floor on abstention, never a ceiling, so the fraction of evidence-licensed columns each model still commits prose on differs (0.550 / 0.669 / 0.779 for Gemini / Haiku / Sonnet; equivalently, residual decline rates of 0.450 / 0.331 / 0.221). The decode gate is the cleanest statement of the whole law. Gate off, the 44 prefixed NDC codes draw 0 attempts from Gemini, 25 from Haiku, and 43 from Sonnet (stripped: 1, 0 and 30): prompt- requested abstention spanning nearly its full possible range across three backbones, and shifting within a backbone on nothing more than a vocabulary prefix. Gate on, all three attempt 0 of 44 in both conditions, and the license withholds zero ICD-9 or demographic decodes on any backbone in either condition. The behaviour the paper praised on Gemini ("deciding, per value, which code systems it is in a position to decode") is now a property of the code, and Section 5.4.1’s account of it is scoped accordingly. Held-out databases, never touched by any study. Four BIRD train databases selected by a rule registered before inspection (al- phabetical walk,≥10 documented columns,≤100 MB, loads cleanly; one selected database proved unusable through a benchmark docu- mentation/schema naming defect and was replaced by continuing the same walk; every step recorded inpapers/data/heldout_- selection.json). On 256 paired columns the dev-corpus shape reproduces out of corpus: coverage 0.930 (A) against 0.461 (C), recall- when-claimed higher for C on every facet with value-domain the lone interval excluding zero (+0.141 [+0.003, +0.161]), and arm A’s description recall lands on 0.244, the dev value exactly. The reg- istered falsehood prediction scores as stated: judged by the same rubric as Section 5.3 over the 217 columns with scorable reference facets and no pipeline error, arm A emits 9.68 falsehoods per 100 columns examined against arm C’s 5.99 (difference +3.69 [+1.58, +6.52], interval excluding zero; the dev corpus gave +3.48 [+0.90, +5.87]), while the conditional rates remain indistinguishable (−0.037 [−0.131, +0.039]): the advantage is selection, on data the system had never seen. Cost of the transfer arm: 1,222 model calls, $8.67. (Harness: scripts/recon_arm_a,c_bedrock.sh; provider:BedrockClient inrosetta/llm/client.py; data:papers/data/recon_A,C_- bedrock.jsonl.) The query-time gate, the one code-thresholded path this study left open, has since been re-run under the same swap on a four-database slice with registered predictions; its struc- ture survives and its Gemini-fit calibration shifts, reported with the mechanism split in Section 6. 5.2.9 The other two model-bearing classes: the capability transfers, the abstention does not. Column descriptions are one of the three outputs a change of model can reach. We measured the other two on the same backbone, and the pattern that emerges across all three is sharper than any of them alone. Table descriptions (the task of Section 5.2.5), re-run with the table describer and its upstream column descriptions both on Sonnet 4.6, scored by the same blinded judge, paired on the 67 tables both runs cover: Two things happen at once. Exact identification falls while "re- lated or better" rises, the direct consequence of never declining: an arm that always answers is more often in the right neighbourhood and less often precisely right. And the compounding claim of Sec- tion 5.2.5 does not merely fail to replicate, it reverses: on Gemini, giving the table describer its own reconstructed column descrip- tions helped slightly (+0.045, layered better on 4 tables and worse on 3); on Sonnet it hurt substantially (−0.258, layered better on 4 and worse on 17). The mechanism is visible and unsurprising once stated: layering propagates whatever the upstream layer produced, so it compounds accuracy on a backbone that abstains when unsure and compounds error on one that guesses. Value decoding (Section 5.4), the i2b2 clinical warehouse with its ontology withheld, and the most consequential of the three, because these are real medical codes: The diagnostic capability transfers: ICD-9 decoding from stripped values holds at 0.940 against 0.955, and the demographic vocabu- laries stay at 1.000. What does not transfer is knowing which code system it cannot decode. Section 5.4 presents the 44-of-44 NDC abstention as the system "deciding, per value, which code systems it is in a position to decode." On a second backbone it decides other- wise: it attempts nearly every drug code and is wrong on roughly nine in ten. The failures are worth setting side by side, because the two arms fail differently. AgainstNDC:00186502228, whose true meaning is a 20 mg enteric-coated esomeprazole capsule (Nexium, AstraZeneca), the naked arm returns a 4 mg candesartan tablet (Atacand). Right manufacturer, different drug, different therapeutic class: an antihypertensive for a reflux drug, the dangerous kind of wrong. The harness arm, whose prompt carries the profiler’s segmentation evidence, returns a 20 mg omeprazole delayed-release capsule (Prilosec, AstraZeneca). Right class, right dose, right form, right maker, the parent molecule of the right drug; a near-miss, but still a fabricated decode of a vocabulary the system holds no content authority for. Both arms render a vital-status code whose true value isLivingas "Deceased". A catalog built on either would be confidently wrong about medication in a clinical warehouse; the naked model’s wrongness is categorically worse, which is the argument for the harness, provided its refusal is enforced in code rather than requested in prose. The unified finding. Across all three model-bearing classes the split falls in the same place: what the system can do transfers; 18 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses Gemini 3.1 Pro Sonnet 4.6 identified exactly (judge = 2), flat0.7460.636 related or better (judge ≥ 1), flat0.8360.909 abstained, flat0.1640.000 abstained, layered0.1790.030 layered− flat (does reconstruction compound?)+0.045−0.258 Gemini 3.1 ProSonnet 4.6 coverage (prefixed, arms A / C) 0.780 / 0.7800.930 / 0.995 recall when claimed0.9160.797 ICD-9 decoded, n = 1340.9550.940 NDC decoded, n = 440.000 (declined all 44) 0.068–0.114 (attempted nearly all) what it declines to do does not. ICD-9 decoding, the language model’s advantage over pattern classification, and the both-claim prose comparison all reproduce. Column abstention (0.422→0.823 coverage), table abstention (0.164→0.000) and value abstention (44 of 44→nearly none) all collapse, in the same direction, on a model of comparable strength. That consistency is what makes this a finding about the architecture rather than three coincidences: as shipped, every one of these gates is a request to the model rather than a rule in the code, so all three fail together the moment the model’s disposition changes. It also sharpens what the contribution is. The deterministic evidence layer is doing real work (four artifact classes depend on it alone and are invariant, and it is what makes the coverage-versus-evidence relationship measurable at all), but in the default configuration the guarantee the paper advertises is only as durable as the backbone’s willingness to say "I do not know." Making these three gates deterministic is the single change that converts the strongest claim in this paper from a property of one model into a property of the system, and Section 5.2.8 reports exactly that change implemented, registered and measured, with Section 6 recording what it costs. (Harness:scripts/recon_table_semantics.py,scripts/recon_- table_judge.py,scripts/i2b2_decode_study.py, all under the Bedrock provider; data:papers/data/table_semantics_bedrock, i2b2_decode_bedrock.json.) 5.2.10 The same inputs with no harness, and what verification adds. Three of this paper’s capability claims had, until this section, only Rosetta’s number attached: the join graph, PII discovery under deceptive names, and the refusal of corrupted identifiers. Each rests on a deterministic mechanism, so "a model could not do this" was an argument from how the mechanism works. Here it is measured. The baseline is deliberately generous: the naked model is the same backbone the system runs on (Gemini 3.1 Pro, so the only difference is the harness), it sees exactly what the matching component sees (byte-identical columns from the same generators and seeds, the same schema listings) and it is scored by the same rule against the same ground truth. PII when the name lies. Four columns whose names scream PII over innocent values, three whose names say nothing over real card, IBAN and email data. The naked model scores 5/7: it correctly finds all three real PII columns from their values, and it is fooled twice by names: a column of plain integers namedcredit_card_number is declaredcredit_card, and another namedssnis declaredssn. Rosetta scores 7/7, because a Luhn check on plain integers fails and no name changes that. The model’s failure is exactly the one the mechanism exists to prevent: when the values do not loudly contradict the name, the name wins. Certifying identifiers at the contamination boundary. At the easy split (columns 100% valid against columns 100% corrupted), both arms separate all six code systems and we report the tie as a tie. But the deployed question is the boundary: the promotion gate’s measured binding point sits between 5% and 6% contamination (Section 5.2.3). So the honest grid is 5%, 6%, 20% contamination across six code systems, with the certification rule stated to the model verbatim ("certify only if at least 95% of values validate") and, in the strongest variant, all 200 values shown. The verifier decides correctly in 17 of 18 cells: the single miss is the IBAN matcher applying its own registered 0.90 threshold rather than the stated 0.95, a policy choice, not an arithmetic failure, and the match records the exact 94% pass fraction either way. The naked model decides correctly in 12 of 18 with a twelve-value sample and 12 of 18 with all 200 values shown, failing in both directions: it refuses clean-enough columns after one corrupted value surfaces in its sample, and it certifies 6%-contaminated columns it cannot count. Both failures were predicted and registered before the run. The model knows these algorithms; it cannot execute two hundred of them. The join graph, and the component this exposes. The shipped join component is a name-stem heuristic: no model, no verifica- tion, the one artifact class that does not implement this paper’s own thesis. The head-to-head shows precisely that, so we built the missing half, an inclusion-dependency verifier over the actual data (pre-registered thresholds: containment≥0.95 into a≥0.95-unique parent; the dependency class the profiling literature discovers at scale [19,20], here used as a verifier), and ran three proposers through it at both conditions: Three findings, one of them against our own registered pre- diction. First, with names visible the naked model dominates the stem heuristic on recall (1.000 against 0.476): it recoversforeign_- data.uuid → cardsbecause understanding what a name means is not stem-matching. One caveat is owed and unresolvable here: these are public benchmark schemas a frontier model has plausibly seen in training, so the names-visible row is an upper bound on inference. Second, we predicted the verifier would kill the model’s false edges, 19 Helwig conditionproposerprecision recallfalse edges vs declared gold names visiblestems (shipped)1.0000.4760 names visiblenaked model0.9631.0004 names visibledata scan, verified0.1350.990655 identifiers destroyed stems / naked model — / 0.0000.000 / 0.000 — identifiers destroyed data scan, verified0.1350.990655 and the prediction failed in the best way available: there was noth- ing to kill. All four edges the pipeline keeps that the declared gold rejects are real, undeclared foreign keys at 97–100% containment: cards.setCode → sets.code,posts.acceptedAnswerId → posts.id,tags.wikiPostId → posts.id,sets.parentCode → sets.code . Scored against declared keys, the verified pipeline’s precision is 0.963; scored against joinability, we can find no false edge in its output at all: it recovered four keys the schema authors forgot to declare, which is the exact enterprise defect the introduc- tion describes. Third, at full opacity names are worthless to every method (stems propose nothing, the naked model recovers noth- ing), but the name-free data scan holds recall 0.990 at precision 0.135, unchanged at every severity by construction, because it never reads a name. The join structure survives in the values even when the schema is gibberish; what is missing without names is not recall but ranking among the 757 data-supported candidates, and that is the correctly-stated open problem. It is also a studied one (machine-learned classifiers separate true foreign keys from spuri- ous inclusion dependencies [24], and randomness-based ranking extends to multi-column keys without reading names [30]), and we defer integrating a ranker deliberately: several of the established features are name-derived and so do not exist at full opacity, and a ranked variant deserves its own registered evaluation rather than a retrofit here. What survives every head-to-head is the discipline, not the intelligence. Name-independence (7/7 against 5/7), exhaus- tive arithmetic at the certification boundary (17 of 18 against 12 of 18 even with all values shown), and, on the backbone the sys- tem ships with, refusal to assert what the evidence cannot support (Sections 5.2.9 and 5.4). Where the naked model wins, it wins at reading: meaningful names, familiar vocabularies. The architec- ture’s correct response to that is not to compete with it but to consume it (the model as a high-recall proposer behind a data- grounded verifier), and the join table above is that composition mea- sured. (Harness:scripts/naked_llm_baselines.py,scripts/ recon_fk_verified.py; data:papers/data/naked_llm_base- lines,fk_verified.json.) 5.3 Is the metric measuring meaning? A validation of content-token recall Section 5.2 rests on content-token recall, which is a lexical proxy for meaning recovery. It is cheap, deterministic and inspectable, but it can be wrong in two directions: it can give false credit, when a candidate reuses the reference’s vocabulary without recovering its meaning, and false blame, when a candidate recovers the meaning in different words. The first would inflate our result; the second would deflate it, and unevenly, since it penalises whichever arm token recall judged 0 judged 1 judged 2 n 0.00139119159 (0, .33]1316231 (.33, .67]19616 (.67, 1]221317 paraphrases most. A result carried by a proxy nobody has audited is not a result, so we audited it. Design. We sampled 60 columns stratified across all eleven databases and judged all three arms on each (180 judgements) with a model asked, for every reference facet, how much of the refer- ence’s meaning the candidate recovers: 2 fully, 1 partially, 0 not at all. The judge sees the reference text and one candidate, with the arm label, the database and the real column name all withheld, and the presentation order shuffled so no two arms for the same column appear together. The rubric is deliberately recall-oriented, matching what the token metric measures: extra material is not penalised, and wording, style, fluency and length are explicitly de- clared irrelevant, so arm B’s telegraphic output is not marked down for reading like machine output. Contradictions are recorded as a separate flag rather than folded into the score, because "did it recover the meaning" and "did it also assert something false" are different questions. Token recall tracks judged meaning, and understates it. Rank correlation across the 223 judgements on claimed rows is휌 = 0.642 (by facet: name expansion 0.735, description 0.613, value domain 0.663). Mean token recall rises monotonically with the judged score (0.031 / 0.284 / 0.554 for judged 0 / 1 / 2), but note the ceiling: judgements rated fully recovered average only 0.554 token recall. A candidate can convey everything the reference says and still surface barely half its vocabulary. The recalls in Sec- tion 5.2 are therefore lower bounds on meaning recovery, not overstatements. False credit runs at 3 of 31 high-recall judgements (9.7%) and false blame at 9 of 159 zero-recall judgements (5.7%). The clearest false-credit case is instructive: against the reference "the date of the match", arm B scored a perfect 1.00 because its pattern- library text reads "100% match ISO-8601 timestamp": an accidental lexical collision, and one that flatters the weakest arm. False blame falls mostly on the two paraphrasing arms (A 4, C 4) and touches arm B once, which is the expected shape: an arm that emits fixed pattern vocabulary has little room to be punished for rewording. Under the judge, the delivered-output ordering holds on the facet that carries the sample, and only there. Recomputing with the judge as the outcome over each arm’s delivered claims is a consistency check on the metric, not an arm comparison: the arms deliver on different column sets, exactly the conditioning Section 5.2.1 rejects. As that check: on description, the judge reproduces B 20 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses armname expansion description value domain B: statistical0.0560.0870.037 A: LLM-direct 0.0330.3940.283 C: Rosetta0.2000.5420.250 < A < C (0.087 / 0.394 / 0.542) and widens the separation; on name expansion it puts the naked arm below even the statistical baseline (0.033 vs 0.056, with the harness at 0.200); on value domain the two language-model arms are a wash (0.250 vs 0.283, C−A−0.033 with interval spanning zero). The arm comparison itself belongs to the common-ground analysis of Section 5.2.1, which the judge leaves where it was: favoring neither language-model arm decisively. Judged meaning recovery, 0–1 scale, on the 60-column validation sample. Four of the nine paired differences exclude zero, all of them on description and value domain: A−B (+0.307 and +0.246) and C −B (+0.455 and +0.213). C−A does not separate on this sample (name expansion +0.167 [−0.062, +0.500], p = 0.696; description +0.148 [−0.023, +0.329], p = 0.088; value domain−0.033 [−0.245, +0.267], p = 0.878), which is consistent with Section 5.2.1 rather than in tension with it: the harness’s advantage there was selection, and this comparison holds the claimed set fixed. Name expansion is not informative here at all: only 38 of the 223 claimed judgements carry that facet, and the ordering even inverts between B and A (0.056 against 0.033) on that thin slice. We read the name-expansion row as noise and do not rest anything on it. The judge is not flattering its own family. Two of the three arms are produced by the same model family as the judge. A second rater from a different family re-scored 60 judgements from a blind worksheet with the arm, column, database and primary verdict all withheld: exact agreement 0.783, linear-weighted휅= 0.737, and no disagreement anywhere exceeded a single point. This reliability check was run on the earlier ten-database judging round and we did not repeat it on the eleven-database round, deliberately: the rater’s value depends on blindness, and having since worked with this corpus they can no longer be blind to it. A second rating collected now would be a weaker check presented as a stronger one. The judging rubric and protocol are unchanged between rounds, so what this establishes (that the protocol yields consistent scores across model families) carries over; what it cannot do is certify the specific judgements in the round reported above. The disagreement is entirely one-sided (the primary judge was stricter in all 13 discor- dant cases and more lenient in none), so a self-preference bias, had it existed, would have had to run against the observed direction. Comparing the two raters’ generosity toward the LLM arms versus the non-LLM arm gives a gap of−0.125: the primary judge is rel- atively less generous to its own family. We disclose two limits on this check. The second rater is an author and wrote the rubric, so this establishes consistency, not independence; and the rater had previously seen the primary verdict on 10 of the 60 items while debugging the harness. Those ids are recorded in the committed ratings file, and agreement on the 50 unseen items is higher (0.800, 휅 = 0.768), so prior exposure did not manufacture the agreement. Two further confounds, checked and dismissed. Verbosity: recall metrics can be gamed by writing more, but arm C is the shorter arm (17.4 content tokens per claimed prediction against arm A’s 19.6) while recovering more, and within each arm the cou- pling between prediction length and recall is negligible (Spearman −0.116 for A, +0.073 for C). C says less and recovers more. Degen- erate references: 16 of the 921 scorable facets have a reference that is literally the stringNOT USEFUL, BIRD’s marker for a field its annotators judged uninformative. No arm can recover meaning that the reference does not carry, and all three score exactly 0.000 on them. Excluding them raises every arm and widens the C−A value-domain gap from +0.087 to +0.098, so we retain them in the headline as the conservative choice. (Harness:scripts/recon_- confounds.py; data: papers/data/confounds.json.) One result runs against us, and we report it. Conditional on making a claim, arm C is flagged for contradicting the reference more often than the baselines: 18.5% of claimed columns versus 16.4% for arm A and 3.3% for arm B. The comparison is not powered (arm C claims only 27 of the sampled columns, and Fisher’s exact test against arm A gives p = 1.00), and manual inspection shows several flags are artifacts of the reference rather than errors of the system, including columns where BIRD’s own documentation describes a sibling column or is the degenerateNOT USEFULmarker. But the point estimate is what it is, and it has a real interpretation: when this system does speak, it speaks specifically, and specific claims are falsifiable in a way that arm B’s "categorical enumerated status code category" is not. The operational quantity points the other way. Per 100 columns examined, arm C emits 8.3 contradicting statements against arm A’s 15.0, because it declines 55% of them. Abstention does not make the system more accurate when it speaks; it makes the system emit fewer falsehoods overall. Because this was the one adversarial finding left unpowered, we re-judged the contradiction flag (same rubric, same blinded judge) on every shared column of the eleven-database corpus rather than a sample: 574 paired columns, 776 claims judged (arm A claims on 537 of them, arm C on 239;scripts/recon_contradiction_- power.py,papers/data/contradiction_power.json). The pow- ered result reproduces the sample’s structure and tightens both halves. Conditional on claiming, the arms are statistically indis- tinguishable: arm C is flagged on 9.6% of its 239 claims, arm A on 8.0% of 537 (an A−C difference of−1.6 p with a database-clustered 95% CI of [−7.2, +2.5] p, spanning zero), so the sample’s apparent conditional disadvantage does not survive power, and both rates come in at roughly half the sample’s estimates. Per 100 columns examined, arm C emits 4.01 contradicting statements against arm A’s 7.49, a difference of +3.48 whose CI [0.90, 5.87] excludes zero, because arm C declines 58% of the scored columns. The powered conclusion is the same sentence as before, now carrying intervals: abstention does not make the system more careful when it speaks; it makes it emit measurably fewer falsehoods overall. 5.4 A real coded warehouse: i2b2/Synthea Sections 5.2 and 5.3 run on BIRD’s relationally-named schemas, and the internal case study that follows runs on self-authored syn- thetic tenants. The sharpest remaining ask is a real, production- shaped, genuinely messy warehouse, so we add one: i2b2, a clini- cal data-warehouse layout deployed at 200+ hospitals, in its CRC star-schema form populated by the Synthea patient simulator. Its observation_facttable stores one row per clinical observation 21 Helwig whose meaning is a coded value inconcept_cd(ICD9:493.90, NDC:00005306343), uninterpretable without the ontology. This is a different opacity from Spider/BIRD: the column names are intact, but the values are codes and the code-to-meaning dictionary lives in a separate ontology. We make the test honest by construction. We build a blind ware- house holdingobservation_factplus the four core dimensions, with the decoder (concept_dimension’s name column and the i2b2 ontology table) genuinely removed from the queried database, not merely hidden from the catalog. Rosetta bootstraps and reconstructs this blind warehouse (75 columns, $0.23); gold answers are derived from the withheld decoder. Reconstruction is accurate on the coded columns. From the val- ues alone, Rosetta reconstructsconcept_cdas "the primary clinical concept code . . . a diagnosis, medication, or lab test . . . prefixed with their source vocabulary, such as ’ICD9:’ for diagnoses or ’NDC:’ for medications" (correct), and recovers the i2b2 EAV conventions of the sibling columns (valtype_cd’sN/T/D/Btype flags,modifier_cd’s TNM-staging and medication modifiers,units_cd’s measurement units). It assigns these a measured 0.50 confidence: appropriately uncertain, since the reading is inferred from values with no docu- mentary or human authority behind it. Delivered behaviour is calibrated abstention, with zero silent errors. We pose five natural clinical questions ("how many distinct patients have a cough / a fever / acute pharyngitis / a routine exam / allergic rhinitis"), each answerable only by recovering the specific ICD-9 code the blind schema does not contain. On all five the gate ab- stains: three confirm-first, two refuse, zero answered, zero silent errors. The mechanism is the authority machinery working as designed. For the cough question (gold: 87 patients), the generator, unable to ground "cough" toICD9:786.2, drafts the unfilteredSE- LECT COUNT(DISTINCT patient_num) FROM observation_fact; a structural trap (null_filter_implied_but_missing) and the critic both fire on the missing filter, and the gate routes confirm-first (score 0.575) rather than deliver the count. A naive always-answerer would return that ungrounded query’s result (133, every patient in the warehouse) as the answer to every one of the five questions, silently wrong against the golds (87, 81, 56, 46, 59) by factors of 1.5–2.9×. Rosetta avoids all five silent errors by refusing to guess. We state the limit as plainly as the result: Rosetta does not magically answer these questions: without the ontology it cannot recover the exact code for a named condition, so on this blind warehouse its value is refusal, not accurate answering, exactly as at full strip on Spider (Section 5.7). Promoting the ontology to evidence, the curated condition of our reconstruction arc, is the lever that would let it answer, the same lever we measured on public schemas. What this study adds is external confirmation where it matters most: on a genuinely coded clinical warehouse, a naive model confidently returns the wrong count and a grounded gate declines to. (Data:papers/data/gate9_i2b2_report.txt, gate9_reconstruction.txt,gate9_gold_questions.json; har- ness: scripts/gate9_score.py.) 5.4.1 Decoding the values, when actually asked to. Section 5.2 reports code-meaning recall of 0.008 on this warehouse and attributes it to task framing rather than to capability: the description writer is asked for prose about a column, never for an enumerated decode table. That is the kind of excuse a paper should be made to cash, so we cashed it. We take the 200 most frequentconcept_cdvalues that the i2b2 ontology can decode, ask for a code-to-meaning table from the values alone, and score each answer against the ontology label, which the blind warehouse does not contain and which we did not author. We report the fraction of all codes decoded substantially cor- rectly (content-token recall≥0.5, so abstaining cannot inflate it), alongside coverage, for the prefixed condition; the stripped condi- tion differs by a single NDC attempt, noted below. The caveat was justified: asked properly, the system decodes 95.5% of real ICD-9 codes (128 of 134, CI [0.905, 0.983]; the de- code set is 200 unique codes: 134 ICD-9, 44 NDC, 22 demographic codes across seven smallDEM|vocabularies, each shown under two conditions, the 400-presentation identification corpus), against the 0.008 the prose measurement suggested. But the far more interest- ing number is the zero. Shown the prefixed codes, it decodes no NDC codes and attempts none: it abstained on all 44 rather than inventing a drug name forNDC:00002314530, whose true meaning is "Axid Pulvules 300mg capsule". (Stripped, it attempted exactly one of the 44, a near-correct decode naming the right drug and dose at low token recall, so across both conditions it declined 87 of the 88 NDC presentations.) The split is not arbitrary: ICD-9 descrip- tors are a compositional, widely-republished taxonomy, while an NDC is an arbitrary eleven-digit registry key whose mapping to "Axid Pulvules" cannot be derived from the code at all. The system decodes the taxonomy and declines the registry, which is exactly the discrimination we would want a data steward to make, made here at the level of individual values on a real clinical warehouse. Two controls sharpen this, and bound the attribution. Strip- ping the vocabulary prefix changes almost nothing (showing 493.90instead ofICD9:493.90moves the overall decode rate from 0.745 to 0.740), so the system is recognising ICD-9 from the shape and content of the codes, not reading the answer off a prefix. And the harness adds nothing here: conditioning the request on the deterministic profiler’s verdict yields 0.745 against the plain model’s 0.745, and the null extends to the abstention itself; the plain model also declines all 44 NDC codes on this backbone. The decode-and-decline discrimination is backbone behavior on this class, not harness behavior, consistent with Section 5.2.9, where the same 44 abstentions become attempts under a backbone swap because, as shipped, this path’s abstention is prompt-requested; what the shipped harness adds is the audit trail and the tier cap, not the selection. (With the tier gate of Section 5.2.8 enabled, the NDC refusal becomes a code property: the license registry refuses registry-key vocabularies identically on every backbone, so the null here is a statement about the default configuration.) That null is consistent with Section 5.2.1 rather than surprising: the determin- istic layer detects competence, it does not amplify it, and on this task the model’s competence was never in doubt for ICD-9 nor recoverable for NDC. One failure in the table is the metric’s, not the system’s: the sin- gleDEM|VITAL:ncode has ontology label "Living" and the system answered "Vital status: Alive": correct, and scored zero for sharing no token. It is a clean instance of the 6.7% false-blame rate quan- tified in Section 5.3, and a reminder that these decode rates are floors. 22 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses code systemcodes coverage decoded ≥ 0.5 ICD-9 diagnoses1341.0000.955 NDC drug codes440.0000.000 demographics (sex, race, language, marital, religion, vital status, date) 221.0000.955 all2000.7800.745 We state the boundary this does not cross. Decoding a published taxonomy tests whether the system can recognise and apply a code system it has seen described somewhere; it does not show that it can decode a proprietary in-house coding scheme, for which no amount of world knowledge would suffice and where the correct be- haviour is the one it showed on NDC. (Harness:scripts/i2b2_de- code_study.py,scripts/i2b2_decode_analysis.py; data:pa- pers/data/i2b2_decode.json.) 5.5 The system in practice: a multi-tenant case study What this section is, and is not. Rosetta runs as a live, multi-tenant service, and we report that running deployment here as an engi- neering and methodological case study: it demonstrates that the architecture operates across many structurally different schemas, hardens under an enforced regression discipline, decouples from any single LLM, and catches its own measurement errors. But ev- ery warehouse in this section is self-authored synthetic data, so we treat these results as suggestive of capability, never as external validation. The paper’s validated claims rest entirely on the third- party Spider study of Sections 5.1 and 5.6; this case study shows the system working, the benchmark shows the result is real, and we keep that boundary explicit throughout. 5.5.1 Deployment shape. Harness. Evaluation is a live-API black- box procedure (scripts/run_evals.py): each question is POSTed to a running/tenants/slug/askendpoint and the returned JSON is scored. Questions are hand-authored YAML banks or- ganized into five tiers: A (easy, documented) through E (out-of- modeled-scope, should refuse). The primary metric is route accu- racy: whether the produced route in answer, confirm-first, refuse matches the expected route. Auxiliary metrics are a variant-aware column퐹 1 (sqlglot-parsed), an execution result match (order- insensitive, numeric-tolerant comparison against a canonical SQL, available only when a canonical query is provided and the route is answer), a mean L4 score, and per-tier signals (a critic catch-rate for Tier C, refusal precision for Tiers D/E). A regression gate (scripts/ regression_gate.py) fails the build if any tenant drops more than 2 p below a recorded baseline. Ablation conditions are not enforced by the harness; the operator selects them by environment variable, which is a methodological limitation we note in Section 6. The gated cohort. Eight synthetic tenant fixtures exist, span- ning eight verticals (telecom, retail, insurance, healthcare, manu- facturing, education, hospitality, logistics). The regression-gated evaluation cohort is six of them (telcomart, zenith, acme, carenexus, forgemark, and lumenscroll), comprising 146 hand-authored ques- tions. Two further tenants exist outside the gate (altanova, with a 20-question bank used for the controlled-lift study below, and routecargo, fixture-only). Each tenant is row-level-security isolated and routed by the same deterministic arithmetic; serving eight structurally different verticals from one architecture is a breadth- of-deployment demonstration, not a claim of external generality: the warehouses are ours. All warehouses are synthetic, which we regard as a strength for open release (the data is the project’s sole IP, with no third-party licensing) and a limitation for external validity (Section 6). 5.5.2 Operational hardening as process. The value in this subsection is the discipline the regression gate enforces, not the accuracy values themselves; Tables 1 and 2 are the operating points it holds. We report all three cohort-level numbers deliberately, because reporting only the best would be dishonest: the system has a conservatively enforced floor, a stable reproducible operating point, and a cold- start floor, and these differ. We explicitly flag, and do not use as a headline, two historical peaks, a single-tenant 1.000 (telcomart 50/50, acme 10/10) and a six- tenant 0.979 (143/146), as cache-hit / lucky-shot artifacts; §5.5.5 recounts how the system’s own machinery caught the inflation and re-baselined downward. Per-tenant enforced floors. Table 2 gives the per-tenant floors carried by the live regression gate. (These enforced floors were recorded after an Opus-4.7 strict- mode model-drift event and are deliberately lower than the stable- Gemini full-system numbers of Table 3, e.g. forgemark 0.889 en- forced here vs 0.944 stable there, because a floor is a conservatively enforced worst case, not a best measurement.) 5.5.3 Reconstruction lift and operational findings (suggestive). The deltas below are the section’s most interesting internal signals and also its most self-grading-vulnerable; we fence them accordingly as small-bank, indicative-not-definitive. The reconstruction lift (internal fixtures; suggestive, not the externally-validated result). These measurements isolate the value of metadata reconstruction by comparing a tenant’s accu- racy with the catalog disabled to its accuracy with reconstruction enabled, on self-authored synthetic banks, so they are indicative of capability rather than external evidence; the externally-validated result is the calibrated abstention of Section 5.6, not these lifts. Ta- ble 3 reports the per-tenant full-system-vs-day-1-cold comparison on Gemini 3.1. The cleanest controlled cold→curated comparison was run on the altanova tenant (20 questions): 50% with zero catalog→90% with an automated LLM pre-flight reconstruction (no human) →95% after curation. The cold run fails all of Tier A, because the system’s weak-grounding traps correctly fire and the system refuses on ungrounded columns rather than guessing: exactly the intended behavior, and a demonstration that the abstention ma- chinery is doing real work. A single-lever ablation on forgemark is suggestive of LLM pre-flight’s contribution: bare 0.389 (7/18)→ 23 Helwig Table 1: Six-tenant cohort route accuracy (N = 146). ConditionRoute accuracyNotes Enforced regression floor 0.918 (134/146)recorded after an Opus-4.7 strict-mode model-drift event Stable reproducible ≈0.932 (136/146) Gemini 3.1 Pro, after refinement Day-1 cold start0.856 (125/146)all curation disabled Table 2: Per-tenant enforced route-accuracy floors (gated cohort). TenantFloor Count telcomart0.88044/50 zenith0.96024/25 acme1.00010/10 carenexus0.96024/25 forgemark0.88916/18 lumenscroll 0.94417/18 Table 3: Full system vs. day-1 cold start, per tenant (Gemini 3.1, six-tenant cohort). TenantFull system Day-1 coldΔ telcomart0.8800.8800 zenith0.9600.9600 acme1.0000.900 −10 p carenexus0.9600.760 −20 p forgemark0.9440.9440 lumenscroll 0.9440.667 −28 p Total0.9320.856 −7.6 p +LLM-preflight 0.556 (10/18): a +16.7 p move, but three questions on an 18-question bank, so indicative rather than a precise effect size. The same arc reproduces across tenants: carenexus from a bare day-1 24% (column퐹 1 0.538) to 96% with automated pre-flight; zenith from a 6/25 = 0.240 baseline to 25/25 = 1.000 over the build arc (the 1.000 read with appropriate caution, see Section 6). A recent live carenexus run (25 questions, automated pre-flight, full system) measured overall route accuracy 0.960, column퐹 1 mean 0.598, mean L4 0.733, with per-tier route accuracy A 1.000 / B 1.000 / C 1.000 / D 0.857 (refuse precision 0.714) / E 1.000 (refuse precision 1.000), in 132.1 s of wall time. LLM pre-flight vs. human SME (led by coverage and cost, not the fragile route delta). In one controlled comparison (a single tenant (carenexus), one unpaid human SME, 25 questions, everything else held fixed), an automated LLM-team "pre-flight SME" beat the human on the two robust axes: it covered 171/171 columns vs. 47/171 and, on the hardest tier (Tier B), achieved 80% vs. 40%, at a cost of $2.89 of LLM spend and 16 minutes of wall time against roughly one-to-two human hours at $0. Its route-accuracy edge, 88.0% vs. 76.0%, we deliberately treat as the weakest of the three axes: a three-question delta with an unpaid- human confound. A reproducible negative result accompanies this: stacking a hand-SME pass on top of the LLM pre-flight regressed accuracy to 80% (below the 88% pre-flight-only number): the human descriptions were shorter and less specific, a cross-phase interference effect we report because it is counterintuitive and reproducible. The total LLM cost of the comparison session was $5.78 (two pre-flight runs at $2.89). Reconstruction quality itself is measured routing-independently as token-recall (0.667 macro; Section 5.1), which does not pass through our own routing at all. 5.5.4 Provider-agnosticism. Because the routing decision is deter- ministic arithmetic over features, the system is not coupled to a particular LLM; the model is a feature provider, and swapping it tests an architectural invariance directly. Swapping the premium LLM from Anthropic Opus to Gemini 3.1 Pro (Vertex) moved the standard six-tenant gate by 0.925→0.932 (+0.7 p) and improved adversarial robustness from 10/23 = 0.435 to 12/23 = 0.522 (+9 p); on carenexus specifically the adversarial pass rose from 0/6 = 0.000 to 4/6 = 0.667. The claim this supports is not that the system is accurate but that it is invariant to the model, a property Spider cannot exhibit and that no reviewer can read as self-grading. 5.5.5 Engineering rigor, and catching our own inflation. Adversarial and engineering rigor. Adversarial banks are constructed by saving only questions that broke the system, so their floors begin at 0.000 by construction and climb as fixes land; the live gate currently floors most tenants at 0.000/N with lumenscroll at 1.000/1, and the bank improved over the build from 0/22 to a stable 3/22 to 9/22 after targeted signal additions. The test suite grew from 39 to 1,648 passing tests (2 skipped), with one regression test added per fix. The deep-pattern library matched 68/78 = 87% of one tenant’s catalog and lifted the result-match rate from 0.50 to 0.70. Catching our own inflation. Twice, the system’s own mea- surement machinery surfaced an inflated number and forced a downward correction before it reached this paper: the episode we regard as this section’s strongest evidence of trustworthiness. First, an LLM-response-cache key changed under model drift, and what had read as a 0.979 six-tenant peak (with a 1.000 single-tenant peak) re-baselined to 0.918; the correction is recorded verbatim in the regression baseline ("Total now 134/146 = 0.918, down from 143/146 = 0.979 cache-hit measurement"), and the gate now carries the corrected floor. Second, the selective-prediction evaluation of Section 5.1 was initially corrupted by an evaluation-harness bug (the in-process pipeline executed against the wrong warehouse, pinning the execution-success feature to a constant and making the routing score look useless), which we found, fixed, and re-ran at larger scale, reversing the earlier weak-discrimination verdict (Section 5.1). Neither correction was forced by a reviewer; both were surfaced by the project’s own gate and harness. We do not claim the system is bug-free; we claim its measurement discipline surfaces its own errors, which is the honest and the stronger claim. A candid note on execution accuracy. The strongest kind of accuracy (does the returned answer match a canonical execution?) 24 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses is the metric we trust most in principle, but it is measured today on only 24 of 792 recorded runs, always over single-digit verifiable subsets (e.g., acme 1.0 on 4 verified rows, forgemark 0.875 on 8, lumenscroll 0.714–0.833 on 6–7). There is no large-N execution- accuracy number. Moreover, the v1 result-match metric is column- projection-sensitive: list-style questions can register as misses even when the rows are correct. We therefore lean on route accuracy for headline claims and treat scaling execution accuracy as essential future work. 5.6 Query time: the external stripped-schema Spider study We have since run the external benchmark and the naive baseline that the previous draft listed as proposed. We use Spider [28]: gold SQL from thexlangai/spiderdev split and the corresponding SQLite databases frompremai-io/spider. Two arms share the mangler (P1). The naive arm (rosetta/eval/spider_bench.py) shows the premium LLM the mangled schema and the question, exe- cutes its SQL against a copy of the mangled database, and compares (order-insensitive, numeric-tolerant multiset) against gold run on the original database. The reconstruction arm (rosetta/eval/ spider_reconstruct.py) bootstraps a throwaway tenant from the mangled database through the full production path (deep profiler, automated LLM SME pre-flight, grounding), then drives the same /askpipeline (run_ask) used in production, with no curation, no human SME, no query-log history, and no tenant-tuned detectors. Cold is deliberately the weakest reconstruction condition: a fully- automated day-1 catalog; we also run an oracle-documented condi- tion (an upper bound) and an SME-affirmed condition (a realistic curation), below. The model is Gemini 3.1 Pro (gemini-3.1-pro- preview) throughout; all numbers below are from live API runs. We evaluate at scale (11 Spider databases×3 severities×3 re- construction conditions: 1,082 execution-labeled questions) and report two quantities per question: the deployed route (answer / confirm-first / refuse) and its correctness, and the latent SQL accuracy (whether the generated query execute-matches gold re- gardless of route), which isolates generation quality from the routing decision. (An earlier, smaller version of this pilot under-reported the deployed routing because of the harness bug of Section 5.1; the latent figures were unaffected, and the routing figures below are the corrected, larger-scale ones, with 95% confidence intervals from a cluster bootstrap over databases. One database,wta_1, is excluded because its source SQLite carries non-UTF-8 bytes that break the SQLite→DuckDB load.) Naive degradation under stripping (11 databases×3 severi- ties, 396 calls). Execution accuracy is 0.924 at severity 0.0 (clean), 0.917 at 0.5, and 0.417 at 1.0 (full opacity). The mid point barely moves because the mangler’s rename lever ramps in only above severity 0.4, leaving the queried identifiers mostly intact; the col- lapse is at full opacity. The operative observation is the failure mode: at full strip the naive model auto-emits a wrong answer on ~58% of questions with no signal of untrustworthiness, precisely the silent-confident-error this paper targets. (On the four databases of the original smaller pilot the figures were 0.95 / 0.95 / 0.55; the broader eleven-database set is harder, which sharpens the full-strip collapse.) Table 4. Naive always-answer vs. cold reconstruction’s cali- brated gate, by severity (11 Spider databases, Gemini 3.1 Pro). The naive arm answers every question; the reconstruction arm abstains (confirm-first / refuse) when grounding is low and auto- answers only a fraction, its coverage, at a higher accuracy on what it emits. (Reconstruction arm: 11 databases, ~12 questions per database per severity, three conditions. Building the SME-affirmed condition surfaced and fixed the in-process warehouse-resolution bug of Sec- tion 5.1; an earlier two-database version of this pilot also surfaced and fixed two scoring/parsing bugs (a brittle JSON extractor that discarded the premium model’s chatty-but-valid SME descriptions, and a result comparator that mis-scored DuckDBDecimalvalues against gold floats); all three carry regression tests. The deployed- route numbers here are post-correction; the latent figures were never affected.) Cold reconstruction generation: an honest negative on these toy schemas, at every severity. Measured by latent SQL accuracy (generation quality independent of the gate), the cold re- construction pipeline sits below naive translation across the board: 0.76 vs. 0.92 on clean schemas, 0.75 vs. 0.92 at mid, and 0.22 vs. 0.42 at full strip. (The earlier two-database pilot showed near-parity on clean, 0.90 vs. 0.95; the broader eleven-database set, which includes harder schemas such asdog_kennelsandemployee_hire_eval- uation, removes that parity.) The failures are genuine, not scoring artifacts (the system emitsNULLplaceholders for columns it cannot map, or refuses outright). We report this negative plainly because it scopes where reconstruction’s value does not lie: it is the oppo- site direction from the internal 50→90 lift, and the dissociation is the point. The internal lift comes from the curation/SME/detector layers a cold Spider bootstrap deliberately omits, over warehouses far more complex (and far more opaque to a general LLM) than singerandpets. The honest reading is that on toy schemas a premium model already handles, cold reconstruction adds nothing to generation; its value here is elsewhere: in knowing when its generation is wrong, which is the calibrated-gate result we turn to next. Calibrated selective answering, confirmed externally (the central result). With the gate executing correctly, the system does not abstain on everything; it abstains selectively, and the selection is calibrated. Across the 1,082 reconstruction questions the three routes are cleanly monotone in both confidence and accuracy: it refuses 159 questions (meanℓ 4 0.086) of which only 1 was actually answerable; it routes 283 to confirm-first (meanℓ 4 0.589, 41% latently correct), the genuinely-uncertain middle band; and it auto- answers 640 (meanℓ 4 0.770) at 86% accuracy (95% CI 78–93%), emitting 90 wrong answers in total (14% of what it emits). Coverage, the fraction it auto-answers, is 0.59 (CI 0.51–0.65). (These pooled figures span all three reconstruction conditions and severities; the per-condition ladder below decomposes them (day-1 cold 0.51/0.82, SME-affirmed 0.59/0.86, and the oracle-documented upper bound 0.68/0.89), so the pooled operating point coincides with the realistic SME-affirmed condition, while Table 4 above reports the cold slice alone.) The defining property is that coverage tracks difficulty. As stripping rises and generation collapses, the gate withholds more 25 Helwig SeverityNaive: exec acc (coverage 1.0) Cold recon: coverage acc when answered latent SQL acc Clean (0.0)0.9240.650.810.76 Mid (0.5)0.9170.640.860.75 Full strip (1.0) 0.4170.250.750.22 0.00.20.40.60.81.0 severity (schema opacity) 0.0 0.2 0.4 0.6 0.8 1.0 coverage (fraction answered) Coverage collapses with opacity cold curated affirmed 0.00.20.40.60.81.0 severity (schema opacity) 0.0 0.2 0.4 0.6 0.8 1.0 accuracy Accuracy holds where it answers cold curated affirmed naive (answers all) Calibrated abstention: coverage tracks difficulty Figure 1: Calibrated abstention: as schema opacity rises and generation collapses, coverage collapses with it (left) while accuracy on what the gate does answer holds (right), across all three reconstruction conditions; the naive arm answers everything at falling accuracy. rather than emitting confident errors: at full opacity, where cold la- tent accuracy falls to 0.22, cold coverage falls to 0.25 while accuracy on what it does answer stays at 0.75; the SME-affirmed condition be- haves the same (latent 0.24, coverage 0.25, accuracy-when-answered 0.87). The contrast with the naive arm is the selective-prediction trade in concrete, external form: at full strip the naive arm an- swers 100% of questions at 42% accuracy, a 58% silent-error rate, while the reconstruction arm answers 25% of them at 75% accu- racy and abstains on the rest. The system converts a high-coverage, high-silent-error translator into a lower-coverage, low-error one, and, as Section 5.1 establishes on the same 1,082 samples, the con- fidence score driving that conversion both discriminates correct from incorrect (normalized AURC 0.26, CI excluding random) and is calibratable (ECE to 0.026). This is the calibrated-abstention guar- antee of Section 4.3 demonstrated, on an external benchmark with confidence intervals, as an actual selective-prediction advantage: not merely the architectural argument that the authority ceiling forces abstention, but the measured result that the gate abstains where it should. The baseline here is a lower bound, not the fair abstention comparison. Our naive arm always answers, so this study estab- lishes that the gate is safer than a non-abstaining translator; it does not yet establish that our authority-grounded confidence is better- calibrated than a cheap, generic abstention mechanism bolted onto the same naive model (a token-logprob or sequence-probability threshold, self-consistency spread across samples, or verbalized confidence). Such a naive-plus-abstention gate would close part of the silent-error gap on its own. To credit the authority ladder specifically, the gate must beat a naive-plus-abstention baseline, not a naive always-answerer; sweeping that baseline’s operating point on the same 11 databases is the immediate next measurement (Section 5.7), and until it is run this comparison should be read as "safer than never abstaining," not "better-calibrated than any abstention." Honest caveats specific to this pilot. The result is not uniform across databases: deployed accuracy-when-answered ranges from 1.00 (network_1,pets_1: zero wrong answers) down to 0.56 onem- ployee_hire_evaluation, where the gate over-answers (it emits 28 wrong answers out of 63 it auto-answered). The cluster-bootstrap confidence intervals are computed precisely so this database-level 26 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses 0.00.20.40.60.81.0 coverage (fraction answered) 0.00 0.05 0.10 0.15 0.20 0.25 0.30 0.35 0.40 0.45 selective risk (error rate among answered) Risk–coverage: the L4 score is a usable selector L4 selector (AURC 0.163) random (= base error 0.383) oracle (AURC 0.085) deployed gate (0.59 cov, 0.14 risk) Figure 2: Risk–coverage curve (L4 score as the selector). The selective risk stays far below the random-ordering reference until high coverage; the deployed three-way gate sits on the favourable part of the curve. refuse n=159 confirm-first n=283 answer n=640 0.0 0.2 0.4 0.6 0.8 1.0 value 0.09 0.01 0.59 0.41 0.77 0.86 The three-way gate is monotone in confidence and accuracy mean L4 confidence latent accuracy Figure 3: The three-way gate is monotone in both confidence and accuracy: refusals carry near-zero L4 and are almost never answerable; confirm-first is the uncertain middle band; answers carry high L4 and high accuracy. variation is reflected rather than hidden, but the outlier is real: on some schemas the gate’s confidence is miscalibrated upward and it emits confident errors, which is exactly the failure the architecture is meant to prevent. Whether that reflects genuine over-confidence or a scoring artifact on that schema’s particular queries we do not resolve here. The latent-accuracy metric, separately, scores a query the system chose not to emit, so it measures generation capability, not delivered behavior; we report it alongside, never instead of, the deployed routing. With those caveats, the finding that holds is sharper than the prior draft’s "zero wrong answers": the gate does not abstain on everything (that earlier claim was the harness bug), it answers selectively, and on average, with a database-clustered 95% CI, it answers a majority of questions at far higher accuracy than the naive arm’s silent-error rate while withholding most of the questions it would get wrong. 0.00.20.40.60.81.0 accuracy when answered employee_hire_evaluation dog_kennels course_teach world_1 museum_visit orchestra concert_singer poker_player tvshow pets_1 network_1 Per-database spread (one over-answering outlier in red) pooled 0.863 [CI 0.78–0.93] Figure 4: Per-database accuracy-when-answered (the hon- est spread). The result holds across databases around the pooled 0.863 [CI 0.78–0.93], with one over-answering outlier (employee_hire_evaluation). The reconstruction-value ladder: cold, SME-affirmed, and documented conditions. To probe where reconstruction’s value lies, we ran two further conditions beyond cold. The oracle-documented condition (scripts/spider_curate_docs.py) overlays aDOC_- CITED_STRONGdescription on every column derived from its orig- inal pre-mangle name: an enterprise warehouse whose opaque physical columns are explained by a maintained data dictionary; it is an upper bound, clearly labeled, because it injects the true semantics rather than inferring them. The SME-affirmed condi- tion (scripts/spider_affirm_facts.py) is the honest analog of real curation: it takes the descriptions the cold pipeline already reconstructed and promotes them to the SME_AFFIRMED authority tier through the exact production "accept" path a human reviewer uses (interaction.commit_reviewed), an SME who accepted the system’s own reconstruction, not one who supplied oracle text. The two conditions bracket the realistic system. The ladder behaves as the authority architecture predicts. Cov- erage and accuracy-when-answered both rise from cold (coverage 0.51, accuracy 0.82) through SME-affirmed (0.59, 0.86) to oracle- documented (0.68, 0.89): more authoritative metadata lifts more questions into the answer region and makes the emitted answers more accurate. This corrects a specific claim in the prior draft: that documentation "lifts grounding from refuse into confirm but not to auto-answer." With the gate executing correctly, both the docu- mented and the SME-affirmed conditions reach the answer region routinely; the earlier non-result was the warehouse-resolution bug, not a property of the authority ladder. (On generation alone the doc- umented condition still does not beat naive on these toy schemas (latent 0.66 vs. naive’s 0.92 on clean), consistent with the cold nega- tive above; its value, again, is in the calibrated gate, where higher authority buys both coverage and precision.) Measured: the fair baseline, naive-plus-abstention. Table 4 pits our gate against a naive arm that always answers; the sharper test, deferred by the previous draft, is whether the authority-grounded gate is better calibrated than the same naive model given a cheap, generic abstention mechanism. We built two and traced each as a risk-coverage curve over the same 11 databases and severities (rosetta/eval/spider_abstention.py; 396 questions, $1.47; anal- ysis free viascripts/spider_abstention_compare.py): self-consistency 27 Helwig (five samples at temperature 0.7: the emitted answer is the modal ex- ecuted result, the confidence the fraction of samples that agree) and verbalized confidence (the model self-reports a probability). A third cheap signal often used for LLM abstention, a token-logprob or sequence-probability threshold, we cannot evaluate: the man- aged Gemini API used throughout this work returns no token log- probabilities, so a logprob baseline is not available on this provider; we note the gap rather than substitute a proxy, and observe that self-consistency agreement is the closest sampling-only surrogate we can compute. The result is two-sided, and we report both halves. Where the cheap baseline suffices. Pooled across severities the naive signals discriminate about as well as our gate (normalized AURC 0.26 (verbalized) and 0.32 (self-consistency) against the cold gate’s 0.33) and, because naive generation is stronger on Spider’s toy schemas (the negative above), they deliver comparable accuracy at matched coverage. Part of every pooled score here is mere difficulty- detection: a confidence that is high on clean schemas and low on stripped ones correlates with correctness across the severity gradient without ranking correctness within a difficulty, so the per- severity numbers below are the cleaner measure. On clean and mid schemas the naive signals carry almost no within-severity ranking signal (normalized AURC 0.82–1.0, at or worse than random), but at 92% base accuracy there is little to rank. The honest reading is that on documented or lightly-degraded schemas a cheap naive gate is enough; the authority ladder is not required there. Where it is not: full opacity. The gate’s advantage concentrates exactly where the paper locates the problem. At full strip the gate’s L4 discriminates correct from incorrect with normalized AURC 0.11 (≈89% of the ranking signal) against 0.41 (verbalized) and 0.47 (self- consistency): the naive model’s own confidence collapses toward random once readable names are gone (stripped of schema cues it cannot tell which of its guesses are right), while the authority- bounded score still can. This superior calibration does not, on these toy schemas, become higher delivered accuracy. At matched cover- age the naive arm’s stronger generation (full-strip base accuracy 0.39 vs the cold gate’s 0.22) offsets the gate’s better ranking, so naive self-consistency matches or slightly exceeds the gate on accuracy- when-answered (e.g. 0.56 vs 0.44 at 50% coverage), except at the lowest coverage, where the gate matches it (0.69 vs 0.67 at 25% coverage) from a much lower base accuracy (0.22 vs 0.39): the sig- nature of the better ranking. The regime in which better calibration and competitive generation would combine to beat the naive gate outright is a complex, genuinely-undocumented warehouse. The generation half of that question is now answered, negatively, on BIRD’s real schemas (Section 5.7: cold reconstruction does not out- generate naive there either); what remains untested is only whether a fully-curated system on a genuinely-undocumented warehouse could combine calibration with competitive generation to win on delivered accuracy. A cheaper baseline still, the execution-sanity gate, col- lapses under opacity. The weakest abstention mechanism avail- able to a naive translator is to answer when its SQL executes and abstain when it errors. We re-executed every naive query against the same mangled database it was generated on (deterministic seed- 0 mangle;scripts/spider_exec_sanity_baseline.py, analysis- only, 1,452 questions): the gate is a near-no-op. Because a query stripped of readable column names is still syntactically valid (it selects the wrong renamed column but runs), its execution rate stays at≈100% across every severity, so it answers essentially ev- erything, and its silent-error rate climbs from 7% on clean schemas to 72% at full strip, tracking the naive always-answerer exactly. The authority gate on the identical questions instead lowers cover- age from 65% to 33% as grounding erodes and holds silent error at ≤15% throughout. This is the sharpest form of the point: even a free abstention signal does not close the opacity gap, because the fail- ure mode under schema opacity is confident-but-wrong execution, not execution failure, and that failure mode is precisely what an authority-bounded confidence, and not a syntactic check, is built to catch. This calibration gap holds at full dev-set breadth. Extending the naive baseline across all 19 dev databases (the breadth study of Section 5.7;scripts/spider_abstention_baseline.py –dbs breadth , 1,452 pooled questions) reproduces both halves. Naive self-consistency accuracy degrades from 0.92 on clean schemas to 0.39 at full strip: the always-answer collapse, now on the full dev set. And at full strip the naive model’s own self-consistency confidence discriminates no better than chance (normalized AURC 0.55) while the authority-bounded gate still ranks correct above incorrect (0.20): the same roughly-threefold calibration edge under opacity, measured on 19 databases rather than eleven. The cheap baseline’s edge on clean schemas and the gate’s edge under opacity both survive the move to breadth. We take this as the honest resolution of the objection the previous draft anticipated: a naive-plus-abstention baseline does close most of the always-answer silent-error gap, so the delivered-behaviour result of Table 4 is an advantage over a non-abstaining model, not over any abstaining one. The gate’s distinctive, measured edge over a cheap abstaining baseline is calibration quality under opacity, together with the properties the architecture exists for and a naive gate has none of: auditability, prompt-injection resistance, and a route decided by deterministic arithmetic rather than the LLM’s own self-report. Two further baselines a reviewer might expect we treat directly. A pure retrieval / data-catalog baseline is ill-posed in this setting: under full opacity there are no readable names to retrieve against, so retrieval must operate over the column values, which our deep pro- filer already fingerprints, or over the reconstructed catalog, which is the system under test itself; a name-based retriever therefore degenerates rather than forming a clean comparison. And a strong agentic text-to-SQL system (schema-linking with decomposition and self-correction) is a stronger generator, not a stronger calibra- tor: the execution-sanity result above shows the calibration gap survives even a generator whose SQL always runs, because under opacity the failure is confident-but-wrong execution, so we treat a full agentic-generator comparison as complementary future work rather than a load-bearing baseline for the calibration claim this paper makes. 5.7 Query time: BIRD and full-Spider-dev breadth The breadth item that stood here as proposed (extending the stripped- schema study from Spider’s toy schemas to BIRD’s larger, nois- ier real-world databases) has since been run at full opacity and is reported below; it answers the open generation question with a 28 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses clean negative and sharpens the abstention result on real schemas. The second proposed item, the full Spider dev set on a continuous severity grid, has now also been run in the cold day-1 condition and is reported below. Two components remain genuinely unrun (leave-one-tenant-out and large-N internal execution accuracy), each needing more live-model budget than the studies above. (The naive-plus-abstention baseline that stood here as the priority experiment has been run; its two-sided result (cheap naive abstention matches our gate on toy schemas, our measured edge is calibration under opacity) is reported in Section 5.6.) Measured: BIRD breadth (real-world schemas). We extended the reconstruction arm to BIRD mini-dev, whose 11 databases (fi- nance, sports, healthcare, and others) carry schemas materially harder than Spider’s. The gap shows in the naive baseline alone: a premium translator that scores 0.92 execution accuracy on clean Spider scores only 0.47 / 0.64 (evidence off / on) on clean BIRD and collapses to 0.07 / 0.11 at full opacity, precisely the regime where reconstruction’s generation had the most room to help. We ran the full-strip (severity 1.0) reconstruction slice (cold and curated- documentation conditions, both evidence modes, matched question- for-question to the naive baseline), completing eight of the eleven databases fully plus the cold condition of a ninth (european_foot- ball_2, the largest at 598 MB, whose curated-documentation condi- tion did not finish). The two largest remaining catalogs,card_games (115 columns) andcodebase_community, initially failed the deep- profiler bootstrap; we traced this not to a scaling limit but to a concrete, since-fixed defect: an extreme-range column produces a non-finite (inf) profiling statistic, which Python’sjson.dumps serialises as the tokenInfinitythat PostgreSQL’sjsonbtype rejects, aborting the evidence write. A recursive sanitizer at the single evidence-write boundary fixes it, and both databases then bootstrap and answer, giving 11/11 BIRD coverage. Because their 100+-column catalogs make for very large prompts, each answered question is expensive, so we sampled these two recovered databases at reduced depth (five full-strip cold questions each), a query-time cost we return to under scalability, not a profiling limit. At full strip both behave as the thesis predicts:codebase_communityrefuses or defers all five (latent accuracy 0), andcard_gamesanswers one (incorrectly) and abstains on the rest. The two findings are reported straight. Generation is a clean negative for cold reconstruction, now on real schemas: cold recon- struction does not out-generate naive even where naive collapses. Pooled full-strip latent accuracy is 0.016 / 0.042 (evidence off / on) for cold reconstruction against 0.084 / 0.134 for naive. The hypothesis that reconstruction’s generation would win on hard real schemas is not supported for the deployable cold day-1 arm; the Spider generation-negative holds on BIRD, and we close that door explicitly. The one nuance the frozen record exposes is confirmatory of the thesis rather than of the contribution: full curated documen- tation reaches 0.041 / 0.161 at full strip, still below naive without the benchmark’s evidence hint (0.041 vs 0.084) but above naive once the hint is supplied (0.161 vs 0.134), so genuine metadata, and only genuine metadata, lifts generation past a collapsed naive model, exactly the metadata-quality lever the paper argues for and exactly not the cold day-1 reconstruction whose generation we decline to claim. Abstention is the result that transfers and strengthens. At full opac- ity the deployed gate is near-silent: without BIRD’s evidence hints it auto-answers only≈5% of questions (21 of 379 valid), emitting 17 confident errors where a naive always-answerer emits 347 and avoiding≈95% of naive’s silent errors by refusing what it cannot ground; with the hints supplied it answers nothing (0 confident errors against 311 naive silent errors). The sharper result is discrimination: on the 738 full-strip questions that produced a valid attempt Rosetta’s authority-grounded score still ranks cor- rect above incorrect (normalized AURC 0.300, better than random), while the naive model’s own self-consistency confidence is worse than random (unclamped normalized AURC 1.19, anti- correlated with correctness). On a fully-stripped real schema the naive model regenerates the same wrong SQL across samples, so it is most confident exactly where it is wrong. (These outcome statistics exclude API/parse/timeout system-failures under the frozen-record policy of Section 5.12: the gate’s structured multi-call pipeline hard- failed on 8.2% of full-strip questions and 15.7% across all conditions, which we report separately as a system-failure rate rather than fold into coverage; the naive single-shot baseline produced an an- swer on every question, so the comparison is not flattered on that axis.) This is the strongest external evidence for the paper’s central claim: on hard real schemas a naive model cannot tell when it is wrong, and a grounded gate can. It is also why the cheap naive- plus-abstention baseline that matched us on Spider’s toy schemas (Section 5.6) would fail here: its abstention signal is anti-correlated with correctness under full opacity. We are explicit about the BIRD result’s limits. Accuracy-when- answered at full opacity is low (0.19): at this extreme the gate’s value is refusal, not accurate answering, because generation has collapsed for every method. Calibration is again not uniform:tox- icologyover-answers (10 confident errors at zero accuracy), and card_games(one of the recovered giants) over-answers on the sin- gle full-strip question it auto-answers, both the BIRD analog of the Spideremployee_hire_evaluationoutlier. Coverage-tracks- difficulty is confirmed on the two databases that ran the full sever- ity range (auto-answer coverage 0.23→0.29→0.02 onsuperhero, 0.12→0.11→0.07 onstudent_club, collapsing toward full strip). With the deep-profiler defect fixed, BIRD coverage is now 11/11; the two recovered giants are sampled at reduced depth (a query- time cost on 100+-column catalogs), andeuropean_football_- 2’s curated-documentation condition remains the one unfinished cell, so the breadth is complete in coverage though uneven in per- database depth. Measured: the full Spider dev set on a continuous sever- ity grid. The study now spans 19 of Spider’s 20 dev databases (all butwta_1, whose non-UTF-8 bytes break the DuckDB load) across a continuous six-point severity grid (0.0, 0.2, 0.4, 0.6, 0.8, 1.0), in the cold day-1 condition: 1,421 execution-labeled cold questions, up from 11 databases at three discrete severities. The central behaviour holds at breadth and at finer resolution. Cover- age tracks difficulty monotonically: the deployed gate answers 65% of questions on clean schemas and only 33% at full strip, re- fusing more as grounding erodes, while accuracy-when-answered stays high (0.75–0.90) until full strip and then falls to 0.57, and the silent-error rate stays bounded (6–15%) at every severity, against a naive always-answerer that is silently wrong on the majority of 29 Helwig fully-stripped questions. Pooled over the grid, the cold gate answers 59% of questions at 81% accuracy with an 11.5% silent-error rate: the day-1 slice of the 86%-at-59% deployed result of Section 5.6, now confirmed across the full dev set. Discrimination is stable as the study widens: the cold routing score’s normalized AURC moves only from 0.33 (11 databases, three severities) to 0.39 (19 databases, six severities), better than random throughout; the finer grid honestly exposes that the intermediate severities (notably 0.6, a partial-rename regime) are where the gate is most tempted to over-answer. That over-answering is not confined to one database: at full strip several schemas (cre_Doc_Template_Mgt,flight_2, battle_death, alongside the previously flaggedemployee_hire_- evaluation) auto-answer a handful of low-arity aggregations they get wrong, so over-answering is a systematic full-strip effect rather than a single-database artifact. It is not, however, a single mech- anism: the role-ambiguity signal that explainsemployee_hire_- evaluationdoes not separate wrong from right answers on these three schemas (Section 6), so their over-answering remains undiag- nosed. The reconstruction arc reproduces on public schemas at breadth. With the curated (oracle-documentation) and SME-affirmed conditions now also run across all 19 databases, the cold→curated arc of the internal case study (Section 5.5) reproduces externally. Supplying oracle documentation lifts pooled coverage from 59% to 74% and accuracy-when-answered from 81% to 91%, halves the silent-error rate (11.5%→7.0%), and sharpens discrimination (cold normalized AURC 0.39→curated 0.19); at full strip it more than doubles latent recovery (0.22→0.47) and keeps the gate accurate when it does answer (0.57→0.83). This is the same lever the internal ablations reported (better metadata, better delivered behaviour), now measured on public databases the detectors were never tuned on. The SME-affirmed condition, which promotes the system’s own reconstructed descriptions to high authority rather than oracle text, lands between cold and curated and does not improve discrimina- tion (AURC 0.37, essentially cold’s): the external echo of the internal finding that a human-on-top stack that over-trusts imperfect re- constructions can regress. Only the matched naive-plus-abstention baseline at breadth now remains open here; leave-one-tenant-out has since been measured (Section 5.10). The per-database variance is now characterized, not yet cured. The larger database set called for here has been run (19 dev databases, above): the over-answering is a systematic full-strip phenomenon, not a single-database artifact, and the per-database diagnosis (Section 6) resolves the mechanism for the flagged outlier, type evidence decoupled from role and join structure. The role- ambiguity signal named there has since been measured: it carries real, gate-invisible information on the database it was diagnosed from, and fails to generalize to the other over-answering schemas (Section 6). What remains is to implement the cap (plus a join-path grounding term independent of per-column type confidence) and re-measure whether it lifts calibration uniformity without over- refusing on clean schemas. Large-N internal execution accuracy: now run (Sections 5.10–5.11). The external Spider study reports execution-grounded routing on 1,082 questions; the internal execution-accuracy number, previously a 24-run subset, has since been scaled across the pro- duction cohort (six tenants, 146 questions, every answered query re-executed against its warehouse), giving a pooled accuracy-when- answered of 86% (57/66) and a full route confusion matrix (Section 5.11). Leave-one-tenant-out generalization: now measured (Sec- tion 5.10). Because the trap detectors and signals were authored against the very questions they are scored on, the strong internal runs may reflect overfitting rather than capability. Two independent answers now stand. The Spider study evaluates cold on nineteen public databases the detectors were never tuned on, and the cali- brated gate holds there. And within the production cohort, Section 5.10 establishes leave-one-tenant-out by construction (the absten- tion gate has no per-tenant parameters, verified in the catalog) and confirms it empirically with execution verification: the single frozen gate answers 46% of questions at 86% accuracy-when-answered across six heterogeneous tenants, with the last-onboarded tenant held out as an explicit temporal control. 5.8 Ablation: which part of the ladder carries the discrimination? The routing score composes several evidence rungs, and a fair re- viewer asks which rung actually carries the calibration, and whether the composition beats the LLM’s own self-report. We answer with a leave-one-component-out ablation on the execution-labeled cold data: because the score is a fixed weighted sum of features that are all logged, we re-score every question with one rung’s weight ze- roed and compare normalized AURC and deployed behaviour, with no new model runs. The re-scoring reproduces the production score to within 5×10 −7 , so each ablated variant is the real router with one input removed. The comparison runs on the 1,349 cold records carrying a complete feature vector (a matched within-subset com- parison); 72 records the gate refused before generating SQL (and thus before any feature existed) are necessarily excluded, which is why the full-strip baseline here (0.256) is slightly above the 0.204 of the full deployed set in Section 5.6, where those correctly-refused records are counted. Three findings, reported straight. Execution grounding is the load-bearing rung. Removing it (the execution-success signal plus the row-count and magnitude sanity penalties) degrades discrimination the most, and by a wide margin: normalized AURC rises from 0.439 to 0.588 across severities and from 0.256 to 0.358 at full strip. No other single rung’s removal comes close. The discrimination lives primarily in whether the generated SQL runs and returns a plausible result: exactly the signal a names-only model cannot see. Catalog and link confidence carry coverage, not ranking. Removing either the reconstructed catalog confidence or the L3 link probabil- ity barely moves the rank order (nAURC even nudges down) but collapses the answer region: coverage falls from 0.79 to 0.05 (no catalog) or to essentially 0 (no link), because without those rungs almost nothing clears the answer threshold and the gate refuses nearly everything. These rungs are load-bearing for delivered cover- age, letting the gate reach the answer region on grounded questions, rather than for rank order. The ladder ties the LLM’s self-report on ranking, and beats it on delivered behaviour: a correction to our earlier down-payment. On the matched subset the full authority score and the generator’s 30 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses own verbalized self-confidence discriminate about equally (full- strip normalized AURC 0.256 vs 0.260; across severities 0.439 vs 0.429): the ladder does not out-rank a free-floating self-estimate, and an earlier version of this section that reported it doing so was comparing the full score on the whole set against the self-report on the feature subset, not a matched comparison. Where the ladder wins is calibrated abstention: routed at the deployed thresholds, the full ladder answers 79% of questions at a 22% silent-error rate, while ranking by the LLM’s self-confidence alone answers 98% at a 32% silent-error rate. The authority ladder’s measured contribution is therefore not a sharper ranking but knowing when to abstain: it converts a comparable ordering into materially safer delivered behaviour, exactly the calibration-under-opacity thesis of Section 5.6 rather than a claim to a better guess. (The critic second-pass rung is inert on cold Spider: its removal changes nothing, consistent with its design of firing only in the medium-confidence band, which cold Spider rarely enters.) The variants that cannot be recovered from the logged features (collapsing the authority caps at reconstruction time, removing the SME tier, and replacing the deterministic router with LLM route-arbitration) change the authority tier before the features are computed and so require re-bootstrapping the study under the variant configuration; the SME-tier removal is partially observed al- ready in the cold-versus-affirmed comparison of Section 5.7, and we scope the remainder as the next controlled measurement. (Analysis: scripts/gate4_ablation.pyovervar/spider_pooled.jsonl; the report is papers/data/gate4_ablation_report.txt.) 5.8.1 A router baseline matrix, and a negative result about authority. The ablation above asks which of our rungs matters. The sharper question a reviewer asks is whether our score beats other people’s se- lectors on the same candidate SQL. We therefore hold the generator fixed (every router below sees the identical query, on identical rows, against identical execution labels) and vary only the signal used to decide whether to answer. Learned routers are fit withGroup- KFold grouped by database and scored only out-of-fold, so no router is ever evaluated on a schema it was trained on. This is free and reproducible from the committed pooled data (scripts/wsC_- baseline_matrix.py; results inpapers/data/wsC_baseline_- matrix_cold,pooled.json). The result does not favour us, and we report it plainly. On the deployed cold condition (1,421 execution-labeled questions, 19 databases), a learned multivariate-Platt selector over purely generic signals (the [17] analogue, using only generator self- confidence, link strength, SQL complexity, executability, and result- sanity) outperforms the deployed authority score on every axis we measure: normalized AURC 0.268 vs 0.388, ECE 0.038 vs 0.150, and coverage at a 10% error budget 0.345 vs 0.027. A gradient-boosted variant lands between them (0.294). Among un- learned single signals the generator’s own verbalized confidence (0.380) essentially matches our full score, consistent with the tie reported above. The decisive test isolates authority rather than learning: hold- ing the learner fixed and toggling only the four authority fea- tures (reconstructed-catalog mean/min confidence, catalog cov- erage, docs-anchored ratio), the change in discrimination is +0.007 (LR) and +0.002 (GBM) on cold, and−0.006 /−0.009 pooled across conditions, indistinguishable from noise, and negative as often as positive. Authority features alone rank barely better than chance (normalized AURC 0.992 cold, 0.776 pooled). Within the regime this benchmark can measure, the authority ladder contributes no incremental discrimination. We diagnose why, because the mechanism matters more than the number. The authority features are populated on ~90% of questions but are near-constant within a condition: cold takes ten distinct catalog-confidence values, all capped at 0.5, while curated and affirmed take two apiece. The ladder is built to cap confidence per evidence tier, not to rank questions inside one. It therefore cannot carry within-tier discrimination by construction, and pooling across tiers does not rescue it (the tier is nearly collinear with the condition label). One feature,docs_anchored_ratio, is identically zero in every condition and is dead weight in the current configuration. Directly ablating the caps agrees. The re-scoring above can- not touch the ceilings themselves, because a cap changes confi- dence before the feature vector exists, so we added an ablation flag (ROSETTA_ABLATION=no-caps, gated at the single function every one of the five clamp sites reads) and re-bootstrapped. Comparison is strictly paired on the same questions, with McNemar’s exact test on delivered wrong answers. Across 41 paired questions in two difficulty regimes, removing every ceiling changed the delivered outcome on exactly one question, and the mechanism was visible when it did (battle_death, score 0.000→0.766, refuse→answer, and the answer was wrong). The aggregate at full opacity moved the predicted way (coverage 0.033→0.133, accuracy-when-answered 1.00→0.75) but one discordant pair cannot reach significance: Mc- Nemar gives p = 1.00, and with a single discordant pair 1.00 is the smallest attainable two-sided value. At mid-severity the two arms were identical (coverage 0.909, silent-error 0.364, zero discordant pairs). The reason the caps rarely bind is instructive rather than disap- pointing, and it is the same reason in both regimes viewed from opposite ends. At full opacity the score is already far below the answer threshold (link strength, generator self-confidence, and the sanity penalties refuse the question without help), so lowering an already-irrelevant ceiling changes nothing. At mid-severity the score is already comfortably above the threshold on the strength of those same features, so raising the ceiling changes nothing either. Catalog confidence entersℓ 4 with a small weight; the ceiling can only be decisive in the narrow band where it is the marginal term. Taken with the leave-one-component-out result above (execu- tion grounding is the load-bearing rung; catalog confidence carries coverage, not ranking) and the router matrix (authority adds no in- cremental discrimination), three independent lines of evidence converge: the authority ladder is not the primary driver of this sys- tem’s delivered safety; execution grounding and the deterministic threshold are. We state that plainly because it is what we mea- sured. What the ladder does provide, and what we do still claim, is label-free provenance and an auditable ceiling: a reason, attached to every fact, for why the system was or was not permitted to be confident. We flag the sample as small (41 paired questions across two regimes) and the full-severity-grid re-bootstrap as the obvi- ous next measurement, but the direction is consistent across every analysis we have run. 31 Helwig Two caveats bound this negative in both directions. First, in our favour: the learned baselines are fit on execution-labeled outcomes which, out-of-fold or not, come from the benchmark; a real undoc- umented warehouse supplies no such labels, whereas the authority score is computed without any. That is a genuine deployment dis- tinction and we rely on it explicitly rather than treat it as an escape hatch. Second, against us: it means the honest statement of our contribution is not "a better confidence estimator." What survives measurement is the label-free, auditable, provenance-carrying con- struction of a confidence ceiling (and the abstention behaviour of Sections 5.6, 5.7 and 5.4 that it produces), not a superior ranking of correct from incorrect. Whether the authority caps earn their place through the variants this study cannot re-score offline (col- lapsing caps at reconstruction time, removing the SME tier, LLM route-arbitration) requires the full re-bootstrap we scope above, and that measurement is now the most important open item in this paper rather than a refinement. 5.9 Cost, latency, and scalability Because this is a data-management pipeline and not merely an LLM prompt, we report its operating cost and scaling behaviour directly from the run logs (var/llm_cache.sqlite;scripts/llm_cost_- audit.py). Cost. The entire body of experiments in this paper (every recon- struction bootstrap and every ask, across Spider (19 databases× six severities×three conditions), BIRD (11 databases), and the in- ternal cohort) cost $281 and consumed 105M tokens over 55,256 model calls. The premium reasoning model (Gemini 3.1 Pro) ac- counts for $137 (72M tokens); the balance is orchestration on a larger model. Per unit the pipeline is inexpensive: a single model call costs a median $0.0024, and reconstructing one column’s se- mantics through the SME pre-flight costs about $0.0027, so a cold catalog for a typical Spider database (20–40 columns) reconstructs for a few cents. Latency. Per-call latency has a low median (5.3 s) but a heavy tail (p90 15 s, p99 57 s). The tail is almost entirely a function of schema width: a single/askissues several model calls (generation plus critic, with retries), and on the widest catalogs, BIRD’scard_- games(115 columns) andcodebase_community(71 columns), the reconstructed schema makes for very large prompts, pushing an end-to-end answer to≈8 minutes against a few seconds on a 20- column schema. This is a real deployment cost we quantify rather than hide: both reconstruction time and answer latency scale with the number of columns the profiler must describe and the prompt then carries. Scaling and the one hard failure. Bootstrap itself scales to these widths. After fixing a single evidence-write defect, a non-finite profiling statistic serialised as the illegal JSON tokenInfinity (Section 5.7), all 11 BIRD databases including the 100+-column giants bootstrap successfully, so the profiler’s hard-failure rate on large schemas is now 0/11; what remains is the query-time cost of wide prompts, not a profiling limit. The scalability questions still open (behaviour at thousands of columns, incremental re-profiling under schema drift, and a prompt budget that grows sub-linearly with catalog size) are engineering work the measured costs above make concrete rather than speculative. 5.10 Leave-one-tenant-out: the abstention gate carries no per-tenant parameters A reviewer’s sharpest generalization concern is that the trap detec- tors and routing signals were authored against the same internal tenants they are scored on, so strong per-tenant numbers may re- flect overfitting to tenant style rather than a gate that transfers. The cleanest answer is architectural and directly verifiable in the catalog: the abstention gate has no per-tenant parameters. The tenant_thresholds table is empty, so every tenant routes on the same global default thresholds (confirm-first at L4 0.55, refuse at 0.20); there are zero per-tenant L4 scoring weights, so every tenant scores on the same global default weight vector; and the trap detec- tors are tenant-agnostic code. Onboarding a tenant fits nothing in the gate. Leave-one-tenant-out is therefore satisfied by construction (removing any tenant leaves the gate bit-for-bit identical), and the empirical question reduces to whether that one frozen gate stays calibrated across tenants of genuinely different shape. It does, and we measure it with execution verification rather than routing alone. Freezing the current configuration, we re-ran each of six synthetic tenants’ full evaluation bank against the live system with every answered query re-executed against that tenant’s own warehouse and its result set compared to the gold query’s. The six tenants span six distinct domains: telecom, e-commerce, insurance, healthcare, manufacturing, and a university registry. The tiered banks encode abstention directly: Tier A/B questions are answer- able, Tiers C/D/E are trap, precision, and unanswerable markers, so over-answering a should-abstain question is a silent error and refusing an answerable one is a false refusal. The table below re- ports it. Pooled across all six tenants the frozen gate answers 46% of questions and is execution-correct on 86% of what it answers (57/66 verified), at a 2% silent-over-answer rate (3/145) and a 0.7% false-refusal rate (1/145). That 86%-accuracy- when-answered lands almost exactly on the external Spider result of Section 5.6 (86% at 59% coverage), on entirely different, real-domain schemas. We designatelumenscroll(a university registry), the last tenant onboarded and the one whose onboarding fit no gate parameters, as the explicit temporal hold-out: on it the frozen gate produces zero silent over-answers, perfect correct-abstention, and, on the seven questions it answers, five execution-correct, the same shape as the tuned-on tenants. The honest caveats remain the per-tenant sample sizes (10–50 questions; lumenscroll’s 0.71 is five of seven) and that these are synthetic warehouses. But the two claims that matter are now execution-grounded rather than route-level: the gate delivers cor- rect answers when it answers and abstains when it should, uni- formly across six heterogeneous tenants and the held-out one; and, because the gate has no per-tenant parameters, it cannot have overfit to any of them. (Runs:scripts/gate67_verified_run.sh; analysis:scripts/gate67_analyze.pyoverpapers/data/gate67_- verified_runs.jsonl.) 5.11 The route confusion matrix A recurring worry about a three-way router is that its route accu- racy is gameable: a policy that simply confirms-first on everything scores well on the trap tier without discriminating anything (Section 32 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses tenantdomainn coverage acc-when-answered silent-error false-refusal correct-abstention telcomarttelecom500.300.87 (13/15)0.130.000.92 acmee-commerce100.401.00 (4/4)0.000.001.00 zenithinsurance250.680.94 (15/16)0.060.000.89 carenexushealthcare250.640.81 (13/16)0.190.061.00 forgemarkmanufacturing180.440.88 (7/8)0.120.001.00 lumenscroll (held-out) university180.390.71 (5/7)0.290.001.00 pooled—1460.460.86 (57/66)0.140.010.96 expected \ actual answer confirm-first refuse total answer641065 confirm-first343349 refuse032831 total674731145 6). The pooled route confusion matrix from the same execution- verified runs (145 questions with a well-defined expected route) shows the gate does not do this. The diagonal dominates. 64 of 65 answerable questions are an- swered; 43 of 49 confirm-first questions are routed to confirm-first; and (the point that refutes the always-confirm strawman) 28 of 31 questions that should be refused are refused outright rather than softened into a confirm. The two dangerous off-diagonals are both small: only 3 of 145 questions are silent over-answers (a should- abstain question routed to answer) and only 1 is a false refusal. The human-confirmation load is moderate and well-targeted: the gate asks a human to confirm on 47 of 145 questions (32%), of which 43 are genuinely borderline (should-confirm), so the confirm-first band is doing discrimination work rather than blanket hedging. This is the non-gameable routing view the metric-definition concern of Section 6 asks for: the gate is scored by its execution-grounded confusion structure, not by a trap-tier accuracy an always-confirm policy could inflate. 5.12 Frozen experimental record Every empirical number in this paper is regenerated from commit- ted cached data by a single script (scripts/build_results_mani- fest.py→ papers/data/results_manifest.json, with LaTeX macros inpapers/latex/results.tex), and a check (scripts/ check_manunumbers.py) fails if the manuscript and the manifest disagree. Two policies, defined once inscripts/results_- lib.pyand applied uniformly, govern the external BIRD/Spider sweeps: Deduplication (keep-last). The severity×condition×evidence sweeps are resumable and append as they run; when a run was resumed it re-processed the boundary questions and appended a second row for the same experimental cell. Every duplicate in our data is confined to one database’s two boundary questions (financial q137/q138): 8 duplicate keys in the reconstruction sweep (the re-run byte-identical) and 12 in the naive sweep (its k=5 self-consistency arm is stochastic, so a few re-runs differ). We keep the last occur- rence per cell and assert that any duplicate outside that known artifact is a hard error, so the committed data files carry zero dupli- cate keys. System-failures are not refusals. A row whose route iserroris an API, JSON-parse, or timeout failure of the LLM pipeline, not a decision by the gate to abstain; folding it into coverage would credit the gate with "refusing" a question it actually crashed on. We exclude such rows from every outcome statistic and report the system-failure rate separately: for the deployed gate, 8.2% at full opacity and 15.7% pooled across all conditions, an operational cost of the structured multi-call reconstruction pipeline. The naive base- line is given the identical treatment; because single-shot generation is a simpler task it produced a parseable answer on every question (0% system-failures), an asymmetry we surface rather than hide, since it means the silent-error comparison of Section 5.7 does not flatter the gate by counting its crashes as principled refusals. 6 Limitations We are deliberately expansive here, because the honest accounting of limitations is, in this project, the principal qualification for peer review. The internal benchmarks are small and self-authored. Eval banks range from 10 to 50 questions per tenant (146 across the gated cohort). The dominant source of run-to-run noise is corpus drift between runs; we report no confidence intervals and no significance tests, and an observed "N = 3, zero variance" is a warm-cache artifact, not evidence of true stability. All warehouses are synthetic. These properties make the numbers in Section 5.5 suggestive of capability but insufficient as external evidence, which is exactly why the external validation of Section 5.6 is needed. Determinism is partly a cache artifact, and the cold-cache query-time variance is now measured. A substantial part of the apparent reproducibility is attributable to an LLM-response cache, and it was precisely a cache-key change under model drift that produced the 0.979→0.918 re-baselining. We treat the 1.000 single-tenant and 0.979 six-tenant peaks as cache-hit / lucky-shot artifacts and do not use them as headline numbers. The previously- unmeasured half of this concession (how much the deployed query path varies when every model call is generated fresh) we have now measured directly: one tenant bank run three times against a stack booted with the cache disabled (30 asks;scripts/coldcache_- variance.py ,papers/data/coldcache_variance.json). The re- sult is the query-time analog of Section 5.1.1’s reconstruction find- ing. The SQL text is genuinely nondeterministic (byte-identical across all three runs on only 2 of 4 always-answered questions, 1.5 distinct query texts per question on average), but the decisions are not: the route is unanimous on 10 of 10 questions among valid sam- ples, the routing score moves by at most 0.021 (mean spread 0.004), and executed-result correctness is identical in all three runs. 1 of 30 asks failed in transport (a system failure under the frozen-record 33 Helwig policy, not a route flip). The system rewords its SQL and does not reword its decisions, on this small bank (one tenant, ten questions), which is the honest scale of the claim. The system, moreover, caught and recorded its own re-baselining: the downward correction is doc- umented verbatim in the regression baseline. The self-correction is a methodological asset even though the underlying variance was, until now, an unmeasured limitation. The detectors were tuned on the questions they score. Be- cause signals and trap detectors were authored against the gated questions, the perfect per-tenant runs (acme 1.000, zenith 1.000) should not by themselves be read as demonstrated generalization. Two things now bound this. First, the external stripped-schema benchmark (Section 5.6) tests the gate on nineteen public databases the detectors were never tuned on. Second, and specific to the over- fitting worry, the abstention gate turns out to have no per-tenant parameters at all (empty threshold-override table, no per-tenant scoring weights; Section 5.10), so leave-one-tenant-out holds by construction and the single frozen gate stays calibrated across six heterogeneous tenants including an explicit temporal hold-out. What remains is to upgrade that route-level, June-configuration result to a fresh HEAD run with execution verification. Metric definitions need defending: partly addressed. Route accuracy on Tier C is, by construction, satisfiable by an always- confirm-first policy; the route confusion matrix of Section 5.11 is the defended alternative, and it shows the gate is not gaming that metric: it refuses 28 of 31 should-refuse questions outright rather than softening them into confirms. Column퐹 1 remains low (≈0.56–0.60) and is currently excused (the benchmark over-specifies expected columns) rather than addressed; the execution accuracy that should replace it is now measured on the internal cohort (Sections 5.10– 5.11) as well as externally on Spider, though scaling it to every internal run remains future work. The selective-prediction advantage is now measured ex- ternally; a generation advantage and uniform calibration are not. As detailed in Section 5.1, token-recall reconstruction quality is measured (0.667 macro), and the controlled selective-prediction mea- surement, which on pooled historical logs returned a negative, and which an evaluation-harness bug initially suppressed (Section 5.1), has now been run correctly on 1,082 execution-labeled Spider samples across 11 databases with database-clustered confidence intervals. The verdict is no longer a split with a weak half: the rout- ing score discriminates correct from incorrect well (normalized AURC 0.26, CI excluding random) and an isotonic map calibrates it (ECE 0.088→0.026). Section 5.6 turns this into the deployed result: a calibrated gate that answers 59% of questions at 86% accuracy [CI 78–93%] with coverage that tracks difficulty, against a naive arm that answers everything at a 58% full-strip silent-error rate. What is not established remains clearly bounded: cold reconstruction does not beat naive on raw generation on these toy schemas (latent accuracy below naive at every severity), and, testing the hypothesis that its generation would help on complex real warehouses, the BIRD breadth study (Section 5.7) finds it does not help there either; the gate’s calibration is not uniform across databases (employee_- hire_evaluationon Spider over-answers with 28 confident errors, andtoxicologyon BIRD similarly over-answers at full strip); the abstention advantage over delivered accuracy is now bounded by the fair baseline (Section 5.6): a cheap naive-plus-abstention gate matches ours on Spider’s toy schemas, so our measured edge is calibration under full opacity (normalized AURC 0.11 vs 0.41–0.47), not delivered accuracy there. Sharpest of all, and reported in full in Section 5.8.1: against a learned selector over generic signals our authority score loses on ranking, calibration, and coverage-at-risk simultaneously, and the authority features add no incremental dis- crimination over those generic signals, so the ladder’s measured value is that it needs no outcome labels, not that it estimates confidence better. We regard resolving this, via the full re-bootstrap ablation of the caps themselves, as the paper’s most important open measurement. Full-Spider breadth (Section 5.7), leave-one-tenant- out with execution verification (Section 5.10), and large-N internal execution accuracy with a route confusion matrix (Section 5.11) have all since been run. We also retract one prior claim outright: a re-weighting "lever" we had reported as doubling discrimination was a four-database small-sample artifact that does not survive to eleven. Diagnosis of the over-answering outliers. The two databases on which the gate over-answers,employee_hire_evaluation(Spi- der) andtoxicology(BIRD), fail in the same way, and the failure is an instance of the authority distinction the architecture is built on. Onemployee_hire_evaluationthe full-strip silent errors are all low-arity aggregations ("count the employees for each city") whose reconstructed columns carry uniformly high catalog confidence (the per-question mean and minimum coincide at≈0.84, so no weak column hides behind a strong average) because the profiler is con- fident about each column’s type (city-like strings, integer counts) while correctness turns on a role the type does not fix: which of several type-homogeneous columns is the intended "city." Ontox- icology, a molecular-chemistry schema, the gate answers more under full opacity than on the clean schema (with names present it correctly recognizes the molecule→atom→bond join complexity and refuses, but a confidently-typed reconstruction pushes it over threshold once names are stripped), and its answers are wrong be- cause that relational structure is unrecoverable from column values. In both cases the routing confidence tracks per-column type recon- struction, which succeeds on type-homogeneous columns, while correctness depends on role (employee_hire_evaluation) or join structure (toxicology) that the reconstruction cannot ground: pre- cisely the evidence-authority gap the ladder is meant to encode (a checksum proving a column holds valid values is not evidence of its business role). The principled remedy, which we have not adopted, is a role-ambiguity cap that lowers confidence when a query must disambiguate among several columns of the same re- constructed type, together with a join-path grounding term inde- pendent of per-column type confidence. We have since measured that signal rather than merely naming it (scripts/recon_role_- ambiguity.py: for every benchmark question, the candidate set of same-reconstructed-type columns its gold SQL must disambiguate among, resolved against the original schema, an oracle instrument that asks whether the signal exists, deliberately not a deployable implementation). Withinemployee_hire_evaluationthe signal’s content is binary and strong: answered questions that reference no non-structural column (bare row counts, zero role-disambiguation demand) are almost always right (35 of 36 across the breadth and answer-region studies), while any question that must pick among 34 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses the schema’s columns is close to a coin flip when answered (ac- curacy 0.575 and 0.471 on the two studies; pooled wrong-vs-right AUC 0.671 and 0.639, p≤0.006), and the routing score is blind to the distinction (Spearman correlation withℓ 4 of 0.059 and 0.04 under the two readings below). A cap would add information the gate does not currently have. The graded count adds nothing beyond that binary within the schema (AUC 0.50 among role-demanding questions, under both a declared-type and a value-shape reading of "same type"): every non-structural column there has a confusable partner, which is exactly why the gate over-answers on it. The same measurement bounds the remedy’s reach. The signal does not separate ontoxicology(answered-vs-withheld AUC 0.529, p = 0.434; consistent with the join-structure attribution above, a dif- ferent mechanism), nor within the other full-strip over-answerers of Section 5.7 (cre_Doc_Template_Mgt,flight_2,battle_death: AUC 0.350–0.583, none distinguishable from chance), so a role- ambiguity cap addresses one diagnosed mechanism, not full-strip over-answering in general. Deploying it stays future work, delib- erately: fitting its threshold after these measurements would be tuning the architecture on the evaluation. The headline selection result is backbone-dependent, and we measured it rather than conceding it. Earlier drafts listed "one model family, no transfer evidence" here as an open limitation. It is now closed, and it did not close in our favour. Re-running arms A and C end to end on Claude Sonnet 4.6 (Section 5.2.8) shows the comparison splits cleanly in two. Everything that does not depend on the model’s disposition transfers: both language- model arms beat the statistical baseline on every facet on both backbones, and the both-claim finding, that the harness writes no better prose than the plain model, reproduces almost exactly (−0.033 /−0.088 /−0.043 against−0.021 /−0.084 /−0.024). What does not transfer is the selection behaviour that Section 5.2.1 iden- tifies as the system’s actual contribution: arm C’s coverage nearly doubles to 0.823 (the naked arm on the same backbone: 0.984) and the evidence-tracking gap goes from +0.257, interval excluding zero, to−0.089, interval spanning zero (no longer detectable). The cause is architectural and we state it plainly: as shipped, the system asks for abstention in a prompt and does not enforce it in code, so a backbone that speculates rather than declines simply specu- lates. The same split appears in the other two model-bearing classes (Section 5.2.9): table abstention falls from 0.164 to 0.000 and the reconstruction-compounds claim of Section 5.2.5 reverses (+0.045 to−0.258), while on the i2b2 clinical warehouse the 44-of-44 NDC abstention becomes an attempt on nearly every drug code with roughly nine in ten wrong (Section 5.2.9 sets the two arms’ failures side by side; the naked arm’s are categorically worse). Across all three, what the system can do transfers and what it declines to do does not, because all three gates are requests to the model rather than rules in the code. The right scoping is by mechanism, not by blanket. The four artifact classes gated in code (joins, hier- archies, glossary/PII, metric mining) transfer by construction. The three prose-gated catalog paths are demonstrated for one back- bone; on a second, the column path keeps a sixteen-point absten- tion margin over the naked model (down from fifty-two) while the value-decode path keeps none, and with the tier gate of Section 5.2.8 enabled, all three refuse in code, identically on every backbone. The query-time gate of Sections 5.6–5.8 is enforced by code thresh- olds over execution-grounded features, and re-running its harvest on the second backbone, four databases×three severities, cold, 290 valid questions of 300 attempted (scripts/spider_gate_- bedrock.sh , analysisscripts/spider_gate_transfer.py, data papers/data/spider_gate_transfer.json), scores its registered predictions as stated. The structure survives: the three-way route stays cleanly monotone in both confidence and accuracy (ℓ 4 0.099/0.520/0.704 across refuse/confirm/answer, latent accuracy 0.057/0.312/0.644), full-strip silent error holds at 16% against the naive always-answer benchmark of 58%, coverage shifts upward as predicted (0.532 vs 0.447 on the 141 identical questions), and accuracy-when-answered degrades some (0.627 vs 0.698). What the swap does not preserve is the numeric calibration: with thresholds fit on the original back- bone’s confidence distribution, the swapped arm emits more silent errors on identical questions (0.199 vs 0.135) and ranks correct above wrong less sharply (raw normalized AURC 0.468 vs 0.274 on the matched slice). The mechanism split is thereby confirmed in both directions: code carries the decision procedure across backbones (monotone routes, selective answering, silent error far below an always-answerer), while the thresholds and feature weights remain per-backbone calibration. The deterministic-evidence, decoding- capability and prose-quality results are demonstrated for two back- bones. Making the three prose gates deterministic was, in earlier drafts, this paper’s most important open item: the single change that converts its strongest claim from a property of one model into a property of the system. It is now implemented and measured (Section 5.2.8), under a protocol registered before implementation and scored on a third backbone and on held-out databases: with the gate on, no-evidence coverage is 0.000 on every backbone by con- struction, recall-when-claimed never degrades (it improves on the two speculating backbones), the prefixed-condition 0/25/43-of-44 spread of NDC decode attempts becomes 0/0/0 in both conditions, and the cross-backbone coverage spread compresses from 0.401 to 0.116 (a floor on abstention, not a ceiling, since each model’s own declines still stack on top). The gate ships default-off so every number in this paper reproduces; what its measurement leaves open is deployment tuning: whether an operator should trade the measured coverage cost (99–295 claims withdrawn per backbone, correct ones among them) for the enforced floor, a choice the per- backbone numbers in Section 5.2.8 are exactly the information for. Our recommendation is concrete: run the gate on wherever catalog prose is consumed without a human review loop (there the enforced floor is worth more than the forgone coverage, and the withdrawn claims are disproportionately the bad ones on exactly the back- bones that need it), and leave it off where an SME reviews commits anyway, which is also the configuration under which every number in this paper was produced. Operational caveats. Ablation conditions are operator-selected via environment variable rather than harness-enforced, which places a discipline burden on the experimenter. Internal execution accu- racy is now measured across the six-tenant cohort (66 execution- verified answered questions, Sections 5.10–5.11) rather than a single 24-run subset, but the per-tenant banks remain small (10–50 ques- tions) and the result-match metric is column-projection-sensitive. We report these so that no reader mistakes the internal evaluation for a settled external benchmark. 35 Helwig 7 Conclusion We have argued that answering questions over real, undocumented enterprise warehouses is fundamentally a metadata-reconstruction problem rather than a translation problem, and we have described a system that treats it as such. The system reconstructs a semantic catalog from the warehouse’s own data through a three-tier deep profiler, bounds the confidence of every reconstructed fact through an authority-tiered ladder in which checksum evidence and docu- mentation evidence are deliberately ranked by what they actually prove, and routes every question to answer, confirm-first, or refuse through deterministic thresholded arithmetic in which the LLM contributes features but never decides the route. Abstention is a first-class, bounded-by-design outcome. The measured internal evidence is encouraging and honestly reported, but it is internal: under controlled ablation on small self- authored banks, reconstruction moves a tenant from 50% to 90% route accuracy with no human in the loop and to 95% with cura- tion; a single-lever ablation is suggestive of a +16.7 p lift from LLM pre-flight alone (three questions on an 18-question bank); the arc reproduces across the six regression-gated tenants plus al- tanova (the eight tenant fixtures span eight verticals); an automated LLM pre-flight reconstruction beats a human SME at lower cost while a human-on-top stack reproducibly regresses; the steady- state six-tenant gate is≈0.932 stable, 0.918 enforced, 0.856 cold; and the system is provider-agnostic, with an Opus→Gemini swap improving adversarial robustness. The engineering substrate (1,648 passing tests (2 skipped), one regression test per fix, full per-fact provenance) is real, and the project’s self-caught re-baselining of its own cache-hit peaks is a model of evaluative honesty. What converts this from an impressive engineering result into a peer-reviewable contribution is now largely run. We have built the parameterizable schema mangler, the reconstruction token-recall scorer (measured 0.667 macro), and the risk-coverage / calibration analyzer. We have run an external Spider stripped-schema study with a matched naive baseline at scale (11 databases, 1,082 execution- labeled questions, database-clustered confidence intervals) and re- ported its result without spin: naive translation degrades from 0.92 to 0.42 execution accuracy under full opacity and silently emits wrong answers on ~58% of stripped questions, while the reconstruc- tion architecture’s calibrated gate answers selectively (86% accuracy [CI 78–93%] over 59% coverage (pooled across the three reconstruc- tion conditions; 82% over 51% for day-1 cold alone), with coverage that tracks difficulty), an externally-measured selective-prediction advantage; on the same samples the routing score discriminates well (normalized AURC 0.26, CI excluding random) and is cali- bratable (ECE 0.088→0.026). It does not, in this cold-bootstrap regime on small schemas, beat naive on raw generation, which we do not claim. We also note that an earlier, smaller version of this study reported the opposite, owing to an evaluation-harness bug we found and fixed (Section 5.1); correcting and re-running our own evaluation at larger scale is itself part of the evidence, of a piece with the project’s self-caught re-baselining of its cache- hit peaks. What remains is the full-Spider breadth sweep, a per- database resolution of the schemas where the gate over-answers, and leave-one-tenant-out generalization on the internal cohort (the fair naive-plus-abstention baseline, once the top remaining item, is now run (Section 5.6), and the BIRD breadth study is now run too (Section 5.7), confirming the generation-negative on real schemas while sharpening the abstention result: under full opacity a naive model’s own confidence goes worse-than-random, so it cannot tell when it is wrong, while the grounded gate still discriminates and avoids≈95% of the naive always-answerer’s silent errors): breadth, not apparatus, and not the abstention guarantee, which the study now confirms externally as a calibrated selective-prediction advan- tage rather than mere total abstention. We believe the architecture’s central commitments (reconstruct before answering, bound confi- dence by evidence authority, and route by deterministic arithmetic so the LLM never arbitrates abstention) are the right ones for the undocumented-warehouse setting, and the external study is the first concrete evidence that the abstention commitment holds, with calibrated selectivity, outside our own fixtures. References [1] Ziawasch Abedjan, Lukasz Golab, and Felix Naumann. 2015. Profiling Relational Data: A Survey. The VLDB Journal 24, 4 (2015), 557–581. doi:10.1007/s00778- 015-0389-y [2] Kaiwen Chen, Yueting Chen, Xiaohui Yu, and Nick Koudas. 2025. Reliable Text- to-SQL with Adaptive Abstention. Proceedings of the ACM on Management of Data 3, 1 (2025). arXiv:2501.10858 doi:10.1145/3709719 [3]C. K. Chow. 1970. On Optimum Recognition Error and Reject Tradeoff. IEEE Transactions on Information Theory 16, 1 (1970), 41–46. doi:10.1109/tit. 1970.1054406 [4]Ran El-Yaniv and Yair Wiener. 2011. Agnostic Selective Classification. In Advances in Neural Information Processing Systems (NeurIPS). [5]Raul Castro Fernandez, Ziawasch Abedjan, Famien Koko, Gina Yuan, Samuel Madden, and Michael Stonebraker. 2018. Aurum: A Data Discovery System. In Proceedings of the IEEE 34th International Conference on Data Engineering (ICDE). 1001–1012. doi:10.1109/ICDE.2018.00094 [6]Dawei Gao, Haibin Wang, Yaliang Li, Xiuyu Sun, Yichen Qian, Bolin Ding, and Jin- gren Zhou. 2024. Text-to-SQL Empowered by Large Language Models: A Bench- mark Evaluation. Proceedings of the VLDB Endowment (2024). arXiv:2308.15363 [7]Yonatan Geifman and Ran El-Yaniv. 2017. Selective Classification for Deep Neural Networks. In Advances in Neural Information Processing Systems (NeurIPS). arXiv:1705.08500 [8] Yonatan Geifman and Ran El-Yaniv. 2019. SelectiveNet: A Deep Neural Net- work with an Integrated Reject Option. In Proceedings of the 36th International Conference on Machine Learning (ICML). arXiv:1901.09192 [9] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. 2017. On Calibration of Modern Neural Networks. In Proceedings of the 34th International Conference on Machine Learning (ICML). arXiv:1706.04599 [10]Jiaqi Guo, Zecheng Zhan, Yan Gao, Yan Xiao, Jian-Guang Lou, Ting Liu, and Dongmei Zhang. 2019. Towards Complex Text-to-SQL in Cross-Domain Database with Intermediate Representation. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics (ACL). arXiv:1905.08205 [11] Alon Halevy, Flip Korn, Natalya F. Noy, Christopher Olston, Neoklis Polyzotis, Sudip Roy, and Steven Euijong Whang. 2016. Goods: Organizing Google’s Datasets. In Proceedings of the 2016 International Conference on Management of Data (SIGMOD). 795–806. doi:10.1145/2882903.2903730 [12]Mike Helwig. 2026. Deterministic by Default: Design Principles for Language Models inside Verification Harnesses. Companion methodology paper. Artifact: https://github.com/mike-m6online/Rosetta. [13]Madelon Hulsebos, Kevin Zeng Hu, Michiel A. Bakker, Emanuel Zgraggen, Arvind Satyanarayan, Tim Kraska, Cagatay Demiralp, and Cesar Hidalgo. 2019. Sherlock: A Deep Learning Approach to Semantic Data Type Detection. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD). 1500–1508. arXiv:1905.10688 [14]Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield-Dodds, Nova DasSarma, Eli Tran- Johnson, et al.2022. Language Models (Mostly) Know What They Know. arXiv preprint arXiv:2207.05221 (2022). arXiv:2207.05221 [15]Haoyang Li, Jing Zhang, Cuiping Li, and Hong Chen. 2023. RESDSQL: Decoupling Schema Linking and Skeleton Parsing for Text-to-SQL. In Proceedings of the AAAI Conference on Artificial Intelligence. arXiv:2302.05965 [16]Jinyang Li, Binyuan Hui, Ge Qu, Jiaxi Yang, Binhua Li, Bowen Li, Bailin Wang, Bowen Qin, Ruiying Geng, Nan Huo, Xuanhe Zhou, Chenhao Ma, Guoliang Li, Kevin Chang, Fei Huang, Reynold Cheng, and Yongbin Li. 2023. Can LLM Already Serve as a Database Interface? A BIg Bench for Large-Scale Database 36 Metadata Reconstruction from Values Alone: Recovering Column Semantics in Undocumented Warehouses Grounded Text-to-SQLs. In Advances in Neural Information Processing Systems (NeurIPS). arXiv:2305.03111 [17]Terrance Liu, Shuyi Wang, Daniel Preotiuc-Pietro, Yash Chandarana, and Chirag Gupta. 2025. Calibrating LLMs for Text-to-SQL Parsing by Leveraging Sub- clause Frequencies. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 16958–16982. arXiv:2505.23804 [18] Alexandru Niculescu-Mizil and Rich Caruana. 2005. Predicting Good Probabilities with Supervised Learning. In Proceedings of the 22nd International Conference on Machine Learning (ICML). 625–632. doi:10.1145/1102351.1102430 [19]Thorsten Papenbrock, Tanja Bergmann, Moritz Finke, Jakob Zwiener, and Fe- lix Naumann. 2015. Data Profiling with Metanome. Proceedings of the VLDB Endowment 8, 12 (2015), 1860–1863. doi:10.14778/2824032.2824086 [20] Thorsten Papenbrock, Sebastian Kruse, Jorge-Arnulfo Quiané-Ruiz, and Felix Naumann. 2015. Divide & Conquer-based Inclusion Dependency Discovery. Pro- ceedings of the VLDB Endowment 8, 7 (2015), 774–785. doi:10.14778/2752939. 2752946 [21]John C. Platt. 1999. Probabilistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods. In Advances in Large Margin Classifiers. MIT Press, 61–74. [22]Mohammadreza Pourreza and Davood Rafiei. 2023. DIN-SQL: Decomposed In- Context Learning of Text-to-SQL with Self-Correction. In Advances in Neural Information Processing Systems (NeurIPS). arXiv:2304.11015 [23]Robert Richardson. 2026. What Predicts Correctness in Text-to-SQL? A Selective- Prediction Study. arXiv preprint arXiv:2607.06799 (2026). arXiv:2607.06799 [24]Alexandra Rostin, Oliver Albrecht, Jana Bauckmann, Felix Naumann, and Ulf Leser. 2009. A Machine Learning Approach to Foreign Key Discovery. In Pro- ceedings of the 12th International Workshop on the Web and Databases (WebDB). [25]Bailin Wang, Richard Shin, Xiaodong Liu, Oleksandr Polozov, and Matthew Richardson. 2020. RAT-SQL: Relation-Aware Schema Encoding and Linking for Text-to-SQL Parsers. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics (ACL). arXiv:1911.04942 [26]Bingbing Wen, Jihan Yao, Shangbin Feng, Chenjun Xu, Yulia Tsvetkov, Bill Howe, and Lucy Lu Wang. 2025. Know Your Limits: A Survey of Abstention in Large Language Models. Transactions of the Association for Computational Linguistics (TACL) (2025). arXiv:2407.18418 [27] Xiaojun Xu, Chang Liu, and Dawn Song. 2017. SQLNet: Generating Structured Queries from Natural Language without Reinforcement Learning. arXiv preprint arXiv:1711.04436 (2017). arXiv:1711.04436 [28]Tao Yu, Rui Zhang, Kai Yang, Michihiro Yasunaga, Dongxu Wang, Zifan Li, James Ma, Irene Li, Qingning Yao, Shanelle Roman, Zilin Zhang, and Dragomir Radev. 2018. Spider: A Large-Scale Human-Labeled Dataset for Complex and Cross-Domain Semantic Parsing and Text-to-SQL Task. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing (EMNLP). 3911–3921. arXiv:1809.08887 doi:10.18653/v1/d18-1425 [29] Bianca Zadrozny and Charles Elkan. 2002. Transforming Classifier Scores into Accurate Multiclass Probability Estimates. In Proceedings of the Eighth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD). 694–699. doi:10.1145/775047.775151 [30] Meihui Zhang, Marios Hadjieleftheriou, Beng Chin Ooi, Cecilia M. Procopiuc, and Divesh Srivastava. 2010. On Multi-Column Foreign Key Discovery. Proceedings of the VLDB Endowment 3, 1–2 (2010), 805–814. doi:10.14778/1920841. 1920944 [31] Victor Zhong, Caiming Xiong, and Richard Socher. 2017. Seq2SQL: Generating Structured Queries from Natural Language using Reinforcement Learning. arXiv preprint arXiv:1709.00103 (2017). arXiv:1709.00103 37