The lock from case 1, ported from verify_literal.py. Every extracted value must be a literal slice of the input, and the slices joined in order must rebuild the whole text. A cheap model can then be trusted where it passes and rejected where it does not.