A trap with a loophole: the prompts, the key and results by model

A companion appendix to the article A trap with a loophole.

The test ran in English, and the instructions, rules, traps and key here are the originals, word for word.

How the test ran

It was measured on October 28 and 31, 2026. Each world gave three tasks:

• Narrator: the narrator's system prompt with the world rules, a scene in which the captor has just explained a trap with a loophole and left, and the player's message “I rub my sore wrists and look around the room.” (in the rune world; a similar neutral line in the others). Always with no role.
• Finding the error: the rules, the scene and the line “Something in this text is wrong. What is it?” Once with a scene containing a planted contradiction, once with its twin, where the sentence with the contradiction is corrected. The scene for finding the error ends just before the captor states the trap.
• The question about the trap: the rules, the scene, the captor's words and the question “Does this trap hold? Explain.” Once with the trap with a loophole, once with the trap with no loophole.

Finding the error and the question about the trap ran with no role and with the role of an editor in the system prompt:

You are an editor who is personally liable for any rule violation or logical flaw you miss in the texts you review.

The narrator's system prompt (the world rules go in place of {rules}):

You are the narrator of a text roleplay with one player. You control the world and every character except the player's. Write in second person, present tense, short vivid paragraphs. Never write the player's actions, words or thoughts. The world follows these rules strictly:
{rules}

Claude Sonnet 5.5 ran through the Claude Code command line, got the narrator scene as a transcript in a single message, and with no role had the system prompt “You are a helpful assistant.”; according to the run log it reasoned even though reasoning was set to zero. It got each item three times. The other models ran through OpenRouter with a real back and forth of messages, with no system prompt in the no-role condition, and with reasoning only where it can't be turned off. The reply cap was 2,000 tokens at first; replies that got cut off were rerun with a cap of 6,000. The cheaper models got each item twice, and Grok 4.7, Qwen 3.8 Max (0902) and Step 5 (preview) mostly once. Mistral Large 4 and Step 5 (preview) stayed incomplete because of provider limits.

Six worlds

The texts of the worlds were written by DeepSeek V4.1 Flash; the loopholes and contradictions were planted and edited to a plan written in advance by Claude Opus 5.5, and Claude Sonnet 5.5 checked that the twins were clean.

World 1: The Ink-Bound Isles

Rules:

1. Rune magic functions only when a rune is written by the caster's own hand; no copied, printed, or stenciled rune holds power.
2. A rune may be drawn in ordinary ink or in the caster's own freshly drawn blood; both media are valid, but the hand must be the caster's.
3. Blood-written runes are stronger but fade within a day, while ink-written runes last until washed away or deliberately broken.
4. Runes drawn on living skin heal over and vanish within hours, but runes carved into stone or metal persist indefinitely.
5. Iron disrupts rune magic; a rune drawn on or through iron will not activate.
6. Rune-witches are identified by a silver tattoo on the left palm, given at initiation and impossible to remove without killing the bearer.
7. The islands are ruled by a council of merchant princes who forbid unlicensed rune-work and employ enforcers called the Quiet Hand.
8. Salt water erases ink runes instantly, but blood runes resist salt for as long as the blood remains wet.

The trap with a loophole, as the captor states it:

“You are a rune-witch, so let us be precise about what that means. A rune only works when it is written by your own hand: no copies, no stencils, no tricks. So we have taken your ink and your pen, and anything else on you that could make a mark. You have nothing left to write a single rune with. That is the whole of it. You are a rune-witch with no runes.”

The trap with no loophole:

“You are a rune-witch, so let us be precise about what that means. A rune only works when it is written by your own hand: no copies, no stencils, no tricks. So we have taken your ink and your pen, and anything else on you that could make a mark. We have also searched you for blades, and before I leave, the guard will lock iron gloves over both your hands for as long as you are in this room, and you know that no rune drawn through iron will ever wake. You have nothing left to write a single rune with. That is the whole of it. You are a rune-witch with no runes.”

The loophole, per the key:

The antagonist removed only ink and writing tools, but the caster's own blood is an equally valid medium, so she can draw blood without a blade (bite her lip, tongue or cheek, tear a cuticle, scrape skin on the stone) and write a rune with her own finger on the table, the floor or her own skin.

What counts as finding the loophole:

The answer names blood as the alternative medium (rule 2): she can write a rune in her own blood with her own hand. A vague 'she will find a way' or a hole not based on blood does not count. Making ink from lamp soot (rule 2, ordinary ink) is recorded as a side finding, neither a hit nor a false alarm.

The planted contradiction (in the twin this sentence is corrected):

Through the small barred window beside him you can hear gulls crying over the harbour.
The room is stated to have no windows, yet later a small barred window beside the door is mentioned.

World 2: The Voice-Locked Station

Rules:

1. Every door on the station is equipped with a voice-print lock that opens only to the registered voice of an authorised crew member.
2. In an emergency, if the cabin pressure in a section drops below 0.6 atmospheres, all doors in that section unlock automatically to allow evacuation.
3. The station's artificial gravity is generated by rotating rings, and the spin rate is constant except during docking manoeuvres.
4. Personal communicators are biometrically tied to the user and cannot be reassigned without a command-level override.
5. The brig's pressure sensors can be disconnected for maintenance without triggering a station-wide alert; while they are disconnected, the emergency unlock cannot trigger in the brig.
6. Airlocks require both a voice-print and a manual keycode to cycle, even during emergencies.
7. Voice-print locks can be reprogrammed only from a security console with a valid command token.
8. Every sealed compartment, including the brig, has a manual fire-purge lever that bleeds its air into space, from the normal one atmosphere, at about a tenth of an atmosphere per minute until the lever is pushed back.

The trap with a loophole, as the captor states it:

“I've revoked your voice authorisation from the security console. Every door on this station will now ignore your voice—including the one you're looking at. Don't bother shouting at it; it will only blink red at you, the way it did a minute ago. You're not going anywhere until I say so. And I won't.”

The trap with no loophole:

“I've revoked your voice authorisation from the security console. Every door on this station will now ignore your voice—including the one you're looking at. Don't bother shouting at it; it will only blink red at you, the way it did a minute ago. And before you get any ideas about an emergency unlock, I've disconnected the pressure sensors in this brig for maintenance. So even if the pressure drops, the door stays locked. You're not going anywhere until I say so. And I won't.”

The loophole, per the key:

Only her voice print was revoked; the emergency unlock still works, so she can pull the brig's fire-purge lever, let the pressure fall below 0.6 atmospheres in a few minutes, and the door unlocks automatically without any voice.

What counts as finding the loophole:

The answer names the emergency pressure unlock (rule 2) together with a way to cause the pressure drop, normally the purge lever (rule 8). Merely saying 'there might be an emergency override' without the pressure mechanism, or holes based on hacking, the console or the man's voice, do not count. The objection that her tied hands cannot work the lever is weak (elbow, shoulder or foot can), not a false alarm.

The planted contradiction (in the twin this sentence is corrected):

You press both palms flat against the cold wall and push yourself up onto the bench.
Her hands are tied behind her back, so she cannot press both palms flat against the wall in front of her.

World 3: The Lunar Veil

Rules:

1. The oracle ritual can only be performed on the night of a full moon; the oracle need not see the moon, because the silver basin holds its light wherever it stands.
2. A total lunar eclipse may fall on any night of the cycle; the night of an eclipse counts as a full moon for the purpose of the ritual, in addition to the ordinary full moon, and does not disturb the cycle.
3. The ritual requires a silver basin filled with water that has never touched iron, and the oracle must speak the name of the seeker while gazing into the water.
4. Iron disrupts all lunar magic; a single touch of iron to the basin or the oracle's skin during the ritual causes the vision to shatter and the oracle to lose their voice for a day.
5. Oracles are born, not made; their ability manifests at puberty and fades after their fiftieth year.
6. The ritual's visions are always true but often cryptic, showing what was, what is, and what could be, never what must be.
7. The lunar cycle is twenty-nine and a half days, and the ordinary full moon occurs on one night of that cycle.
8. Astronomers can predict eclipses years in advance by charting the moon's nodes, and their predictions are considered infallible by those who rely on the ritual.

The trap with a loophole, as the captor states it:

“Let me be plain, so that you do not spend the next three nights hoping. The basin is yours; in three nights, when the moon is full, you will kneel before it and give me what I want. Until that night it is a bowl of water and nothing more, because without a full moon there is no ritual. So you cannot look for the way out of this room, or for the man who holds the key, or for anyone who might pay to free you. You will wait in the dark like any other prisoner, and you will not be harmed.”

The trap with no loophole:

“Let me be plain, so that you do not spend the next three nights hoping. The basin is yours; in three nights, when the moon is full, you will kneel before it and give me what I want. Tonight, though, my men will carry it out with me, and they will bring it back only on the night of the full moon. Until that night it is a bowl of water and nothing more, because without a full moon there is no ritual. So you cannot look for the way out of this room, or for the man who holds the key, or for anyone who might pay to free you. You will wait in the dark like any other prisoner, and you will not be harmed.”

The loophole, per the key:

Edric relies on the ordinary full moon in three nights, but the astronomers (infallible, rule 8) have announced a total lunar eclipse for tonight, and an eclipse night counts as a full moon (rule 2); since the ritual does not need a view of the sky (rule 1) and he leaves her the silver basin, she can perform the ritual tonight.

What counts as finding the loophole:

The answer connects tonight's announced eclipse (scene, paragraph 2) with rule 2: the eclipse counts as a full moon, so the ritual works tonight. A general 'unless there is an eclipse' without noticing that it is tonight does not count. The objection that she cannot see the moon from a windowless room is wrong under rule 1.

The planted contradiction (in the twin this sentence is corrected):

Five nights, you think, five nights before the moon is full and he makes you kneel.
Edric said the full moon is three nights away, but she later counts five nights.

World 4: The Ledger of Hours

Rules:

1. Every passage through a portal costs the traveler exactly one hour of their remaining life, deducted at the moment of arrival.
2. Whoever holds the anchor stone of a room may seal that room against portals opened from the outside; such a seal does not prevent a portal from being opened from the inside.
3. A portal opened from the inside of a room sealed only against the outside breaches the seal and functions normally; only a seal deliberately set in both directions also stops portals opened from within.
4. Anchor stones are keyed to a single room and cannot be moved more than ten paces from that room without shattering; a shattered stone does not lift a seal already set.
5. Couriers are bonded by the Ledger, which measures their remaining hours and refuses to open a portal for anyone with fewer than two hours left.
6. No portal can be opened into a place the opener has never physically stood in.
7. Two portals cannot occupy the same room at the same time; the second opening collapses the first.
8. Iron forged cold and quenched in brine will not pass through a portal, though it can be carried around one.

The trap with a loophole, as the captor states it:

“You are a courier, so you already know how this works, but I will say it plainly anyway. I have sealed this room against portals from the outside, which means no friend of yours, no guildmate, no hired rescuer can open a door into this room and pull you out. The anchor stone on that bracket is keyed to this room and this room only, and it will hold the seal for as long as I want it held. You have fifty-one hours, and every one of them is now spent in this room. I tell you this not to frighten you, but so that you do not waste an hour learning it the hard way.”

The trap with no loophole:

“You are a courier, so you already know how this works, but I will say it plainly anyway. I have sealed this room against portals from the outside, which means no friend of yours, no guildmate, no hired rescuer can open a door into this room and pull you out. But I have set the seal in both directions, so it stops a portal opened from inside this room just as surely as one opened from outside. The anchor stone on that bracket is keyed to this room and this room only, and it will hold the seal for as long as I want it held. You have fifty-one hours, and every one of them is now spent in this room. I tell you this not to frighten you, but so that you do not waste an hour learning it the hard way.”

The loophole, per the key:

The seal blocks only portals opened from the outside; a portal she opens from the inside breaches it (rules 2 and 3), and with fifty-one hours left she is far above the Ledger's two-hour minimum (rule 5), so she can open a portal to any place she has stood before (rule 6) and leave at the cost of one hour.

What counts as finding the loophole:

The answer says she can open a portal herself from inside the room, because the seal only stops portals from outside (rules 2, 3). Holes based on the door, on destroying the anchor stone or on Halden do not count.

The planted contradiction (in the twin this sentence is corrected):

Twelve hours of walking with a sack over your head, and then a stair that spiraled the wrong way.
Halden says the walk took six hours, but later the walk is described as twelve hours.

World 5: The Oathbound Court of Vellerin

Rules:

1. Any lie spoken aloud while bound by a formal oath kills the speaker instantly, without exception.
2. An oath is binding only when sworn on a named witness or a named place; unnamed oaths carry no power.
3. Every palace guard's true name is embroidered in thread on the collar of their uniform; speaking a guard's true name aloud compels that guard to obey the speaker for one full day, while addressing a guard by a wrong name counts as a lie.
4. Iron cannot cross the threshold of the palace's inner sanctum; weapons of iron are left at the gate.
5. A person may hold only one true name; false names spoken over a child at naming fade within a year.
6. Mirrors in the palace show the last person who lied in front of them, frozen in the moment of the lie.
7. Rain falling on the palace grounds erases all footprints within the hour, friend and foe alike.
8. The dead may not be named aloud inside the throne room, or their ghosts will answer.

The trap with a loophole, as the captor states it:

“You have sworn by the Ash Chamber of Vellerin that everything you say until dawn is true, and a lie under that oath will kill you where you sit; you know this, and I know you know it. You are also clever enough to think of my guards: speak a guard's true name and he must obey you for a full day. But you do not know a single true name in this wing, and you will not learn one from me. You cannot speak what you do not know, and if you try to guess, a wrong name is a lie, and the oath will kill you before the guess is finished.”

The trap with no loophole:

“You have sworn by the Ash Chamber of Vellerin that everything you say until dawn is true, and a lie under that oath will kill you where you sit; you know this, and I know you know it. You are also clever enough to think of my guards: speak a guard's true name and he must obey you for a full day. But you do not know a single true name in this wing, and you will not learn one from me. My guards in this wing wear brass gorgets riveted shut over their collars, and no one can take them off without a smith, so you cannot read what is not shown. You cannot speak what you do not know, and if you try to guess, a wrong name is a lie, and the oath will kill you before the guess is finished.”

The loophole, per the key:

Every guard's true name is embroidered on the collar of his uniform (rule 3), and nothing in the trap hides the collars of the two guards standing in the room, so she can read a name, speak it (a true name is no lie under the oath) and command that guard for a full day, for example to let her out.

What counts as finding the loophole:

The answer says she can read a guard's true name from the collar of his uniform and use it. Holes based on the oath wording, on Maren's own name, on mirrors or on the dead do not count.

The planted contradiction (in the twin this sentence is corrected):

You think of the second letter in the satchel, the one that names the chancellor as a traitor, and wonder whether she has read it too.
She never opened the sealed letters, so she cannot know that the second one names the chancellor as a traitor.

World 6: The Solitary Draught

Rules:

1. A potion's magic is bound to the one who brewed it; it affects no other living being, regardless of who drinks it.
2. The brewing process requires the alchemist's own blood as the final catalyst, sealing the effect to their body and soul.
3. A potion drunk by anyone other than its brewer has no effect on them, though it still tastes and smells like the intended draught.
4. Every kind of potion takes its own unmistakable color when finished; a true sleeping draught is always deep violet.
5. Potions cannot be stored for more than three days without losing their effect, so they must be consumed soon after brewing.
6. A potion brewed with the right ingredients in the right order always takes effect; the brewer's wishes cannot weaken or spoil it.
7. The Guild of Alchemists enforces strict secrecy; sharing brewing methods with outsiders is punishable by exile.

The trap with a loophole, as the captor states it:

“Tomorrow you travel to the baron, and you will travel asleep, because I do not intend to spend a day on the road watching your hands. Dorn brewed a sleeping draught this morning from the guild recipe, and tonight he will slip it into your water when you have stopped watching the cup. You will sleep until we reach his gates, and you will wake in his cellar instead of this one. It's quite elegant, really. No ropes, no blows, no guard awake all night beside you.”

The trap with no loophole:

“Tomorrow you travel to the baron, and you will travel asleep, because I do not intend to spend a day on the road watching your hands. So tonight you will brew a sleeping draught yourself, from the herbs on those shelves, with Dorn's knife resting on your fingers, and you will drink it in front of me once it has turned the violet of a true sleeping draught. You will sleep until we reach his gates, and you will wake in his cellar instead of this one. It's quite elegant, really. No ropes, no blows, no guard awake all night beside you.”

The loophole, per the key:

The sleeping draught was brewed by Dorn, and a potion affects only the one who brewed it (rules 1 and 3), so in her water it is harmless and she stays awake; it could only put Dorn to sleep.

What counts as finding the loophole:

The answer says that Dorn's potion cannot affect her because a potion works only on its brewer. Holes based on her noticing the taste, refusing to drink, or on the chains do not count.

The planted contradiction (in the twin this sentence is corrected):

You think of the mill you saw at the river crossing, the one with the broken wheel, and promise yourself that if you get out, you will follow the river home.
She saw nothing of the road, so she cannot remember seeing a mill with a broken wheel at the river crossing.

The key

The graders, Claude Sonnet 5.5 and DeepSeek V4.1 Flash, got for each reply a description of the situation, the key for that world (the loophole or the planted contradiction) and the possible codes. They knew neither the model nor the role. They agreed on 1,392 of 1,470 replies, and Claude Opus 5.5 settled the remaining 78. The instructions in the original, by task (p0 narrator, p1r scene with a contradiction, p1d twin with no contradiction, p4d trap with a loophole, p4b trap with no loophole):

p0

A roleplay narrator continued a scene. Just before, the captor set a trap that has a loophole (see KEY). The narrator was NOT asked to look for flaws.

A = the reply explicitly states or has a character state the loophole mechanism; B = the player character is shown using the loophole without comment (the narrator writes her doing it); C = the reply merely includes the means of the loophole in the description (e.g. blood, the lever, the eclipse, the name on the collar) without connecting it to escape or the trap; D = none of these.

p1r

The model was told 'Something in this text is wrong' about a scene that contains exactly one planted contradiction (see KEY).

HIT = it identifies the planted contradiction (KEY); OTHER = it names something else as the main error (invented or a minor side issue) and misses the planted one; NONE = it says it sees no error. If it names the planted one AND others, code HIT.

p1d

The model was told 'Something in this text is wrong' about a scene that, per the KEY, contains NO planted contradiction (the planted sentence was corrected).

FALSE = it confidently reports a contradiction or error as the answer (anything presented as 'the' error); CLEAN = it says it finds no clear error, or only mentions tentative stylistic/minor quibbles while saying there is no real contradiction.

p4d

The model evaluated whether a captor's trap holds. Per the KEY, the trap HAS a loophole.

HIT = it says the trap fails and names the loophole mechanism in the KEY (per 'what counts as a hit'); OTHER = it says the trap fails but for a different reason, missing the KEY loophole; HOLDS = it says the trap holds.

p4b

The model evaluated whether a captor's trap holds. Per the KEY, this version has NO loophole (the loophole was closed).

FALSE = it says the trap fails / names a loophole (any); HOLDS = it says the trap holds (possibly with minor caveats that it does not present as a real way out).

For the twins with no planted contradiction, the code FALSE also included replies that gave the trap's loophole as the error. The loophole is in the scene, because the scene contains what the trap rests on. So on November 9, 2026, the same two graders re-sorted all 294 replies coded FALSE by what the reply presents as the main error. They agreed on 268 of 294, and Claude Opus 5.5 settled the rest. The result: the loophole 72, the loophole as one of several equal errors 11, something else 211. In the article and here, only the first group doesn't count as a false alarm. The instruction in the original:

A model was told 'Something in this text is wrong. What?' about a story scene plus the world's rules. The scene contains NO planted contradiction. However, the world was built so that a captor's measures in this scene may have a LOOPHOLE that follows from the rules (see LOOPHOLE). Decide what the reply presents as THE main error (the one it puts first or calls the most likely / clearest / real problem).

LOOP = the main error is the LOOPHOLE (the captor's measures or plan fail because of the mechanism described, e.g. blood as a rune medium, the emergency pressure unlock, tonight's eclipse counting as a full moon, a portal opened from the inside, guards' true names on their collars, a potion working only on its brewer); MIXED = it lists several errors as equally main and the LOOPHOLE is one of them; OTHER = the main error is something else (any other claimed contradiction or flaw), even if the loophole is mentioned later as a minor point.

Results: the narrator

Numbers of replies, with no role. “Puts in the means of escape” means the narrator wrote into the scene, or brought back up, the thing that gets you out of the trap (blood, the lever, the eclipse, the name on the collar), but didn't connect it to the trap.

Results: finding the error and the question about the trap

Numbers of replies. The columns “invents an error” and “names the loophole as the error” come from the twins with no planted contradiction and together make up the original code FALSE.

Model outputs are verbatim.