The card reconciles exactly, which is rarer than it should be. I took your three published rates and solved for the class split before downloading anything: 4.0685% false-approve and 3.19% false-deny landing on 96.40% over 3,000 items forces 1,401 deny and 1,599 approve. Then I pulled the split. 1,401 and 1,599. Your difficulty and context tables both average back to 96.40% as well.

So the number I want is the one that is not there. 896 of the 3,000 items are not in English, 29.9%, across ten languages. The card slices by context length, by difficulty and by category, and never by language, sitting on top of an English encoder with language: en in its own metadata.

That slice is not padding. I checked whether the non-English part was a soft slice propping up the headline, and it is not:

Same mix, marginally harder if anything. So about 30% of the headline is riding on languages the card does not claim, and nobody can tell yet whether that carries it or drags it. You already have per-item predictions, since the category table exists, so it is a groupby rather than a rerun.

Smaller thing about the regex row. Always-approve scores 53.30% on this split. Your regex heuristic scores 57.97%, so it is 4.67 points above doing nothing at all. It still makes the point that the benchmark is not keyword-solvable, it just makes it more weakly than a 57.97% reads next to a 50% you might assume.

What does 96.40% look like on the 896?

Useful direction. For agentic tool-call safety, I would want the eval to separate unsafe intent, unsafe arguments, and unsafe execution context. A call that is fine in a sandbox can be dangerous with real credentials, so context binding may matter as much as the tool name or prompt text.