card: add limits (1.7B text policy, synthetic data, N=18 null)

README.md

@@ -37,3 +37,7 @@ from mlx_lm.lora import load
 path = snapshot_download("caiotheodoro/plumb-blended")
 model, tokenizer = load("mlx-community/Qwen3-1.7B-4bit", adapter_path=path)
 ```
+
+## Limits
+
+A 1.7B text policy, not the 27B multimodal production model. It reads the pay application as structured text rather than a rendered scan, so OCR is out of scope. All data is synthetic: generated AIA G702/G703 pay applications, not real contractor filings. CIs are 95% bootstrap, 10,000 resamples, seed 11, over the same 1000-task seed-777 benchmark. The clean-protocol N=18 arms and the pow-* / leaked-anchor grows are a null result and are not published as weights.