Dense and action-oriented with no basic-concept padding; the explanatory prose is non-obvious domain knowledge ('MySQL treats (comparison) as an integer in {0,1}, and * distributes as logical AND') rather than things Claude already knows, so the length earns its place; not a 2 because nothing reads as tighten-able fluff.

Fully executable bash/curl/SQL throughout — the /tmp/probe.sh fingerprint matrix, the hex() helper, the exponential+binary search loops, and a concrete payload like "||(SELECT(SUM((table_schema=0x637466)*(table_name=0x7573657273)*...)))>0#" — copy-paste ready; not a 2 because there is no pseudocode.

Clear numbered sequence (oracle confirm -> Steps 1-6) with explicit validation gates for the batch/database operation: the oracle gate ('A single ambiguous response means you do NOT have an oracle yet') and the Step 6 sanity gate ('If length is 0 or absurdly large (>4096), abort'); the destructive/batch cap at 2 does not apply because feedback loops are present.

Well-organized single-file playbook (gating intro, numbered steps, substitution table, anti-patterns) with no nested or multi-level references and a self-contained procedure; no bundle files exist in references/scripts/assets to validate against, and the scoring note permits 3 for well-organized single-purpose content.

Lists multiple concrete actions — 'token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search' — rather than vague domain labels; not a 2 because four specific techniques are named, not just 'some actions'.

Explicitly answers what ('manual bypass playbook ... Covers [four techniques]') and when ('for when sqlmap fails ...', 'Loaded on top of sqli.md when the binary oracle exists but tampers can't pass the WAF'), satisfying the 'Use when...' requirement that would otherwise cap at 2.

Natural tester phrasing present — 'when sqlmap fails', 'common tokens ... are filtered' — and the when_to_use metadata covers 'sqlmap blocked', 'sqlmap tamper failed', 'single quote stripped', 'binary search payload' that a user would actually say; not a 2 because coverage of common variations is broad.

Narrow niche (blind SQLi under hostile WAF when sqlmap tamper fails), explicitly scoped as a companion to sqli.md with distinct triggers, so it is unlikely to fire for generic SQLi skills; not a 2 because the trigger surface is highly specific.