@chrono-meta/fh-gate 3.2.0 → 3.4.0

package/scripts/finding_pipeline.sh

@@ -30,13 +30,20 @@ set -uo pipefail
 
 SUPPORTED_FAMILIES="codex gemini"          # must match finding_verifier.sh's own case statement
 
-TARGET=""; OUT=""; FLEET=""
-usage() { echo "usage: finding_pipeline.sh <target-file> --out <dir> [--fleet <table>]" >&2; exit 2; }
+TARGET=""; OUT=""; FLEET=""; SEEDED_IDS=""; SEEDED_FILE=""; SEEDS_ROUTED=""; ROUND2=0; ROUND2_BLIND=0; R1_ONLY=0; REUSE_R1=""
+usage() { echo "usage: finding_pipeline.sh <target-file> --out <dir> [--fleet <table>] [--round2|--round2-blind] [--r1-only] [--reuse-r1 <dir>] [--seeded <ids>] [--seeded-file <path>]" >&2; exit 2; }
 need() { [ $# -ge 2 ] || { echo "finding_pipeline: $1 needs a value" >&2; exit 2; }; }
 [ $# -ge 1 ] || usage
 TARGET="$1"; shift
 while [ $# -gt 0 ]; do
   case "$1" in
+    --round2)      ROUND2=1; shift ;;
+    --round2-blind) ROUND2=1; ROUND2_BLIND=1; shift ;;
+    # 짝지음(paired) — 플래그만 fleet 으로 통과시킨다(측정 층은 fleet 이다). RESULT §15 잔여 참조.
+    --r1-only)     R1_ONLY=1; shift ;;
+    --reuse-r1)    REUSE_R1="${2:-}"; shift 2 ;;
+    --seeded)      need "$@"; SEEDED_IDS="$2"; shift 2 ;;
+    --seeded-file) need "$@"; SEEDED_FILE="$2"; shift 2 ;;
     --out)   need "$@"; OUT="$2"; shift 2 ;;    # `shift 2` on a trailing flag consumes nothing and
     --fleet) need "$@"; FLEET="$2"; shift 2 ;;  # spins forever; codex reproduced the hang.
     *) usage ;;
@@ -57,13 +64,31 @@ umask 077
 mkdir -p "$OUT" || { echo "finding_pipeline: cannot create --out" >&2; exit 2; }
 # 🟥 미리 깔린 심링크를 따라가면 «출력»이 남의 파일 truncate 가 된다. 리다이렉션도 open() 도
 #    심링크를 따라간다 — 그래서 쓰기 «전»에 거부한다(cross-family review 2026-09-09).
-for _p in "$OUT" "$OUT/fleet" "$OUT/confirmed.jsonl" "$OUT/dropped.jsonl" "$OUT/splits.txt" "$OUT/families.txt"; do
+for _p in "$OUT" "$OUT/fleet" "$OUT/confirmed.jsonl" "$OUT/dropped.jsonl" "$OUT/splits.txt" "$OUT/families.txt" "$OUT/roster.txt" "$OUT/roster.err" "$OUT/families.err"; do
   if [ -L "$_p" ]; then
     echo "finding_pipeline: refusing to write through a symlink: $_p" >&2; exit 2
   fi
 done
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# 씨앗 선언을 «작업 시작 전» 에 확정한다 — verify 쪽과 같은 규율(빈 파일·디코드 오류는 설정 오류다)
+ALL_SEEDS="$SEEDED_IDS"
+if [ -n "$SEEDED_FILE" ]; then
+  _FROM_FILE=$(/usr/bin/python3 -c '
+import sys
+try:
+    with open(sys.argv[1], encoding="utf-8") as fh:
+        ids = [l.strip() for l in fh if l.strip() and not l.startswith("#")]
+except (OSError, UnicodeDecodeError) as e:
+    print("finding_pipeline: --seeded-file unusable: %s" % e, file=sys.stderr); sys.exit(2)
+if not ids:
+    print("finding_pipeline: --seeded-file %r yielded no ids — a control file that declares "
+          "nothing is a disabled control, not an absent one" % sys.argv[1], file=sys.stderr)
+    sys.exit(2)
+print(",".join(ids))' "$SEEDED_FILE") || exit 2
+  ALL_SEEDS="${ALL_SEEDS:+$ALL_SEEDS,}$_FROM_FILE"
+fi
+
 FLEET_SH="$HERE/finding_fleet.sh"; VERIFY_PY="$HERE/finding_verify.py"; VERIFIER_SH="$HERE/finding_verifier.sh"
 for f in "$FLEET_SH" "$VERIFY_PY" "$VERIFIER_SH"; do
   [ -f "$f" ] || { echo "finding_pipeline: missing $f — skipped, NOT passed" >&2; exit 3; }
@@ -86,9 +111,68 @@ argv_json() {  # each argument becomes one JSON string — no shell ever parses
 # the second family and make a single-family run look cross-verified.
 /bin/rm -rf "$OUT/fleet"
 FA=(); [ -n "$FLEET" ] && FA=(--fleet "$FLEET")
-bash "$FLEET_SH" "$TARGET" --out "$OUT/fleet" ${FA[@]+"${FA[@]}"} 2>&1 | tee "$OUT/fleet_run.log"
+# 생성시점 탈상관은 fleet 층의 일이다 — 드라이버는 플래그만 통과시킨다.
+R2ARGS=(); [ "$ROUND2" -eq 1 ] && R2ARGS=(--round2); [ "$ROUND2_BLIND" -eq 1 ] && R2ARGS=(--round2-blind)
+
+# ── 짝지음 인자 해석 ────────────────────────────────────────────────────────────────
+# 🟥 --r1-only 는 검증·드롭감사·씨앗 판정을 «돌리지 않는다». 그러므로 씨앗을 선언한 채로는
+#    거부한다 — 선언된 컨트롤이 돈 적 없이 통과로 읽히는 것이 이 레포가 이름 붙인 결함이다.
+PAIRARGS=()
+if [ "$R1_ONLY" -eq 1 ]; then
+  [ "$ROUND2" -eq 1 ] && { echo "finding_pipeline: --r1-only cannot be combined with --round2/--round2-blind" >&2; exit 2; }
+  [ -n "$REUSE_R1" ] && { echo "finding_pipeline: --r1-only and --reuse-r1 are mutually exclusive" >&2; exit 2; }
+  [ -n "$ALL_SEEDS" ] && { echo "finding_pipeline: --r1-only runs no verification — refusing to accept seeds that would never be judged" >&2; exit 2; }
+  PAIRARGS=(--r1-only)
+fi
+if [ -n "$REUSE_R1" ]; then
+  [ "$ROUND2" -eq 1 ] || { echo "finding_pipeline: --reuse-r1 requires --round2 or --round2-blind" >&2; exit 2; }
+  # 호출자가 파이프라인 out 을 줬으면 그 안의 fleet/ 로 내려간다. 어느 쪽을 골랐는지 «찍는다».
+  _R1SRC="$REUSE_R1"
+  [ -s "$REUSE_R1/fleet/findings.jsonl" ] && _R1SRC="$REUSE_R1/fleet"
+  [ -s "$_R1SRC/findings.jsonl" ] || { echo "finding_pipeline: --reuse-r1 resolved to '$_R1SRC' which has no non-empty findings.jsonl" >&2; exit 2; }
+  echo "PIPELINE reuse_r1 resolved=$_R1SRC sha256=$(/usr/bin/shasum -a 256 "$_R1SRC/findings.jsonl" | /usr/bin/cut -c1-16)"
+  PAIRARGS=(--reuse-r1 "$_R1SRC")
+fi
+
+bash "$FLEET_SH" "$TARGET" --out "$OUT/fleet" ${FA[@]+"${FA[@]}"} ${R2ARGS[@]+"${R2ARGS[@]}"} ${PAIRARGS[@]+"${PAIRARGS[@]}"} 2>&1 | tee "$OUT/fleet_run.log"
 FLEET_RC=${PIPESTATUS[0]}
+
+# --r1-only: 공유 round-1 만 남기고 끝낸다(검증 단계 없음 — 위에서 씨앗을 이미 거부했다)
+if [ "$R1_ONLY" -eq 1 ]; then
+  # 🟥 `|| echo 0` 을 쓰면 안 된다 — `grep -c .` 는 빈 파일에서 «0 을 찍고 rc=1» 이라 폴백이
+  #    한 줄을 더 붙여 `_n1="0\n0"` 이 되고, `[ "$_n1" -eq 0 ]` 은 **구문오류로 거짓**이 되어
+  #    빈 round-1 이 «사용 가능» 으로 통과한다(fail-OPEN). cross-family codex 가 적발, 자력 0.
+  #    [[feedback_pipefail_fallback_disarms_guard]] — 질문은 «폴백 붙였나» 가 아니라
+  #    «실패 시 stdout 이 비는가» 다. 여기서는 안 빈다.
+  _n1=$(/usr/bin/grep -c . "$OUT/fleet/findings.jsonl" 2>/dev/null)
+  case "${_n1:-}" in ''|*[!0-9]*) _n1=0 ;; esac
+  if [ "$FLEET_RC" -ne 0 ] || [ "$_n1" -eq 0 ]; then
+    echo "PIPELINE target=$(basename "$TARGET") fleet_rc=$FLEET_RC findings=$_n1 status=R1_UNUSABLE rc=3"
+    exit 3
+  fi
+  echo "PIPELINE target=$(basename "$TARGET") fleet_rc=0 findings=$_n1 status=R1_ONLY r1_dir=$OUT/fleet sha256=$(/usr/bin/shasum -a 256 "$OUT/fleet/findings.jsonl" | /usr/bin/cut -c1-16) rc=0"
+  exit 0
+fi
 FINDINGS="$OUT/fleet/findings.jsonl"
+if [ "$FLEET_RC" -eq 0 ] && [ ! -s "$FINDINGS" ] && [ -f "$OUT/fleet/INTENTIONAL_EMPTY" ]; then
+  # 🟥 R3 #8: every member completed round 2 and withdrew everything — that is a REVIEWED empty result,
+  #    not a missing review. The typed marker (not the empty file) is what distinguishes the two.
+  # R4 #6: a reused --out kept the previous run's aggregates beside this early return — reset them here.
+  for _p in "$OUT/confirmed.jsonl" "$OUT/dropped.jsonl" "$OUT/splits.txt"; do
+    [ -L "$_p" ] && { echo "finding_pipeline: refusing to write through a symlink: $_p" >&2; exit 2; }
+    : > "$_p"
+  done
+  # R4 #1: a declared control that never entered the run is ABSENT on this path too — WITHDRAWN must not
+  #        pass a seed check it never ran. Same exit (5) and same SEEDED line the verifier would print.
+  if [ -n "$ALL_SEEDS" ]; then
+    _n=$(printf '%s' "$ALL_SEEDS" | /usr/bin/tr ',' '\n' | /usr/bin/grep -c .)
+    echo "PIPELINE target=$(basename "$TARGET") fleet_rc=0 findings=0 status=WITHDRAWN confirmed=0 dropped=0 coverage=0/0 rc=5"
+    echo "SEEDED declared=$_n present=0 kept=0 dropped=0 abstained=0 status=ABSENT"
+    exit 5
+  fi
+  echo "PIPELINE target=$(basename "$TARGET") fleet_rc=0 findings=0 status=WITHDRAWN confirmed=0 dropped=0 coverage=0/0 rc=0"
+  exit 0
+fi
 if [ "$FLEET_RC" -ne 0 ] || [ ! -s "$FINDINGS" ]; then
   echo "PIPELINE target=$(basename "$TARGET") fleet_rc=$FLEET_RC findings=0 status=UNREVIEWED"
   echo "  🟥 an empty finding list is UNREVIEWED, not clean (finding_fleet.sh says so and this agrees)" >&2
@@ -97,6 +181,9 @@ fi
 # A fleet is "ok" when ONE member succeeded. A member that crashed after emitting a few findings still
 # leaves its family present, so the split routing below sees two families and the run looks complete.
 FAILED_MEMBERS=$(grep -c '^MEMBER .* rc=[^0]' "$OUT/fleet_run.log" 2>/dev/null); FAILED_MEMBERS=${FAILED_MEMBERS:-0}
+# 🟥 rc=0 인데 계약 출력이 0 인 멤버 — 안전필터 차단이 이 얼굴이다. failed_members 로는 안 보인다.
+#    «0건» 이 아니라 «검증 없는 0» 이므로 별 칸으로 표면화한다(기존 필드 의미는 안 건드린다).
+BLOCKED_MEMBERS=$(grep -c '^MEMBER2\{0,1\} .*status=ZERO_NONJSON$' "$OUT/fleet_run.log" 2>/dev/null); BLOCKED_MEMBERS=${BLOCKED_MEMBERS:-0}
 
 # ── 2. split by producer, verify each half with the other family ──────────────────────────────────
 # Families are read into a newline-delimited list and validated. An unquoted space-joined expansion
@@ -121,17 +208,62 @@ if [ "$FAMRC" -ne 0 ] || [ ! -s "$OUT/families.txt" ]; then
   echo "finding_pipeline: findings carry no usable producer_family — cannot route" >&2; exit 3
 fi
 
+# 🟥 검증자 후보 풀은 «발견을 낸 계열» 이 아니라 «실제로 돌아간 함대 명부» 다.
+#    families.txt 는 producer_family 에서 만들어지므로 0건을 낸 계열은 목록에서 사라진다. 그러면
+#    pick_verifier 가 «다른 계열이 없다» 로 읽고 그 발견들을 통째로 미검증 처리한다 — 검증자로
+#    쓸 수 있는 계열이 멀쩡히 돌고 있었는데도. 측정이 스스로 찾아낸 결함이다:
+#    F_typed 팔 case_g02.py r1~r3 이 정확히 이 형태로 coverage 0/2 (0%) 였다(2026-09-10).
+#    분할 루프는 바뀌지 않는다 — 여전히 발견자별이다. 바뀌는 것은 «누가 검증할 수 있나» 뿐이다.
+#    rc!=0 인 멤버는 제외한다: 안 돌아간 CLI 는 검증도 못 한다(한도 소진이 그 형태).
+ROSTER="$OUT/roster.txt"
+/usr/bin/python3 -c '
+import re,sys
+seen=[]
+for l in open(sys.argv[1],encoding="utf-8",errors="replace"):
+    # 🟥 role 값에 공백이 들어갈 수 있다(fleet 표가 허용한다). 접두 전체를 한 패턴으로 묶으면
+    #    그런 줄이 통째로 무시되고 명부가 «빈 채로 성공» 한다 — 두 필드를 따로 잡는다.
+    # 🟥 R2 #6: `\brc=` 는 role 안의 rc= 를 먼저 잡는다(role=rc=1 rc=0 → 오탈락, 실행 확인).
+    #    레코드 형식이 고정이므로 «뒤에서» 잡는다 — rc= 다음에 findings= 가 오는 것이 앵커다.
+    # 🟥 R3 #6: «findings= 가 뒤에 온다» 는 접미 경계가 아니었다 — role=`rc=0 findings=x` 가 먼저 잡혔다.
+    #    레코드 끝(`rc=N findings=N [self_dropped=N] status=S$`)에 앵커한다.
+    fm = re.search(r"\bfamily=(\S+)", l); rm = re.search(r" rc=(\S+) findings=\S+(?: self_dropped=\S+)? status=\S+\s*$", l)
+    if not l.startswith("MEMBER") or not fm or not rm: continue
+    fam, rc = fm.group(1), rm.group(1)
+    if rc != "0": continue
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+", fam):
+        sys.stderr.write("finding_pipeline: illegal family %r in fleet roster — refusing to route\n" % (fam,))
+        sys.exit(2)
+    if fam not in seen: seen.append(fam)
+if not seen:
+    # 🟥 빈 목록을 «성공» 으로 내보내면 안 된다. `print("\n".join([]))` 는 개행 1바이트를 쓰고
+    #    `[ -s ]` 는 그걸 «내용 있음» 으로 읽는다 — 그러면 DEGRADE 분기가 통째로 건너뛰어지고
+    #    아무도 검증자를 못 받는다(cross-family #4, codex 2026-09-10).
+    sys.stderr.write("finding_pipeline: fleet roster parsed 0 usable families\n"); sys.exit(4)
+print("\n".join(seen))' "$OUT/fleet/members.txt" > "$ROSTER" 2>"$OUT/roster.err"
+ROSTRC=$?
+_ROSTER_N=$(/usr/bin/grep -c . "$ROSTER" 2>/dev/null); _ROSTER_N=${_ROSTER_N:-0}
+if [ "$ROSTRC" -ne 0 ] || [ "$_ROSTER_N" -eq 0 ]; then
+  cat "$OUT/roster.err" >&2
+  # 🟥 degrade 는 «조용히 넘어감» 이 아니라 «좁은 풀로 되돌아감 + 그 사실을 말함» 이다.
+  #    없는 검증자를 만들어내지 않으므로 방향은 안전하다(과소검증 쪽으로 실패한다).
+  echo "  ⚠️  fleet roster unusable (rc=$ROSTRC) — verifier pool DEGRADED to producer families; a family that produced 0 findings cannot be picked" >&2
+  /bin/cp "$OUT/families.txt" "$ROSTER" 2>/dev/null || : > "$ROSTER"
+  ROSTER_SRC="families(DEGRADED)"
+else
+  ROSTER_SRC="fleet"
+fi
+
 supported() { case " $SUPPORTED_FAMILIES " in *" $1 "*) return 0;; *) return 1;; esac; }
 pick_verifier() { # $1=producer — a DIFFERENT family the wrapper can actually run
   local p="$1" f
-  while IFS= read -r f; do [ -n "$f" ] && [ "$f" != "$p" ] && supported "$f" && { echo "$f"; return; }; done < "$OUT/families.txt"
+  while IFS= read -r f; do [ -n "$f" ] && [ "$f" != "$p" ] && supported "$f" && { echo "$f"; return; }; done < "$ROSTER"
   echo ""
 }
 pick_auditor() { # $1=producer $2=verifier — prefer a third party; fall back to producer (appeal)
   local p="$1" v="$2" f
   while IFS= read -r f; do
     [ -n "$f" ] && [ "$f" != "$p" ] && [ "$f" != "$v" ] && supported "$f" && { echo "$f"; return; }
-  done < "$OUT/families.txt"
+  done < "$ROSTER"
   supported "$p" && { echo "$p"; return; }
   echo ""
 }
@@ -140,7 +272,11 @@ pick_auditor() { # $1=producer $2=verifier — prefer a third party; fall back t
 # run's verdict while a confirmed survivor sat in the other split. Rank them explicitly instead, and
 # derive 1-vs-0 from the survivor count at the end, never from a split.
 WORST_RANK=0; WORST_CODE=0
-rank_of() { case "$1" in 2) echo 4;; 3) echo 3;; 4) echo 2;; *) echo 0;; esac; }
+# 🟥 exit 5 (SEEDED DEGRADED/INCONCLUSIVE/ABSENT) had NO CASE here, so it fell to the default 0
+# and the driver exited 0 while a split had just reported that the filter deleted a known-true
+# finding. The entire seeded control was invisible at the level a reader actually reads.
+# (cross-family round 4, gemini family, S severity — three same-family rounds missed it.)
+rank_of() { case "$1" in 2) echo 5;; 5) echo 4;; 3) echo 3;; 4) echo 2;; *) echo 0;; esac; }
 note_rc() { local r; r=$(rank_of "$1"); if [ "$r" -gt "$WORST_RANK" ]; then WORST_RANK="$r"; WORST_CODE="$1"; fi; }
 
 : > "$OUT/confirmed.jsonl"; : > "$OUT/dropped.jsonl"; : > "$OUT/splits.txt"
@@ -169,16 +305,84 @@ for l in open(sys.argv[1],encoding="utf-8"):
     printf 'split producer=%s verifier=%s rc=0 (no findings)\n' "$PROD" "$VER" >> "$OUT/splits.txt"; continue
   fi
 
+  # 🟥 검증 패스의 CLI stderr(토큰 회계 «tokens used» 포함)가 mktemp 에 쓰이고 cleanup 이 지웠다.
+  #    그래서 «검증 패스 토큰 = 0바이트» 로 보였는데 0 이 아니라 «버려진 것» 이다. --keep 은 이미
+  #    있는 채널이고 파이프라인이 안 넘겼을 뿐이다. split 디렉터리에 남긴다(2026-09-10).
+  # 🟥 R2 #7: 검증과 감사가 같은 keep 을 쓰면 드롭이 있는 런에서 감사가 검증 err.txt 를 덮는다 —
+  #    토큰 회계가 «바로 그 런» 에서 또 버려진다. 갈라 둔다. #1: 잎 경로 심링크도 여기서 거부.
+  for _p in "$SD/keep_verify" "$SD/keep_audit"; do
+    [ -L "$_p" ] && { echo "finding_pipeline: refusing to write through a symlink: $_p" >&2; note_rc 2; continue 2; }
+    mkdir -p "$_p"
+    for _leaf in raw.txt err.txt prompt.txt findings.jsonl; do
+      [ -L "$_p/$_leaf" ] && { echo "finding_pipeline: refusing to write through a symlink: $_p/$_leaf" >&2; note_rc 2; continue 3; }
+    done
+  done
+  export FH_VERIFIER_KEEP="$SD"   # verifier 가 MODE 별로 keep_verify/ keep_audit/ 를 «스스로» 고른다 (R2 #7)
   AUDARGS=()
   if [ -n "$AUD" ]; then
     AUDARGS=(--audit-verifier-argv "$(argv_json bash "$VERIFIER_SH" --family "$AUD" --target "$TARGET" --audit)" --audit-family "$AUD")
   else
     echo "  ⚠️  split producer=$PROD — no supported auditor; any drop will come back UNAUDITED" >&2
   fi
+  # 🟥 Seeds are forwarded PER SPLIT, filtered to the ids that actually live in that split's input.
+  # Forwarding the whole declared set to every split would make each split report ABSENT for the
+  # seeds that belong to the other producer — a false alarm manufactured by the routing, not by the
+  # filter. The global "did any declared seed enter at all?" question is answered once, below.
+  SEEDARGS=()
+  if [ -n "$ALL_SEEDS" ]; then
+    # 🟥 R6 #3: resolve each declared seed against the WHOLE fleet result BEFORE partitioning — two rows in
+    #    different splits sharing one member_id each looked unique inside their split (CLEAN twice) while the
+    #    unsplit verifier calls the same declaration AMBIGUOUS. Global multiplicity is decided once, here.
+    _AMBIG=$(ALL_SEEDS="$ALL_SEEDS" /usr/bin/python3 -c '
+import sys, json, os, collections
+want = {x.strip() for x in os.environ.get("ALL_SEEDS", "").split(",") if x.strip()}
+cnt = collections.Counter()
+try:
+    for l in open(sys.argv[1], encoding="utf-8"):
+        l = l.strip()
+        if not l: continue
+        try: d = json.loads(l)
+        except Exception: continue
+        if not isinstance(d, dict): continue
+        keys = {str(d[k]) for k in ("id", "member_id") if d.get(k) is not None}
+        for k in keys & want: cnt[k] += 1
+except OSError: pass
+print(",".join(sorted(k for k, c in cnt.items() if c > 1)))' "$FINDINGS")
+    if [ -n "$_AMBIG" ]; then
+      echo "PIPELINE target=$(basename "$TARGET") status=SEED_AMBIGUOUS seeds=$_AMBIG rc=5"
+      echo "SEEDED declared=$(printf '%s' "$ALL_SEEDS" | /usr/bin/tr ',' '\n' | /usr/bin/grep -c .) present=0 kept=0 dropped=0 abstained=0 status=AMBIGUOUS"
+      echo "  🟥 seed(s) $_AMBIG match more than one fleet row — member ids are only locally unique; declare the routing id instead" >&2
+      exit 5
+    fi
+    _SPLIT_SEEDS=$(ALL_SEEDS="$ALL_SEEDS" /usr/bin/python3 -c '
+import sys, json, os
+want = {x.strip() for x in os.environ.get("ALL_SEEDS", "").split(",") if x.strip()}
+have = set()
+try:
+    for l in open(sys.argv[1], encoding="utf-8"):
+        l = l.strip()
+        if not l: continue
+        try: d = json.loads(l)
+        except Exception: continue
+        if isinstance(d, dict):
+            if d.get("id") is not None: have.add(str(d["id"]))
+            if d.get("member_id") is not None: have.add(str(d["member_id"]))
+except OSError: pass
+print(",".join(sorted(want & have)))' "$SD/in.jsonl")
+    if [ -n "$_SPLIT_SEEDS" ]; then
+      SEEDARGS=(--seeded "$_SPLIT_SEEDS")
+    fi
+  fi
   /usr/bin/python3 "$VERIFY_PY" "$SD/in.jsonl" --out "$SD" \
     --verifier-argv "$(argv_json bash "$VERIFIER_SH" --family "$VER" --target "$TARGET")" --family "$VER" \
-    ${AUDARGS[@]+"${AUDARGS[@]}"} > "$SD/summary.txt" 2>"$SD/err.txt"
+    ${SEEDARGS[@]+"${SEEDARGS[@]}"} ${AUDARGS[@]+"${AUDARGS[@]}"} > "$SD/summary.txt" 2>"$SD/err.txt"
   RC=$?
+  # 🟥 «라우팅했다» 를 «검증됐다» 로 세면 안 된다. 초판은 verify 를 부르기 «전» 에 기록해서,
+  #   verify 가 크래시해도 그 씨앗은 «돌았다» 로 남았다(cross-family round 6). 요약을 실제로
+  #   낸 실행에 대해서만 기록한다.
+  if [ -n "${_SPLIT_SEEDS:-}" ] && [ -s "$SD/summary.txt" ]; then
+    SEEDS_ROUTED="${SEEDS_ROUTED:+$SEEDS_ROUTED,}$_SPLIT_SEEDS"
+  fi
   note_rc "$RC"
   cat "$SD/summary.txt"
   printf 'split producer=%s verifier=%s auditor=%s rc=%s\n' "$PROD" "$VER" "${AUD:-NONE}" "$RC" >> "$OUT/splits.txt"
@@ -196,6 +400,154 @@ TOTAL_UNVER=$(count_lines '"verdict": *"unverified"' "$OUT/confirmed.jsonl")
 # becomes true by wording alone.
 TOTAL_AUD=$(count_lines '"drop_verdict": *"\(correct-drop\|wrong-drop\|uncertain\)"' "$OUT/dropped.jsonl")
 TOTAL_WRONG=$(count_lines '"reinstated": *true' "$OUT/confirmed.jsonl")
+# 🟥 COVERAGE ALSO RIDES THE DRIVER LINE, not only the per-split one. `finding_verify.py` records it
+# per split, but the driver's summary is what a reader actually reads — a field recorded in a place
+# nobody reads is the half-externalisation shape this repo keeps re-finding (a slot with zero
+# consumers always reports "done", because presence is doing the judging).
+#
+# 🟥 THREE things this number got wrong on the first attempt, all found by cross-family round 2:
+#   ⓐ it subtracted `unverified` but NOT `needs-debate` — an all-debate run printed 100%. The
+#     verifier had already been fixed for exactly this and the driver had not: a half-fix that
+#     stopped at the propagation boundary, which is the failure mode this repo has a name for.
+#   ⓑ the DENOMINATOR was `confirmed + dropped`, i.e. what came OUT. A partition that is skipped
+#     (unsupported family) then vanishes from numerator and denominator alike and coverage reads
+#     100% while findings were never judged at all. The denominator must be what came IN.
+#   ⓒ the counters were line greps, so passthrough metadata containing `"verdict": "unverified"`
+#     anywhere in a row counted as an abstention. Verdicts are read from the TOP LEVEL of each row.
+# 🟥 판정 수는 «뺄셈» 이 아니라 «양의 계수» 로 구한다. 초판은 입력 총수에서 기권을 뺐는데,
+#    그러면 **출력에 아예 안 나타난 것이 판정된 것으로 계수된다** — 건너뛴 파티션도, 읽기 실패도,
+#    깨진 JSON 도 전부 «100%» 가 된다(cross-family R3 가 A급 둘로 지목, 재현됨).
+#    판정 = 「해결된 verdict 를 실제로 들고 있는 행」의 수다. 없으면 0 이고, 그것이 fail-closed 다.
+_count_json() {   # $1 = 파일, $2 = 필드, $3.. = 셀 값들. 실패는 «0» 이 아니라 비-영 종료로 낸다.
+  /usr/bin/python3 -c '
+import sys, json
+path, field, want = sys.argv[1], sys.argv[2], set(sys.argv[3:])
+n = 0
+try:
+    fh = open(path, encoding="utf-8")
+except FileNotFoundError:
+    print(0); sys.exit(0)                 # 파일 자체가 없는 것은 «행이 0» 이다
+except OSError as e:
+    print("count: %s" % e, file=sys.stderr); sys.exit(9)
+with fh:
+    try:
+        for l in fh:
+            l = l.strip()
+            if not l: continue
+            d = json.loads(l)             # 깨진 줄은 «건너뛰기» 가 아니라 계측 오류다
+            if not isinstance(d, dict): raise ValueError("row is not an object")
+            v = d.get(field)
+            if v is not None and not isinstance(v, str): raise ValueError("non-string %s" % field)
+            if v in want: n += 1
+    except (json.JSONDecodeError, ValueError, UnicodeDecodeError) as e:
+        print("count: %s" % e, file=sys.stderr); sys.exit(9)
+print(n)' "$@"
+}
+_count_lines_json() {   # 행 수 — 같은 실패 규율
+  /usr/bin/python3 -c '
+import sys
+n = 0
+try:
+    fh = open(sys.argv[1], encoding="utf-8")
+except FileNotFoundError:
+    print(0); sys.exit(0)
+except OSError as e:
+    print("count: %s" % e, file=sys.stderr); sys.exit(9)
+with fh:
+    try:
+        for l in fh:
+            if l.strip(): n += 1
+    except UnicodeDecodeError as e:
+        print("count: %s" % e, file=sys.stderr); sys.exit(9)
+print(n)' "$1"
+}
+COUNT_ERR=0
+TOTAL_IN=$(_count_lines_json "$FINDINGS") || COUNT_ERR=1
+TOTAL_UNVER=$(_count_json "$OUT/confirmed.jsonl" verdict unverified) || COUNT_ERR=1
+TOTAL_DEBATE=$(_count_json "$OUT/confirmed.jsonl" verdict needs-debate) || COUNT_ERR=1
+# 🟥 양의 계수: 실제로 «해결된» 판정을 들고 있는 행만 센다.
+# 복권된 행은 이제 verdict=confirmed 를 단다(verify 쪽 근원 수리). 그 전에 만들어진 산출물과의
+# 호환을 위해 «reinstated 이면서 false-positive» 도 판정으로 센다 — 그 행은 감사가 «되돌렸다» 는
+# 결정을 받은 것이지 미판정이 아니다.
+JUDGED_CONF=$(_count_json "$OUT/confirmed.jsonl" verdict confirmed) || COUNT_ERR=1
+JUDGED_REINST=$(/usr/bin/python3 -c '
+import sys, json
+n = 0
+try:
+    fh = open(sys.argv[1], encoding="utf-8")
+except FileNotFoundError:
+    print(0); sys.exit(0)
+except OSError as e:
+    print("count: %s" % e, file=sys.stderr); sys.exit(9)
+with fh:
+    try:
+        for l in fh:
+            l = l.strip()
+            if not l: continue
+            d = json.loads(l)
+            if isinstance(d, dict) and d.get("reinstated") is True and d.get("verdict") != "confirmed":
+                n += 1
+    except (json.JSONDecodeError, ValueError, UnicodeDecodeError) as e:
+        print("count: %s" % e, file=sys.stderr); sys.exit(9)
+print(n)' "$OUT/confirmed.jsonl") || COUNT_ERR=1
+JUDGED_DROP=$(_count_json "$OUT/dropped.jsonl" verdict false-positive) || COUNT_ERR=1
+TOTAL_IN=${TOTAL_IN:-0}; TOTAL_UNVER=${TOTAL_UNVER:-0}; TOTAL_DEBATE=${TOTAL_DEBATE:-0}
+JUDGED_CONF=${JUDGED_CONF:-0}; JUDGED_DROP=${JUDGED_DROP:-0}
+JUDGED_REINST=${JUDGED_REINST:-0}
+TOTAL_JUDGED=$(( JUDGED_CONF + JUDGED_DROP + JUDGED_REINST ))
+# 🟥 Split-level ABSENT cannot fire once seeds are filtered per split, so the "did the control run
+# at all?" question is asked ONCE, globally, against the whole fleet output.
+if [ -n "$ALL_SEEDS" ]; then
+  _SEEDS_SEEN=$(ALL_SEEDS="$ALL_SEEDS" /usr/bin/python3 -c '
+import sys, json, os
+want = {x.strip() for x in os.environ.get("ALL_SEEDS", "").split(",") if x.strip()}
+have = set()
+try:
+    for l in open(sys.argv[1], encoding="utf-8"):
+        l = l.strip()
+        if not l: continue
+        try: d = json.loads(l)
+        except Exception: continue
+        if isinstance(d, dict):
+            if d.get("id") is not None: have.add(str(d["id"]))
+            if d.get("member_id") is not None: have.add(str(d["member_id"]))
+except OSError: pass
+print(len(want & have))' "$FINDINGS")
+  if [ "${_SEEDS_SEEN:-0}" -eq 0 ]; then
+    echo "  ⚠️  declared seeds are not present anywhere in the fleet output — the control never ran" >&2
+    note_rc 5
+  fi
+  # 🟥 «하나라도 들어왔나» 로는 부족하다. 선언한 씨앗 중 **어떤 split 에도 안 실린 것**이 있으면
+  #   그 씨앗은 검증기를 통과한 적이 없고, 그런데도 나머지가 CLEAN 이면 드라이버는 0 을 낸다.
+  #   두 경로로 그렇게 된다: ⓐ fleet 출력에 애초에 없다 ⓑ 있는데 producer_family 가 없거나
+  #   지원되지 않아 라우팅에서 빠진다. 둘 다 «통제가 그 씨앗에 대해 안 돌았다» 는 같은 사실이다.
+  #   (cross-family round 5, gemini 계열.)
+  _SEEDS_MISSED=$(ALL_SEEDS="$ALL_SEEDS" ROUTED="${SEEDS_ROUTED:-}" /usr/bin/python3 -c '
+import os
+want = {x.strip() for x in os.environ.get("ALL_SEEDS", "").split(",") if x.strip()}
+got  = {x.strip() for x in os.environ.get("ROUTED", "").split(",") if x.strip()}
+missed = sorted(want - got)
+print(",".join(missed))')
+  if [ -n "$_SEEDS_MISSED" ]; then
+    echo "  ⚠️  declared seeds never reached any verified split: $_SEEDS_MISSED — the control did not run for them" >&2
+    note_rc 5
+  fi
+fi
+if [ "$COUNT_ERR" -ne 0 ]; then
+  echo "  ⚠️  coverage 계측이 실패했다 — 이 런의 coverage 는 판정이 아니라 «못 잼» 이다" >&2
+  note_rc 3
+fi
+# 🟥 회계 불일치는 clamp 로 덮지 않는다 — 판정이 입력보다 많으면 그건 «0으로 눌러서 정상처럼
+#    보이게 할 것» 이 아니라 계측 결함이다(R3 지적).
+if [ "$TOTAL_JUDGED" -gt "$TOTAL_IN" ]; then
+  echo "  ⚠️  coverage 회계 불일치: 판정 $TOTAL_JUDGED > 입력 $TOTAL_IN" >&2
+  note_rc 3
+fi
+if [ "$TOTAL_IN" -gt 0 ]; then
+  COV_PCT=$(( TOTAL_JUDGED * 100 / TOTAL_IN ))   # floored, never rounded
+else
+  COV_PCT=0
+fi
 
 if [ "$FAILED_MEMBERS" -gt 0 ]; then
   echo "  ⚠️  $FAILED_MEMBERS fleet member(s) exited non-zero — a member that crashed after emitting some findings leaves its family looking complete" >&2
@@ -205,9 +557,16 @@ fi
 RC_FINAL="$WORST_CODE"
 [ "$WORST_RANK" -eq 0 ] && [ "$TOTAL_CONF" -eq 0 ] && RC_FINAL=1
 
-printf 'PIPELINE target=%s families=%s confirmed=%s dropped=%s unverified=%s audited_drops=%s reinstated=%s failed_members=%s rc=%s\n' \
-  "$(basename "$TARGET")" "$(tr '\n' ',' < "$OUT/families.txt" | sed 's/,$//')" "$TOTAL_CONF" "$TOTAL_DROP" \
-  "$TOTAL_UNVER" "$TOTAL_AUD" "$TOTAL_WRONG" "$FAILED_MEMBERS" "$RC_FINAL"
+# 🟥 `confirmed=` prints the RESOLVED confirmations, not the raw line count of confirmed.jsonl.
+# That file also holds debate and unverified rows, so the driver printed `confirmed=2 debate=2
+# coverage=0/2` — three numbers in one line contradicting each other. The verifier had already been
+# fixed for exactly this; the driver had not. **Third recurrence of the same half-fix shape in this
+# change** (cross-family round 6). Survivor semantics for rc stay on TOTAL_CONF.
+printf 'PIPELINE target=%s families=%s roster=%s(%s) confirmed=%s dropped=%s unverified=%s debate=%s coverage=%s/%s (%s%%) audited_drops=%s reinstated=%s failed_members=%s blocked_members=%s rc=%s\n' \
+  "$(basename "$TARGET")" "$(tr '\n' ',' < "$OUT/families.txt" | sed 's/,$//')" \
+  "$(tr '\n' ',' < "$ROSTER" | sed 's/,$//')" "$ROSTER_SRC" "$JUDGED_CONF" "$TOTAL_DROP" \
+  "$TOTAL_UNVER" "$TOTAL_DEBATE" "$TOTAL_JUDGED" "$TOTAL_IN" "$COV_PCT" "$TOTAL_AUD" "$TOTAL_WRONG" \
+  "$FAILED_MEMBERS" "$BLOCKED_MEMBERS" "$RC_FINAL"
 # `unverified` is reported on its own line rather than folded into `confirmed`, because folding it is
 # exactly the "not found rendered as zero" family this repo keeps re-finding.
 exit "$RC_FINAL"

package/scripts/finding_verifier.sh

@@ -22,6 +22,9 @@ CODEX="${FH_CODEX_BIN:-$(command -v codex 2>/dev/null || echo "$HOME/.npm-global
 AGY="${FH_AGY_BIN:-$(command -v agy 2>/dev/null || echo "$HOME/.local/bin/agy")}"
 
 FAMILY=""; TARGET=""; MODE="verify"; KEEP=""
+# 호출자(파이프라인)가 env 로 보존 경로를 줄 수 있다 — 검증 패스의 CLI stderr(토큰 회계)가 여기서 산다.
+# --keep 플래그가 뒤에서 덮으므로 env 는 «폴백» 이지 강제가 아니다. (2026-09-10: 0바이트 ≠ 0 토큰)
+KEEP="${FH_VERIFIER_KEEP:-}"
 usage() { echo "usage: finding_verifier.sh --family codex|gemini --target <file> [--audit] [--keep <dir>]" >&2; exit 2; }
 # `shift 2` with only one word left FAILS and consumes nothing, so the loop spins forever. Under
 # `set -uo pipefail` (no errexit) nothing stops it. codex reproduced a hang on a trailing --family.
@@ -52,7 +55,33 @@ fi
 umask 077
 
 WORK="$(mktemp -d 2>/dev/null)" || { echo "finding_verifier: mktemp failed" >&2; exit 3; }
-cleanup() { [ -n "$KEEP" ] && cp "$WORK"/* "$KEEP"/ 2>/dev/null; rm -rf "$WORK"; }
+# 🟥 R2 #7: 검증과 감사가 같은 keep 을 쓰면 감사가 검증 err.txt(토큰 회계)를 덮는다 — 드롭이 있는 런에서
+#    «바로 그 런» 의 회계가 또 버려진다. MODE 별 하위 디렉터리로 가른다. R2 #1: 심링크 잎은 복사 전에 거부.
+# 🟥 R3 #3: the root is checked BEFORE the mode dir is appended — appended first, a symlink root became
+#    an ancestor and passed both the dir check and the leaf check (path probe: INPUT_IS_SYMLINK → GUARD_ALLOWS).
+# R4 #2: `link/` makes -L false (the trailing slash resolves through the link) — strip separators first, keep "/" intact.
+# R6 #5: `link/.` and `link//.` also resolve through the link — strip trailing "/." and "/" until stable.
+while [ "${#KEEP}" -gt 1 ]; do
+  case "$KEEP" in
+    */.) KEEP="${KEEP%/.}" ;;
+    */)  KEEP="${KEEP%/}" ;;
+    *)   break ;;
+  esac
+done
+if [ -n "$KEEP" ] && [ -L "$KEEP" ]; then echo "finding_verifier: --keep root is a symlink: $KEEP — refusing" >&2; exit 2; fi
+if [ -n "$KEEP" ] && [ -z "${FH_VERIFIER_KEEP_FLAT:-}" ]; then KEEP="$KEEP/keep_$MODE"; fi
+cleanup() {
+  if [ -n "$KEEP" ]; then
+    [ -L "$KEEP" ] && { echo "finding_verifier: refusing to keep through a symlink: $KEEP" >&2; rm -rf "$WORK"; return; }
+    mkdir -p "$KEEP" 2>/dev/null
+    for _f in "$WORK"/*; do
+      _dst="$KEEP/$(basename "$_f")"
+      [ -L "$_dst" ] && { echo "finding_verifier: refusing to keep through a symlink: $_dst" >&2; continue; }
+      cp "$_f" "$_dst" 2>/dev/null
+    done
+  fi
+  rm -rf "$WORK"
+}
 trap cleanup EXIT
 
 cat > "$WORK/findings.jsonl"
@@ -95,7 +124,7 @@ fi
 case "$FAMILY" in
   codex)  "$CODEX" exec --sandbox read-only --skip-git-repo-check -m gpt-6-astra \
             -c model_reasoning_effort="high" < "$WORK/prompt.txt" > "$WORK/raw.txt" 2>"$WORK/err.txt" ;;
-  gemini) "$AGY" --model gemini-3.8-flash-high --output-format text --print-timeout 5m \
+  gemini) "$AGY" --mode plan --sandbox --model gemini-3.8-flash-high --output-format text --print-timeout 20m \
             -p "$(cat "$WORK/prompt.txt")" < /dev/null > "$WORK/raw.txt" 2>"$WORK/err.txt" ;;
   *) echo "finding_verifier: unknown family '$FAMILY' (codex|gemini)" >&2; exit 2 ;;
 esac