@ictechgy/context-guard 0.4.13 → 0.4.15

package/plugins/context-guard/bin/context-guard-bench

@@ -49,9 +49,10 @@ from __future__ import annotations
 
 import argparse
 import collections
-from contextlib import contextmanager
+from contextlib import contextmanager, nullcontext
 import csv
 import datetime as _dt
+import hashlib
 import json
 import math
 import os
@@ -65,6 +66,7 @@ import subprocess
 import sys
 import time
 import unicodedata
+from collections.abc import Iterable
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
@@ -318,6 +320,126 @@ ALLOWED_FIRST_ABSOLUTE_SYMLINKS = {
     "var": Path("/private/var"),
 }
 
+# --- Phase 4/5 optional image-context evaluation profile (evaluation-only) ---
+# 이 profile 은 task fixture 가 명시적으로 opt-in 할 때만 동작한다. profile 이 없는
+# 기존 replay 는 스키마/동작이 그대로 유지된다. profile 이 붙은 report 는 어떤
+# 경우에도 public claim / promotion 권한을 얻지 못하도록 clamp 된다.
+IMAGE_CONTEXT_EVALUATION_PROFILE_ID = "contextguard.bench.image-context-pack-evaluation.v1"
+SUPPORTED_EVALUATION_PROFILE_IDS = frozenset({IMAGE_CONTEXT_EVALUATION_PROFILE_ID})
+IMAGE_CONTEXT_READINESS_SCHEMA_VERSION = "contextguard.bench.image-context-pack-readiness.v1"
+IMAGE_CONTEXT_PROFILE_REPORT_KEY = "image_context_pack"
+EVALUATION_PROFILES_REPORT_KEY = "evaluation_profiles"
+IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS = "image_context_pack_evaluation_only_not_public_claim"
+PROFILE_STATUS_BLOCKED = "blocked"
+PROFILE_STATUS_READY_FOR_BOUNDED_PILOT_REVIEW = "ready_for_bounded_pilot_review"
+# 가져온 local proof-verifier 레코드는 "누가 만들었는지" 를 인증하지 않고 artifact 를
+# 다시 읽지도 않는다. 라벨로 그 경계를 명시한다.
+IMPORTED_LOCAL_VERIFIER_ATTESTATION_LABEL = "imported_local_verifier_attestation"
+PROOF_VERIFICATION_SCHEMA_VERSION = "contextguard.experiments.proof-carrying-context-verification.v1"
+PROOF_VERIFICATION_VERIFIED_STATUS = "verified"
+# experimental_registry.PROOF_VERIFICATION_CLAIM_BOUNDARY 와 반드시 같은 문자열이다.
+# 가져온 attestation 은 이 local-only 경계를 그대로 선언할 때만 verified 로 인정한다.
+PROOF_VERIFICATION_CLAIM_BOUNDARY = (
+    "Local receipt/hash/range/command binding only; no semantic-safety, protected-zone, freshness, replacement, "
+    "omission, or hosted-savings authority."
+)
+# local verifier 는 rehydration 을 절대 실행하지 않는다. 실행했다고 주장하는 레코드는
+# 이 evaluation-only 경계를 벗어나므로 verified 로 받아들이지 않는다.
+PROOF_VERIFICATION_REHYDRATION_EXECUTED = False
+# verified attestation 에서 placeholder 로 취급해 거부할 receipt/command 값이다.
+PROFILE_FALLBACK_PLACEHOLDER_VALUES = frozenset({"", "none", "null", "n/a", "-"})
+
+# reject_prewrite 오류 ID. 출력이 하나라도 기록되기 전에 실패해야 하는 구조적 오류다.
+PROFILE_REJECT_CONTROLS_MISSING = "profile_controls_missing"
+PROFILE_REJECT_SCHEMA_INVALID = "profile_schema_invalid"
+PROFILE_REJECT_BINDING_MISMATCH = "profile_binding_mismatch"
+PROFILE_REJECT_BATCH_INCOMPLETE = "profile_batch_incomplete"
+PROFILE_REJECT_FRESH_OUTPUT_REQUIRED = "profile_fresh_output_required"
+PROFILE_REJECT_PROMPT_BINDING_INVALID = "profile_prompt_binding_invalid"
+PROFILE_REJECT_CORRECTION_INCONSISTENT = "profile_correction_inconsistent"
+PROFILE_REJECT_MEASUREMENT_INCONSISTENT = "profile_measurement_inconsistent"
+PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT = "profile_fallback_claim_inconsistent"
+# profile 은 evaluation-only replay 전용이다. --evidence-jsonl 없이 profiled task 가
+# 선택되면 provider runtime 을 부르기 전에, 어떤 출력/lock 도 만들기 전에 거부한다.
+PROFILE_REJECT_REPLAY_REQUIRED = "profile_replay_required"
+PROFILE_REJECT_ERROR_IDS = (
+    PROFILE_REJECT_CONTROLS_MISSING,
+    PROFILE_REJECT_SCHEMA_INVALID,
+    PROFILE_REJECT_BINDING_MISMATCH,
+    PROFILE_REJECT_BATCH_INCOMPLETE,
+    PROFILE_REJECT_FRESH_OUTPUT_REQUIRED,
+    PROFILE_REJECT_PROMPT_BINDING_INVALID,
+    PROFILE_REJECT_CORRECTION_INCONSISTENT,
+    PROFILE_REJECT_MEASUREMENT_INCONSISTENT,
+    PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT,
+    PROFILE_REJECT_REPLAY_REQUIRED,
+)
+
+# lane gate ID. 순서는 report/dashboard 출력 순서와 동일하게 고정한다.
+IMAGE_CONTEXT_GATE_PROFILE_AND_PROMPT_BINDING = "profile_and_prompt_binding"
+IMAGE_CONTEXT_GATE_PROTECTED_ZONE_DENY_REVIEW = "protected_zone_deny_review"
+IMAGE_CONTEXT_GATE_EXACT_TEXT_FALLBACK_BINDING = "exact_text_fallback_binding"
+IMAGE_CONTEXT_GATE_MISSED_CONTEXT_REVIEW = "missed_context_review"
+IMAGE_CONTEXT_GATE_HUMAN_CORRECTION_CONSISTENCY = "human_correction_consistency"
+# generic quality gate 결과를 lane 이 직접 소비한다. profile 이 generic regression 을
+# 무시하고 ready 로 올라가는 경로를 막는다.
+IMAGE_CONTEXT_GATE_CORRECTIONS_REGRESSION = "corrections_regression"
+IMAGE_CONTEXT_GATE_FAILURE_RATE_REGRESSION = "failure_rate_regression"
+IMAGE_CONTEXT_GATE_GENERIC_MATCHED_SUCCESS_AND_MEASUREMENT = "generic_matched_success_and_measurement"
+IMAGE_CONTEXT_GATE_EVALUATION_ONLY_PROMOTION_BOUNDARY = "evaluation_only_promotion_boundary"
+IMAGE_CONTEXT_GATE_IDS = (
+    IMAGE_CONTEXT_GATE_PROFILE_AND_PROMPT_BINDING,
+    IMAGE_CONTEXT_GATE_PROTECTED_ZONE_DENY_REVIEW,
+    IMAGE_CONTEXT_GATE_EXACT_TEXT_FALLBACK_BINDING,
+    IMAGE_CONTEXT_GATE_MISSED_CONTEXT_REVIEW,
+    IMAGE_CONTEXT_GATE_HUMAN_CORRECTION_CONSISTENCY,
+    IMAGE_CONTEXT_GATE_CORRECTIONS_REGRESSION,
+    IMAGE_CONTEXT_GATE_FAILURE_RATE_REGRESSION,
+    IMAGE_CONTEXT_GATE_GENERIC_MATCHED_SUCCESS_AND_MEASUREMENT,
+    IMAGE_CONTEXT_GATE_EVALUATION_ONLY_PROMOTION_BOUNDARY,
+)
+# lane gate 를 막는 generic quality_gate 값. summarize_benchmark_rows 가 계산한다.
+GENERIC_QUALITY_GATE_PASS = "pass"
+GENERIC_QUALITY_GATE_CORRECTIONS_REGRESSION = "corrections_regression"
+GENERIC_QUALITY_GATE_FAILURE_RATE_REGRESSION = "failure_rate_regression"
+IMAGE_CONTEXT_PROFILE_BLOCKER_GATE_ID = "image_context_pack_evaluation_only"
+IMAGE_CONTEXT_CLAIM_BOUNDARY = {
+    "id": "image_context_pack_evaluation_only_never_promotion_or_public_claim",
+    "evaluation_only": True,
+    "promotion_authority": False,
+    "public_claim_allowed": False,
+    "runtime_authority": False,
+    "hosted_savings_claim_allowed": False,
+    "fallback_attestation_label": IMPORTED_LOCAL_VERIFIER_ATTESTATION_LABEL,
+    "fallback_attestation_is_independently_verified": False,
+    "protected_zone_evidence_is_review_attestation_not_semantic_proof": True,
+    "reason": (
+        "The image-context evaluation profile reviews imported evidence only. It does not render, "
+        "parse, or reread any image or artifact, does not authenticate who produced an imported "
+        "verifier or review record, and can never authorize a public savings claim, a quality "
+        "non-inferiority claim, or a runtime promotion."
+    ),
+}
+PROFILE_SAMPLE_ADEQUACY_POLICY_STATUS = "not_defined_for_promotion"
+
+# profile 중첩 블록의 명시적 byte/count 한계. 타입/한계 검사는 항상 semantic 분류보다
+# 먼저 실행되어 oversize 값이 blocked 분기로 새지 않도록 한다.
+MAX_PROFILE_LABEL_CHARS = 120
+MAX_PROFILE_POLICY_CHARS = 120
+MAX_PROFILE_NOTE_CHARS = 500
+MAX_PROFILE_SUMMARY_CHARS = 500
+MAX_PROFILE_COMMAND_CHARS = 500
+MAX_PROFILE_RECEIPT_ID_CHARS = 200
+MAX_PROFILE_BLOCKER_ITEMS = 20
+MAX_PROFILE_PROTECTED_REGION_COUNT = 10_000
+MAX_PROFILE_CORRECTION_COUNT = 10_000
+SHA256_HEX_PATTERN = re.compile(r"\A[0-9a-f]{64}\Z")
+PROTECTED_ZONE_DENY_POLICY = "deny"
+# 프로파일 진단에 실리는 작성자 통제 라벨은 문자셋이 안전해 보여도 원문을 절대 남기지
+# 않는다. G006 은 regex-safe 값까지 포함한 완전 불투명 표현을 요구한다.
+PROFILE_REDACTED_PLACEHOLDER = "[REDACTED]"
+MAX_PROFILE_ERROR_LABELS = 5
+
 
 def _base_open_flags() -> int:
     flags = os.O_RDONLY
@@ -472,6 +594,34 @@ def csv_file_lock(csv_path: Path, *, create_parent: bool) -> Any:
             os.close(fd)
 
 
+@contextmanager
+def csv_parent_directory_lock(csv_path: Path, *, create_parent: bool) -> Any:
+    """Serialize a CSV transaction without creating a lock sidecar.
+
+    Normal writers take this stable directory-inode lock before the historical
+    sidecar lock. Profiled replay can therefore hold it across freshness validation
+    and its complete batch without leaving a sidecar on rejection. The stable inode
+    also avoids an unlink-while-waiters race.
+    """
+    if fcntl is None:
+        raise OSError("platform does not support advisory CSV locks")
+    parent = csv_path.parent
+    if create_parent:
+        parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
+    locked = False
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)
+        locked = True
+        yield
+    finally:
+        try:
+            if locked:
+                fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+
+
 # 재현성 우선: fixture 에 명시되지 않은 필드는 argv 로 전달하지 않는다.
 # 사용자가 baseline 으로 의도한 변형이 implicit default(예: effort="medium")로 인해
 # 왜곡되지 않도록, 파싱 단계에서 명시 여부를 그대로 보존한다.
@@ -488,6 +638,8 @@ class TaskFixture:
     success_cwd: str = "."
     variant_prompt_files: dict[str, str] = field(default_factory=dict)
     variant_prompt_texts: dict[str, str] = field(default_factory=dict)
+    # 선택적 evaluation profile opt-in. None 이면 기존 generic 동작을 그대로 유지한다.
+    evaluation_profile: str | None = None
 
 
 @dataclass
@@ -535,6 +687,12 @@ class EvidenceReplayRow:
     public_claim_eligible: bool
     explicit_notes: bool
     line_number: int
+    # profile 을 선언하지 않은 row 는 세 필드가 모두 None 이며 generic 경로와 동일하다.
+    evaluation_profile: str | None = None
+    evaluation_controls: dict[str, Any] | None = None
+    # preflight 가 채우는 정규화된 lane 판정. report annotation 은 이 값만 사용하므로
+    # 이미 검증된 batch 위에서 절대 실패하지 않는다.
+    evaluation_lane: dict[str, Any] | None = None
 
     @property
     def key(self) -> tuple[str, str]:
@@ -639,6 +797,16 @@ def require_argv_safe_prompt(text: str, *, owner: str) -> str:
 
 def validate_variant_prompt_file_path(raw_path: str, *, owner: str) -> Path:
     """Return a safe relative prompt-file path, or fail before any file read."""
+    # 결정적으로 거부 가능한 값: 임베디드 NUL 과 로컬 fs 인코딩으로 표현 불가한 문자열.
+    # 이 값들은 이후 os.open 에서 ValueError/UnicodeError 로 터질 수 있으므로 미리 막는다.
+    if "\x00" in raw_path:
+        raise SystemExit(f"{owner} variant_prompt_files path must not contain embedded NUL")
+    try:
+        os.fsencode(raw_path)
+    except UnicodeError:
+        raise SystemExit(
+            f"{owner} variant_prompt_files path is not representable on the local filesystem"
+        ) from None
     rel_path = Path(raw_path)
     if rel_path.is_absolute():
         raise SystemExit(f"{owner} variant_prompt_files path must be relative: {raw_path}")
@@ -658,19 +826,44 @@ def validate_variant_prompt_file_references(
     Unknown variant keys and unsafe relative paths are rejected before any file
     read. Missing prompt files are intentionally not checked here so a run
     narrowed by --task-id/--variant is not blocked by unselected prompt files.
+
+    Profiled tasks use the redacted profile owner and never echo raw task ids,
+    variant labels, mapping keys, or unsafe paths. Unprofiled messages stay
+    unchanged for compatibility.
     """
     known_variants = {variant.name for variant in variants}
     for task in tasks:
+        profiled = task.evaluation_profile is not None
         unknown = sorted(set(task.variant_prompt_files) - known_variants)
         if unknown:
+            if profiled:
+                # 매핑 키·variant 라벨은 attacker-controlled 이므로 이름 대신 적색 처리한다.
+                profile_reject(
+                    PROFILE_REJECT_PROMPT_BINDING_INVALID,
+                    profile_owner(task.id),
+                    "variant_prompt_files references unknown variant(s): "
+                    f"{redact_profile_labels(unknown)}",
+                )
             raise SystemExit(
                 f"task {task.id} variant_prompt_files references unknown variant(s): {', '.join(unknown)}"
             )
         for variant_name, raw_path in task.variant_prompt_files.items():
-            validate_variant_prompt_file_path(
-                raw_path,
-                owner=f"task {task.id} variant {variant_name}",
+            owner = (
+                profile_owner(task.id, variant_name)
+                if profiled
+                else f"task {task.id} variant {variant_name}"
             )
+            try:
+                validate_variant_prompt_file_path(raw_path, owner=owner)
+            except SystemExit:
+                if profiled:
+                    # 원본 경로·라벨이 새어나가지 않도록 안정적인 프로파일 오류로 다시 쓴다.
+                    profile_reject(
+                        PROFILE_REJECT_PROMPT_BINDING_INVALID,
+                        owner,
+                        "variant_prompt_files path is unsafe or invalid",
+                    )
+                raise
 
 
 def read_variant_prompt_file(path: Path, *, owner: str, display_path: str | None = None) -> str:
@@ -768,41 +961,89 @@ def parse_tasks(path: Path, variants: list["Variant"] | None = None) -> list[Tas
     for item in raw:
         if not isinstance(item, dict):
             raise SystemExit(f"task entry must be a JSON object: {item}")
+        # evaluation_profile opt-in 을 필수 라벨(id/prompt)보다 먼저 확정한다.
+        # 지원 프로파일의 구조 오류는 raw KeyError 가 아니라 안정적인 프로파일 거부로 끝낸다.
+        evaluation_profile = item.get("evaluation_profile")
+        profiled = evaluation_profile is not None
+        if "id" not in item:
+            if profiled:
+                profile_reject(
+                    PROFILE_REJECT_SCHEMA_INVALID,
+                    profile_owner(None),
+                    "task fixture fields are invalid",
+                )
+            raise KeyError("id")
+        task_id = str(item["id"])
+        owner = profile_owner(task_id) if profiled else f"task {task_id}"
+        if profiled and (
+            not isinstance(evaluation_profile, str)
+            or evaluation_profile not in SUPPORTED_EVALUATION_PROFILE_IDS
+        ):
+            profile_reject(
+                PROFILE_REJECT_SCHEMA_INVALID,
+                owner,
+                "declares an unsupported evaluation_profile id",
+            )
+        if "variant_prompts" in item:
+            detail = "variant_prompts is not supported; use file-backed variant_prompt_files"
+            if profiled:
+                profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, detail)
+            raise SystemExit(f"{owner} {detail}")
         effort_raw = item.get("effort")
         budget_raw = item.get("max_budget_usd")
         if budget_raw is not None:
             try:
                 budget = float(budget_raw)
             except (TypeError, ValueError):
-                raise SystemExit(f"task {item.get('id')} max_budget_usd must be number or null")
+                detail = "max_budget_usd must be number or null"
+                if profiled:
+                    profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, detail)
+                raise SystemExit(f"{owner} {detail}")
             if not math.isfinite(budget) or budget <= 0:
-                raise SystemExit(f"task {item.get('id')} max_budget_usd must be finite and > 0 (use null for unlimited)")
+                detail = "max_budget_usd must be finite and > 0 (use null for unlimited)"
+                if profiled:
+                    profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, detail)
+                raise SystemExit(f"{owner} {detail}")
         else:
             budget = None
-        task_id = str(item["id"])
-        if "variant_prompts" in item:
-            raise SystemExit(
-                f"task {task_id} variant_prompts is not supported; use file-backed variant_prompt_files"
+        # profiled 경로에서는 매핑 키 등 attacker-controlled 라벨이 파서 오류에 실릴 수
+        # 있으므로, 구조 필드 오류(파서 SystemExit·필수 prompt 누락 KeyError)를 안정적인
+        # 프로파일 거부로 다시 쓴다. unprofiled 는 원본 예외를 그대로 재발생시킨다.
+        try:
+            max_turns = parse_positive_int(
+                item.get("max_turns", 3), field="max_turns", owner=owner,
+            )
+            allowed_tools = parse_string_list(
+                item.get("allowed_tools", []),
+                field="allowed_tools",
+                owner=owner,
             )
+            variant_prompt_files = parse_string_map(
+                item.get("variant_prompt_files"),
+                field="variant_prompt_files",
+                owner=owner,
+            )
+            prompt = str(item["prompt"])
+        except (SystemExit, KeyError):
+            if profiled:
+                profile_reject(
+                    PROFILE_REJECT_SCHEMA_INVALID,
+                    owner,
+                    "task fixture fields are invalid",
+                )
+            raise
         fixtures.append(TaskFixture(
+            evaluation_profile=evaluation_profile,
             id=task_id,
-            prompt=str(item["prompt"]),
+            prompt=prompt,
             model=str(item.get("model", "sonnet")),
             effort=str(effort_raw) if effort_raw is not None else None,
-            max_turns=parse_positive_int(item.get("max_turns", 3), field="max_turns", owner=f"task {task_id}"),
+            max_turns=max_turns,
             max_budget_usd=budget,
-            allowed_tools=parse_string_list(
-                item.get("allowed_tools", []),
-                field="allowed_tools",
-                owner=f"task {task_id}",
-            ),
+            allowed_tools=allowed_tools,
             success_command=item.get("success_command"),
             success_cwd=str(item.get("success_cwd", ".")),
-            variant_prompt_files=parse_string_map(
-                item.get("variant_prompt_files"),
-                field="variant_prompt_files",
-                owner=f"task {task_id}",
-            ),
+            variant_prompt_files=variant_prompt_files,
         ))
     if variants is not None:
         validate_variant_prompt_file_references(fixtures, variants)
@@ -1498,72 +1739,93 @@ def append_csv(
     existing_key_cache: set[tuple[str, str]] | None = None,
     existing_key_cache_stamp: dict[str, tuple[int, int, int, int] | None] | None = None,
 ) -> bool:
-    with csv_file_lock(csv_path, create_parent=True):
-        key = (result.task_id, result.variant)
-        if skip_existing:
-            if existing_key_cache is not None:
-                refresh_existing_key_cache_unlocked(csv_path, existing_key_cache, existing_key_cache_stamp)
-                if key in existing_key_cache:
-                    return False
-            elif key in _read_existing_keys_unlocked(csv_path):
-                return False
-        flags = os.O_CREAT | os.O_APPEND | os.O_WRONLY
-        fd = _open_regular_no_symlink(csv_path, flags, 0o600, create_parent=True)
-        try:
-            new_file = os.fstat(fd).st_size == 0
-            if not new_file:
-                validate_csv_schema(csv_path, read_csv_header_unlocked(csv_path))
-            with os.fdopen(fd, "a", encoding="utf-8", newline="") as f:
-                fd = -1
-                writer = csv.DictWriter(f, fieldnames=CSV_COLUMNS)
-                if new_file:
-                    writer.writeheader()
-                tokens = result.tokens
-                total = sum(tokens.values())
-                shifted_cost_known = cost_shift_measured(result)
-                writer.writerow({
-                    "date": sanitize_csv_cell(_dt.datetime.now().strftime("%Y-%m-%dT%H:%M:%S")),
-                    "claude_version": sanitize_csv_cell(claude_ver),
-                    "task_id": sanitize_csv_cell(result.task_id),
-                    "variant": sanitize_csv_cell(result.variant),
-                    "model": sanitize_csv_cell(result.model),
-                    "effort": sanitize_csv_cell(result.effort),
-                    "total_tokens": total,
-                    "input_tokens": tokens.get("input_tokens", 0),
-                    "output_tokens": tokens.get("output_tokens", 0),
-                    "cache_read": tokens.get("cache_read", 0),
-                    "cache_creation": tokens.get("cache_creation", 0),
-                    "provider_cached_tokens": result.provider_cached_tokens,
-                    "provider_cached_tokens_measured": (
-                        "true" if result.provider_cached_tokens_measured else "false"
-                    ),
-                    "cost_usd": f"{result.cost_usd:.6f}",
-                    "cost_measured": "true" if result.cost_measured else "false",
-                    "wall_time_seconds": f"{result.wall_time_seconds:.6f}",
-                    "turns": result.turns,
-                    "hook_triggers": result.hook_triggers,
-                    "bytes_before": result.bytes_before,
-                    "bytes_after": result.bytes_after,
-                    "artifacts_used": result.artifacts_used,
-                    "external_tokens": result.external_tokens,
-                    "external_tokens_measured": "true" if result.external_tokens_measured else "false",
-                    "external_cost_usd": f"{result.external_cost_usd:.6f}",
-                    "external_cost_measured": "true" if result.external_cost_measured else "false",
-                    "total_cost_with_shift_usd": (
-                        f"{(result.cost_usd + result.external_cost_usd):.6f}" if shifted_cost_known else ""
-                    ),
-                    "success": "true" if result.success else "false",
-                    "corrections": result.corrections,
-                    "notes": sanitize_csv_note(result.notes),
-                    "primary_tokens_measured": "true" if result.primary_tokens_measured else "false",
-                })
-        finally:
-            if fd != -1:
-                os.close(fd)
+    with csv_parent_directory_lock(csv_path, create_parent=True):
+        with csv_file_lock(csv_path, create_parent=False):
+            return append_csv_unlocked(
+                csv_path,
+                claude_ver,
+                result,
+                skip_existing=skip_existing,
+                existing_key_cache=existing_key_cache,
+                existing_key_cache_stamp=existing_key_cache_stamp,
+            )
+
+
+def append_csv_unlocked(
+    csv_path: Path,
+    claude_ver: str,
+    result: RunResult,
+    *,
+    skip_existing: bool = False,
+    existing_key_cache: set[tuple[str, str]] | None = None,
+    existing_key_cache_stamp: dict[str, tuple[int, int, int, int] | None] | None = None,
+) -> bool:
+    """Append one row while the caller holds the CSV transaction lock."""
+    key = (result.task_id, result.variant)
+    if skip_existing:
         if existing_key_cache is not None:
-            existing_key_cache.add(key)
-        if existing_key_cache_stamp is not None:
-            existing_key_cache_stamp["stamp"] = csv_file_stamp_unlocked(csv_path)
+            refresh_existing_key_cache_unlocked(csv_path, existing_key_cache, existing_key_cache_stamp)
+            if key in existing_key_cache:
+                return False
+        elif key in _read_existing_keys_unlocked(csv_path):
+            return False
+    flags = os.O_CREAT | os.O_APPEND | os.O_WRONLY
+    fd = _open_regular_no_symlink(csv_path, flags, 0o600, create_parent=True)
+    try:
+        new_file = os.fstat(fd).st_size == 0
+        if not new_file:
+            validate_csv_schema(csv_path, read_csv_header_unlocked(csv_path))
+        with os.fdopen(fd, "a", encoding="utf-8", newline="") as f:
+            fd = -1
+            writer = csv.DictWriter(f, fieldnames=CSV_COLUMNS)
+            if new_file:
+                writer.writeheader()
+            tokens = result.tokens
+            total = sum(tokens.values())
+            shifted_cost_known = cost_shift_measured(result)
+            writer.writerow({
+                "date": sanitize_csv_cell(_dt.datetime.now().strftime("%Y-%m-%dT%H:%M:%S")),
+                "claude_version": sanitize_csv_cell(claude_ver),
+                "task_id": sanitize_csv_cell(result.task_id),
+                "variant": sanitize_csv_cell(result.variant),
+                "model": sanitize_csv_cell(result.model),
+                "effort": sanitize_csv_cell(result.effort),
+                "total_tokens": total,
+                "input_tokens": tokens.get("input_tokens", 0),
+                "output_tokens": tokens.get("output_tokens", 0),
+                "cache_read": tokens.get("cache_read", 0),
+                "cache_creation": tokens.get("cache_creation", 0),
+                "provider_cached_tokens": result.provider_cached_tokens,
+                "provider_cached_tokens_measured": (
+                    "true" if result.provider_cached_tokens_measured else "false"
+                ),
+                "cost_usd": f"{result.cost_usd:.6f}",
+                "cost_measured": "true" if result.cost_measured else "false",
+                "wall_time_seconds": f"{result.wall_time_seconds:.6f}",
+                "turns": result.turns,
+                "hook_triggers": result.hook_triggers,
+                "bytes_before": result.bytes_before,
+                "bytes_after": result.bytes_after,
+                "artifacts_used": result.artifacts_used,
+                "external_tokens": result.external_tokens,
+                "external_tokens_measured": "true" if result.external_tokens_measured else "false",
+                "external_cost_usd": f"{result.external_cost_usd:.6f}",
+                "external_cost_measured": "true" if result.external_cost_measured else "false",
+                "total_cost_with_shift_usd": (
+                    f"{(result.cost_usd + result.external_cost_usd):.6f}" if shifted_cost_known else ""
+                ),
+                "success": "true" if result.success else "false",
+                "corrections": result.corrections,
+                "notes": sanitize_csv_note(result.notes),
+                "primary_tokens_measured": "true" if result.primary_tokens_measured else "false",
+            })
+    finally:
+        if fd != -1:
+            os.close(fd)
+    if existing_key_cache is not None:
+        existing_key_cache.add(key)
+    if existing_key_cache_stamp is not None:
+        existing_key_cache_stamp["stamp"] = csv_file_stamp_unlocked(csv_path)
     return True
 
 
@@ -2021,6 +2283,26 @@ def parse_evidence_row(raw_value: Any, *, owner: str, line_number: int) -> Evide
         primary_tokens_measured=primary_tokens_measured,
         self_hosted_metrics=self_hosted_metrics,
     )
+    # Profile metadata 는 추가 필드로만 수집한다. 깊은 검증은 preflight 에서 task/prompt
+    # 문맥과 함께 수행하며, 어떤 출력도 기록되기 전에 끝난다.
+    # profile 오류는 evidence 파일 경로를 절대 echo 하지 않는다. 줄 번호만으로 위치를 준다.
+    profile_row_owner = f"evidence line {line_number}"
+    evaluation_profile = raw.get("evaluation_profile")
+    if evaluation_profile is not None and (
+        not isinstance(evaluation_profile, str)
+        or evaluation_profile not in SUPPORTED_EVALUATION_PROFILE_IDS
+    ):
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, profile_row_owner,
+            "evaluation_profile is not a supported profile id",
+        )
+    evaluation_controls = raw.get("evaluation_controls")
+    if evaluation_controls is not None and not isinstance(evaluation_controls, dict):
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, profile_row_owner,
+            "evaluation_controls must be a JSON object",
+        )
+
     return EvidenceReplayRow(
         result=result,
         source_type=str(provenance["source_type"]),
@@ -2031,6 +2313,8 @@ def parse_evidence_row(raw_value: Any, *, owner: str, line_number: int) -> Evide
         public_claim_eligible=False,
         explicit_notes=explicit_notes,
         line_number=line_number,
+        evaluation_profile=evaluation_profile,
+        evaluation_controls=evaluation_controls,
     )
 
 
@@ -2236,6 +2520,860 @@ def measurement_baseline_contract() -> dict[str, Any]:
     }
 
 
+# --- image-context evaluation profile: bounded validation + fail-closed preflight ---
+#
+# 검증 순서는 불변이다: 타입/바운드 검사가 항상 semantic 정책 분류보다 먼저 실행된다.
+# 따라서 oversize 된 non-`deny` 정책 값이 blocked-scorecard 분기로 새어나갈 수 없다.
+# 구조적으로 해석 불가능한 evidence 는 어떤 출력 바이트도 쓰이기 전에 거부(reject_prewrite)되고,
+# 형식이 올바른 negative evidence 는 수용되어 blocked lane score 로 보고된다.
+
+PROFILE_CONTROL_BLOCK_KEYS = (
+    "control_provenance",
+    "exact_text_fallback",
+    "human_correction",
+    "missed_context_review",
+    "prompt_evidence",
+    "protected_zone_review",
+    "provider_usage",
+    "shifted_cost",
+    "source_omission",
+)
+PROFILE_NESTED_KEYS: dict[str, tuple[str, ...]] = {
+    "control_provenance": ("review_source", "verifier_label"),
+    "exact_text_fallback": (
+        "available", "verified", "receipt_id", "content_sha256",
+        "retrieval_command", "verifier_projection",
+    ),
+    "human_correction": ("count", "reason"),
+    "missed_context_review": ("correction_required", "present", "review_completed", "summary"),
+    "prompt_evidence": ("sha256", "source_label"),
+    "protected_zone_review": (
+        "included_prompt_like_regions", "included_protected_regions", "policy",
+        "review_completed", "review_note", "reviewer_label",
+    ),
+    "provider_usage": ("primary_cost_measured", "primary_tokens_measured", "provider_called"),
+    "shifted_cost": ("external_cost_measured", "external_tokens_measured", "status"),
+    "source_omission": ("present", "transform"),
+}
+PROFILE_PROJECTION_KEYS = (
+    "schema", "status", "blockers", "candidate_replacement", "claim_boundary", "proof_unit",
+)
+PROFILE_PROOF_UNIT_KEYS = (
+    "status", "receipt_id", "receipt_verified", "content_hash_declared_value",
+    "content_hash_verified", "rehydration_receipt_bound", "rehydration_syntax_valid",
+    "rehydration_verified", "rehydration_executed", "retrieval_command",
+)
+PROFILE_PROOF_UNIT_REQUIRED_FLAGS = (
+    "receipt_verified",
+    "content_hash_verified",
+    "rehydration_receipt_bound",
+    "rehydration_syntax_valid",
+    "rehydration_verified",
+)
+PROFILE_SHIFTED_COST_STATUSES = ("measured", "unmeasured")
+
+
+def redact_profile_label(value: Any) -> str:
+    """Bound one untrusted label so an error message can never carry a payload.
+
+    Task ids, variant names, unknown evidence keys, and prompt-map labels are
+    author-controlled. Opted-in profile diagnostics must use a fully opaque fixed
+    representation for every such value — even regex-safe-looking identifiers —
+    because any preserved attacker text is itself a leak channel. The stable error
+    id and fixed field names carry the meaning; ``value`` is intentionally unused.
+    """
+    # 작성자 통제 값은 형태와 무관하게 절대 진단에 싣지 않는다.
+    return PROFILE_REDACTED_PLACEHOLDER
+
+
+def redact_profile_labels(values: Iterable[Any]) -> str:
+    """Render a bounded, fully opaque key list for schema errors.
+
+    The count is always truthful; each name collapses to the shared placeholder so
+    no author-controlled text rides the message. The list is truncated so an
+    oversized evidence object cannot flood the diagnostic.
+    """
+    labels = [redact_profile_label(value) for value in values]
+    shown = labels[:MAX_PROFILE_ERROR_LABELS]
+    overflow = len(labels) - len(shown)
+    rendered = ", ".join(shown)
+    if overflow > 0:
+        rendered = f"{rendered}, +{overflow} more"
+    return rendered
+
+
+def profile_owner(task_id: Any, variant: Any = None) -> str:
+    """Build the redacted owner prefix shared by every profile error."""
+    owner = f"task {redact_profile_label(task_id)}"
+    if variant is not None:
+        owner = f"{owner} variant {redact_profile_label(variant)}"
+    return owner
+
+
+def profile_reject(error_id: str, owner: str, detail: str) -> "NoReturn":
+    """Fail closed with a stable id and a bounded, redacted message.
+
+    Raw policy text, prompt content, and filesystem paths are never echoed. ``owner``
+    must already come from :func:`profile_owner` and ``detail`` must be a fixed
+    literal or a redacted label list; the final message is sanitized again so no
+    caller can smuggle a secret-shaped value through.
+    """
+    raise SystemExit(sanitize_note_text(f"{error_id}: {owner} {detail}"))
+
+
+def profile_block(controls: dict[str, Any], key: str, *, owner: str) -> dict[str, Any]:
+    if key not in controls:
+        profile_reject(PROFILE_REJECT_CONTROLS_MISSING, owner, f"evaluation_controls.{key} is required")
+    value = controls[key]
+    if not isinstance(value, dict):
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"evaluation_controls.{key} must be an object")
+    unknown = sorted(set(value) - set(PROFILE_NESTED_KEYS[key]))
+    if unknown:
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, owner,
+            f"evaluation_controls.{key} has unknown v1 key(s): {redact_profile_labels(unknown)}",
+        )
+    return value
+
+
+def profile_bool(block: dict[str, Any], key: str, *, owner: str, label: str) -> bool:
+    value = block.get(key)
+    if not isinstance(value, bool):
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"{label}.{key} must be a boolean")
+    return value
+
+
+def profile_int(block: dict[str, Any], key: str, *, owner: str, label: str, maximum: int) -> int:
+    value = block.get(key)
+    if isinstance(value, bool) or not isinstance(value, int):
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"{label}.{key} must be an integer")
+    if value < 0 or value > maximum:
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"{label}.{key} is outside its allowed bounds")
+    return value
+
+
+def profile_text(block: dict[str, Any], key: str, *, owner: str, label: str, maximum: int) -> str:
+    value = block.get(key)
+    if not isinstance(value, str):
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"{label}.{key} must be a string")
+    if len(value.encode("utf-8")) > maximum:
+        # 값 자체는 절대 에러에 실지 않는다. 길이 위반 사실만 보고한다.
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, f"{label}.{key} exceeds its {maximum}-byte bound")
+    return value
+
+
+def profile_variant_prompt_sha256(task: TaskFixture, variant_name: str, *, task_file_dir: Path, owner: str) -> str:
+    """SHA-256 of the selected variant prompt file, read with the existing safe reader."""
+    raw_path = task.variant_prompt_files.get(variant_name)
+    if not raw_path:
+        profile_reject(
+            PROFILE_REJECT_PROMPT_BINDING_INVALID, owner,
+            "a profiled task requires a file-backed variant_prompt_files entry for every selected variant",
+        )
+    try:
+        rel_path = validate_variant_prompt_file_path(raw_path, owner=owner)
+        text = read_variant_prompt_file(
+            task_file_dir / rel_path, owner=owner, display_path=str(rel_path),
+        )
+    except (SystemExit, ValueError, UnicodeError):
+        # SystemExit: 경로/내용 누설 방지용 안정 프로파일 오류 재작성.
+        # ValueError/UnicodeError: 조기 검증을 지나친 os.open NUL·인코딩 거부 등만 좁게 정규화.
+        # 프로그래머 버그를 숨기지 않도록 범용 Exception 은 잡지 않는다.
+        profile_reject(
+            PROFILE_REJECT_PROMPT_BINDING_INVALID, owner,
+            "the selected variant prompt file could not be safely read",
+        )
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def validate_profile_fallback_projection(fallback: dict[str, Any], *, owner: str) -> None:
+    """Validate one bounded imported local-verifier projection.
+
+    A record that *claims* verification while contradicting its own binding fields is a
+    structural rejection. Replay never authenticates the record's author and never
+    rereads the artifact; this only checks internal consistency.
+    """
+    # 검증을 주장하려면 fallback 자체가 available 이어야 한다. available=false 인데
+    # verified=true 인 레코드는 자기 모순이다.
+    if fallback.get("available") is not True:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification while declaring the fallback unavailable",
+        )
+    # placeholder receipt/command 로는 어떤 것도 되찾을 수 없다. 검증 주장에는 실제
+    # 값이 필요하다.
+    for key in ("receipt_id", "retrieval_command"):
+        value = fallback.get(key)
+        if not isinstance(value, str) or value.strip().lower() in PROFILE_FALLBACK_PLACEHOLDER_VALUES:
+            profile_reject(
+                PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+                f"exact_text_fallback claims verification without an exact {key}",
+            )
+    projection = fallback.get("verifier_projection")
+    if not isinstance(projection, dict):
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification without a bounded verifier projection",
+        )
+    unknown = sorted(set(projection) - set(PROFILE_PROJECTION_KEYS))
+    if unknown:
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, owner,
+            f"exact_text_fallback.verifier_projection has unknown v1 key(s): {redact_profile_labels(unknown)}",
+        )
+    if projection.get("schema") != PROOF_VERIFICATION_SCHEMA_VERSION:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "verifier projection schema does not match the local proof-verification contract",
+        )
+    if projection.get("status") != PROOF_VERIFICATION_VERIFIED_STATUS:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification but the verifier status is not verified",
+        )
+    blockers = projection.get("blockers")
+    if not isinstance(blockers, list) or len(blockers) > MAX_PROFILE_BLOCKER_ITEMS:
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, "verifier projection blockers must be a bounded list")
+    if blockers:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification but the verifier reports blockers",
+        )
+    if projection.get("candidate_replacement") is not None:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification but the verifier proposes a candidate replacement",
+        )
+    # 가져온 레코드는 local-only 경계를 그대로 선언해야 한다. 경계가 다르면 이 lane 이
+    # 인정할 수 있는 권한 범위를 벗어난 주장이다.
+    if projection.get("claim_boundary") != PROOF_VERIFICATION_CLAIM_BOUNDARY:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification without the expected local-only claim boundary",
+        )
+    unit = projection.get("proof_unit")
+    if not isinstance(unit, dict):
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification without exactly one verified proof unit",
+        )
+    unknown_unit = sorted(set(unit) - set(PROFILE_PROOF_UNIT_KEYS))
+    if unknown_unit:
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, owner,
+            f"verifier proof_unit has unknown v1 key(s): {redact_profile_labels(unknown_unit)}",
+        )
+    if unit.get("status") != PROOF_VERIFICATION_VERIFIED_STATUS:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification but its proof unit is not verified",
+        )
+    for flag in PROFILE_PROOF_UNIT_REQUIRED_FLAGS:
+        if unit.get(flag) is not True:
+            profile_reject(
+                PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+                f"exact_text_fallback claims verification but proof_unit.{flag} does not confirm it",
+            )
+    # local verifier 는 rehydration 을 실행하지 않는다. 실행했다고 주장하면 이 레코드는
+    # 우리가 검증할 수 있는 evaluation-only 경계 밖의 산출물이다.
+    if unit.get("rehydration_executed") is not PROOF_VERIFICATION_REHYDRATION_EXECUTED:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback claims verification but proof_unit.rehydration_executed leaves the local-only boundary",
+        )
+    if unit.get("receipt_id") != fallback["receipt_id"]:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback receipt id is not bound to the verified proof unit",
+        )
+    if unit.get("content_hash_declared_value") != fallback["content_sha256"]:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback content hash is not bound to the verified proof unit",
+        )
+    if unit.get("retrieval_command") != fallback["retrieval_command"]:
+        profile_reject(
+            PROFILE_REJECT_FALLBACK_CLAIM_INCONSISTENT, owner,
+            "exact_text_fallback retrieval command is not bound to the verified proof unit",
+        )
+
+
+def validate_profile_row_controls(
+    row: EvidenceReplayRow,
+    task: TaskFixture,
+    *,
+    task_file_dir: Path,
+) -> dict[str, Any]:
+    """Validate one profiled evidence row and return its normalized lane record."""
+    owner = profile_owner(task.id, row.result.variant)
+    controls = row.evaluation_controls
+    if controls is None:
+        profile_reject(PROFILE_REJECT_CONTROLS_MISSING, owner, "evaluation_controls is required for a profiled row")
+    unknown = sorted(set(controls) - set(PROFILE_CONTROL_BLOCK_KEYS))
+    if unknown:
+        profile_reject(
+            PROFILE_REJECT_SCHEMA_INVALID, owner,
+            f"evaluation_controls has unknown v1 key(s): {redact_profile_labels(unknown)}",
+        )
+
+    # --- prompt binding -------------------------------------------------
+    prompt_evidence = profile_block(controls, "prompt_evidence", owner=owner)
+    declared_sha = profile_text(prompt_evidence, "sha256", owner=owner, label="prompt_evidence", maximum=64)
+    profile_text(prompt_evidence, "source_label", owner=owner, label="prompt_evidence", maximum=MAX_PROFILE_LABEL_CHARS)
+    if not SHA256_HEX_PATTERN.match(declared_sha):
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, "prompt_evidence.sha256 must be lowercase hex SHA-256")
+    actual_sha = profile_variant_prompt_sha256(task, row.result.variant, task_file_dir=task_file_dir, owner=owner)
+    if declared_sha != actual_sha:
+        profile_reject(
+            PROFILE_REJECT_PROMPT_BINDING_INVALID, owner,
+            "prompt_evidence.sha256 does not match the locally recomputed prompt hash",
+        )
+
+    # --- omission + exact-text fallback ---------------------------------
+    source_omission = profile_block(controls, "source_omission", owner=owner)
+    omission_present = profile_bool(source_omission, "present", owner=owner, label="source_omission")
+    profile_text(source_omission, "transform", owner=owner, label="source_omission", maximum=MAX_PROFILE_LABEL_CHARS)
+
+    fallback = profile_block(controls, "exact_text_fallback", owner=owner)
+    profile_bool(fallback, "available", owner=owner, label="exact_text_fallback")
+    fallback_verified = profile_bool(fallback, "verified", owner=owner, label="exact_text_fallback")
+    profile_text(fallback, "receipt_id", owner=owner, label="exact_text_fallback", maximum=MAX_PROFILE_RECEIPT_ID_CHARS)
+    fallback_sha = profile_text(
+        fallback, "content_sha256", owner=owner, label="exact_text_fallback", maximum=MAX_PROFILE_RECEIPT_ID_CHARS,
+    )
+    profile_text(
+        fallback, "retrieval_command", owner=owner, label="exact_text_fallback", maximum=MAX_PROFILE_COMMAND_CHARS,
+    )
+    if fallback_verified:
+        if not SHA256_HEX_PATTERN.match(fallback_sha):
+            profile_reject(
+                PROFILE_REJECT_SCHEMA_INVALID, owner,
+                "exact_text_fallback.content_sha256 must be lowercase hex SHA-256 when verification is claimed",
+            )
+        validate_profile_fallback_projection(fallback, owner=owner)
+    # 생략된 원문이 있는데 통과한 attestation 이 없으면 lane 을 막는다(거부가 아니다).
+    fallback_bound = (not omission_present) or fallback_verified
+
+    # --- protected zone review ------------------------------------------
+    protection = profile_block(controls, "protected_zone_review", owner=owner)
+    # 바운드 검사가 정책 의미 분류보다 먼저다: oversize 값은 blocked 가 아니라 reject 다.
+    policy = profile_text(
+        protection, "policy", owner=owner, label="protected_zone_review", maximum=MAX_PROFILE_POLICY_CHARS,
+    )
+    protection_completed = profile_bool(protection, "review_completed", owner=owner, label="protected_zone_review")
+    included_protected = profile_int(
+        protection, "included_protected_regions", owner=owner,
+        label="protected_zone_review", maximum=MAX_PROFILE_PROTECTED_REGION_COUNT,
+    )
+    included_prompt_like = profile_int(
+        protection, "included_prompt_like_regions", owner=owner,
+        label="protected_zone_review", maximum=MAX_PROFILE_PROTECTED_REGION_COUNT,
+    )
+    profile_text(
+        protection, "reviewer_label", owner=owner, label="protected_zone_review", maximum=MAX_PROFILE_LABEL_CHARS,
+    )
+    profile_text(
+        protection, "review_note", owner=owner, label="protected_zone_review", maximum=MAX_PROFILE_NOTE_CHARS,
+    )
+    protection_attested = (
+        policy == PROTECTED_ZONE_DENY_POLICY
+        and protection_completed
+        and included_protected == 0
+        and included_prompt_like == 0
+    )
+
+    # --- missed context review ------------------------------------------
+    missed = profile_block(controls, "missed_context_review", owner=owner)
+    missed_completed = profile_bool(missed, "review_completed", owner=owner, label="missed_context_review")
+    missed_present = profile_bool(missed, "present", owner=owner, label="missed_context_review")
+    profile_bool(missed, "correction_required", owner=owner, label="missed_context_review")
+    profile_text(missed, "summary", owner=owner, label="missed_context_review", maximum=MAX_PROFILE_SUMMARY_CHARS)
+    missed_reviewed = missed_completed and not missed_present
+
+    # --- human correction consistency -----------------------------------
+    correction = profile_block(controls, "human_correction", owner=owner)
+    correction_count = profile_int(
+        correction, "count", owner=owner, label="human_correction", maximum=MAX_PROFILE_CORRECTION_COUNT,
+    )
+    correction_reason = profile_text(
+        correction, "reason", owner=owner, label="human_correction", maximum=MAX_PROFILE_NOTE_CHARS,
+    )
+    if correction_count != row.result.corrections:
+        profile_reject(
+            PROFILE_REJECT_CORRECTION_INCONSISTENT, owner,
+            "human_correction.count does not equal the row's top-level corrections field",
+        )
+    if correction_count > 0 and (not correction_reason.strip() or correction_reason.strip().lower() == "none"):
+        profile_reject(
+            PROFILE_REJECT_CORRECTION_INCONSISTENT, owner,
+            "a positive human_correction.count requires an explicit bounded reason",
+        )
+
+    # --- measurement flags may never upgrade the generic normalized fields
+    provider_usage = profile_block(controls, "provider_usage", owner=owner)
+    lane_tokens_measured = profile_bool(provider_usage, "primary_tokens_measured", owner=owner, label="provider_usage")
+    lane_cost_measured = profile_bool(provider_usage, "primary_cost_measured", owner=owner, label="provider_usage")
+    profile_bool(provider_usage, "provider_called", owner=owner, label="provider_usage")
+    if lane_tokens_measured != row.result.primary_tokens_measured or lane_cost_measured != row.result.cost_measured:
+        profile_reject(
+            PROFILE_REJECT_MEASUREMENT_INCONSISTENT, owner,
+            "provider_usage measurement flags contradict the generic normalized provider fields",
+        )
+
+    shifted = profile_block(controls, "shifted_cost", owner=owner)
+    lane_external_tokens = profile_bool(shifted, "external_tokens_measured", owner=owner, label="shifted_cost")
+    lane_external_cost = profile_bool(shifted, "external_cost_measured", owner=owner, label="shifted_cost")
+    shifted_status = profile_text(
+        shifted, "status", owner=owner, label="shifted_cost", maximum=MAX_PROFILE_LABEL_CHARS,
+    )
+    if shifted_status not in PROFILE_SHIFTED_COST_STATUSES:
+        profile_reject(PROFILE_REJECT_SCHEMA_INVALID, owner, "shifted_cost.status must be measured or unmeasured")
+    if (
+        lane_external_tokens != row.result.external_tokens_measured
+        or lane_external_cost != row.result.external_cost_measured
+    ):
+        profile_reject(
+            PROFILE_REJECT_MEASUREMENT_INCONSISTENT, owner,
+            "shifted_cost measurement flags contradict the generic normalized shifted-cost fields",
+        )
+    if (shifted_status == "measured") != (lane_external_tokens and lane_external_cost):
+        profile_reject(
+            PROFILE_REJECT_MEASUREMENT_INCONSISTENT, owner,
+            "shifted_cost.status contradicts its own measurement flags",
+        )
+
+    provenance_block = profile_block(controls, "control_provenance", owner=owner)
+    profile_text(
+        provenance_block, "review_source", owner=owner, label="control_provenance", maximum=MAX_PROFILE_LABEL_CHARS,
+    )
+    profile_text(
+        provenance_block, "verifier_label", owner=owner, label="control_provenance", maximum=MAX_PROFILE_LABEL_CHARS,
+    )
+
+    # 정규화된 lane 판정만 보고에 전달한다. 자유 텍스트(정책/노트/요약/라벨)는 절대
+    # 포함하지 않으므로 secret-shaped 값이 report/dashboard 로 새어나갈 수 없다.
+    return {
+        "task_id": task.id,
+        "variant": row.result.variant,
+        "success": bool(row.result.success),
+        "source_omission_present": omission_present,
+        "fallback_bound": fallback_bound,
+        "fallback_verified": fallback_verified,
+        # 아무 verifier 레코드도 제출되지 않은 경우("missing")와 제출되었으나 실패를
+        # 보고하는 경우("failed")는 서로 다른 증거 수준이다.
+        "fallback_projection_supplied": fallback.get("verifier_projection") is not None,
+        "protected_zone_attested": protection_attested,
+        "missed_context_reviewed": missed_reviewed,
+        # lane 이 correction 판정을 lane 데이터에서 직접 유도할 수 있도록 정규화해 넘긴다.
+        "human_correction_consistent": correction_count == row.result.corrections,
+        "provider_measured": bool(row.result.primary_tokens_measured and row.result.cost_measured),
+        "shifted_cost_measured": bool(lane_external_tokens and lane_external_cost),
+    }
+
+
+def selected_profiled_task_ids(
+    tasks: list[TaskFixture],
+    targets: list[tuple[TaskFixture, Variant]],
+) -> list[str]:
+    """Profiled task ids that this invocation actually selected, in stable order."""
+    profiled = {task.id for task in tasks if task.evaluation_profile is not None}
+    selected = {task.id for task, _ in targets}
+    return sorted(profiled & selected)
+
+
+def preflight_profile_replay_mode(
+    tasks: list[TaskFixture],
+    targets: list[tuple[TaskFixture, Variant]],
+    *,
+    evidence_replay_active: bool,
+) -> None:
+    """Refuse a profiled task outside evidence replay, before any provider call.
+
+    The profile is evaluation-only: it validates imported evidence and clamps every
+    authority surface. Those checks live entirely on the replay path, so running a
+    profiled task through the provider would execute a real run whose report never
+    sees profile validation or the evaluation-only clamp. Fail closed instead, before
+    the provider runtime, the lock sidecar, and the first output byte.
+
+    This also refuses ``--dry-run``. A dry run writes nothing and spawns no provider,
+    so it is not itself dangerous, but keeping the invariant absolute — a profiled task
+    never enters the provider path — is what makes the boundary auditable. The useful
+    preview, ``--evidence-jsonl --dry-run``, is unaffected.
+    """
+    if evidence_replay_active:
+        return
+    for task_id in selected_profiled_task_ids(tasks, targets):
+        profile_reject(
+            PROFILE_REJECT_REPLAY_REQUIRED, profile_owner(task_id),
+            "a profiled task is evaluation-only and runs only under --evidence-jsonl replay; "
+            "provider execution is refused",
+        )
+
+
+def preflight_profile_fresh_output(
+    tasks: list[TaskFixture],
+    targets: list[tuple[TaskFixture, Variant]],
+    *,
+    resume: bool,
+    csv_has_preexisting_content: bool,
+) -> None:
+    """Refuse a resumed or pre-existing profiled batch before any lock/read helper.
+
+    v1 gives up incremental replay so profile context cannot silently vanish from a
+    resumed report. This must run before the resume key snapshot, which acquires the
+    CSV lock and therefore creates a ``.lock`` sidecar: rejecting afterwards would
+    leave a byte on disk for a run we refused.
+    """
+    if not (resume or csv_has_preexisting_content):
+        return
+    for task_id in selected_profiled_task_ids(tasks, targets):
+        profile_reject(
+            PROFILE_REJECT_FRESH_OUTPUT_REQUIRED, profile_owner(task_id),
+            "v1 profiled replay requires a fresh empty results CSV and forbids --resume",
+        )
+
+
+def profile_batch_freshness_gate_unlocked(
+    tasks: list[TaskFixture],
+    targets: list[tuple[TaskFixture, Variant]],
+    csv_path: Path,
+) -> None:
+    """Recheck output freshness while the caller holds the full-batch lock.
+
+    The pre-lock gate reads the CSV without the lock, so a concurrent writer could
+    still land a row between that check and the first append. One recheck under the
+    caller's held parent-directory lock closes that window for the whole batch.
+    """
+    profiled_task_ids = selected_profiled_task_ids(tasks, targets)
+    if not profiled_task_ids:
+        return
+    if file_has_content_no_follow(csv_path):
+        profile_reject(
+            PROFILE_REJECT_FRESH_OUTPUT_REQUIRED,
+            profile_owner(profiled_task_ids[0]),
+            "the results CSV gained content after the profiled batch was validated",
+        )
+
+
+def preflight_evaluation_profiles(
+    tasks: list[TaskFixture],
+    variants: list[Variant],
+    targets: list[tuple[TaskFixture, Variant]],
+    evidence_rows: list[EvidenceReplayRow],
+    *,
+    task_file_dir: Path,
+    resume: bool,
+    csv_has_preexisting_content: bool,
+    baseline_variant: str = "baseline",
+) -> None:
+    """Validate the complete profiled batch before the first output byte is written.
+
+    Runs before any CSV/ledger/report/dashboard write and before any lock sidecar is
+    created, so a rejection leaves the filesystem byte-unchanged. Attaches the
+    normalized lane record to each row, which makes report annotation infallible over
+    an already-validated batch.
+    """
+    # 같은 gate 를 main 이 lock helper 이전에 이미 호출한다. 여기서 다시 부르는 것은
+    # 이 함수를 직접 쓰는 호출자도 같은 boundary 를 얻게 하기 위한 이중 방어다.
+    preflight_profile_fresh_output(
+        tasks, targets, resume=resume, csv_has_preexisting_content=csv_has_preexisting_content,
+    )
+    profiled_tasks = {task.id: task for task in tasks if task.evaluation_profile is not None}
+    rows_by_task: dict[str, list[EvidenceReplayRow]] = collections.defaultdict(list)
+    for row in evidence_rows:
+        rows_by_task[row.result.task_id].append(row)
+
+    # profiled row 가 unprofiled task 에 붙는 경우도 binding 위반이다.
+    for row in evidence_rows:
+        task = profiled_tasks.get(row.result.task_id)
+        if task is None and (row.evaluation_profile is not None or row.evaluation_controls is not None):
+            profile_reject(
+                PROFILE_REJECT_BINDING_MISMATCH,
+                profile_owner(row.result.task_id, row.result.variant),
+                "a profiled evidence row cannot be replayed against a task that does not declare the profile",
+            )
+    if not profiled_tasks:
+        return
+
+    variant_names = {variant.name for variant in variants}
+    if baseline_variant not in variant_names or len(variant_names - {baseline_variant}) < 1:
+        profile_reject(
+            PROFILE_REJECT_BATCH_INCOMPLETE,
+            profile_owner(next(iter(sorted(profiled_tasks)))),
+            "v1 profiled replay requires the configured baseline and at least one candidate variant",
+        )
+
+    selected_by_task: dict[str, set[str]] = collections.defaultdict(set)
+    for task, variant in targets:
+        selected_by_task[task.id].add(variant.name)
+
+    for task_id, task in sorted(profiled_tasks.items()):
+        selected = selected_by_task.get(task_id, set())
+        if not selected:
+            continue
+        # v1 은 부분 배치를 허용하지 않는다: 선택된 배치가 모든 variant 를 덮어야 한다.
+        expected = {variant.name for variant in variants}
+        if selected != expected:
+            profile_reject(
+                PROFILE_REJECT_BATCH_INCOMPLETE, profile_owner(task_id),
+                "v1 profiled replay requires the complete baseline/candidate batch; "
+                "partial variant selection is not supported",
+            )
+        task_rows = rows_by_task.get(task_id, [])
+        # 중복/여분 row 는 coverage 집합 계산에 흡수되어 조용히 통과했다. 배치가
+        # 모호하면 어떤 lane 판정도 신뢰할 수 없으므로 안정 ID 로 먼저 거부한다.
+        seen_variants: set[str] = set()
+        for row in task_rows:
+            owner = profile_owner(task_id, row.result.variant)
+            if row.result.variant in seen_variants:
+                profile_reject(
+                    PROFILE_REJECT_BATCH_INCOMPLETE, owner,
+                    "a profiled task cannot carry duplicate evidence rows for one variant",
+                )
+            seen_variants.add(row.result.variant)
+            if row.result.variant not in expected:
+                profile_reject(
+                    PROFILE_REJECT_BATCH_INCOMPLETE, owner,
+                    "a profiled batch cannot carry an evidence row for an unknown variant",
+                )
+        for row in task_rows:
+            owner = profile_owner(task_id, row.result.variant)
+            if row.evaluation_profile is None and row.evaluation_controls is None:
+                profile_reject(
+                    PROFILE_REJECT_BATCH_INCOMPLETE, owner,
+                    "a profiled task cannot mix profiled and unprofiled evidence rows",
+                )
+            if row.evaluation_profile != task.evaluation_profile:
+                profile_reject(
+                    PROFILE_REJECT_BINDING_MISMATCH, owner,
+                    "the evidence row profile does not equal the task profile",
+                )
+
+        covered = {row.result.variant for row in task_rows}
+        if not expected.issubset(covered):
+            profile_reject(
+                PROFILE_REJECT_BATCH_INCOMPLETE, profile_owner(task_id),
+                "profiled replay requires complete baseline and candidate evidence coverage",
+            )
+        for row in task_rows:
+            row.evaluation_lane = validate_profile_row_controls(row, task, task_file_dir=task_file_dir)
+
+
+def build_image_context_evaluation_lane(
+    replay_rows: list[EvidenceReplayRow],
+    report: dict[str, Any],
+) -> dict[str, Any] | None:
+    """Aggregate the validated lane records into the additive report block."""
+    lanes = [row.evaluation_lane for row in replay_rows if row.evaluation_lane is not None]
+    if not lanes:
+        return None
+
+    provider_measured = all(lane["provider_measured"] for lane in lanes)
+    shifted_measured = all(lane["shifted_cost_measured"] for lane in lanes)
+    all_success = all(lane["success"] for lane in lanes)
+    omission_lanes = [lane for lane in lanes if lane["source_omission_present"]]
+
+    # generic quality gate 결과를 lane 이 그대로 소비한다. profile 이 자기만의 판정으로
+    # generic regression 을 덮어쓰지 못하게 하는 것이 목적이므로, 어떤 matched pair 가
+    # regression 을 보고하면 lane 도 막힌다(보수적으로 fail-closed).
+    #
+    # 이름 붙은 두 gate 만 매핑하면 구멍이 남는다: quality_gate 는 corrections_regression /
+    # failure_rate_regression 외에도 insufficient_corrections_data 같은 값을 낼 수 있고,
+    # 그때 lane 이 ready 로 올라가면 안 된다. 따라서 불변식은 "pass 가 아니면 막는다" 이며,
+    # 두 이름은 이유를 드러내는 구체 blocker 로 함께 유지한다.
+    generic_quality_gates: set[str] = set()
+    pairs = report.get("matched_pair_evidence")
+    pair_keys: set[tuple[str, str]] = set()
+    if isinstance(pairs, list):
+        for pair in pairs:
+            if isinstance(pair, dict) and isinstance(pair.get("quality_gate"), str):
+                generic_quality_gates.add(pair["quality_gate"])
+                if isinstance(pair.get("task_id"), str) and isinstance(pair.get("variant"), str):
+                    pair_keys.add((pair["task_id"], pair["variant"]))
+    baseline_variant = report.get("baseline_variant")
+    expected_pair_keys = {
+        (lane["task_id"], lane["variant"])
+        for lane in lanes
+        if isinstance(baseline_variant, str) and lane["variant"] != baseline_variant
+    }
+    comparisons = report.get("comparisons")
+    comparison_rows = [item for item in comparisons if isinstance(item, dict)] if isinstance(comparisons, list) else []
+    expected_candidate_variants = {variant for _, variant in expected_pair_keys}
+    comparison_variants = {
+        item["variant"] for item in comparison_rows if isinstance(item.get("variant"), str)
+    }
+    all_comparisons_pass = (
+        bool(comparison_rows)
+        and comparison_variants == expected_candidate_variants
+        and all(
+            item.get("quality_gate") == GENERIC_QUALITY_GATE_PASS
+            and isinstance(item.get("matched_successful_task_count"), int)
+            and item["matched_successful_task_count"] > 0
+            for item in comparison_rows
+        )
+    )
+    complete_matched_pairs = bool(expected_pair_keys) and pair_keys == expected_pair_keys
+    generic_quality_pass = (
+        complete_matched_pairs
+        and all_comparisons_pass
+        and generic_quality_gates == {GENERIC_QUALITY_GATE_PASS}
+    )
+
+    gate_results = {
+        # preflight 를 통과했다면 profile/prompt binding 은 이미 증명되었다.
+        IMAGE_CONTEXT_GATE_PROFILE_AND_PROMPT_BINDING: True,
+        IMAGE_CONTEXT_GATE_PROTECTED_ZONE_DENY_REVIEW: all(lane["protected_zone_attested"] for lane in lanes),
+        IMAGE_CONTEXT_GATE_EXACT_TEXT_FALLBACK_BINDING: all(lane["fallback_bound"] for lane in lanes),
+        IMAGE_CONTEXT_GATE_MISSED_CONTEXT_REVIEW: all(lane["missed_context_reviewed"] for lane in lanes),
+        # count/reason 모순은 거부되지만, 판정은 lane 레코드에서 직접 유도한다.
+        IMAGE_CONTEXT_GATE_HUMAN_CORRECTION_CONSISTENCY: all(
+            lane["human_correction_consistent"] for lane in lanes
+        ),
+        IMAGE_CONTEXT_GATE_CORRECTIONS_REGRESSION: (
+            GENERIC_QUALITY_GATE_CORRECTIONS_REGRESSION not in generic_quality_gates
+        ),
+        IMAGE_CONTEXT_GATE_FAILURE_RATE_REGRESSION: (
+            GENERIC_QUALITY_GATE_FAILURE_RATE_REGRESSION not in generic_quality_gates
+        ),
+        # generic quality gate 가 pass 가 아니면 어떤 값이든 여기서 막힌다.
+        IMAGE_CONTEXT_GATE_GENERIC_MATCHED_SUCCESS_AND_MEASUREMENT: (
+            all_success and provider_measured and shifted_measured and generic_quality_pass
+        ),
+        # 이 gate 는 통과해도 권한을 주지 않는다. 경계 자체가 불변이므로 항상 참이다.
+        IMAGE_CONTEXT_GATE_EVALUATION_ONLY_PROMOTION_BOUNDARY: True,
+    }
+    blocking_gate_ids = [gate_id for gate_id in IMAGE_CONTEXT_GATE_IDS if not gate_results[gate_id]]
+
+    if not omission_lanes:
+        fallback_level = "missing"
+    elif all(lane["fallback_verified"] for lane in omission_lanes):
+        fallback_level = IMPORTED_LOCAL_VERIFIER_ATTESTATION_LABEL
+    elif any(
+        lane["fallback_projection_supplied"] and not lane["fallback_verified"]
+        for lane in omission_lanes
+    ):
+        # 검증 레코드가 제출되었지만 성공을 증명하지 못했다.
+        fallback_level = "failed"
+    else:
+        # 생략은 선언되었으나 어떤 verifier attestation 도 제출되지 않았다.
+        fallback_level = "missing"
+
+    matched_task_ids = sorted({lane["task_id"] for lane in lanes})
+    return {
+        "schema_version": IMAGE_CONTEXT_READINESS_SCHEMA_VERSION,
+        "status": PROFILE_STATUS_BLOCKED if blocking_gate_ids else PROFILE_STATUS_READY_FOR_BOUNDED_PILOT_REVIEW,
+        "evaluation_only": True,
+        "promotion_authority": False,
+        "public_claim_allowed": False,
+        "gate_ids": list(IMAGE_CONTEXT_GATE_IDS),
+        "blocking_gate_ids": blocking_gate_ids,
+        "matched_task_count": len(matched_task_ids),
+        "evidence_levels": {
+            "provider_measurement": "measured" if provider_measured else "unmeasured",
+            "fallback_binding": fallback_level,
+            "protected_zone": (
+                "review_attested"
+                if gate_results[IMAGE_CONTEXT_GATE_PROTECTED_ZONE_DENY_REVIEW] else "failed"
+            ),
+            "missed_context": (
+                "reviewed" if gate_results[IMAGE_CONTEXT_GATE_MISSED_CONTEXT_REVIEW] else "missing"
+            ),
+        },
+        # 표본 관측치는 어떤 승격 임계값도 정의하지 않는다.
+        "sample_adequacy": {
+            "matched_task_count": len(matched_task_ids),
+            "profiled_row_count": len(lanes),
+            "task_class_labels": matched_task_ids,
+            "policy_status": PROFILE_SAMPLE_ADEQUACY_POLICY_STATUS,
+        },
+        "claim_boundary": IMAGE_CONTEXT_CLAIM_BOUNDARY,
+    }
+
+
+def clamp_report_for_evaluation_profile(report: dict[str, Any], lane: dict[str, Any]) -> None:
+    """Force every public-authority surface to a non-candidate, evaluation-only value.
+
+    Complete lane evidence may reach ``ready_for_bounded_pilot_review``; it may never
+    reach promotion authority or a public claim. Pre-clamp measurements survive only in
+    explicitly non-authoritative fields such as ``raw_metric_claim_status``.
+    """
+    report[EVALUATION_PROFILES_REPORT_KEY] = {IMAGE_CONTEXT_PROFILE_REPORT_KEY: lane}
+    report["public_claim_status"] = IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS
+    # 콘솔이 report['claim_status'] 를 그대로 출력하므로 legacy 필드도 함께 clamp 한다.
+    report["claim_status"] = IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS
+    report["public_claim_eligible"] = False
+
+    # replay_evidence 는 top-level 과 같은 이름의 권한 필드를 복사해 들고 있다. 여기를
+    # 함께 clamp 하지 않으면 report.json 소비자가 중첩 사본에서 candidate/eligible=true 를
+    # 그대로 읽어 evaluation-only 경계를 우회한다.
+    replay_evidence = report.get("replay_evidence")
+    if isinstance(replay_evidence, dict):
+        replay_evidence["public_claim_status"] = IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS
+        replay_evidence["public_claim_eligible"] = False
+        replay_evidence["report_claim_gates_allow_public_claim"] = False
+
+    readiness = report.get("public_claim_readiness")
+    if isinstance(readiness, dict):
+        readiness["claim_allowed"] = False
+        readiness["status"] = IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS
+        readiness["reason"] = IMAGE_CONTEXT_PROFILE_BLOCKER_GATE_ID
+        # `_observed` 라는 이름이 붙었어도 값 자체가 "..._public_claim_candidate" 라는
+        # 권한 문자열이다. 그대로 두면 downstream 이 이 필드를 읽고 candidate 로 오해할
+        # 수 있으므로, profiled report 에서는 관측치도 evaluation-only 로 clamp 한다.
+        readiness["public_claim_status_observed"] = IMAGE_CONTEXT_EVALUATION_ONLY_CLAIM_STATUS
+        readiness["public_claim_eligible_observed"] = False
+        blocking = readiness.get("blocking_gate_ids")
+        if isinstance(blocking, list) and IMAGE_CONTEXT_PROFILE_BLOCKER_GATE_ID not in blocking:
+            blocking.append(IMAGE_CONTEXT_PROFILE_BLOCKER_GATE_ID)
+
+    pairs = report.get("matched_pair_evidence")
+    if isinstance(pairs, list):
+        for pair in pairs:
+            if not isinstance(pair, dict):
+                continue
+            boundary = pair.get("claim_boundary")
+            if isinstance(boundary, dict):
+                boundary["token_savings_claim_allowed"] = False
+                boundary["shifted_cost_claim_allowed"] = False
+                boundary["evaluation_profile"] = IMAGE_CONTEXT_EVALUATION_PROFILE_ID
+
+
+def render_image_context_evaluation_section(report: dict[str, Any]) -> list[str]:
+    """Bounded dashboard section: statuses and ids only, never raw evidence text."""
+    profiles = report.get(EVALUATION_PROFILES_REPORT_KEY)
+    if not isinstance(profiles, dict):
+        return []
+    lane = profiles.get(IMAGE_CONTEXT_PROFILE_REPORT_KEY)
+    if not isinstance(lane, dict):
+        return []
+    levels = lane.get("evidence_levels") if isinstance(lane.get("evidence_levels"), dict) else {}
+    blockers = lane.get("blocking_gate_ids") or []
+    sample = lane.get("sample_adequacy") if isinstance(lane.get("sample_adequacy"), dict) else {}
+    return [
+        "## Image-context evaluation",
+        "",
+        f"- Schema: `{markdown_value(lane.get('schema_version'))}`",
+        f"- Status: `{markdown_value(lane.get('status'))}`",
+        f"- Matched tasks: {markdown_value(lane.get('matched_task_count'))}",
+        f"- Evaluation only: `{markdown_value(lane.get('evaluation_only'))}`",
+        f"- Promotion authority: `{markdown_value(lane.get('promotion_authority'))}`",
+        f"- Public claim allowed: `{markdown_value(lane.get('public_claim_allowed'))}`",
+        f"- Provider measurement: `{markdown_value(levels.get('provider_measurement'))}`",
+        f"- Fallback binding: `{markdown_value(levels.get('fallback_binding'))}`",
+        f"- Protected zone: `{markdown_value(levels.get('protected_zone'))}`",
+        f"- Missed context: `{markdown_value(levels.get('missed_context'))}`",
+        f"- Blocking gates: `{markdown_value(', '.join(str(item) for item in blockers) if blockers else 'none')}`",
+        f"- Sample policy: `{markdown_value(sample.get('policy_status'))}`",
+        "",
+        "> Claim boundary: this lane is evaluation-only. `ready_for_bounded_pilot_review` authorizes a "
+        "bounded human pilot review of imported evidence; it is not promotion, not runtime authority, "
+        "not quality proof, and not a hosted API token/cost savings claim. The fallback record is an "
+        "imported local-verifier attestation: replay does not authenticate its author and does not "
+        "reread the artifact.",
+        "",
+    ]
+
+
 def summarize_benchmark_rows(rows: list[dict[str, str]], baseline_variant: str) -> dict[str, Any]:
     by_variant: dict[str, dict[str, Any]] = {}
     successful_rows_by_variant_task: dict[str, dict[str, list[dict[str, str]]]] = {}
@@ -2967,6 +4105,11 @@ def annotate_replay_report(
         replay_rows=replay_rows,
         mixed_csv=mixed_csv,
     )
+    # Additive lane block. 이미 preflight 로 검증된 batch 위에서만 동작하므로 실패하지 않는다.
+    # profile 이 없는 report 는 이 블록도, clamp 도 얻지 않는다(기존 동작 그대로).
+    lane = build_image_context_evaluation_lane(replay_rows, report)
+    if lane is not None:
+        clamp_report_for_evaluation_profile(report, lane)
     report["default_matrix"] = build_default_matrix(report)
     return report
 
@@ -3552,6 +4695,8 @@ def render_dashboard_markdown(report: dict[str, Any]) -> str:
         "allow it and public-claim provenance is complete. Proxy byte reductions are diagnostic "
         "and are not hosted API token savings.",
         "",
+        # profile 이 선언된 report 에만 추가되는 bounded 섹션. 원문/정책/영수증 내용은 넣지 않는다.
+        *render_image_context_evaluation_section(report),
         "## Variant summary",
         "",
         "| Variant | Runs | Successes | Failure rate | Tokens/success | Bytes saved | Token proxy saved | Quality notes |",
@@ -3869,6 +5014,25 @@ def main() -> int:
         print("no (task, variant) targets matched the filters", file=sys.stderr)
         return 1
 
+    # profile gate 는 어떤 lock/read helper 보다 먼저 끝난다. existing_keys_snapshot 은
+    # CSV lock sidecar 를 만들기 때문에, 그 뒤에서 거부하면 우리가 거절한 실행이 이미
+    # 파일 시스템에 바이트를 남긴 뒤가 된다.
+    #
+    # replay 경계는 --dry-run 에도 적용한다. dry-run 이 provider 를 부르지 않는 것은
+    # 맞지만, 불변식을 "profiled task 는 provider 경로에 진입하지 않는다" 로 단순하게
+    # 유지하는 편이 감사 가능하고 fail-closed 다. 의미 있는 미리보기인
+    # `--evidence-jsonl --dry-run` 은 그대로 동작한다.
+    preflight_profile_replay_mode(tasks, targets, evidence_replay_active=args.evidence_jsonl is not None)
+    # 반대로 freshness 는 출력을 쓰는 실행에만 의미가 있다. dry-run 은 CSV/ledger/report 를
+    # 하나도 쓰지 않으므로 기존 CSV 가 있어도 잃을 profile 문맥이 없다.
+    if not args.dry_run:
+        preflight_profile_fresh_output(
+            tasks,
+            targets,
+            resume=args.resume,
+            csv_has_preexisting_content=file_has_content_no_follow(args.csv),
+        )
+
     if args.resume:
         skip_keys, skip_keys_loaded_stamp = existing_keys_snapshot(args.csv)
         skip_keys_stamp = {"stamp": skip_keys_loaded_stamp}
@@ -3893,6 +5057,18 @@ def main() -> int:
             return 0
         csv_had_preexisting_content = file_has_content_no_follow(args.csv)
         evidence_rows = read_evidence_jsonl(args.evidence_jsonl)
+        # 완전한 profile preflight 는 첫 append_csv 이전, 그리고 어떤 lock sidecar 도
+        # 만들어지기 전에 끝난다. 실패 시 파일 시스템은 바이트 단위로 그대로 남는다.
+        preflight_evaluation_profiles(
+            tasks,
+            variants,
+            targets,
+            evidence_rows,
+            task_file_dir=args.tasks.parent,
+            resume=args.resume,
+            csv_has_preexisting_content=csv_had_preexisting_content,
+            baseline_variant=args.baseline_variant,
+        )
         runnable_targets = resume_runnable_targets(
             args.csv,
             targets,
@@ -3901,40 +5077,54 @@ def main() -> int:
             existing_key_cache_stamp=skip_keys_stamp,
         )
         evidence_by_key = validate_evidence_coverage(evidence_rows, runnable_targets)
+        profiled_batch = bool(selected_profiled_task_ids(tasks, targets))
         runnable_keys = {(task.id, variant.name) for task, variant in runnable_targets}
         claude_ver = "evidence-replay"
         completed = 0
         replay_rows_written: list[EvidenceReplayRow] = []
-        for task, variant in targets:
-            if args.resume and (task.id, variant.name) not in runnable_keys:
-                print(f"skip {task.id}/{variant.name} (already in {args.csv})")
-                continue
-            evidence = evidence_by_key[(task.id, variant.name)]
-            print(f"replay {task.id}/{variant.name} ...", flush=True)
-            result = run_evidence_fixture(task, variant, evidence)
-            wrote = append_csv(
-                args.csv,
+        pending_ledger_rows: list[tuple[EvidenceReplayRow, RunResult]] = []
+        batch_lock = csv_parent_directory_lock(args.csv, create_parent=True) if profiled_batch else nullcontext()
+        with batch_lock:
+            if profiled_batch:
+                # The same stable lock covers the raced freshness recheck and every
+                # row. No sidecar is created, and no foreign append can land between
+                # profiled rows because append_csv takes this lock first.
+                profile_batch_freshness_gate_unlocked(tasks, targets, args.csv)
+            for task, variant in targets:
+                if args.resume and (task.id, variant.name) not in runnable_keys:
+                    print(f"skip {task.id}/{variant.name} (already in {args.csv})")
+                    continue
+                evidence = evidence_by_key[(task.id, variant.name)]
+                print(f"replay {task.id}/{variant.name} ...", flush=True)
+                result = run_evidence_fixture(task, variant, evidence)
+                writer = append_csv_unlocked if profiled_batch else append_csv
+                wrote = writer(
+                    args.csv,
+                    claude_ver,
+                    result,
+                    skip_existing=args.resume,
+                    existing_key_cache=skip_keys if args.resume else None,
+                    existing_key_cache_stamp=skip_keys_stamp,
+                )
+                if wrote:
+                    replay_rows_written.append(evidence)
+                    if args.ledger_jsonl is not None:
+                        pending_ledger_rows.append((evidence, result))
+                completed += 1
+                status = "ok" if result.success else "FAIL"
+                suffix = "" if wrote else " (CSV not updated; row already present)"
+                print(
+                    f"  {status} tokens={sum(result.tokens.values())} cost=${result.cost_usd:.4f} "
+                    f"wall_time={result.wall_time_seconds:.3f}s {sanitize_note_text(result.notes)}{suffix}"
+                )
+        # Ledger/report/dashboard writes happen after the CSV batch lock so distinct
+        # outputs in the same directory cannot deadlock on the directory inode.
+        for evidence, result in pending_ledger_rows:
+            append_cost_shift_ledger(
+                args.ledger_jsonl,
                 claude_ver,
                 result,
-                skip_existing=args.resume,
-                existing_key_cache=skip_keys if args.resume else None,
-                existing_key_cache_stamp=skip_keys_stamp,
-            )
-            if wrote:
-                replay_rows_written.append(evidence)
-                if args.ledger_jsonl is not None:
-                    append_cost_shift_ledger(
-                        args.ledger_jsonl,
-                        claude_ver,
-                        result,
-                        replay_provenance=evidence.provenance_payload(),
-                    )
-            completed += 1
-            status = "ok" if result.success else "FAIL"
-            suffix = "" if wrote else " (CSV not updated; row already present)"
-            print(
-                f"  {status} tokens={sum(result.tokens.values())} cost=${result.cost_usd:.4f} "
-                f"wall_time={result.wall_time_seconds:.3f}s {sanitize_note_text(result.notes)}{suffix}"
+                replay_provenance=evidence.provenance_payload(),
             )
         if args.report_json is not None or args.dashboard_md is not None:
             report = write_report_outputs(