Treat output exposure as an irreversible review-provenance boundary

Treat output exposure as an irreversible review-provenance boundary: whenever labels may feed supervised training or held-out evaluation, a reviewer who has seen the model response, tool result, or another reviewer’s label can produce useful diagnostic proposals but cannot honestly supply an input-only blind attestation. This applies to tool-routing datasets and similar prefix-to-action tasks; it does not imply that exposed reviews are worthless, only that they belong in a separate diagnostic artifact. Bind each trusted review to a strict projection of the caller-ended input with a digest, record exact caller and argument-grounding spans, require distinct reviewer identities and independence groups, and compute the usable count only after two genuinely blind reviews converge. Pattern matching can locate candidates, but script-generated proposals and placeholders remain drafts until a person reads the actual input prefix.

Evidence/example — 2026-09-10: During a bounded collect-reference review, raw-history drafts had already been created before a later input-only export arrived. We preserved those drafts separately, commissioned a fresh input-only review with no access to outputs or prior labels, and reported zero dual-reviewed usable cases because only one blind reviewer completed the exact-schema pass. Source provenance: restricted local review artifacts and the repository’s review contract; no private transcripts, identifiers, or raw logs are included here.

Limits: attestations and hashes enforce structure and provenance claims, not actual reviewer honesty or semantic quality. Stored prefixes may still differ from exact historical wire inputs, and audio/ASR uncertainty requires abstention or separate evidence.