S0-R1-C5.5-R6-R7 Canonical Glossary Protected-IR Compiler Closure

core/pipeline_agent.py

@@ -74,7 +74,9 @@ class SSciPipelineAgent:
     MAX_TRANSLATION_CLAIM_REPAIR_ATTEMPTS = 2
     MAX_TRANSLATION_CLAIM_TOTAL_REPAIRS = 6
     PROTECTED_ENTITY_LEDGER_VERSION = 'protected-entity-ledger-v2'
-    CANONICAL_GLOSSARY_QUALITY_VERSION = 'canonical-glossary-quality-v3'
+    CANONICAL_GLOSSARY_QUALITY_VERSION = 'canonical-glossary-quality-v4'
+    CANONICAL_GLOSSARY_IR_VERSION = 'canonical-glossary-protected-ir-v1'
+    MAX_CANONICAL_GLOSSARY_IR_ATTEMPTS = 2
     SEMANTIC_CLAIM_FRAME_VERSION = 'smartpaper-core-semantic-claim-frame-v1'
     CITATION_CLAIM_FRAME_VERSION = 'smartpaper-citation-claim-frame-v1'
 
@@ -7163,8 +7165,224 @@ TEXT:
             raise DeepSeekRequestError(f'Translation left unresolved protected placeholders in {block_id}.')
         return text.strip() if keep_claim_markers else cls._strip_translation_claim_markers(text)
 
+    @classmethod
+    def _compile_canonical_glossary_ir(cls, source):
+        """Compile one canonical concept into a protected, server-owned IR.
+
+        Exact technical identities are replaced by opaque SP-G placeholders before
+        any model sees the concept.  The model may translate only the linguistic
+        surface around those placeholders; exact anchor values remain server-side.
+        """
+        source_value = re.sub(r'\s+', ' ', str(source or '')).strip()
+        mapping = {}
+        counter = 0
+        pattern = cls._translation_protected_pattern()
+
+        def replace(match):
+            nonlocal counter
+            original = match.group(0)
+            anchor_type = cls._translation_anchor_type(original)
+            if cls._translation_fact_render_policy(anchor_type) != 'exact':
+                return original
+            counter += 1
+            placeholder = f'[[SP-G{counter:06d}]]'
+            mapping[placeholder] = {
+                'source': original,
+                'type': anchor_type,
+                'render_policy': 'exact',
+            }
+            return placeholder
+
+        protected_source = pattern.sub(replace, source_value)
+        return {
+            'ir_version': cls.CANONICAL_GLOSSARY_IR_VERSION,
+            'source': source_value,
+            'protected_source': protected_source,
+            'anchors': mapping,
+        }
+
+    @staticmethod
+    def _canonical_glossary_ir_placeholders(value):
+        return re.findall(r'\[\[SP-G\d{6}\]\]', str(value or ''))
+
+    @classmethod
+    def _validate_canonical_glossary_ir_target(cls, protected_target, ir, block_id=''):
+        """Fail closed on deleted, duplicated, invented, or reordered SP-G anchors."""
+        text = re.sub(r'\s+', ' ', str(protected_target or '')).strip()
+        expected = list(dict(ir or {}).get('anchors', {}))
+        found = cls._canonical_glossary_ir_placeholders(text)
+        if Counter(found) != Counter(expected):
+            missing = list((Counter(expected) - Counter(found)).elements())[:8]
+            added = list((Counter(found) - Counter(expected)).elements())[:8]
+            raise DeepSeekRequestError(
+                f'Canonical glossary protected IR placeholder mismatch in {block_id}: '
+                f'missing={missing}, added={added}.'
+            )
+        if found != expected:
+            raise DeepSeekRequestError(
+                f'Canonical glossary protected IR anchor order changed in {block_id}: '
+                f'expected={expected}, got={found}.'
+            )
+        return True
+
+    @classmethod
+    def _restore_canonical_glossary_ir_target(cls, protected_target, ir, block_id=''):
+        cls._validate_canonical_glossary_ir_target(protected_target, ir, block_id=block_id)
+        text = re.sub(r'\s+', ' ', str(protected_target or '')).strip()
+        for placeholder, manifest in dict(dict(ir or {}).get('anchors', {})).items():
+            text = text.replace(placeholder, str(manifest.get('source') or ''))
+        if re.search(r'\[\[SP-G\d{6}\]\]', text):
+            raise DeepSeekRequestError(
+                f'Canonical glossary protected IR left unresolved placeholders in {block_id}.'
+            )
+        return text.strip()
+
+    @classmethod
+    def _protect_existing_canonical_target_with_ir(cls, target, ir, block_id=''):
+        """Project a sealed target back into SP-G form for secondary review.
+
+        This is used only after deterministic anchor checks pass.  Reviewers never
+        receive the raw exact anchor values and therefore cannot translate or rename
+        them; they may only edit the surrounding linguistic surface.
+        """
+        text = re.sub(r'\s+', ' ', str(target or '')).strip()
+        for placeholder, manifest in dict(dict(ir or {}).get('anchors', {})).items():
+            surface = str(manifest.get('source') or '')
+            if not surface:
+                continue
+            pos = text.find(surface)
+            if pos < 0:
+                raise DeepSeekRequestError(
+                    f'Canonical glossary target cannot be projected to protected IR in {block_id}: '
+                    f'missing exact anchor type={manifest.get("type") or "IMMUTABLE"}.'
+                )
+            text = text[:pos] + placeholder + text[pos + len(surface):]
+        cls._validate_canonical_glossary_ir_target(text, ir, block_id=block_id)
+        return text
+
+    @classmethod
+    def _canonical_exact_anchor_sequence(cls, value):
+        """Return exact-render technical anchors as a byte-stable sequence."""
+        _protected, mapping = cls._protect_translation_tokens(str(value or ''))
+        return [
+            str(manifest.get('source') or '')
+            for manifest in dict(mapping or {}).values()
+            if isinstance(manifest, dict)
+            and str(manifest.get('render_policy') or '') == 'exact'
+            and str(manifest.get('source') or '') not in {'', '|'}
+        ]
+
+    @classmethod
+    def _canonical_anchor_drift_defects(cls, source, target):
+        expected = cls._canonical_exact_anchor_sequence(source)
+        actual = cls._canonical_exact_anchor_sequence(target)
+        expected_counts = Counter(expected)
+        actual_counts = Counter(actual)
+        defects = []
+        if any(actual_counts.get(anchor, 0) < count for anchor, count in expected_counts.items()):
+            defects.append('PROTECTED_ANCHOR_LOSS')
+        if any(actual_counts.get(anchor, 0) > count for anchor, count in expected_counts.items()):
+            defects.append('PROTECTED_ANCHOR_DUPLICATION')
+        # Exact target-side technical identities that were not source-owned are
+        # not allowed to appear inside a strict canonical identity.
+        if any(anchor not in expected_counts for anchor in actual_counts):
+            defects.append('PROTECTED_ANCHOR_ADDITION')
+        if expected_counts == actual_counts and expected != actual:
+            defects.append('PROTECTED_ANCHOR_ORDER_DRIFT')
+        return defects
+
+    def _translate_canonical_glossary_ir_terms(self, terms, target_lang):
+        """Translate canonical concepts through protected IR with one bounded skeleton retry."""
+        terms = list(terms or [])
+        if not terms:
+            return {}
+        ir_by_id = {}
+        source_by_id = {}
+        for index, source in enumerate(terms, start=1):
+            term_id = f'G{index:06d}'
+            ir_by_id[term_id] = self._compile_canonical_glossary_ir(source)
+            source_by_id[term_id] = source
+
+        resolved = {}
+        pending = list(ir_by_id)
+        rule = self._translation_language_rule(target_lang)
+        for attempt in range(1, self.MAX_CANONICAL_GLOSSARY_IR_ATTEMPTS + 1):
+            if not pending:
+                break
+            payload = []
+            for term_id in pending:
+                ir = ir_by_id[term_id]
+                payload.append({
+                    'term_id': term_id,
+                    'protected_source': ir['protected_source'],
+                    'anchor_manifest': [
+                        {'id': placeholder, 'type': str(manifest.get('type') or 'IMMUTABLE')}
+                        for placeholder, manifest in ir['anchors'].items()
+                    ],
+                })
+            strict = (
+                ' This is a strict skeleton retry. Copy every [[SP-Gxxxxxx]] placeholder byte-for-byte, '
+                'exactly once, and in the same order. Do not translate, delete, duplicate, rename, or move placeholders.'
+                if attempt > 1 else ''
+            )
+            response = self.call_deepseek(
+                (
+                    f'Translate the supplied protected research-concept surfaces into {target_lang}. {rule} '
+                    'SP-G placeholders are opaque server-owned technical identities: preserve every placeholder '
+                    'byte-for-byte, exactly once, and in the same order; translate only the linguistic surface around them. '
+                    'Do not infer or spell out what a placeholder represents. Return JSON only as '
+                    '{"terms":[{"term_id":"G000001","target":"..."}]} and return every supplied term_id exactly once.'
+                    + strict
+                ),
+                json.dumps({'ir_version': self.CANONICAL_GLOSSARY_IR_VERSION, 'terms': payload}, ensure_ascii=False),
+                max_tokens=max(1200, min(5000, 120 + len(payload) * 90)),
+                temp=0.0, model_role='translation', thinking=False, allow_fallback=False,
+            )
+            parsed = self._extract_json_from_text(response)
+            items = parsed.get('terms', []) if isinstance(parsed, dict) else []
+            returned = {
+                str(item.get('term_id') or '').strip(): re.sub(r'\s+', ' ', str(item.get('target') or '')).strip()
+                for item in items if isinstance(item, dict)
+            }
+            next_pending = []
+            for term_id in pending:
+                protected_target = returned.get(term_id, '')
+                try:
+                    if not protected_target:
+                        raise DeepSeekRequestError(
+                            f'Canonical glossary protected IR omitted term_id={term_id}.'
+                        )
+                    restored = self._restore_canonical_glossary_ir_target(
+                        protected_target, ir_by_id[term_id], block_id=f'canonical:{term_id}'
+                    )
+                    defects = self._canonical_target_deterministic_defects(
+                        source_by_id[term_id], restored, target_lang
+                    )
+                    anchor_defects = [d for d in defects if d.startswith('PROTECTED_ANCHOR_')]
+                    if anchor_defects:
+                        raise DeepSeekRequestError(
+                            f'Canonical glossary protected IR restoration violated anchor contract: '
+                            f'{term_id} defects={anchor_defects}'
+                        )
+                    resolved[source_by_id[term_id]] = restored
+                except DeepSeekRequestError:
+                    if attempt >= self.MAX_CANONICAL_GLOSSARY_IR_ATTEMPTS:
+                        raise
+                    next_pending.append(term_id)
+            pending = next_pending
+        if pending:
+            raise DeepSeekRequestError(
+                'Canonical glossary protected IR exhausted with unresolved terms: ' + ', '.join(pending[:3])
+            )
+        return resolved
+
     def seed_canonical_concept_glossary(self, concept_ledger, target_lang, existing=None):
-        """Translate/freeze canonical task concepts once before section work."""
+        """Translate/freeze canonical task concepts through protected IR.
+
+        R6-R7 moves exact technical identities out of model ownership.  Existing
+        safe glossary entries remain frozen; missing or deterministic-unsafe
+        entries are rebuilt through SP-G protected IR before quality review.
+        """
         mapping = dict(existing or {})
         rows = (dict(concept_ledger or {}).get('items') or []) if isinstance(concept_ledger, dict) else []
         sources = []
@@ -7184,45 +7402,52 @@ TEXT:
                 flexible_sources.append(term)
             else:
                 strict_sources.append(term)
-        # Only true research constructs receive deterministic canonical-identity
-        # enforcement.  Descriptive academic terms still receive a preferred
-        # glossary translation but may vary naturally with target-language
-        # grammar or equivalent wording; semantic QA remains authoritative.
         self._canonical_concept_sources = set(strict_sources)
         self._canonical_flexible_sources = set(flexible_sources)
         self._canonical_concept_kinds = dict(source_kinds)
         if not sources:
             return mapping
 
-        missing = [term for term in sources if not str(mapping.get(term) or '').strip()]
-        # Acronyms/technical identifiers preserve literal identity; conceptual
-        # phrases must be translated instead of becoming legal English residue.
+        # Rebuild only entries that are missing or whose server-owned identity
+        # invariants are already broken.  Safe historical targets remain frozen.
+        rebuild = []
+        for term in sources:
+            current = re.sub(r'\s+', ' ', str(mapping.get(term) or '')).strip()
+            if not current:
+                rebuild.append(term)
+                continue
+            if term in strict_sources:
+                defects = self._canonical_target_deterministic_defects(term, current, target_lang)
+                if defects:
+                    rebuild.append(term)
+                    mapping.pop(term, None)
+                    self._record_translation_assurance(
+                        'CANONICAL_GLOSSARY_STALE_TARGET_REBUILD', target_lang=target_lang,
+                        severity='repair', decision='REPAIR_LOCAL',
+                        detail={'source': term[:120], 'defects': ','.join(defects[:4])},
+                    )
+                    continue
+            elif self._canonical_anchor_drift_defects(term, current):
+                rebuild.append(term)
+                mapping.pop(term, None)
+
         translate_terms = []
-        for term in missing:
+        for term in rebuild:
             compact = re.sub(r'[^A-Za-z0-9]', '', term)
-            technical = bool(compact) and (compact.isupper() or any(ch.isdigit() for ch in compact) or (len(compact) > 2 and any(ch.isupper() for ch in compact[1:]))) and ' ' not in term
+            technical = bool(compact) and (
+                compact.isupper() or any(ch.isdigit() for ch in compact)
+                or (len(compact) > 2 and any(ch.isupper() for ch in compact[1:]))
+            ) and ' ' not in term
             if technical:
                 mapping[term] = term
             else:
                 translate_terms.append(term)
         if translate_terms:
-            rule = self._translation_language_rule(target_lang)
-            response = self.call_deepseek(
-                f"Translate the supplied frozen research concepts into {target_lang}. {rule} Each source is a canonical concept identity, not a stylistic phrase. Give one stable canonical target term for each source; do not merge distinct sources or replace one concept with a near-synonym. Return JSON only as {{\"terms\":[{{\"source\":\"...\",\"target\":\"...\"}}]}} and return every source exactly once.",
-                json.dumps({'terms': translate_terms}, ensure_ascii=False),
-                max_tokens=max(1200, min(5000, 120 + len(translate_terms) * 90)),
-                temp=0.0, model_role='translation', thinking=False, allow_fallback=False,
-            )
-            parsed = self._extract_json_from_text(response)
-            items = parsed.get('terms', []) if isinstance(parsed, dict) else []
-            returned = {
-                re.sub(r'\s+', ' ', str(item.get('source') or '')).strip(): re.sub(r'\s+', ' ', str(item.get('target') or '')).strip()
-                for item in items if isinstance(item, dict)
-            }
-            if set(returned) != set(translate_terms) or any(not returned.get(term) for term in translate_terms):
-                raise DeepSeekRequestError('Canonical concept glossary identity mismatch or omitted term.')
+            translated = self._translate_canonical_glossary_ir_terms(translate_terms, target_lang)
             for term in translate_terms:
-                target = returned[term]
+                target = re.sub(r'\s+', ' ', str(translated.get(term) or '')).strip()
+                if not target:
+                    raise DeepSeekRequestError(f'Canonical concept glossary omitted term after protected IR: {term[:80]}')
                 if target.casefold() == term.casefold() and re.search(r'[a-z]{4,}', term):
                     raise DeepSeekRequestError(f'Canonical concept remained untranslated: {term[:80]}')
                 mapping[term] = target
@@ -7287,28 +7512,15 @@ TEXT:
 
         if cls._canonical_target_surface_suspicious(target_value, target_lang):
             defects.append('MALFORMED_SURFACE')
-        if not cls._canonical_target_preserves_source_anchors(source_value, target_value):
-            defects.append('PROTECTED_ANCHOR_LOSS')
+        defects.extend(cls._canonical_anchor_drift_defects(source_value, target_value))
         return list(dict.fromkeys(defects))
 
     def validate_and_refine_canonical_concept_glossary(self, concept_ledger, target_lang, glossary):
-        """Review strict canonical terms without giving the reviewer unilateral veto power.
-
-        Contract:
-        1. Server-owned deterministic invariants decide whether a candidate is
-           safe enough to freeze (non-empty, translated target-language signal,
-           well-formed surface, protected-anchor preservation).
-        2. The independent model reviewer may replace a candidate only with one
-           distinct, deterministic-safe correction.
-        3. If the reviewer rejects/omits/contradicts a candidate but supplies no
-           usable correction, an already safe candidate is retained with an
-           assurance warning instead of aborting the whole manuscript.
-        4. If the candidate itself is deterministic-unsafe and no safe correction
-           exists, the gate remains fail-closed.
-
-        This prevents a secondary quality-review formatting/judgment failure from
-        becoming a single point of failure across Chinese, Russian, and Kazakh
-        translation while preserving genuine terminology-integrity barriers.
+        """Review strict canonical terms through the same protected IR contract.
+
+        The secondary reviewer never receives raw exact anchor values.  It may
+        only judge/repair the linguistic surface around opaque SP-G placeholders.
+        Server-side deterministic invariants remain the final authority.
         """
         mapping = dict(glossary or {})
         rows = (dict(concept_ledger or {}).get('items') or []) if isinstance(concept_ledger, dict) else []
@@ -7324,16 +7536,47 @@ TEXT:
         if not strict_sources:
             return mapping
 
-        payload = [
-            {'source': source, 'candidate_target': str(mapping.get(source) or '').strip()}
-            for source in strict_sources
-        ]
-        candidate_defects = {
-            row['source']: self._canonical_target_deterministic_defects(
-                row['source'], row['candidate_target'], target_lang
-            )
-            for row in payload
-        }
+        source_by_id = {}
+        id_by_source = {}
+        ir_by_source = {}
+        payload = []
+        candidate_defects = {}
+        protected_candidates = {}
+        for index, source in enumerate(strict_sources, start=1):
+            term_id = f'G{index:06d}'
+            source_by_id[term_id] = source
+            id_by_source[source] = term_id
+            ir = self._compile_canonical_glossary_ir(source)
+            ir_by_source[source] = ir
+            candidate = re.sub(r'\s+', ' ', str(mapping.get(source) or '')).strip()
+            defects = self._canonical_target_deterministic_defects(source, candidate, target_lang)
+            candidate_defects[source] = defects
+            protected_candidate = ''
+            if candidate and not any(code.startswith('PROTECTED_ANCHOR_') for code in defects):
+                try:
+                    protected_candidate = self._protect_existing_canonical_target_with_ir(
+                        candidate, ir, block_id=f'canonical-review:{term_id}'
+                    )
+                except DeepSeekRequestError:
+                    # Treat projection failure as an anchor-integrity defect.  In
+                    # normal production R6-R7 seed rebuilds such a stale target
+                    # before review; direct callers remain fail-closed unless the
+                    # reviewer supplies a fresh protected correction.
+                    if 'PROTECTED_ANCHOR_LOSS' not in defects:
+                        defects = list(defects) + ['PROTECTED_ANCHOR_LOSS']
+                        candidate_defects[source] = list(dict.fromkeys(defects))
+            protected_candidates[source] = protected_candidate
+            payload.append({
+                'term_id': term_id,
+                'protected_source': ir['protected_source'],
+                'candidate_target': protected_candidate,
+                'deterministic_defects': list(candidate_defects[source]),
+                'anchor_manifest': [
+                    {'id': placeholder, 'type': str(manifest.get('type') or 'IMMUTABLE')}
+                    for placeholder, manifest in ir['anchors'].items()
+                ],
+            })
+
         empty_sources = [source for source, defects in candidate_defects.items() if 'EMPTY_TARGET' in defects]
         if empty_sources:
             raise DeepSeekRequestError(
@@ -7344,16 +7587,16 @@ TEXT:
         try:
             response = self.call_deepseek(
                 (
-                    f"Independently review strict research-construct translations for {target_lang}. {language_rule} "
-                    "Judge semantic identity and natural academic terminology, not stylistic preference. "
-                    "Reject duplicated/malformed wording, concept narrowing/broadening, or a target that changes the construct. "
-                    "Every protected exact source anchor inside a construct (for example AI, LLM, model/tool IDs, hypothesis IDs, formulas, statistics or exact numbers) must remain byte-for-byte in the target canonical label; never localize, delete, duplicate, or rename such an anchor. "
-                    "If the candidate is sound, return it unchanged with accepted=true. If it is materially flawed, return exactly one corrected canonical target with accepted=false. "
-                    "Do not merge distinct constructs. Return JSON only as "
-                    '{"terms":[{"source":"...","candidate_target":"...","accepted":true,"target":"..."}]}'
-                    " and return every source exactly once."
+                    f'Independently review strict research-construct translations for {target_lang}. {language_rule} '
+                    'Judge semantic identity and natural academic terminology, not stylistic preference. '
+                    'SP-G placeholders are opaque server-owned technical identities. Never infer, translate, delete, duplicate, '
+                    'rename, or reorder them. Preserve every placeholder byte-for-byte, exactly once, and in the same order. '
+                    'If candidate_target is empty, construct one safe target from protected_source. If the candidate is sound, '
+                    'return it unchanged with accepted=true. If it is materially flawed, return exactly one corrected protected '
+                    'target with accepted=false. Do not merge distinct constructs. Return JSON only as '
+                    '{"terms":[{"term_id":"G000001","accepted":true,"target":"..."}]} and return every term_id exactly once.'
                 ),
-                json.dumps({'terms': payload}, ensure_ascii=False),
+                json.dumps({'ir_version': self.CANONICAL_GLOSSARY_IR_VERSION, 'terms': payload}, ensure_ascii=False),
                 max_tokens=max(1200, min(4200, 180 + len(payload) * 120)),
                 temp=0.0, model_role='translation', thinking=False, allow_fallback=False,
             )
@@ -7377,12 +7620,12 @@ TEXT:
         for item in items:
             if not isinstance(item, dict):
                 continue
-            source = re.sub(r'\s+', ' ', str(item.get('source') or '')).strip()
-            if source in strict_sources:
-                returned[source] = item
+            term_id = str(item.get('term_id') or '').strip()
+            if term_id in source_by_id:
+                returned[term_id] = item
         extra_count = sum(
             1 for item in items if isinstance(item, dict)
-            and re.sub(r'\s+', ' ', str(item.get('source') or '')).strip() not in strict_sources
+            and str(item.get('term_id') or '').strip() not in source_by_id
         )
         if extra_count:
             self._record_translation_assurance(
@@ -7392,9 +7635,19 @@ TEXT:
 
         refined = dict(mapping)
         for source in strict_sources:
-            candidate = str(mapping.get(source) or '').strip()
+            term_id = id_by_source[source]
+            candidate = re.sub(r'\s+', ' ', str(mapping.get(source) or '')).strip()
             defects = list(candidate_defects.get(source) or [])
-            item = returned.get(source)
+            protected_candidate = str(protected_candidates.get(source) or '')
+            # Populate lazily because a candidate may have been anchor-unsafe.
+            if not protected_candidate and candidate and not any(code.startswith('PROTECTED_ANCHOR_') for code in defects):
+                try:
+                    protected_candidate = self._protect_existing_canonical_target_with_ir(
+                        candidate, ir_by_source[source], block_id=f'canonical-review:{term_id}'
+                    )
+                except DeepSeekRequestError:
+                    protected_candidate = ''
+            item = returned.get(term_id)
             if not item:
                 if defects:
                     raise DeepSeekRequestError(
@@ -7409,16 +7662,22 @@ TEXT:
 
             accepted_raw = item.get('accepted')
             accepted = accepted_raw is True or str(accepted_raw).strip().casefold() == 'true'
-            reviewed_target = re.sub(r'\s+', ' ', str(item.get('target') or '')).strip()
-            reviewed_defects = (
-                self._canonical_target_deterministic_defects(source, reviewed_target, target_lang)
-                if reviewed_target else ['EMPTY_TARGET']
-            )
+            reviewed_protected = re.sub(r'\s+', ' ', str(item.get('target') or '')).strip()
+            reviewed_target = ''
+            reviewed_defects = ['EMPTY_TARGET']
+            if reviewed_protected:
+                try:
+                    reviewed_target = self._restore_canonical_glossary_ir_target(
+                        reviewed_protected, ir_by_source[source], block_id=f'canonical-review:{term_id}'
+                    )
+                    reviewed_defects = self._canonical_target_deterministic_defects(
+                        source, reviewed_target, target_lang
+                    )
+                except DeepSeekRequestError:
+                    reviewed_target = ''
+                    reviewed_defects = ['PROTECTED_IR_SKELETON_MISMATCH']
 
-            # A sound acceptance means no remapping.  If the reviewer claims to
-            # accept but also changes the term, keep a safe frozen candidate; if
-            # the candidate is unsafe, a distinct safe target may still rescue it.
-            if accepted and reviewed_target in {'', candidate}:
+            if accepted and reviewed_protected in {'', protected_candidate}:
                 if not defects:
                     continue
                 raise DeepSeekRequestError(
@@ -7437,13 +7696,10 @@ TEXT:
                 continue
 
             if not defects:
-                # Reviewer vetoes, omits a correction, proposes an invalid
-                # correction, or contradicts accepted=true.  None of these is
-                # actionable evidence against an already deterministic-safe term.
                 reason = 'NON_ACTIONABLE_REJECTION'
-                if accepted and reviewed_target and reviewed_target != candidate:
+                if accepted and reviewed_protected and reviewed_protected != protected_candidate:
                     reason = 'ACCEPTED_BUT_CHANGED'
-                elif reviewed_target and reviewed_target != candidate and reviewed_defects:
+                elif reviewed_protected and reviewed_protected != protected_candidate and reviewed_defects:
                     reason = 'INVALID_CORRECTION'
                 self._record_translation_assurance(
                     'CANONICAL_GLOSSARY_REVIEW_INCONCLUSIVE', target_lang=target_lang, severity='diagnostic',