Harden the ADK reference harness

Change-Id: Ifdbad7dda040308074054305a4f18aa4d176d3e9

Author: nickg-ca

reference/README.md

@@ -170,6 +170,11 @@ def __init__(
         self.config = config or BudgetConfig()
         self.run_id = run_id
         self.accumulated_tokens = initial_tokens
+        # Usage-bearing LLM responses seen. Counted where tokens are counted, at
+        # the same granularity, so the spend ledger's llm_calls column describes
+        # the same events as its tokens column. Not a ceiling: max_llm_calls is
+        # enforced by the ADK RunConfig, this merely observes.
+        self.llm_calls = 0
         self.cached_tokens = 0
         self.fresh_tokens = initial_tokens
         self.graph_steps = initial_steps
@@ -193,6 +198,7 @@ def elapsed_formatted(self) -> str:
         return f"{minutes}m {secs:02d}s"
 
     def record_tokens(self, count: int, cached_count: int = 0, cache_discount: float = 0.1) -> None:
+        self.llm_calls += 1
         """Records token consumption from an LLM call or stage with cache discounting (0.1x / 90% discount)."""
         if count <= 0:
             return

reference/core/budget.py

@@ -1320,8 +1320,14 @@ def _sanitize_structured_response(response: Any, schema_cls: Any) -> Any:
                     "reason": f"Fallback: {clean_snippet}",
                 }
             elif schema_name == "ReviewVerdict":
+                # Fail CLOSED like the other two verdicts. The old value
+                # ("confirmed") promoted a safety-blocked or garbage response
+                # into a confirmed vulnerability and sent it down the
+                # critic/repro chain. The "Fallback:" reason prefix is a
+                # contract with the classifier: synthesized dismissals are
+                # routed but never persisted as finding status.
                 fallback_payload = {
-                    "route": "confirmed",
+                    "route": "false_positive",
                     "reason": f"Fallback: {clean_snippet}",
                 }
             elif schema_name == "CriticVerdict":