@allocator-one/rcl 4.4.19

package/dist/index.js

@@ -0,0 +1,2688 @@
+#!/usr/bin/env node
+import { previewTerminalRejection, applyTerminalRejection } from './converge/terminal-rejection.js';
+import { guardedDeliveryState } from './telemetry/deliver.js';
+import { AmbiguousReviewerIdentityError, assertUnambiguousReviewerIdentities } from './dispatch/reviewer-identity.js';
+import { retainAssemblyRefusal } from './output/assembly-refusal.js';
+import { createReviewCycleRemote } from './converge/cycle-remote.js';
+import { assertNoPendingFreshReview, freshReviewOutputPaths } from './converge/fresh-review.js';
+import { previewStaleReport, applyStaleReport } from './converge/stale-report.js';
+import { Command, InvalidArgumentError } from 'commander';
+import ora from 'ora';
+import chalk from 'chalk';
+import { readdir, readFile } from 'fs/promises';
+import { hostname } from 'os';
+import { fileURLToPath } from 'url';
+import { dirname, join, resolve } from 'path';
+import { loadConfig } from './config/loader.js';
+import { applyHarnessModelKeys } from './config/harness.js';
+import { DEFAULT_MODELS, DEFAULT_TIMEOUT_MS, DEFAULT_ASYNC_TIMEOUT_MS, DEFAULT_QUORUM_FRACTION, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, DEFAULT_REASONING_EFFORT, DEFAULT_THRESHOLDS, } from './config/defaults.js';
+import { resolveProviderConcurrency } from './config/provider-concurrency.js';
+import { parseGitHubTarget, fetchPRDiff, isGitHubTarget } from './resolver/github.js';
+import { loadLocalDiff } from './resolver/local.js';
+import { loadGitDiff, resolveGitHeads } from './resolver/git.js';
+import { loadPlanAsDiff } from './resolver/plan.js';
+import { isPlanFocus, PLAN_FOCUS_MODES } from './prompts/plan.js';
+import { chunkDiff } from './prepare/chunker.js';
+import { buildPrompt, loadContextDocs as loadPromptContextDocs } from './prepare/prompt-builder.js';
+import { BUILTIN_ROLES, getRoleByName } from './roles/builtin.js';
+import { resolveRoles, findProjectRulesFile } from './roles/loader.js';
+import { historicalExecutionPlan, legacyPendingClaimRoles } from './converge/legacy-roster.js';
+import { decodeOriginalReport } from './evidence/original-run/decode.js';
+import { originalRunReportSchema } from './telemetry/recovery/source.js';
+import { buildAssignments, detectProvider } from './roles/dispatcher.js';
+import { defaultAdapterFactory, runReviews } from './dispatch/runner.js';
+import { mergeChunkReviews } from './dispatch/merge.js';
+import { partitionAsyncAssignments, asyncTargetKey, resolveAsyncStoreDir, resolveExistingAsyncStoreDir, spoolAsyncCalls, launchAsyncWorkers, runAsyncWorker, collectAsyncResults, currentBranchLabel, MAX_ASYNC_CALLS_PER_ROUND, snapshotAsyncResults, consumeBoundAsyncResults, } from './dispatch/async-lane.js';
+import { evaluateCiGate } from './ci.js';
+import { resolveQuorumPolicy } from './dispatch/quorum.js';
+import { assertAdmissibleReportHealth, deriveBlockingHealth, describeBlockingHealth, ReportHealthError } from './report/blocking-health.js';
+import { resolveGatingConfig } from './consensus/gating.js';
+import { printReviewSummary } from './output/terminal.js';
+import { postGitHubReview } from './output/github.js';
+import { renderReportArtifacts, writeReportArtifacts } from './output/artifacts.js';
+import { assembleCompletedReview } from './report/assembly.js';
+import { assertReviewWorkWithinLimit, buildCouncilRunPlan, CouncilProgressReporter, formatCouncilRunPlan, } from './output/progress.js';
+import { resolveFinding, buildDiscussPrompts, runDiscussion, loadContextDocs, } from './discuss.js';
+import { DEFAULT_CONVERGE_ATTEMPT_CAP, claimConvergeAttempt, ConvergeAttemptBudgetExceededError, convergeAttemptErrorExitCode, ConvergeAttemptStateError, resolveGitCommonDir, } from './converge/attempt-budget.js';
+import { DEFAULT_CONVERGE_ROUND_CAP, HARD_CONVERGE_ROUND_CAP, processRoundReport, recordVerdicts, findingGatingReason, ConvergeRoundCapError, ConvergeRunStateError, } from './converge/run-state.js';
+import { applyRoundGap, previewRoundGap } from './converge/round-gap.js';
+import { guardReviewLaunch, ReviewLaunchRefused } from './converge/launch-guard.js';
+import { createBoundFixRecovery } from './converge/bound-fix-recovery.js';
+import { openReadSink } from './telemetry/read-sink.js';
+import { reconcileFlushedRun } from './converge/delivery-reconciliation.js';
+import { validateLaunchOutputs, validateLaunchProviders } from './converge/launch-preflight.js';
+import { writeExclusive, serializeRecoveryDocument } from './evidence/original-run/journal.js';
+import { readStable, sha256 } from './telemetry/recovery/files.js';
+import { appendCalls, appendOutcomes, loadModelStats, resolveDataDir, DEFAULT_WINDOW_DAYS, MIN_OUTCOMES_FOR_WEIGHT, } from './models/stats-store.js';
+import { buildSeedRecords } from './models/seed.js';
+import { assignmentLane, buildRoster, configDigest, diffDigest, describeRunTarget, detectRunner, parseSpecSource, resolveConvergeContext, guardedInputSha256, sha256Hex, stableStringify, validateSha, } from './report/run-header.js';
+import { assertExpectedHead, resolveReviewTarget } from './resolver/target.js';
+import { createTelemetryRuntime, deliverRun, evidenceRequirementConflict, emitConvergeEvents, flushOutbox, flushOutboxAtStart, loadHarnessSettings, resolveTelemetryLevel, } from './telemetry/deliver.js';
+import { normalizeGeneratedReport, sanitizeForDelivery } from './telemetry/envelope.js';
+import { Quarantine, QUARANTINE_DIR } from './telemetry/quarantine.js';
+import { scrubText } from './telemetry/scrub.js';
+import { validateEnvelopeTimeoutMs } from './telemetry/sink.js';
+import { buildEvent, roundIdentities } from './telemetry/events.js';
+import { credentialHost } from './telemetry/credentials.js';
+import { attestRun, renewAttestation } from './telemetry/attest.js';
+import { uuidv7 } from './report/uuid.js';
+import { runEvidenceStatus } from './evidence/status.js';
+import { runEvidenceShow } from './evidence/show.js';
+import { runFindingRecovery } from './evidence/recover-finding.js';
+import { runOriginalRecovery } from './evidence/recover-run.js';
+import { runFindingRetriage } from './evidence/retriage-finding.js';
+import { fetchServerModelStats, loadMergedWeights, mergeWeights } from './models/server-stats.js';
+import { runBackfill } from './telemetry/backfill.js';
+import { runRefutationRecovery } from './telemetry/recovery/command.js';
+import { parseRepoName } from './evidence/target.js';
+import { text } from './evidence/format.js';
+import { loadConvergeRunState } from './converge/run-state.js';
+import { finalizeOrdinaryPendingLaunch, previewOrdinaryPendingLaunch, resumePendingLegacyLaunch } from './converge/pending-legacy-resume.js';
+import { exportOrdinaryPendingPackage, retainOrdinaryLaunchInputs } from './converge/ordinary-pending-export.js';
+import { capturePreparedCouncil } from './dispatch/capture-council.js';
+import { executeCapturedOriginal } from './dispatch/original-execution.js';
+import { resolveFinalizedAsyncExecution } from './dispatch/checkpoint-async-store.js';
+import { exportCheckpointProof } from './dispatch/checkpoint.js';
+import { captureAggregationInputs, AGGREGATION_ALGORITHM } from './report/aggregation-inputs.js';
+import { decodeSupplementalAsync } from './report/supplemental-async.js';
+import { projectCheckpointReport } from './report/checkpoint-projection.js';
+import { executeCheckpointGating } from './dispatch/checkpoint-gating-execution.js';
+import { assembleCheckpointReview } from './report/checkpoint-assembly.js';
+import { describeReviewerEvidence } from './report/reviewer-evidence.js';
+import { serializeReviewerArtifact } from './report/reviewer-artifact.js';
+import { deliverTerminalReviewerRun } from './telemetry/terminal-reviewer-delivery.js';
+const RCL_VERSION = JSON.parse(await readFile(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf-8')).version;
+const program = new Command();
+program
+    .name('rcl')
+    .description('Review Council — multi-model AI code review')
+    .version(RCL_VERSION);
+// Commands that perform work first deliver what an earlier one could not, bounded to
+// five seconds so an offline machine never stalls (IO-12475 section 8.4).
+// The telemetry commands manage the outbox themselves; the detached async
+// worker is not a user command.
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    const name = actionCommand.name();
+    if (name === 'review')
+        return; // Review flushes after detecting explicit/pending cycles.
+    // Reads and explicit repairs must not flush unrelated evidence, even in preview.
+    if (actionCommand.parent?.name() === 'evidence' && (name === 'show' || name === 'status'))
+        return;
+    if (name === 'converge-rejected' || name === 'converge-stale' || name === 'converge-gap' || name === 'recover-run' || name === 'recover-finding' || name === 'retriage-finding' || name === 'telemetry' || actionCommand.parent?.name() === 'telemetry' || name.includes('worker'))
+        return;
+    const flags = actionCommand.opts();
+    if (flags.telemetry === false || (process.env['RCL_TELEMETRY'] ?? '').trim().toLowerCase() === 'off')
+        return;
+    try {
+        // One cheap readdir before any credential or config work: most commands
+        // find an empty outbox and pay nothing.
+        const entries = await readdir(join(resolveDataDir(), 'outbox')).catch(() => []);
+        if (entries.length === 0)
+            return;
+        await flushOutboxAtStart(await createTelemetryRuntime({ rclVersion: RCL_VERSION }));
+    }
+    catch {
+        // Never let the outbox stop the command the user asked for.
+    }
+});
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * `--evidence-required` with telemetry switched off cannot be honored; say so
+ * before spending the council. The flag and the environment are known up
+ * front; the project config's `harness.telemetry: off` is checked again once
+ * the config is loaded, still before any reviewer call.
+ */
+function assertEvidenceCanBeRequired(opts, config) {
+    const conflict = evidenceRequirementConflict(opts, config, process.env);
+    if (conflict !== undefined)
+        throw new Error(conflict);
+}
+/**
+ * With `--evidence-required`, resolve where the evidence would go before any
+ * reviewer is paid: an unmanaged repository or a missing credential makes
+ * delivery impossible, and that is worth knowing at once.
+ */
+async function assertEvidenceDeliverable(opts, config, credential) {
+    if (!opts.evidenceRequired)
+        return;
+    const runtime = await createTelemetryRuntime({
+        rclVersion: RCL_VERSION,
+        config,
+        noTelemetry: opts.telemetry === false,
+        ...(credential ? { credential } : {}),
+    });
+    if (!runtime.repoManaged) {
+        throw new Error('--evidence-required needs a Harness-managed repository (one carrying .harness-cli/config.json); this one is not.');
+    }
+    if (runtime.level === 'off')
+        throw new Error('--evidence-required contradicts the resolved telemetry level off.');
+    if (!runtime.sink)
+        throw new Error(`--evidence-required needs a Harness credential: ${runtime.note ?? 'none available'}.`);
+}
+/** `--attest` records the full report or nothing: the resolved telemetry level must be `full`. */
+function attestLevelMessage(level) {
+    return `--attest needs the telemetry level full (resolved: ${level}): an attested run carries its full report as evidence. Check RCL_TELEMETRY and harness.telemetry in the project config.`;
+}
+/**
+ * `--attest` (RCL-40), before any key, config or reviewer work: the target
+ * must be a pull request, the telemetry level must resolve to `full` from the
+ * environment and the project config (the file `--config` names included),
+ * and only then is the job's OIDC token requested and exchanged. An attested
+ * review is recorded or it does not run; the caller treats evidence as
+ * required from here on.
+ */
+async function attestBeforeReview(spinner, opts, target, gitMode) {
+    if (gitMode || target === undefined || !isGitHubTarget(target)) {
+        throw new Error('--attest applies to a pull request target (owner/repo#N or a GitHub PR URL): Harness attests a run of the pull request it re-reads, not a local diff or a patch file.');
+    }
+    if (opts.telemetry === false) {
+        throw new Error('--attest contradicts --no-telemetry: an attested review is recorded or it does not run.');
+    }
+    const level = resolveTelemetryLevel(await loadHarnessSettings(process.cwd(), opts.config), { noTelemetry: false }, process.env);
+    if (level !== 'full')
+        throw new Error(attestLevelMessage(level));
+    spinner.text = 'Attesting to Harness as this GitHub Actions run...';
+    const attestation = await attestRun({ runId: uuidv7(), rclVersion: RCL_VERSION });
+    spinner.info(`Attested: run-bound credential from ${credentialHost(attestation.credential)} for run ${attestation.runId} (expires ${attestation.expiresAt})`);
+    spinner.start('Loading configuration...');
+    return attestation;
+}
+/** Converge commands report their events fail-soft; nothing they do depends on it. */
+async function reportConvergeEvents(events) {
+    try {
+        await emitConvergeEvents(await createTelemetryRuntime({ rclVersion: RCL_VERSION }), events);
+    }
+    catch {
+        // Evidence of the loop is advisory next to the loop's own durable state.
+    }
+}
+// review command
+program
+    .command('review [target]')
+    .description('Review a PR, local diff, or uncommitted work. Target: owner/repo#N, GitHub PR URL, or path to .patch file; or use --staged/--working-tree')
+    .option('--staged', 'Review staged changes (git diff --cached) instead of a target')
+    .option('--working-tree', 'Review all uncommitted changes (git diff HEAD) instead of a target')
+    .option('--role <name>', 'Use a single named role')
+    .option('--roles <names>', 'Comma-separated list of roles')
+    .option('--reviewer <pair>', 'Explicit model:role pair (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--context <path>', 'Context file or directory to include (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--spec <path>', 'Specification file for spec-compliance role')
+    .option('--models <models>', 'Comma-separated list of primary (SOTA) models')
+    .option('--secondary-models <models>', 'Comma-separated list of secondary models (specialized roles only)')
+    .option('--async-models <models>', 'Comma-separated list of async (non-blocking) bonus reviewers')
+    .option('--focus <areas>', 'Comma-separated focus areas')
+    .option('--post', 'Post review as GitHub PR comment')
+    .option('--json', 'Output JSON to stdout')
+    .option('--json-file <path>', 'Write JSON output to file')
+    .option('--markdown <path>', 'Write Markdown report to file')
+    .option('--ci', 'CI mode: exit non-zero if critical/important findings')
+    .option('--head-sha <sha>', 'Exact head commit a patch file was taken from (patch files only)')
+    .option('--base-sha <sha>', 'Exact base commit a patch file was taken from (patch files only)')
+    .option('--expect-head-sha <sha>', 'Fail fast unless the resolved head commit equals this SHA')
+    .option('--spec-source <source>', 'Where --spec came from: flag | repo_file | harness_issue:<ID>')
+    .option('--converge-target <key>', 'Converge target this round belongs to (or RCL_CONVERGE_TARGET)')
+    .option('--for-pr <owner/repo#N>', 'The pull request a patch-file review is evidence for (or RCL_FOR_PR): Harness verifies its head against that pull request')
+    .option('--round <n>', 'Converge round number (or RCL_CONVERGE_ROUND)')
+    .option('--attempt <n>', 'Converge attempt number (or RCL_CONVERGE_ATTEMPT)')
+    .option('--start-over', 'Start an explicitly requested fresh review with a new normal budget; retain all prior evidence and spending')
+    .option('--guarded-converge', 'Validate and claim inside this review process; derive the round from native state')
+    .option('--bound-fix-recovery <run-id>', 'Review unchanged inputs once live Harness evidence proves a retained bound fix obligation after this native dismissal-only run')
+    .option('--launch-intent <intent>', 'Guarded intent: review, stop-upstream, stop-review, or retry-delivery')
+    .option('--retry-report <path>', 'Original legacy report proving an inconclusive launch; the new inputs may differ; requires --retry-reason')
+    .option('--resume-pending', 'Finalize an unobservable pending legacy dispatch, then claim one fresh checkpointed retry under its target lock')
+    .option('--finalize-pending-only', 'Finalize one authenticated ordinary pending launch without claiming or dispatching its successor')
+    .option('--pending-native-sha256 <digest>', 'Finalize-only: exact native state digest returned by --preview-pending')
+    .option('--pending-attempt-sha256 <digest>', 'Finalize-only: exact attempt state digest returned by --preview-pending')
+    .option('--export-pending-package <path>', 'Export authenticated ordinary pending inputs to an exclusive private file without provider calls or native writes')
+    .option('--expect-base-sha <sha>', 'Pending package export: require the resolved current base to equal this SHA')
+    .option('--ordinary-pending-package <path>', 'Immutable ordinary pending-launch package; requires --resume-pending or --finalize-pending-only and replaces --retry-report')
+    .option('--preview-pending', 'Authenticate pending recovery or preview a pending package export without provider calls')
+    .option('--resume-async-sha256 <hashes>', 'Comma-separated SHA-256 bindings for every legacy async result retained as historical evidence')
+    .option('--retry-reason <reason>', 'Explicit bounded recovery decision for a previous failed or unknown launch; never resets caps')
+    .option('--max-attempts <n>', 'Guarded convergence: explicitly authorized attempt cap (omitting preserves the cap)')
+    .option('--max-rounds <n>', 'Guarded convergence: explicitly authorized round cap (2–99; omitting preserves the cap)')
+    .option('--no-telemetry', 'Do not deliver this review as evidence to Harness')
+    .option('--evidence-required', 'Exit 4 unless Harness acknowledged the evidence (spools first; retry with rcl telemetry flush)')
+    .option('--config <path>', 'Path to config file')
+    .option('--attest', 'GitHub Actions gate workflow only: exchange the job OIDC token for a run-bound Harness credential and record this review as attested (needs id-token: write and HARNESS_API_URL; implies --evidence-required; no fallback to another credential)')
+    .action(async (target, opts) => {
+    await runReview(target, opts);
+});
+// review-plan command
+program
+    .command('review-plan <file>')
+    .description('Council-review an implementation plan document before code exists')
+    .option('--focus <mode>', `Focus the review: ${PLAN_FOCUS_MODES.join(' | ')} (default: comprehensive)`)
+    .option('--role <name>', 'Use a single named role')
+    .option('--roles <names>', 'Comma-separated list of roles')
+    .option('--reviewer <pair>', 'Explicit model:role pair (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--context <path>', 'Context file or directory to include (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--spec <path>', 'Specification the plan should satisfy (enables spec-compliance role)')
+    .option('--models <models>', 'Comma-separated list of primary (SOTA) models')
+    .option('--secondary-models <models>', 'Comma-separated list of secondary models (specialized roles only)')
+    .option('--async-models <models>', 'Comma-separated list of async (non-blocking) bonus reviewers')
+    .option('--json', 'Output JSON to stdout')
+    .option('--json-file <path>', 'Write JSON output to file')
+    .option('--markdown <path>', 'Write Markdown report to file')
+    .option('--spec-source <source>', 'Where --spec came from: flag | repo_file | harness_issue:<ID>')
+    .option('--converge-target <key>', 'Converge target this round belongs to (or RCL_CONVERGE_TARGET)')
+    .option('--for-pr <owner/repo#N>', 'The pull request a patch-file review is evidence for (or RCL_FOR_PR): Harness verifies its head against that pull request')
+    .option('--round <n>', 'Converge round number (or RCL_CONVERGE_ROUND)')
+    .option('--attempt <n>', 'Converge attempt number (or RCL_CONVERGE_ATTEMPT)')
+    .option('--no-telemetry', 'Do not deliver this review as evidence to Harness')
+    .option('--evidence-required', 'Exit 4 unless Harness acknowledged the evidence (spools first; retry with rcl telemetry flush)')
+    .option('--config <path>', 'Path to config file')
+    .action(async (file, opts) => {
+    await runPlanReview(file, opts);
+});
+// discuss command
+program
+    .command('discuss <question>')
+    .description('Ask the models that flagged a finding a follow-up question (one round, from a saved report)')
+    .requiredOption('--report <path>', 'Report JSON from a previous review (--json-file)')
+    .requiredOption('--finding <id>', 'Finding id from the report; use <id>:<n> if the id is ambiguous')
+    .option('--models <models>', 'Override which models answer (comma-separated)')
+    .option('--context <path>', 'Code or doc file to attach as context (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--json', 'Output JSON to stdout')
+    .option('--config <path>', 'Path to config file')
+    .action(async (question, opts) => {
+    await runDiscuss(question, opts);
+});
+// Machine-enforced cost/safety guard used by the rcl-converge workflow.
+program
+    .command('converge-attempt')
+    .description('Atomically consume one persisted rcl-converge attempt before starting a review')
+    // Optional-value syntax is deliberate: Commander otherwise exits before
+    // the action, preventing --json callers from receiving structured errors
+    // for a missing value. The action enforces both values as required.
+    .option('--target [key]', 'Required stable repository-and-PR/branch convergence target key')
+    .option('--max-attempts [n]', `Explicit per-target cap override (default ${DEFAULT_CONVERGE_ATTEMPT_CAP} for a new target)`)
+    .option('--json', 'Output the claim as JSON')
+    .action(async (opts) => {
+    try {
+        if (typeof opts.target !== 'string' || opts.target.trim() === '') {
+            throw new ConvergeAttemptStateError('--target is required.');
+        }
+        let maxAttempts;
+        if (opts.maxAttempts !== undefined) {
+            maxAttempts = typeof opts.maxAttempts === 'string' ? Number(opts.maxAttempts) : NaN;
+            if (!Number.isSafeInteger(maxAttempts) || maxAttempts < 1) {
+                throw new ConvergeAttemptStateError('maxAttempts (--max-attempts) must be a positive safe integer.');
+            }
+        }
+        const claim = await claimConvergeAttempt({
+            gitCommonDir: await resolveGitCommonDir(),
+            target: opts.target,
+            maxAttempts,
+        });
+        await reportConvergeEvents([
+            buildEvent({
+                kind: 'attempt_claimed',
+                convergeTarget: claim.target,
+                attempt: claim.attempt,
+                // The claim's local state path and process id stay on this machine.
+                payload: { attempt: claim.attempt, cap: claim.cap, ...(claim.cycle ? { cycle_id: claim.cycle.id } : {}) },
+            }),
+            // An explicit --max-attempts is consent evidence, whatever it was before.
+            ...(maxAttempts !== undefined
+                ? [buildEvent({ kind: 'cap_changed', convergeTarget: claim.target, attempt: claim.attempt, payload: { kind: 'attempts', to: claim.cap } })]
+                : []),
+        ]);
+        if (opts.json) {
+            console.log(JSON.stringify(claim));
+        }
+        else {
+            console.log(`Convergence attempt ${claim.attempt}/${claim.cap} claimed for ${claim.target}. ` +
+                `State: ${claim.stateFile}`);
+            if (claim.warning)
+                console.error(chalk.yellow(claim.warning));
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const code = err instanceof ConvergeAttemptBudgetExceededError
+            ? err.code
+            : err instanceof ConvergeAttemptStateError
+                ? err.code
+                : 'RCL_CONVERGE_ATTEMPT_ERROR';
+        if (opts.json) {
+            console.error(JSON.stringify({
+                error: {
+                    code,
+                    message,
+                    ...(err instanceof ConvergeAttemptBudgetExceededError
+                        ? { attemptsUsed: err.attemptsUsed, cap: err.cap, target: err.target }
+                        : {}),
+                },
+            }));
+        }
+        else {
+            console.error(chalk.red(message));
+        }
+        // Exit 2 is the expected consent boundary. Exit 3 means accounting or
+        // infrastructure failed and raising the cap is not the remediation.
+        process.exitCode = convergeAttemptErrorExitCode(err);
+    }
+});
+program
+    .command('converge-rejected')
+    .description('Preview or apply an evidenced terminal local rejection; preserves the original report and spent attempts')
+    .option('--preview').option('--apply')
+    .requiredOption('--manifest <path>', 'Exclusive preview output or exact reviewed manifest')
+    .option('--manifest-sha256 <sha256>')
+    .option('--target <target>').option('--run <uuid>')
+    .option('--report <path>').option('--report-sha256 <sha256>')
+    .option('--reason <text>').option('--json')
+    .action(async (opts) => {
+    try {
+        if ([opts.preview, opts.apply].filter(Boolean).length !== 1)
+            throw new Error('choose_exactly_one_rejection_mode');
+        const common = await resolveGitCommonDir(), dataDir = resolveDataDir();
+        let result;
+        if (opts.preview) {
+            if (opts.manifestSha256 !== undefined)
+                throw new Error('preview_does_not_accept_manifest_digest');
+            const manifest = await previewTerminalRejection({ target: opts.target, runId: opts.run,
+                reportPath: opts.report, reportSha256: opts.reportSha256, reason: opts.reason }, common, dataDir);
+            await writeExclusive(opts.manifest, manifest, 16384);
+            result = { mode: 'preview', manifest, manifestSha256: sha256(serializeRecoveryDocument(manifest)) };
+        }
+        else {
+            if ([opts.target, opts.run, opts.report, opts.reportSha256, opts.reason].some(v => v !== undefined))
+                throw new Error('apply_uses_only_pinned_manifest');
+            result = { mode: 'apply', result: await applyTerminalRejection({ manifest: opts.manifest,
+                    manifestSha256: opts.manifestSha256 }, common, dataDir) };
+        }
+        console.log(JSON.stringify({ ...result, accounting: 'unchanged',
+            scope: 'local terminal disposition only; no admission, upload, provider calls or approval' }));
+    }
+    catch (error) {
+        console.error(JSON.stringify({ error: { code: 'RCL_CONVERGE_REJECTED', message: error instanceof Error ? error.message : String(error) } }));
+        process.exitCode = 3;
+    }
+});
+// Cross-round finding identity + machine-enforced round cap (RCL-24).
+program
+    .command('converge-stale')
+    .description('Preview/apply/resume an audited stale unadmitted report disposition; preserves reports, attempts and findings')
+    .option('--preview').option('--apply').option('--resume')
+    .requiredOption('--manifest <path>', 'Exclusive preview output; reviewed manifest for apply/resume')
+    .option('--manifest-sha256 <sha256>', 'Exact reviewed manifest digest for apply/resume')
+    .option('--target <target>')
+    .option('--head <sha>', 'Current exact head from the guarded launch refusal')
+    .option('--input-sha256 <sha256>', 'Current effective input digest from the guarded launch refusal; rechecked on continuation')
+    .option('--report <path>', 'Original completed, healthy, delivered report JSON')
+    .option('--report-sha256 <sha256>', 'Original immutable report digest')
+    .option('--reason <text>', 'Source-backed reason this report became materially stale, at most 500 characters')
+    .option('--json')
+    .action(async (opts) => {
+    try {
+        if ([opts.preview, opts.apply, opts.resume].filter(Boolean).length !== 1)
+            throw new Error('choose_exactly_one_stale_report_mode');
+        const common = await resolveGitCommonDir();
+        let result;
+        if (opts.preview) {
+            if (opts.manifestSha256 !== undefined)
+                throw new Error('preview_does_not_accept_manifest_digest');
+            if (![opts.target, opts.head, opts.inputSha256, opts.report, opts.reportSha256, opts.reason].every(v => typeof v === 'string'))
+                throw new Error('stale_report_preview_arguments_required');
+            const manifest = await previewStaleReport({ target: opts.target, headSha: opts.head,
+                inputSha256: opts.inputSha256, reportPath: opts.report, reportSha256: opts.reportSha256, reason: opts.reason }, common);
+            await writeExclusive(opts.manifest, manifest, 16384);
+            result = { mode: 'preview', manifest, manifestSha256: sha256(serializeRecoveryDocument(manifest)) };
+        }
+        else {
+            if ([opts.target, opts.head, opts.inputSha256, opts.report, opts.reportSha256, opts.reason].some(v => v !== undefined))
+                throw new Error('apply_uses_only_pinned_manifest');
+            result = { mode: opts.apply ? 'apply' : 'resume', result: await applyStaleReport({ manifest: opts.manifest,
+                    manifestSha256: opts.manifestSha256, mode: opts.apply ? 'apply' : 'resume' }, common) };
+        }
+        console.log(JSON.stringify({ ...result, accounting: 'unchanged', scope: 'local stale disposition only; no admission, provider calls or approval' }));
+    }
+    catch (error) {
+        console.error(JSON.stringify({ error: { code: 'RCL_CONVERGE_STALE', message: error instanceof Error ? error.message : String(error) } }));
+        process.exitCode = 3;
+    }
+});
+program
+    .command('converge-gap')
+    .description('Preview, apply or resume one evidenced missing-terminal-report audit gap; never creates a round, finding, verdict or attempt')
+    .option('--preview')
+    .option('--apply')
+    .option('--resume')
+    .requiredOption('--manifest <path>', 'Exclusive preview manifest; existing reviewed manifest for apply/resume')
+    .option('--target <target>')
+    .option('--gap-round <number>')
+    .option('--admitting-round <number>')
+    .option('--attempt <number>')
+    .option('--run <uuid>')
+    .option('--report <path>', 'Exact original report JSON')
+    .option('--report-sha256 <sha256>')
+    .option('--incomplete <path>', 'Available incomplete-run evidence; does not prove global absence')
+    .option('--incomplete-sha256 <sha256>')
+    .option('--evidence <path>', 'Optional JSON array of additional {path, sha256} selections')
+    .option('--manifest-sha256 <sha256>', 'Exact reviewed manifest bytes; required for apply/resume')
+    .option('--json')
+    .action(async (opts) => {
+    try {
+        if ([opts.preview, opts.apply, opts.resume].filter(Boolean).length !== 1)
+            throw new Error('choose_exactly_one_round_gap_mode');
+        const gitCommonDir = await resolveGitCommonDir();
+        let result;
+        if (opts.preview) {
+            if (opts.manifestSha256 !== undefined)
+                throw new Error('preview_does_not_accept_manifest_digest');
+            if (![opts.target, opts.gapRound, opts.admittingRound, opts.attempt, opts.run, opts.report, opts.reportSha256, opts.incomplete, opts.incompleteSha256].every(value => typeof value === 'string'))
+                throw new Error('round_gap_preview_arguments_required');
+            const evidence = typeof opts.evidence === 'string' ? JSON.parse((await readStable(opts.evidence, 1024 * 1024)).text) : undefined;
+            const manifest = await previewRoundGap({ target: opts.target, gapRound: Number(opts.gapRound), admittingRound: Number(opts.admittingRound), attempt: Number(opts.attempt), runId: opts.run,
+                reportPath: opts.report, reportSha256: opts.reportSha256,
+                incompletePath: opts.incomplete, incompleteSha256: opts.incompleteSha256, ...(evidence !== undefined ? { evidence } : {}) }, gitCommonDir);
+            await writeExclusive(opts.manifest, manifest, 1024 * 1024);
+            result = { mode: 'preview', manifest, manifestSha256: sha256(serializeRecoveryDocument(manifest)), accounting: 'unchanged', scope: 'local audit only; no admission or approval' };
+        }
+        else {
+            if ([opts.target, opts.gapRound, opts.admittingRound, opts.attempt, opts.run, opts.report, opts.reportSha256, opts.incomplete, opts.incompleteSha256, opts.evidence].some(v => v !== undefined))
+                throw new Error('apply_uses_only_pinned_manifest');
+            result = { mode: opts.apply ? 'apply' : 'resume', result: await applyRoundGap({ manifest: opts.manifest, manifestSha256: opts.manifestSha256, mode: opts.apply ? 'apply' : 'resume' }, gitCommonDir), accounting: 'unchanged', scope: 'local audit only; no admission or approval' };
+        }
+        console.log(JSON.stringify(result));
+    }
+    catch (error) {
+        console.error(JSON.stringify({ error: { code: 'RCL_CONVERGE_GAP', message: error instanceof Error ? error.message : String(error) } }));
+        process.exitCode = 3;
+    }
+});
+function blockingHealthJson(health) {
+    return {
+        conclusive: health.conclusive,
+        blockingSeats: health.policy.seatCount,
+        successfulBlockingSeats: health.successfulSeats.length,
+        requiredSuccessfulSeats: health.policy.minimumSuccessful,
+        quorumFraction: health.policy.fraction,
+        incompleteSeats: health.unsuccessfulSeats,
+        excludedSuccesses: health.excludedSuccesses,
+    };
+}
+program
+    .command('converge-report')
+    .description('Dedupe a round report against the converge run state, enforce the round cap, and classify findings as new/repeat/suppressed/regating. ' +
+    'Refuses a report whose blocking reviewer health is inconclusive or cannot be derived from its reviews and roster (exit 4). ' +
+    'Exit codes: 0 admitted, 2 round cap, 3 state failure, 4 reviewer health.')
+    .option('--target [key]', 'Stable convergence target key (same key as converge-attempt)')
+    .option('--report [path]', 'Round report JSON (a --json-file output)')
+    .option('--round [n]', 'Evidence round number (1-based)')
+    .option('--max-rounds [n]', `Round cap override (default ${DEFAULT_CONVERGE_ROUND_CAP}, hard maximum ${HARD_CONVERGE_ROUND_CAP})`)
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    try {
+        if (typeof opts.target !== 'string' || opts.target.trim() === '') {
+            throw new ConvergeRunStateError('--target is required.');
+        }
+        if (typeof opts.report !== 'string' || opts.report.trim() === '') {
+            throw new ConvergeRunStateError('--report is required.');
+        }
+        const round = typeof opts.round === 'string' ? Number(opts.round) : NaN;
+        if (!Number.isSafeInteger(round) || round < 1) {
+            throw new ConvergeRunStateError('--round must be a positive integer.');
+        }
+        let maxRounds;
+        if (opts.maxRounds !== undefined) {
+            maxRounds = typeof opts.maxRounds === 'string' ? Number(opts.maxRounds) : NaN;
+            if (!Number.isSafeInteger(maxRounds)) {
+                throw new ConvergeRunStateError(`--max-rounds must be an integer between 2 and ${HARD_CONVERGE_ROUND_CAP}.`);
+            }
+        }
+        let report;
+        let reportSha256;
+        try {
+            const source = await readFile(opts.report);
+            report = JSON.parse(source.toString('utf8'));
+            reportSha256 = sha256(source);
+        }
+        catch (err) {
+            throw new ConvergeRunStateError(`Could not read report JSON: ${opts.report}`, {
+                cause: err,
+            });
+        }
+        if (!Array.isArray(report.findings)) {
+            throw new ConvergeRunStateError(`Not an rcl report (no findings array): ${opts.report}`);
+        }
+        // Reviewer health gates admission before any native state is read or
+        // written: an inconclusive report is never triaged (RCL-136).
+        const health = assertAdmissibleReportHealth(report);
+        // The round remembers the report's run id only when it is a UUID and
+        // the report was produced for this converge target (a report copied
+        // from another target must not bind its run to this loop).
+        const reportRunId = typeof report.run?.id === 'string' && UUID_PATTERN.test(report.run.id) ? report.run.id : undefined;
+        // A report without a converge target (a plain `rcl review`, or one
+        // copied in) is not this loop's evidence either.
+        const reportTarget = report.run?.converge?.target;
+        const runId = reportRunId !== undefined && typeof reportTarget === 'string' && reportTarget.trim() === opts.target.trim()
+            ? reportRunId
+            : undefined;
+        if (reportRunId !== undefined && runId === undefined) {
+            console.error(chalk.yellow(`Report run ${reportRunId} ${reportTarget === undefined ? 'carries no converge target' : `belongs to converge target ${reportTarget}`}, not ${opts.target}; the round keeps no run id.`));
+        }
+        const result = await processRoundReport({
+            gitCommonDir: await resolveGitCommonDir(),
+            target: opts.target,
+            round,
+            findings: report.findings,
+            reportSha256,
+            cycleId: report.run?.cycle_id,
+            ...(maxRounds !== undefined ? { maxRounds } : {}),
+            ...(runId !== undefined ? { runId } : {}),
+        });
+        const classified = result.findings.map((f) => ({
+            identity: f.identity,
+            status: f.status,
+            gating: findingGatingReason(f.finding),
+            severity: f.finding.severity,
+            file: f.finding.file,
+            startLine: f.finding.startLine,
+            endLine: f.finding.endLine,
+            title: f.finding.title,
+            ...(f.suppressReason ? { suppressReason: f.suppressReason } : {}),
+        }));
+        const actionable = classified.filter((f) => (f.status === 'new' || f.status === 'regating') && f.gating !== 'none');
+        await reportConvergeEvents([
+            buildEvent({
+                kind: 'round_processed',
+                convergeTarget: opts.target,
+                round,
+                ...(runId !== undefined ? { runId } : {}),
+                payload: {
+                    round,
+                    round_cap: result.roundCap,
+                    counts: result.counts,
+                    actionable_gating: actionable.length,
+                    // Which identity each sighting was matched to, so the server
+                    // can apply standing verdicts to keys that moved (IO-12601).
+                    identities: roundIdentities(result.findings),
+                },
+            }),
+            ...(maxRounds !== undefined
+                ? [buildEvent({ kind: 'cap_changed', convergeTarget: opts.target, round, payload: { kind: 'rounds', to: result.roundCap } })]
+                : []),
+        ]);
+        if (opts.json) {
+            console.log(JSON.stringify({
+                target: opts.target,
+                round,
+                roundCap: result.roundCap,
+                reviewerHealth: blockingHealthJson(health),
+                counts: result.counts,
+                actionableGating: actionable.length,
+                findings: classified,
+            }, null, 2));
+            return;
+        }
+        console.log(chalk.dim(describeBlockingHealth(health)));
+        console.log(`Round ${round}/${result.roundCap} for ${opts.target}: ` +
+            `${result.counts.new} new, ${result.counts.repeat} repeat, ` +
+            `${result.counts.suppressed} suppressed, ${result.counts.regating} regating · ` +
+            `${actionable.length} actionable gating finding(s)`);
+        for (const f of actionable) {
+            console.log(`  [${f.status}] ${f.identity} ${f.file}:${f.startLine} — ${f.title}`);
+        }
+        for (const f of classified.filter((c) => c.status === 'suppressed')) {
+            console.log(chalk.dim(`  [suppressed] ${f.identity} ${f.file}:${f.startLine} — ${f.suppressReason}`));
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (opts.json) {
+            const code = err instanceof ConvergeRunStateError && err.message === 'report_health_inconclusive'
+                ? 'report_health_inconclusive'
+                : err instanceof ConvergeRoundCapError || err instanceof ConvergeRunStateError
+                    ? err.code
+                    : err instanceof ReportHealthError
+                        ? err.code
+                        : 'RCL_CONVERGE_REPORT_ERROR';
+            const health = err instanceof ReportHealthError && err.health ? { reviewerHealth: blockingHealthJson(err.health) } : {};
+            console.error(JSON.stringify({ error: { code, message, ...health } }));
+        }
+        else {
+            console.error(chalk.red(message));
+        }
+        // Exit 2 = round-cap consent boundary (mirrors converge-attempt);
+        // exit 3 = state/infrastructure failure; exit 4 = reviewer health
+        // is inconclusive or unverifiable, so nothing was admitted.
+        const healthRefusal = err instanceof ReportHealthError ||
+            (err instanceof ConvergeRunStateError && err.message === 'report_health_inconclusive');
+        process.exitCode = err instanceof ConvergeRoundCapError ? 2 : healthRefusal ? 4 : 3;
+    }
+});
+// Record triage outcomes for finding identities (RCL-24; the precision
+// history these verdicts build feeds RCL-27's model weighting).
+program
+    .command('converge-verdict')
+    .description('Record fixed/dismissed triage verdicts for finding identities in the converge run state')
+    .option('--run-id <uuid>', 'Report run UUID (required for fresh review cycles)')
+    .option('--target [key]', 'Stable convergence target key')
+    .option('--round [n]', 'Evidence round the triage belongs to')
+    .option('--fixed <key>', 'Finding identity verified and fixed (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--fixed-reason <key=reason>', 'Current fix explanation for an identity also passed to --fixed (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--dismissed <key=reason>', 'Finding identity dismissed, with reason (repeatable)', (val, prev) => {
+    prev.push(val);
+    return prev;
+}, [])
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    try {
+        if (typeof opts.target !== 'string' || opts.target.trim() === '') {
+            throw new ConvergeRunStateError('--target is required.');
+        }
+        const round = typeof opts.round === 'string' ? Number(opts.round) : NaN;
+        if (!Number.isSafeInteger(round) || round < 1) {
+            throw new ConvergeRunStateError('--round must be a positive integer.');
+        }
+        const fixedReasons = new Map();
+        for (const assignment of opts.fixedReason) {
+            const eq = assignment.indexOf('=');
+            const key = assignment.slice(0, eq);
+            const reason = assignment.slice(eq + 1);
+            if (eq < 1 || reason.trim() === '' || !opts.fixed.includes(key)) {
+                throw new ConvergeRunStateError('--fixed-reason requires key=reason for an identity also passed to --fixed.');
+            }
+            if (fixedReasons.has(key)) {
+                throw new ConvergeRunStateError(`Duplicate --fixed-reason for finding "${key}".`);
+            }
+            fixedReasons.set(key, reason);
+        }
+        const verdicts = [
+            ...opts.fixed.map((key) => ({ key, verdict: 'fixed', reason: fixedReasons.get(key) })),
+            ...opts.dismissed.map((entry) => {
+                const eq = entry.indexOf('=');
+                return eq === -1
+                    ? { key: entry, verdict: 'dismissed' }
+                    : {
+                        key: entry.slice(0, eq),
+                        verdict: 'dismissed',
+                        reason: entry.slice(eq + 1),
+                    };
+            }),
+        ];
+        if (verdicts.length === 0) {
+            throw new ConvergeRunStateError('Nothing to record: pass --fixed and/or --dismissed.');
+        }
+        if (new Set(verdicts.map(({ key }) => key)).size !== verdicts.length) {
+            throw new ConvergeRunStateError('Pass each finding identity only once, as either fixed or dismissed.');
+        }
+        const { entries: updated, resolution, runId: roundRun } = await recordVerdicts({
+            gitCommonDir: await resolveGitCommonDir(),
+            target: opts.target,
+            round,
+            verdicts,
+            runId: opts.runId,
+        });
+        // Feed the cross-run precision history (RCL-27) — fail-soft, the
+        // verdicts above are already durably recorded.
+        try {
+            const ts = new Date().toISOString();
+            await appendOutcomes(updated
+                .filter((e) => e.verdict !== undefined && e.models.length > 0)
+                .map((e) => ({
+                ts,
+                verdict: e.verdict,
+                models: e.models,
+                severity: e.verdictSeverity ?? e.severity,
+                target: opts.target,
+                findingKey: e.key,
+                source: 'live',
+            })));
+        }
+        catch (err) {
+            // Advisory history; verdict recording must not fail over it —
+            // but say so, or a broken store silently stops learning.
+            console.warn(`Model-stats store unavailable (outcomes not recorded): ${String(err)}`);
+        }
+        await reportConvergeEvents([
+            buildEvent({
+                kind: 'verdicts_recorded',
+                convergeTarget: opts.target,
+                round,
+                ...(roundRun !== undefined ? { runId: roundRun } : {}),
+                payload: {
+                    verdicts: updated.map((e) => ({
+                        identity_key: e.key,
+                        verdict: e.verdict,
+                        // Verdict reasons are user-authored prose: scrubbed like every other free text that leaves the machine.
+                        ...(e.verdictReason !== undefined ? { reason: scrubText(e.verdictReason, 500) } : {}),
+                        severity: e.verdictSeverity ?? e.severity,
+                        models: e.models,
+                    })),
+                },
+            }),
+            ...(resolution
+                ? [
+                    buildEvent({
+                        kind: 'resolution',
+                        convergeTarget: opts.target,
+                        round,
+                        ...(roundRun !== undefined ? { runId: roundRun } : {}),
+                        payload: {
+                            status: resolution.status,
+                            actionable: resolution.actionable,
+                            unresolved: resolution.unresolved.length,
+                            fixed_this_round: resolution.fixedThisRound,
+                        },
+                    }),
+                ]
+                : []),
+        ]);
+        if (opts.json) {
+            console.log(JSON.stringify({
+                target: opts.target,
+                round,
+                recorded: verdicts.length,
+                ...(resolution ? { resolution } : {}),
+            }));
+        }
+        else {
+            console.log(`Recorded ${verdicts.length} verdict(s) for ${opts.target} round ${round}.`);
+            if (resolution) {
+                switch (resolution.status) {
+                    case 'converged-dismissal-only':
+                        console.log(`Round ${round} resolution: all ${resolution.actionable} gating finding(s) dismissed, ` +
+                            'nothing fixed — the reviewed patch is unchanged, so this round CONVERGES. ' +
+                            'No confirmation round is required (RCL-30).');
+                        break;
+                    case 'fixes-pending-fresh-round':
+                        console.log(`Round ${round} resolution: ${resolution.fixedThisRound} fix(es) recorded — ` +
+                            'the patch changes; commit, push, and run a fresh exact-head round.');
+                        break;
+                    case 'unresolved':
+                        console.log(`Round ${round} resolution: ${resolution.unresolved.length} gating identity(ies) ` +
+                            `still untriaged: ${resolution.unresolved.join(', ')}`);
+                        break;
+                }
+            }
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (opts.json) {
+            console.error(JSON.stringify({ error: { code: 'RCL_CONVERGE_VERDICT', message } }));
+        }
+        else {
+            console.error(chalk.red(message));
+        }
+        process.exitCode = 3;
+    }
+});
+// Evidence delivery operations (IO-12475 section 8.10).
+const telemetry = program
+    .command('telemetry')
+    .description('Evidence delivery to Harness: credentials, queued deliveries and retained rejected reports');
+telemetry
+    .command('recover-reviewer')
+    .description('Deliver one exact retained terminal reviewer report without restarting reviewers or verification')
+    .requiredOption('--target <target>', 'Exact guarded convergence target')
+    .requiredOption('--run <id>', 'Exact retained terminal run UUID')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    try {
+        const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION });
+        const result = await deliverTerminalReviewerRun(runtime, { target: opts.target, runId: opts.run });
+        if (opts.json)
+            console.log(JSON.stringify(result, null, 2));
+        else
+            console.log(`${result.outcome.line}\nReport ${result.reportSha256}; reviewer artifact ${result.reviewerArtifactSha256}`);
+        process.exitCode = result.outcome.exitCode;
+    }
+    catch (error) {
+        const message = scrubText(error instanceof Error ? error.message : String(error), 300);
+        if (opts.json)
+            console.error(JSON.stringify({ error: { code: 'RCL_TERMINAL_REVIEWER_DELIVERY', message } }));
+        else
+            console.error(chalk.red(`Cannot recover terminal reviewer delivery: ${message}`));
+        process.exitCode = 4;
+    }
+});
+telemetry
+    .command('rejected')
+    .description('Inspect immutable retained evidence without delivering or retrying it')
+    .option('--run <id>', 'Select one retained original run')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    const store = new Quarantine(join(resolveDataDir(), QUARANTINE_DIR));
+    try {
+        const selected = opts.run ? await store.inspect(opts.run) : undefined;
+        const entries = opts.run ? (selected ? [selected] : []) : await store.list();
+        if (opts.json)
+            console.log(JSON.stringify({ dir: store.dir, entries }, null, 2));
+        else {
+            console.log(`Retained evidence: ${entries.length} entr${entries.length === 1 ? 'y' : 'ies'} — no automatic retry`);
+            for (const entry of entries)
+                console.log(`  ${entry.runId} ${entry.status} ${entry.path}${entry.error ? ` (${entry.error})` : ''}`);
+        }
+        if ((opts.run && entries.length === 0) || entries.some((e) => e.status !== 'complete'))
+            process.exitCode = 1;
+    }
+    catch (error) {
+        console.error(`Cannot inspect retained evidence: ${scrubText(error instanceof Error ? error.message : String(error), 200)}`);
+        process.exitCode = 1;
+    }
+});
+telemetry
+    .command('status')
+    .description('Show the telemetry level, the credential source and every spooled delivery')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION, requireRepo: false });
+    const entries = await runtime.outbox.list();
+    const loss = await runtime.outbox.pendingLoss();
+    const refused = await runtime.outbox.refusedLoss();
+    const status = {
+        level: runtime.level,
+        repoManaged: runtime.repoManaged,
+        credential: runtime.credential
+            ? { source: runtime.credential.source, host: credentialHost(runtime.credential) }
+            : null,
+        note: runtime.note ?? null,
+        outbox: { dir: runtime.outbox.dir, entries, pendingLoss: loss, refusedLoss: refused },
+    };
+    if (opts.json) {
+        console.log(JSON.stringify(status, null, 2));
+        return;
+    }
+    console.log(`Telemetry level: ${status.level}`);
+    console.log(status.repoManaged
+        ? 'Repository: Harness-managed (.harness-cli/config.json found) — reviews here are delivered'
+        : 'Repository: not Harness-managed — reviews here are not delivered; the outbox still flushes');
+    console.log(status.credential
+        ? `Credential: ${status.credential.source} → ${status.credential.host}`
+        : `Credential: none${status.note ? ` (${status.note})` : ''}`);
+    console.log(`Outbox: ${runtime.outbox.dir} — ${entries.length} entr${entries.length === 1 ? 'y' : 'ies'}`);
+    for (const entry of entries) {
+        console.log(`  ${entry.id} ${entry.meta.kind} spooled ${entry.meta.spooled_at} attempts ${entry.meta.attempts} ` +
+            `${entry.bytes} bytes artifacts [${entry.artifacts.join(', ')}] events ${entry.events}` +
+            (entry.meta.envelope_delivered ? ' (envelope delivered)' : '') +
+            (entry.failed ? chalk.red(` FAILED: ${entry.failed.reason}`) : ''));
+    }
+    if (loss.length > 0) {
+        console.log(chalk.yellow(`Artifacts not spooled (outbox over its cap) for ${loss.length} run(s); reported on the next flush.`));
+    }
+    if (refused.length > 0) {
+        console.log(chalk.yellow(`${refused.length} loss report(s) the server refused are kept under ${runtime.outbox.dir}/loss (*.refused); they are not retried.`));
+    }
+});
+telemetry
+    .command('flush')
+    .description('Deliver every spooled envelope, artifact and event batch (runs to completion)')
+    .option('--run <id>', 'Flush one spooled run only')
+    .option('--envelope-timeout-ms <ms>', 'Envelope POST timeout in milliseconds (1–120000; default: 10000)', value => {
+    try {
+        return validateEnvelopeTimeoutMs(/^\d+$/.test(value) ? Number(value) : NaN);
+    }
+    catch (error) {
+        throw new InvalidArgumentError(error.message);
+    }
+})
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION, requireRepo: false,
+        ...(opts.envelopeTimeoutMs !== undefined ? { envelopeTimeoutMs: opts.envelopeTimeoutMs } : {}) });
+    if (!runtime.sink) {
+        const reason = runtime.level === 'off' ? 'telemetry is off' : runtime.note ?? 'no Harness credential';
+        console.error(chalk.red(`Cannot flush: ${reason}.`));
+        process.exitCode = 1;
+        return;
+    }
+    const summary = await flushOutbox(runtime, opts.run ? { runId: opts.run } : {});
+    const reconciled = await reconcileFlushedRun(opts.run, summary, runtime.sink, {
+        cwd: process.cwd(),
+        onError: error => process.stderr.write(chalk.dim(`Run reconciliation skipped: ${String(error)}\n`)),
+    });
+    if (reconciled === 'reconciled')
+        process.stderr.write(chalk.dim('Reconciled delivered run ' + opts.run + ' with its guarded launch state.\n'));
+    if (opts.json) {
+        console.log(JSON.stringify(summary, null, 2));
+    }
+    else {
+        console.log(`Delivered ${summary.delivered.length}, remaining ${summary.remaining.length}, failed ${summary.failed.length}, dropped ${summary.dropped.length}` +
+            (summary.stopped ? ` (stopped: ${summary.stopped})` : '') +
+            (summary.lossPending ? `; ${summary.lossPending} loss report(s) still pending` : ''));
+        for (const id of summary.delivered)
+            console.log(`  delivered ${id}`);
+        for (const f of summary.failed)
+            console.log(chalk.red(`  failed ${f.id}: ${f.reason}`));
+        for (const d of summary.dropped)
+            console.log(chalk.dim(`  dropped ${d.id}: ${d.reason}`));
+        for (const id of summary.remaining)
+            console.log(chalk.yellow(`  remaining ${id}`));
+    }
+    if (summary.remaining.length > 0 || summary.failed.length > 0)
+        process.exitCode = 1;
+});
+// Evidence reads (RCL-41): what Harness holds about a pull request's gate
+// and about one run. The skills gate on `evidence status`'s exit code: 0 only
+// when the judged projection is converged, 1 for any other status, 2 when the
+// pull request cannot be named, 3 when the read could not be answered.
+const evidenceCmd = program
+    .command('evidence')
+    .description('Read Review Council evidence on Harness: a pull request’s gate status, one run’s record');
+function evidenceDeps() {
+    return {
+        rclVersion: RCL_VERSION,
+        stdout: (line) => console.log(line),
+        stderr: (line) => console.error(chalk.red(line)),
+    };
+}
+evidenceCmd
+    .command('status [pr]')
+    .description('Gate status of a pull request — N or #N against the current remote, owner/repo#N, or a URL; exit 0 only when the judged projection is converged')
+    .option('--enforced', 'Judge the enforced projection instead of the advisory one')
+    .option('--json', 'Print the API status object')
+    .action(async (pr, opts) => {
+    process.exitCode = await runEvidenceStatus(pr, opts, evidenceDeps());
+});
+evidenceCmd
+    .command('show [run-id]')
+    .description('One recorded run: header, reviewer health, artifacts, findings with identity, gating reason and verdict')
+    .option('--json', 'Print the API run object')
+    .action(async (runId, opts) => {
+    process.exitCode = await runEvidenceShow(runId ?? '', opts, evidenceDeps());
+});
+evidenceCmd
+    .command('recover-run')
+    .description('Preview, apply or resume delivery of one immutable original asserted run; no review, events or native accounting')
+    .option('--preview', 'Validate sources and scoped remote reads; write only a new exclusive manifest')
+    .option('--apply', 'Start the explicitly pinned manifest operation')
+    .option('--resume', 'Resume the same journal through fresh exact run/artifact reads')
+    .requiredOption('--manifest <path>', 'Exclusive preview manifest; existing manifest for apply/resume')
+    .option('--manifest-sha256 <sha256>', 'Required exact reviewed manifest digest for apply/resume')
+    .option('--run <uuid>', 'Original run UUID (preview)')
+    .option('--for-pr <owner/repo#N>', 'Original repository and pull request (preview)')
+    .option('--head <sha>', 'Original full reviewed head SHA (preview)')
+    .option('--report-json <path>', 'Original bounded regular UTF-8 JSON file (preview)')
+    .option('--report-sha256 <sha256>', 'Exact original JSON digest (preview)')
+    .option('--report-md <path>', 'Optional original Markdown file (preview)')
+    .option('--markdown-sha256 <sha256>', 'Required digest when selecting original Markdown')
+    .option('--original-mode <mode>', 'Required operator assertion: asserted; CI/attested originals unsupported')
+    .option('--original-prose <mode>', 'Explicit original finding-prose representation: control-code-units-v1')
+    .option('--json', 'Print machine-readable operation status and diagnostics')
+    .action(async (opts) => {
+    process.exitCode = await runOriginalRecovery(opts, evidenceDeps());
+});
+evidenceCmd
+    .command('recover-finding')
+    .description('Preview an unpaid, attributed correction of one recorded finding identity; never reruns review or changes native history')
+    .requiredOption('--target <target>', 'The retained native convergence target')
+    .requiredOption('--run <uuid>', 'The immutable Harness run ID')
+    .requiredOption('--report-sha256 <sha256>', 'The original report JSON digest')
+    .requiredOption('--finding-ref <ref>', 'The exact finding ref within the run')
+    .requiredOption('--identity <key>', 'The native canonical identity from retained state')
+    .requiredOption('--for-pr <owner/repo#N>', 'The expected pull request, explicitly named')
+    .option('--submit', 'Submit the correction; without this flag only read and preview')
+    .action(async (opts) => {
+    process.exitCode = await runFindingRecovery(opts, evidenceDeps());
+});
+evidenceCmd
+    .command('retriage-finding')
+    .description('Preview a fresh dismissal of one recorded finding at its actual severity; no rematching or native history changes')
+    .requiredOption('--target <target>', 'The recorded convergence target, or an event label for a standalone attested run')
+    .requiredOption('--run <uuid>', 'The immutable Harness run ID')
+    .requiredOption('--report-sha256 <sha256>', 'The original stored report JSON digest')
+    .requiredOption('--finding-ref <ref>', 'The exact finding ref within the run')
+    .requiredOption('--for-pr <owner/repo#N>', 'The expected pull request, explicitly named')
+    .requiredOption('--reason-file <path>', 'UTF-8 file containing the explicit source-backed reason for this new judgment')
+    .option('--submit', 'Submit the fresh verdict; without this flag only read and preview')
+    .action(async (opts) => {
+    process.exitCode = await runFindingRetriage(opts, evidenceDeps());
+});
+telemetry
+    .command('recover-refutations')
+    .description('Discover original refutations and write a reviewed recovery manifest; dry-run by default')
+    .requiredOption('--manifest <path>', 'New private manifest path, or the reviewed manifest with --apply')
+    .option('--root <path>', 'Discovery root; repeat to replace the default roots', (value, previous = []) => [...previous, value])
+    .option('--exclude-sha256 <digest>', 'Explicit synthetic report digest; repeat as needed', (value, previous = []) => [...previous, value])
+    .option('--inventory-only', 'Offline discovery artifact without a destination; cannot be applied')
+    .option('--apply', 'Revalidate and apply only the reviewed manifest selections')
+    .option('--output <path>', 'New outcome path for apply; defaults to a unique file beside the manifest')
+    .action(async (opts) => {
+    process.exitCode = await runRefutationRecovery(opts, evidenceDeps());
+});
+telemetry
+    .command('backfill')
+    .description('Post recovered pre-3.0 reports and converge ledgers as backfill evidence (deterministic ids: running twice adds nothing)')
+    .requiredOption('--from <dir>', 'Directory of rcl-report-*.json reports and rcl-converge-*-ledger.md ledgers')
+    .requiredOption('--repo <owner/repo>', 'The GitHub repository the reports reviewed')
+    .option('--dry-run', 'Build the runs and report counts without posting')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    const repo = parseRepoName(opts.repo);
+    if (repo === null) {
+        console.error(chalk.red('--repo must be a GitHub owner/repo.'));
+        process.exitCode = 2;
+        return;
+    }
+    // A dry run builds and counts; it needs no credential and sends nothing.
+    // The ids still depend on the host, so a credential is used for them when
+    // there is one and a placeholder named otherwise.
+    const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION, requireRepo: false });
+    let host;
+    if (runtime.sink && runtime.credential) {
+        host = credentialHost(runtime.credential);
+    }
+    else if (opts.dryRun) {
+        host = 'no-credential';
+    }
+    else {
+        const reason = runtime.level === 'off' ? 'telemetry is off' : runtime.note ?? 'no Harness credential';
+        console.error(chalk.red(`Cannot backfill: ${reason}.`));
+        process.exitCode = 1;
+        return;
+    }
+    let summary;
+    try {
+        summary = await runBackfill({ dir: opts.from, repo: `${repo.owner}/${repo.repo}`, rclVersion: RCL_VERSION, ...(opts.dryRun ? { dryRun: true } : {}) }, {
+            ...(runtime.sink ? { sink: runtime.sink } : {}),
+            host,
+            placeholderHost: host === 'no-credential',
+            ...(opts.json ? {} : { progress: (line) => console.log(chalk.dim(text(line, 400))) }),
+        });
+    }
+    catch (err) {
+        console.error(chalk.red(`Cannot backfill: ${scrubText(err instanceof Error ? err.message : String(err), 300)}`));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(summary, null, 2));
+    }
+    else if (summary.dryRun) {
+        console.log(`Would post ${summary.runs} run(s) with ${summary.planned.artifacts} artifact(s) and ${summary.planned.events} verdict event(s) ` +
+            `(${summary.planned.verdicts} verdicts)${host === 'no-credential' ? ' — ids shown for a placeholder host; log in for the real ones' : ''}; ` +
+            `${summary.skipped} file(s) skipped; ledgers ${summary.ledgersScanned}, bullets matched ${summary.bulletsMatched}, unmatched ${summary.bulletsUnmatched}.`);
+        for (const f of summary.skippedFiles)
+            console.log(chalk.dim(`  skipped ${text(f.file, 200)}: ${text(f.reason, 300)}`));
+    }
+    else {
+        console.log(`Posted ${summary.runs} run(s): ${summary.created} new, ${summary.existing} already recorded; ` +
+            `${summary.artifacts} artifact(s) uploaded for the new runs; verdict events ${summary.events.inserted} new, ${summary.events.duplicates} already recorded; ` +
+            `${summary.skipped} file(s) skipped; ledgers ${summary.ledgersScanned}, bullets matched ${summary.bulletsMatched} (at build), unmatched ${summary.bulletsUnmatched}.`);
+        for (const f of summary.skippedFiles)
+            console.log(chalk.dim(`  skipped ${text(f.file, 200)}: ${text(f.reason, 300)}`));
+        for (const f of summary.failed)
+            console.log(chalk.red(`  failed ${text(f.file, 200)}: ${text(f.reason, 300)}`));
+    }
+    if (summary.failed.length > 0)
+        process.exitCode = 1;
+});
+// Detached async-lane worker (RCL-25) — launched by the review process for
+// each async (non-blocking) reviewer call; not for interactive use.
+program
+    .command('async-worker', { hidden: true })
+    .requiredOption('--spool <path>', 'Spool file written by the launching review')
+    .action(async (opts) => {
+    try {
+        await runAsyncWorker(opts.spool);
+    }
+    catch {
+        // Nothing is awaiting this process; a failed worker simply leaves no
+        // result to merge. Exit non-zero for post-mortem visibility only.
+        process.exitCode = 1;
+    }
+});
+// Per-model triage history (RCL-27): trailing precision, volume, latency,
+// dead-call rate, and the consensus weight each model earns from them.
+const modelsCmd = program
+    .command('models')
+    .description('Per-model trailing precision, volume, latency, dead-call rate, and consensus weight');
+modelsCmd
+    .command('show', { isDefault: true })
+    .description(`Print per-model stats over the trailing window (default ${DEFAULT_WINDOW_DAYS} days)`)
+    .option('--window <days>', 'Trailing window in days', String(DEFAULT_WINDOW_DAYS))
+    .option('--local', 'This machine’s store only; do not ask Harness for the org-wide window')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    const windowDays = Number(opts.window);
+    if (!Number.isFinite(windowDays) || windowDays <= 0) {
+        console.error(chalk.red('--window must be a positive number of days.'));
+        process.exitCode = 1;
+        return;
+    }
+    const stats = await loadModelStats({ windowDays });
+    // The org-wide window (RCL-38): Harness's `model-stats` over every run the
+    // organization recorded. Its weight wins for a model it has the outcome
+    // floor for; this machine's store decides below that. The same window is
+    // asked of both; the server answers up to 366 days.
+    const server = opts.local
+        ? { kind: 'none', reason: '--local' }
+        : !Number.isInteger(windowDays) || windowDays > 366
+            ? { kind: 'none', reason: `the server window is whole days up to 366 (asked for ${windowDays})` }
+            : await fetchServerModelStats({ rclVersion: RCL_VERSION, windowDays });
+    const merged = mergeWeights(stats, server.kind === 'ok' ? server.value : undefined);
+    if (opts.json) {
+        console.log(JSON.stringify({
+            windowDays,
+            dataDir: resolveDataDir(),
+            models: stats,
+            server: server.kind === 'ok' ? { host: server.host, ...server.value } : null,
+            serverNote: server.kind === 'ok' ? null : server.reason,
+            weights: merged.map(({ model, weight, source, serverOutcomes, localOutcomes }) => ({
+                model,
+                weight,
+                source,
+                ...(serverOutcomes !== undefined ? { serverOutcomes } : {}),
+                ...(localOutcomes !== undefined ? { localOutcomes } : {}),
+            })),
+        }, null, 2));
+        return;
+    }
+    if (merged.length === 0) {
+        console.log(`No model history in ${resolveDataDir()} yet` +
+            (server.kind === 'ok' ? ` and none on ${server.host} for this window.` : ` (org-wide: ${server.reason}).`) +
+            ' Converge runs record it automatically; seed from recovered artifacts with `rcl models seed --from <dir>`,' +
+            ' or backfill the organization with `rcl telemetry backfill --from <dir> --repo <owner/repo>`.');
+        return;
+    }
+    console.log('\n' + chalk.bold(`Model history — trailing ${windowDays} days`) + '\n');
+    console.log(chalk.dim(server.kind === 'ok'
+        ? `Org-wide from ${server.host}: ${server.value.models.length} model(s), window ${server.value.window_days} days, computed ${server.value.computed_at}.`
+        : `Org-wide window not used (${server.reason}); weights are this machine’s.`));
+    const pct = (v) => (v === undefined || v === null ? '—' : `${(v * 100).toFixed(0)}%`);
+    console.log(chalk.dim('model'.padEnd(46) +
+        'precision (n)'.padEnd(16) +
+        'calls'.padEnd(8) +
+        'dead'.padEnd(7) +
+        'p50'.padEnd(8) +
+        'weight'.padEnd(8) +
+        'source'));
+    for (const row of merged) {
+        // Every column of a row comes from one record: the server's when the
+        // server weighs it, else this machine's, else the server's thin row.
+        const fromServer = row.source === 'server' || (row.local === undefined && row.server !== undefined);
+        const outcomes = fromServer ? (row.server?.outcomes ?? 0) : (row.local?.outcomes ?? 0);
+        const precision = fromServer ? pct(row.server?.precision) : pct(row.local?.precision);
+        const calls = fromServer ? (row.server?.calls ?? 0) : (row.local?.calls ?? 0);
+        const dead = fromServer ? pct(row.server?.dead_rate) : pct(row.local?.deadRate);
+        const p50 = fromServer ? (row.server?.p50_ms ?? null) : (row.local?.p50Ms ?? null);
+        console.log(text(row.model, 46).padEnd(46) +
+            `${outcomes > 0 ? precision : '—'} (${outcomes})`.padEnd(16) +
+            String(calls).padEnd(8) +
+            dead.padEnd(7) +
+            (typeof p50 === 'number' ? `${(p50 / 1000).toFixed(0)}s` : '—').padEnd(8) +
+            row.weight.toFixed(2).padEnd(8) +
+            row.source);
+    }
+    console.log(chalk.dim(`\nWeights (0.5 + precision, clamped to [0.5, 1.5]; neutral 1 under ${MIN_OUTCOMES_FOR_WEIGHT} outcomes) ` +
+        'scale each model’s consensus vote in reviews and gating. Source: server = the organization’s window on Harness, ' +
+        'local = this machine’s store, neutral = neither holds enough.\n'));
+});
+modelsCmd
+    .command('seed')
+    .description('Backfill the model-stats store from a directory of rcl reports and converge ledgers')
+    .requiredOption('--from <dir>', 'Directory holding rcl-report-*.json and rcl-converge-*-ledger.md files')
+    .option('--json', 'Output JSON')
+    .action(async (opts) => {
+    try {
+        const { calls, outcomes, ...summary } = await buildSeedRecords(opts.from);
+        await appendCalls(calls);
+        await appendOutcomes(outcomes);
+        if (opts.json) {
+            console.log(JSON.stringify({ ...summary, dataDir: resolveDataDir() }, null, 2));
+        }
+        else {
+            console.log(`Seeded ${summary.callsSeeded} call record(s) from ${summary.reportsScanned} report(s) and ` +
+                `${summary.outcomesSeeded} outcome record(s) from ${summary.ledgersScanned} ledger(s) ` +
+                `(${summary.unmatchedBullets}/${summary.bullets} ledger bullets could not be matched) → ${resolveDataDir()}`);
+        }
+    }
+    catch (err) {
+        console.error(chalk.red(`Seed failed: ${err instanceof Error ? err.message : String(err)}`));
+        process.exitCode = 1;
+    }
+});
+// roles subcommand
+const rolesCmd = program.command('roles').description('Manage and inspect roles');
+rolesCmd
+    .command('list')
+    .description('List all built-in roles')
+    .action(() => {
+    console.log('\n' + chalk.bold('Built-in Roles:') + '\n');
+    for (const role of BUILTIN_ROLES) {
+        const tag = role.isSpecialized ? chalk.dim('[specialized]') : chalk.blue('[general]');
+        console.log(`  ${chalk.cyan(role.name.padEnd(22))} ${tag}  ${chalk.dim(role.description)}`);
+    }
+    console.log('');
+});
+rolesCmd
+    .command('show <name>')
+    .description('Show details for a specific role')
+    .action((name) => {
+    const role = getRoleByName(name);
+    if (!role) {
+        console.error(chalk.red(`Role "${name}" not found.`));
+        console.log('Run `rcl roles list` to see available roles.');
+        process.exit(1);
+    }
+    console.log('\n' + chalk.bold(`Role: ${role.name}`) + '\n');
+    console.log(chalk.dim('Description:'), role.description);
+    console.log(chalk.dim('Type:'), role.isSpecialized ? 'specialized' : 'general');
+    console.log(chalk.dim('Focus:'), role.focus.join(', '));
+    if (role.severityBias) {
+        console.log(chalk.dim('Severity bias:'), JSON.stringify(role.severityBias));
+    }
+    console.log('\n' + chalk.dim('System Prompt:'));
+    console.log(role.systemPrompt);
+    console.log('');
+});
+/**
+ * Shared front half of every council command: config, role resolution,
+ * assignments. `fallbackRoles` is used only when neither CLI flags nor
+ * config request roles (plan review defaults to a plan-suited subset).
+ */
+/**
+ * Harness key distribution runs BEFORE loadConfig: the loader's default-fleet
+ * degradation (dropping openrouter models without OPENROUTER_API_KEY) must
+ * see any injected keys.
+ */
+async function fetchHarnessKeys(spinner, credential) {
+    const { note } = await applyHarnessModelKeys(credential ? { credential } : {});
+    if (note) {
+        spinner.info(note);
+        spinner.start('Loading configuration...');
+    }
+}
+async function prepareCouncil(spinner, opts, fallbackRoles, attestation) {
+    const startedAt = new Date();
+    // Validate the converge context first: a bad --round must fail before any
+    // model time is spent, not after the council has run.
+    const converge = resolveConvergeContext({ convergeTarget: opts.convergeTarget, round: opts.round, attempt: opts.attempt }, reviewConvergeEnvironment(opts));
+    if (!opts.exportPendingPackage)
+        await fetchHarnessKeys(spinner, attestation?.credential);
+    const config = await loadConfig(opts.config, undefined, { preserveDefaultRoster: opts.guardedConverge });
+    // Validate mutually exclusive role options
+    const roleOptionCount = [opts.role, opts.roles, opts.reviewer?.length].filter(Boolean).length;
+    if (roleOptionCount > 1) {
+        spinner.fail('--role, --roles, and --reviewer are mutually exclusive');
+        process.exit(1);
+    }
+    // Override models from CLI
+    if (opts.models) {
+        config.models = opts.models.split(',').map((s) => s.trim()).filter(Boolean);
+        // Clear secondary and async models unless explicitly provided — don't
+        // leak code to default providers the user overrode away from.
+        if (opts.secondaryModels === undefined) {
+            config.secondaryModels = [];
+        }
+        if (opts.asyncModels === undefined) {
+            config.asyncModels = [];
+        }
+    }
+    if (opts.secondaryModels !== undefined) {
+        config.secondaryModels = opts.secondaryModels.split(',').map((s) => s.trim()).filter(Boolean);
+    }
+    if (opts.asyncModels !== undefined) {
+        config.asyncModels = opts.asyncModels.split(',').map((s) => s.trim()).filter(Boolean);
+    }
+    // Determine roles to use
+    let requestedRoles;
+    let explicitReviewers;
+    if (opts.role) {
+        requestedRoles = [opts.role];
+    }
+    else if (opts.roles) {
+        requestedRoles = opts.roles.split(',').map((s) => s.trim());
+    }
+    else if (opts.reviewer && opts.reviewer.length > 0) {
+        explicitReviewers = opts.reviewer.map((pair) => {
+            const colonIdx = pair.indexOf(':');
+            if (colonIdx < 0) {
+                throw new InvalidArgumentError(`Invalid reviewer pair "${pair}". Use model:role format.`);
+            }
+            return {
+                model: pair.slice(0, colonIdx),
+                role: pair.slice(colonIdx + 1),
+            };
+        });
+    }
+    else if (fallbackRoles && !config.roles?.length) {
+        requestedRoles = fallbackRoles;
+    }
+    // Load spec file
+    let specContent;
+    let spec;
+    const specPath = opts.spec ?? config.spec;
+    // Validated before any file is read so a typo fails fast, spec or not.
+    const specSource = opts.specSource !== undefined
+        ? parseSpecSource(opts.specSource)
+        : specPath
+            ? opts.spec
+                ? 'flag'
+                : 'repo_file'
+            : undefined;
+    if (specPath) {
+        try {
+            specContent = await readFile(specPath, 'utf-8');
+            spec = { source: specSource ?? 'flag', sha256: sha256Hex(specContent) };
+        }
+        catch {
+            if (opts.guardedConverge)
+                throw new ReviewLaunchRefused('unreadable_spec', `Could not read required spec: ${specPath}`);
+            spinner.warn(`Could not read spec file: ${specPath}`);
+        }
+    }
+    // Provenance was claimed explicitly: refuse to run with nothing to attach
+    // it to, rather than dropping the claim from the header without a word.
+    if (opts.specSource !== undefined && spec === undefined) {
+        throw new Error(specPath
+            ? `--spec-source was given but the spec file could not be read: ${specPath}`
+            : '--spec-source was given without a spec; pass --spec <path> (or set spec in the config).');
+    }
+    // A resolved spec makes the spec-compliance role useful for plan review
+    // too — the plan gets checked against the higher-level spec.
+    if (requestedRoles === fallbackRoles && requestedRoles && specContent) {
+        requestedRoles = [...requestedRoles, 'spec-compliance'];
+    }
+    // Repository rules remain shared review context without a dedicated seat.
+    const projectRulesFile = await findProjectRulesFile();
+    let historicalPlan;
+    let pendingClaimRoles;
+    if (opts.retryReport) {
+        let source;
+        try {
+            source = originalRunReportSchema.parse(decodeOriginalReport(await readFile(opts.retryReport, 'utf8')).value);
+        }
+        catch {
+            throw new ReviewLaunchRefused('retry_report_plan_invalid', 'The retry report cannot reconstruct a supported historical execution plan.');
+        }
+        const projectRulesContent = projectRulesFile
+            ? await readFile(projectRulesFile, 'utf8').catch(() => undefined)
+            : undefined;
+        if ((source.run.spec?.sha256 ?? undefined) !== (spec?.sha256 ?? undefined)) {
+            throw new ReviewLaunchRefused('retry_report_plan_invalid', 'The retry report is bound to different specification content.');
+        }
+        historicalPlan = historicalExecutionPlan(source.run, config, projectRulesContent, specContent);
+        if (opts.resumePending && historicalPlan) {
+            pendingClaimRoles = legacyPendingClaimRoles(config, specContent);
+            if (!pendingClaimRoles) {
+                throw new ReviewLaunchRefused('retry_report_plan_invalid', 'The pending claim cannot reconstruct its original 4.4.9 dispatch plan.');
+            }
+        }
+    }
+    // Resolve roles
+    const roles = historicalPlan?.roles ?? await resolveRoles(config, requestedRoles, specContent);
+    if (roles.length === 0) {
+        spinner.fail('No roles resolved. Check your --role/--roles flags.');
+        process.exit(1);
+    }
+    // Build role map for voter
+    const roleMap = new Map();
+    for (const role of roles) {
+        roleMap.set(role.name, role);
+    }
+    const models = config.models ?? [...DEFAULT_MODELS];
+    const secondaryModels = config.secondaryModels ?? [];
+    const built = buildAssignments({
+        models,
+        roles,
+        secondaryModels,
+        explicitReviewers,
+        roleMap,
+        deterministic: opts.guardedConverge,
+    });
+    if (opts.guardedConverge && explicitReviewers && built.length !== explicitReviewers.length) {
+        throw new ReviewLaunchRefused('invalid_reviewers', 'Guarded review refuses unknown reviewer roles rather than removing them.');
+    }
+    // Async lane (RCL-25): async models run the general role(s) only.
+    // Membership in `models` wins over `asyncModels` — an explicit blocking
+    // seat is an explicit choice, so the model stays blocking and gets no
+    // duplicate async seat. Async models appearing only in `secondaryModels`
+    // are partitioned OUT of the blocking path below. Explicit --reviewer
+    // pairs mean exact manual control: every pair runs as given — even a
+    // model that is usually async — and no bonus seats are added, so the
+    // async roster must not partition pairs away.
+    const asyncModels = explicitReviewers
+        ? []
+        : (config.asyncModels ?? []).filter((m) => !models.includes(m));
+    const { blocking: assignments } = partitionAsyncAssignments(built, asyncModels);
+    const generalRoles = roles.filter((r) => !r.isSpecialized);
+    const asyncAssignments = explicitReviewers || asyncModels.length === 0 || generalRoles.length === 0
+        ? []
+        : buildAssignments({ models: asyncModels, roles: generalRoles, roleMap, deterministic: opts.guardedConverge });
+    let pendingClaimPlan;
+    if (pendingClaimRoles) {
+        const pendingRoleMap = new Map(pendingClaimRoles.map(role => [role.name, role]));
+        const pendingBuilt = buildAssignments({ models, roles: pendingClaimRoles, secondaryModels,
+            roleMap: pendingRoleMap, deterministic: true });
+        const { blocking: pendingAssignments } = partitionAsyncAssignments(pendingBuilt, asyncModels);
+        const pendingGeneral = pendingClaimRoles.filter(role => !role.isSpecialized);
+        const pendingAsyncAssignments = asyncModels.length === 0 || pendingGeneral.length === 0 ? []
+            : buildAssignments({ models: asyncModels, roles: pendingGeneral, roleMap: pendingRoleMap, deterministic: true });
+        pendingClaimPlan = {
+            assignments: pendingAssignments,
+            asyncAssignments: pendingAsyncAssignments,
+            gatingConfig: resolveGatingConfig(config.gating, [...models, ...secondaryModels, ...(config.asyncModels ?? [])]),
+            contextFiles: [...(opts.context ?? []), ...(config.context ?? []), ...(projectRulesFile ? [projectRulesFile] : [])],
+        };
+    }
+    assertUnambiguousReviewerIdentities([...assignments, ...asyncAssignments].map(({ model, role }) => ({ model, role: role.name })));
+    const contextFiles = [...(opts.context ?? []), ...(config.context ?? [])];
+    if (projectRulesFile && !historicalPlan?.embedsProjectRules && !contextFiles.some(path => resolve(path) === projectRulesFile)) {
+        contextFiles.push(projectRulesFile);
+    }
+    // Resolve gating now: a config error (e.g. an aggregator-routed verifier)
+    // must fail before any model time is spent, and the verifier is chosen
+    // under roster containment — never a provider outside the configured fleet.
+    const gatingConfig = historicalPlan?.gating ?? resolveGatingConfig(config.gating, [
+        ...models,
+        ...secondaryModels,
+        ...(config.asyncModels ?? []),
+    ]);
+    return {
+        config,
+        roleMap,
+        assignments,
+        asyncAssignments,
+        gatingConfig,
+        contextFiles,
+        ...(spec ? { spec, specContent } : {}),
+        ...(historicalPlan ? { historicalRetryPlan: true } : {}),
+        ...(pendingClaimPlan ? { pendingClaimPlan } : {}),
+        explicit: explicitReviewers !== undefined,
+        coreModels: models,
+        ...(converge ? { converge } : {}),
+        startedAt,
+    };
+}
+function reviewConvergeEnvironment(opts) {
+    return opts.startOver || opts.cycleReview
+        ? { ...process.env, RCL_CONVERGE_ROUND: undefined, RCL_CONVERGE_ATTEMPT: undefined }
+        : process.env;
+}
+async function discoverCycleReview(target, opts) {
+    const prRef = target && isGitHubTarget(target) ? target : opts.forPr ?? process.env['RCL_FOR_PR'];
+    if (opts.startOver && (!prRef || opts.staged || opts.workingTree))
+        throw new Error('--start-over needs a PR or a captured patch with --for-pr and --head-sha');
+    if (!prRef)
+        return opts;
+    const pr = parseGitHubTarget(prRef);
+    const targetKey = opts.convergeTarget?.trim() || process.env['RCL_CONVERGE_TARGET']?.trim() || `${pr.repo.toLowerCase()}-${pr.number}`;
+    let common;
+    try {
+        common = await resolveGitCommonDir();
+    }
+    catch (error) {
+        if (opts.startOver)
+            throw error;
+        return opts;
+    }
+    if (!opts.startOver)
+        await assertNoPendingFreshReview(common, targetKey);
+    const active = opts.startOver ? undefined : await loadConvergeRunState(common, targetKey);
+    if (!opts.startOver && !active?.cycle)
+        return opts;
+    if (opts.attempt !== undefined || (opts.startOver && opts.round !== undefined) || opts.attest)
+        throw new Error('A fresh review assigns its own ordinals and needs an ordinary actor credential');
+    if (opts.telemetry === false)
+        throw new Error('Fresh review cycles require Harness evidence');
+    const paths = opts.jsonFile ? {} : await freshReviewOutputPaths(common);
+    return { ...opts, ...paths, ...(opts.markdown ? { markdown: opts.markdown } : {}),
+        convergeTarget: targetKey, guardedConverge: true, cycleReview: true, evidenceRequired: true };
+}
+async function runReview(target, opts) {
+    const spinner = ora('Loading configuration...').start();
+    try {
+        if (opts.exportPendingPackage !== undefined && (!opts.exportPendingPackage.trim() || !opts.guardedConverge ||
+            !opts.expectBaseSha || opts.startOver || opts.boundFixRecovery || opts.attest || opts.resumePending ||
+            opts.finalizePendingOnly || opts.ordinaryPendingPackage || opts.retryReport || opts.retryReason ||
+            opts.resumeAsyncSha256 || opts.pendingNativeSha256 || opts.pendingAttemptSha256 || opts.launchIntent ||
+            opts.maxAttempts !== undefined || opts.maxRounds !== undefined || opts.attempt !== undefined ||
+            opts.post || opts.json || opts.jsonFile !== undefined || opts.markdown !== undefined || opts.ci ||
+            opts.evidenceRequired || opts.staged || opts.workingTree || !target)) {
+            throw new ReviewLaunchRefused('pending_export_incompatible', '--export-pending-package requires an ordinary guarded PR or patch target, original preparation flags and --expect-base-sha; do not combine it with launch, recovery, output or evidence flags.');
+        }
+        if (opts.expectBaseSha !== undefined && !opts.exportPendingPackage) {
+            throw new ReviewLaunchRefused('pending_export_incompatible', '--expect-base-sha requires --export-pending-package.');
+        }
+        if (opts.expectBaseSha)
+            validateSha(opts.expectBaseSha, '--expect-base-sha');
+        if (opts.boundFixRecovery !== undefined) {
+            if (!opts.guardedConverge || !opts.evidenceRequired || opts.telemetry === false ||
+                opts.startOver || opts.attest || opts.retryReport !== undefined || opts.retryReason !== undefined ||
+                (opts.launchIntent !== undefined && opts.launchIntent !== 'review') ||
+                opts.staged || opts.workingTree || !(opts.forPr || (target && isGitHubTarget(target)))) {
+                throw new ReviewLaunchRefused('bound_fix_recovery_incompatible', '--bound-fix-recovery requires --guarded-converge, --evidence-required and a PR target or explicit --for-pr; do not combine it with start-over, attestation or another retry mode.');
+            }
+            if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(opts.boundFixRecovery)) {
+                throw new ReviewLaunchRefused('bound_fix_recovery_invalid', '--bound-fix-recovery must name an exact native run UUID.');
+            }
+        }
+        if (opts.resumePending && (!opts.guardedConverge || opts.finalizePendingOnly || (!opts.retryReport && !opts.ordinaryPendingPackage) ||
+            (opts.retryReport && opts.ordinaryPendingPackage) || !opts.retryReason ||
+            !opts.resumeAsyncSha256 || !opts.evidenceRequired || opts.telemetry === false ||
+            opts.maxAttempts === undefined || opts.startOver || opts.boundFixRecovery || opts.attest)) {
+            throw new ReviewLaunchRefused('pending_resume_incompatible', '--resume-pending requires guarded convergence, evidence delivery, exactly one legacy retry report or ordinary package, retained retry reason, an explicit attempt cap and retained async result digests.');
+        }
+        const finalizeOnlyIgnoredReviewFlags = opts.retryReason !== undefined || opts.maxRounds !== undefined ||
+            opts.round !== undefined || opts.attempt !== undefined || opts.post || opts.json ||
+            opts.jsonFile !== undefined || opts.markdown !== undefined || opts.ci || opts.evidenceRequired ||
+            opts.forPr !== undefined || opts.role !== undefined || opts.roles !== undefined ||
+            opts.models !== undefined || opts.secondaryModels !== undefined || opts.asyncModels !== undefined ||
+            (opts.reviewer?.length ?? 0) > 0 || (opts.context?.length ?? 0) > 0 ||
+            opts.spec !== undefined || opts.focus !== undefined;
+        const finalizeOnlySourceFlags = opts.staged || opts.workingTree || opts.specSource !== undefined;
+        if (opts.finalizePendingOnly && (!opts.guardedConverge || opts.resumePending || !opts.ordinaryPendingPackage ||
+            opts.retryReport !== undefined || !opts.resumeAsyncSha256 || opts.maxAttempts === undefined ||
+            (!opts.previewPending && (!opts.pendingNativeSha256 || !opts.pendingAttemptSha256)) ||
+            (opts.previewPending && (opts.pendingNativeSha256 !== undefined || opts.pendingAttemptSha256 !== undefined)) ||
+            opts.startOver || opts.boundFixRecovery || opts.attest || opts.launchIntent !== undefined ||
+            finalizeOnlyIgnoredReviewFlags || finalizeOnlySourceFlags)) {
+            throw new ReviewLaunchRefused('pending_finalize_incompatible', '--finalize-pending-only accepts only guarded target/head/base/config bindings, one ordinary pending package, an explicit unchanged attempt cap, retained async result digests and, for apply, both exact state digests from preview; do not combine it with review, output, evidence or retry flags.');
+        }
+        if (!opts.finalizePendingOnly &&
+            (opts.pendingNativeSha256 !== undefined || opts.pendingAttemptSha256 !== undefined)) {
+            throw new ReviewLaunchRefused('pending_finalize_incompatible', 'Pending native and attempt state digests apply only to --finalize-pending-only.');
+        }
+        if (!opts.resumePending && !opts.finalizePendingOnly &&
+            (opts.resumeAsyncSha256 !== undefined || opts.ordinaryPendingPackage !== undefined)) {
+            throw new ReviewLaunchRefused('pending_resume_incompatible', '--resume-async-sha256 and --ordinary-pending-package require --resume-pending or --finalize-pending-only.');
+        }
+        if (opts.previewPending && !opts.exportPendingPackage && ((!opts.resumePending && !opts.finalizePendingOnly) ||
+            !opts.ordinaryPendingPackage || opts.retryReport)) {
+            throw new ReviewLaunchRefused('pending_preview_incompatible', '--preview-pending requires one pending recovery mode and --ordinary-pending-package, without --retry-report.');
+        }
+        if (!opts.exportPendingPackage)
+            opts = { ...opts, ...await discoverCycleReview(target, opts) };
+        // Finalize-only is a recovery-state operation even though it is exposed by
+        // `review`; preview and apply must not flush unrelated review evidence.
+        if (!opts.exportPendingPackage && !opts.finalizePendingOnly && !opts.cycleReview && opts.telemetry !== false &&
+            (process.env['RCL_TELEMETRY'] ?? '').trim().toLowerCase() !== 'off') {
+            try {
+                if ((await readdir(join(resolveDataDir(), 'outbox')).catch(() => [])).length > 0) {
+                    await flushOutboxAtStart(await createTelemetryRuntime({ rclVersion: RCL_VERSION }));
+                }
+            }
+            catch { /* Startup delivery remains best-effort for legacy reviews. */ }
+        }
+        if (!opts.guardedConverge && (opts.launchIntent !== undefined || opts.retryReason !== undefined || opts.retryReport !== undefined ||
+            opts.maxAttempts !== undefined || opts.maxRounds !== undefined)) {
+            throw new ReviewLaunchRefused('guard_required', 'Launch intent, retry reason and launch caps require --guarded-converge.');
+        }
+        if (opts.guardedConverge) {
+            const converge = resolveConvergeContext(opts, reviewConvergeEnvironment(opts));
+            if (!converge)
+                throw new ReviewLaunchRefused('target_required', 'A guarded launch requires --converge-target.');
+            if (converge.attempt !== undefined || opts.attest) {
+                throw new ReviewLaunchRefused('incompatible_launch', 'Guarded review claims its own attempt; do not preclaim, pass --attempt, or combine it with --attest.');
+            }
+        }
+        // Exactly one review source: a positional target, --staged, or --working-tree
+        const sourceCount = [target, opts.staged, opts.workingTree].filter(Boolean).length;
+        if (sourceCount === 0) {
+            spinner.fail('Missing review target. Provide owner/repo#N, a patch file, --staged, or --working-tree.');
+            process.exit(1);
+        }
+        if (sourceCount > 1) {
+            spinner.fail('A positional target, --staged, and --working-tree are mutually exclusive');
+            process.exit(1);
+        }
+        const gitMode = opts.staged ? 'staged' : opts.workingTree ? 'working-tree' : undefined;
+        // Classify the positional target ONCE by shape: a GitHub PR reference is
+        // a PR, anything else is a local patch file (whatever its extension or
+        // path form). Both the flag gate below and the diff resolution use this
+        // single decision, so they cannot diverge.
+        const patchTarget = !gitMode && target !== undefined && !isGitHubTarget(target);
+        // Validate the head-binding flags BEFORE any config, key, network, or
+        // git work: a bad flag must fail before anything is spent or fetched.
+        if ((opts.headSha !== undefined || opts.baseSha !== undefined) && !patchTarget) {
+            throw new Error(`--head-sha and --base-sha apply to patch files only; ${gitMode ? `--${gitMode} resolves HEAD itself` : 'a PR target resolves its heads from GitHub'}.`);
+        }
+        if (opts.headSha !== undefined)
+            validateSha(opts.headSha, '--head-sha');
+        if (opts.baseSha !== undefined)
+            validateSha(opts.baseSha, '--base-sha');
+        if (opts.expectHeadSha !== undefined)
+            validateSha(opts.expectHeadSha, '--expect-head-sha');
+        if (opts.evidenceRequired && patchTarget && opts.headSha === undefined) {
+            throw new Error('--evidence-required needs --head-sha for a patch file: evidence must bind to the commit it reviewed.');
+        }
+        // --attest (RCL-40) runs before any key, config or reviewer work; an
+        // attested review is recorded or it does not run, so evidence is required.
+        let attestation;
+        if (opts.attest) {
+            attestation = await attestBeforeReview(spinner, opts, target, gitMode);
+            opts = { ...opts, evidenceRequired: true };
+        }
+        assertEvidenceCanBeRequired(opts);
+        const prepared = await prepareCouncil(spinner, opts, undefined, attestation);
+        const { config } = prepared;
+        if (attestation) {
+            // The loaded config is the authority; the pre-exchange check read the same file.
+            const level = resolveTelemetryLevel(config, { noTelemetry: opts.telemetry === false }, process.env);
+            if (level !== 'full')
+                throw new Error(attestLevelMessage(level));
+        }
+        assertEvidenceCanBeRequired(opts, config);
+        await assertEvidenceDeliverable(opts, config, attestation?.credential);
+        spinner.text = `Resolving diff for: ${target ?? `--${gitMode}`}`;
+        // Resolve diff. Git modes bracket the read with two HEAD resolutions: a
+        // commit landing between them would bind the diff to a commit it was
+        // not taken against, and --expect-head-sha would then vouch for it.
+        let diff;
+        let gitHeads;
+        if (gitMode) {
+            gitHeads = await resolveGitHeads();
+            diff = await loadGitDiff(gitMode);
+            // Both ends of the binding must hold still: HEAD (what the diff is
+            // relative to) and the merge-base (what the header records as base).
+            // Index or worktree edits during the read are not guarded — the
+            // diff_sha256 describes exactly the bytes that were read.
+            const after = await resolveGitHeads();
+            if (after.headSha !== gitHeads.headSha || after.baseSha !== gitHeads.baseSha) {
+                throw new Error(`HEAD or its merge-base moved (${gitHeads.headSha ?? 'unknown'}/${gitHeads.baseSha ?? 'unknown'} → ${after.headSha ?? 'unknown'}/${after.baseSha ?? 'unknown'}) while the diff was being read — refusing to review; rerun once the tree is quiet.`);
+            }
+        }
+        else if (patchTarget) {
+            try {
+                diff = await loadLocalDiff(target);
+            }
+            catch (err) {
+                // A mistyped PR reference lands here too; say what a target can be
+                // instead of a bare ENOENT.
+                if (err.code === 'ENOENT') {
+                    throw new Error(`No such patch file: ${target}. A review target is a local patch file, owner/repo#N, or a GitHub PR URL.`);
+                }
+                throw err;
+            }
+        }
+        else {
+            const prTarget = parseGitHubTarget(target);
+            diff = await fetchPRDiff(prTarget, config.githubToken);
+        }
+        // Resolve the head BEFORE the empty-diff exit so --expect-head-sha is
+        // honored even when there is nothing to review: a moved target must
+        // never read as a clean round.
+        const runTarget = await resolveReviewTarget(diff, gitMode, {
+            ...opts,
+            convergeTarget: opts.convergeTarget ?? process.env['RCL_CONVERGE_TARGET'],
+            // The flag is the user's word and is refused off a patch file; a value
+            // left in the environment only ever attributes a patch file.
+            ...(opts.forPr !== undefined
+                ? { forPr: opts.forPr }
+                : !diff.metadata && !gitMode && (process.env['RCL_FOR_PR'] ?? '').trim() !== ''
+                    ? { forPr: process.env['RCL_FOR_PR'] }
+                    : {}),
+        }, { gitHeads });
+        if (opts.expectHeadSha !== undefined) {
+            assertExpectedHead(runTarget, opts.expectHeadSha);
+        }
+        if (diff.files.length === 0 && opts.exportPendingPackage) {
+            throw new ReviewLaunchRefused('pending_export_input_mismatch', 'The pending launch cannot be authenticated with an empty diff.');
+        }
+        if (diff.files.length === 0) {
+            spinner.warn(gitMode === 'staged'
+                ? 'No staged changes to review.'
+                : gitMode === 'working-tree'
+                    ? 'No uncommitted changes to review.'
+                    : 'No files found in diff. Nothing to review.');
+            process.exit(0);
+        }
+        // PR and Git-mode labels identify the review target directly. Patch
+        // paths identify the capture; executeCouncil scopes converging patches
+        // by their native convergence target instead.
+        const asyncTargetLabel = diff.metadata
+            ? `${diff.metadata.owner}/${diff.metadata.repo}#${diff.metadata.number}`
+            : (target ?? `git-${gitMode}-${await currentBranchLabel()}`);
+        await executeCouncil(spinner, prepared, diff, opts, {
+            command: 'review',
+            target: runTarget,
+            asyncTargetLabel,
+            ...(attestation ? { attestation } : {}),
+        });
+    }
+    catch (err) {
+        spinner.fail(String(err));
+        if (process.env['RCL_DEBUG']) {
+            console.error(err);
+        }
+        process.exitCode = opts.guardedConverge && (err instanceof ConvergeAttemptBudgetExceededError || err instanceof ConvergeRoundCapError)
+            ? 2 : opts.guardedConverge && (err instanceof ConvergeAttemptStateError || err instanceof ConvergeRunStateError) ? 3 : 1;
+    }
+}
+/**
+ * Shared back half of every council command: chunking, prompt building,
+ * dispatch, consensus, and every output surface.
+ */
+async function prepareCouncilWork(spinner, prepared, diff, opts, focus) {
+    const { assignments, contextFiles } = prepared;
+    const chunks = chunkDiff(diff.files);
+    assertReviewWorkWithinLimit(chunks.length, assignments.length);
+    spinner.text = `Building prompts (${chunks.length} chunk(s), ${assignments.length} reviewer(s))...`;
+    const chunkAssignments = chunks.flatMap(chunk => assignments.map(assignment => ({ assignment, chunk })));
+    const { docs: contextDocs, skipped } = await loadPromptContextDocs(contextFiles);
+    if (opts.guardedConverge && skipped.length > 0) {
+        throw new ReviewLaunchRefused('unreadable_context', `Required context could not be read: ${skipped.join(', ')}`);
+    }
+    for (const path of skipped)
+        console.warn(`Context file not readable, not included in the review: ${path}`);
+    const prompts = await Promise.all(chunkAssignments.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, {
+        contextDocs,
+        plan: focus === undefined ? undefined : { focus },
+    })));
+    return { chunks, chunkAssignments, contextDocs, prompts };
+}
+async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork) {
+    const { config, roleMap, assignments, asyncAssignments } = prepared;
+    const planContext = extra.focus !== undefined ? { focus: extra.focus } : undefined;
+    const work = preparedWork ?? await prepareCouncilWork(spinner, prepared, diff, opts, extra.focus);
+    const { chunks, chunkAssignments, contextDocs, prompts } = work;
+    if (opts.guardedConverge) {
+        const roster = buildRoster({ assignments, asyncAssignments, coreModels: prepared.coreModels,
+            explicit: prepared.explicit, gating: prepared.gatingConfig });
+        const guardedInput = {
+            head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo, pr: extra.target.prNumber,
+            diff: diffDigest(diff.files), config: configDigest(config), roster, prompts,
+            asyncRoles: asyncAssignments.map(assignment => assignment.role), spec: prepared.spec,
+        };
+        const ordinaryAsyncDescriptors = chunks.flatMap(() => asyncAssignments.map(assignment => ({
+            model: assignment.model, role: assignment.role.name, provider: assignment.provider,
+        }))).slice(0, MAX_ASYNC_CALLS_PER_ROUND);
+        let completion;
+        const common = await resolveGitCommonDir();
+        if (opts.exportPendingPackage) {
+            const receipt = await exportOrdinaryPendingPackage({ gitCommonDir: common,
+                target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? '',
+                expectedBaseSha: opts.expectBaseSha, expectedRound: prepared.converge.round,
+                guardedInput, path: opts.exportPendingPackage,
+                preview: opts.previewPending === true, asyncStoreDir: await resolveExistingAsyncStoreDir(),
+                asyncTargetKey: asyncTargetKey(extra.asyncTargetLabel ?? prepared.converge.target, extra.target.kind === 'patch' ? prepared.converge.target : undefined),
+                asyncDescriptors: ordinaryAsyncDescriptors });
+            spinner.stop();
+            console.log(JSON.stringify(receipt));
+            return undefined;
+        }
+        const native = opts.startOver ? undefined : await loadConvergeRunState(common, prepared.converge.target);
+        let cycleRemote;
+        let boundFixRecovery;
+        if (opts.boundFixRecovery !== undefined) {
+            if (!extra.target.repo || !extra.target.prNumber) {
+                throw new ReviewLaunchRefused('bound_fix_recovery_requires_pr', 'Bound fix recovery requires evidence bound to a pull request.');
+            }
+            const opened = await openReadSink({ rclVersion: RCL_VERSION });
+            if (!opened.sink)
+                throw new ReviewLaunchRefused('bound_fix_recovery_unanswered', 'Cannot read live Harness recovery evidence without an authenticated evidence credential.');
+            boundFixRecovery = createBoundFixRecovery(opened.sink, extra.target.repo, extra.target.prNumber, opts.boundFixRecovery);
+        }
+        if (opts.startOver || native?.cycle) {
+            if (!extra.target.repo || !extra.target.prNumber)
+                throw new Error('fresh_review_requires_pr');
+            const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION, config, noTelemetry: opts.telemetry === false });
+            if (!runtime.sink || runtime.level !== 'full')
+                throw new Error('Fresh review cycles require full Harness evidence and an actor credential');
+            cycleRemote = createReviewCycleRemote(runtime.sink, extra.target.repo, extra.target.prNumber, extra.target.headSha ?? '');
+        }
+        if (opts.resumePending || opts.finalizePendingOnly) {
+            const expectedAsyncSha256 = opts.resumeAsyncSha256.split(',').map(value => value.trim());
+            if (expectedAsyncSha256.length === 0 || expectedAsyncSha256.some(value => !/^[a-f0-9]{64}$/.test(value)) ||
+                new Set(expectedAsyncSha256).size !== expectedAsyncSha256.length) {
+                throw new ReviewLaunchRefused('pending_async_binding_invalid', 'Retained async SHA-256 bindings must be unique lowercase 64-character digests.');
+            }
+            const migrationPackage = opts.ordinaryPendingPackage === undefined ? undefined : JSON.parse((await readStable(opts.ordinaryPendingPackage)).text);
+            const loadMigrationRetainedAsync = async () => {
+                if (!migrationPackage)
+                    throw new ReviewLaunchRefused('pending_async_missing', 'An ordinary package is required.');
+                const store = await resolveExistingAsyncStoreDir();
+                const wanted = new Map(migrationPackage.retainedAsync.map(item => [item.sha256, item]));
+                const found = new Map();
+                for (const name of await readdir(store)) {
+                    const path = join(store, name);
+                    const bytes = await readStable(path).catch(() => undefined);
+                    if (!bytes || !wanted.has(bytes.sha256))
+                        continue;
+                    let row;
+                    try {
+                        row = JSON.parse(bytes.text);
+                    }
+                    catch {
+                        throw new ReviewLaunchRefused('pending_async_corrupt', 'A package-bound retained async artifact is not valid JSON.');
+                    }
+                    const descriptor = wanted.get(bytes.sha256);
+                    if (row.model !== descriptor.model || row.role !== descriptor.role || row.provider !== descriptor.provider) {
+                        throw new ReviewLaunchRefused('pending_async_identity_mismatch', 'A package-bound retained async artifact has a different reviewer identity.');
+                    }
+                    if (found.has(bytes.sha256))
+                        throw new ReviewLaunchRefused('pending_async_duplicate', 'Multiple retained async artifacts match one authenticated digest.');
+                    found.set(bytes.sha256, { path, sha256: bytes.sha256, bytesBase64: bytes.raw.toString('base64') });
+                }
+                if (found.size !== wanted.size)
+                    throw new ReviewLaunchRefused('pending_async_missing', 'A package-bound retained async artifact is unavailable.');
+                return [...found.values()].sort((a, b) => a.sha256.localeCompare(b.sha256));
+            };
+            if (opts.previewPending && migrationPackage) {
+                const inputSha256 = guardedInputSha256(migrationPackage.guardedInput);
+                const preview = await previewOrdinaryPendingLaunch({ gitCommonDir: common,
+                    target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? '',
+                    pendingInputSha256: inputSha256, recoveryInputSha256: inputSha256,
+                    retryReason: opts.retryReason ?? 'Finalize-only authentication preview.',
+                    captured: {}, retainedAsyncSha256: expectedAsyncSha256,
+                    migrationPackage, maxAttempts: Number(opts.maxAttempts), maxPhysicalCalls: 1, maxAttemptsPerCell: 1,
+                    maxDurationMs: 1, validate: async () => { }, loadRetainedAsync: loadMigrationRetainedAsync,
+                    run: async () => { throw new Error('preview_must_not_run'); }, preview: true,
+                    previewMode: opts.finalizePendingOnly ? 'finalize-only' : 'combined' });
+                spinner.stop();
+                console.log(JSON.stringify({
+                    mode: opts.finalizePendingOnly ? 'finalize-only-preview' : 'preview', ...preview,
+                }));
+                return undefined;
+            }
+            if (opts.finalizePendingOnly && migrationPackage) {
+                const inputSha256 = guardedInputSha256(migrationPackage.guardedInput);
+                const result = await finalizeOrdinaryPendingLaunch({ gitCommonDir: common,
+                    target: prepared.converge.target, headSha: extra.target.headSha ?? '',
+                    baseSha: extra.target.baseSha ?? '', pendingInputSha256: inputSha256,
+                    nativeStateSha256: opts.pendingNativeSha256, attemptStateSha256: opts.pendingAttemptSha256,
+                    retainedAsyncSha256: expectedAsyncSha256, migrationPackage,
+                    maxAttempts: Number(opts.maxAttempts), loadRetainedAsync: loadMigrationRetainedAsync });
+                spinner.stop();
+                console.log(JSON.stringify({ mode: 'finalize-only', ...result }));
+                return undefined;
+            }
+            // An ordinary migration package authenticates the old launch itself. The
+            // current prepared plan is used only for its fresh successor; it must not
+            // be substituted for the interrupted launch's input.
+            const pendingClaimPlan = migrationPackage ? {
+                assignments, asyncAssignments, gatingConfig: prepared.gatingConfig,
+                contextFiles: prepared.contextFiles,
+            } : prepared.pendingClaimPlan;
+            if (!pendingClaimPlan) {
+                throw new ReviewLaunchRefused('pending_claim_plan_missing', 'The pending launch has no supported original planner reconstruction.');
+            }
+            const pendingClaimRoster = buildRoster({ assignments: pendingClaimPlan.assignments,
+                asyncAssignments: pendingClaimPlan.asyncAssignments, coreModels: prepared.coreModels,
+                explicit: false, gating: pendingClaimPlan.gatingConfig });
+            const pendingClaimChunks = chunks.flatMap(chunk => pendingClaimPlan.assignments.map(assignment => ({ assignment, chunk })));
+            const { docs: pendingClaimContext, skipped: pendingClaimSkipped } = await loadPromptContextDocs([...new Set(pendingClaimPlan.contextFiles)]);
+            if (pendingClaimSkipped.length > 0) {
+                throw new ReviewLaunchRefused('unreadable_context', `Pending claim context could not be read: ${pendingClaimSkipped.join(', ')}`);
+            }
+            const pendingClaimPrompts = await Promise.all(pendingClaimChunks.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, { contextDocs: pendingClaimContext, plan: planContext })));
+            const pendingClaimAsyncChunks = chunks.flatMap(chunk => pendingClaimPlan.asyncAssignments.map(assignment => ({ assignment, chunk })))
+                .slice(0, MAX_ASYNC_CALLS_PER_ROUND);
+            const pendingClaimAsyncPrompts = await Promise.all(pendingClaimAsyncChunks.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, { contextDocs: pendingClaimContext, plan: planContext })));
+            const claimedInputSha256 = migrationPackage
+                ? guardedInputSha256(migrationPackage.guardedInput)
+                : guardedInputSha256({
+                    head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo, pr: extra.target.prNumber,
+                    diff: diffDigest(diff.files), config: configDigest(config), roster: pendingClaimRoster,
+                    prompts: pendingClaimPrompts,
+                    asyncRoles: pendingClaimPlan.asyncAssignments.map(assignment => assignment.role), spec: prepared.spec,
+                });
+            if (process.env['RCL_DEBUG'])
+                process.stderr.write(`Pending claim input: ${claimedInputSha256}\n`);
+            const thresholds = {
+                minConsensusScore: config.thresholds?.minConsensusScore ?? DEFAULT_THRESHOLDS.minConsensusScore,
+                minConfidence: config.thresholds?.minConfidence ?? DEFAULT_THRESHOLDS.minConfidence,
+                dedupeLineWindow: config.thresholds?.dedupeLineWindow ?? DEFAULT_THRESHOLDS.dedupeLineWindow,
+                jaccardThreshold: config.thresholds?.jaccardThreshold ?? DEFAULT_THRESHOLDS.jaccardThreshold,
+            };
+            const aggregationInputs = captureAggregationInputs({ algorithm: AGGREGATION_ALGORITHM,
+                diffSha256: diffDigest(diff.files), roleMap, thresholds, gating: prepared.gatingConfig,
+                belowThresholdAppendix: config.output?.belowThresholdAppendix ?? true });
+            const captured = capturePreparedCouncil({ target: prepared.converge.target,
+                headSha: extra.target.headSha ?? '', mergeBaseSha: extra.target.baseSha ?? '', diff,
+                assignments,
+                lanes: assignments.map(item => assignmentLane(item.model, prepared.coreModels, prepared.explicit)),
+                chunks, prompts, config, specBytes: prepared.specContent ?? '', contextDocs,
+                compatibility: { parser: { name: 'findings-json', version: 1 }, aggregation: AGGREGATION_ALGORITHM },
+                aggregationInputs,
+                ...(pendingClaimAsyncChunks.length ? { async: {
+                        assignments: pendingClaimPlan.asyncAssignments, prompts: pendingClaimAsyncPrompts,
+                        timeoutMs: config.asyncTimeout ?? DEFAULT_ASYNC_TIMEOUT_MS,
+                        maxAttemptsPerCall: (config.maxRetries ?? DEFAULT_MAX_RETRIES) + 1,
+                        maxPhysicalCalls: pendingClaimAsyncChunks.length * ((config.maxRetries ?? DEFAULT_MAX_RETRIES) + 1),
+                    } } : {}), });
+            const asyncStoreDir = await resolveAsyncStoreDir();
+            const asyncKey = asyncTargetKey(extra.asyncTargetLabel ?? prepared.converge.target, extra.target.kind === 'patch' ? prepared.converge.target : undefined, prepared.converge.cycleId);
+            const recoveryInputSha256 = sha256Hex(stableStringify({
+                head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo,
+                pr: extra.target.prNumber, diff: diffDigest(diff.files), config: configDigest(config),
+                roster, prompts, asyncRoles: asyncAssignments.map(assignment => assignment.role), spec: prepared.spec,
+            }));
+            const pendingResumeOptions = { gitCommonDir: common,
+                target: prepared.converge.target, headSha: extra.target.headSha ?? '',
+                baseSha: extra.target.baseSha ?? '',
+                pendingInputSha256: claimedInputSha256, recoveryInputSha256,
+                retryReason: opts.retryReason,
+                ...(opts.retryReport ? { legacyRetry: { reportPath: opts.retryReport, config, roster,
+                        historicalPlan: prepared.historicalRetryPlan === true } } : {}),
+                ...(migrationPackage ? { migrationPackage } : {}), captured,
+                retainedAsyncSha256: expectedAsyncSha256,
+                maxAttempts: Number(opts.maxAttempts),
+                maxPhysicalCalls: captured.plan.cells.length * ((config.maxRetries ?? DEFAULT_MAX_RETRIES) + 1),
+                maxAttemptsPerCell: (config.maxRetries ?? DEFAULT_MAX_RETRIES) + 1,
+                maxDurationMs: Math.min(2_147_483_647, (config.timeout ?? DEFAULT_TIMEOUT_MS) * Math.max(1, Math.ceil(captured.plan.cells.length / (config.concurrency ?? DEFAULT_CONCURRENCY))) *
+                    ((config.maxRetries ?? DEFAULT_MAX_RETRIES) + 1) +
+                    prepared.gatingConfig.verificationTimeoutMs),
+                validate: async () => { validateLaunchProviders(roster.map(entry => entry.provider)); await validateLaunchOutputs(opts); },
+                loadRetainedAsync: migrationPackage ? loadMigrationRetainedAsync : async () => {
+                    const snapshot = await snapshotAsyncResults(asyncStoreDir, asyncKey, pendingClaimPlan.assignments.map(assignment => ({
+                        model: assignment.model, role: assignment.role.name,
+                    })), expectedAsyncSha256);
+                    if (snapshot.reviews.length !== pendingClaimAsyncChunks.length) {
+                        throw new ReviewLaunchRefused('pending_async_incomplete', `Expected ${pendingClaimAsyncChunks.length} retained async results, found ${snapshot.reviews.length}.`);
+                    }
+                    const identity = (value) => `${value.model}\u0000${value.role}\u0000${value.provider ?? ''}`;
+                    const expected = pendingClaimAsyncChunks.map(({ assignment }) => identity({
+                        model: assignment.model, role: assignment.role.name, provider: assignment.provider,
+                    })).sort();
+                    const actual = snapshot.reviews.map(review => identity(review)).sort();
+                    if (expected.some((value, index) => value !== actual[index])) {
+                        throw new ReviewLaunchRefused('pending_async_identity_mismatch', 'Retained async results do not match the interrupted launch plan.');
+                    }
+                    return snapshot.artifacts;
+                },
+                run: async (execution) => {
+                    const completion = await executeCouncil(spinner, { ...prepared, converge: execution.context }, diff, { ...opts, guardedConverge: false, exclusiveOutputs: true }, { ...extra, pendingResume: execution }, work);
+                    if (!completion)
+                        throw new Error('pending_resume_missing_completion');
+                    return completion;
+                }, };
+            if (opts.previewPending) {
+                const preview = await resumePendingLegacyLaunch({ ...pendingResumeOptions, preview: true });
+                spinner.stop();
+                console.log(JSON.stringify({ mode: 'preview', ...preview }));
+                return undefined;
+            }
+            const result = await resumePendingLegacyLaunch({ ...pendingResumeOptions, preview: false });
+            try {
+                if (!migrationPackage)
+                    await consumeBoundAsyncResults(asyncStoreDir, asyncKey, expectedAsyncSha256, { allowAlreadyConsumed: result.reusedCompletion });
+            }
+            catch (error) {
+                console.warn(`Retained async results could not be cleaned after terminal recovery: ${String(error)}`);
+            }
+            if (result.reusedCompletion) {
+                process.exitCode = result.completion.exitCode ??
+                    (result.completion.deliveryPending ? 4 : 0);
+            }
+            return result.completion;
+        }
+        const claim = await guardReviewLaunch({
+            gitCommonDir: await resolveGitCommonDir(),
+            target: prepared.converge.target,
+            startOver: opts.startOver, cycleRemote,
+            boundFixRecovery,
+            headSha: extra.target.headSha ?? '',
+            inputSha256: guardedInputSha256(guardedInput),
+            round: prepared.converge.round,
+            intent: opts.launchIntent,
+            retryReason: opts.retryReason,
+            ...(opts.retryReport ? { legacyRetry: { reportPath: opts.retryReport, config, roster,
+                    historicalPlan: prepared.historicalRetryPlan === true } } : {}),
+            maxAttempts: opts.maxAttempts === undefined ? undefined : Number(opts.maxAttempts),
+            maxRounds: opts.maxRounds === undefined ? undefined : Number(opts.maxRounds),
+            validate: async () => {
+                validateLaunchProviders(roster.map(entry => entry.provider));
+                if (assignments.length < 2) {
+                    throw new ReviewLaunchRefused('insufficient_reviewers', 'Convergence needs at least two reviewer assignments for a conclusive round.');
+                }
+                await validateLaunchOutputs(opts);
+            },
+            beforeClaim: async (context) => {
+                const retained = await retainOrdinaryLaunchInputs({ gitCommonDir: common, target: context.target,
+                    attempt: context.attempt, round: context.round, ...(context.cycleId ? { cycleId: context.cycleId } : {}),
+                    headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? null,
+                    guardedInput, asyncDescriptors: ordinaryAsyncDescriptors });
+                return { ordinaryInputs: { version: 1, packetSha256: retained.sha256,
+                        baseSha: retained.baseSha } };
+            },
+            onClaim: async (claim) => {
+                if (opts.telemetry !== false)
+                    await reportConvergeEvents([buildEvent({
+                            kind: 'attempt_claimed', convergeTarget: claim.target, attempt: claim.attempt,
+                            payload: { attempt: claim.attempt, cap: claim.cap, ...(claim.cycle ? { cycle_id: claim.cycle.id } : {}),
+                                ...(boundFixRecovery ? { bound_fix_recovery: { run_id: boundFixRecovery.runId,
+                                        repo: boundFixRecovery.repo, pr_number: boundFixRecovery.prNumber, head_sha: extra.target.headSha } } : {}) },
+                        })]);
+                if (claim.cycle)
+                    process.stderr.write(`Review cycle ${claim.cycle.id}. Prior local history: ${claim.cycle.history.attempts} attempts, ${claim.cycle.history.rounds} admitted rounds${claim.cycle.history.incomplete ? ' (known history only)' : ''}.\n`);
+                process.stderr.write(`Convergence attempt ${claim.attempt}/${claim.cap} claimed for ${claim.target}.\n`);
+                if (boundFixRecovery)
+                    process.stderr.write(`Bound fix recovery verified from run ${boundFixRecovery.runId}; attempt ${claim.attempt} retains the existing review history.\n`);
+            },
+            run: async (converge) => {
+                const guardedCompletion = await executeCouncil(spinner, { ...prepared, converge }, diff, { ...opts, guardedConverge: false, exclusiveOutputs: true }, extra, work);
+                if (!guardedCompletion)
+                    throw new Error('guarded_launch_missing_completion');
+                completion = guardedCompletion;
+                return guardedCompletion;
+            },
+        });
+        if (claim.warning)
+            process.stderr.write(`${claim.warning}\n`);
+        if (claim.resumedCompletion) {
+            process.stderr.write(`Fresh review already completed as run ${claim.resumedCompletion.runId}; no reviewers restarted.\n`);
+            if (claim.resumedCompletion.reportPath)
+                process.stderr.write(`Retained report: ${claim.resumedCompletion.reportPath}\n`);
+            process.exitCode = claim.resumedCompletion.exitCode ?? (claim.resumedCompletion.deliveryPending ? 4 : 0);
+        }
+        return claim.resumedCompletion ?? completion;
+    }
+    // Async lane (RCL-25): fire the async reviewers with the round, never
+    // await them; collect whatever arrived from earlier rounds after the
+    // blocking council returns. Best-effort by design — a broken lane must
+    // never fail or slow the blocking round.
+    const asyncTargetLabel = extra.asyncTargetLabel;
+    let asyncStoreDir;
+    let asyncKey;
+    let asyncLaunched = 0;
+    if (!extra.pendingResume &&
+        asyncTargetLabel !== undefined &&
+        (asyncAssignments.length > 0 || (config.asyncModels?.length ?? 0) > 0)) {
+        try {
+            asyncStoreDir = await resolveAsyncStoreDir();
+            asyncKey = asyncTargetKey(asyncTargetLabel, extra.target.kind === 'patch' ? prepared.converge?.target : undefined, prepared.converge?.cycleId);
+            let asyncChunkAssignments = chunks.flatMap((chunk) => asyncAssignments.map((assignment) => ({ assignment, chunk })));
+            if (asyncChunkAssignments.length > MAX_ASYNC_CALLS_PER_ROUND) {
+                console.warn(`Async lane: capping ${asyncChunkAssignments.length} async calls at ` +
+                    `${MAX_ASYNC_CALLS_PER_ROUND} (one detached process each); the rest are dropped.`);
+                asyncChunkAssignments = asyncChunkAssignments.slice(0, MAX_ASYNC_CALLS_PER_ROUND);
+            }
+            if (asyncChunkAssignments.length > 0) {
+                const asyncPrompts = await Promise.all(asyncChunkAssignments.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, {
+                    contextDocs,
+                    plan: planContext,
+                })));
+                const spools = await spoolAsyncCalls(asyncChunkAssignments.map(({ assignment }, i) => ({
+                    model: assignment.model,
+                    role: assignment.role.name,
+                    provider: assignment.provider,
+                    systemPrompt: asyncPrompts[i].systemPrompt,
+                    userPrompt: asyncPrompts[i].userPrompt,
+                })), {
+                    storeDir: asyncStoreDir,
+                    targetKey: asyncKey,
+                    timeoutMs: config.asyncTimeout ?? DEFAULT_ASYNC_TIMEOUT_MS,
+                    maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+                    reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,
+                });
+                launchAsyncWorkers(spools);
+                asyncLaunched = spools.length;
+            }
+        }
+        catch (err) {
+            console.warn(`Async reviewer lane unavailable: ${String(err)}`);
+            asyncStoreDir = undefined;
+        }
+    }
+    const startTime = Date.now();
+    const totalCalls = chunkAssignments.length;
+    const timeoutMs = config.timeout ?? DEFAULT_TIMEOUT_MS;
+    const concurrency = config.concurrency ?? DEFAULT_CONCURRENCY;
+    const providerConcurrency = resolveProviderConcurrency(config.providerConcurrency);
+    const runPlan = buildCouncilRunPlan({
+        totalCalls,
+        reviewers: assignments.length,
+        chunks: chunks.length,
+        concurrency,
+        timeoutMs,
+        providers: chunkAssignments.map(({ assignment }) => assignment.provider),
+        providerConcurrency,
+    });
+    const planText = formatCouncilRunPlan(runPlan);
+    const interactive = process.stderr.isTTY === true;
+    const postReviewStage = (stage) => {
+        const line = `Post-review stage: ${stage}`;
+        if (interactive && spinner.isSpinning) {
+            spinner.text = line;
+        }
+        else {
+            process.stderr.write(`${line}\n`);
+        }
+    };
+    if (interactive) {
+        spinner.text = planText;
+        spinner.start();
+    }
+    else {
+        spinner.stop();
+        process.stderr.write(`${planText}\n`);
+    }
+    const progress = new CouncilProgressReporter({
+        totalCalls,
+        interactive,
+        updateInteractive: (text) => {
+            spinner.text = text;
+        },
+        writeLine: (text) => {
+            process.stderr.write(`${text}\n`);
+        },
+    });
+    progress.start();
+    let chunkReviews;
+    let pendingProjection;
+    let pendingAsyncExecution;
+    try {
+        if (extra.pendingResume) {
+            if (!(await extra.pendingResume.journal.read()).finalized) {
+                await executeCapturedOriginal({ commonDir: await resolveGitCommonDir(),
+                    ownership: extra.pendingResume.ownership, journal: extra.pendingResume.journal,
+                    expectedPlan: extra.pendingResume.journal.getPlan(), launch: extra.pendingResume.launch,
+                    onPhysicalReviewComplete: review => { progress.complete(review); },
+                    onLateAuditError: error => {
+                        console.warn(`Late reviewer result could not be retained: ${scrubText(String(error), 300)}`);
+                    } });
+                await extra.pendingResume.journal.finalize(extra.pendingResume.ownership);
+            }
+            pendingAsyncExecution = await resolveFinalizedAsyncExecution({ commonDir: await resolveGitCommonDir(),
+                namespace: extra.pendingResume.launch.runId, plan: extra.pendingResume.journal.getPlan(),
+                ownership: extra.pendingResume.ownership });
+            const proof = await exportCheckpointProof(extra.pendingResume.journal);
+            pendingProjection = projectCheckpointReport({ sources: [],
+                successor: { runId: extra.pendingResume.launch.runId, proof },
+                policy: { version: 1, fraction: config.quorumFraction ?? DEFAULT_QUORUM_FRACTION } });
+            chunkReviews = pendingProjection.seatReviews.map(seat => structuredClone(seat.review));
+        }
+        else
+            chunkReviews = await runReviews(chunkAssignments.map((ca) => ca.assignment), prompts, {
+                // Fall back to the shared constants, never to inline literals:
+                // duplicated defaults drift (this read 120_000 after the default
+                // moved to 600_000).
+                timeoutMs,
+                maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+                concurrency,
+                // Keep the default version-owned rather than materializing it into
+                // legacy config digests. Explicit caps remain source-bound inputs.
+                providerConcurrency,
+                reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,
+                // Quorum closure (RCL-26, RCL-136): the round stops waiting once the
+                // configured fraction of blocking seats completed every chunk — the
+                // same seats and policy as the report's blocking health and the
+                // server's gate. Secondary seats never count toward that quorum.
+                quorum: {
+                    fraction: config.quorumFraction ?? DEFAULT_QUORUM_FRACTION,
+                    coreModels: config.models ?? DEFAULT_MODELS,
+                    blocking: chunkAssignments.map((ca) => assignmentLane(ca.assignment.model, prepared.coreModels, prepared.explicit) === 'blocking'),
+                },
+                onReviewComplete: (review) => progress.complete(review),
+            });
+    }
+    finally {
+        progress.stop();
+    }
+    postReviewStage('collecting and merging reviewer outputs');
+    const preserveRefusedReviews = async (error, asyncArtifacts = []) => {
+        try {
+            const path = await retainAssemblyRefusal(resolveDataDir(), {
+                run: { ...(extra.attestation ? { id: extra.attestation.runId } : {}), command: extra.command, target: extra.target,
+                    startedAt: prepared.startedAt.toISOString(), ...(prepared.converge ? { converge: prepared.converge } : {}) },
+                chunkReviews, asyncArtifacts,
+            });
+            process.stderr.write(`Assembly refused; observed reviewer results retained privately at ${path}\n`);
+        }
+        catch (retentionError) {
+            error.message += ` Observed reviewer results could not be retained: ${String(retentionError)}`;
+            throw error;
+        }
+    };
+    try {
+        assertUnambiguousReviewerIdentities(chunkReviews);
+    }
+    catch (error) {
+        if (error instanceof AmbiguousReviewerIdentityError)
+            await preserveRefusedReviews(error);
+        throw error;
+    }
+    // Collect async results from earlier rounds of this target (marked async).
+    // Report assembly collapses the completed calls to one (model, role) review.
+    let arrivedAsync = [];
+    if (extra.pendingResume) {
+        const bytes = (await extra.pendingResume.journal.readBindings())['supplemental-async'];
+        if (bytes === undefined)
+            throw new Error('pending_legacy_resume_async_binding_missing');
+        const supplemental = decodeSupplementalAsync(bytes);
+        arrivedAsync = supplemental.reviews.map(review => structuredClone(review));
+        asyncLaunched = supplemental.asyncLaunched;
+    }
+    else if (asyncStoreDir && asyncKey) {
+        try {
+            arrivedAsync = await collectAsyncResults(asyncStoreDir, asyncKey, { blockingReviews: chunkReviews, onIdentityRefused: preserveRefusedReviews });
+        }
+        catch (err) {
+            if (err instanceof AmbiguousReviewerIdentityError)
+                throw err;
+            console.warn(`Could not collect async reviewer results: ${String(err)}`);
+        }
+    }
+    // RCL-27: every call feeds the cross-run model history (fail-soft — the
+    // stats store must never break a review).
+    try {
+        const ts = new Date().toISOString();
+        await appendCalls([...chunkReviews, ...arrivedAsync].map((r) => ({
+            ts,
+            model: r.model,
+            role: r.role,
+            durationMs: r.durationMs,
+            status: r.status,
+            source: 'live',
+        })));
+    }
+    catch (err) {
+        // Stats are advisory; reviews must not fail over them — but a broken
+        // store should not be invisible either.
+        console.warn(`Model-stats store unavailable (call history not recorded): ${String(err)}`);
+    }
+    // Trailing-precision weights scale each model's consensus vote. An empty
+    // history means no weighting (and no weight noise in the report).
+    // Org-wide history from Harness outranks this machine's store for a model
+    // the org has enough outcomes for (RCL-38); the server is asked with a
+    // short bound and the local store stands in when it cannot answer.
+    // Telemetry off means nothing leaves the machine for weights either. The
+    // server side is bounded to three seconds; the settings file and the local
+    // store are read as local files.
+    // An attested review may outlast its credential: from here on — the
+    // weights read, then delivery — the credential is renewed for the same run
+    // id when little of it remains (RCL-40).
+    let attestation = extra.attestation;
+    if (attestation) {
+        const renewal = await renewAttestation(attestation, { rclVersion: RCL_VERSION });
+        attestation = renewal.attestation;
+        if (renewal.renewed) {
+            process.stderr.write(chalk.dim(`Attestation renewed for run ${attestation.runId} (expires ${attestation.expiresAt})`) + '\n');
+        }
+        else if (renewal.failure !== undefined) {
+            process.stderr.write(chalk.dim(`Attestation not renewed (${renewal.failure}); continuing with the credential in hand`) + '\n');
+        }
+    }
+    let modelWeights;
+    try {
+        if (extra.pendingResume)
+            throw new Error('pending resume uses its frozen unweighted aggregation');
+        const level = resolveTelemetryLevel(await loadHarnessSettings(process.cwd(), opts.config), { noTelemetry: opts.telemetry === false }, process.env);
+        const loaded = await loadMergedWeights({
+            rclVersion: RCL_VERSION,
+            timeoutMs: 3_000,
+            serverEnabled: level !== 'off',
+            ...(attestation ? { credential: attestation.credential } : {}),
+        });
+        if (loaded.size > 0)
+            modelWeights = loaded;
+    }
+    catch (err) {
+        // Weights are advisory; the review runs unweighted, but not silently.
+        if (!extra.pendingResume)
+            console.warn(`Model weights unavailable (consensus unweighted): ${scrubText(err instanceof Error ? err.message : String(err), 300)}`);
+        modelWeights = undefined;
+    }
+    const runInput = {
+        id: extra.pendingResume?.launch.runId ?? extra.attestation?.runId,
+        rclVersion: RCL_VERSION,
+        command: extra.command,
+        target: extra.target,
+        roster: buildRoster({
+            assignments,
+            asyncAssignments,
+            coreModels: prepared.coreModels,
+            explicit: prepared.explicit,
+            gating: prepared.gatingConfig,
+        }),
+        ...(prepared.spec ? { spec: prepared.spec } : {}),
+        contextFiles: contextDocs.map((d) => ({ path: d.label, sha256: d.sha256 })),
+        // Record the effective focus that shaped the plan prompts.
+        ...(extra.command === 'review-plan' ? { plan: { focus: extra.focus ?? 'comprehensive' } } : {}),
+        runner: detectRunner(process.env, hostname()),
+        startedAt: extra.pendingResume
+            ? new Date(extra.pendingResume.launch.startedAtMs)
+            : prepared.startedAt,
+        ...(prepared.converge ? { converge: { target: prepared.converge.target, round: prepared.converge.round, attempt: prepared.converge.attempt }, cycleId: prepared.converge.cycleId } : {}),
+    };
+    const assemblyDependencies = {
+        onStage: postReviewStage,
+        onVerificationStart: () => { spinner.text = 'Verifying single-model findings...'; },
+        onVerificationProgress: (event) => {
+            const line = `Verification ${event.completedBatches}/${event.totalBatches} batches ` +
+                `(${event.completedCandidates}/${event.totalCandidates} findings)`;
+            if (interactive) {
+                spinner.text = line;
+            }
+            else {
+                const stride = Math.max(1, Math.ceil(event.totalBatches / 20));
+                if (event.completedBatches === 0 ||
+                    event.completedBatches === event.totalBatches ||
+                    event.completedBatches % stride === 0) {
+                    process.stderr.write(`${line}\n`);
+                }
+            }
+        },
+    };
+    let result;
+    let pendingEvidence;
+    if (extra.pendingResume) {
+        const proof = await exportCheckpointProof(extra.pendingResume.journal);
+        const supplementalBytes = (await extra.pendingResume.journal.readBindings())['supplemental-async'];
+        if (supplementalBytes === undefined)
+            throw new Error('pending_legacy_resume_async_binding_missing');
+        const supplementalAsync = decodeSupplementalAsync(supplementalBytes);
+        const checkpointAssembly = {
+            projection: pendingProjection,
+            supplementalAsync,
+            ...(pendingAsyncExecution === undefined ? {} : { asyncExecution: pendingAsyncExecution }),
+            diff,
+            startTime: extra.pendingResume.launch.startedAtMs,
+            run: runInput,
+        };
+        const gated = await executeCheckpointGating({ assembly: checkpointAssembly,
+            commonDir: await resolveGitCommonDir(), ownership: extra.pendingResume.ownership,
+            journal: extra.pendingResume.journal, beforeLaunch: async () => { },
+            askFactory: model => {
+                const adapter = defaultAdapterFactory(detectProvider(model));
+                return (selected, system, user, request) => adapter.ask(selected, system, user, request);
+            },
+            onLateAuditError: error => {
+                console.warn(`Late verifier result could not be retained: ${scrubText(String(error), 300)}`);
+            },
+        });
+        result = (await assembleCheckpointReview(checkpointAssembly, {
+            ...assemblyDependencies, verificationProof: gated.verificationProof,
+        })).report;
+        result.run.reviewer_evidence = describeReviewerEvidence(proof, supplementalAsync);
+        pendingEvidence = { proof, assembly: checkpointAssembly, verificationProof: gated.verificationProof };
+    }
+    else
+        result = await assembleCompletedReview({
+            chunkReviews, arrivedAsync, asyncLaunched, startTime, roleMap, config, diff,
+            gatingConfig: prepared.gatingConfig, modelWeights, run: runInput,
+        }, assemblyDependencies);
+    const { run } = result;
+    // The same derivation converge-report and the server apply to this report.
+    // A report it cannot judge is recorded as inconclusive, never as healthy.
+    let blockingHealth;
+    let blockingHealthError;
+    try {
+        blockingHealth = deriveBlockingHealth({ roster: run.roster, reviews: result.reviews,
+            fraction: config.quorumFraction ?? DEFAULT_QUORUM_FRACTION });
+    }
+    catch (error) {
+        blockingHealthError = error instanceof Error ? error.message : String(error);
+    }
+    spinner.succeed('Review complete');
+    process.stderr.write(chalk.dim(`Reviewed ${describeRunTarget(run.target)} · run ${run.id}` +
+        (run.converge ? ` · converge ${run.converge.target} round ${run.converge.round ?? '?'}` : '')) + '\n');
+    // Status lines go to stderr: stdout may be a machine-read JSON stream
+    // (`--json | jq`), which a stray status line would corrupt.
+    if (asyncLaunched > 0) {
+        process.stderr.write(chalk.dim(extra.pendingResume
+            ? `Reused ${asyncLaunched} retained async reviewer call(s) from this same interrupted attempt.`
+            : `Fired ${asyncLaunched} async reviewer call(s) — results merge into the next round of this target.`) + '\n');
+    }
+    if (arrivedAsync.length > 0) {
+        process.stderr.write(chalk.dim(`Merged ${mergeChunkReviews(arrivedAsync).length} async reviewer result(s) from an earlier round.`) + '\n');
+    }
+    process.stderr.write(blockingHealth
+        ? (blockingHealth.conclusive ? chalk.dim : chalk.yellow)(describeBlockingHealth(blockingHealth)) + '\n'
+        : chalk.yellow(`Blocking reviewer health could not be derived (${blockingHealthError}); the report will not be admitted.`) + '\n');
+    // Evidence delivery (IO-12475 section 8) is fail-soft: nothing in it may
+    // turn a finished review into a failure unless --evidence-required asks.
+    let runtime;
+    let runtimeError;
+    try {
+        runtime = await createTelemetryRuntime({
+            rclVersion: RCL_VERSION,
+            config,
+            noTelemetry: opts.telemetry === false,
+            ...(attestation ? { credential: attestation.credential, attestedExpiresAt: attestation.expiresAt } : {}),
+        });
+    }
+    catch (err) {
+        // Kept for the --evidence-required verdict below, which names the cause.
+        runtimeError = scrubText(String(err), 200);
+        process.stderr.write(chalk.dim(`Evidence delivery unavailable: ${runtimeError}`) + '\n');
+    }
+    // The report as it may leave the machine — free text scrubbed, a parse
+    // failure reduced to the parser message unless harness.parseFailures opts
+    // in. --json-file and --markdown are written from the same view, so the
+    // declared digests match the files and nothing raw travels. With
+    // telemetry off only fresh prose normalization applies. This is the fresh
+    // producer boundary; retained reports and envelope builders never rewrite it.
+    const produced = normalizeGeneratedReport(result);
+    const delivered = runtime && runtime.level !== 'off' ? sanitizeForDelivery(produced, { parseFailures: runtime.parseFailures }) : produced;
+    postReviewStage('rendering report artifacts');
+    const artifacts = renderReportArtifacts(delivered);
+    let pendingReviewerArtifact;
+    if (extra.pendingResume && pendingEvidence) {
+        pendingReviewerArtifact = serializeReviewerArtifact({
+            assembly: pendingEvidence.assembly,
+            reportBytes: artifacts.report_json,
+            representation: { version: 1, parseFailures: runtime?.parseFailures ?? false },
+            ...(pendingEvidence.verificationProof ? { verificationProof: pendingEvidence.verificationProof } : {}),
+        });
+        await extra.pendingResume.journal.retainTerminalReport({
+            reportBytes: artifacts.report_json,
+            reviewerArtifactBytes: pendingReviewerArtifact.bytes,
+        }, extra.pendingResume.ownership);
+    }
+    // Output
+    if (opts.json) {
+        console.log(artifacts.report_json);
+    }
+    else {
+        printReviewSummary(result);
+    }
+    const outputDiagnostics = await writeReportArtifacts(artifacts, { ...opts, exclusive: opts.guardedConverge || opts.exclusiveOutputs }, {
+        onWritten: (label, path) => console.log(chalk.dim(`${label} written to: ${path}`)),
+        onError: (message) => process.stderr.write(chalk.red(message) + '\n'),
+    });
+    if (opts.post && !diff.metadata) {
+        console.log(chalk.yellow('--post ignored: no PR to post to for a local diff.'));
+    }
+    if (opts.post && diff.metadata) {
+        const postSpinner = ora('Posting review to GitHub...').start();
+        try {
+            await postGitHubReview(result, diff.metadata, config.githubToken, diff.files);
+            postSpinner.succeed('Review posted to GitHub');
+        }
+        catch (err) {
+            postSpinner.fail(`Failed to post to GitHub: ${String(err)}`);
+        }
+    }
+    // A failed requested output must not prevent delivery or immutable recovery
+    // retention of the rendered originals. Try both files before any exit code.
+    const evidenceRequired = opts.evidenceRequired === true;
+    const delivery = runtime
+        ? await deliverRun(runtime, { result: delivered, artifacts, evidenceRequired, outputDiagnostics,
+            ...(pendingReviewerArtifact ? { reviewerArtifact: pendingReviewerArtifact } : {}) }).catch((err) => ({
+            status: 'error',
+            line: `Evidence delivery failed: ${scrubText(String(err), 300)}`,
+            exitCode: evidenceRequired ? 4 : 0,
+            spooled: false,
+        }))
+        : {
+            status: 'off',
+            line: evidenceRequired ? `Evidence not sent: telemetry could not be set up (${runtimeError ?? 'unknown cause'})` : '',
+            exitCode: evidenceRequired ? 4 : 0,
+            spooled: false,
+        };
+    if (delivery.line !== '')
+        process.stderr.write(chalk.dim(delivery.line) + '\n');
+    // The flush hint is honest only when something was spooled to flush.
+    const evidenceFailure = [
+        `Evidence was not recorded (--evidence-required): ${delivery.line || delivery.status}.`,
+        delivery.spooled
+            ? `Retry delivery with \`rcl telemetry flush --run ${delivery.runId}\` rather than re-running the review.`
+            : undefined,
+        delivery.retention?.status === 'complete'
+            ? `Original reports are retained; inspect them with \`rcl telemetry rejected --run ${delivery.runId}\` before supported recovery.`
+            : delivery.retention?.status === 'failed'
+                ? `Original report retention failed: ${delivery.retention.error ?? 'unknown error'}.`
+                : undefined,
+    ].filter((part) => part !== undefined).join(' ');
+    if (opts.exclusiveOutputs && outputDiagnostics.some(diagnostic => diagnostic.path === 'output.report_json') &&
+        !delivery.spooled && delivery.status !== 'recorded' && delivery.retention?.status !== 'complete') {
+        throw new ReviewLaunchRefused('report_write_failed', 'The JSON report could not be retained. This attempt remains spent; correct the output path before an explicit bounded retry.');
+    }
+    const completion = {
+        runId: run.id,
+        reportJsonSha256: sha256Hex(artifacts.report_json),
+        successfulReviews: result.stats.successfulReviews,
+        totalReviews: result.stats.totalReviews,
+        // Aggregate counters stay the report's own stats; launch health is blocking-only.
+        reviewerHealth: blockingHealth
+            ? { version: 1, policy: blockingHealth.policy, successfulSeats: blockingHealth.successfulSeats.length }
+            : { version: 1, policy: resolveQuorumPolicy(0), successfulSeats: 0 },
+        ...guardedDeliveryState(delivery),
+        ...(prepared.converge?.cycleId ? {
+            exitCode: opts.ci && run.ci_exit_code !== 0 ? run.ci_exit_code : delivery.exitCode || (outputDiagnostics.length > 0 ? 1 : 0),
+            ...(opts.jsonFile ? { reportPath: resolve(opts.jsonFile) } : {}),
+        } : {}),
+        hardFailure: chunkReviews.some(review => review.status === 'error' || review.status === 'parse_failed'),
+    };
+    // CI mode: fail on a fully-failed run or on blocking findings. The gate
+    // verdict keeps its exit code — pipelines branch on it — and an evidence
+    // failure is reported beside it.
+    if (opts.ci) {
+        const verdict = evaluateCiGate(result);
+        if (verdict.exitCode !== 0) {
+            console.error(chalk.red(`\n${verdict.message}`));
+            if (delivery.exitCode !== 0)
+                console.error(chalk.red(evidenceFailure));
+            process.exitCode = verdict.exitCode;
+            return completion;
+        }
+    }
+    if (delivery.exitCode !== 0) {
+        console.error(chalk.red(evidenceFailure));
+        process.exitCode = delivery.exitCode;
+        return completion;
+    }
+    if (outputDiagnostics.length > 0)
+        process.exitCode = 1;
+    return completion;
+}
+async function runDiscuss(question, opts) {
+    const spinner = ora('Loading report...').start();
+    try {
+        await fetchHarnessKeys(spinner);
+        const config = await loadConfig(opts.config);
+        let result;
+        try {
+            result = JSON.parse(await readFile(opts.report, 'utf-8'));
+        }
+        catch {
+            throw new Error(`Could not read report JSON: ${opts.report}`);
+        }
+        if (!Array.isArray(result.findings)) {
+            throw new Error(`Not an rcl report (no findings array): ${opts.report}`);
+        }
+        const finding = resolveFinding(result, opts.finding);
+        const models = opts.models
+            ? opts.models.split(',').map((s) => s.trim()).filter(Boolean)
+            : finding.consensus.models;
+        if (models.length === 0) {
+            throw new Error('No models to ask: the finding lists none and --models was not given.');
+        }
+        const contextDocs = await loadContextDocs(opts.context ?? []);
+        const prompts = buildDiscussPrompts({ finding, question, contextDocs });
+        spinner.text = `Asking ${models.length} model(s) about "${finding.title.slice(0, 60)}"...`;
+        const answers = await runDiscussion(models, prompts, {
+            timeoutMs: config.timeout ?? DEFAULT_TIMEOUT_MS,
+            maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+            reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,
+        });
+        spinner.succeed(`Discussion complete (${answers.filter((a) => a.status === 'success').length}/${answers.length} answered)`);
+        if (opts.json) {
+            console.log(JSON.stringify({ finding: { id: finding.id, file: finding.file, title: finding.title }, question, answers }, null, 2));
+            return;
+        }
+        console.log('');
+        console.log(chalk.bold(`Finding: `) + `${finding.title}`);
+        console.log(chalk.dim(`${finding.file}:${finding.startLine}–${finding.endLine} · ${finding.severity} · ${finding.consensus.disputed ? 'disputed' : finding.consensus.tier}`));
+        console.log(chalk.bold(`Question: `) + question);
+        for (const answer of answers) {
+            console.log('');
+            console.log(chalk.dim('─'.repeat(80)));
+            if (answer.status === 'success') {
+                console.log(chalk.cyan.bold(answer.model) + chalk.dim(` (${(answer.durationMs / 1000).toFixed(1)}s)`));
+                console.log('');
+                console.log(answer.text);
+            }
+            else {
+                console.log(chalk.cyan.bold(answer.model) +
+                    ' ' +
+                    chalk.red(answer.status === 'timeout' ? '⏱ timed out' : `✗ ${answer.error ?? 'error'}`));
+            }
+        }
+        console.log('');
+    }
+    catch (err) {
+        spinner.fail(String(err));
+        if (process.env['RCL_DEBUG']) {
+            console.error(err);
+        }
+        process.exit(1);
+    }
+}
+/**
+ * Roles whose instincts transfer to reviewing a design document. Used only
+ * when neither CLI flags nor config request roles; spec-compliance joins
+ * when a spec is resolved (see prepareCouncil).
+ */
+const PLAN_DEFAULT_ROLES = ['general', 'architecture', 'edge-case-hunter'];
+async function runPlanReview(file, opts) {
+    const spinner = ora('Loading configuration...').start();
+    try {
+        // A plan is not a commit: the review-plan command declares none of the
+        // head-binding flags, and this guard keeps any future path that shares
+        // the option type from carrying one that would then be silently ignored.
+        if (opts.headSha !== undefined || opts.baseSha !== undefined || opts.expectHeadSha !== undefined) {
+            throw new Error('--head-sha, --base-sha and --expect-head-sha do not apply to plan reviews; a plan is bound by its content digest.');
+        }
+        assertEvidenceCanBeRequired(opts);
+        let focus;
+        if (opts.focus) {
+            if (!isPlanFocus(opts.focus)) {
+                spinner.fail(`Invalid --focus "${opts.focus}". Use one of: ${PLAN_FOCUS_MODES.join(', ')}.`);
+                process.exit(1);
+            }
+            focus = opts.focus;
+        }
+        const prepared = await prepareCouncil(spinner, opts, PLAN_DEFAULT_ROLES);
+        assertEvidenceCanBeRequired(opts, prepared.config);
+        await assertEvidenceDeliverable(opts, prepared.config);
+        spinner.text = `Loading plan: ${file}`;
+        const diff = await loadPlanAsDiff(file);
+        // Plan reviews get an async lane too: re-reviewing the same plan file
+        // collects what the previous run fired.
+        await executeCouncil(spinner, prepared, diff, opts, {
+            command: 'review-plan',
+            target: { kind: 'plan' },
+            focus,
+            asyncTargetLabel: `plan:${file}`,
+        });
+    }
+    catch (err) {
+        spinner.fail(String(err));
+        if (process.env['RCL_DEBUG']) {
+            console.error(err);
+        }
+        process.exit(1);
+    }
+}
+program.parse();
+//# sourceMappingURL=index.js.map