@dzhechkov/harness-cli 0.4.6 → 0.5.1

package/src/cli.ts

@@ -7,16 +7,21 @@
 import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { execFileSync, execSync, spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
+import { execFileSync, execSync, spawn, type ChildProcess } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
 
 import {
   createSkill,
   getSkillInfo,
-  isTargetName,
-  listSkills,
+  listSkillsDetailed,
+  formatSkillLoadFailures,
+  formatSkillApplyFailures,
+  resolveTargetName,
+  formatTargetProblem,
+  formatTargetAliasNote,
+  TARGET_NAMES_SORTED,
   runDoctor,
   runInit,
   resolvePackageSkillRoots,
@@ -49,8 +54,38 @@ import {
   runVerify,
   runInitAgentsMd,
   runInitGeminiMd,
+  runSyncAgentsPolicy,
+  runSyncCodexHooks,
+  resolveCodexHome,
+  withNamedLockSync,
+  // dz workflow run (feature dz-workflow-run): the pure scheduler + the dispatch adapters.
+  TRACE_RUNID_RE,
+  WF_RUN_OWNER_HOST,
+  preflight,
+  runWorkflow,
+  makeClaudePDispatcher,
+  makeCodexExecDispatcher,
+  type ChildRunner,
+  type Dispatcher,
+  type DispatchResult,
+  type RunStore,
+  type RunnerInputs,
+  type SchedulerDeps,
+  type WfRunState,
+  NamedLockTimeoutError,
+  NamedLockCompromisedError,
+  type CodexHooksSyncReport,
+  type ParityCell,
+  type ParityFeature,
+  type ParityReportCell,
+  type RuntimeCapability,
+  POLICY_SOURCES,
+  detectPolicyDrift,
+  hasPolicyFence,
   TARGET_NAMES,
   buildParityMatrix,
+  downgradeForStaleEvidence,
+  findStaleTranscriptEvidence,
   TARGET_CAPABILITIES,
   TARGET_SHORT_LABELS,
   WORKFLOW_TEMPLATES_RETIRED_MESSAGE,
@@ -215,6 +250,7 @@ import {
   buildChallengeBrief,
   planDiscriminationCheck,
   classifyDiscrimination,
+  classifyExecutionEvidence,
   pickAdversaryModel,
   CHALLENGE_QUESTIONS,
   loadOutcomes,
@@ -320,6 +356,24 @@ import {
   renderDomainBoostNote,
   renderDomainCutNote,
   parseReqeDebt,
+  // qe-bridge (feature qe-bridge-claude, ADR-001): the pure half of the reverse QE bridge.
+  KNOWN_CLAUDE,
+  isSafeClaudeId,
+  claudeProbeArgs,
+  claudeReviewArgs,
+  interpretClaudeProbe,
+  modelFamily,
+  buildBridgePrompt,
+  parseBridgeOutput,
+  buildBridgeFailureRecord,
+  buildBridgeSignoffRecord,
+  renderBridgeReport,
+  isSafeSlug,
+  hasUnsafePathChars,
+  hasDotDotSegment,
+  type BridgeFamily,
+  type BridgeFailureReason,
+  type NamedExtract,
   buildReqeBrief,
   settleReqeDebt,
   renderReqeList,
@@ -343,7 +397,9 @@ import {
   planImport,
 } from '@dzhechkov/harness-core';
 import type { MutationEntryResult, MutationObservation, MutationRegistryEntry } from '@dzhechkov/harness-core';
+import type { SkillApplyFailure, SkillLoadFailure } from '@dzhechkov/harness-core';
 import type { ReqeDebt } from '@dzhechkov/harness-core';
+import type { ClassifyResultRow, ExecutionEvidence } from '@dzhechkov/harness-core';
 import type { IdeaRecord, IdeaStatus } from '@dzhechkov/harness-core';
 import type { Family, ModelRung, Candidate as BtoCandidate, DimScores } from '@dzhechkov/harness-core';
 import type { SetupSpec } from '@dzhechkov/harness-core';
@@ -355,7 +411,7 @@ import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, S
 const USAGE = `dz - DZ cross-platform harness CLI
 
 Usage:
-  dz init   --target <name> [--skills-dir <dir>] [--project <dir>] [--preset <name>] [--select id,id,...] [--force] [--enrich]
+  dz init   --target <name> [--skills-dir <dir>] [--project <dir>] [--preset <name>] [--select id,id,...] [--force] [--enrich] [--no-hooks] [--no-verify]   (--target codex ALSO installs the user-global dz veto+recall hooks and LIVE-verifies them (ADR-001 §8); --no-hooks = skills only; --no-verify skips the live probe and can never report ready)
   dz verify [--skills-dir <dir>] [--target <name>]
   dz sync   [--canonical <dir>] [--project <dir>] [--dry-run] [--force]
   dz update   (alias of sync)
@@ -390,6 +446,7 @@ Usage:
   dz epoch-replay --score <judgments.json> --work-order <file> [--slice <name>] [--json]   (un-blind against the pre-registered assignment → SUPPORTED only when the two 95% Wilson CIs are DISJOINT, else FALSIFIED / INCONCLUSIVE)
   dz score --slug <feature> [--project <dir>] [--json]   (process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination, cross-model QE grade, live verification, README-first, learning loop, amendments — descriptive-only, a low score exits 0)
   dz reqe [--slug <feature> [--done --report <f>]] [--json]   (the re-QE debt ledger: a usage-switched run whose Step-8 QE ran on the coder's OWN family records a debt; list debts, print the cross-family review brief, settle FAIL-CLOSED against a graded report — the settlement lands in 08_qe_report.md)
+  dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <f>] [--timeout <s>] [--allow-same-family] [--json]   (the REVERSE QE bridge: run an INDEPENDENT Claude reviewer over a feature's Step-8 artifacts from ANY host — a Codex session included, plain shell, no Claude agent plane needed — and land a PARSED signoff. The reviewer runs ISOLATED: an EMPTY temp cwd plus --safe-mode --strict-mcp-config --tools '' --no-session-persistence, so no CLAUDE.md/skills/plugins/hooks/MCP load, and the verdict is read from the --output-format json RESULT ENVELOPE — text a session customization printed onto the same stdout can never become a signoff. Probes the model before trusting it; sends SCOPED extracts with a loud 200k-char ceiling (never silent truncation); the grade must AGREE across three LAST-anchored channels (terminal marker line, fenced qe-bridge-signoff JSON, the report's own GRADE line) AND the marker must be the FINAL content — empty, gradeless, self-contradicting or miscounted output is one of 18 NAMED failures with an audit record under features/<slug>/.fa-state/qe-bridge/ (runId, resolved executable + binOverride, prompt sha256, channel offsets, requestedOut, reportWritten, retained raw stdout; 0600 files in a 0700 dir), never a clean review. A --coder-family that contradicts the recorded reqe debt is refused. Writes features/<slug>/08b_reqe_report.md, which dz reqe --done settles unchanged. DISCLOSURE: the extracts you scope are sent to the Claude runtime; the bridge cannot classify secrets. DZ_QE_BRIDGE_CLAUDE_BIN is a TEST SEAM, not a flag. exit 0 signoff parsed (ANY grade — it reports, it does not gate) / 1 named failure / 2 usage)
   dz mutation-gate [--package <dir>] [--registry <file>] [--test-cmd "<cmd>"] [--only <id[,id]>] [--timeout <ms>] [--rebaseline per-entry|final] [--keep-scratch] [--json]   (prove each NAMED protection has a test that DISCRIMINATES: copy the package to a scratch dir, verify the baseline suite is green, apply each registry mutation, run the suite, REQUIRE red, restore. The red must be BEHAVIOURAL: a mutation that no longer parses is MUTATION_UNPARSEABLE; a red run whose OWN output reports a test FILE failing to load (node --test file-level not-ok with exitCode, vitest Failed Suites) is MUTATION_LOAD_FATAL — the signal comes from the same run as the failing count, never from a separate isolated import; red output whose shape matches no known runner is INCONCLUSIVE (a runner-coverage gap, loud, never PROVEN); a count far above the entry's bound is OVER_FAILING; a restored tree that does not reproduce green makes the entry INCONCLUSIVE (flaky). Mutation writes are realpath-contained to the scratch copy: a symlink escape or a node_modules/ target is refused (exit 2), the real tree is never written. A mutation that does not apply, a green suite, or an inconclusive run is a FAILURE — never a skip. exit 0 all proven / 1 gate failed / 2 setup error)
   dz backlog add "<idea>" [--effort 1-5] [--proposal <text>] [--dry-run] [--project <dir>] [--json]   (capture an idea: semantic dedup against existing ideas via the Brain vector engine (DUPLICATE>=0.92 merges, RELATED links, NEW creates) + GoalMap alignment; --dry-run classifies without writing)
   dz backlog list [--status <s>] [--goal <id>] [--project <dir>] [--json]   (list captured ideas, filterable by status/goal)
@@ -404,7 +461,7 @@ Usage:
   dz backlog enrich <id> [--project <dir>] [--json]                        (stage the idea2prd input scaffold in features/<slug>/ and hand off to the idea2prd-manual skill — the CLI never fabricates a PRD)
   dz backlog jira <id> [--project <dir>] [--json]                          (draft a Jira issue via the configurable adapter (backlog.jira.adapter: jira-mcp|copilot-mcp|none); none writes an auditable jira-outbox/<id>.json stub)
   dz backlog harmonize [--apply] [--threshold <0-1>] [--project <dir>] [--json]   (batch semantic dedup of the backlog ideas; --dry-run default, --apply snapshots first)
-  dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
+  dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--no-verify] [--install-driver] [--force] [--enrich]   (--target codex ALSO installs + LIVE-verifies the codex hooks; an unverified hook exits non-zero WITHOUT aborting the rest of setup)
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
   dz consolidate [--sessions-dir <dir>] [--project <dir>] [--no-mirror] [--prune-noise [--apply]] [--prune-quarantine [--apply]]   (both prunes: DRY-RUN by default; --apply snapshots then deletes; prune-quarantine = expired unproven lessons ONLY, never coupled to noise)
@@ -441,6 +498,8 @@ Usage:
               (build-time: reconcile project grants vs installed skills' declared capabilities; dz never enforces — the host does)
   dz sync-upstream [--package <dir>] [--list] [--all]
   dz drift-check [--json] [--project <dir>]                             (CI gate: exit 1 if any shared skill drifted between its monorepo copies)
+  dz agents-sync [--project <dir>] [--check] [--json]                   (sync/verify the always-on policy fence in root AGENTS.md; exit 0 synced/written, 1 drift, 3 inconclusive)
+  dz hooks-sync --target codex [--check] [--verify] [--remove] [--json]  (install/verify the dz veto + recall hooks in $CODEX_HOME/hooks.json; exit 0 armed+trusted, 1 not armed/drift, 3 inconclusive)
   dz sync-canonical <skill> [--check] [--from <dir>] [--auto] [--project <dir>]  (heal every copy from skills-meta/<skill> or --from; no canonical + --check = compare copies to each other (exit 1 on drift); no canonical + write = refuse unless --auto (LOUD, picks most-complete copy); --check writes nothing)
   dz plugin [--version <ver>]
   dz downloads
@@ -452,6 +511,18 @@ Usage:
 
 Global: --version | -v [--json]   (prints this CLI's own semver on one line, exit 0; "unknown" + exit 1 when unresolvable)
 
+  dz workflow run <plan.json> [--run-id <id>] [--resume <runId>] [--arg k=v]... [--coder-family codex|claude]
+              [--default-family codex|claude] [--budget <n>] [--max-wall-clock <s>] [--stage-timeout <s>]
+              [--budget-extra <n>] [--wall-clock-extra <s>] [--run-dir <dir>] [--allow-same-family-qe] [--json]
+              (INTERPRET a loop-plan/1 plan host-independently; writes trace/budget/checkpoints under .dz/loop-trace/<runId>/)
+
+EXIT CODES - "workflow run" and "workflow-lint" have DIFFERENT tables, side by side:
+  run   0 completed | 1 failed (named reason) | 2 usage/invalid plan | 75 typed pause (sysexits EX_TEMPFAIL)
+  lint  0 clean     | 1 findings              | 3 inconclusive
+  75 is NOT 3: 3 reads ignorable and collides with lint's inconclusive, while a pause strands resumable work.
+  On a pause the LAST stdout line is a "wf-pause-envelope/1" JSON object; a FAILURE emits none, so a wrapper
+  tells the two apart from stdout + exit code alone, without parsing prose.
+
 Workflows: author loop-plan/1 plans with dz workflow init/validate/render; gate them with dz workflow-lint; read runs with dz workflow-trace (the ADR-005 templates are retired)
 
 Targets: ${TARGET_NAMES.join(', ')}
@@ -461,6 +532,18 @@ Presets: ${PRESET_NAMES.join(', ')}`;
 export interface CliIo {
   readonly cwd?: string;
   readonly write?: (line: string) => void;
+  /**
+   * Diagnostics sink — **stderr**, defaulting to `console.error`.
+   *
+   * Before feature dz-cli-defects `CliIo` had no stderr seam at all, so every
+   * diagnostic (including the top-level error handler) landed on stdout and
+   * `dz list > skills.txt` wrote the error INTO the data file. `write` stays "data
+   * only"; `writeErr` is "diagnosis only".
+   *
+   * There is deliberately **no** fall-back to `write`: a test that wants to assert on
+   * stderr must inject `writeErr`, or the assertion would be theatre.
+   */
+  readonly writeErr?: (line: string) => void;
   /**
    * Pre-read STDIN content (injectable so `dz brain ground`'s hook path is testable without
    * an actual pipe). When omitted, the CLI reads fd 0 synchronously — but only for the one
@@ -531,6 +614,8 @@ function parseArgs(argv: string[]): ParsedArgs {
 }
 
 type Write = (line: string) => void;
+/** Mirrors {@link Write}, but for the stderr seam (see {@link CliIo.writeErr}). */
+type WriteErr = (line: string) => void;
 
 /**
  * Discover skill source directories: explicit `--skills-dir` if given, else
@@ -560,6 +645,14 @@ interface InstallSkillsResult {
   readonly skipped: number;
   /** Selected ids found in NO searched directory (empty when no `select` was given). */
   readonly missing: string[];
+  /** Skill dirs that could not be LOADED, across every searched directory (D1). */
+  readonly failures: SkillLoadFailure[];
+  /**
+   * Skills that loaded but could not be COMPILED or WRITTEN (fix round 1, QE F4).
+   * A separate list because it accuses a different artifact — the target tree, not
+   * the source `SKILL.md`.
+   */
+  readonly applyFailures: SkillApplyFailure[];
 }
 
 /**
@@ -597,10 +690,12 @@ async function installSkills(opts: {
     let written = 0;
     let skipped = 0;
     for (const s of results) { written += s.written; skipped += s.skipped; }
-    return { results, dirsSearched: skillsDirs.length, written, skipped, missing: [...report.missing] };
+    return { results, dirsSearched: skillsDirs.length, written, skipped, missing: [...report.missing], failures: [...report.failures], applyFailures: [...report.applyFailures] };
   }
 
   const results: { id: string; written: number; skipped: number }[] = [];
+  const failures: SkillLoadFailure[] = [];
+  const applyFailures: SkillApplyFailure[] = [];
   for (const skillsDir of skillsDirs) {
     const r = await runInit({
       target,
@@ -613,6 +708,8 @@ async function installSkills(opts: {
     for (const skill of r.skills) {
       results.push({ id: skill.id, written: skill.written.length, skipped: skill.skipped.length });
     }
+    failures.push(...r.failures);
+    applyFailures.push(...r.applyFailures);
   }
 
   let written = 0;
@@ -620,7 +717,7 @@ async function installSkills(opts: {
   for (const s of results) { written += s.written; skipped += s.skipped; }
   const installed = new Set(results.map((s) => s.id));
   const missing = select !== undefined ? [...select].filter((id) => !installed.has(id)) : [];
-  return { results, dirsSearched: skillsDirs.length, written, skipped, missing };
+  return { results, dirsSearched: skillsDirs.length, written, skipped, missing, failures, applyFailures };
 }
 
 /** Warn about preset/select ids that weren't found in any installed pack. */
@@ -636,12 +733,22 @@ function writeMissingSkillsHint(write: Write, missing: string[], presetName: str
   }
 }
 
-async function cmdInit(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): Promise<number> {
-  const target = options.get('target');
-  if (target === undefined || !isTargetName(target)) {
-    write(`dz init: --target must be one of: ${TARGET_NAMES.join(', ')}`);
+async function cmdInit(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write, writeErr: WriteErr): Promise<number> {
+  const targetOpt = options.get('target');
+  if (targetOpt === undefined) {
+    // A missing `--target` is the same accusation as an unresolvable one, so it takes
+    // the same channel: diagnostics on stderr, stdout stays a data channel (ADR-002
+    // §Decision 2 / driver D6; fix round 1, QE F2).
+    writeErr(`dz init: --target must be one of: ${TARGET_NAMES_SORTED.join(', ')}`);
+    return 1;
+  }
+  const resolution = resolveTargetName(targetOpt);
+  if (resolution.kind === 'unknown') {
+    for (const line of formatTargetProblem('dz init', resolution)) writeErr(line);
     return 1;
   }
+  const target = resolution.target;
+  if (resolution.via === 'alias') writeErr(formatTargetAliasNote('dz init', targetOpt, target));
   const explicitSkillsDir = options.get('skills-dir');
   const projectRoot = resolve(cwd, options.get('project') ?? '.');
 
@@ -679,19 +786,56 @@ async function cmdInit(options: Map<string, string>, flags: Set<string>, cwd: st
     write(`  (searched ${r.dirsSearched} skill directories)`);
   }
   writeMissingSkillsHint(write, r.missing, presetName);
-  return 0;
+
+  // Codex-targeted init DELIVERS the hooks and verifies them (ADR-001 §8). Skills alone are not the
+  // target's harness: the veto + recall legs are what `--target codex` promises.
+  // `--no-hooks` is the documented escape for "skills only" (the same flag `dz setup` already
+  // carries): hook delivery writes USER-GLOBAL config, so a command that only wants skills compiled
+  // must be able to say so — and every test that is about skills says it.
+  let codexHooksOk = true;
+  if (target === 'codex' && !flags.has('no-hooks')) {
+    const delivery = deliverCodexHooks({ project: projectRoot, verify: !flags.has('no-verify') }, undefined, 'dz init');
+    codexHooksOk = delivery.ok;
+    for (const line of delivery.stdout) write(line);
+    for (const line of delivery.stderr) writeErr(line);
+  }
+  // Skip-and-collect must not become skip-and-SILENCE: a skill that failed to load is
+  // named on stderr and the command exits 1 (it exited 1 before too — by throwing).
+  if (r.failures.length > 0 || r.applyFailures.length > 0) {
+    // Counts first, then the named block — the same shape `dz list` uses. The block's
+    // own header already says "N skipped", so this line carries what it cannot: how many
+    // DID install, so a reader can tell a mostly-fine install from a mostly-broken one.
+    //
+    // The two failure kinds are counted and rendered SEPARATELY (fix round 1, QE F4):
+    // an unwritable target directory is not a broken pack, and printing it as one names
+    // the wrong file.
+    const parts = [`${r.results.length} installed`];
+    if (r.failures.length > 0) parts.push(`${r.failures.length} skipped`);
+    if (r.applyFailures.length > 0) parts.push(`${r.applyFailures.length} failed to write`);
+    writeErr(`dz init: ${parts.join(', ')}`);
+    for (const line of formatSkillLoadFailures(r.failures)) writeErr(line);
+    for (const line of formatSkillApplyFailures(r.applyFailures)) writeErr(line);
+    return 1;
+  }
+  return codexHooksOk ? 0 : 1;
 }
 
-async function cmdVerify(options: Map<string, string>, cwd: string, write: Write): Promise<number> {
+async function cmdVerify(options: Map<string, string>, cwd: string, write: Write, writeErr: WriteErr): Promise<number> {
   const skillsDir = resolve(cwd, options.get('skills-dir') ?? '.claude/skills');
   const targetOpt = options.get('target');
-  if (targetOpt !== undefined && !isTargetName(targetOpt)) {
-    write(`dz verify: --target must be one of: ${TARGET_NAMES.join(', ')}`);
-    return 1;
+  let target: TargetName | undefined;
+  if (targetOpt !== undefined) {
+    const resolution = resolveTargetName(targetOpt);
+    if (resolution.kind === 'unknown') {
+      for (const line of formatTargetProblem('dz verify', resolution)) writeErr(line);
+      return 1;
+    }
+    target = resolution.target;
+    if (resolution.via === 'alias') writeErr(formatTargetAliasNote('dz verify', targetOpt, target));
   }
   const report = await runVerify({
     skillsDir,
-    ...(targetOpt !== undefined ? { target: targetOpt } : {}),
+    ...(target !== undefined ? { target } : {}),
   });
   write(`dz verify (${report.target}): ${report.valid}/${report.total} skill(s) valid`);
   for (const skill of report.skills) {
@@ -700,7 +844,7 @@ async function cmdVerify(options: Map<string, string>, cwd: string, write: Write
   return report.valid === report.total ? 0 : 1;
 }
 
-async function cmdSync(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): Promise<number> {
+async function cmdSync(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write, writeErr: WriteErr): Promise<number> {
   const projectRoot = resolve(cwd, options.get('project') ?? '.');
   const canonicalArg = options.get('canonical');
 
@@ -727,6 +871,14 @@ async function cmdSync(options: Map<string, string>, flags: Set<string>, cwd: st
   write(
     `dz sync${report.dryRun ? ' --dry-run' : ''}: ${inSync}/${total} in sync, ${missing} missing, ${drift} drift`,
   );
+  // Skip-and-collect (D1): the broken canonical skills are NAMED on stderr, and their
+  // presence keeps the exit code non-zero — a partial sync is not a clean sync.
+  if (report.failures.length > 0) {
+    // See `cmdInit` above: counts here, names in the block below.
+    writeErr(`dz sync: ${report.skills.length} compared, ${report.failures.length} skipped`);
+    for (const line of formatSkillLoadFailures(report.failures)) writeErr(line);
+    return 1;
+  }
   return missing === 0 && drift === 0 ? 0 : 1;
 }
 
@@ -773,19 +925,42 @@ function cmdCreateSkill(options: Map<string, string>, flags: Set<string>, cwd: s
   return 0;
 }
 
-function cmdList(options: Map<string, string>, cwd: string, write: Write): number {
+/**
+ * `dz list` — skip-and-collect (feature dz-cli-defects, D1).
+ *
+ * One unparseable `SKILL.md` used to discard the ENTIRE listing with a message naming
+ * neither the file nor the count. Now the parseable skills list on stdout and the
+ * broken ones are named on stderr. The whole emit contract, in one place:
+ *
+ * | valid | skipped | stdout | stderr | exit |
+ * |-------|---------|--------|--------|------|
+ * | >0    | 0       | listing | *empty* | 0 |
+ * | >0    | >0      | listing of the valid ones | named summary | 1 |
+ * | 0     | >0      | *nothing* | named summary | 1 |
+ * | 0     | 0       | *nothing* | `no skills found in <dir>` | 1 |
+ *
+ * The last row is the ONE intentional departure from byte-identical output: that line
+ * used to go to stdout. Moving it keeps *stdout is data, stderr is diagnosis* whole —
+ * the invariant that makes `dz list > out.txt` trustworthy.
+ */
+function cmdList(options: Map<string, string>, cwd: string, write: Write, writeErr: WriteErr): number {
   const skillsDir = resolve(cwd, options.get('skills-dir') ?? '.claude/skills');
-  const skills = listSkills(skillsDir);
-  if (skills.length === 0) {
-    write(`dz list: no skills found in ${skillsDir}`);
+  const { skills, failures } = listSkillsDetailed(skillsDir);
+  if (skills.length === 0 && failures.length === 0) {
+    writeErr(`dz list: no skills found in ${skillsDir}`);
     return 1;
   }
-  write(`${skills.length} skill(s) in ${skillsDir}:\n`);
-  for (const skill of skills) {
-    const desc = skill.description.length > 80 ? skill.description.slice(0, 77) + '...' : skill.description;
-    write(`  ${skill.id.padEnd(35)} ${desc}`);
+  if (skills.length > 0) {
+    write(`${skills.length} skill(s) in ${skillsDir}:\n`);
+    for (const skill of skills) {
+      const desc = skill.description.length > 80 ? skill.description.slice(0, 77) + '...' : skill.description;
+      write(`  ${skill.id.padEnd(35)} ${desc}`);
+    }
   }
-  return 0;
+  if (failures.length === 0) return 0;
+  writeErr(`dz list: ${skills.length} listed, ${failures.length} skipped in ${skillsDir}`);
+  for (const line of formatSkillLoadFailures(failures)) writeErr(line);
+  return 1;
 }
 
 function cmdInfo(options: Map<string, string>, args: ParsedArgs, cwd: string, write: Write): number {
@@ -1599,6 +1774,7 @@ async function cmdInstall(
   flags: Set<string>,
   cwd: string,
   write: Write,
+  writeErr: WriteErr,
   installRunner?: (command: string, cwd: string) => void,
 ): Promise<number> {
   const pkg = options.get('_positional_0');
@@ -1608,10 +1784,13 @@ async function cmdInstall(
   }
 
   const targetOpt = options.get('target') ?? 'claude-code';
-  if (!isTargetName(targetOpt)) {
-    write(`dz install: --target must be one of: ${TARGET_NAMES.join(', ')}`);
+  const targetResolution = resolveTargetName(targetOpt);
+  if (targetResolution.kind === 'unknown') {
+    for (const line of formatTargetProblem('dz install', targetResolution)) writeErr(line);
     return 1;
   }
+  const target = targetResolution.target;
+  if (targetResolution.via === 'alias') writeErr(formatTargetAliasNote('dz install', targetOpt, target));
 
   const projectRoot = resolve(cwd, options.get('project') ?? '.');
 
@@ -1647,7 +1826,7 @@ async function cmdInstall(
 
   // Step 3: Use dz init with the resolved skills root as source
   const report = await runInit({
-    target: targetOpt,
+    target,
     skillsDir: root.dir,
     projectRoot,
     force: flags.has('force'),
@@ -1666,21 +1845,36 @@ async function cmdInstall(
   if (root.layout === 'npx-template' && root.hasCompanionAssets) {
     write(`  note: ${pkg} also ships commands/hooks/agents — \`npx -y ${pkg} init\` installs the full kit.`);
   }
+  // Skip-and-collect at install time (D1 / the report's D2 amendment): the offending
+  // SKILL.md came out of the DOWNLOADED TARBALL, so the path is rendered relative to
+  // the package root (a `node_modules/**` absolute path is not actionable) and the
+  // message says whose defect it is. Exit 1 — a pack that shipped an unloadable skill
+  // did not fully install.
+  if (report.failures.length > 0) {
+    writeErr(`dz install: ${pkg} ships ${report.failures.length} unparseable skill(s) —`);
+    for (const line of formatSkillLoadFailures(report.failures, { relativeTo: pkgDir })) writeErr(line);
+    writeErr('This is a defect in the package, not in your project.');
+    writeErr(`Workaround: npx -y ${pkg} init`);
+    return 1;
+  }
   return 0;
 }
 
-function cmdCompose(options: Map<string, string>, cwd: string, write: Write): number {
+function cmdCompose(options: Map<string, string>, cwd: string, write: Write, writeErr: WriteErr): number {
   const combo = options.get('_positional_0');
   if (!combo) {
     write('dz compose: preset combination required (e.g., dz compose devops+mcp+web3)');
     return 1;
   }
   // --target is documented; honor it in the suggested install command (was hardcoded claude-code).
-  const target = options.get('target') ?? 'claude-code';
-  if (!isTargetName(target)) {
-    write(`dz compose: --target must be one of: ${TARGET_NAMES.join(', ')}`);
+  const targetOpt = options.get('target') ?? 'claude-code';
+  const composeResolution = resolveTargetName(targetOpt);
+  if (composeResolution.kind === 'unknown') {
+    for (const line of formatTargetProblem('dz compose', composeResolution)) writeErr(line);
     return 1;
   }
+  const target = composeResolution.target;
+  if (composeResolution.via === 'alias') writeErr(formatTargetAliasNote('dz compose', targetOpt, target));
   const presetNames = combo.split('+').map((s) => s.trim());
   const allSkills = new Set<string>();
   const resolved: string[] = [];
@@ -3897,12 +4091,19 @@ async function cmdBrain(
   return sub === undefined ? 0 : 1;
 }
 
-async function cmdSetup(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): Promise<number> {
-  const target = options.get('target');
-  if (!target || !isTargetName(target)) {
-    write(`dz setup: --target required (${TARGET_NAMES.join(', ')})`);
+async function cmdSetup(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write, writeErr: WriteErr): Promise<number> {
+  const targetOpt = options.get('target');
+  if (!targetOpt) {
+    writeErr(`dz setup: --target required (${TARGET_NAMES_SORTED.join(', ')})`);
+    return 1;
+  }
+  const setupResolution = resolveTargetName(targetOpt);
+  if (setupResolution.kind === 'unknown') {
+    for (const line of formatTargetProblem('dz setup', setupResolution)) writeErr(line);
     return 1;
   }
+  const target = setupResolution.target;
+  if (setupResolution.via === 'alias') writeErr(formatTargetAliasNote('dz setup', targetOpt, target));
 
   const projectRoot = resolve(cwd, options.get('project') ?? '.');
   const presetName = options.get('preset');
@@ -3955,6 +4156,17 @@ async function cmdSetup(options: Map<string, string>, flags: Set<string>, cwd: s
     write(`║     (no skills resolved)                              ║`);
   }
 
+  // Step 5 (ADR-001 §8): DELIVER the codex hooks and verify them live. Non-aborting — the rest of
+  // setup has already run and the summary still prints; only the exit code carries the failure.
+  let codexHooksOk = true;
+  if (target === 'codex' && !flags.has('no-hooks')) {
+    write(`║  5. Delivering codex hooks (live verify)...           ║`);
+    const delivery = deliverCodexHooks({ project: projectRoot, verify: !flags.has('no-verify') }, undefined, 'dz setup');
+    codexHooksOk = delivery.ok;
+    for (const line of delivery.stdout) write(line);
+    for (const line of delivery.stderr) writeErr(line);
+  }
+
   write(`╠══════════════════════════════════════════════════════╣`);
   write(`║  Setup: ${String(setupResult.completed).padStart(2)} done, ${String(setupResult.skipped).padStart(2)} skipped                     ║`);
   // Honest label derived from the ACTUAL wiring (runSetup's 'agentdb wiring' invariant check),
@@ -3974,7 +4186,9 @@ async function cmdSetup(options: Map<string, string>, flags: Set<string>, cwd: s
       + (install.dirsSearched > 1 ? `  (searched ${install.dirsSearched} skill dirs)` : ''));
     writeMissingSkillsHint(write, install.missing, selectArg !== undefined ? undefined : preset);
   }
-  return 0;
+  // A hook that was written but never witnessed firing is NOT a completed setup (ADR-002 §5): the
+  // step is reported failed, the process was not aborted.
+  return codexHooksOk ? 0 : 1;
 }
 
 function cmdPretrain(options: Map<string, string>, cwd: string, write: Write): number {
@@ -4089,12 +4303,17 @@ function cmdRecommend(options: Map<string, string>, cwd: string, write: Write):
   return 0;
 }
 
-function cmdUpgrade(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+function cmdUpgrade(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write, writeErr: WriteErr): number {
   const targetOpt = options.get('target') ?? 'claude-code';
-  if (!isTargetName(targetOpt)) {
-    write(`dz upgrade: --target must be one of: ${TARGET_NAMES.join(', ')}`);
+  const upgradeResolution = resolveTargetName(targetOpt);
+  if (upgradeResolution.kind === 'unknown') {
+    for (const line of formatTargetProblem('dz upgrade', upgradeResolution)) writeErr(line);
     return 1;
   }
+  // The dir map is keyed by the RESOLVED name — keying it by the raw `--target` would
+  // let an alias validate and then miss the map.
+  const upgradeTarget = upgradeResolution.target;
+  if (upgradeResolution.via === 'alias') writeErr(formatTargetAliasNote('dz upgrade', targetOpt, upgradeTarget));
   const projectRoot = resolve(cwd, options.get('project') ?? '.');
   const targetDirMap: Record<string, string> = {
     'claude-code': '.claude/skills', codex: '.agents/skills', opencode: '.opencode/skills',
@@ -4102,9 +4321,9 @@ function cmdUpgrade(options: Map<string, string>, flags: Set<string>, cwd: strin
     'agents-md': 'AGENTS.md', cursor: '.cursor/rules', gemini: 'GEMINI.md',
     windsurf: '.windsurf/rules',
   };
-  const mappedDir = targetDirMap[targetOpt];
+  const mappedDir = targetDirMap[upgradeTarget];
   if (mappedDir === undefined) {
-    write(`dz upgrade: no skills directory mapping for target ${targetOpt}`);
+    write(`dz upgrade: no skills directory mapping for target ${upgradeTarget}`);
     return 1;
   }
   const targetDir = join(projectRoot, mappedDir);
@@ -4122,7 +4341,7 @@ function cmdUpgrade(options: Map<string, string>, flags: Set<string>, cwd: strin
 
   const report = checkUpgrades(targetDir, canonicalDirs);
 
-  write(`\ndz upgrade — ${targetOpt} (${targetDir})`);
+  write(`\ndz upgrade — ${upgradeTarget} (${targetDir})`);
   write(`  Installed: ${report.installed}  Needs update: ${report.needsUpdate}  Up-to-date: ${report.upToDate}  Custom: ${report.notInCanonical}\n`);
 
   for (const check of report.skills) {
@@ -4131,7 +4350,7 @@ function cmdUpgrade(options: Map<string, string>, flags: Set<string>, cwd: strin
   }
 
   if (report.needsUpdate > 0) {
-    write(`\n${report.needsUpdate} skill(s) need update. Run: dz init --target ${targetOpt} --force`);
+    write(`\n${report.needsUpdate} skill(s) need update. Run: dz init --target ${upgradeTarget} --force`);
   }
   // ADR-001 (verify-apply-leg): verify what we just left on disk. A TAMPERED pack aborts.
   const sigFatal = reportPackVerification(projectRoot, options.get('pubkey'), flags.has('require-signing'), write);
@@ -4675,7 +4894,7 @@ function cmdPublish(options: Map<string, string>, flags: Set<string>, cwd: strin
 /*  ADR-001): computed from the declarative model, never hand-written  */
 /* ------------------------------------------------------------------ */
 
-function cmdParity(options: Map<string, string>, flags: Set<string>, write: Write): number {
+function cmdParity(options: Map<string, string>, flags: Set<string>, write: Write, writeErr: WriteErr): number {
   const json = flags.has('json');
   if (flags.has('help')) {
     write('dz parity [--target <name>] [--json] — the computed feature×target map (never hand-written)');
@@ -4704,34 +4923,79 @@ function cmdParity(options: Map<string, string>, flags: Set<string>, write: Writ
   }
 
   const matrix = buildParityMatrix();
-  const target = options.get('target');
-  if (target !== undefined && !TARGET_NAMES.includes(target as (typeof TARGET_NAMES)[number])) {
-    if (json) write(JSON.stringify({ error: `unknown target "${target}"`, targets: TARGET_NAMES, exitCode: 1 }, null, 2));
-    else write(`dz parity: unknown target "${target}" — one of: ${TARGET_NAMES.join(', ')}`);
-    return 1;
+  // EVIDENCE staleness, folded into the report (fix round 2, R2-3). Derived from the records
+  // themselves — no `codex --version`, no subprocess, so `dz parity` stays a deterministic function
+  // of the model. A cell whose deciding form rests on a transcript that is older than the newest
+  // recording for the SAME target is reported `inconclusive`, never `full`: the round-1 gate could
+  // already tell, and nothing a user runs was asking it.
+  const staleEvidence = findStaleTranscriptEvidence();
+  const staleByTarget = new Map<string, RuntimeCapability[]>();
+  for (const s of staleEvidence) staleByTarget.set(s.target, [...(staleByTarget.get(s.target) ?? []), s.capability]);
+  const reportCell = (feature: ParityFeature, t: TargetName, cell: ParityCell): ParityReportCell =>
+    downgradeForStaleEvidence(feature, cell, staleByTarget.get(t) ?? []);
+  const staleNote = (t: TargetName): string[] =>
+    staleEvidence
+      .filter((s) => s.target === t)
+      .map((s) => `  ⚠ ${s.capability}: evidence recorded on ${s.recordedVersion ?? '(no runtime version recorded)'}, newest recording for this target is ${s.probedVersion ?? '(none)'} — INCONCLUSIVE until re-probed (${s.evidence ?? ''})`);
+  // Site 8 of the D3 rewiring, closed in fix round 1 (QE F1). It shipped spelling its
+  // own bare guard `TARGET_NAMES.includes(...)` and was therefore invisible to the AM-2
+  // grep-guard, which searched for the token `isTargetName(` — a PRESENCE check on one
+  // spelling where the property was "no call site bypasses the resolver". The guard in
+  // `test/target-alias-cli.test.ts` now checks the class, and the sweep list is derived
+  // from the help text so a ninth command cannot be missed the same way.
+  const targetOpt = options.get('target');
+  let target: TargetName | undefined;
+  if (targetOpt !== undefined) {
+    const parityResolution = resolveTargetName(targetOpt);
+    if (parityResolution.kind === 'unknown') {
+      // Both forms go to stderr: an error is not data, and `dz parity --json | jq`
+      // must not be fed a diagnostic (ADR-002 §Decision 2 / driver D6).
+      if (json) {
+        writeErr(JSON.stringify({ error: `unknown target ${JSON.stringify(targetOpt)}`, suggestion: parityResolution.suggestion, targets: TARGET_NAMES_SORTED, exitCode: 1 }, null, 2));
+      } else {
+        for (const line of formatTargetProblem('dz parity', parityResolution)) writeErr(line);
+      }
+      return 1;
+    }
+    target = parityResolution.target;
+    if (parityResolution.via === 'alias') writeErr(formatTargetAliasNote('dz parity', targetOpt, target));
   }
 
   if (json) {
-    const rows = matrix.map((r) => ({
-      id: r.feature.id,
-      title: r.feature.title,
-      cells: target !== undefined ? { [target]: r.cells[target as (typeof TARGET_NAMES)[number]] } : r.cells,
-    }));
+    const shown = target !== undefined ? [target] : TARGET_NAMES;
+    const rows = matrix.map((r) => {
+      const cells: Record<string, ParityReportCell> = {};
+      for (const t of shown) cells[t] = reportCell(r.feature, t, r.cells[t]);
+      return { id: r.feature.id, title: r.feature.title, cells };
+    });
     // A filtered response stays internally consistent: capabilities are filtered too (Codex QE gap 9).
-    const caps = target !== undefined ? { [target]: TARGET_CAPABILITIES[target as (typeof TARGET_NAMES)[number]] } : TARGET_CAPABILITIES;
-    write(JSON.stringify({ targets: target !== undefined ? [target] : TARGET_NAMES, capabilities: caps, features: rows }, null, 2));
+    const caps = target !== undefined ? { [target]: TARGET_CAPABILITIES[target] } : TARGET_CAPABILITIES;
+    write(JSON.stringify({
+      targets: shown,
+      capabilities: caps,
+      // The evidence axis travels WITH the matrix: a consumer that reads `level` must be able to
+      // read why a cell is inconclusive without a second command.
+      staleEvidence: staleEvidence.filter((sv) => shown.includes(sv.target)),
+      features: rows,
+    }, null, 2));
     return 0;
   }
 
   if (target !== undefined) {
-    const t = target as (typeof TARGET_NAMES)[number];
+    const t = target;
     write(`\ndz parity — ${t}  (capabilities: ${TARGET_CAPABILITIES[t].join(', ')})\n`);
     for (const r of matrix) {
-      const c = r.cells[t];
-      const icon = c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : '—';
-      write(`  ${icon} ${r.feature.title.padEnd(58)} ${c.level === 'none' ? 'not available on this target' : `via ${c.via ?? ''}`}`);
-    }
-    write('\n  ✓ full (the complete experience)   ◐ manual (works, you drive it by hand)   — not available');
+      const c = reportCell(r.feature, t, r.cells[t]);
+      const icon = c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : c.level === 'inconclusive' ? '?' : '—';
+      const detail = c.level === 'none'
+        ? 'not available on this target'
+        : c.level === 'inconclusive'
+          ? `via ${c.via ?? ''} — INCONCLUSIVE: stale evidence for ${(c.staleEvidence ?? []).join(', ')}`
+          : `via ${c.via ?? ''}`;
+      write(`  ${icon} ${r.feature.title.padEnd(58)} ${detail}`);
+    }
+    write('\n  ✓ full (the complete experience)   ◐ manual (works, you drive it by hand)   ? evidence stale (re-probe)   — not available');
+    for (const line of staleNote(t)) write(line);
     return 0;
   }
 
@@ -4742,8 +5006,8 @@ function cmdParity(options: Map<string, string>, flags: Set<string>, write: Writ
   write(`  ${'feature'.padEnd(52)} ${TARGET_NAMES.map((t) => (short[t] ?? t).padStart(4)).join('')}`);
   for (const r of matrix) {
     const cells = TARGET_NAMES.map((t) => {
-      const c = r.cells[t];
-      return (c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : '—').padStart(4);
+      const c = reportCell(r.feature, t, r.cells[t]);
+      return (c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : c.level === 'inconclusive' ? '?' : '—').padStart(4);
     }).join('');
     write(`  ${r.feature.title.slice(0, 52).padEnd(52)} ${cells}`);
   }
@@ -5690,6 +5954,361 @@ function readDriftAllowlist(root: string): string[] {
   }
 }
 
+/** Refresh or verify the root AGENTS.md bearing-policy projection. */
+/**
+ * `dz hooks-sync --target codex` (`crossrt-2-codex-hooks`, AM-14).
+ *
+ * ONE verb in the existing target vocabulary (`parity`, `delivery-check`, `--target`), extensible to
+ * a future runtime without a third surface. **No alias** — `dz codex-hooks` resolves to nothing.
+ *
+ * Exit map (ADR-002 §5, pinned by test):
+ *   0 = `armed` AND `trust: 'trusted'` — the ONLY outcome that may print a success word (AM-17)
+ *   1 = not armed, armed-but-trust-pending, drift, or a refusal
+ *   3 = inconclusive (including "no codex binary on PATH")
+ */
+function cmdHooksSync(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+  writeErr: WriteErr,
+): number {
+  const json = flags.has('json');
+  const usage = 'dz hooks-sync --target codex [--check] [--verify] [--remove] [--json] [--project <dir>] [--no-verify]';
+  if (flags.has('help')) {
+    write(`${usage} — install/verify the dz veto + recall hooks in $CODEX_HOME/hooks.json`);
+    return 0;
+  }
+  for (const flag of flags) {
+    if (!['check', 'verify', 'no-verify', 'remove', 'json', 'help'].includes(flag)) {
+      const message = `dz hooks-sync: unknown option --${flag}\n${usage}`;
+      (json ? write : writeErr)(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : message);
+      return 1;
+    }
+  }
+  for (const key of options.keys()) {
+    if (key !== 'target' && key !== 'project' && key !== 'codex-home') {
+      const message = key.startsWith('_positional_') ? `unexpected argument ${JSON.stringify(options.get(key))}` : `unknown option --${key}`;
+      (json ? write : writeErr)(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz hooks-sync: ${message}\n${usage}`);
+      return 1;
+    }
+  }
+  // Every `--target` read in this CLI goes through resolveTargetName (alias support + one spelling
+  // of the unknown-target message), pinned by `everyTargetGuardUsesResolveTargetName`.
+  const targetOpt = options.get('target');
+  if (targetOpt === undefined) {
+    const message = '--target is required';
+    (json ? write : writeErr)(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz hooks-sync: ${message}\n${usage}`);
+    return 1;
+  }
+  const resolution = resolveTargetName(targetOpt);
+  if (resolution.kind === 'unknown') {
+    if (json) {
+      write(JSON.stringify({ error: `unknown target ${targetOpt}`, exitCode: 1 }));
+    } else {
+      for (const line of formatTargetProblem('dz hooks-sync', resolution)) writeErr(line);
+    }
+    return 1;
+  }
+  const target = resolution.target;
+  if (resolution.via === 'alias') writeErr(formatTargetAliasNote('dz hooks-sync', targetOpt, target));
+  if (target !== 'codex') {
+    // Deliberately narrow: only Codex has a hook carrier today. Naming the reason keeps a future
+    // reader from assuming the other nine are simply unimplemented here.
+    const message = `unsupported --target ${target} (only "codex" has a hook carrier today)`;
+    (json ? write : writeErr)(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz hooks-sync: ${message}\n${usage}`);
+    return 1;
+  }
+
+  const codexHome = options.get('codex-home');
+  const projectOpt = options.get('project');
+  // `--no-verify` wins over `--verify`: an explicit refusal to measure is never overridden by the
+  // flag that asks for a measurement.
+  const report = runSyncCodexHooksGuarded(
+    codexHooksSyncOptions({
+      ...(codexHome !== undefined ? { codexHome } : {}),
+      ...(projectOpt !== undefined ? { project: resolve(cwd, projectOpt) } : {}),
+      check: flags.has('check'),
+      remove: flags.has('remove'),
+      verify: !flags.has('no-verify'),
+    }),
+  );
+
+  if (json) {
+    write(JSON.stringify({ ...report, exitCode: report.exitCode }));
+    return report.exitCode;
+  }
+
+  for (const err of report.errors) writeErr(`dz hooks-sync: ${err}`);
+  for (const warn of report.warnings) writeErr(`dz hooks-sync: warning: ${warn}`);
+
+  // SILENT in a home that never opted in — the leg-1 F12 lesson: a --check that chatters in every
+  // unrelated project trains its reader to ignore it.
+  if (flags.has('check') && !report.installed && report.errors.length === 0) return report.exitCode;
+
+  if (flags.has('remove')) {
+    write(`dz hooks-sync: removed ${report.removed} managed entr(ies) from ${report.registryPath}`);
+    return report.exitCode;
+  }
+
+  // AM-17 / G-G: the success word is reachable ONLY from `report.ready` — armed AND trusted AND
+  // WITNESSED blocking by a live, non-bypassed probe. The pre-fix version printed it off
+  // `exitCode === 0 && trust && installed`, none of which is evidence that the guard fires.
+  const summary = codexHooksSummary(report);
+  for (const line of summary.stdout) write(line);
+  for (const line of summary.stderr) writeErr(line);
+  return report.exitCode;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Codex hook DELIVERY — one implementation, three call sites                  */
+/* -------------------------------------------------------------------------- */
+
+export interface CodexHooksSyncInput {
+  readonly codexHome?: string | undefined;
+  readonly project?: string | undefined;
+  readonly check?: boolean;
+  readonly remove?: boolean;
+  /** `false` = the user's `--no-verify`. Anything else runs the live probe. */
+  readonly verify?: boolean;
+}
+
+/**
+ * The argv → operation mapping, extracted so it can be PINNED.
+ *
+ * It is the mapping that was broken: `--verify`, `--no-verify` and `--project` were parsed,
+ * validated, listed in the usage line — and then never reached `runSyncCodexHooks`, so the CRITICAL
+ * finding (a `ready` with no live proof behind it) lived entirely in three missing object keys.
+ * A function that returns the options object is testable without a codex binary; an inline literal
+ * is not.
+ */
+export function codexHooksSyncOptions(input: CodexHooksSyncInput): Parameters<typeof runSyncCodexHooks>[0] {
+  return {
+    ...(input.codexHome !== undefined ? { codexHome: input.codexHome } : {}),
+    ...(input.project !== undefined ? { project: input.project } : {}),
+    check: input.check === true,
+    remove: input.remove === true,
+    verify: input.verify !== false,
+  };
+}
+
+export interface CodexHooksSummary {
+  readonly ok: boolean;
+  readonly stdout: readonly string[];
+  readonly stderr: readonly string[];
+}
+
+/**
+ * What the user is told about a sync report — the ONE place the success word can be printed.
+ *
+ * `report.ready` is the whole gate: installed ∧ executable ∧ trusted ∧ a live, non-bypassed probe
+ * that WITNESSED our block. Nothing else may print "ready" (AM-17 / G-G), and `--no-verify` never
+ * can, because it never measured.
+ */
+export function codexHooksSummary(report: CodexHooksSyncReport, label = 'dz hooks-sync'): CodexHooksSummary {
+  const stdout: string[] = [];
+  const stderr: string[] = [];
+  if (report.ready) {
+    stdout.push(`${label}: codex hooks installed and ARMED (trust: ${report.trust}) — VERIFIED by a live veto probe — ready`);
+    return { ok: true, stdout, stderr };
+  }
+  if (report.installed) {
+    const verdict = report.verify === null ? 'not verified (no live probe ran)' : `${report.verify.verdict} — ${report.verify.reason}`;
+    // Say what the report ESTABLISHED, not a hopeful summary of it: `installed+trusted` used to
+    // print verbatim even when the same line went on to report `trust: unknown` (the re-QE's
+    // non-closure note). A message that argues with its own parenthesis teaches the reader to skip
+    // the parenthesis.
+    const established = report.trust === 'trusted' ? 'installed+trusted' : `installed, trust ${report.trust}`;
+    stderr.push(`${label}: ${established}, NOT verified — ARMED = NO (trust: ${report.trust}, executable: ${report.executable}, verify: ${verdict})`);
+    stderr.push('→ open an interactive Codex session in this directory, approve the two dz hooks, then re-run `dz hooks-sync --target codex --verify`');
+  } else {
+    stderr.push(`${label}: ARMED = NO — the managed entries are not present in the registry`);
+  }
+  return { ok: false, stdout, stderr };
+}
+
+/**
+ * ADR-001 §8: `dz setup` and `dz init --target codex` DELIVER the hooks and verify them.
+ *
+ * Non-aborting by contract (ADR-002 D6): the caller keeps going and folds `ok` into its own exit
+ * code. Before this round no production path called `runSyncCodexHooks` at all — the operation, its
+ * classifier and its exit map existed and were reachable only from the dedicated command
+ * (independent review, finding 2).
+ */
+/**
+ * Serialize dz's own `hooks.json` read-merge-write behind the `codex-hooks` named lock
+ * (feature qe-bridge-claude, ADR-001 D4-A — the exit condition of the accepted degradation in
+ * `architecture/degradations.md`).
+ *
+ * The lock lives BESIDE the registry it guards (`$CODEX_HOME/.dz/locks/codex-hooks.lock`), not in
+ * this repo: two dz processes running from two different worktrees share a `CODEX_HOME`, not a
+ * project root, so a lock under the project would serialize nothing.
+ *
+ * READ-ONLY runs (`--check`) are NOT locked: they write nothing, and a check that can be blocked by
+ * a writer would be a new failure mode in exchange for no guarantee.
+ *
+ * HONEST LIMIT: this is an ADVISORY lock. It serializes dz-side writers only; a foreign installer
+ * (ruvnet-brain ships its own Codex hooks bundle) never takes it. For that case the pre-existing
+ * mitigations remain the backstop — foreign entries preserved byte-for-byte, a timestamped backup
+ * before every modifying write, and atomic temp+rename so no reader sees a partial file.
+ */
+function runSyncCodexHooksLocked(options: Parameters<typeof runSyncCodexHooks>[0] = {}): CodexHooksSyncReport {
+  if (options?.check === true) return runSyncCodexHooks(options);
+  const codexHome = resolveCodexHome(options?.codexHome);
+  // AM-35a is a SHIPPED property with a test: a run that refuses (no `codex` on PATH) must leave
+  // CODEX_HOME untouched — dz does not create user-global state for a runtime that is not there.
+  // Taking the lock creates `<codexHome>/.dz/locks/`, so when the guarded operation turned out to
+  // write nothing, the lock scaffolding is removed again (empty-dir removals only: a directory that
+  // still holds another process's live lock simply refuses to go).
+  const preexisting = existsSync(join(codexHome, '.dz'));
+  const tidyLockScaffold = (report: CodexHooksSyncReport): void => {
+    if (preexisting || report.written || report.writes.length > 0) return;
+    for (const dir of [join(codexHome, '.dz', 'locks'), join(codexHome, '.dz')]) {
+      try {
+        rmdirSync(dir);
+      } catch { /* non-empty (someone else's lock) or gone — leave it */ }
+    }
+  };
+  // ROUND-2 C2: the lock now wraps ONLY the registry read-plan-write transaction, passed in as the
+  // operation's `criticalSection` seam. It used to wrap the WHOLE operation, including a live veto
+  // probe that can block for ~300s — ten times the 30s stale threshold, after which a waiter is
+  // entitled to break the lock and the holder is no longer excluding anyone. The probes mutate
+  // nothing shared, so they run unlocked by design.
+  let lockError: Error | null = null;
+  const report = runSyncCodexHooks({
+    ...options,
+    criticalSection: <T>(fn: () => T): T => {
+      try {
+        return withNamedLockSync(codexHome, 'codex-hooks', fn);
+      } catch (error) {
+        if (error instanceof NamedLockTimeoutError || error instanceof NamedLockCompromisedError) {
+          lockError = error;
+          throw error;
+        }
+        throw error;
+      }
+    },
+  });
+  tidyLockScaffold(report);
+  if (lockError !== null) throw lockError;
+  return report;
+}
+
+/** Wrap the delivery so a lock refusal becomes a REPORT (loud, nothing written), not a stack trace. */
+function runSyncCodexHooksGuarded(options: Parameters<typeof runSyncCodexHooks>[0] = {}): CodexHooksSyncReport {
+  const codexHome = resolveCodexHome(options?.codexHome);
+  try {
+    return runSyncCodexHooksLocked(options);
+  } catch (error) {
+    if (error instanceof NamedLockTimeoutError || error instanceof NamedLockCompromisedError) {
+      const why = error instanceof NamedLockTimeoutError
+        ? `another dz process is writing ${join(codexHome, 'hooks.json')} (${error.message}) — NOTHING was written; retry once it finishes`
+        : `the codex-hooks lock was broken while this run held it (${error.message}) — the registry write may have raced; re-run and re-verify`;
+      return {
+        codexHome,
+        registryPath: join(codexHome, 'hooks.json'),
+        installed: false,
+        executable: false,
+        written: false,
+        removed: 0,
+        foreignPreserved: 0,
+        unattributable: 0,
+        drift: [],
+        trust: 'unknown',
+        codexVersion: null,
+        writes: [],
+        verify: null,
+        verified: false,
+        ready: false,
+        exitCode: 1,
+        warnings: [],
+        errors: [why],
+      };
+    }
+    throw error;
+  }
+}
+
+export function deliverCodexHooks(
+  input: CodexHooksSyncInput,
+  sync: (options: Parameters<typeof runSyncCodexHooks>[0]) => CodexHooksSyncReport = runSyncCodexHooksGuarded,
+  label = 'dz setup',
+): CodexHooksSummary & { readonly report: CodexHooksSyncReport } {
+  const report = sync(codexHooksSyncOptions(input));
+  const summary = codexHooksSummary(report, label);
+  const stderr = [...report.errors.map((e) => `${label}: ${e}`), ...report.warnings.map((w) => `${label}: warning: ${w}`), ...summary.stderr];
+  return { ok: summary.ok, stdout: summary.stdout, stderr, report };
+}
+
+function cmdAgentsSync(
+  options: Map<string, string>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+  writeErr: WriteErr,
+): number {
+  const json = flags.has('json');
+  const usage = 'dz agents-sync [--project <dir>] [--check] [--json]';
+  if (flags.has('help')) {
+    write(`${usage} — sync/verify the dz:policies fence in root AGENTS.md`);
+    return 0;
+  }
+  for (const flag of flags) {
+    if (!['check', 'json', 'help'].includes(flag)) {
+      const message = `dz agents-sync: unknown option --${flag}\n${usage}`;
+      (json ? write : writeErr)(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : message);
+      return 1;
+    }
+  }
+  for (const key of options.keys()) {
+    if (key !== 'project') {
+      const message = key.startsWith('_positional_') ? `unexpected argument ${JSON.stringify(options.get(key))}` : `unknown option --${key}`;
+      (json ? write : writeErr)(json ? JSON.stringify({ error: message, exitCode: 1 }) : `dz agents-sync: ${message}\n${usage}`);
+      return 1;
+    }
+  }
+
+  const root = resolve(cwd, options.get('project') ?? '.');
+  try {
+    const report = runSyncAgentsPolicy({ projectRoot: root, check: flags.has('check') });
+    const drifted = report.drift.filter((finding) => finding.status !== 'ok');
+    const inconclusive = report.missing.length > 0;
+    const failed = flags.has('check')
+      ? report.changed || report.budget.overflow || drifted.length > 0
+      : !report.inSync;
+    const exitCode = inconclusive ? 3 : failed ? 1 : 0;
+    if (json) {
+      write(JSON.stringify({ ...report, sections: report.blocks, exitCode }));
+      return exitCode;
+    }
+    if (inconclusive) {
+      writeErr(`dz agents-sync: INCONCLUSIVE — unreadable or unanchored policy source(s): ${report.missing.join(', ')}`);
+      writeErr('→ heal with: restore the named source anchors, then run dz agents-sync');
+      return 3;
+    }
+    if (failed) {
+      const effect = flags.has('check') ? 'AGENTS.md would change' : 'AGENTS.md was not rewritten';
+      writeErr(`dz agents-sync: DRIFT — ${drifted.length} stale/missing section(s); ${effect}`);
+      for (const finding of drifted) writeErr(`  ${finding.id}: ${finding.file} (${finding.status})`);
+      if (drifted.some((finding) => finding.id === 'dz:policies')) {
+        writeErr('→ heal with: repair duplicate/unmatched dz:policies markers, then run dz agents-sync');
+      } else {
+        writeErr('→ heal with: dz agents-sync');
+      }
+      return 1;
+    }
+    const verb = report.written ? 'wrote' : 'in sync';
+    write(`dz agents-sync: ${verb} — ${report.blocks.length} policy section(s), ${report.budget.bytes} bytes (${report.budget.pct}% of ${report.budget.cap})`);
+    for (const warning of report.warnings) writeErr(`dz agents-sync: warning: ${warning}`);
+    return 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (json) write(JSON.stringify({ error: message, exitCode: 1 }));
+    else writeErr(`dz agents-sync: ${message}`);
+    return 1;
+  }
+}
+
 function cmdDriftCheck(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   const root = resolve(cwd, options.get('project') ?? '.');
   // Default scope = PUBLISHED packages only: the `.claude/skills` dogfood copies legitimately lag the
@@ -5803,6 +6422,31 @@ function gatherReadmeCounts(root: string): { label: string; a: number; b: number
 function gatherGuardFacts(op: string, root: string, text: string | undefined, storeCap: number): Record<string, unknown> {
   const facts: Record<string, unknown> = { op };
   if (op === 'publish') {
+    // agents-md-policy-sync: fixed registry, no tree walk. The pure detector
+    // recomputes every expected hash from current source text; this gatherer
+    // only supplies bytes. Any unexpected gather failure omits the fact, and
+    // evaluateGuard records that advisory coverage gap in `notes`.
+    try {
+      const policyFiles = new Map<string, string | null>();
+      for (const file of new Set(POLICY_SOURCES.map((source) => source.file))) {
+        try { policyFiles.set(file, readFileSync(join(root, file), 'utf8')); }
+        catch { policyFiles.set(file, null); }
+      }
+      let agentsMd: string | null = null;
+      try { agentsMd = readFileSync(join(root, 'AGENTS.md'), 'utf8'); } catch { /* missing stamp evidence */ }
+      const policyDrift = detectPolicyDrift(policyFiles, agentsMd, POLICY_SOURCES);
+      facts['policyDrift'] = {
+        applicable: policyDrift.applicable,
+        // Did this repo OPT IN? A `dz:policies` fence in AGENTS.md is the only durable signal that
+        // someone ran `dz agents-sync` here. Without it the advisory rule is out of scope and stays
+        // silent; with it, unreadable sources become a loud note instead of a silent skip.
+        fenced: hasPolicyFence(agentsMd),
+        drifted: policyDrift.findings
+          .filter((finding) => finding.status !== 'ok')
+          .map((finding) => `${finding.id}:${finding.file}:${finding.status}`),
+      };
+    } catch { /* unexpected gather failure — omission becomes a visible guard note */ }
+
     // Read every workspace manifest ONCE: build a name→version map, then resolve each `workspace:*` dep to the
     // version pnpm WOULD publish it as. In a pnpm workspace (pnpm-workspace.yaml present) `workspace:*` in source
     // is correct and gets rewritten at publish — so reporting it raw would be a FALSE gate. We mirror the rewrite:
@@ -6837,7 +7481,7 @@ async function cmdRetro(options: Map<string, string>, flags: Set<string>, cwd: s
  *   --from-spec <spec.json>    preview the scaffold (create / augment per file); the SKILL fills the spec
  *   --apply                    with --from-spec: WRITE (create missing, AUGMENT existing — never clobber)
  */
-function cmdFeatureAdrSetup(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
+function cmdFeatureAdrSetup(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write, writeErr: WriteErr): number {
   let repoRoot = cwd;
   try { repoRoot = execSync('git rev-parse --show-toplevel', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || cwd; } catch { /* not git */ }
 
@@ -6856,11 +7500,24 @@ function cmdFeatureAdrSetup(options: Map<string, string>, flags: Set<string>, cw
   // Its "runnable here" list is computed for --target (default agents-md, the AGENTS.md-class target class).
   const wantGates = flags.has('gates');
   const targetOpt = options.get('target');
-  if (targetOpt !== undefined && !isTargetName(targetOpt)) {
-    write(`dz feature-adr-setup: --target must be one of: ${TARGET_NAMES.join(', ')}`);
-    return 1;
+  // Sites 7 AND 8 of the D3 rewiring. Site 8 (the coercion below) is NOT a guard — it
+  // is a silent fallback, and a mechanical "replace isTargetName with resolveTargetName"
+  // pass would miss it. With aliasing in place and the coercion left alone,
+  // `dz feature-adr-setup --gates --target claude` would pass validation and then emit
+  // for **agents-md**. So the coercion CONSUMES the resolution computed once, above;
+  // `agents-md` is the default only when `--target` is ABSENT.
+  let gatesTarget: TargetName = 'agents-md';
+  if (targetOpt !== undefined) {
+    const gatesResolution = resolveTargetName(targetOpt);
+    if (gatesResolution.kind === 'unknown') {
+      for (const line of formatTargetProblem('dz feature-adr-setup', gatesResolution)) writeErr(line);
+      return 1;
+    }
+    gatesTarget = gatesResolution.target;
+    if (gatesResolution.via === 'alias') {
+      writeErr(formatTargetAliasNote('dz feature-adr-setup', targetOpt, gatesTarget));
+    }
   }
-  const gatesTarget: TargetName = isTargetName(targetOpt ?? '') ? (targetOpt as TargetName) : 'agents-md';
 
   const specPath = options.get('from-spec');
   if (specPath === undefined && !wantGuards && !wantGates) {
@@ -6976,7 +7633,15 @@ function cmdChallenge(options: Map<string, string>, flags: Set<string>, cwd: str
  *   --base <ref>                    the base ref to fail against (default HEAD)
  *   --name '<filter>'               optional -t test-name filter applied to every target
  *   --runner '<cmd>'                test runner (default `npx vitest run`)
- *   --json                          machine-readable {plan, results, verdict, finding}
+ *   --timeout <ms>                  per-run timeout (default 300000; a timed-out run is CANNOT_ISOLATE)
+ *   --json                          machine-readable {plan, results, tipTree, perTest, aggregate,
+ *                                   findings, measurementValid, primaryAction}
+ *
+ * This executor is THIN by design (house style: pure classifier + thin executor). It performs exactly the
+ * I/O the pure gate cannot — stat, worktree, run, capture — and hands OBSERVATIONS back. It no longer
+ * interprets anything: the pre-epoch load-error regex that lived here (`/cannot find module|failed to
+ * load|.../i`) is DELETED, because a regex over a runner's stderr, written in the executor, is exactly the
+ * probabilistic channel that minted `DISCRIMINATES` for `--runner false`.
  *
  * NEVER auto-aborts: a non-discriminating (false-green) test is reported as a HIGH finding for the owner to
  * decide (dz's rule — a false gate kills trust). Exit code is 0 on a clean run regardless of verdict; 2 only on
@@ -6996,6 +7661,9 @@ function cmdDiscriminationCheck(options: Map<string, string>, flags: Set<string>
     nameFilter !== undefined && nameFilter.trim() !== '' ? { file, name: nameFilter.trim() } : { file });
   const baseRef = options.get('base') ?? 'HEAD';
   const runnerOpt = options.get('runner');
+  // R11: a hung runner is a loud non-answer, never a pass. Same default + parse shape as mutation-gate.
+  const timeoutOpt = Number(options.get('timeout') ?? '300000');
+  const timeoutMs = Number.isFinite(timeoutOpt) && timeoutOpt > 0 ? timeoutOpt : 300000;
 
   const plan = planDiscriminationCheck(runnerOpt !== undefined ? { baseRef, propertyTests, runner: runnerOpt } : { baseRef, propertyTests });
 
@@ -7009,82 +7677,186 @@ function cmdDiscriminationCheck(options: Map<string, string>, flags: Set<string>
     return 0;
   }
 
-  // Execute the plan in a temp worktree WE own; substitute {{WORKTREE}} and always clean up.
-  // `git worktree add` must CREATE the path, so compute a fresh non-existent one (do NOT mkdtemp it).
-  const worktree = join(mkdtempSync(join(tmpdir(), 'dz-disc-')), 'wt');
-  const results: { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' }[] = [];
-  try {
-    // 1) add the detached worktree at base (git creates `worktree`; its parent already exists).
-    const addCmd = plan.commands[0]!.replace(/\{\{WORKTREE\}\}/g, worktree);
-    execSync(addCmd, { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' });
-
-    // 1b) a fresh worktree has NO node_modules — without this, every test fails to load (runner + deps
-    // unresolvable) and the gate collapses to always-VIA_ERROR, blind to false greens. Absolute-path
-    // symlinks point back at the main checkout's already-installed trees, robust across pnpm's layout.
-    const linkNodeModules = (relDir: string): void => {
-      const srcNm = join(repoRoot, relDir, 'node_modules');
-      if (!existsSync(srcNm)) return;
-      const dstNm = join(worktree, relDir, 'node_modules');
-      if (existsSync(dstNm)) return;
-      try { mkdirSync(dirname(dstNm), { recursive: true }); symlinkSync(srcNm, dstNm, 'dir'); } catch { /* best effort */ }
-    };
-    linkNodeModules('.'); // root (hoisted deps + .bin)
-    const pkgDirs = new Set<string>();
-    for (const t of plan.targets) {
-      let d = dirname(t.file);
-      while (d && d !== '.' && d !== sep) {
-        if (existsSync(join(repoRoot, d, 'package.json'))) { pkgDirs.add(d); break; }
-        d = dirname(d);
+  // ── (1) stat + isFile, BEFORE the worktree (AM-6 / FR-A1) ──────────────────────────────────
+  // R12: `stat` FOLLOWS symlinks on purpose. A dangling symlink lstat-exists but has no readable
+  // content — that IS absence of the named check. A directory stat-exists but is not a regular
+  // file. Pre-epoch both reached the copy step, threw, and were caught into `outcome:'error'`,
+  // which minted the near-pass DISCRIMINATES_VIA_ERROR (MEASURED — acid A1 / the dangling-symlink
+  // and directory rows of features/wave1-instrument-repair/07_code_changes/acid-red-runs.md).
+  const absent: { file: string; name?: string; outcome: 'absent'; evidence?: ExecutionEvidence }[] = [];
+  const present: { file: string; name?: string }[] = [];
+  for (const t of plan.targets) {
+    let isRegular = false;
+    let isDirectory = false;
+    try {
+      const st = statSync(resolve(repoRoot, t.file));
+      isRegular = st.isFile();
+      isDirectory = st.isDirectory();
+    } catch { /* ENOENT / dangling symlink / permission — absence, either way */ }
+    if (isRegular) { present.push(t.name !== undefined ? { file: t.file, name: t.name } : { file: t.file }); continue; }
+    const row = t.name !== undefined ? { file: t.file, name: t.name, outcome: 'absent' as const } : { file: t.file, outcome: 'absent' as const };
+    // Out-of-band detail channel: TEST_FILE_ABSENT is evidence-EXEMPT (its evidence is the stat
+    // itself), and absent rows never consult the evidence gate — so this object cannot degrade the
+    // row. It exists only so the finding can tell the operator WHY the path is not a test file.
+    absent.push(isDirectory
+      ? { ...row, evidence: { exitCode: null, runner: 'unrecognised', failureKind: 'unrecognised', testsExecuted: null, targetSeen: false, evidenceLine: 'not-a-regular-file' } }
+      : row);
+  }
+
+  const results: ClassifyResultRow[] = [...absent];
+  let tipTree: { headSha: string; dirtyFiles: number } | null = null;
+
+  // Confirmation 12: with nothing present there is nothing to run — no worktree is built at all.
+  if (present.length > 0) {
+    const runner = runnerOpt !== undefined && plan.commands.some((c) => c.includes(runnerOpt)) ? runnerOpt : 'npx vitest run';
+    // Execute the plan in a temp worktree WE own; substitute {{WORKTREE}} and always clean up.
+    // `git worktree add` must CREATE the path, so compute a fresh non-existent one (do NOT mkdtemp it).
+    const worktree = join(mkdtempSync(join(tmpdir(), 'dz-disc-')), 'wt');
+    try {
+      // 1) add the detached worktree at base (git creates `worktree`; its parent already exists).
+      const addCmd = plan.commands[0]!.replace(/\{\{WORKTREE\}\}/g, worktree);
+      execSync(addCmd, { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' });
+
+      // 1b) a fresh worktree has NO node_modules — without this, every test fails to load (runner + deps
+      // unresolvable) and the gate collapses to always-VIA_ERROR, blind to false greens. Absolute-path
+      // symlinks point back at the main checkout's already-installed trees, robust across pnpm's layout.
+      const linkNodeModules = (relDir: string): void => {
+        const srcNm = join(repoRoot, relDir, 'node_modules');
+        if (!existsSync(srcNm)) return;
+        const dstNm = join(worktree, relDir, 'node_modules');
+        if (existsSync(dstNm)) return;
+        try { mkdirSync(dirname(dstNm), { recursive: true }); symlinkSync(srcNm, dstNm, 'dir'); } catch { /* best effort */ }
+      };
+      linkNodeModules('.'); // root (hoisted deps + .bin)
+      const pkgDirs = new Set<string>();
+      for (const t of present) {
+        let d = dirname(t.file);
+        while (d && d !== '.' && d !== sep) {
+          if (existsSync(join(repoRoot, d, 'package.json'))) { pkgDirs.add(d); break; }
+          d = dirname(d);
+        }
       }
-    }
-    for (const d of pkgDirs) linkNodeModules(d);
+      for (const d of pkgDirs) linkNodeModules(d);
 
-    // 2) copy each property test into the base worktree, then 3) run it and record pass/fail/error per target.
-    for (const t of plan.targets) {
-      try {
-        const src = resolve(repoRoot, t.file);
-        // containment guard (defense in depth beyond planDiscriminationCheck's path sanitation).
-        if (!resolve(src).startsWith(resolve(repoRoot) + sep)) { results.push(nameFor(t, 'error')); continue; }
-        const dst = join(worktree, t.file);
-        mkdirSync(dirname(dst), { recursive: true });
-        writeFileSync(dst, readFileSync(src));
-      } catch { results.push(nameFor(t, 'error')); continue; }
-
-      const runner = (runnerOpt !== undefined && plan.commands.some((c) => c.includes(runnerOpt))) ? runnerOpt : 'npx vitest run';
-      // t.file + t.name already passed the engine's strict sanitation (no quotes/metacharacters/leading-dash);
-      // still quote + `--` so a path can never be read as a runner option or split a word.
-      const nameArg = t.name ? ` -t '${t.name}'` : '';
-      try {
-        execSync(`${runner}${nameArg} -- '${t.file}'`, { cwd: worktree, stdio: 'pipe', encoding: 'utf-8' });
-        results.push(nameFor(t, 'pass')); // exit 0 → test PASSED at base → false green
-      } catch (e) {
-        // vitest exits non-zero on failure AND on load/compile error. Distinguish: a load error usually names
-        // "Cannot find module"/"Failed to load"/"No test files"; otherwise treat as an assertion failure (red).
-        const out = String((e as { stdout?: string; stderr?: string }).stdout ?? '') + String((e as { stderr?: string }).stderr ?? '');
-        const isLoadError = /cannot find module|failed to load|no test (files )?found|error: cannot|transform failed|esbuild/i.test(out);
-        results.push(nameFor(t, isLoadError ? 'error' : 'fail'));
+      // 2) copy each property test into the base worktree, then 3) run it and record the OBSERVATION.
+      for (const t of present) {
+        try {
+          const src = resolve(repoRoot, t.file);
+          // containment guard (defense in depth beyond planDiscriminationCheck's path sanitation).
+          if (!resolve(src).startsWith(resolve(repoRoot) + sep)) { results.push(nameFor(t, 'error')); continue; }
+          const dst = join(worktree, t.file);
+          mkdirSync(dirname(dst), { recursive: true });
+          writeFileSync(dst, readFileSync(src));
+        } catch {
+          // the file STAT-PASSED and the copy still failed: degrade LOUDLY as an error with NO
+          // evidence (the gate reads it as CANNOT_ISOLATE), never as absence and never as a pass.
+          results.push(nameFor(t, 'error'));
+          continue;
+        }
+
+        // t.file + t.name already passed the engine's strict sanitation (no quotes/metacharacters/leading-dash);
+        // still quote + `--` so a path can never be read as a runner option or split a word.
+        const nameArg = t.name ? ` -t '${t.name}'` : '';
+        const cmd = `${runner}${nameArg} -- '${t.file}'`;
+        const base = runCapturedTest(cmd, worktree, timeoutMs);
+        const evidence = classifyExecutionEvidence(base.output, base.exitCode, t.file);
+        const outcome = discriminationOutcomeOf(base.exitCode, evidence);
+        const row: Record<string, unknown> = t.name !== undefined
+          ? { file: t.file, name: t.name, outcome, evidence }
+          : { file: t.file, outcome, evidence };
+
+        // 4) TIP CONTROL (FR-A2 + Confirmation 17). Run it for ALL non-assertion redness — file-load
+        // redness (the matrix's EVIDENCED-error rows) AND unrecognised redness (so the invocation
+        // ledger can prove the tip was REACHED). The CLASSIFIER still ignores the tip for unevidenced
+        // base rows per the matrix; running it is cheap and only ever on an already-broken path.
+        // Do NOT "simplify" this to evidenced-error-only — that silently breaks Confirmation 17.
+        if (base.exitCode !== null && base.exitCode !== 0 && evidence.failureKind !== 'assertions') {
+          const tip = runCapturedTest(cmd, repoRoot, timeoutMs);
+          const tipEvidence = classifyExecutionEvidence(tip.output, tip.exitCode, t.file);
+          row['tipOutcome'] = discriminationOutcomeOf(tip.exitCode, tipEvidence);
+          row['tipEvidence'] = tipEvidence;
+          // R15, named honestly: the base run is isolated in a worktree, but the tip runs in the LIVE
+          // tree, where a concurrent writer can flip the observation mid-gate. No lock is taken
+          // (deferred to backlog 9520e506); instead every tip-derived reading carries the tree
+          // CONDITIONS it was taken under, so a surprising verdict can be re-read against them.
+          if (tipTree === null) tipTree = readTipTreeConditions(repoRoot);
+        }
+        results.push(row as unknown as ClassifyResultRow);
       }
+    } catch (e) {
+      if (flags.has('json')) { write(JSON.stringify({ plan, error: 'worktree-setup-failed', detail: String((e as Error).message).slice(0, 300) }, null, 2)); }
+      else write(`discrimination-check: could not create worktree at ${baseRef}: ${String((e as Error).message).slice(0, 200)}`);
+      return 2;
+    } finally {
+      try { execSync(`git worktree remove --force ${worktree}`, { cwd: repoRoot, stdio: 'pipe' }); } catch { /* fall through to rm */ }
+      // remove the whole mkdtemp parent (worktree is `<mkdtemp>/wt`), so nothing leaks under tmp even on error.
+      try { rmSync(dirname(worktree), { recursive: true, force: true }); } catch { /* best effort */ }
+      try { execSync('git worktree prune', { cwd: repoRoot, stdio: 'pipe' }); } catch { /* best effort */ }
     }
-  } catch (e) {
-    if (flags.has('json')) { write(JSON.stringify({ plan, error: 'worktree-setup-failed', detail: String((e as Error).message).slice(0, 300) }, null, 2)); }
-    else write(`discrimination-check: could not create worktree at ${baseRef}: ${String((e as Error).message).slice(0, 200)}`);
-    return 2;
-  } finally {
-    try { execSync(`git worktree remove --force ${worktree}`, { cwd: repoRoot, stdio: 'pipe' }); } catch { /* fall through to rm */ }
-    // remove the whole mkdtemp parent (worktree is `<mkdtemp>/wt`), so nothing leaks under tmp even on error.
-    try { rmSync(dirname(worktree), { recursive: true, force: true }); } catch { /* best effort */ }
-    try { execSync('git worktree prune', { cwd: repoRoot, stdio: 'pipe' }); } catch { /* best effort */ }
   }
 
   const result = classifyDiscrimination({ propertyTests, results });
-  if (flags.has('json')) { write(JSON.stringify({ plan, results, ...result }, null, 2)); return 0; }
+  if (flags.has('json')) { write(JSON.stringify({ plan, results, tipTree, ...result }, null, 2)); return 0; }
 
   write(`discrimination-check @ ${baseRef} — verdict: ${result.aggregate}`);
-  for (const p of result.perTest) write(`  ${p.verdict === 'NON_DISCRIMINATING' ? '✗' : '✓'} ${p.file}${p.name ? ` (${p.name})` : ''}: ${p.verdict}`);
-  if (result.finding) write(`\n  [${result.finding.severity}] ${result.finding.title}\n  ${result.finding.detail}`);
+  for (const p of result.perTest) {
+    // FR-A6: ✓ is reserved for the two ESTABLISHED trust verdicts. Every other value — including
+    // every degraded reading — renders ✗, because a ✗ the operator investigates beats a ✓ that
+    // silently meant "we could not tell".
+    const mark = p.verdict === 'DISCRIMINATES' || p.verdict === 'DISCRIMINATES_VIA_ERROR' ? '✓' : '✗';
+    write(`  ${mark} ${p.file}${p.name ? ` (${p.name})` : ''}: ${p.verdict}${p.reason ? ` (reason: ${p.reason})` : ''}`);
+  }
+  write(`  measurementValid: ${String(result.measurementValid)} · primaryAction: ${result.primaryAction}`);
+  // ALL findings print, not just the worst: the scalar aggregate names one state, and a corpus with
+  // a false green AND an absent file has two problems, each with its own operator action.
+  for (const f of result.findings) write(`\n  [${f.severity}] ${f.title}\n  ${f.detail}`);
   return 0;
 }
 
+/**
+ * Run one test command and CAPTURE the observation — output plus the exit code, including the
+ * "no exit code at all" case. `execSync`'s timeout kills the child via signal and leaves
+ * `status` null; a spawn failure does the same. That null is not an error to swallow, it is the
+ * evidence (`CANNOT_ISOLATE` reason `'timeout'`), so it is returned as data.
+ */
+function runCapturedTest(cmd: string, cwd: string, timeoutMs: number): { output: string; exitCode: number | null } {
+  try {
+    const stdout = execSync(cmd, { cwd, stdio: 'pipe', encoding: 'utf-8', timeout: timeoutMs });
+    return { output: String(stdout ?? ''), exitCode: 0 };
+  } catch (e) {
+    const err = e as { stdout?: string; stderr?: string; status?: unknown };
+    return {
+      output: String(err.stdout ?? '') + String(err.stderr ?? ''),
+      exitCode: typeof err.status === 'number' ? err.status : null,
+    };
+  }
+}
+
+/**
+ * The outcome VALUE for one captured run. The executor's whole remaining judgment, and it is
+ * mechanical: exit 0 is a pass, no exit code is an error, and a non-zero exit is an error only when
+ * the classifier RECOGNISED a file-load failure. An unrecognised red is deliberately recorded as a
+ * `fail` VALUE whose evidence then degrades it — exactly acid A6's pinned shape, and the reason the
+ * executor no longer owns a regex.
+ */
+function discriminationOutcomeOf(exitCode: number | null, evidence: ExecutionEvidence): 'pass' | 'fail' | 'error' {
+  if (exitCode === null) return 'error';
+  if (exitCode === 0) return 'pass';
+  return evidence.failureKind === 'file-load' ? 'error' : 'fail';
+}
+
+/** The live tree's identity at tip-run time (R15). Best-effort: unknown conditions read as such. */
+function readTipTreeConditions(repoRoot: string): { headSha: string; dirtyFiles: number } {
+  let headSha = 'unknown';
+  let dirtyFiles = -1;
+  try { headSha = execSync('git rev-parse HEAD', { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' }).trim(); } catch { /* best effort */ }
+  try {
+    const porcelain = execSync('git status --porcelain', { cwd: repoRoot, stdio: 'pipe', encoding: 'utf-8' });
+    dirtyFiles = String(porcelain).split('\n').filter((l) => l.trim() !== '').length;
+  } catch { /* best effort */ }
+  return { headSha, dirtyFiles };
+}
+
 /** small helper: build a result row, omitting `name` when absent (exactOptionalPropertyTypes). */
 function nameFor(t: { file: string; name?: string }, outcome: 'pass' | 'fail' | 'error'): { file: string; name?: string; outcome: 'pass' | 'fail' | 'error' } {
   return t.name !== undefined ? { file: t.file, name: t.name, outcome } : { file: t.file, outcome };
@@ -7459,47 +8231,630 @@ function cmdMutationGate(options: Map<string, string>, flags: Set<string>, cwd:
  * debt); an oversized or non-regular due-file counts as MALFORMED, never a silent skip (QE #8);
  * a debt whose embedded slug differs from its directory is MALFORMED — identity is the directory,
  * the JSON only confirms it (QE #4: an embedded foreign slug must not redirect settlement). */
-function scanReqeDebts(root: string): { debts: Array<{ debt: ReqeDebt; duePath: string; dir: string }>; malformed: number } {
-  const out: Array<{ debt: ReqeDebt; duePath: string; dir: string }> = [];
-  let malformed = 0;
-  const featuresDir = join(root, 'features');
-  let slugs: string[] = [];
+/* ── `dz workflow run` — the impure half of the loop-plan executor (feature dz-workflow-run) ──────
+ *
+ * Everything DECIDABLE lives in harness-core's pure scheduler. This half owns exactly four things
+ * core refuses to touch: the filesystem, the lock, the child processes, and the exit code. Keeping
+ * that line sharp is what lets the whole feature be tested without a child process — so anything
+ * added here that could have been a decision belongs upstream instead.
+ */
+
+/** The env TEST SEAM (the `DZ_QE_BRIDGE_CLAUDE_BIN` precedent: an env var, never a flag — a flag
+ * invites production use). Recorded LOUDLY in run-state as `dispatcherOverride: true`, because a
+ * test seam that leaves no trace in the artifact is indistinguishable from a real run. */
+const WF_RUN_DISPATCH_SCRIPT_ENV = 'DZ_WF_RUN_DISPATCH_SCRIPT';
+const WF_RUN_OWNER_FILE = 'run-owner.json';
+const WF_RUN_STATE_FILE = 'run-state.json';
+
+/**
+ * THE ONE PLACE anything in the loop runner is signalled (Step-8 re-QE NEW-C4).
+ *
+ * Round 1 guarded `process.kill(-pid, …)` — the process-GROUP path — and left `child.kill(sig)`
+ * unguarded beside it. A fake child reporting `pid: 0` therefore still received the signal through
+ * the object method, which is the same defect wearing a different call shape. `process.kill(-0, …)`
+ * signals the CALLER'S OWN process group; round 0 of this exact class took down the vitest worker
+ * pool. Two call shapes meant two chances to forget, so now there is one.
+ *
+ * The guard is on the PID, not on the shape: an unsignalable pid (not an integer, or <= 1) reaches
+ * NOTHING — neither `process.kill` nor `child.kill`. Returns whether a signal was actually sent, so
+ * a caller can never mistake "refused" for "delivered".
+ */
+function signalChildSafely(child: { pid?: unknown; kill?: (signal: NodeJS.Signals) => unknown } | undefined, signal: NodeJS.Signals, detached: boolean): boolean {
+  const raw = child?.pid;
+  if (typeof raw !== 'number' || !Number.isInteger(raw) || raw <= 1) return false;
   try {
-    if (lstatSync(featuresDir).isSymbolicLink()) return { debts: [], malformed: 0 }; // r2 #4: features/ itself
-    slugs = readdirSync(featuresDir);
+    if (detached) process.kill(-raw, signal);
+    else child?.kill?.(signal);
+    return true;
   } catch {
-    return { debts: [], malformed: 0 };
-  }
-  for (const slug of slugs.sort()) {
-    const dir = join(featuresDir, slug);
-    const stateDir = join(dir, '.fa-state');
-    const duePath = join(stateDir, 'reqe-due.json');
-    try {
-      if (lstatSync(dir).isSymbolicLink() || lstatSync(stateDir).isSymbolicLink()) continue;
-    } catch {
-      continue; // no feature dir / no state dir — nothing to scan
-    }
-    let st;
-    try {
-      st = lstatSync(duePath);
-    } catch {
-      continue; // no due-file — the common, silent case
-    }
-    if (!st.isFile() || st.size > 64 * 1024) {
-      malformed++; // exists but is not a plain small file — named, never silently dropped
-      continue;
-    }
-    try {
-      const debt = parseReqeDebt(readFileSync(duePath, 'utf-8'));
-      if (debt && debt.slug === slug) out.push({ debt, duePath, dir });
-      else malformed++;
-    } catch {
-      malformed++;
-    }
+    return false; // already gone, or not ours — both mean nothing more to do
   }
+}
+
+/** Test seam for the chokepoint: NEW-C4's proof needs to call it with a hostile pid. */
+export function __wfSignalChildTestSeam(child: unknown, signal: string, detached: boolean): boolean {
+  return signalChildSafely(child as { pid?: unknown; kill?: (s: NodeJS.Signals) => unknown }, signal as NodeJS.Signals, detached);
+}
+
+/** Live children, keyed by pid, for the kill-group handlers (AM-10). */
+const wfLiveChildren = new Map<number, ChildProcess>();
+let wfHandlersInstalled = false;
+
+/** Kill the process GROUP of every live child. A detached child leads its own group, so killing the
+ * leader alone would leave whatever it spawned running — that is the orphan class AM-10 closes.
+ * NAMED RESIDUE: a SIGKILL of the runner itself runs no handler, so that case still orphans. */
+function wfKillLiveChildren(signal: NodeJS.Signals = 'SIGTERM'): number[] {
+  const killed: number[] = [];
+  for (const [pid, child] of [...wfLiveChildren.entries()]) {
+    // ONE chokepoint: group first (a detached child leads its own), then the leader. Neither shape
+    // is reachable without the pid guard.
+    if (signalChildSafely(child, signal, true) || signalChildSafely(child, signal, false)) killed.push(pid);
+    wfLiveChildren.delete(pid);
+  }
+  return killed;
+}
+
+function wfInstallKillHandlers(): void {
+  if (wfHandlersInstalled) return;
+  wfHandlersInstalled = true;
+  process.on('exit', () => { wfKillLiveChildren(); });
+  process.on('SIGTERM', () => { wfKillLiveChildren(); process.exit(143); });
+  process.on('SIGINT', () => { wfKillLiveChildren(); process.exit(130); });
+}
+
+/** Exposed for the unit test: the kill set must NAME every live child's pid. */
+export function __wfKillGroupTestSeam(): { register: (pid: number, child: ChildProcess) => void; killAll: () => number[]; size: () => number } {
+  return {
+    register: (pid, child) => { wfLiveChildren.set(pid, child); },
+    killAll: () => wfKillLiveChildren(),
+    size: () => wfLiveChildren.size,
+  };
+}
+
+/** A `ChildRunner` over the generalized wrapper, registering every live child for the kill set. */
+/** A `ChildRunner` bound to ONE family, so its child can only ever receive that family's
+ * credentials (re-QE H9). Two runners, two credential sets, one wrapper. */
+const wfChildRunnerFor = (family: BridgeFamily): ChildRunner => async (bin, argv, opts) =>
+  runChildBridge(bin, argv, {
+    ...opts,
+    // a dispatched model gets a NAMED minimal environment, never the runner's whole one (HIGH-9)
+    envMode: 'allowlist',
+    envExtra: CHILD_ENV_BY_FAMILY[family],
+    onSpawn: (child) => {
+      if (typeof child.pid !== 'number') return;
+      const pid = child.pid;
+      wfLiveChildren.set(pid, child);
+      child.on('close', () => { wfLiveChildren.delete(pid); });
+    },
+  });
+
+/** Build the SCRIPTED dispatcher from the env seam's JSON file (test-only). */
+function wfScriptedDispatcher(scriptPath: string, family: BridgeFamily): Dispatcher {
+  const raw = JSON.parse(readFileSync(scriptPath, 'utf8')) as Record<string, unknown>;
+  const script = (raw['steps'] ?? raw) as Record<string, unknown>;
+  const probeId = typeof raw['probeId'] === 'string' ? (raw['probeId'] as string) : `${family}-scripted`;
+  const consumed = new Map<string, number>();
+  return {
+    probe: async (candidates) => ({ id: raw['probeFails'] === true ? null : probeId, wallMs: 1, detail: `scripted probe (${candidates.join(',') || 'defaults'})` }),
+    dispatch: async (req) => {
+      const key = req.itemKey === null ? req.stepId : `${req.stepId}:${req.itemKey}`;
+      const entry = script[key] ?? script[req.stepId];
+      const n = consumed.get(key) ?? 0;
+      consumed.set(key, n + 1);
+      const picked = Array.isArray(entry) ? (entry[Math.min(n, entry.length - 1)] as Record<string, unknown>) : (entry as Record<string, unknown> | undefined);
+      const base: DispatchResult = {
+        outcome: 'ok',
+        text: `scripted:${key}`,
+        family,
+        modelUsed: req.resolvedModelId,
+        wallMs: 1,
+        tokensIn: null,
+        tokensOut: null,
+        tokensSource: null,
+      };
+      if (picked === undefined || picked === null) return base;
+      // a scripted step may ask the runner to CREATE its declared writes (the landed-barrier leg)
+      if (picked['writes'] === true) {
+        for (const rel of req.expectedWrites) {
+          // the seam re-checks containment too — a test double that could write outside the root
+          // would be a hole in exactly the guard the real path is being tested for (CRITICAL-4)
+          const abs = wfContainedPath(req.cwd, rel);
+          if (abs === null) continue;
+          mkdirSync(dirname(abs), { recursive: true });
+          writeFileSync(abs, `scripted write for ${req.stepId} attempt ${req.attempt}\n`);
+        }
+      }
+      return { ...base, ...(picked as Partial<DispatchResult>) };
+    },
+  };
+}
+
+/** Read a small JSON file, or null. */
+function wfReadJson(path: string): unknown {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Is a recorded pid still alive? `kill(pid, 0)` is the portable liveness probe. */
+function wfPidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return (e as NodeJS.ErrnoException).code === 'EPERM'; // alive, just not ours
+  }
+}
+
+/** The fs `RunStore`. Every write that must be atomic is temp+rename; every file that must be NEW
+ * is `wx`. Nothing here decides anything. */
+/**
+ * Containment, re-checked at the LAST possible moment (Step-8 CRITICAL-4: "repeat containment
+ * immediately before filesystem access").
+ *
+ * Preflight validated these paths minutes earlier, against a filesystem that has since been written
+ * to — by the very models this run dispatched. A symlink planted between preflight and the probe is
+ * not a hypothetical here; creating files is what the file-deliverable steps DO. Returns the
+ * absolute path, or null when the path no longer resolves inside the root.
+ */
+function wfContainedPath(targetCwd: string, rel: string): string | null {
+  const check = containedUnderRoot(targetCwd, rel);
+  return check.ok ? check.path : null;
+}
+
+function wfMakeStore(runDir: string, repoRoot: string, targetCwd: string): RunStore {
+  const statePath = join(runDir, WF_RUN_STATE_FILE);
+  const tracePath = join(runDir, 'trace.jsonl');
+  const stateDir = join(runDir, '.fa-state');
+  const ckptPath = join(stateDir, 'checkpoints.jsonl');
+  const budgetPath = join(runDir, 'budget.jsonl');
+  const duePath = join(stateDir, 'reqe-due.json');
+  const ledgerPath = join(repoRoot, '.dz', 'feature-adr', 'run-cost-ledger.jsonl');
+  const hashOf = (abs: string): string | null => {
+    try {
+      return createHash('sha256').update(readFileSync(abs)).digest('hex');
+    } catch {
+      return null;
+    }
+  };
+  return {
+    runDirExists: () => existsSync(runDir),
+    hasTrace: () => existsSync(tracePath),
+    readTraceText: () => (existsSync(tracePath) ? readFileSync(tracePath, 'utf8') : null),
+    readRunState: () => wfReadJson(statePath) as WfRunState | null,
+    writeRunState: (s) => {
+      mkdirSync(runDir, { recursive: true });
+      const tmp = statePath + '.tmp';
+      writeFileSync(tmp, JSON.stringify(s, null, 2) + '\n');
+      renameSync(tmp, statePath); // atomic: a half-written state is a foreign run forever
+    },
+    appendTraceLines: (lines) => {
+      if (lines.length === 0) return;
+      mkdirSync(runDir, { recursive: true });
+      appendFileSync(tracePath, lines.join('\n') + '\n');
+    },
+    readCheckpointsText: () => (existsSync(ckptPath) ? readFileSync(ckptPath, 'utf8') : null),
+    appendCheckpointLine: (line) => {
+      mkdirSync(stateDir, { recursive: true });
+      appendFileSync(ckptPath, line + '\n');
+    },
+    appendBudgetRow: (row) => {
+      mkdirSync(runDir, { recursive: true });
+      appendFileSync(budgetPath, JSON.stringify(row) + '\n');
+    },
+    appendLedgerLine: (line) => {
+      try {
+        mkdirSync(dirname(ledgerPath), { recursive: true });
+        appendFileSync(ledgerPath, line + '\n');
+      } catch {
+        /* telemetry is SECONDARY: a ledger failure never fails a run */
+      }
+    },
+    probeArtifact: (rel) => {
+      const abs = wfContainedPath(targetCwd, rel);
+      // a path that no longer resolves inside the root is NOT LANDED, whatever is at the other end
+      return abs !== null && existsSync(abs);
+    },
+    // re-QE R3-A: the same realpath + symlinked-ancestor discipline, for reads AND writes, at the
+    // moment before the dispatch grants filesystem access
+    pathContainmentOk: (rel) => wfContainedPath(targetCwd, rel) !== null,
+    snapshotWrites: (rels) => {
+      const out: Record<string, string | null> = {};
+      for (const rel of rels) {
+        const abs = wfContainedPath(targetCwd, rel);
+        out[rel] = abs === null ? null : hashOf(abs);
+      }
+      return out;
+    },
+    writeReqeDebt: (record) => {
+      mkdirSync(stateDir, { recursive: true });
+      writeFileSync(duePath, JSON.stringify(record, null, 2) + '\n');
+    },
+  };
+}
+
+/**
+ * `dz workflow run <plan.json>` — INTERPRET the plan (ADR-001). Registered inside the existing
+ * `case 'workflow':` branch when `_positional_0 === 'run'`, BEFORE the sync `cmdWorkflow`.
+ *
+ * Exit codes (AM-11): `0` completed · `1` failed (named) · `2` usage / invalid plan ·
+ * `75` typed pause (sysexits EX_TEMPFAIL). NOT `3`: that collides with workflow-lint's
+ * inconclusive and reads ignorable, while a pause strands resumable progress.
+ */
+async function cmdWorkflowRun(
+  options: Map<string, string>,
+  optionLists: Map<string, string[]>,
+  flags: Set<string>,
+  cwd: string,
+  write: Write,
+): Promise<number> {
+  const json = flags.has('json');
+  const usage = 'dz workflow run <plan.json> [--run-id <id>] [--resume <runId>] [--arg k=v]… '
+    + '[--coder-family codex|claude] [--default-family codex|claude] [--budget <n>] [--max-wall-clock <s>] '
+    + '[--stage-timeout <s>] [--budget-extra <n>] [--wall-clock-extra <s>] [--run-dir <dir>] '
+    + '[--allow-same-family-qe] [--json]';
+  const usageError = (message: string): number => {
+    write(json ? JSON.stringify({ ok: false, reason: 'plan-invalid', error: message, exitCode: 2 }) : `dz workflow run: ${message}\n${usage}`);
+    return 2;
+  };
+
+  if (flags.has('help')) {
+    write(usage);
+    write('');
+    write('EXIT CODES — `dz workflow run` and `dz workflow-lint` have DIFFERENT tables (AM-11):');
+    write('  run   0 completed · 1 failed (named reason) · 2 usage/invalid plan · 75 typed pause (EX_TEMPFAIL)');
+    write('  lint  0 clean     · 1 findings            · 3 inconclusive');
+    write('  75 is NOT 3: 3 reads ignorable and collides with lint, while a pause strands resumable work.');
+    write('On a pause the LAST stdout line is a `wf-pause-envelope/1` JSON object; a FAILURE emits none,');
+    write('so a wrapper can tell the two apart from stdout + exit code alone, without parsing prose.');
+    return 0;
+  }
+
+  // ── closed allowlists (the cmdQeBridge discipline: an unknown flag is a usage error, never a
+  // silently-ignored intention) ──
+  const OPTS = new Set(['run-id', 'resume', 'arg', 'coder-family', 'default-family', 'budget', 'max-wall-clock', 'stage-timeout', 'budget-extra', 'wall-clock-extra', 'run-dir', 'project', '_positional_0', '_positional_1']);
+  const FLAGS = new Set(['allow-same-family-qe', 'json', 'help']);
+  for (const k of options.keys()) if (!OPTS.has(k)) return usageError(`unknown option --${k}`);
+  for (const f of flags) if (!FLAGS.has(f)) return usageError(`unknown flag --${f}`);
+
+  // ── SINGLETONS (Step-8 HIGH-8 — the recurring class) ──
+  //
+  // `parseArgs` keeps every occurrence in `optionLists` but the main map is LAST-WINS, so
+  // `--coder-family codex --coder-family claude` was accepted and only `claude` reached preflight.
+  // For a SAFETY option that is a bypass: the same-family guard compares the coder family against a
+  // qe step's family, and whoever supplies the last occurrence chooses the answer. Every option here
+  // is a singleton BY MEANING — a run has one coder family, one budget, one run directory — so a
+  // second occurrence is not a preference, it is an ambiguity, and the only honest answer is to
+  // refuse. `--arg` is deliberately absent: it is the one genuinely repeatable option.
+  const SINGLETON_OPTS = ['run-id', 'resume', 'coder-family', 'default-family', 'budget', 'max-wall-clock', 'stage-timeout', 'budget-extra', 'wall-clock-extra', 'run-dir', 'project'];
+  for (const key of SINGLETON_OPTS) {
+    const occurrences = optionLists.get(key) ?? [];
+    if (occurrences.length > 1) {
+      return usageError(
+        `--${key} was given ${occurrences.length} times (${occurrences.map((v) => JSON.stringify(v)).join(', ')}) — it is a singleton, and a second occurrence is an ambiguity, not a preference. `
+        + 'Stacking a safety option would let the LAST value decide what the first one refused.',
+      );
+    }
+  }
+
+  const planPath = options.get('_positional_1') ?? '';
+  if (planPath === '') return usageError('a plan.json positional is required');
+  const root = resolve(cwd, options.get('project') ?? '.');
+  const absPlan = resolve(cwd, planPath);
+  if (!existsSync(absPlan)) return usageError(`no such plan file: ${absPlan}`);
+
+  let rawPlan: unknown;
+  try {
+    rawPlan = JSON.parse(readFileSync(absPlan, 'utf8'));
+  } catch (e) {
+    return usageError(`unparseable plan JSON — ${e instanceof Error ? e.message : String(e)}`);
+  }
+  const parsed = parsePlan(rawPlan);
+  if (isParseErrors(parsed)) {
+    if (json) write(JSON.stringify({ ok: false, reason: 'plan-invalid', parseErrors: parsed, exitCode: 2 }));
+    else for (const e of parsed) write(`PARSE ${e.path}: ${e.message}`);
+    return 2;
+  }
+  const diags = validatePlan(parsed);
+  if (diags.length > 0) {
+    if (json) write(JSON.stringify({ ok: false, reason: 'plan-invalid', diagnostics: diags, exitCode: 2 }));
+    else for (const d of diags) write(`${d.invariant} ${d.path}: ${d.message}`);
+    return 2;
+  }
+
+  // ── numeric options ride the Number.isFinite clamp (every numeric config clamp needs it) ──
+  const num = (key: string, scale = 1): { ok: true; value: number | null } | { ok: false; why: string } => {
+    const raw = options.get(key);
+    if (raw === undefined) return { ok: true, value: null };
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0) return { ok: false, why: `--${key} must be a finite non-negative number (got ${JSON.stringify(raw)})` };
+    return { ok: true, value: Math.floor(n * scale) };
+  };
+  const nums: Record<string, number | null> = {};
+  for (const [key, scale] of [['budget', 1], ['max-wall-clock', 1000], ['stage-timeout', 1000], ['budget-extra', 1], ['wall-clock-extra', 1000]] as const) {
+    const r = num(key, scale);
+    if (!r.ok) return usageError(r.why);
+    nums[key] = r.value;
+  }
+
+  const familyOpt = (key: string): { ok: true; value: BridgeFamily | null } | { ok: false; why: string } => {
+    const raw = options.get(key);
+    if (raw === undefined) return { ok: true, value: null };
+    if (raw !== 'codex' && raw !== 'openai' && raw !== 'claude') return { ok: false, why: `--${key} must be codex or claude (got ${JSON.stringify(raw)})` };
+    return { ok: true, value: modelFamily(raw) };
+  };
+  const coder = familyOpt('coder-family');
+  if (!coder.ok) return usageError(coder.why);
+  const dflt = familyOpt('default-family');
+  if (!dflt.ok) return usageError(dflt.why);
+
+  const resumeArgs: Record<string, string> = {};
+  for (const kv of optionLists.get('arg') ?? []) {
+    const eq = kv.indexOf('=');
+    if (eq <= 0) return usageError(`--arg must be k=v (got ${JSON.stringify(kv)})`);
+    resumeArgs[kv.slice(0, eq)] = kv.slice(eq + 1);
+  }
+
+  const resumeId = options.get('resume') ?? null;
+  const runId = options.get('run-id') ?? resumeId ?? `${parsed.name}-${randomBytes(2).toString('hex')}`;
+  if (!TRACE_RUNID_RE.test(runId)) return usageError(`runId ${JSON.stringify(runId)} fails ${String(TRACE_RUNID_RE)}`);
+  if (resumeId !== null && options.get('run-id') !== undefined && options.get('run-id') !== resumeId) {
+    return usageError('--run-id and --resume name different runs — a resume continues the run it names');
+  }
+
+  const runDirOpt = options.get('run-dir');
+  let runDir: string;
+  if (runDirOpt !== undefined) {
+    const contained = containedUnderRoot(root, runDirOpt);
+    if (!contained.ok) return usageError(`--run-dir ${contained.why}`);
+    runDir = contained.path;
+  } else {
+    runDir = join(root, '.dz', 'loop-trace', runId); // the addressing `dz workflow-trace --run <id>` already uses
+  }
+
+  // The scripted-seam marker is established BEFORE the first refusal can emit (re-QE MINOR): an
+  // EARLY refusal is still a run that would have dispatched to no real model, and a reader of that
+  // envelope has the same right to know as a reader of a completed one.
+  const seamScriptPath = process.env[WF_RUN_DISPATCH_SCRIPT_ENV];
+  const dispatcherOverride = typeof seamScriptPath === 'string' && seamScriptPath !== '';
+  const emit = (payload: object): void => {
+    write(JSON.stringify(dispatcherOverride ? { ...payload, dispatcherOverride: true } : payload));
+  };
+
+  // ── AM-7 ownership, ATOMICALLY (Step-8 HIGH-6) ──
+  //
+  // The previous shape read the owner marker, decided, and wrote it later — a window in which two
+  // processes both saw "no live owner" and both proceeded. And the write itself was wrapped in a
+  // swallowing try, so a run could execute while its durable claim silently did not exist.
+  //
+  // Now: check and claim happen INSIDE the named lock, the claim is `wx` (create-or-fail, so the
+  // filesystem itself arbitrates), a STALE marker is only replaced under that same lock, and a
+  // failure to claim FAILS THE RUN. One writer per run is not a convention here; it is an atomic
+  // filesystem operation.
+  const ownerPath = join(runDir, WF_RUN_OWNER_FILE);
+  const startedMarker = new Date().toISOString();
+  const RUN_ARTIFACTS = [WF_RUN_STATE_FILE, 'trace.jsonl', 'budget.jsonl', join('.fa-state', 'checkpoints.jsonl')];
+  type Claim = { ok: true } | { ok: false; reason: 'run-exists' | 'run-locked'; detail: string };
+  const claim: Claim = withNamedLockSync(root, `wf-run-${runId}`, (): Claim => {
+    mkdirSync(runDir, { recursive: true });
+    // ORDER MATTERS. A LIVE owner is `run-locked` whichever kind of invocation this is — that is
+    // the precise fact, and it outranks "the directory has files in it". Only then does a FRESH run
+    // refuse a directory that already holds a run's artifacts.
+    const existingOwner = wfReadJson(ownerPath) as { pid?: number; startedMarker?: string } | null;
+    if (existingOwner !== null && typeof existingOwner.pid === 'number' && wfPidAlive(existingOwner.pid)) {
+      return { ok: false, reason: 'run-locked', detail: `another dz workflow run (pid ${existingOwner.pid}, started ${existingOwner.startedMarker ?? 'unknown'}) owns ${runDir} — ONE writer per run, always` };
+    }
+    if (resumeId === null) {
+      // a FRESH run may not write into a directory that already holds ANY artifact of a run — not
+      // merely one with a readable state file (a HALF-written run is exactly the dangerous case).
+      // The owner marker is excluded: a dead one is stale residue, handled by the claim below.
+      const found = RUN_ARTIFACTS.filter((rel) => existsSync(join(runDir, rel)));
+      if (found.length > 0) {
+        return {
+          ok: false,
+          reason: 'run-exists',
+          detail: `run directory ${runDir} already holds ${found.join(', ')} — pass --resume ${runId} to continue it, or choose another --run-id. A fresh run never writes into an existing run's artifacts`,
+        };
+      }
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        writeFileSync(ownerPath, JSON.stringify({ host: WF_RUN_OWNER_HOST, pid: process.pid, runnerVersion: dzOwnVersion(), startedMarker }, null, 2) + '\n', { flag: 'wx' });
+        return { ok: true };
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code !== 'EEXIST') {
+          return { ok: false, reason: 'run-locked', detail: `cannot claim ${ownerPath}: ${e instanceof Error ? e.message : String(e)} — refusing to run without a durable owner record` };
+        }
+        const held = wfReadJson(ownerPath) as { pid?: number; startedMarker?: string } | null;
+        if (held !== null && typeof held.pid === 'number' && wfPidAlive(held.pid)) {
+          return { ok: false, reason: 'run-locked', detail: `another dz workflow run (pid ${held.pid}, started ${held.startedMarker ?? 'unknown'}) owns ${runDir} — ONE writer per run, always` };
+        }
+        // STALE: the recorded owner is gone. Replacing it is safe HERE and only here, because this
+        // whole block holds the named lock, so no concurrent claimant can be mid-decision.
+        try {
+          unlinkSync(ownerPath);
+        } catch {
+          /* someone else just cleared it; the retry's `wx` decides */
+        }
+      }
+    }
+    return { ok: false, reason: 'run-locked', detail: `could not claim ${ownerPath} after replacing a stale marker — another writer is racing for this run` };
+  });
+  if (!claim.ok) {
+    if (json) emit({ schema: 'wf-run-result/1', runId, status: 'failed', reason: claim.reason, exitCode: 1 });
+    else write(`dz workflow run: ${claim.reason} — ${claim.detail}`);
+    return 1;
+  }
+
+  // ── NEW-H (re-QE): from HERE to the end, every exit path — return, throw, or completion — runs
+  // the cleanup. Round 1 opened the try only around `runWorkflow`, so a `usageError` return or a
+  // throw while CONSTRUCTING the dispatchers (a malformed seam file is enough) left `run-owner.json`
+  // behind: a durable claim held by a process that had already exited.
+  try {
+  const targetCwd = root;
+  const inputs: RunnerInputs = {
+    plan: parsed,
+    runId,
+    coderFamily: coder.value ?? 'claude',
+    allowSameFamilyQe: flags.has('allow-same-family-qe'),
+    defaultFamily: dflt.value,
+    budgetOverride: nums['budget'] ?? null,
+    maxWallClockMsOverride: nums['max-wall-clock'] ?? null,
+    stageTimeoutMsOverride: nums['stage-timeout'] ?? null,
+    resume: resumeId,
+    resumeArgs,
+    budgetExtra: nums['budget-extra'] ?? null,
+    wallClockExtraMs: nums['wall-clock-extra'] ?? null,
+    runnerVersion: dzOwnVersion(),
+    cwdRoot: targetCwd,
+  };
+
+  const pre = preflight(inputs, {
+    realpath: (p) => { try { return realpathSync(p); } catch { return null; } },
+    exists: (p) => existsSync(p),
+  });
+  if (!pre.ok) {
+    if (json) emit({ schema: 'wf-run-result/1', runId, status: 'failed', reason: pre.reason, exitCode: 1 });
+    else write(`dz workflow run: ${pre.reason} — ${pre.detail}`);
+    return 1;
+  }
+
+  // ── dispatchers: the real adapters, or the scripted env TEST SEAM ──
+  const scriptPath = seamScriptPath;
+  let dispatchers: Record<BridgeFamily, Dispatcher>;
+  if (dispatcherOverride) {
+    if (!existsSync(scriptPath as string)) return usageError(`${WF_RUN_DISPATCH_SCRIPT_ENV}=${String(scriptPath)} does not exist`);
+    dispatchers = { claude: wfScriptedDispatcher(scriptPath as string, 'claude'), openai: wfScriptedDispatcher(scriptPath as string, 'openai') };
+  } else {
+    wfInstallKillHandlers();
+    const isolated = mkdtempSync(join(tmpdir(), 'dz-wf-run-'));
+    const monotonicMs = (): number => Number(process.hrtime.bigint() / 1000000n);
+    dispatchers = {
+      claude: makeClaudePDispatcher(wfChildRunnerFor('claude'), { isolatedCwd: () => isolated, monotonicMs }),
+      openai: makeCodexExecDispatcher(wfChildRunnerFor('openai'), { isolatedCwd: () => isolated, monotonicMs }),
+    };
+  }
+
+  const store = wfMakeStore(runDir, root, targetCwd);
+  const deps: SchedulerDeps = {
+    store,
+    dispatchers,
+    lock: (fn) => withNamedLockSync(root, `wf-run-${runId}`, fn),
+    now: () => new Date().toISOString(),
+    monotonicMs: () => Number(process.hrtime.bigint() / 1000000n),
+    dispatcherOverride,
+    planPath: relative(root, absPlan) || planPath,
+    slug: parsed.name,
+    // the envelope must point at THIS run's state file and reproduce THIS run's flags (HIGH-7)
+    runStatePath: relative(root, join(runDir, WF_RUN_STATE_FILE)) || join(runDir, WF_RUN_STATE_FILE),
+    runDirArg: runDirOpt ?? null,
+    // the run-state owner records the process that actually holds the claim (HIGH-6) — `pid: 0`
+    // was a durable record of a process that never existed
+    ownerPid: process.pid,
+    ownerStartedMarker: startedMarker,
+  };
+
+  const outcome = await runWorkflow(inputs, pre, deps);
+
+  // A run that dispatched to NO REAL MODEL says so on every channel (Step-8 MEDIUM-11): the
+  // result/pause envelope carries `dispatcherOverride`, and the human line says it in words. A seam
+  // visible only inside a state file is a seam a reader of the output cannot know about.
+  const seamNote = dispatcherOverride ? ' [SCRIPTED DISPATCHER — no real model ran]' : '';
+  if (outcome.kind === 'paused') {
+    if (!json) write(`dz workflow run: PAUSED (${outcome.envelope.pauseState})${seamNote} — resume with: ${outcome.envelope.resumeCmd}`);
+    // the envelope is the LAST stdout line, ALWAYS (AM-16)
+    emit({ ...outcome.envelope, ...(dispatcherOverride ? { dispatcherOverride: true } : {}) });
+    return 75;
+  }
+  if (outcome.kind === 'failed') {
+    if (!json) write(`dz workflow run: ${outcome.reason}${seamNote} — ${outcome.detail}`);
+    emit(outcome.result); // a wf-run-result/1 line — and NEVER a pause envelope
+    return 1;
+  }
+  if (!json) {
+    const terminal = outcome.result.terminalRoute === undefined ? '' : ` via the plan's terminal route ${outcome.result.terminalRoute}`;
+    write(`dz workflow run: completed (${runId})${terminal}${seamNote} — trace at ${join(relative(root, runDir) || '.', 'trace.jsonl')}`);
+  }
+  emit(outcome.result);
+  return 0;
+  } finally {
+    // the claim is released exactly once, on EVERY path out of the claimed region
+    try { unlinkSync(ownerPath); } catch { /* already gone */ }
+    wfKillLiveChildren();
+  }
+}
+
+function scanReqeDebts(root: string): { debts: Array<{ debt: ReqeDebt; duePath: string; dir: string }>; malformed: number } {
+  const out: Array<{ debt: ReqeDebt; duePath: string; dir: string }> = [];
+  let malformed = 0;
+  /**
+   * TWO scan roots (K1 — feature dz-workflow-run):
+   *   `features/<slug>/.fa-state/` — the feature-adr home, the original root;
+   *   `.dz/loop-trace/<runId>/.fa-state/` — the DEFAULT home of a `dz workflow run` (ADR-003).
+   * Without the second root the ADR-002 waiver promise ("a waived run's debt is surfaced by
+   * `dz reqe`") is FALSE for every default-homed loop run — the record would be written to a
+   * directory nothing ever reads. The scan's own rules are unchanged: symlinked containers are
+   * skipped, an oversize or non-plain file is NAMED as malformed rather than silently dropped, and
+   * a debt whose `slug` disagrees with its directory is malformed too.
+   */
+  const scanRoots: { base: string; keyMatchesDir: boolean }[] = [
+    { base: join(root, 'features'), keyMatchesDir: true },
+    // a loop run's directory is its runId; the debt's `slug` is the PLAN's name, so the two need
+    // not agree — the identity check that applies under features/ does not apply here
+    { base: join(root, '.dz', 'loop-trace'), keyMatchesDir: false },
+  ];
+  for (const scanRoot of scanRoots) scanOneReqeRoot(scanRoot.base, scanRoot.keyMatchesDir, out, (n) => { malformed += n; });
   return { debts: out, malformed };
 }
 
+/** One scan root's walk — extracted verbatim from the original single-root body (K1). */
+function scanOneReqeRoot(
+  featuresDir: string,
+  keyMatchesDir: boolean,
+  out: Array<{ debt: ReqeDebt; duePath: string; dir: string }>,
+  addMalformed: (n: number) => void,
+): void {
+  let malformed = 0;
+  let slugs: string[] = [];
+  try {
+    if (lstatSync(featuresDir).isSymbolicLink()) return; // r2 #4: the container itself
+    slugs = readdirSync(featuresDir);
+  } catch {
+    return;
+  }
+  for (const slug of slugs.sort()) {
+    const dir = join(featuresDir, slug);
+    const stateDir = join(dir, '.fa-state');
+    const duePath = join(stateDir, 'reqe-due.json');
+    try {
+      if (lstatSync(dir).isSymbolicLink() || lstatSync(stateDir).isSymbolicLink()) continue;
+    } catch {
+      continue; // no feature dir / no state dir — nothing to scan
+    }
+    let st;
+    try {
+      st = lstatSync(duePath);
+    } catch {
+      continue; // no due-file — the common, silent case
+    }
+    if (!st.isFile() || st.size > 64 * 1024) {
+      malformed++; // exists but is not a plain small file — named, never silently dropped
+      continue;
+    }
+    try {
+      const debt = parseReqeDebt(readFileSync(duePath, 'utf-8'));
+      if (debt && (!keyMatchesDir || debt.slug === slug)) out.push({ debt, duePath, dir });
+      else malformed++;
+    } catch {
+      malformed++;
+    }
+  }
+  addMalformed(malformed);
+}
+
 /**
  * `dz reqe` — the re-QE debt ledger (backlog 6b40e667): list usage-switched same-family QE debts,
  * print the cross-family review brief, settle FAIL-CLOSED against a graded report.
@@ -7642,6 +8997,770 @@ function cmdReqe(options: Map<string, string>, flags: Set<string>, cwd: string,
   return 0;
 }
 
+/* -------------------------------------------------------------------------- */
+/* `dz qe-bridge` — the reverse QE bridge (feature qe-bridge-claude, ADR-001)   */
+/* -------------------------------------------------------------------------- */
+
+/** Review timeout default: an adversarial QE pass legitimately takes minutes (NFR-3). */
+const QE_BRIDGE_DEFAULT_TIMEOUT_S = 600;
+const QE_BRIDGE_MIN_TIMEOUT_S = 30;
+const QE_BRIDGE_MAX_TIMEOUT_S = 3600;
+/** Probe timeout — the mirror of `codexProbeCommand`'s `timeout 60`. */
+const QE_BRIDGE_PROBE_TIMEOUT_MS = 60_000;
+
+export interface ClaudeBridgeRun {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  spawnError: string | null;
+}
+
+/**
+ * Run one `claude` call with the prompt on STDIN. Spawn-injectable, and NEVER throws: a missing
+ * binary, a crash and a hang all come back as DATA, because the taxonomy above them can only name
+ * a failure it is handed. (The first draft of this function let the ENOENT escape as an uncaught
+ * exception and the command never settled — the acid A1 red, quoted in red-green.md.)
+ *
+ * Mirrors `probeContent`'s settled-flag + SIGTERM deadline shape (`cli.ts` probes) and scrubs
+ * `PROBE_SCRUB_ENV`, so a bridge launched from inside a nested Claude session cannot inherit the
+ * parent's session identity (SEC-4).
+ */
+export async function runClaudeBridge(
+  bin: string,
+  argv: string[],
+  promptStdin: string,
+  timeoutMs: number,
+  cwd: string = process.cwd(),
+  spawnImpl: typeof spawn = spawn,
+): Promise<ClaudeBridgeRun> {
+  // A THIN WRAPPER over runChildBridge since the loop runner needed the same machinery with two
+  // extra knobs. This signature is consumed by the qe-bridge suites and MUST NOT change.
+  return runChildBridge(bin, argv, { stdinText: promptStdin, timeoutMs, cwd, detached: false, spawnImpl });
+}
+
+/** How long a child's process group gets to honour SIGTERM before SIGKILL (Step-8 MEDIUM-14). */
+const CHILD_SIGKILL_GRACE_MS = 2000;
+
+/**
+ * The MINIMAL environment a dispatched child gets (Step-8 HIGH-9).
+ *
+ * A deny-list removes what somebody remembered; an allow-list carries what the child needs and
+ * nothing else. The named set is deliberately boring — enough for a binary to find itself, resolve
+ * a home directory, write a temp file and talk to a proxy — plus each runtime's own credential
+ * variables, which are listed because they are REQUIRED, not because they happened to be present.
+ * Anything a future adapter needs is added HERE, visibly, with a reason.
+ */
+const CHILD_ENV_BASE: readonly string[] = [
+  'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'TZ',
+  'TMPDIR', 'TEMP', 'TMP',
+  'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
+  // node itself, for a child that IS node
+  'NODE_EXTRA_CA_CERTS',
+];
+
+/**
+ * CREDENTIALS ARE PER FAMILY (Step-8 re-QE H9 — the round-1 allowlist shipped BOTH sets to BOTH
+ * runtimes, which is a shorter list of the same mistake).
+ *
+ * A codex dispatch has no business holding an Anthropic key, and vice versa. The two runtimes are
+ * separate blast radii precisely because the cross-model rule makes them review each other: if one
+ * is compromised or simply misbehaves, it must not be carrying the other's credentials. The base
+ * above is boring on purpose — enough to find a binary, a home directory and a proxy — and nothing
+ * in it authenticates anything.
+ */
+const CHILD_ENV_BY_FAMILY: Readonly<Record<BridgeFamily, readonly string[]>> = {
+  claude: ['ANTHROPIC_API_KEY', 'CLAUDE_CONFIG_DIR'],
+  openai: ['OPENAI_API_KEY', 'CODEX_HOME'],
+};
+
+function buildAllowlistEnv(extra: readonly string[], parent: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const out: NodeJS.ProcessEnv = {};
+  for (const key of [...CHILD_ENV_BASE, ...extra]) {
+    const v = parent[key];
+    if (typeof v === 'string') out[key] = v;
+  }
+  return out;
+}
+
+/** Test seam for H9: the exact environment ONE family's child would receive. */
+export function __wfChildEnvTestSeam(family: BridgeFamily, parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  return buildAllowlistEnv(CHILD_ENV_BY_FAMILY[family], parent);
+}
+
+/**
+ * THE child-process wrapper both the qe-bridge and the loop runner ride (ADR-002 O1: ONE impure
+ * wrapper, not two). Generalized from `runClaudeBridge` with the same guarantees — a settled flag so
+ * no path resolves twice, a deadline timer that SIGTERMs, the `PROBE_SCRUB_ENV` scrub so a bridge
+ * launched from inside a nested Claude session cannot inherit it, and an injectable `spawnImpl` —
+ * plus the two knobs the generalization adds:
+ *
+ *   • `stdinText: null` ⇒ `stdio[0] = 'ignore'`. MEASURED: codex-cli 0.148.0 prints
+ *     `Reading additional input from stdin...` and WAITS when stdin is left open. Passing an empty
+ *     string is not the same thing as closing it.
+ *   • `detached: true` ⇒ the child leads its OWN process group, so the runner can kill the whole
+ *     group (AM-10). `onSpawn` hands the live child to the caller's registry at the only moment the
+ *     pid is knowable.
+ *
+ * Never throws: a spawn failure resolves with `spawnError` set, exactly like the original.
+ */
+export async function runChildBridge(
+  bin: string,
+  argv: string[],
+  opts: {
+    stdinText: string | null;
+    timeoutMs: number;
+    cwd: string;
+    detached: boolean;
+    spawnImpl?: typeof spawn;
+    onSpawn?: (child: ChildProcess) => void;
+    /**
+     * `'scrub'` (default) — inherit the parent environment minus `PROBE_SCRUB_ENV`. The historical
+     * qe-bridge posture; unchanged so its suites keep their meaning.
+     * `'allowlist'` — build the child's environment from a NAMED list and nothing else
+     * (Step-8 HIGH-9). A deny-list can only remove what somebody thought of; every cloud token,
+     * registry credential and unrelated secret in the parent survived it. The loop runner uses this.
+     */
+    envMode?: 'scrub' | 'allowlist';
+    /** Extra variable names the allowlist should carry (a family's own auth, named by the caller). */
+    envExtra?: readonly string[];
+  },
+): Promise<ClaudeBridgeRun> {
+  const spawnImpl = opts.spawnImpl ?? spawn;
+  return new Promise<ClaudeBridgeRun>((resolveRun) => {
+    const env: NodeJS.ProcessEnv = opts.envMode === 'allowlist'
+      ? buildAllowlistEnv(opts.envExtra ?? [])
+      : { ...process.env };
+    if (opts.envMode !== 'allowlist') for (const key of PROBE_SCRUB_ENV) delete env[key];
+    let out = '';
+    let err = '';
+    let settled = false;
+    let timedOut = false;
+    let child: ReturnType<typeof spawn> | undefined;
+    const finish = (spawnError: string | null, exitCode: number | null): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      // A DETACHED child leads its own group, so kill the GROUP — killing the leader alone leaves
+      // whatever it spawned running (the orphan class AM-10 exists to close). SIGTERM is a REQUEST;
+      // a group that ignores it would outlive the runner, so a bounded grace period later the same
+      // group gets SIGKILL, which is not a request (Step-8 MEDIUM-14).
+      // EVERY termination goes through the one guarded chokepoint (re-QE NEW-C4) — there is no
+      // second call shape here to forget to guard.
+      const sent = signalChildSafely(child, 'SIGTERM', opts.detached);
+      if (sent) {
+        const escalation = setTimeout(() => {
+          signalChildSafely(child, 'SIGKILL', opts.detached);
+        }, CHILD_SIGKILL_GRACE_MS);
+        escalation.unref?.(); // the grace timer must never hold the runner's event loop open
+      }
+      resolveRun({ stdout: out, stderr: err, exitCode, timedOut, spawnError });
+    };
+    const timer = setTimeout(() => {
+      timedOut = true;
+      finish(null, null);
+    }, opts.timeoutMs);
+    try {
+      child = spawnImpl(bin, argv, {
+        cwd: opts.cwd,
+        env,
+        detached: opts.detached,
+        stdio: [opts.stdinText === null ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+      });
+    } catch (error) {
+      finish(`cannot run \`${bin}\`: ${error instanceof Error ? error.message : String(error)}`, null);
+      return;
+    }
+    opts.onSpawn?.(child as ChildProcess);
+    child.on('error', (error: Error) => finish(`cannot run \`${bin}\`: ${error.message}`, null));
+    child.stdout?.on('data', (c: Buffer) => { out += c.toString(); });
+    child.stderr?.on('data', (c: Buffer) => { err += c.toString(); });
+    child.on('close', (code) => finish(null, code));
+    // EPIPE when the child died before reading: already reported through 'error'/'close'.
+    child.stdin?.on('error', () => { /* ignored on purpose */ });
+    if (opts.stdinText !== null) {
+      try {
+        child.stdin?.write(opts.stdinText);
+        child.stdin?.end();
+      } catch {
+        /* the close/error handlers decide the outcome */
+      }
+    }
+  });
+}
+
+/** stderr wording that PROVES a login problem. Anything else stays unclassified: a guessed reason
+ * is a small lie, and the failure record carries the raw evidence instead (ADR-001 D3-A). */
+function classifyClaudeStderr(stderr: string): 'claude-not-logged-in' | 'exit-nonzero' {
+  return /invalid api key|not logged in|please run \/login|unauthorized|authentication (failed|error)|oauth token (has )?expired/i.test(stderr)
+    ? 'claude-not-logged-in'
+    : 'exit-nonzero';
+}
+
+/** Test seam AND escape hatch for a non-standard install: the executable the bridge spawns.
+ * Deliberately an ENV VAR and not a flag — a reviewer's identity should not be something a caller
+ * can redirect with a casual command-line switch, and every record says loudly when it was used
+ * (round-2 M3). */
+const QE_BRIDGE_CLAUDE_BIN_ENV = 'DZ_QE_BRIDGE_CLAUDE_BIN';
+
+/**
+ * CRASH FAILPOINT (round-4 R4-1) — test-only, and the ONLY thing it can do is stop. Set
+ * `DZ_QE_BRIDGE_FAILPOINT=hang-before-rename` and the process blocks after the temp record is
+ * written and before the rename, so a test can SIGKILL it exactly inside the window the atomic
+ * update exists to close. Unset (the normal case) it is one string comparison and no behaviour.
+ * A crash-window property that no test can enter is a claim, not a guarantee.
+ */
+const QE_BRIDGE_FAILPOINT_ENV = 'DZ_QE_BRIDGE_FAILPOINT';
+
+/** Files under `.fa-state/qe-bridge/` may quote reviewed source and reviewer prose: owner-only. */
+const RECORD_FILE_MODE = 0o600;
+const RECORD_DIR_MODE = 0o700;
+
+/**
+ * Write a NEW file, never through a symlink, never over an existing one, and never world-readable.
+ * `wx` gives O_EXCL (no overwrite, no symlink follow at the final component); the explicit chmods
+ * defeat the process umask, which `mode:` alone does not (MEASURED: under umask 022 the round-1
+ * writes landed 0644/0755 — round-2 MAJOR M6).
+ */
+function writeNewFileOrThrow(path: string, content: string, mode: number = RECORD_FILE_MODE): void {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: RECORD_DIR_MODE });
+  try {
+    chmodSync(dir, RECORD_DIR_MODE);
+  } catch { /* not ours to tighten (a pre-existing shared dir) — the file mode below still applies */ }
+  writeFileSync(path, content, { flag: 'wx', mode });
+  chmodSync(path, mode);
+}
+
+/**
+ * Path containment that survives a symlinked PARENT (round-2 M6). Lexical `startsWith` is not
+ * containment: `features/x/` can be a symlink to `/etc`, and `wx` only refuses a symlink at the
+ * FINAL component. So: walk from the deepest EXISTING ancestor, realpath it, and require the result
+ * to stay under the realpath of the root — and refuse outright if any existing component on the way
+ * is a symlink.
+ */
+function containedUnderRoot(root: string, target: string): { ok: true; path: string } | { ok: false; why: string } {
+  let realRoot: string;
+  try {
+    realRoot = realpathSync(root);
+  } catch {
+    return { ok: false, why: `the project root ${root} does not resolve` };
+  }
+  const abs = resolve(root, target);
+  const rel = relative(realRoot, abs);
+  if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) return { ok: false, why: `${target} resolves outside the project root` };
+
+  // deepest existing ancestor, with every existing component checked for a symlink
+  const parts = rel.split(sep).filter((p) => p !== '');
+  let walked = realRoot;
+  for (const part of parts) {
+    const next = join(walked, part);
+    let st;
+    try {
+      st = lstatSync(next);
+    } catch {
+      break; // this component does not exist yet: nothing below it can be a symlink either
+    }
+    if (st.isSymbolicLink()) return { ok: false, why: `${target} passes through the symlink ${relative(realRoot, next)} — refusing (a symlinked parent can redirect a new file out of the repository)` };
+    walked = next;
+  }
+  let realWalked: string;
+  try {
+    realWalked = realpathSync(walked);
+  } catch {
+    return { ok: false, why: `${target} has an unresolvable parent` };
+  }
+  const realRel = relative(realRoot, realWalked);
+  if (realRel.startsWith('..') || isAbsolute(realRel)) return { ok: false, why: `${target} escapes the project root through its parent directories` };
+  return { ok: true, path: abs };
+}
+
+/**
+ * `dz qe-bridge --family claude` — run a Claude reviewer over Step-8-scoped inputs and land a
+ * PARSED signoff (feature qe-bridge-claude, ADR-001).
+ *
+ * The point of the command: when CODEX hosts the run there is no Claude agent plane to dispatch
+ * from, so the cross-family QE rule has no vehicle — `buildReqeBrief` hands the human a `null`
+ * command template for exactly this case. This is that vehicle, callable from a plain shell.
+ *
+ * ISOLATION (round-2 CRITICAL C1): both calls run from an EMPTY temporary directory with the
+ * runtime's own `--safe-mode --strict-mcp-config --tools '' --no-session-persistence`, and the
+ * verdict is read out of the `--output-format json` result envelope. Without that, the reviewer is a
+ * fully customized session running INSIDE the repository under review, and hooks/plugins can print a
+ * complete signoff onto the same stdout the parser reads (MEASURED — see red-green.md).
+ *
+ * Exit codes: 0 = a signoff was PARSED (any grade — the bridge reports, `dz reqe` gates),
+ * 1 = a NAMED failure (record in `.fa-state/qe-bridge/failed-*.json`, raw output beside it,
+ * never at `--out`), 2 = a usage error (nothing spawned, nothing written).
+ */
+async function cmdQeBridge(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): Promise<number> {
+  const json = flags.has('json');
+  const usage = 'dz qe-bridge --family claude --slug <feature> [--coder-family codex|claude] [--model <id>] [--files a,b] [--out <file>] [--timeout <s>] [--allow-same-family] [--project <dir>] [--json]';
+
+  const usageError = (message: string): number => {
+    write(json ? JSON.stringify({ ok: false, error: message, exitCode: 2 }) : `dz qe-bridge: ${message}\n${usage}`);
+    return 2;
+  };
+
+  if (flags.has('help')) {
+    if (json) {
+      write(JSON.stringify({ help: usage, exitCode: 0 }));
+      return 0;
+    }
+    write(usage);
+    write('  Runs a CLAUDE reviewer over a feature’s Step-8 artifacts from ANY host (a Codex session included)');
+    write('  and writes a parsed SIGNOFF. Exit 0 = a signoff was parsed (ANY grade — the bridge reports, it does');
+    write('  not gate); 1 = a named failure (see features/<slug>/.fa-state/qe-bridge/failed-*.json); 2 = usage.');
+    write('  --family codex is reserved: the forward bridge is `codex exec` (see .claude/rules/feature-adr-conventions.md).');
+    write('  Default report: features/<slug>/08b_reqe_report.md — settle it with');
+    write('    dz reqe --slug <feature> --done --report features/<feature>/08b_reqe_report.md');
+    write('  DISCLOSURE: the bridge sends the extracts you scope (--files, plus the feature’s manifest/ADR/QE report)');
+    write('  to the Claude runtime. It cannot classify secrets — scoping the content you scope is YOUR decision (SEC-5).');
+    return 0;
+  }
+
+  const ALLOWED_FLAGS = new Set(['json', 'help', 'allow-same-family']);
+  for (const flag of flags) {
+    if (!ALLOWED_FLAGS.has(flag)) {
+      return usageError(`unknown option --${flag}` + (['model', 'slug', 'family', 'out', 'files', 'timeout', 'coder-family', 'project'].includes(flag) ? ` (it takes a value: --${flag} <value>)` : ''));
+    }
+  }
+  const ALLOWED_OPTIONS = new Set(['family', 'slug', 'coder-family', 'model', 'files', 'out', 'timeout', 'project']);
+  for (const key of options.keys()) {
+    if (key.startsWith('_positional_')) return usageError(`unexpected argument "${options.get(key)}"`);
+    if (key === 'claude-bin') return usageError(`--claude-bin was removed in favour of the ${QE_BRIDGE_CLAUDE_BIN_ENV} environment variable — a TEST SEAM, recorded loudly in every signoff (binOverride:true). Who reviews is not a casual command-line switch.`);
+    if (!ALLOWED_OPTIONS.has(key)) return usageError(`unknown option --${key}`);
+  }
+
+  // ── family (the reserved codex direction errors with a pointer, never a silent alias) ──
+  const family = options.get('family');
+  if (family === undefined) return usageError('--family claude is required');
+  if (family === 'codex' || family === 'openai') {
+    return usageError('--family codex is reserved — the FORWARD bridge already exists: dispatch `codex exec -m <probed-id> --sandbox read-only "<brief>" < /dev/null` (one bridge per direction; see .claude/rules/feature-adr-conventions.md)');
+  }
+  if (family !== 'claude') return usageError(`unsupported --family ${family} (this leg ships "claude" only)`);
+
+  const slug = options.get('slug') ?? '';
+  if (!isSafeSlug(slug)) return usageError('a kebab-case --slug <feature> is required (no path separators, max 40 chars)');
+
+  const root = resolve(cwd, options.get('project') ?? '.');
+  const featureDir = join(root, 'features', slug);
+  if (!existsSync(featureDir)) return usageError(`no feature directory at features/${slug} — the bridge reviews an existing feature’s artifacts`);
+
+  // ── coder family: the RECORDED DEBT is the authority; the flag may only fill a gap ──
+  //
+  // Round-2 MAJOR M3: round 1 let `--coder-family codex` override a debt that said `claude`, which
+  // turns the loud `--allow-same-family` escape into an optional formality — a Claude-coded feature
+  // could be Claude-reviewed by mis-declaring one flag. The debt is written by the pipeline; the
+  // flag is written by whoever is running the command.
+  let coderFamily: BridgeFamily | null = null;
+  let coderFamilySource = 'flag';
+  let recordedDebtFamily: BridgeFamily | null = null;
+  const duePath = join(featureDir, '.fa-state', 'reqe-due.json');
+  if (existsSync(duePath)) {
+    try {
+      const debt = parseReqeDebt(readFileSync(duePath, 'utf-8'));
+      if (debt) recordedDebtFamily = debt.coderFamily;
+    } catch { /* unreadable debt: treated as absent, and the flag must then be given */ }
+  }
+  const coderOpt = options.get('coder-family');
+  if (coderOpt !== undefined) {
+    // The FLAG surface stays a closed allowlist (the cmdQeBridge discipline — a flag is not a
+    // place to accept whatever parses); the FAMILY behind it comes from the ONE mapper the loop
+    // runner also uses for its same-family comparison (ADR-002 W20/AM-17). A second normalization
+    // here is how a codex-coded run comes to be reviewed by codex under a claude label — the
+    // agreement between the two call sites is pinned by a test, not by care.
+    const asked = coderOpt === 'codex' || coderOpt === 'openai' || coderOpt === 'claude' ? modelFamily(coderOpt) : null;
+    if (asked === null) return usageError(`--coder-family must be codex or claude (got "${coderOpt}")`);
+    if (recordedDebtFamily !== null && recordedDebtFamily !== asked) {
+      return usageError(
+        `--coder-family ${coderOpt} contradicts the recorded debt at features/${slug}/.fa-state/reqe-due.json, which says the coder family was ${recordedDebtFamily}. ` +
+        'The debt is the authority: it was written by the run being reviewed, the flag by whoever is invoking this command. ' +
+        'Refusing rather than letting a flag re-label who wrote the code — that label is what decides whether this review is cross-family. ' +
+        'Fix the flag, or correct the debt file if IT is wrong.',
+      );
+    }
+    coderFamily = asked;
+  } else if (recordedDebtFamily !== null) {
+    coderFamily = recordedDebtFamily;
+    coderFamilySource = 'reqe-due.json';
+  }
+  if (coderFamily === null) {
+    return usageError(`--coder-family codex|claude is required (no readable re-QE debt at features/${slug}/.fa-state/reqe-due.json to read it from) — who WROTE the code decides whether this review is cross-family`);
+  }
+
+  // ── --out: under the repo, no traversal, no control characters, no symlinked parents ──
+  const outOpt = options.get('out') ?? join('features', slug, '08b_reqe_report.md');
+  if (hasUnsafePathChars(outOpt) || hasDotDotSegment(outOpt)) return usageError('--out must not contain control characters or ".." segments');
+  const outCheck = containedUnderRoot(root, outOpt);
+  if (!outCheck.ok) return usageError(`--out ${outCheck.why}`);
+  const outPath = outCheck.path;
+
+  // ── timeouts: Number.isFinite-safe clamp (the numeric-clamp lesson) ──
+  let timeoutS = QE_BRIDGE_DEFAULT_TIMEOUT_S;
+  const timeoutRaw = options.get('timeout');
+  if (timeoutRaw !== undefined) {
+    const n = Number(timeoutRaw);
+    if (!Number.isFinite(n)) return usageError(`--timeout must be a number of seconds (got "${timeoutRaw}")`);
+    timeoutS = Math.min(QE_BRIDGE_MAX_TIMEOUT_S, Math.max(QE_BRIDGE_MIN_TIMEOUT_S, Math.floor(n)));
+  }
+
+  // ── model candidates: an allowlist says a name is spellable, only the probe says it answers ──
+  const modelOpt = options.get('model');
+  if (modelOpt !== undefined && !isSafeClaudeId(modelOpt)) {
+    return usageError(`unsafe --model id "${modelOpt}" — ids must match /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/ (a leading "-" would become an option)`);
+  }
+  const candidates = modelOpt !== undefined ? [modelOpt] : Object.keys(KNOWN_CLAUDE);
+
+  const binRaw = process.env[QE_BRIDGE_CLAUDE_BIN_ENV];
+  const binOverride = typeof binRaw === 'string' && binRaw.trim() !== '';
+  const binOpt = binOverride ? binRaw.trim() : 'claude';
+  if (hasUnsafePathChars(binOpt)) return usageError(`${QE_BRIDGE_CLAUDE_BIN_ENV} must not contain control characters`);
+  let resolvedBin = binOpt;
+  if (binOverride) {
+    try {
+      resolvedBin = realpathSync(binOpt);
+    } catch {
+      resolvedBin = binOpt; // unresolvable: recorded as given, and the spawn will name the failure
+    }
+  }
+
+  // ── extracts: SCOPED, never a repo dump ──
+  const extracts: NamedExtract[] = [];
+  const pushIfPresent = (rel: string, label: string): void => {
+    const p = join(root, rel);
+    try {
+      if (!lstatSync(p).isFile()) return;
+      extracts.push({ label, text: readFileSync(p, 'utf-8') });
+    } catch { /* absent: the brief says so by omission */ }
+  };
+  pushIfPresent(join('features', slug, '07_code_changes', 'change_manifest.md'), `features/${slug}/07_code_changes/change_manifest.md`);
+  const adrDir = join(featureDir, '03_adr');
+  if (existsSync(adrDir)) {
+    for (const f of readdirSync(adrDir).filter((n) => n.endsWith('.md')).sort()) {
+      pushIfPresent(join('features', slug, '03_adr', f), `features/${slug}/03_adr/${f}`);
+    }
+  }
+  pushIfPresent(join('features', slug, '08_qe_report.md'), `features/${slug}/08_qe_report.md (the review ON RECORD — judge it, do not inherit it)`);
+
+  const filesOpt = options.get('files');
+  for (const rel of (filesOpt ?? '').split(',').map((s) => s.trim()).filter((s) => s !== '')) {
+    if (hasUnsafePathChars(rel) || hasDotDotSegment(rel) || isAbsolute(rel)) {
+      return usageError(`--files entry "${rel}" must be a repo-relative path with no ".." segments and no control characters`);
+    }
+    const check = containedUnderRoot(root, rel);
+    if (!check.ok) return usageError(`--files entry "${check.why}"`);
+    let st;
+    try {
+      st = lstatSync(check.path);
+    } catch {
+      return usageError(`--files entry "${rel}" does not exist`);
+    }
+    if (!st.isFile()) return usageError(`--files entry "${rel}" is not a regular file (symlinks are refused)`);
+    extracts.push({ label: rel, text: readFileSync(check.path, 'utf-8') });
+  }
+  if (extracts.length === 0) {
+    return usageError(`nothing to review: features/${slug} has no change manifest, ADR or QE report, and no --files were given`);
+  }
+
+  // ── run identity + the audit bundle (round-2 M7) ──
+  //
+  // R3-2: the state directory is checked with the SAME containment walk as `--out`, BEFORE anything
+  // is created in it. Round 2 contained the record PATHS but not the directory they live in, so a
+  // symlinked `.fa-state/qe-bridge` (or `.fa-state`) silently redirected every write — and every
+  // chmod — outside the repository. A guard that covers the leaves but not the branch is not a guard.
+  const stateDirRel = join('features', slug, '.fa-state', 'qe-bridge');
+  const stateCheck = containedUnderRoot(root, stateDirRel);
+  if (!stateCheck.ok) return usageError(`the audit state directory ${stateCheck.why}`);
+  const stateDir = stateCheck.path;
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const runId = `${stamp}-${randomBytes(4).toString('hex')}`;
+  const requestedOut = relative(root, outPath);
+  const uniquePath = (base: string, ext: string): string => {
+    let candidate = `${base}${ext}`;
+    for (let n = 2; existsSync(candidate); n += 1) candidate = `${base}-${n}${ext}`;
+    return candidate;
+  };
+  /** Retain the raw reviewer stdout. THROWS on failure (R3-3): round 2 swallowed the error and
+   * recorded `rawStdoutFile: null`, which turns "we could not keep the evidence" into a field nobody
+   * reads. On the success path an unretainable stdout fails the run; on a failure path the forensics
+   * are best-effort, because the run is already failing for a named reason. */
+  const retainRaw = (stdout: string, kind: 'signoff' | 'failed'): string | null => {
+    if (stdout === '') return null;
+    const p = uniquePath(join(stateDir, `${kind}-${runId}`), '.stdout.txt');
+    writeNewFileOrThrow(p, stdout);
+    return relative(root, p);
+  };
+  const retainRawBestEffort = (stdout: string, kind: 'signoff' | 'failed'): string | null => {
+    try {
+      return retainRaw(stdout, kind);
+    } catch {
+      return null;
+    }
+  };
+
+  let promptSha256: string | null = null;
+
+  const failRun = (
+    reason: BridgeFailureReason,
+    detail: string,
+    model: string | null,
+    forensics?: { stdout: string; stderr: string },
+  ): number => {
+    const emittedAt = new Date().toISOString();
+    const rawStdoutFile = forensics === undefined ? null : retainRawBestEffort(forensics.stdout, 'failed');
+    const record = buildBridgeFailureRecord(reason, detail, {
+      slug,
+      model,
+      emittedAt,
+      runId,
+      claudeBin: resolvedBin,
+      binOverride,
+      requestedOut,
+      reportWritten: false,
+      rawStdoutFile,
+      promptSha256,
+    });
+    let recordPath = '';
+    try {
+      recordPath = uniquePath(join(stateDir, `failed-${runId}`), '.json');
+      writeNewFileOrThrow(recordPath, `${JSON.stringify(record, null, 2)}\n`);
+      if (forensics && forensics.stderr.trim() !== '') writeNewFileOrThrow(uniquePath(join(stateDir, `failed-${runId}`), '.stderr.txt'), forensics.stderr);
+    } catch (primaryError) {
+      // R3-1: the one condition that breaks the record medium ITSELF (`audit-write-failed`) must
+      // still leave a named record behind, or the closed taxonomy has a member nothing can evidence.
+      // Fall back ONE level up, inside the same per-feature state plane — not to an invented path.
+      try {
+        recordPath = uniquePath(join(featureDir, '.fa-state', `qe-bridge-fallback-${runId}`), '.json');
+        writeNewFileOrThrow(recordPath, `${JSON.stringify({ ...record, fallbackFrom: relative(root, stateDir), fallbackReason: String(primaryError) }, null, 2)}\n`);
+      } catch (fallbackError) {
+        write(json ? JSON.stringify({ ok: false, reason, detail, recordError: String(fallbackError), exitCode: 1 }) : `dz qe-bridge: ${reason} — ${detail}\n  (the failure record could NOT be written: ${String(fallbackError)})`);
+        return 1;
+      }
+    }
+    if (json) write(JSON.stringify({ ok: false, reason, detail, record: relative(root, recordPath), runId, reportWritten: false, requestedOut, exitCode: 1 }));
+    else {
+      write(`dz qe-bridge: FAILED — ${reason}`);
+      write(`  ${detail}`);
+      write(`  record: ${relative(root, recordPath)}`);
+      write(`  no report was written at ${requestedOut} — an unparseable or absent review is never a passing one.`);
+    }
+    return 1;
+  };
+
+  // ── the prompt (built BEFORE any model call: a same-family refusal must cost nothing) ──
+  const built = buildBridgePrompt({ slug, coderFamily, allowSameFamily: flags.has('allow-same-family'), extracts });
+  if (!built.ok) return failRun(built.reason, built.detail, null);
+  const prompt = built.prompt;
+  promptSha256 = createHash('sha256').update(prompt).digest('hex');
+
+  // ── the isolated working directory: an EMPTY dir, so project-scoped discovery finds nothing ──
+  let isolatedCwd: string;
+  try {
+    isolatedCwd = mkdtempSync(join(tmpdir(), 'dz-qe-bridge-iso-'));
+  } catch (error) {
+    return failRun('probe-failed', `could not create an isolated working directory for the reviewer: ${String(error)}`, null);
+  }
+  const cleanupIsolated = (): void => {
+    try {
+      rmSync(isolatedCwd, { recursive: true, force: true });
+    } catch { /* a leftover empty temp dir is not worth failing a review over */ }
+  };
+
+  try {
+    // ── probe: the allowlist is a search order, the probe is the answer ──
+    let probed: string | null = null;
+    const probeNotes: string[] = [];
+    for (const id of candidates) {
+      const probeArgs = claudeProbeArgs(id);
+      if (probeArgs === null) {
+        probeNotes.push(`${id}: unsafe id, never spawned`);
+        continue;
+      }
+      const run = await runClaudeBridge(binOpt, probeArgs, '', QE_BRIDGE_PROBE_TIMEOUT_MS, isolatedCwd);
+      if (run.spawnError !== null) {
+        const enoent = /ENOENT|not found|no such file/i.test(run.spawnError);
+        return failRun(
+          enoent ? 'claude-not-found' : 'probe-failed',
+          enoent
+            ? `\`${binOpt}\` is not runnable (${run.spawnError}) — install/authenticate the Claude CLI, or point ${QE_BRIDGE_CLAUDE_BIN_ENV} at it`
+            : run.spawnError,
+          null,
+        );
+      }
+      if (run.timedOut) {
+        probeNotes.push(`${id}: probe timed out after ${QE_BRIDGE_PROBE_TIMEOUT_MS / 1000}s`);
+        continue;
+      }
+      if (interpretClaudeProbe({ stdout: run.stdout, exitCode: run.exitCode ?? 1 })) {
+        probed = id;
+        break;
+      }
+      const loginish = classifyClaudeStderr(run.stderr) === 'claude-not-logged-in';
+      if (loginish) {
+        return failRun('claude-not-logged-in', `the liveness probe for ${id} failed with a login error: ${run.stderr.trim().split('\n')[0]}`, null, { stdout: run.stdout, stderr: run.stderr });
+      }
+      probeNotes.push(`${id}: exit ${String(run.exitCode)}, no model-authored \`OK\` in the result envelope (${run.stdout.length} chars of stdout)${run.stderr.trim() === '' ? '' : ` (stderr: ${run.stderr.trim().split('\n')[0]})`}`);
+    }
+    if (probed === null) {
+      return failRun('probe-failed', `no candidate model answered the liveness probe — ${probeNotes.join('; ')}`, null);
+    }
+
+    // ── the review call ──
+    const reviewArgs = claudeReviewArgs(probed);
+    if (reviewArgs === null) return failRun('probe-failed', `the probed id ${probed} failed id validation on the review path`, probed);
+    const started = Date.now();
+    const review = await runClaudeBridge(binOpt, reviewArgs, prompt, timeoutS * 1000, isolatedCwd);
+    const elapsedMs = Date.now() - started;
+
+    if (review.spawnError !== null) {
+      const enoent = /ENOENT|not found|no such file/i.test(review.spawnError);
+      return failRun(enoent ? 'claude-not-found' : 'exit-nonzero', review.spawnError, probed, { stdout: review.stdout, stderr: review.stderr });
+    }
+    if (review.timedOut) {
+      return failRun('timeout', `the review call exceeded --timeout ${timeoutS}s and the child was killed (timeout-${timeoutS}s)`, probed, { stdout: review.stdout, stderr: review.stderr });
+    }
+    if (review.exitCode !== 0) {
+      const reason = classifyClaudeStderr(review.stderr);
+      return failRun(
+        reason,
+        `\`${binOpt}\` exited ${String(review.exitCode)}${review.stderr.trim() === '' ? ' with no stderr' : `: ${review.stderr.trim().split('\n')[0]}`}` +
+          (reason === 'exit-nonzero' ? ' — the cause is NOT classified: from outside the process a limit-exhaustion death and a crash look alike, so the raw evidence is saved instead of a guess.' : ''),
+        probed,
+        { stdout: review.stdout, stderr: review.stderr },
+      );
+    }
+    if (review.stdout.trim() === '') {
+      return failRun('empty-output', `the review call exited 0 with no output (${review.stdout.length} chars) — silence is not a clean review`, probed, { stdout: review.stdout, stderr: review.stderr });
+    }
+
+    // ── PARSE, never synthesize ──
+    const emittedAt = new Date().toISOString();
+    const parsed = parseBridgeOutput(review.stdout, { slug, coderFamily, model: probed, elapsedMs, promptSha256, emittedAt });
+    if (!parsed.ok) {
+      // No `?? <some named reason>` fallback: a state the parser did not name is its OWN failure
+      // (round-2 MAJOR M5 — laundering an unknown state into `no-grade-marker` reads like a verdict
+      // about the reviewer's text when it is really a verdict about our own code).
+      const reason: BridgeFailureReason = parsed.reason;
+      return failRun(reason, parsed.detail, probed, { stdout: review.stdout, stderr: review.stderr });
+    }
+    const signoff = parsed.signoff;
+
+    // ── landing (R3-3 ordering): AUDIT FIRST, then the report, then the truth about the report ──
+    //
+    // Round 2 wrote the report BEFORE the record, so a crash between the two left a report on disk
+    // and a record that said `reportWritten:false` — metadata that lies in the direction of "no
+    // review happened" while a review report sits next to it. The order below can only ever
+    // understate: the record exists first saying false, the report lands, then the record is
+    // corrected. A crash at any point leaves a record that is true or pessimistic, never optimistic.
+    let rawStdoutFile: string | null;
+    try {
+      rawStdoutFile = retainRaw(review.stdout, 'signoff');
+    } catch (error) {
+      return failRun(
+        'audit-write-failed',
+        `the review was PARSED (grade ${signoff.grade}) but its raw stdout could not be retained: ${String(error)} — an unauditable success is not a success, so the run FAILS rather than shipping a verdict nobody can re-derive`,
+        probed,
+        { stdout: review.stdout, stderr: review.stderr },
+      );
+    }
+
+    const recordText = (reportWritten: boolean): string => `${JSON.stringify(buildBridgeSignoffRecord(signoff, {
+      runId,
+      claudeBin: resolvedBin,
+      binOverride,
+      requestedOut,
+      reportWritten,
+      rawStdoutFile,
+      promptSha256,
+      ...(parsed.channels === undefined ? {} : { channels: parsed.channels }),
+    }), null, 2)}\n`;
+
+    let signoffPath: string;
+    try {
+      signoffPath = uniquePath(join(stateDir, `signoff-${runId}`), '.json');
+      writeNewFileOrThrow(signoffPath, recordText(false));
+    } catch (error) {
+      return failRun(
+        'audit-write-failed',
+        `the review was PARSED (grade ${signoff.grade}) but the signoff record could not be written: ${String(error)} — the verdict exists and cannot be persisted, so the run FAILS rather than reporting an unrecorded success`,
+        probed,
+        { stdout: review.stdout, stderr: review.stderr },
+      );
+    }
+
+    let reportError: unknown = null;
+    try {
+      writeNewFileOrThrow(outPath, renderBridgeReport(signoff), 0o600);
+    } catch (error) {
+      reportError = error;
+    }
+
+    if (reportError === null) {
+      // the ONLY moment `reportWritten:true` may appear: after the report is on disk
+      try {
+        // ATOMIC (R4-1): write a sibling temp file, then rename() over the original. On the same
+        // filesystem rename is atomic, so a reader — or a crash — sees the OLD complete record or
+        // the NEW complete record, never a truncated one. Round 3 truncated and rewrote in place,
+        // which made the "a crash leaves a record that is true or pessimistic" claim untrue in the
+        // one case it was about.
+        const tmpPath = `${signoffPath}.tmp.${process.pid}`;
+        writeNewFileOrThrow(tmpPath, recordText(true));
+        if (process.env[QE_BRIDGE_FAILPOINT_ENV] === 'hang-before-rename') {
+          // test-only: stop dead INSIDE the window, so a SIGKILL can prove the property
+          Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 600_000);
+        }
+        renameSync(tmpPath, signoffPath);
+        chmodSync(signoffPath, RECORD_FILE_MODE);
+      } catch (error) {
+        return failRun(
+          'audit-write-failed',
+          `the report landed at ${requestedOut} but the signoff record could not be updated to say so: ${String(error)} — the record on disk understates (reportWritten:false); re-run rather than trusting a record that disagrees with the tree`,
+          probed,
+          { stdout: review.stdout, stderr: review.stderr },
+        );
+      }
+    } else {
+      const detail = `the review was PARSED (grade ${signoff.grade}) but ${requestedOut} could not be written: ${String(reportError)} — prior evidence is never overwritten and a symlinked target is never followed; the verdict is preserved at ${relative(root, signoffPath)} with reportWritten:false`;
+      return failRun('report-write-failed', detail, probed, { stdout: '', stderr: '' });
+    }
+
+    if (json) {
+      write(JSON.stringify({
+        ok: true,
+        grade: signoff.grade,
+        gradedBy: signoff.gradedBy,
+        coderFamily: signoff.coderFamily,
+        coderFamilySource,
+        findings: signoff.findings.length,
+        report: requestedOut,
+        reportWritten: true,
+        signoff: relative(root, signoffPath),
+        rawStdout: rawStdoutFile,
+        runId,
+        binOverride,
+        claudeBin: resolvedBin,
+        elapsedMs,
+        promptChars: prompt.length,
+        promptSha256,
+        channels: parsed.channels,
+        exitCode: 0,
+      }));
+    } else {
+      write(`dz qe-bridge: GRADE ${signoff.grade} from claude/${signoff.gradedBy.model} — ${signoff.findings.length} finding(s) in ${Math.round(elapsedMs / 1000)}s`);
+      if (binOverride) write(`  ⚠ reviewer executable OVERRIDDEN via ${QE_BRIDGE_CLAUDE_BIN_ENV}: ${resolvedBin} (recorded as binOverride:true — this signoff does not prove Anthropic's runtime answered)`);
+      write(`  report:  ${requestedOut}`);
+      write(`  signoff: ${relative(root, signoffPath)}`);
+      write(`  settle:  dz reqe --slug ${slug} --done --report ${requestedOut}`);
+      write('  the bridge REPORTS (any grade exits 0); gating stays with dz reqe and the host pipeline.');
+    }
+    return 0;
+  } finally {
+    cleanupIsolated();
+  }
+}
+
+
 function cmdScore(options: Map<string, string>, flags: Set<string>, cwd: string, write: Write): number {
   const json = flags.has('json');
   if (flags.has('help')) {
@@ -9334,6 +11453,8 @@ async function cmdImportEcc(options: Map<string, string>, flags: Set<string>, cw
 export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   const cwd = io.cwd ?? process.cwd();
   const write: Write = io.write ?? ((line) => { console.log(line); });
+  // Diagnostics go to stderr so `dz <cmd> > out.txt` yields clean data (feature dz-cli-defects).
+  const writeErr: WriteErr = io.writeErr ?? ((line) => { console.error(line); });
   // Lazy STDIN reader — only `dz brain ground` reads it, and only when no positional prompt is
   // given. Never blocks: injected `io.stdin` wins; else read fd 0 synchronously, but bail to '' on
   // a TTY (nothing piped) or any read error. Grounding must never hang waiting on an empty pipe.
@@ -9376,14 +11497,14 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
   try {
     switch (command) {
       case 'init':
-        return await cmdInit(options, flags, cwd, write);
+        return await cmdInit(options, flags, cwd, write, writeErr);
       case 'verify':
-        return await cmdVerify(options, cwd, write);
+        return await cmdVerify(options, cwd, write, writeErr);
       case 'sync':
       case 'update':
-        return await cmdSync(options, flags, cwd, write);
+        return await cmdSync(options, flags, cwd, write, writeErr);
       case 'list':
-        return cmdList(options, cwd, write);
+        return cmdList(options, cwd, write, writeErr);
       case 'create-skill':
         return cmdCreateSkill(options, flags, cwd, write);
       case 'info':
@@ -9391,6 +11512,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'scout':
         return await cmdScout(options, flags, cwd, write);
       case 'workflow':
+        // `run` is ASYNC (it drives child processes); every other subcommand stays sync.
+        if ((options.get('_positional_0') ?? '') === 'run') return await cmdWorkflowRun(options, optionLists, flags, cwd, write);
         return cmdWorkflow(options, flags, cwd, write);
       case 'workflow-lint':
         return cmdWorkflowLint(options, flags, cwd, write);
@@ -9401,7 +11524,7 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'doctor':
         return await cmdDoctor(options, flags, cwd, write);
       case 'install':
-        return await cmdInstall(options, flags, cwd, write, io.installRunner);
+        return await cmdInstall(options, flags, cwd, write, writeErr, io.installRunner);
       case 'bundle':
         return cmdBundle(options, flags, cwd, write);
       case 'teach':
@@ -9429,17 +11552,17 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'verify-pack':
         return cmdVerifyPack(options, flags, cwd, write);
       case 'setup':
-        return await cmdSetup(options, flags, cwd, write);
+        return await cmdSetup(options, flags, cwd, write, writeErr);
       case 'pretrain':
         return cmdPretrain(options, cwd, write);
       case 'compose':
-        return cmdCompose(options, cwd, write);
+        return cmdCompose(options, cwd, write, writeErr);
       case 'diff':
         return cmdDiff(options, cwd, write);
       case 'recommend':
         return cmdRecommend(options, cwd, write);
       case 'upgrade':
-        return cmdUpgrade(options, flags, cwd, write);
+        return cmdUpgrade(options, flags, cwd, write, writeErr);
       case 'auto-canonicalize':
         return await cmdAutoCanonicalize(options, cwd, write);
       case 'publish':
@@ -9447,7 +11570,7 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'release':
         return cmdRelease(options, flags, cwd, write, io.releaseRunner);
       case 'parity':
-        return cmdParity(options, flags, write);
+        return cmdParity(options, flags, write, writeErr);
       case 'registry':
         return cmdRegistry(options, cwd, write);
       case 'benchmark':
@@ -9458,6 +11581,10 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return await cmdSyncUpstream(options, flags, cwd, write);
       case 'drift-check':
         return cmdDriftCheck(options, flags, cwd, write);
+      case 'hooks-sync':
+        return cmdHooksSync(options, flags, cwd, write, writeErr);
+      case 'agents-sync':
+        return cmdAgentsSync(options, flags, cwd, write, writeErr);
       case 'sync-canonical':
         return cmdSyncCanonical(options, flags, cwd, write);
       case 'plugin':
@@ -9475,7 +11602,7 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
       case 'retro':
         return await cmdRetro(options, flags, cwd, write);
       case 'feature-adr-setup':
-        return cmdFeatureAdrSetup(options, flags, cwd, write);
+        return cmdFeatureAdrSetup(options, flags, cwd, write, writeErr);
       case 'challenge':
         return cmdChallenge(options, flags, cwd, write);
       case 'discrimination-check':
@@ -9494,6 +11621,8 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return cmdScore(options, flags, cwd, write);
       case 'reqe':
         return cmdReqe(options, flags, cwd, write);
+      case 'qe-bridge':
+        return await cmdQeBridge(options, flags, cwd, write);
       case 'backlog':
         return await cmdBacklog(options, flags, cwd, write);
       case 'routing':
@@ -9512,7 +11641,9 @@ export async function runCli(argv: string[], io: CliIo = {}): Promise<number> {
         return 1;
     }
   } catch (error) {
-    write(`dz: ${error instanceof Error ? error.message : String(error)}`);
+    // stderr, not stdout: an uncaught failure is a diagnostic, and routing it through
+    // `write` is what made `dz list > skills.txt` write the error into the data file.
+    writeErr(`dz: ${error instanceof Error ? error.message : String(error)}`);
     return 1;
   }
 }