@dzhechkov/skills-feature-adr 1.3.36 → 1.3.40

package/README.md

@@ -139,7 +139,41 @@ Workflow({ scriptPath: '.claude/workflows/feature-adr.js',
 ```
 
 Omit the Codex knobs entirely for today's all-Claude behavior. The run result reports
-`plannerUsed` / `coderUsed` / `qeReviewerUsed` / `codexModel` so you can see who did what.
+`plannerUsed` / `coderUsed` / `qeReviewerUsed` / `codexModel` / `modelsUsed` so you can see who did what.
+
+### Per-stage model routing — `args.models`
+
+The three Codex knobs above are shortcuts. `args.models` is the **general dial**: an optional map that
+routes each of the 11 pipeline stages to an optimal model. Keys: `{router, requirements, research, adr,
+ideation, ddd, architecture, plan, code, qe, fleet}`. Each value is a **spec** — Claude
+`fable|opus|sonnet|haiku`, or Codex `codex` / `codex:<id>` / `codex:<id>:<reasoning>`
+(`reasoning ∈ low|medium|high|xhigh`; ids incl. `gpt-5.5`, `gpt-5.6`).
+
+**Recommended DEFAULT TABLE** (applied only when you opt in — one `args.models` key or any Codex knob
+turns it on; otherwise every stage is session-inherited, byte-identical to today):
+
+| router | requirements | adr | ideation | architecture | plan | code | qe | fleet |
+|---|---|---|---|---|---|---|---|---|
+| `fable` | `sonnet` | `opus` | `sonnet` | `opus` | `sonnet` | coder (default `opus`) | cross-model | `sonnet` |
+
+(`research` folds into `requirements`, `ddd` into `architecture` — recorded in `modelsUsed`, not a
+separate call.)
+
+**Cross-model QE default (load-bearing):** when `args.models.qe` is unset, QE auto-routes to the **other
+family than the coder** — a model that writes code must not also self-QE; independent cross-model review
+catches what self-review misses. coder=Codex ⇒ QE=Claude (`opus`); coder=Claude ⇒ QE=Codex
+(`codex:<top>:high`), or a Claude reviewer if Codex is unavailable (never blocks).
+
+**Precedence:** `args.models[stage]` wins; the legacy `planner`/`coder`/`qeReviewer`/`codexModel` knobs
+fill only unspecified stages. `codexModel` seeds the id for a bare `'codex'` spec. gpt-5.6-ready: a new
+Codex id is a data-only allowlist edit.
+
+```js
+// Claude writes the code; Codex independently QEs it (cross-model by construction):
+Workflow({ scriptPath: '.claude/workflows/feature-adr.js',
+  args: { slug: 'add-oauth', description: '…', tier: 'L',
+          models: { code: 'opus', qe: 'codex:gpt-5.6:high', architecture: 'opus', router: 'fable' } } })
+```
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.36",
+  "version": "1.3.40",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -375,6 +375,69 @@ Pre-flight, if Codex is `ready` (`codex-companion setup --json`), the orchestrat
 before launching; plain `/feature-adr` offers the same at the planning checkpoint. Omit the Codex knobs
 for today's all-Claude behavior. See `.claude/rules/feature-adr-ultracode.md`.
 
+**Per-stage model routing — `args.models` (one dial, 11 stages).** `args.models` is an optional map that
+routes each pipeline stage to an optimal model. Keys: `{router, requirements, research, adr, ideation,
+ddd, architecture, plan, code, qe, fleet}`. Each value is a **spec**:
+
+- **Claude** — `'fable' | 'opus' | 'sonnet' | 'haiku'` → adds `model` to that stage's `agent()` call
+  (any role `agentType` like `qe-code-reviewer` is PRESERVED).
+- **Codex** — `'codex'` / `'codex:<id>'` / `'codex:<id>:<reasoning>'` (e.g. `'codex:gpt-5.6:xhigh'`;
+  `reasoning ∈ low|medium|high|xhigh`; ids incl. `gpt-5.5`, `gpt-5.6`) → routes the stage to the
+  `codex:codex-rescue` runtime with that `codexModel` + reasoning hint.
+
+**Recommended DEFAULT TABLE** (applied only when you opt into routing — any one `args.models` key or any
+Codex knob flips it on; otherwise every stage stays session-inherited, byte-identical to today):
+
+| Stage | Default | | Stage | Default |
+|---|---|---|---|---|
+| router | `fable` | | architecture | `opus` |
+| requirements | `sonnet` | | plan | `sonnet` |
+| research | `sonnet` (folds into requirements) | | code | *the coder knob* (default Claude `opus`) |
+| adr | `opus` | | qe | *CROSS-MODEL of the coder* (see below) |
+| ideation | `sonnet` | | fleet | `sonnet` |
+| ddd | `opus` (folds into architecture) | | | |
+
+**Cross-model QE default (load-bearing).** When `args.models.qe` is UNSET, QE is auto-routed to the
+**other model family than the coder** — a model that WRITES code must not also SELF-QE; independent
+cross-model review catches what self-review misses. coder=Codex ⇒ QE=Claude (`opus`); coder=Claude ⇒
+QE=Codex (`codex:<top>:high`), or a Claude reviewer if Codex is unavailable (**never blocks**).
+
+**Precedence.** `args.models[stage]` is the general mechanism and WINS on conflict; the legacy
+`planner`/`coder`/`qeReviewer`/`codexModel` knobs are shortcuts that fill a stage only when `args.models`
+does not. `codexModel` sets the default id for a bare `'codex'` spec. Codex-fallback (Claude-first, then
+Codex on limit-exhaustion) stays a knob-only behavior; a direct `models.code='codex'` means codex-first.
+
+**gpt-5.6-ready** — a new Codex id is a DATA-ONLY addition to the `KNOWN_CODEX` allowlist (no control flow).
+**Reporting** — the run result includes `modelsUsed` (the resolved per-stage model) so you see who did what.
+
+*Example:* `Workflow({ scriptPath: '.claude/workflows/feature-adr.js', args: { slug, description, tier:
+'L', models: { code: 'opus', qe: 'codex:gpt-5.6:high', architecture: 'opus', router: 'fable' } } })` —
+Claude writes the code, Codex independently QEs it.
+
+**Usage-adaptive routing (pre-emptive Codex switch under limit pressure).** When routing is opted into,
+the workflow probes Claude SESSION (active 5h-block) and WEEKLY (rolling 7d) usage at EACH phase boundary
+via a minimal `dz usage --json` agent. When either metric is `>= usageThreshold` (default `70`) BEFORE a
+phase launches — OR the probe output is missing (agent-null, which often MEANS the limit was hit) — ALL
+remaining stages switch to `codex:<top>` (design/code/plan at `xhigh`, router/qe/fleet at `high`). When a
+later probe reads BOTH metrics below the threshold (positive numbers, not nulls), the normal Claude+Codex
+mix is RESTORED. Null percentages (unconfigured limits) change NOTHING in either direction. Switched
+stages are tagged ` (usage-switched)` in `modelsUsed`, and every flip is recorded in the result's
+`usageEvents` array (the audit trail — never trust promiseTags for this). Args:
+
+| `args.*` | Default | Effect |
+|---|---|---|
+| `usageAdaptive` | `true` when routing is requested (any `args.models` key or Codex knob); `false` otherwise | `true` forces it on even without other routing; `false` disables all probes (byte-identical to today) |
+| `usageThreshold` | `70` | the `>=` percent (either metric) that triggers the pre-emptive switch |
+| `usageReasoning` | the `OVERRIDE_REASONING` map | per-stage reasoning under the override (merge over the default: design/code/plan → `xhigh`, router/qe/fleet → `high`) |
+
+Configure the limits the probe measures against in `.dz/config.json` — `memory.usage.sessionTokenLimit`
+and `memory.usage.weeklyTokenLimit` (OPTIONAL; absent ⇒ `pct` is `null` and no switch fires). The
+percentages are **ESTIMATES** from local transcript aggregation (there is no official usage API);
+**calibrate** by scaling a limit by `X/100` when a real limit-hit lands at an estimated `X%`.
+**Honest caveat (the wrapper lesson):** at TRUE exhaustion even the Codex dispatch dies because
+`codex:codex-rescue` is a Claude wrapper subagent — so the switch MUST happen BEFORE, which is why the
+70% pre-emptive probe (not just reactive null-detection) is the real defense.
+
 ### Pattern memory loop (self-learning — runs in ALL modes)
 
 **Self-learning is MANDATORY on EVERY `/feature-adr` run — including plain `/feature-adr` without any
@@ -408,6 +471,15 @@ non-blocking — an error or empty result never stalls the pipeline. This layer
 **distinct from the Keysarium reward layer** installed by `--with-learning`: it uses agentic-qe MCP
 memory + the dz store, is UNCONDITIONAL for the dz half (recall/teach/fa-record run in every mode) and Direct-mode-only for the aqe-MCP half, and never touches `.keysarium/memory/`.
 
+**Canonical brain store — `args.brain` (never fragment the loop).** The dz durable loop only compounds if
+Step-0 recall and Step-8 teach hit the SAME store. The workflow pins both to a canonical **brain** —
+`args.brain`, default = the workspace root — via `cd <brain> && dz recall/teach … --project <brain>`, so a
+Step-8 teach issued from a coder that `cd`'d into a target repo still lands in the brain, not that repo's
+`.dz`. Omitting `args.brain` is behaviorally inert for a workspace-CWD run (`brain === repo`). **Share** a
+brain: `dz recall --all --json > patterns.json` → `dz teach --from-json patterns.json --project <brain>`
+(exact-text dedup, idempotent). **Recover** a fragmented store: `cd <stray-repo> && dz recall --all --json >
+/tmp/stray.json` → `dz teach --from-json /tmp/stray.json --project <brain>` to merge it back into the brain.
+
 **Live learning panel (`dz statusline`).** The pipeline **drives** the panel: at each pattern-memory-loop
 step above it records its live state via `dz statusline --fa-record …`, so `dz statusline` can surface
 per-run learning (which feature, which step, how many patterns recalled vs. newly stored). Each of the

package/templates/.claude/workflows/feature-adr.js

@@ -1,7 +1,7 @@
 export const meta = {
   name: 'feature-adr',
   description: 'Canonical /feature-adr --full-qe-extended pipeline as a reusable workflow: router+RECALL then design(ADR, applies learned patterns) then plan then code then agentic-qe QE+TEACH, producing features/<slug>/00-09 artifacts. MANDATORY in-process self-learning loop (Step-0 recall, apply, Step-8 teach). OPTIONAL Codex routing: args.planner=codex (Step-6), args.coder/qeReviewer=codex-fallback (Step-7/8 fall back to Codex when Claude limits exhaust; args.codexModel default auto, Codex self-selects top). Hybrid checkpoints (S/M autonomous; L/XL stop-after-plan).',
-  whenToUse: 'ultracode + a feature implementation. Invoke via Workflow({scriptPath:".claude/workflows/feature-adr.js", args:{slug, description, code, tier, stopAfter, planner, coder, qeReviewer, codexModel}}) instead of an ad-hoc orchestration, so every feature ships with an ADR + inline agentic-qe QE + self-learning.',
+  whenToUse: 'ultracode + a feature implementation. Invoke via Workflow({scriptPath:".claude/workflows/feature-adr.js", args:{slug, description, code, tier, stopAfter, planner, coder, qeReviewer, codexModel, brain}}) instead of an ad-hoc orchestration, so every feature ships with an ADR + inline agentic-qe QE + self-learning. args.brain pins the self-learning loop (recall/teach) to ONE canonical brain store (default = the workspace root) so lessons never fragment into a target repo when the coder cd`s away.',
   phases: [
     { title: 'Router', detail: 'Step 0 - classify + self-learning recall' },
     { title: 'Design', detail: 'Steps 1-5 - requirements, ADR, QCSD, architecture (tier-gated)' },
@@ -25,6 +25,206 @@ const REPO = (A.repo || '.').replace(/\/+$/, '')
 const FDIR = REPO + '/features/' + SLUG
 // The dz CLI: bare `dz` (on PATH for installed users) unless the caller overrides with a bin path.
 const DZ = A.dzBin || 'dz'
+// CANONICAL BRAIN store: the self-learning loop (Step-0 recall → Step-8 teach) MUST read+write ONE
+// shared pattern store so lessons never fragment into a target repo's .dz when the Step-7 coder cd's
+// away. BRAIN defaults to the workspace root (REPO) — so an OMITTED args.brain is behaviorally inert
+// for a workspace-CWD run (BRAIN===REPO, same store as today's bare recall/teach). Override args.brain
+// with a stable absolute path to keep ONE brain across several target checkouts.
+const BRAIN = (A.brain || REPO).replace(/\/+$/, '')
+// Helpers PIN every learn-loop command to the canonical brain: `cd <BRAIN> &&` survives a cd'd agent
+// (belt); `--project <BRAIN>` is explicit (suspenders). Either alone fixes it; together they also
+// survive the relative-vs-absolute --project resolution asymmetry between recall and teach.
+const DZ_RECALL = (terms) => 'cd ' + BRAIN + ' && ' + DZ + ' recall "' + terms + '" --project ' + BRAIN
+const DZ_TEACH = (lesson, reward, domain) =>
+  'cd ' + BRAIN + ' && ' + DZ + ' teach "' + lesson + '" --reward ' + reward + ' --domain ' + domain + ' --project ' + BRAIN
+
+// ── Codex-routing knobs (hoisted so the routing block below can fold them) ──
+// CODER/QE_REVIEWER ∈ 'claude'|'codex'|'codex-fallback'. On 'codex-fallback' the Claude agent runs
+// FIRST; if it returns null (e.g. the Claude Code session limit is exhausted mid-code/mid-QE), the SAME
+// task is retried on the codex:codex-rescue runtime. args.codexModel is DEFAULT 'auto' (Codex self-selects
+// the top model available to the account — ids are account/version-specific and move ahead of any static
+// default, so 'auto' is the portable choice). To hard-pin a specific id the orchestrator writes it into
+// ~/.codex/config.toml at pre-flight; the hint below only nudges.
+const CODEX_MODEL = A.codexModel || 'auto'
+const CODEX_HINT = ' (If you are the Codex runtime, prefer the ' + CODEX_MODEL + ' model.)'
+const CODER = (A.coder === 'codex' || A.coder === 'codex-fallback') ? A.coder : 'claude'
+const QE_REVIEWER = (A.qeReviewer === 'codex' || A.qeReviewer === 'codex-fallback') ? A.qeReviewer : 'claude'
+const PLANNER = (A.planner === 'codex') ? 'codex' : 'claude'
+
+// ── PER-STAGE MODEL ROUTING (args.models) ───────────────────────────────────
+// One dial routes each pipeline stage to an optimal model. `args.models` is an optional per-stage map
+// over {router, requirements, research, adr, ideation, ddd, architecture, plan, code, qe, fleet}; each
+// value a SPEC — Claude 'fable'|'opus'|'sonnet'|'haiku', or Codex 'codex' / 'codex:<id>' /
+// 'codex:<id>:<reasoning>' (reasoning ∈ low|medium|high|xhigh; ids incl gpt-5.5, gpt-5.6).
+// LOAD-BEARING: when args.models.qe is unset the QE stage is auto-routed to the OTHER family than the
+// coder (a model that codes must not also self-QE). BACKWARD-COMPATIBLE: omitting args.models AND the
+// legacy knobs ⇒ routingRequested is false ⇒ every stage resolves to {} ⇒ byte-identical to today.
+// Precedence: args.models[stage] > legacy planner/coder/qeReviewer/codexModel knobs > DEFAULT_MODELS.
+// gpt-5.6-ready: adding a codex id is a DATA-ONLY edit to KNOWN_CODEX. This block is the parser-safe
+// (string concat, explicit if/return, object-literal tables — NO template literals, NO inline ?:agent())
+// mirror of src/feature-adr-routing.ts; keep the two in lock-step (a drift test asserts it).
+const MODELS = (A.models && typeof A.models === 'object') ? A.models : {}
+const KNOWN_CODEX = { 'auto': 1, 'gpt-5.5': 1, 'gpt-5.6': 1 }
+const CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 }
+const DEFAULT_MODELS = { router: 'fable', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: null, qe: null, fleet: 'sonnet' }
+const routingRequested = (Object.keys(MODELS).length > 0) || (PLANNER === 'codex') || (CODER === 'codex' || CODER === 'codex-fallback') || (QE_REVIEWER === 'codex' || QE_REVIEWER === 'codex-fallback') || (A.usageAdaptive === true)
+const modelsUsed = {}
+
+// ── USAGE-ADAPTIVE ROUTING (pre-emptive codex switch at >= usageThreshold, default 70%) ──
+// At every phase boundary a minimal haiku probe runs 'dz usage --json'; when SESSION or WEEKLY
+// usage crosses the threshold BEFORE a phase launches, ALL remaining stages switch to
+// codex:<topCodexId> (design/code/plan at xhigh, router/qe/fleet at high). When a later probe reads
+// BOTH metrics below threshold (positive numbers, not nulls) the normal mix is RESTORED. The
+// load-bearing asymmetry: an agent-null probe (dispatch died — often MEANS limits) fail-safe-switches
+// TO codex; a value-null (unconfigured limits) flips NOTHING. All additive behind USAGE_ADAPTIVE:
+// usageAdaptive:false OR no routing requested ⇒ zero probes, byte-identical to today.
+// The single mutable routing bit usageOverride lives HERE (the workflow is its own environment);
+// the pure library mirror (feature-adr-routing.ts) threads it via RoutingEnv — never a global.
+const USAGE_THRESHOLD = Number(A.usageThreshold) > 0 ? Number(A.usageThreshold) : 70
+const USAGE_ADAPTIVE = (A.usageAdaptive !== false) && (routingRequested || A.usageAdaptive === true)
+const OVERRIDE_REASONING = mergeOpts({ router: 'high', requirements: 'xhigh', research: 'xhigh', adr: 'xhigh', ideation: 'xhigh', ddd: 'xhigh', architecture: 'xhigh', plan: 'xhigh', code: 'xhigh', qe: 'high', fleet: 'high' }, (A.usageReasoning && typeof A.usageReasoning === 'object') ? A.usageReasoning : {})
+const usageReasoning = OVERRIDE_REASONING
+let usageOverride = false
+const usageEvents = []
+
+// decideUsageAction: the PURE hysteresis core (byte-equivalent to feature-adr-routing.ts). Given the
+// previous override bit, a probe signal (or null when the probe agent DIED), and the threshold,
+// decide the new override bit + the LOCKED 6-value action. Total function.
+function decideUsageAction(prevOverride, signal, threshold) {
+  if (signal === null || signal === undefined) {
+    if (prevOverride) return { override: true, action: 'keep' }
+    return { override: true, action: 'fail-safe-switch' }
+  }
+  const s = signal.sessionPct
+  const w = signal.weeklyPct
+  const sKnown = typeof s === 'number' && isFinite(s) && s >= 0
+  const wKnown = typeof w === 'number' && isFinite(w) && w >= 0
+  if ((sKnown && s >= threshold) || (wKnown && w >= threshold)) {
+    return { override: true, action: prevOverride ? 'keep' : 'switch' }
+  }
+  if (sKnown && wKnown) {
+    return { override: false, action: prevOverride ? 'restore' : 'none' }
+  }
+  return { override: prevOverride, action: prevOverride ? 'keep' : 'none' }
+}
+
+const PROBE_SCHEMA = { type: 'object', additionalProperties: false, required: ['sessionPct', 'weeklyPct'], properties: { sessionPct: { type: ['number', 'null'] }, weeklyPct: { type: ['number', 'null'] } } }
+
+// usageProbe: at each phase boundary, dispatch a minimal haiku/effort-low agent that runs EXACTLY
+// one shell command ('dz usage --json') — the same guaranteed-single-command shape as fa-record:step0.
+// Feed the reading to decideUsageAction, flip usageOverride, record a usageEvents entry. First
+// statement is the BC guard: when USAGE_ADAPTIVE is off, ZERO probe agents are dispatched (AC-4).
+async function usageProbe(phaseName) {
+  if (!USAGE_ADAPTIVE) return
+  const probePrompt = 'Run EXACTLY this one shell command via your Bash tool and return ONLY its parsed JSON fields sessionPct and weeklyPct (numbers or null), nothing else, do not summarize: ' + DZ + ' usage --json --project ' + REPO
+  const r = await agent(probePrompt, { label: 'usage:probe', phase: phaseName, model: 'haiku', effort: 'low', schema: PROBE_SCHEMA })
+  const d = decideUsageAction(usageOverride, r, USAGE_THRESHOLD)
+  if (d.action === 'switch') log('usage: session ' + (r ? r.sessionPct : null) + '% / week ' + (r ? r.weeklyPct : null) + '% >= ' + USAGE_THRESHOLD + '% — switching remaining stages to codex:' + topCodexId())
+  if (d.action === 'fail-safe-switch') log('usage: probe died (agent-null — often MEANS limits) — fail-safe switching remaining stages to codex:' + topCodexId())
+  if (d.action === 'restore') log('usage: back to ' + (r ? r.sessionPct : null) + '%/' + (r ? r.weeklyPct : null) + '% — restoring normal routing')
+  usageOverride = d.override
+  usageEvents.push({ phase: phaseName, sessionPct: r ? r.sessionPct : null, weeklyPct: r ? r.weeklyPct : null, action: d.action })
+}
+
+// reactiveBelt: generalizes today's codex-fallback. When a stage agent returns null while NOT already
+// overridden (a possible limit event), flip the override so the REMAINING stages don't walk into the
+// same wall. The legacy codex-fallback same-stage retry is untouched. Best-effort: at TRUE exhaustion
+// even codex dispatch dies (codex:codex-rescue is a Claude wrapper) — the 70% pre-emptive probe is the real defense.
+function reactiveBelt(phaseName) {
+  if (!USAGE_ADAPTIVE || usageOverride) return
+  usageOverride = true
+  usageEvents.push({ phase: phaseName, sessionPct: null, weeklyPct: null, action: 'reactive-switch' })
+  log('usage: stage agent returned null while not overridden — possible limit event, switching remaining stages to codex:' + topCodexId())
+}
+
+function specToOpts(spec) {
+  if (!spec) return {}
+  const parts = String(spec).split(':')
+  if (parts[0] === 'codex') {
+    let id = parts[1] || CODEX_MODEL
+    if (id !== 'auto' && !KNOWN_CODEX[id]) { log('models: unknown codex id ' + id + ' — using ' + CODEX_MODEL); id = CODEX_MODEL }
+    const reasoning = parts[2] || 'high'
+    return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning }
+  }
+  if (CLAUDE_NAMES[parts[0]]) return { model: parts[0] }
+  log('models: unknown spec ' + spec + ' — session-inherited')
+  return {}
+}
+
+function resolveCoderSpec() {
+  if (CODER === 'codex' || CODER === 'codex-fallback') return 'codex:' + CODEX_MODEL + ':high'
+  return 'opus'
+}
+
+function coderIsCodex() {
+  if (CODER === 'codex' || CODER === 'codex-fallback') return true
+  const codeSpec = MODELS.code
+  if (codeSpec && String(codeSpec).split(':')[0] === 'codex') return true
+  return false
+}
+
+function topCodexId() {
+  let top = CODEX_MODEL
+  if (top === 'auto') {
+    const ids = Object.keys(KNOWN_CODEX)
+    for (let i = 0; i < ids.length; i++) { if (ids[i] !== 'auto') top = ids[i] || top }
+  }
+  return top
+}
+
+function resolveQeSpec() {
+  if (coderIsCodex()) return 'opus'
+  const CODEX_AVAILABLE = A.codexAvailable !== false
+  if (!CODEX_AVAILABLE) return 'opus'
+  return 'codex:' + topCodexId() + ':high'
+}
+
+// qeShouldUseCodex: the load-bearing cross-model gate — the model that wrote the code must NEVER self-QE.
+// (1) explicit MODELS.qe wins; (2) legacy QE_REVIEWER==='codex' knob honored ONLY when coder is NOT codex
+// (a codex coder + qeReviewer:'codex' would be codex-self-QE); (3) else the cross-model default decides.
+function qeShouldUseCodex() {
+  const explicit = MODELS.qe
+  if (explicit !== undefined && explicit !== null) {
+    return String(explicit).split(':')[0] === 'codex'
+  }
+  if (QE_REVIEWER === 'codex') return !coderIsCodex()
+  return routingRequested && resolveQeSpec().split(':')[0] === 'codex'
+}
+
+function resolveStageModel(stage) {
+  if (usageOverride) {
+    const r = (usageReasoning && usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high'
+    const o = specToOpts('codex:' + topCodexId() + ':' + r)
+    o._usageSwitched = true
+    return o
+  }
+  let spec = MODELS[stage]
+  if (spec === undefined) {
+    if (!routingRequested) return {}
+    spec = DEFAULT_MODELS[stage]
+  }
+  if (stage === 'code' && (spec === null || spec === undefined)) return specToOpts(resolveCoderSpec())
+  if (stage === 'qe' && (spec === null || spec === undefined)) return specToOpts(resolveQeSpec())
+  return specToOpts(spec)
+}
+
+function mergeOpts(base, extra) {
+  const out = {}
+  for (const k in base) out[k] = base[k]
+  for (const k in extra) out[k] = extra[k]
+  return out
+}
+
+// modelLabel: record the resolved spec for a stage in modelsUsed (for the run report / who-did-what).
+function modelLabel(opts) {
+  if (opts && opts.agentType === 'codex:codex-rescue') {
+    const base = 'codex:' + opts.codexModel + ':' + opts._reasoning
+    if (opts._usageSwitched) return base + ' (usage-switched)'
+    return base
+  }
+  if (opts && opts.model) return opts.model
+  return 'session'
+}
 
 const ROUTER = { type: 'object', additionalProperties: false, required: ['tier', 'activeSteps', 'rationale'], properties: { tier: { type: 'string', enum: ['S', 'M', 'L', 'XL'] }, activeSteps: { type: 'array', items: { type: 'number' } }, rationale: { type: 'string' } } }
 const ARTIFACT = { type: 'object', additionalProperties: false, required: ['wrote', 'summary'], properties: { wrote: { type: 'array', items: { type: 'string' } }, summary: { type: 'string' } } }
@@ -32,8 +232,11 @@ const QE = { type: 'object', additionalProperties: false, required: ['grade', 'g
 
 // Step 0: Router + MANDATORY self-learning recall
 phase('Router')
-const routerPrompt = 'You are Step 0 (Complexity Router) of the /feature-adr pipeline. TWO jobs. (1) MANDATORY SELF-LEARNING RECALL (never skip — run BOTH Bash commands, do not summarize instead of running them): via your Bash tool run `dz recall "<the key domain terms of this feature>"` (and `dz recall --all` if narrow) to load relevant LEARNED PATTERNS, then run `dz statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled <count> --mode ' + MODE + ' --project ' + REPO + '`. Summarize the top 3 applicable patterns in the rationale. (2) Classify S/M/L/XL + active steps. Feature: "' + DESC + '". Code: ' + CODE_HINT + '. S=1-3 files (0,1,6,7,8); M=4-10 (0,1,3,3.5,5,6,7,8); L=11-30 (all+9); XL=30+ (full+9). Return {tier, activeSteps, rationale} with the recalled patterns folded into rationale.'
-const router = await agent(routerPrompt, { label: 'router+recall', phase: 'Router', schema: ROUTER, effort: 'low' })
+await usageProbe('Router')
+const routerPrompt = 'You are Step 0 (Complexity Router) of the /feature-adr pipeline. TWO jobs. (1) MANDATORY SELF-LEARNING RECALL (never skip — run BOTH Bash commands VERBATIM, do not summarize instead of running them): the learned patterns live in the CANONICAL BRAIN store at `' + BRAIN + '` — pin every recall to it. Via your Bash tool run EXACTLY `' + DZ_RECALL('<the key domain terms of this feature>') + '` (and `' + DZ_RECALL('<the key domain terms of this feature>') + ' --all` if narrow) to load relevant LEARNED PATTERNS from the brain. Preserve recalled pattern TEXT, reward, domain, and any visible id in the rationale as a concrete list so Step 8 can compare candidate lessons against it. Then run `dz statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled <count> --mode ' + MODE + ' --project ' + REPO + '`. Summarize the top 3 applicable patterns in the rationale. (2) Classify S/M/L/XL + active steps. Feature: "' + DESC + '". Code: ' + CODE_HINT + '. S=1-3 files (0,1,6,7,8); M=4-10 (0,1,3,3.5,5,6,7,8); L=11-30 (all+9); XL=30+ (full+9). Return {tier, activeSteps, rationale} with the recalled patterns folded into rationale.'
+const routerOpts = mergeOpts({ label: 'router+recall', phase: 'Router', schema: ROUTER, effort: 'low' }, resolveStageModel('router'))
+modelsUsed.router = modelLabel(routerOpts)
+const router = await agent(routerPrompt, routerOpts)
 let tier = A.tier || (router ? router.tier : 'M')
 const LEARNED = router ? router.rationale : 'none recalled'
 const isMplus = tier === 'M' || tier === 'L' || tier === 'XL'
@@ -47,14 +250,27 @@ await agent('Run EXACTLY this one shell command via your Bash tool and report it
 
 // Steps 1-5: Design (tier-gated thunks built explicitly - no inline ternary-null)
 phase('Design')
+await usageProbe('Design')
 const designThunks = []
 const reqExtra = isLplus ? ' Also write ' + FDIR + '/02_research.md (codebase patterns + external analogues; read the repo for the closest existing implementation to mirror).' : ''
-designThunks.push(() => agent('Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.', { label: 'requirements', phase: 'Design', schema: ARTIFACT }))
+// Resolve per-stage model opts up-front (parser-safe: no inline resolveStageModel inside the thunk arrays).
+// research folds into requirements, ddd folds into architecture (single shared call) — recorded for reporting.
+const reqOpts = mergeOpts({ label: 'requirements', phase: 'Design', schema: ARTIFACT }, resolveStageModel('requirements'))
+const adrOpts = mergeOpts({ label: 'adr', phase: 'Design', schema: ARTIFACT }, resolveStageModel('adr'))
+const qcsdOpts = mergeOpts({ label: 'qcsd', phase: 'Design', schema: ARTIFACT }, resolveStageModel('ideation'))
+const archOpts = mergeOpts({ label: 'architecture', phase: 'Design', schema: ARTIFACT }, resolveStageModel('architecture'))
+modelsUsed.requirements = modelLabel(reqOpts)
+modelsUsed.research = modelLabel(reqOpts)
+modelsUsed.adr = modelLabel(adrOpts)
+modelsUsed.ideation = modelLabel(qcsdOpts)
+modelsUsed.architecture = modelLabel(archOpts)
+modelsUsed.ddd = modelLabel(archOpts)
+designThunks.push(() => agent('Step 1 (Requirements)' + (isLplus ? ' + Step 2 (Research)' : '') + ' of /feature-adr for "' + DESC + '" (tier ' + tier + ', slug ' + SLUG + '). Code: ' + CODE_HINT + '. APPLY these Step-0 recalled LEARNED PATTERNS (fold the applicable ones into requirements/constraints - the loop paying off): ' + LEARNED + '. Write ' + FDIR + '/01_requirements.md (functional + non-functional requirements, acceptance criteria, constraints, and an "Applied learned patterns" note).' + reqExtra + ' Return wrote[] + a 1-line summary.', reqOpts))
 if (isMplus) {
-  designThunks.push(() => agent('Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. Write ' + FDIR + '/03_adr/001-' + SLUG + '.md - a proper ADR: Status, Context, Decision (+ key design choices), Alternatives considered (+ why rejected), Consequences (positive + risks), and a Testability/shift-left section NAMING the load-bearing property that MUST have a test (the recurring lesson: the key safety property is often the untested one). Return wrote[] + summary.', { label: 'adr', phase: 'Design', schema: ARTIFACT }))
-  designThunks.push(() => agent('Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. Return wrote[] + summary.', { label: 'qcsd', phase: 'Design', schema: ARTIFACT }))
+  designThunks.push(() => agent('Step 3 (ADR + shift-left testability) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the actual code (' + CODE_HINT + ') to ground it. Write ' + FDIR + '/03_adr/001-' + SLUG + '.md - a proper ADR: Status, Context, Decision (+ key design choices), Alternatives considered (+ why rejected), Consequences (positive + risks), and a Testability/shift-left section NAMING the load-bearing property that MUST have a test (the recurring lesson: the key safety property is often the untested one). Return wrote[] + summary.', adrOpts))
+  designThunks.push(() => agent('Step 3.5 (QCSD ideation swarm - HTSM quality criteria + SFDIPOT risk) of /feature-adr for "' + DESC + '" (' + SLUG + '). Assess quality criteria + product-factors risk. Write ' + FDIR + '/03.5_ideation_report.md with a GO/CONDITIONAL/NO-GO verdict + top quality risks for QE. Return wrote[] + summary.', qcsdOpts))
   const archExtra = isLplus ? ' Also ' + FDIR + '/04_domain_model.md (DDD).' : ''
-  designThunks.push(() => agent((isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.', { label: 'architecture', phase: 'Design', schema: ARTIFACT }))
+  designThunks.push(() => agent((isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.', archOpts))
 }
 const design = await parallel(designThunks)
 
@@ -63,11 +279,17 @@ const design = await parallel(designThunks)
 // the codex:codex-rescue runtime and GRACEFULLY FALL BACK to the default (Claude) planner if Codex is
 // unavailable/errors — the pipeline never blocks on Codex.
 phase('Plan')
-const PLANNER = (A.planner === 'codex') ? 'codex' : 'claude'
+await usageProbe('Plan')
 const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for "' + DESC + '" (' + SLUG + ', tier ' + tier + '). Given the requirements + ADR + architecture in ' + FDIR + ', decompose into milestones + concrete tasks with success metrics. Write ' + FDIR + '/06_implementation_plan.md. Return wrote[] + summary.'
+// Resolve the plan model. args.models.plan wins; else the planner:'codex' knob (via routingRequested +
+// DEFAULT_MODELS/coder-fold) or the DEFAULT_MODELS.plan ('sonnet') under routing; else {} (BC).
+const planModel = resolveStageModel('plan')
+const planIsCodex = (planModel.agentType === 'codex:codex-rescue') || (MODELS.plan === undefined && PLANNER === 'codex')
 let plan = null
-if (PLANNER === 'codex') {
-  const codexPlan = await agent(planPrompt, { label: 'plan:codex', phase: 'Plan', agentType: 'codex:codex-rescue' })
+if (planIsCodex) {
+  modelsUsed.plan = (planModel.agentType === 'codex:codex-rescue') ? modelLabel(planModel) : ('codex:' + CODEX_MODEL + ':high')
+  const codexPlanOpts = mergeOpts({ label: 'plan:codex', phase: 'Plan', agentType: 'codex:codex-rescue' }, planModel.agentType ? planModel : {})
+  const codexPlan = await agent(planPrompt, codexPlanOpts)
   if (codexPlan) {
     plan = { wrote: [FDIR + '/06_implementation_plan.md'], summary: String(codexPlan).slice(0, 500), planner: 'codex' }
     log('Plan: Codex (top model)')
@@ -75,42 +297,50 @@ if (PLANNER === 'codex') {
     log('Plan: Codex unavailable — falling back to the default planner')
   }
 }
+if (plan === null && planIsCodex) reactiveBelt('Plan')
 if (plan === null) {
-  const claudePlan = await agent(planPrompt, { label: 'plan', phase: 'Plan', schema: ARTIFACT })
-  plan = claudePlan ? { wrote: claudePlan.wrote, summary: claudePlan.summary, planner: PLANNER === 'codex' ? 'claude-fallback' : 'claude' } : null
+  const claudePlanOpts = mergeOpts({ label: 'plan', phase: 'Plan', schema: ARTIFACT }, planIsCodex ? {} : planModel)
+  modelsUsed.plan = planIsCodex ? 'claude-fallback' : modelLabel(claudePlanOpts)
+  const claudePlan = await agent(planPrompt, claudePlanOpts)
+  plan = claudePlan ? { wrote: claudePlan.wrote, summary: claudePlan.summary, planner: planIsCodex ? 'claude-fallback' : 'claude' } : null
 }
 
 // Hybrid checkpoint for L/XL
 const stopHere = STOP_AFTER === 'plan' || (isLplus && STOP_AFTER !== 'none')
 if (stopHere) {
-  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), note: 'L/XL checkpoint - review the ADR + plan, then re-invoke with args.stopAfter="none" to implement + QE.' }
+  // MED-fix: pre-compute the PLANNED code/qe/fleet labels here (resolution is PURE → matches the post-
+  // checkpoint run), so the reviewer sees the load-bearing cross-model QE decision at the exact point
+  // they re-invoke. Marked `(planned)` since the stages haven't executed yet.
+  const codePlanned = modelLabel(resolveStageModel('code'))
+  const qePlanned = qeShouldUseCodex() ? modelLabel(resolveStageModel('qe')) : modelLabel(mergeOpts({ agentType: 'qe-code-reviewer' }, resolveStageModel('qe')))
+  const plannedModels = mergeOpts(modelsUsed, { code: codePlanned + ' (planned)', qe: qePlanned + ' (planned)' })
+  if (isLplus) plannedModels.fleet = modelLabel(resolveStageModel('fleet')) + ' (planned)'
+  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: plannedModels, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, note: 'L/XL checkpoint - review the ADR + plan (+ the planned code/qe/fleet models), then re-invoke with args.stopAfter="none" to implement + QE.' }
 }
 
-// Codex fallback config (opt-in). CODER/QE_REVIEWER ∈ 'claude'|'codex'|'codex-fallback'. On
-// 'codex-fallback' the Claude agent runs FIRST; if it returns null (e.g. the Claude Code session limit
-// is exhausted mid-code/mid-QE — exactly the failure we hit before), the SAME task is retried on the
-// codex:codex-rescue runtime. args.codexModel is DEFAULT 'auto' (Codex self-selects the top model
-// available to the account — model ids are account/version-specific and move ahead of any static
-// default, so 'auto' is the portable choice). To hard-pin a specific id (e.g. this account's top is
-// gpt-5.5), the orchestrator writes it into ~/.codex/config.toml at pre-flight; the hint below only nudges.
-const CODEX_MODEL = A.codexModel || 'auto'
-const CODEX_HINT = ' (If you are the Codex runtime, prefer the ' + CODEX_MODEL + ' model.)'
-const CODER = (A.coder === 'codex' || A.coder === 'codex-fallback') ? A.coder : 'claude'
-const QE_REVIEWER = (A.qeReviewer === 'codex' || A.qeReviewer === 'codex-fallback') ? A.qeReviewer : 'claude'
-
 // Step 7: Code (optional Codex fallback on Claude-limit exhaustion)
 phase('Code')
+await usageProbe('Code')
 const codePrompt = 'Step 7 (Code) of /feature-adr for "' + DESC + '" (' + SLUG + '). Implement the feature per the plan + ADR + architecture in ' + FDIR + '. Write the ACTUAL production code + its tests (mirror the closest existing implementation named in research/architecture). Follow repo conventions; build must pass. Write a change manifest ' + FDIR + '/07_code_changes/change_manifest.md listing every file touched. Return wrote[] (incl. real source files) + summary.'
+// Resolve the coder model. args.models.code wins (a direct 'codex' spec = codex-first); else the legacy
+// CODER knob drives it (with its codex-fallback null-guard). resolveStageModel('code') folds both via the
+// code:null sentinel → resolveCoderSpec(). A Claude resolution merges {model} onto the Claude branch;
+// under the BC omit-path it is {} (byte-identical).
+const codeModel = resolveStageModel('code')
+const codeIsCodexFirst = (MODELS.code !== undefined) ? (codeModel.agentType === 'codex:codex-rescue') : (CODER === 'codex')
+const codeClaudeOpts = mergeOpts({ label: 'code', phase: 'Code', schema: ARTIFACT, effort: 'high' }, codeIsCodexFirst ? {} : (codeModel.agentType ? {} : codeModel))
 let code = null
 let coderUsed = 'claude'
-if (CODER !== 'codex') {
-  code = await agent(codePrompt, { label: 'code', phase: 'Code', schema: ARTIFACT, effort: 'high' })
-  if (code) coderUsed = 'claude'
+if (!codeIsCodexFirst) {
+  code = await agent(codePrompt, codeClaudeOpts)
+  if (code) { coderUsed = 'claude'; modelsUsed.code = modelLabel(codeClaudeOpts) }
 }
-if (code === null && (CODER === 'codex' || CODER === 'codex-fallback')) {
-  if (CODER === 'codex-fallback') log('Code: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
-  const codexCode = await agent(codePrompt + CODEX_HINT, { label: 'code:codex', phase: 'Code', agentType: 'codex:codex-rescue' })
-  if (codexCode) { code = { wrote: [FDIR + '/07_code_changes/change_manifest.md'], summary: String(codexCode).slice(0, 500) }; coderUsed = CODER === 'codex' ? 'codex' : 'codex-fallback' }
+if (code === null && !codeIsCodexFirst) reactiveBelt('Code')
+if (code === null && (codeIsCodexFirst || CODER === 'codex-fallback')) {
+  if (CODER === 'codex-fallback' && !codeIsCodexFirst) log('Code: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
+  const codeCodexOpts = mergeOpts({ label: 'code:codex', phase: 'Code', agentType: 'codex:codex-rescue' }, codeModel.agentType ? codeModel : {})
+  const codexCode = await agent(codePrompt + CODEX_HINT, codeCodexOpts)
+  if (codexCode) { code = { wrote: [FDIR + '/07_code_changes/change_manifest.md'], summary: String(codexCode).slice(0, 500) }; coderUsed = codeIsCodexFirst ? 'codex' : 'codex-fallback'; modelsUsed.code = modelLabel(codeCodexOpts) }
 }
 
 // Step 7.5: Codex-landed barrier. Codex applies edits OUT-OF-BAND via its own runtime; without this,
@@ -127,26 +357,52 @@ if (coderUsed === 'codex' || coderUsed === 'codex-fallback') {
 
 // Step 8: QE (brutal-honesty, agentic-qe) + MANDATORY teach
 phase('QE')
-const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test - the recurring lesson). Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md. MANDATORY SELF-LEARNING STORE (close the loop, never skip): via Bash run `dz teach "<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>" --reward <0.7-0.95> --domain <area>` for each genuine lesson (1-3 max, high-signal), then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled 3 --stored <count taught> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. Return {grade, gaps, codeTestsAdequate, docTestsPresent}.' + landedNote
+await usageProbe('QE')
+const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test - the recurring lesson). Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md. MANDATORY SELF-LEARNING STORE (close the loop, never skip): compare every candidate lesson against the Step-0 recalled LEARNED patterns above. Teach ONLY lessons NOT covered by Step-0 recall. On overlap, run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate; if --reinforce is unavailable, skip the duplicate teach and report `reinforced existing pattern <id>` in the QE report. Store every genuinely new lesson in the CANONICAL BRAIN store at `' + BRAIN + '` so it is NOT lost to a target repo you may have cd`d into. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal) — the `cd ' + BRAIN + ' &&` prefix + `--project ' + BRAIN + '` pin guarantee the lesson lands in the brain regardless of your CWD. Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled 3 --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. Return {grade, gaps, codeTestsAdequate, docTestsPresent}.' + landedNote
+// CROSS-MODEL QE (load-bearing): resolveStageModel('qe') derives the OTHER family than the resolved
+// coder when args.models.qe is unset (coder-codex ⇒ opus; coder-Claude ⇒ codex, or opus if codex absent).
+// An explicit args.models.qe wins. A Claude qe spec is merged onto the qe-code-reviewer base (role
+// PRESERVED); a codex qe spec REPLACES agentType with codex:codex-rescue (as today). The codex-null→
+// Claude guard is retained as the runtime belt so codex-unavailable never blocks.
+const qeModel = resolveStageModel('qe')
+// Single tested source of truth (feature-adr-routing.ts:qeShouldUseCodex) — closes the self-QE hole where
+// the legacy qeReviewer='codex' knob used to re-route QE back to codex even when the CODER was codex.
+if (MODELS.qe === undefined && QE_REVIEWER === 'codex' && coderIsCodex()) log('QE: coder is codex — enforcing cross-model Claude QE (ignoring qeReviewer=codex to avoid self-review)')
+const qeIsCodex = qeShouldUseCodex()
+const qeClaudeOpts = mergeOpts({ label: 'qe:brutal', phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeIsCodex ? {} : qeModel)
 let qe = null
 let qeReviewerUsed = 'claude'
-if (QE_REVIEWER !== 'codex') {
-  qe = await agent(qePrompt, { label: 'qe:brutal', phase: 'QE', agentType: 'qe-code-reviewer', schema: QE })
-  if (qe) qeReviewerUsed = 'claude'
+if (!qeIsCodex) {
+  qe = await agent(qePrompt, qeClaudeOpts)
+  if (qe) { qeReviewerUsed = 'claude'; modelsUsed.qe = modelLabel(qeClaudeOpts) }
+}
+if (qe === null && !qeIsCodex) reactiveBelt('QE')
+if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
+  if (QE_REVIEWER === 'codex-fallback' && !qeIsCodex) log('QE: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
+  const qeCodexOpts = mergeOpts({ label: 'qe:codex', phase: 'QE', agentType: 'codex:codex-rescue' }, qeModel.agentType ? qeModel : {})
+  const codexQe = await agent(qePrompt + CODEX_HINT, qeCodexOpts)
+  if (codexQe) { qe = { grade: 'codex-review', gaps: [], codeTestsAdequate: null, docTestsPresent: null, summary: String(codexQe).slice(0, 500) }; qeReviewerUsed = qeIsCodex ? 'codex' : 'codex-fallback'; modelsUsed.qe = modelLabel(qeCodexOpts) }
 }
-if (qe === null && (QE_REVIEWER === 'codex' || QE_REVIEWER === 'codex-fallback')) {
-  if (QE_REVIEWER === 'codex-fallback') log('QE: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
-  const codexQe = await agent(qePrompt + CODEX_HINT, { label: 'qe:codex', phase: 'QE', agentType: 'codex:codex-rescue' })
-  if (codexQe) { qe = { grade: 'codex-review', gaps: [], codeTestsAdequate: null, docTestsPresent: null, summary: String(codexQe).slice(0, 500) }; qeReviewerUsed = QE_REVIEWER === 'codex' ? 'codex' : 'codex-fallback' }
+// Belt: if a codex-first QE returned null (codex unavailable), fall back to a Claude reviewer — never block.
+if (qe === null && qeIsCodex) {
+  log('QE: Codex unavailable — falling back to a Claude reviewer (cross-model belt)')
+  const qeBeltOpts = mergeOpts({ label: 'qe:brutal', phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, routingRequested ? { model: 'opus' } : {})
+  qe = await agent(qePrompt, qeBeltOpts)
+  if (qe) { qeReviewerUsed = 'claude'; modelsUsed.qe = modelLabel(qeBeltOpts) }
 }
 
 // Step 9: Fleet QE (L/XL)
 let fleet = 'skipped (S/M)'
 if (isLplus) {
   phase('FleetQE')
+  await usageProbe('FleetQE')
+  const fleetModel = resolveStageModel('fleet')
+  modelsUsed.fleet = modelLabel(mergeOpts({}, fleetModel))
+  const fleetTraceOpts = mergeOpts({ label: 'fleet:trace', phase: 'FleetQE', agentType: 'qe-requirements-validator' }, fleetModel)
+  const fleetCovOpts = mergeOpts({ label: 'fleet:cov', phase: 'FleetQE', agentType: 'qe-coverage-specialist' }, fleetModel)
   const fleetThunks = [
-    () => agent('Step 9 fleet-QE (requirements traceability + risk) for ' + SLUG + ': map ADR decisions to code to tests; flag orphans + high risk. Write ' + FDIR + '/09_fleet_qe_assessment.md.', { label: 'fleet:trace', phase: 'FleetQE', agentType: 'qe-requirements-validator' }),
-    () => agent('Step 9 fleet-QE (coverage + regression) for ' + SLUG + ': risk-weighted coverage gaps + regression selection for the changed files. Append to ' + FDIR + '/09_fleet_qe_assessment.md.', { label: 'fleet:cov', phase: 'FleetQE', agentType: 'qe-coverage-specialist' }),
+    () => agent('Step 9 fleet-QE (requirements traceability + risk) for ' + SLUG + ': map ADR decisions to code to tests; flag orphans + high risk. Write ' + FDIR + '/09_fleet_qe_assessment.md.', fleetTraceOpts),
+    () => agent('Step 9 fleet-QE (coverage + regression) for ' + SLUG + ': risk-weighted coverage gaps + regression selection for the changed files. Append to ' + FDIR + '/09_fleet_qe_assessment.md.', fleetCovOpts),
   ]
   await parallel(fleetThunks)
   fleet = 'run'
@@ -167,6 +423,10 @@ return {
   coderUsed: coderUsed,
   qeReviewerUsed: qeReviewerUsed,
   codexModel: CODEX_MODEL,
+  modelsUsed: modelsUsed,
+  usageEvents: usageEvents,
+  usageThreshold: USAGE_THRESHOLD,
   selfLearning: 'recall@Step0 + teach@Step8 (mandatory)',
+  brain: BRAIN,
   promiseTags: tags,
 }