@dzhechkov/skills-feature-adr 1.3.63 → 1.3.65

package/.dz-manifest.json

@@ -3,38 +3,6 @@
     "version": 1,
     "pack": "skills-feature-adr",
     "files": [
-      {
-        "path": ".agentic-qe/brain.rvf",
-        "sha256": "70f89fc8d429547e83bfae570908ab29d03310d0ea6f665041e9d234a613c9b3"
-      },
-      {
-        "path": ".agentic-qe/brain.rvf.lock",
-        "sha256": "dabbafbdcc8ebd25620e26be72e0416225740d0706e6d955d19d31beb5179a49"
-      },
-      {
-        "path": ".agentic-qe/memory.db",
-        "sha256": "a9a1c9c9a16a4928935c1b9683ac06dab3d9a74dd4084e11c48f81dd95f9d9b6"
-      },
-      {
-        "path": ".agentic-qe/memory.db-shm",
-        "sha256": "e0d6e3d8739fca2b4e1d7c8f2c2287ca1e997f25278e57ca51b6fc8928404d06"
-      },
-      {
-        "path": ".agentic-qe/memory.db-wal",
-        "sha256": "f4ffd1e7c99d271374117717ff4d5206c620180e3c36de6a6d445ff513b8bd05"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf",
-        "sha256": "69cfe471991b1d375cfbdcdb2df88226f86195659f7aa761581ca4d5f46ff24a"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf.idmap.json",
-        "sha256": "1f8838c958b471fe5d819d681d29b1965a75470a9e4d6a2171d6c7e620ba223e"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf.lock",
-        "sha256": "f7c13d34313c97974dc8ba868859d68201a2d6a2dcba6670d2e52ec66d010081"
-      },
       {
         "path": "CHANGELOG.md",
         "sha256": "e4f50d4f757f877b54c8d25dfc1321776545be4cb814d5f17ee1128ee2320982"
@@ -45,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "e3aec229dfc9657d90214618356600eb7c25481e4f3d21f32ca8cf33f7b543e7"
+        "sha256": "4a887b8fe2a52c75be7189ddeef4393dc2a8a872d747bdbde3caba94488960dd"
       },
       {
         "path": "bin/cli.js",
@@ -57,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "e8683f389e05702b2a8f382428eb62ffd8cae6802460905690f47acd013caa72"
+        "sha256": "1f95669ddfb76990bfeb0e1be603c27651f47a9233020ed10c37e8705543b688"
       },
       {
         "path": "scripts/sync-templates.js",
@@ -141,7 +109,7 @@
       },
       {
         "path": "templates/.claude/skills/explore/SKILL.md",
-        "sha256": "c755a7bcdfe97fb7cb0bcd7bf3b1fd8a2d238ef082967fbf87740fc808302542"
+        "sha256": "2473e7961845db0d64566cd42627b374d1830664b9e302058a1b1aa466bc7361"
       },
       {
         "path": "templates/.claude/skills/explore/references/questioning-techniques.md",
@@ -153,7 +121,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/SKILL.md",
-        "sha256": "14edee77f2d108815e2a2c1d3cf40226ef277659b9be1232230fc3c8bf1a31f9"
+        "sha256": "c422d1e2b50cf7b8bd56cd5d886d96af30d8bf33a468b925396f395ebf32de53"
       },
       {
         "path": "templates/.claude/skills/feature-adr/examples/sample-feature-output.md",
@@ -293,7 +261,7 @@
       },
       {
         "path": "templates/.claude/skills/frontend-design/SKILL.md",
-        "sha256": "742519aca53dab0f10e903e19bd1641b62dd975cdd0df9aab3b2ac3173ce0ec2"
+        "sha256": "c9e93c1b95b99a9e120b93d7683afa804713f98ce44bf29ba6d24e9ea1b44aee"
       },
       {
         "path": "templates/.claude/skills/knowledge-extractor/SKILL.md",
@@ -337,7 +305,7 @@
       },
       {
         "path": "templates/.claude/skills/problem-solver-enhanced/SKILL.md",
-        "sha256": "530623c986dee931d47314c22195ea9de50a75f2a0daecfc469fb015c3dd3415"
+        "sha256": "031378aa2e10c98928e35de07d454135e73550cd0c49f0cd886d53e4208d6b9f"
       },
       {
         "path": "templates/.claude/skills/system-grill/JOURNAL-TEMPLATE.md",
@@ -349,7 +317,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "466adce16bb53b7b6d3d40f7ab21580b978d53f00b76628c830e4ed16127b586"
+        "sha256": "8afa77bb421ea4052eec0feab5f49edc1f2b1cea69238971f8ef1b3c8328a483"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -377,5 +345,5 @@
       }
     ]
   },
-  "signature": "+FPXqVvujh2lZm4KF3Vva8BVv4cfmtYLdLq6gGPwOB0nnjqyJFlFEcRVfavGaIbQGAbLQ7Lnjcxs+iT8O2g2BQ=="
+  "signature": "3OT+p3Tm5tBnn9T2RKEPlCnhCiaemKAOraeoPA4zYR28p1MpACnkeEmVyXPpwnqhG/a6uD/AjC/DrRuihMdHCw=="
 }

package/README.md

@@ -106,6 +106,32 @@ ARCHITECTURE → IMPLEMENTATION →  CODE   →   QE    →  FLEET QE
 # Full protocols + 6 extra skills, up to 7 fleet QE agents
 ```
 
+### Durable checkpoints + resume (v1.3.64)
+
+Every expensive stage (router / design / plan / code / qe / fleet) checkpoints its result into
+`features/<slug>/.fa-state/checkpoints.jsonl`. Re-invoking the workflow with the SAME slug resumes
+completed stages instead of re-running them — covering both a **killed run** (previously a total
+restart: the exact failure mode that motivated usage-adaptive routing) and the **standard L/XL
+two-phase flow** (the `stopAfter: 'plan'` → `stopAfter: 'none'` re-invoke now resumes
+router+design+plan for free).
+
+```js
+// run 1 (dies mid-code, or stops at the L/XL plan checkpoint)…
+Workflow({ scriptPath: '.claude/workflows/feature-adr.js', args: { slug: 'add-x', description: '…' } })
+// run 2 — same slug: completed stages resume, only the unfinished work runs
+Workflow({ scriptPath: '.claude/workflows/feature-adr.js', args: { slug: 'add-x', description: '…', stopAfter: 'none' } })
+//   → log: "checkpoint: router RESUMED … design RESUMED … plan RESUMED"; result carries resumedStages
+```
+
+Knobs: `args.resume: 'auto'` (default — resume only on input-hash match AND every tier-required
+artifact present) · `'never'` (ignore recorded state) · `'force'` (trust the hash, skip artifact
+probes); `args.checkpoints: false` disables the layer entirely. **Honest scope:** resume proves the
+run *inputs* are unchanged and artifacts exist — it does NOT fingerprint the working tree; after
+manual edits mid-feature pass `resume: 'never'` (or delete `.fa-state/`) and re-QE. A stale-input
+checkpoint never resumes in any mode. RU: упавший L/XL-ран продолжает с места смерти, а не
+пере-тратит выполненные стадии; штатный двухфазный L/XL-флоу тоже дешевеет — re-invoke после
+план-чекпоинта возобновляет router+design+plan из чекпоинтов.
+
 ### Codex model routing (optional)
 
 If [Codex](https://developers.openai.com/codex) is installed + logged in, the pipeline can route work to
@@ -248,8 +274,13 @@ Workflow({ scriptPath: '.claude/workflows/feature-adr.js',
 
 > Note: under the override, coder **and** QE both run on Codex — the cross-model self-QE guard is
 > consciously suspended (a Claude QE reviewer is exactly the agent that dies under limit pressure). The
-> ` (usage-switched)` suffix + `usageEvents` keep it auditable; re-run an independent QE after limits
-> reset if the switch fired during Step 8.
+> ` (usage-switched)` suffix + `usageEvents` keep it auditable — and since v1.3.65 the suspension is a
+> **machine debt**, not a note: the run writes `features/<slug>/.fa-state/reqe-due.json` (idempotent,
+> run-stamped, crash-resume-safe) and returns `reqeDue: true`; after limits reset, `dz usage` shows a
+> `re-QE due:` line, `dz reqe --slug <s>` prints the cross-family review brief, and
+> `dz reqe --slug <s> --done --report <f>` settles FAIL-CLOSED — only against an existing graded
+> report, never the run's own 08_qe_report.md (real-path and inode compared). RU: «перепроверь другой
+> семьёй потом» стало долгом на диске с полным жизненным циклом.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.63",
+  "version": "1.3.65",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"
@@ -15,10 +15,6 @@
     ".dz-manifest.json",
     "sbom.json"
   ],
-  "scripts": {
-    "test": "node --test \"test/**/*.test.js\"",
-    "prepack": "node -e \"const fs=require('fs');const bad=['.claude','.skills-feature-adr.json'].filter(p=>fs.existsSync(p));if(bad.length){console.error('prepack guard: stray init artifacts in package dir: '+bad.join(', ')+' — remove before packing');process.exit(1)}\""
-  },
   "keywords": [
     "claude",
     "claude-code",
@@ -63,5 +59,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "test": "node --test \"test/**/*.test.js\""
   }
-}
+}

package/sbom.json

@@ -9,86 +9,6 @@
     }
   },
   "components": [
-    {
-      "type": "file",
-      "name": ".agentic-qe/brain.rvf",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "70f89fc8d429547e83bfae570908ab29d03310d0ea6f665041e9d234a613c9b3"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/brain.rvf.lock",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "dabbafbdcc8ebd25620e26be72e0416225740d0706e6d955d19d31beb5179a49"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/memory.db",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "a9a1c9c9a16a4928935c1b9683ac06dab3d9a74dd4084e11c48f81dd95f9d9b6"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/memory.db-shm",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "e0d6e3d8739fca2b4e1d7c8f2c2287ca1e997f25278e57ca51b6fc8928404d06"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/memory.db-wal",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "f4ffd1e7c99d271374117717ff4d5206c620180e3c36de6a6d445ff513b8bd05"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/patterns.rvf",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "69cfe471991b1d375cfbdcdb2df88226f86195659f7aa761581ca4d5f46ff24a"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/patterns.rvf.idmap.json",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "1f8838c958b471fe5d819d681d29b1965a75470a9e4d6a2171d6c7e620ba223e"
-        }
-      ]
-    },
-    {
-      "type": "file",
-      "name": ".agentic-qe/patterns.rvf.lock",
-      "hashes": [
-        {
-          "alg": "SHA-256",
-          "content": "f7c13d34313c97974dc8ba868859d68201a2d6a2dcba6670d2e52ec66d010081"
-        }
-      ]
-    },
     {
       "type": "file",
       "name": "CHANGELOG.md",
@@ -115,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e3aec229dfc9657d90214618356600eb7c25481e4f3d21f32ca8cf33f7b543e7"
+          "content": "4a887b8fe2a52c75be7189ddeef4393dc2a8a872d747bdbde3caba94488960dd"
         }
       ]
     },
@@ -145,7 +65,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e8683f389e05702b2a8f382428eb62ffd8cae6802460905690f47acd013caa72"
+          "content": "1f95669ddfb76990bfeb0e1be603c27651f47a9233020ed10c37e8705543b688"
         }
       ]
     },
@@ -355,7 +275,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c755a7bcdfe97fb7cb0bcd7bf3b1fd8a2d238ef082967fbf87740fc808302542"
+          "content": "2473e7961845db0d64566cd42627b374d1830664b9e302058a1b1aa466bc7361"
         }
       ]
     },
@@ -385,7 +305,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "14edee77f2d108815e2a2c1d3cf40226ef277659b9be1232230fc3c8bf1a31f9"
+          "content": "c422d1e2b50cf7b8bd56cd5d886d96af30d8bf33a468b925396f395ebf32de53"
         }
       ]
     },
@@ -735,7 +655,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "742519aca53dab0f10e903e19bd1641b62dd975cdd0df9aab3b2ac3173ce0ec2"
+          "content": "c9e93c1b95b99a9e120b93d7683afa804713f98ce44bf29ba6d24e9ea1b44aee"
         }
       ]
     },
@@ -845,7 +765,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "530623c986dee931d47314c22195ea9de50a75f2a0daecfc469fb015c3dd3415"
+          "content": "031378aa2e10c98928e35de07d454135e73550cd0c49f0cd886d53e4208d6b9f"
         }
       ]
     },
@@ -875,7 +795,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "466adce16bb53b7b6d3d40f7ab21580b978d53f00b76628c830e4ed16127b586"
+          "content": "8afa77bb421ea4052eec0feab5f49edc1f2b1cea69238971f8ef1b3c8328a483"
         }
       ]
     },

package/templates/.claude/skills/explore/SKILL.md

@@ -10,7 +10,7 @@ description: >
   provide solutions until task is fully explored.
 trust_tier: 1
 trust_tier_label: "Structured"
-trust_tier_path: "Run /bto-test to promote to Tier 2"
+trust_tier_path: "Run a BTO evaluation (see the skills-bto package) to promote to Tier 2"
 ---
 
 # Explore: Adaptive Task Clarification

package/templates/.claude/skills/feature-adr/SKILL.md

@@ -11,7 +11,7 @@ description: >
   "implement feature", "/feature-adr".
 trust_tier: 0
 trust_tier_label: "Advisory"
-trust_tier_path: "Run /bto-test to promote to Tier 1"
+trust_tier_path: "Run a BTO evaluation (see the skills-bto package) to promote to Tier 1"
 agentic_qe_version: "7.5.1"
 agentic_qe_source: "https://github.com/proffesor-for-testing/agentic-qe"
 agentic_qe_skills_core: 9

package/templates/.claude/skills/frontend-design/SKILL.md

@@ -4,7 +4,7 @@ description: Create distinctive, production-grade frontend interfaces with high
 license: Complete terms in LICENSE.txt
 trust_tier: 0
 trust_tier_label: "Advisory"
-trust_tier_path: "Add references/ directory and run /bto-test to promote to Tier 1"
+trust_tier_path: "Add references/ directory and run a BTO evaluation (see the skills-bto package) to promote to Tier 1"
 ---
 
 This skill guides creation of distinctive, production-grade frontend interfaces that avoid generic "AI slop" aesthetics. Implement real working code with exceptional attention to aesthetic details and creative choices.

package/templates/.claude/skills/problem-solver-enhanced/SKILL.md

@@ -3,7 +3,7 @@ name: problem-solver-enhanced
 description: Elite problem-solving system combining first principles thinking, game theory, root cause analysis, systematic frameworks AND TRIZ inventive principles for solving complex challenges. Use when facing complex challenges with unclear solutions, strategic decisions with multiple stakeholders, problems requiring breakthrough (not incremental) solutions, trade-offs that seem impossible to resolve, competitive scenarios requiring game-theoretic analysis, system design problems, or any situation requiring both analytical rigor and inventive thinking beyond surface-level solutions.
 trust_tier: 1
 trust_tier_label: "Structured"
-trust_tier_path: "Run /bto-test to promote to Tier 2"
+trust_tier_path: "Run a BTO evaluation (see the skills-bto package) to promote to Tier 2"
 ---
 
 # Elite Problem Solver (Enhanced with TRIZ)

package/templates/.claude/workflows/feature-adr.js

@@ -1,6 +1,6 @@
 export const meta = {
   name: 'feature-adr',
-  description: 'Canonical /feature-adr --full-qe-extended pipeline as a reusable workflow: router+RECALL then design(ADR, applies learned patterns) then plan then code then agentic-qe QE+TEACH, producing features/<slug>/00-09 artifacts. MANDATORY in-process self-learning loop (Step-0 recall, apply, Step-8 teach). OPTIONAL Codex routing: args.planner=codex (Step-6), args.coder/qeReviewer=codex-fallback (Step-7/8 fall back to Codex when Claude limits exhaust; args.codexModel default auto, Codex self-selects top). Hybrid checkpoints (S/M autonomous; L/XL stop-after-plan).',
+  description: 'Canonical /feature-adr --full-qe-extended pipeline as a reusable workflow: router+RECALL then design(ADR, applies learned patterns) then plan then code then agentic-qe QE+TEACH, producing features/<slug>/00-09 artifacts. MANDATORY in-process self-learning loop (Step-0 recall, apply, Step-8 teach). OPTIONAL Codex routing: args.planner=codex (Step-6), args.coder/qeReviewer=codex-fallback (Step-7/8 fall back to Codex when Claude limits exhaust; args.codexModel default auto, Codex self-selects top). Hybrid checkpoints (S/M autonomous; L/XL stop-after-plan). DURABLE per-stage checkpoints in features/<slug>/.fa-state/ (args.resume auto|never|force, args.checkpoints:false to disable): a dead run or an L/XL re-invoke resumes completed stages instead of re-spending them.',
   whenToUse: 'ultracode + a feature implementation. Invoke via Workflow({scriptPath:".claude/workflows/feature-adr.js", args:{slug, description, code, tier, stopAfter, planner, coder, qeReviewer, codexModel, brain}}) instead of an ad-hoc orchestration, so every feature ships with an ADR + inline agentic-qe QE + self-learning. args.brain pins the self-learning loop (recall/teach) to ONE canonical brain store (default = the workspace root) so lessons never fragment into a target repo when the coder cd`s away.',
   phases: [
     { title: 'Router', detail: 'Step 0 - classify + self-learning recall' },
@@ -100,6 +100,110 @@ const DZ_RECALL = (terms) => 'cd ' + BRAIN + ' && ' + DZ + ' recall "' + terms +
 const DZ_TEACH = (lesson, reward, domain) =>
   'cd ' + BRAIN + ' && ' + DZ + ' teach "' + lesson + '" --reward ' + reward + ' --domain ' + domain + ' --project ' + BRAIN
 
+// ── Durable checkpoints + resume (backlog 49e4a95b) — inline mirror of ──
+// ── harness-core/src/feature-adr-checkpoints.ts (the workflow is self-contained, no imports) ──
+// After each expensive stage a cheap effort-low agent appends {stage, inputHash, result} to
+// features/<slug>/.fa-state/checkpoints.jsonl (the sandbox has no fs — the agent IS the fs). On the
+// next run with the same slug, a stage is SKIPPED only when its recorded inputHash matches AND its
+// expected artifact is still on disk. This covers BOTH the crash case (a dead L/XL session used to
+// re-spend every completed stage) and the STANDARD L/XL two-phase flow (stop-after-plan → re-invoke
+// used to re-run router+design+plan wholesale). Granularity is per-STAGE — a death mid-code re-runs
+// the code stage only, never Steps 0–6. args.checkpoints:false disables everything; args.resume: 'auto'(default)
+// | 'never' (ignore recorded state) | 'force' (trust the hash, skip the artifact probe). A STALE
+// inputHash NEVER resumes in any mode — 'force' relaxes only the artifact probe (load-bearing,
+// tested in feature-adr-checkpoints.test.ts).
+const CHECKPOINTS_ON = A.checkpoints !== false
+const RESUME_MODE = A.resume === 'never' ? 'never' : (A.resume === 'force' ? 'force' : 'auto')
+const CKPT_FILE = FDIR + '/.fa-state/checkpoints.jsonl'
+const CKPT_LS_SENTINEL = '---FA-CKPT-LS---'
+const CKPT_MAX = 12000
+// SALTED into every hash: bump when stage semantics/prompts/composite shapes change → every old
+// checkpoint hashes stale and re-runs (never resumes into new logic).
+const CKPT_SCHEMA_VERSION = 'fa-ckpt-2'
+// HONEST SCOPE (the narrowed promise): the hash proves the run INPUTS are unchanged; the probe
+// proves the stage artifacts EXIST. Neither fingerprints the working tree — a crash-resume
+// legitimately sees the dead run's uncommitted writes, so a tree hash would invalidate every real
+// resume. After MANUAL edits: resume:'never' or delete .fa-state/, and re-QE independently.
+const STAGE_ARTIFACTS_CKPT = { router: null, design: '01_requirements.md', plan: '06_implementation_plan.md', code: '07_code_changes/change_manifest.md', qe: '08_qe_report.md', fleet: '09_fleet_qe_assessment.md' }
+function fnv1a(str) { let h = 0x811c9dc5; for (let i = 0; i < str.length; i++) { h ^= str.charCodeAt(i); h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0 } return h.toString(16).padStart(8, '0') }
+// 64 bits from two FNV passes — a single 32-bit hash admits findable collisions (Codex QE #9).
+function fnv1a64(str) { return fnv1a(str) + fnv1a('fa-ckpt-salt' + str) }
+function ckptHash(stage, parts) { return fnv1a64(JSON.stringify([CKPT_SCHEMA_VERSION, stage].concat(parts.map(function (p) { return p === undefined ? null : p })))) }
+function decideCheckpointResume(mode, entry, inputHash, artifactRel, listing) {
+  if (mode === 'never') return { resume: false, reason: 'mode-never' }
+  if (!entry || entry.result === null || entry.result === undefined) return { resume: false, reason: 'no-checkpoint' }
+  if (entry.inputHash !== inputHash) return { resume: false, reason: 'stale-input' }
+  if (mode === 'force') return { resume: true, reason: 'resumed-force' }
+  const required = artifactRel === null ? [] : (typeof artifactRel === 'string' ? [artifactRel] : artifactRel)
+  for (const rel of required) { if (!listing.has(rel)) return { resume: false, reason: 'artifact-missing' } }
+  return { resume: true, reason: 'resumed' }
+}
+let CKPT_ENTRIES = {}
+let CKPT_LISTING = new Set()
+const resumedStages = []
+async function loadCheckpoints(phaseName) {
+  if (!CHECKPOINTS_ON) return
+  const readCmd = 'cat ' + shq(CKPT_FILE) + ' 2>/dev/null || true; echo ' + shq(CKPT_LS_SENTINEL) + '; cd ' + shq(FDIR) + ' 2>/dev/null && find . -maxdepth 2 -type f 2>/dev/null | sed "s|^\\./||" || true'
+  const readOut = await agent('Run EXACTLY this via Bash and return its stdout VERBATIM (it may be empty) with NO code fences and NO commentary: ' + readCmd, { label: 'ckpt:read', phase: phaseName, effort: 'low' })
+  const raw = String(readOut == null ? '' : readOut)
+  // LINE-ANCHORED sentinel: a sentinel string INSIDE a recorded result shares its line with JSON
+  // syntax (stringify never emits raw newlines) and can never split the stream (Codex QE #10).
+  const allLines = raw.split('\n')
+  const sentinelAt = allLines.findIndex(function (l) { return l.trim() === CKPT_LS_SENTINEL })
+  const body = sentinelAt === -1 ? allLines : allLines.slice(0, sentinelAt)
+  const ls = sentinelAt === -1 ? [] : allLines.slice(sentinelAt + 1)
+  let malformed = 0
+  for (const line of body) {
+    const t = line.trim()
+    if (t === '') continue
+    try {
+      const e = JSON.parse(t)
+      if (e && typeof e === 'object' && typeof e.stage === 'string' && typeof e.inputHash === 'string' && ('result' in e) && e.result !== null && e.result !== undefined) CKPT_ENTRIES[e.stage] = e
+      else { if (e && typeof e === 'object' && typeof e.stage === 'string') delete CKPT_ENTRIES[e.stage]; malformed++ }
+    } catch (err) { malformed++ }
+  }
+  for (const line of ls) { const t = line.trim(); if (t !== '') CKPT_LISTING.add(t) }
+  const found = Object.keys(CKPT_ENTRIES)
+  if (malformed > 0) log('checkpoints: ' + malformed + ' malformed/null line(s) skipped (named, never silent — an all-malformed file resumes nothing)')
+  if (found.length > 0) log('checkpoints: ' + found.length + ' recorded stage(s) [' + found.join(', ') + '] (resume=' + RESUME_MODE + '; resume verifies INPUTS + artifact presence, NOT current-tree equivalence — after manual edits use resume:"never")')
+}
+async function withCheckpoint(stage, phaseName, inputHash, runFn, ckptOpts) {
+  const o = ckptOpts || {}
+  // artifacts override (Codex QE #2): tier-dependent stages pass EVERY artifact the tier requires
+  const artifactRel = (o.artifacts !== undefined) ? o.artifacts : ((stage in STAGE_ARTIFACTS_CKPT) ? STAGE_ARTIFACTS_CKPT[stage] : null)
+  let entry = CKPT_ENTRIES[stage]
+  // composite-shape validation (Codex QE #8): an old/partial composite must read as no-checkpoint
+  if (entry && typeof o.validate === 'function' && !o.validate(entry.result)) {
+    log('checkpoint: ' + stage + ' recorded result has an unexpected shape — treating as no checkpoint')
+    entry = undefined
+  }
+  const d = CHECKPOINTS_ON ? decideCheckpointResume(RESUME_MODE, entry, inputHash, artifactRel, CKPT_LISTING) : { resume: false, reason: 'checkpoints-off' }
+  if (d.resume) {
+    resumedStages.push(stage)
+    log('checkpoint: ' + stage + ' RESUMED (' + d.reason + ') — stage skipped, recorded result restored (inputs+artifacts verified; current-tree equivalence is NOT — the named limitation)')
+    return entry.result
+  }
+  if (CHECKPOINTS_ON && CKPT_ENTRIES[stage] && (d.reason === 'stale-input' || d.reason === 'artifact-missing')) log('checkpoint: ' + stage + ' NOT resumed (' + d.reason + ') — running live')
+  const result = await runFn()
+  // never checkpoint a dead/partial stage: null/undefined, or a parallel() array holding any null
+  const partial = Array.isArray(result) && result.some(function (x) { return x === null || x === undefined })
+  const persistable = (typeof o.persist === 'function') ? (result !== null && result !== undefined && o.persist(result)) : true
+  if (CHECKPOINTS_ON && result !== null && result !== undefined && !partial && persistable) {
+    let line = null
+    try { line = JSON.stringify({ stage: stage, inputHash: inputHash, result: result }) } catch (err) { line = null }
+    if (line && line.length <= CKPT_MAX) {
+      await agent('Run EXACTLY this one shell command via your Bash tool and reply with only OK: mkdir -p ' + shq(FDIR + '/.fa-state') + " && printf '%s\\n' " + shq(line) + ' >> ' + shq(CKPT_FILE), { label: 'ckpt:write:' + stage, phase: phaseName, effort: 'low' })
+    } else if (line) {
+      log('checkpoint: ' + stage + ' result oversize (' + line.length + ' > ' + CKPT_MAX + ' chars) — not checkpointed; the stage will re-run on resume (honest cost, never truncated state)')
+    } else {
+      log('checkpoint: ' + stage + ' result not serializable — not checkpointed')
+    }
+  } else if (CHECKPOINTS_ON && result !== null && result !== undefined && !partial && !persistable) {
+    log('checkpoint: ' + stage + ' result NOT persisted (persist predicate refused — e.g. a not-landed codex code stage must never resume as landed)')
+  }
+  return result
+}
+
 // ── Codex-routing knobs (hoisted so the routing block below can fold them) ──
 // CODER/QE_REVIEWER ∈ 'claude'|'codex'|'codex-fallback'. On 'codex-fallback' the Claude agent runs
 // FIRST; if it returns null (e.g. the Claude Code session limit is exhausted mid-code/mid-QE), the SAME
@@ -575,12 +679,18 @@ const AMENDMENT_GATE = 'AMENDMENT GATE (P2): read the `## Amendments` sections o
 
 // Step 0: Router + MANDATORY self-learning recall
 phase('Router')
+await loadCheckpoints('Router')
 await usageProbe('Router')
 const routerPrompt = 'You are Step 0 (Complexity Router) of the /feature-adr pipeline. TWO jobs. (1) MANDATORY SELF-LEARNING RECALL (never skip — run BOTH Bash commands VERBATIM, do not summarize instead of running them): the learned patterns live in the CANONICAL BRAIN store at `' + BRAIN + '` — pin every recall to it. Via your Bash tool run EXACTLY `' + DZ_RECALL('<the key domain terms of this feature>') + '` (and `' + DZ_RECALL('<the key domain terms of this feature>') + ' --all` if narrow) to load relevant LEARNED PATTERNS from the brain. Preserve recalled pattern TEXT, reward, domain, and any visible id in the rationale as a concrete list so Step 8 can compare candidate lessons against it. Then run `dz statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled <count> --mode ' + MODE + ' --project ' + REPO + '`. Summarize the top 3 applicable patterns in the rationale. (2) Classify S/M/L/XL + active steps. Feature: "' + DESC + '". Code: ' + CODE_HINT + '. S=1-3 files (0,1,6,7,8; if an ADR is explicitly forced, use Nygard as the lightweight fallback); M=4-10 (0,1,3,3.5,5,6,7,8; Nygard/ITD-light ADR); L=11-30 (all+9; MADR+Confirmation ADRs); XL=30+ (full+9; MADR+Confirmation ADRs). ADR template-weight rule: S/M -> Nygard/ITD-light; L/XL -> MADR + NHS Wales Confirmation, while every generated ADR still carries the invariant core. Return {tier, activeSteps, rationale} with the recalled patterns folded into rationale.'
 const routerModel = resolveStageModel('router')
 const routerOpts = mergeOpts({ label: stageLabel('router+recall', routerModel), phase: 'Router', schema: ROUTER, effort: 'low' }, routerModel)
 modelsUsed.router = modelLabel(routerOpts)
-const router = await agent(routerPrompt + codexEffortHint(routerOpts), routerOpts)
+// router checkpoint: its result (tier + recalled-pattern rationale) seeds every downstream hash.
+// The Step-0 RECALL is part of the stage — a resumed router restores the SAME recalled patterns the
+// original run applied (fresh lessons taught since then enter on the next live run, not mid-resume).
+const routerHash = ckptHash('router', [DESC, CODE_HINT, MODE, A.tier === undefined ? null : A.tier, BRAIN, MODELS.router === undefined ? null : MODELS.router, CODEX_MODEL, usageOverride])
+const router = await withCheckpoint('router', 'Router', routerHash, async () => agent(routerPrompt + codexEffortHint(routerOpts), routerOpts))
+if (resumedStages.indexOf('router') !== -1) modelsUsed.router = modelsUsed.router + ' (resumed)'
 let tier = A.tier || (router ? router.tier : 'M')
 const LEARNED = router ? router.rationale : 'none recalled'
 const isMplus = tier === 'M' || tier === 'L' || tier === 'XL'
@@ -620,7 +730,7 @@ if (autoCostStages.length > 0) {
 // GUARANTEED fa-panel write (the router, being low-effort + multi-job, tends to skip the fa-record
 // Bash call). A dedicated single-command agent reliably lights up the live /feature-adr panel at the
 // most visible moment. Uses the workspace bin (PATH-independent). Best-effort — never blocks.
-await agent('Run EXACTLY this one shell command via your Bash tool and report its stdout verbatim — do nothing else, do not summarize: ' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled 3 --stored 0 --mode ' + MODE + ' --project ' + REPO, { label: 'fa-record:step0', phase: 'Router', effort: 'low' })
+if (resumedStages.indexOf('router') === -1) await agent('Run EXACTLY this one shell command via your Bash tool and report its stdout verbatim — do nothing else, do not summarize: ' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 0 recall" --recalled 3 --stored 0 --mode ' + MODE + ' --project ' + REPO, { label: 'fa-record:step0', phase: 'Router', effort: 'low' })
 
 // R1 product-architecture-lens (ADR-001 Decision 3): forward-looking сверка of THIS feature vs the LIVE
 // product map + vision. NON-BLOCKING/soft by design — it LOGS {signal,confidence} so a real command
@@ -672,7 +782,17 @@ if (isMplus) {
   const archExtra = isLplus ? ' Also ' + FDIR + '/04_domain_model.md (DDD).' : ''
   designThunks.push(() => designStage((isLplus ? 'Step 4 (DDD) + ' : '') + 'Step 5 (Architecture) of /feature-adr for "' + DESC + '" (' + SLUG + '). READ the code. Write ' + FDIR + '/05_architecture.md (components, data flow, integration points, the emit/merge/wiring shape).' + archExtra + ' Return wrote[] + summary.', archOpts, FDIR + '/05_architecture.md', 'architecture'))
 }
-const design = await parallel(designThunks)
+// design checkpoint: ONE composite entry for the whole parallel design fan (requirements/ADR/QCSD/
+// architecture). A partial fan (any null) is never checkpointed — resume must not restore half a
+// design. The hash carries EVERY input that steers the fan (Codex QE #4): tier, models, the recalled
+// patterns, the project-skills manifest state, the usage override, and CODEX_MODEL (a bare 'codex'
+// model spec resolves through it). The artifact probe requires EVERY tier-active design artifact
+// (Codex QE #2 — a one-file probe accepted a design missing its ADR/architecture).
+const designHash = ckptHash('design', [tier, DESC, CODE_HINT, fnv1a64(String(LEARNED)), MODELS.requirements === undefined ? null : MODELS.requirements, MODELS.adr === undefined ? null : MODELS.adr, MODELS.ideation === undefined ? null : MODELS.ideation, MODELS.architecture === undefined ? null : MODELS.architecture, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, CODEX_MODEL])
+const designArtifacts = ['01_requirements.md']
+if (isMplus) designArtifacts.push('03_adr/001-' + SLUG + '.md', '03.5_ideation_report.md', '05_architecture.md')
+if (isLplus) designArtifacts.push('02_research.md', '04_domain_model.md')
+const design = await withCheckpoint('design', 'Design', designHash, async () => parallel(designThunks), { artifacts: designArtifacts })
 
 // Step 6: Plan — optionally routed to Codex's top model (opt-in via args.planner='codex').
 // The user opts in at pre-flight ('use the top Codex model for planning?'); we route the Plan step to
@@ -685,6 +805,11 @@ const planPrompt = 'Step 6 (SPARC-GOAP implementation plan) of /feature-adr for
 // DEFAULT_MODELS/coder-fold) or the DEFAULT_MODELS.plan ('sonnet') under routing; else {} (BC).
 const planModel = resolveStageModel('plan')
 const planIsCodex = (planModel.agentType === 'codex:codex-rescue') || (MODELS.plan === undefined && PLANNER === 'codex')
+// plan checkpoint: keyed on the design fan's RESULT (a stale design invalidates the plan) + the
+// planner spec. Covers the standard L/XL two-phase flow: the stop-after-plan re-invoke resumes
+// router+design+plan instead of re-running them.
+const planHash = ckptHash('plan', [tier, DESC, fnv1a64(JSON.stringify(design === undefined ? null : design)), PLANNER, MODELS.plan === undefined ? null : MODELS.plan, CODEX_MODEL, usageOverride])
+let plan = await withCheckpoint('plan', 'Plan', planHash, async () => {
 let plan = null
 if (planIsCodex) {
   const planCodexLabelOpts = (planModel.agentType === 'codex:codex-rescue') ? planModel : specToOpts('codex:' + CODEX_MODEL + ':high')
@@ -709,6 +834,9 @@ if (plan === null) {
   const claudePlan = await agent(planPrompt, claudePlanOpts)
   plan = claudePlan ? { wrote: claudePlan.wrote, summary: claudePlan.summary, planner: planIsCodex ? 'claude-fallback' : 'claude' } : null
 }
+return plan
+})
+if (resumedStages.indexOf('plan') !== -1) modelsUsed.plan = (plan && plan.planner ? String(plan.planner) : 'plan') + ' (resumed)'
 
 // ── R6 challenge panel: adversarial plan-gate at the checkpoint (ADVISE, never block) ──
 // The panel is NEVER the plan's own author (ADR §1 hard invariant): author=Claude → a cross-family Codex
@@ -794,7 +922,7 @@ if (stopHere) {
   // P4 (checkpoint-gate-line): a DERIVED gates map — each entry comes from machine state (artifact/verdict
   // presence), never from prose, so a skipped gate shows as 'not-run' instead of being silently forgotten.
   const planGates = { plan: (plan ? 'produced' : 'missing'), challengePanel: (challengeVerdict ? 'ran' : 'not-run'), code: 'not-run', qe: 'not-run' }
-  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: plannedModels, challengeVerdict: challengeVerdict, gates: planGates, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'L/XL checkpoint - review the ADR + plan (+ the planned code/qe/fleet models) + the challenge panel verdict (advisory) + the gates line, then re-invoke with args.stopAfter="none" to implement + QE. Present the gates map as a `🚦 Gates:` line in the checkpoint banner.' }
+  return { tier: tier, phase: 'checkpoint-after-plan', artifactsDir: FDIR, planner: (plan ? plan.planner : null), plan: (plan ? plan.summary : null), modelsUsed: plannedModels, challengeVerdict: challengeVerdict, gates: planGates, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'L/XL checkpoint - review the ADR + plan (+ the planned code/qe/fleet models) + the challenge panel verdict (advisory) + the gates line, then re-invoke with args.stopAfter="none" to implement + QE (durable checkpoints make the re-invoke resume router+design+plan instead of re-running them). Present the gates map as a `🚦 Gates:` line in the checkpoint banner.' }
 }
 
 // Step 7: Code (optional Codex fallback on Claude-limit exhaustion)
@@ -809,6 +937,12 @@ const codeModel = resolveStageModel('code')
 const codeIsCodexFirst = (MODELS.code !== undefined) ? (codeModel.agentType === 'codex:codex-rescue') : (CODER === 'codex')
 const codeClaudeModel = codeIsCodexFirst ? {} : (codeModel.agentType ? {} : codeModel)
 const codeClaudeOpts = mergeOpts({ label: stageLabel('code', codeClaudeModel), phase: 'Code', schema: ARTIFACT, effort: 'high' }, codeClaudeModel)
+// code checkpoint: COMPOSITE — the branchy claude/codex/fallback block sets three interdependent
+// values (code result, coderUsed, codexCodeText); resume must restore all of them together or the
+// barrier/QE/auto-cost logic downstream would see an inconsistent trio. codexCodeText is capped for
+// the checkpoint (it only feeds the expected-targets parse, already consumed by the original run).
+const codeHash = ckptHash('code', [tier, DESC, fnv1a64(JSON.stringify(plan === undefined ? null : plan)), CODER, MODELS.code === undefined ? null : MODELS.code, CODEX_MODEL, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride])
+const codeStage = await withCheckpoint('code', 'Code', codeHash, async () => {
 let code = null
 let coderUsed = 'claude'
 let codexCodeText = ''
@@ -825,11 +959,10 @@ if (code === null && (codeIsCodexFirst || CODER === 'codex-fallback')) {
   const codexCode = await safeCodexAgent(codePrompt + CODEX_HINT + codexEffortHint(codeCodexOpts) + codexExpectedTargetsHint, codeCodexOpts)
   if (codexCode) { codexCodeText = String(codexCode); code = { wrote: [FDIR + '/07_code_changes/change_manifest.md'], summary: codexCodeText.slice(0, 500) }; coderUsed = codeIsCodexFirst ? 'codex' : 'codex-fallback'; modelsUsed.code = modelLabel(codeCodexLabelOpts) }
 }
-
-// Step 7.5: Codex-landed barrier. Codex applies edits OUT-OF-BAND via its own runtime; without this,
-// Step-8 QE can read the tree before the async write flushes and false-grade "Step 7 never ran" on real
-// completed code. Poll a bounded 120s backing-off window, preferring declared expected code targets when
-// known. Claude-coded runs are synchronous → this barrier is skipped with zero target parsing/probe work.
+if (code === null) return null
+// Step 7.5 landing barrier runs INSIDE the checkpointed stage (Codex QE #3): the checkpoint may
+// only exist AFTER the barrier confirmed the out-of-band Codex edits landed — a crash between
+// code-return and barrier must leave NO resumable code checkpoint.
 let landedNote = ''
 if (needsCodeLandedBarrier(coderUsed)) {
   const expectedCodeTargets = extractExpectedCodeTargets(A.expectedCodeTargets, codexCodeText)
@@ -838,6 +971,23 @@ if (needsCodeLandedBarrier(coderUsed)) {
   const probe = await agent('Confirm the Codex Step-7 edits have LANDED in the working tree BEFORE QE runs (Codex writes out-of-band). Expected-file mode must be satisfied by one of the declared expected paths; unrelated dirty files do not count in that mode. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + barrierCmd, { label: 'code:confirm-landed', phase: 'Code' })
   landedNote = '\n\nCODEX-CODED (out-of-band): Step 7.5 landing barrier used mode=' + barrierPlan.mode + ', window=' + barrierPlan.pollWindowSeconds + 's. Review the signal below. If status=landed, read the listed files and do NOT report "Step 7 never ran". Only status=genuinely-not-landed with "' + barrierPlan.emptySignal + '" means the bounded barrier found no intended code after the full window.\nExpected code targets: ' + (barrierPlan.expectedPaths.length ? barrierPlan.expectedPaths.join(', ') : '(none declared; fallback accepts any non-pipeline code change)') + '\n' + String(probe || '(landed-probe failed)').slice(0, 1500)
 }
+return { code: code, coderUsed: coderUsed, codexCodeText: String(codexCodeText).slice(0, 4000), modelUsed: modelsUsed.code, landedNote: landedNote }
+}, { validate: function (r) { return !!(r && typeof r === 'object' && r.code && typeof r.code === 'object' && typeof r.coderUsed === 'string' && typeof r.landedNote === 'string') }, persist: function (r) { return !/genuinely-not-landed/.test(String(r.landedNote || '')) } })
+let code = codeStage ? codeStage.code : null
+let coderUsed = codeStage ? codeStage.coderUsed : 'claude'
+let codexCodeText = codeStage ? codeStage.codexCodeText : ''
+if (codeStage && codeStage.modelUsed) modelsUsed.code = codeStage.modelUsed + (resumedStages.indexOf('code') !== -1 ? ' (resumed)' : '')
+
+// Step 7.5: Codex-landed barrier. Codex applies edits OUT-OF-BAND via its own runtime; without this,
+// Step-8 QE can read the tree before the async write flushes and false-grade "Step 7 never ran" on real
+// completed code. Poll a bounded 120s backing-off window, preferring declared expected code targets when
+// known. Claude-coded runs are synchronous → this barrier is skipped with zero target parsing/probe work.
+// landedNote comes FROM the checkpointed composite (the barrier ran inside the code stage — QE #3):
+// on resume the ORIGINAL barrier signal is restored verbatim with a resumed marker prepended.
+let landedNote = codeStage ? String(codeStage.landedNote || '') : ''
+if (resumedStages.indexOf('code') !== -1 && landedNote !== '') {
+  landedNote = '\n\n[RESUMED from checkpoint — the landing barrier below ran in the ORIGINAL run; the change-manifest artifact was re-verified present by the resume probe]' + landedNote
+}
 
 // Step 8: QE (brutal-honesty, agentic-qe) + MANDATORY teach
 phase('QE')
@@ -852,9 +1002,18 @@ const qeModel = resolveStageModel('qe')
 // Single tested source of truth (feature-adr-routing.ts:qeShouldUseCodex) — closes the self-QE hole where
 // the legacy qeReviewer='codex' knob used to re-route QE back to codex even when the CODER was codex.
 if (MODELS.qe === undefined && QE_REVIEWER === 'codex' && coderIsCodex()) log('QE: coder is codex — enforcing cross-model Claude QE (ignoring qeReviewer=codex to avoid self-review)')
-const qeIsCodex = qeShouldUseCodex()
+// reqe QE #3: the usage override can resolve the QE stage to codex EVEN when qeShouldUseCodex()
+// (which reads the pre-override config) says claude — dispatching that through the "claude" branch
+// would run the stub wrapper AND mislabel qeReviewerUsed='claude' (a codex-on-codex review recorded
+// as cross-family). The resolved agentType is the truth; either signal routes the codex branch.
+const qeIsCodex = qeShouldUseCodex() || (qeModel && qeModel.agentType === 'codex:codex-rescue')
 const qeClaudeModel = qeIsCodex ? {} : qeModel
 const qeClaudeOpts = mergeOpts({ label: stageLabel('qe:brutal', qeClaudeModel), phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeClaudeModel)
+// qe checkpoint: COMPOSITE (verdict + reviewer identity) keyed on the CODE stage's result — a re-coded
+// feature always re-QEs. The teach/fa-record side effects belong to the stage: a resumed QE does not
+// re-teach (the original run already stored its lessons — replaying teach would double-store).
+const qeHash = ckptHash('qe', [fnv1a64(JSON.stringify(codeStage === undefined ? null : codeStage)), tier, DESC, QE_REVIEWER, MODELS.qe === undefined ? null : MODELS.qe, CODEX_MODEL, coderUsed, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride])
+const qeStage = await withCheckpoint('qe', 'QE', qeHash, async () => {
 let qe = null
 let qeReviewerUsed = 'claude'
 if (!qeIsCodex) {
@@ -890,17 +1049,63 @@ if (qe === null && qeIsCodex) {
   qe = await agent(qePrompt, qeBeltOpts)
   if (qe) { qeReviewerUsed = 'claude'; modelsUsed.qe = modelLabel(qeBeltOpts) }
 }
+if (qe === null) return null
+return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe }
+}, { validate: function (r) { return !!(r && typeof r === 'object' && r.qe && typeof r.qe === 'object' && typeof r.qeReviewerUsed === 'string') } })
+let qe = qeStage ? qeStage.qe : null
+let qeReviewerUsed = qeStage ? qeStage.qeReviewerUsed : 'claude'
+if (qeStage && qeStage.modelUsed) modelsUsed.qe = qeStage.modelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
 
 // Step 8 claim-gate: fold the QE agent's reported claim-check counts into an additive result field.
 const claimGate = step8ClaimGate(qe && qe.claimCheck ? qe.claimCheck : null)
 log(claimGate.note)
 
+// ── re-QE debt emission (backlog 6b40e667) — mirror of harness-core/src/reqe.ts ──
+// The cross-model guard was consciously SUSPENDED when the usage override made coder and QE the
+// same family (FR-2.9). Record that as a machine DEBT (features/<slug>/.fa-state/reqe-due.json) so
+// `dz reqe` / `dz usage` surface it after limits reset — a doc instruction on the weakest detection
+// layer becomes a fact on disk. Emitted ONLY for the actual same-family-under-override case: a
+// switch that kept cross-family QE, or the codex-unavailable Claude belt (no override), creates no
+// debt. A RESUMED qe never re-emits (the original run emitted; a settlement must not be clobbered).
+let reqeDue = false
+{
+  const reqeFamOf = function (s) { return /codex|gpt|openai/i.test(String(s || '')) ? 'openai' : 'claude' }
+  const qeLabel = String(modelsUsed.qe || '')
+  if (/\(usage-switched\)/.test(qeLabel) && reqeFamOf(coderUsed) === reqeFamOf(qeReviewerUsed)) {
+    reqeDue = true
+    const reqeDebt = { schema: 'reqe-due-1', slug: SLUG, coderFamily: reqeFamOf(coderUsed), qeFamily: reqeFamOf(qeReviewerUsed), qeGrade: (qe && qe.grade) ? String(qe.grade) : null, reason: 'usage-switched self-review: Step-8 QE ran on the coder’s own family under the limit override (FR-2.9)', emittedAt: null, runStamp: qeHash }
+    // IDEMPOTENT + VERIFIED (reqe QE #2 + r2 #2/#3): a RESUMED qe re-runs this block (the original
+    // run may have died between the qe checkpoint and this write), but: an existing due file is
+    // never clobbered; a settlement blocks re-emission ONLY when it carries THIS run's runStamp (an
+    // OLD settlement must not immunize the slug against a FRESH run's debt); the write itself is
+    // noclobber `set -C` (O_EXCL — a concurrent emitter or a planted/dangling symlink cannot be
+    // written through). The agent echoes the written file back; an unverifiable write is logged
+    // LOUDLY, and reqeDue stays true in the result either way.
+    const dueQ = shq(FDIR + '/.fa-state/reqe-due.json')
+    const emitCmd = 'if [ -e ' + dueQ + ' ]; then echo REQE-EXISTS; elif grep -qs ' + shq(qeHash) + ' ' + shq(FDIR + '/.fa-state') + '/reqe-settled*.json 2>/dev/null; then echo REQE-SETTLED-THIS-RUN; else mkdir -p ' + shq(FDIR + '/.fa-state') + ' && printf %s ' + shq(JSON.stringify(reqeDebt)) + ' | sed "s/\\"emittedAt\\":null/\\"emittedAt\\":\\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"/" | (set -C; cat > ' + dueQ + ') && cat ' + dueQ + '; fi'
+    const emitOut = await agent('Run EXACTLY this one shell command via your Bash tool and return its stdout VERBATIM, nothing else: ' + emitCmd, { label: 'reqe:emit', phase: 'QE', effort: 'low' })
+    const emitText = String(emitOut || '')
+    if (/REQE-SETTLED-THIS-RUN/.test(emitText)) log('re-QE debt: THIS run’s debt was already settled — not re-opened')
+    else if (/REQE-EXISTS/.test(emitText)) log('re-QE debt: already recorded for ' + SLUG + ' — not overwritten')
+    else if (emitText.indexOf('reqe-due-1') !== -1) log('re-QE DEBT recorded: Step-8 ran same-family under the usage override — after limits reset run `dz reqe --slug ' + SLUG + '` for the independent cross-family pass')
+    else log('re-QE debt write UNVERIFIED (agent returned no readback) — the debt may be missing on disk; reqeDue=true is still reported, record it manually via features/' + SLUG + '/.fa-state/reqe-due.json')
+  }
+}
+
 // ── AUTO-COST outcome recording (feature learned-cost-routing) ──
 // The two-phase label lands here: every auto-cost stage that produced an artifact records a PROVISIONAL (i);
 // the CODE stage's authoritative gate (ii) is the Step-8 QE grade (A/B = pass) — a produced-but-gate-FAILED
 // run is recorded as a FAILURE, down-ranking that model for the next run (ADR §2). Byte-identical no-op when
 // nothing was auto-cost. Gate-less stages get weak provisional credit; richer per-stage gates are Phase-2.
-if (Object.keys(AUTOCOST).length > 0) {
+// checkpoint guard, AT-MOST-ONCE by choice: a resumed QE skips recording. NAMED window (Codex QE #6):
+// if the original run died AFTER the qe checkpoint landed but BEFORE recording finished, that run's
+// routing sample is LOST — accepted, because the alternative (re-recording on every resume) would
+// double-count outcomes and silently skew the auto-cost ranking. A lost sample under-informs; a
+// double-counted one misinforms.
+if (Object.keys(AUTOCOST).length > 0 && resumedStages.indexOf('qe') !== -1) {
+  log('auto-cost: qe stage was RESUMED — outcome recording skipped (already recorded by the original run)')
+}
+if (Object.keys(AUTOCOST).length > 0 && resumedStages.indexOf('qe') === -1) {
   const recPhase = isLplus ? 'FleetQE' : 'QE'
   // Record ONLY stages that ACTUALLY RAN and produced an artifact (QE finding: a blanket loop over configured
   // auto-cost stages credited skipped/failed/fallback stages). `code`/`plan` are guarded by their result var.
@@ -957,8 +1162,12 @@ if (isLplus) {
     () => agent('Step 9 fleet-QE (requirements traceability + risk) for ' + SLUG + ': map ADR decisions to code to tests; flag orphans + high risk. Write ' + FDIR + '/09_fleet_qe_assessment.md.' + codexEffortHint(fleetTraceOpts), fleetTraceOpts),
     () => agent('Step 9 fleet-QE (coverage + regression) for ' + SLUG + ': risk-weighted coverage gaps + regression selection for the changed files. Append to ' + FDIR + '/09_fleet_qe_assessment.md.' + codexEffortHint(fleetCovOpts), fleetCovOpts),
   ]
-  await parallel(fleetThunks)
-  fleet = 'run'
+  const fleetHash = ckptHash('fleet', [fnv1a64(JSON.stringify(qeStage === undefined ? null : qeStage)), tier, MODELS.fleet === undefined ? null : MODELS.fleet, CODEX_MODEL, usageOverride])
+  fleet = await withCheckpoint('fleet', 'FleetQE', fleetHash, async () => {
+    const fleetRuns = await parallel(fleetThunks)
+    return fleetRuns.every(function (x) { return x !== null && x !== undefined }) ? 'run' : null
+  })
+  if (fleet === null) fleet = 'failed (a fleet agent died — not checkpointed)'
 }
 
 // ── Step 10 (OPT-IN): Delivery Gate — post-implementation full review of the LANDED feature ──
@@ -1100,6 +1309,9 @@ return {
   usageEvents: usageEvents,
   usageThreshold: USAGE_THRESHOLD,
   selfLearning: 'recall@Step0 + teach@Step8 (mandatory)',
+  resumedStages: resumedStages,
+  checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off',
+  reqeDue: reqeDue,
   brain: BRAIN,
   polymorphism: POLY.hasManifest ? POLY.report : null,
   claimGate: claimGate,