@dzhechkov/skills-feature-adr 1.5.15 → 1.5.16

package/.dz-manifest.json

@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "66f3b2cf7fdcf9efbf64c7d5cc36b34ffc82b151a9bc07e6fda5fc47d4fba72e"
+        "sha256": "a76e2b71dd2598d4d6789ee00ce99791d4e4927466f4800e5637c4bbbade859e"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "e74b1a22e0260a61a3ab37512366402c4e6231b85625028a86219ee3f5c21e12"
+        "sha256": "d9af637b1b430a77811424de145ff5a72eceff10b7a583413affa4899c877b8e"
       },
       {
         "path": "src/cli.js",
@@ -137,7 +137,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md",
-        "sha256": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
+        "sha256": "b6e505083c1b8bc92243379b72ff4667b5b91ef65fd9c2ef7407129018b3e56b"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/04-ddd.md",
@@ -157,7 +157,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
+        "sha256": "4aa7ef1dea08b8d1995d968a317da5d36a4859ec299637bdc60170cf577c87af"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -255,6 +255,10 @@
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
         "sha256": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
       },
+      {
+        "path": "templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs",
+        "sha256": "80f9691b8e94bf310461aeaaaa23af6e336d41d0962fdf137737639655cbdeb8"
+      },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
         "sha256": "82c3c48c25f400f3a64d1caba3d47357f3db87460f0746f88706f901eb6ff689"
@@ -321,7 +325,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "7928cc90575eaef4f4626849f4490631676bc4ce6eb80e8f94c99d9e215bbd77"
+        "sha256": "6f9e6205c8f78bef8086603bf0efe8099011a2cc273d786b8404bd77af565354"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -333,5 +337,5 @@
       }
     ]
   },
-  "signature": "wSJpaUNRsFXAD5Ye7V5y8FPgcvrLDEq6peQpK/RadbFsD518KglZDn5GNzV4DJE6i+mkHbH9tIwr+HIYXKN4BA=="
+  "signature": "nV5vsSwCCTR5hUAMHmxpGPe3DoZoRQJsnAdqqm4gO0OPm1GHMWBx5AZhJEC1jzUugamIpkJEPtWCsD6d+e0oAg=="
 }

package/README.md

@@ -1,6 +1,6 @@
 # @dzhechkov/skills-feature-adr
 
-Current package version: `1.5.15`. <!-- dz:version -->
+Current package version: `1.5.16`. <!-- dz:version -->
 
 Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/skills-feature-adr
 
@@ -1401,3 +1401,20 @@ watch v1 ETA is unavailable and global source inventory omitted. No stdin/raw mo
 store writes or automatic terminal/settings changes. Normal SQLite ephemeral WAL/SHM sidecars are
 permitted. One-shot Claude text/JSON/ETA remain unchanged. Codex native footer capability is not
 asserted; parity names manual `dz statusline --watch` access.
+
+
+Review convergence in `/feature-adr` now uses one installed Node gate in Plain and native Workflow.
+Step 3.5 closes before planning; Step 8 closes before completion and delivery, including S tier and
+resumed runs. The host measures current artifact bytes and preserves originating reviewer conditions;
+focused rework includes an explicit author delta/new-risk assessment and independent own-condition
+verification. Serious primary or precision findings remain visible at the round ceiling.
+
+Missing or stale receipts, legacy resume, unavailable reviewers and read-only Codex mode A pause
+with host-driven repair instructions. Parallel native design can require focused review after sibling
+artifacts settle. Clean initial supported review closes without invented conditions or an extra review.
+This is a receipt consistency/freshness gate, not reviewer authentication or semantic proof; existing
+Confirmation, scope, family and budget gates still apply. No automatic repair loop or new CLI command.
+
+Repeated prepare retains all pending paths until verified closure. Actual fallback families bind before dispatch while prior owners remain required. Same-slug QE repair uses current own-reviewer evidence bound to the complete historical checkpoint; original findings/grades remain visible, and failed Confirmation still blocks delivery.
+
+Before fallback, host prepare retains independently written pending receipt findings under the original owner even if that reviewer returned null. Unreconciled pending evidence pauses dispatch for originating-reviewer repair; it cannot be replaced by a clean fallback to obtain closure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.5.15",
+  "version": "1.5.16",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"

package/sbom.json

@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "66f3b2cf7fdcf9efbf64c7d5cc36b34ffc82b151a9bc07e6fda5fc47d4fba72e"
+          "content": "a76e2b71dd2598d4d6789ee00ce99791d4e4927466f4800e5637c4bbbade859e"
         }
       ]
     },
@@ -69,7 +69,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "e74b1a22e0260a61a3ab37512366402c4e6231b85625028a86219ee3f5c21e12"
+          "value": "d9af637b1b430a77811424de145ff5a72eceff10b7a583413affa4899c877b8e"
         }
       ]
     },
@@ -349,7 +349,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
+          "content": "b6e505083c1b8bc92243379b72ff4667b5b91ef65fd9c2ef7407129018b3e56b"
         }
       ]
     },
@@ -399,7 +399,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
+          "content": "4aa7ef1dea08b8d1995d968a317da5d36a4859ec299637bdc60170cf577c87af"
         }
       ]
     },
@@ -643,6 +643,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "80f9691b8e94bf310461aeaaaa23af6e336d41d0962fdf137737639655cbdeb8"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
@@ -809,7 +819,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7928cc90575eaef4f4626849f4490631676bc4ce6eb80e8f94c99d9e215bbd77"
+          "content": "6f9e6205c8f78bef8086603bf0efe8099011a2cc273d786b8404bd77af565354"
         }
       ]
     },

package/templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md

@@ -27,6 +27,135 @@ sonnet (analytical quality assessment — multiple parallel agents)
 
 ## Protocol
 
+## Review convergence gate (Plain and native Workflow)
+
+Review follows **initial review → host rework → focused verification → closure**, or explicit owner
+escalation. A grade/GO label does not establish closure. Run the same installed Node gate before
+planning (phase `ideation`) and before Step-8 completion/delivery (phase `qe`), including resume.
+
+The host prepares a measured artifact snapshot BEFORE independent review. Resolve the executable
+from this installed skill's `scripts/check-review-convergence.mjs`; do not use a scratch replacement.
+For example, from the execution project, using the actual originating role/family:
+
+```bash
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" prepare \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation \
+  --reviewers '[{"id":"qcsd-quality","family":"owner-exception"},{"id":"qcsd-risk","family":"owner-exception"},{"id":"qcsd-testability","family":"owner-exception"}]'
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" evaluate \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation
+```
+
+For QE use `--phase qe` and the actual `qe-primary` reviewer, plus `qe-precision` when configured.
+`family` is `codex`, `claude`, or an explicitly authorized `owner-exception`. Existing family/routing
+policy remains binding; this receipt does not authorize an exception. Only the host calls `prepare`.
+It retains originating reviewer roles and prior condition meanings in the existing feature checkpoint
+`.fa-state/review-convergence-<phase>-host.json`; neither the latest report nor an empty request array
+can replace that lineage. Do not edit/delete host lineage to obtain a clean bootstrap. A new nonce is
+issued when measured bytes/path membership change; repeated preparation cannot remove conditions. Pending changed paths accumulate across every prepare, including path additions/deletions, until an established closure; failed/refused evaluations never clear them.
+
+The snapshot measures requirements, every direct ADR, architecture, and other available design
+inputs. QE also measures the plan, ideation report, every declared target, and host-discovered Git
+changes/additions/deletions against `.fa-state/base-ref` (HEAD when absent). Receipt/checkpoint files,
+QE report and generated `architecture/map.json` are outputs excluded to avoid circular hashes.
+Explicit planned deletions carry a null digest. Traversal, symlinks and non-files refuse. The host
+must include relevant unchanged dependencies in declared targets; hashing cannot discover semantic
+dependencies. Parallel Workflow design may change after ideation review: that stale review pauses
+before planning and needs focused review of the settled snapshot.
+
+All three QCSD core roles remain originating reviewers. The coordinator does not manufacture their
+receipts from grades or report prose. The JSON example below shows one entry; include all three
+actual roles in `reviews`, with their actual families. Each independent reviewer writes its OWN
+entry, preserving other reviewer entries and the actual
+author handoff, in `.fa-state/review-convergence-<phase>-review.json`. A genuinely clean initial
+review needs no invented condition or extra review. Its complete receipt shape is:
+
+```json
+{
+  "schema": "fa-review-convergence-1", "phase": "ideation",
+  "nonce": "<copy host snapshot nonce>", "revision": "<copy host snapshot revision>",
+  "author": null,
+  "reviews": [{
+    "reviewer": "qcsd-quality", "family": "owner-exception", "independent": true, "verdict": "clean",
+    "conditions": [], "verifications": [],
+    "newRisks": {"assessment": "none identified after complete scope review", "evidence": "<actual review evidence>", "conditions": []},
+    "authorAssessmentChecked": false, "deltaVerification": null
+  }]
+}
+```
+
+`verdict` is `clean`, `conditional`, or `no-go`. Conditions have closed fields
+`{id, owner, severity, classification, requirement, scope, evidence}`: stable unique ID, originating
+role ID, BLOCKER/CRITICAL/HIGH/WARNING/SUGGESTION, structural/wording, exact acceptance meaning,
+nonempty repo-relative scope paths, and original evidence. Carry every prior own condition unchanged
+on every pass. Reviewer verifications have closed fields
+`{id, revision, classification, evidence, implementationVerified}`. Only the originating independent
+role can verify its own condition at the current revision; author/lead/scribe assertions cannot.
+
+Rework requires the actual author object
+`{addressed, changedScope, classification, delta, evidence, newRisks}`. Addressed IDs name prior
+conditions; changedScope includes ALL host-measured changes and affected dependencies. Delta/evidence
+explain the actual fix. Both author and reviewer `newRisks` require explicit assessment/evidence and a
+conditions array, including an explicit none-identified assessment when empty. The reviewer must set
+`authorAssessmentChecked:true` and supply independent
+`deltaVerification:{classification,evidence,implementationVerified}`. Structural changes affect
+behavior, contracts, safeguards, architecture or acceptance meaning and require affected implementation
+and test verification. Wording changes affect expression only; the independent reviewer checks that
+classification, so an author's wording label cannot weaken structural verification.
+
+Focused scope is outstanding conditions plus actual changes and affected dependencies. New serious
+risks always expand that scope. Retain ALL conditions and serious primary/precision findings until
+own-reviewer verification; a token/round ceiling escalates unresolved risk, never approves it.
+
+Gate exits: 0 with `prepared` (prepare only) or `closed` (evaluate only); 1 `unresolved`; 3
+`not-established`. Inspect the structured reasons/unresolved IDs. Missing executable/report, malformed
+or contradictory output, foreign/duplicate/omitted conditions, stale phase/nonce/manifest or unavailable
+reviewer refuses. Native Workflow strictly checks stdout AND exit before planning and before
+completion/delivery/success tags. Supported native/Mode-B/fallback/precision reviewers receive this
+contract; the read-only Codex mode-A route cannot accept it and pauses for a supported independent
+review. A scribe never creates reviewer evidence from grade. Historical resume without this contract
+needs fresh evidence; resume rechecks bytes and every configured route, including unwitnessed precision.
+
+Host prepare first reads the existing reviewer receipt, including valid partial own entries written
+before an agent/transport failure. It preserves independently written conditions under their original
+role/family before binding any actual fallback. This imports findings, never closure or author/scribe
+claims. A stale receipt cannot originate new host conditions; known prior meanings remain immutable.
+`pending-reviewer-receipt-needs-origin-review` pauses before native fallback dispatch when pending
+evidence cannot be reconciled. Keep the original receipt and host lineage. Have its originating
+reviewer repair malformed/foreign fields or refresh unknown stale own findings at the unchanged
+host identity/current snapshot. Repeat prepare for the selected actual base-role families, complete
+the returned full reviewer roster with actual own verification, then evaluate and resume the same
+slug. No receipt/lineage deletion or relabeling is a recovery action. The existing QE checkpoint
+validator rejects a paused non-QE result, so same-slug resume re-enters only that reviewer stage;
+unrelated coder checkpoints remain eligible for reuse.
+
+Bind the actual fallback family with host prepare BEFORE reviewer dispatch. An unused role may change family; once review evidence originated, its role/family and prior conditions remain required, and the new family receives a distinct `<base-id>:<family>` role. Reviewers read the returned full roster and never relabel old ownership.
+
+On refusal, the host settles artifacts, calls prepare with the selected actual base-role families, supplies
+the author handoff, requests focused own-condition verification, then evaluates and resumes the same
+slug. This is host-driven repair, not an automatic repair loop. Existing Confirmation, amendment,
+scope, testing, independent-family and budget gates remain conjunctive. This gate establishes receipt
+consistency and current artifact binding, not semantic truth or authenticated reviewer identity.
+
+For a same-slug QE resume blocked by historical serious findings, read-only mode A, or an
+unwitnessed precision append, preserve the complete original checkpoint, findings and grades.
+Prepare returns `checkpointDigest`: SHA-256 of `JSON.stringify` of the latest `qe` result in
+`.fa-state/checkpoints.jsonl`. Each actual originating reviewer supplies optional closed-field
+`checkpointVerification:{checkpointDigest,evidence,supported:true,route,findings,reportDigest}`
+in its own review entry, in addition to the ordinary current-revision independent verification.
+`route` is native/mode-b/fallback and evidence describes the actual supported focused review;
+mode A, author/scribe flags, or the old grade cannot establish this proof. `findings` maps EVERY
+original serious gap with `{digest,conditionId}`, where digest is SHA-256(JSON.stringify(gap))
+and conditionId names that reviewer's preserved serious condition with its current structural
+implementation verification. Both primary and precision origins must verify their own findings.
+Use `reportDigest:null` normally; an unwitnessed precision append requires that originating
+precision reviewer to verify the actual complete `08_qe_report.md` and supply its SHA-256.
+The report must contain Primary QE pass, Precision QE pass, and Combined Step-8 grade sections.
+Then evaluate with the same phase/repo/feature and re-invoke the same slug. Only a closed gate
+with complete checkpoint binding can reconcile historical refusals on an actual resumed QE stage;
+live findings, changed checkpoints/artifacts and a failed Confirmation gate still block delivery.
+This procedure runs no coder or automatic repair loop, and retains the historical result for audit.
+
+
 ### 1. Flag Detection (MANDATORY)
 
 Scan feature requirements + ADR decisions and SET these flags:

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -23,6 +23,132 @@ sonnet (analytical evaluation)
 
 ## Protocol
 
+## Review convergence gate (Plain and native Workflow)
+
+Review follows **initial review → host rework → focused verification → closure**, or explicit owner
+escalation. A grade/GO label does not establish closure. Run the same installed Node gate before
+planning (phase `ideation`) and before Step-8 completion/delivery (phase `qe`), including resume.
+
+The host prepares a measured artifact snapshot BEFORE independent review. Resolve the executable
+from this installed skill's `scripts/check-review-convergence.mjs`; do not use a scratch replacement.
+For example, from the execution project, using the actual originating role/family:
+
+```bash
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" prepare \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation \
+  --reviewers '[{"id":"qcsd","family":"owner-exception"}]'
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" evaluate \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation
+```
+
+The ideation example above is illustrative; QCSD uses its three actual core role entries. For QE use `--phase qe` and the actual `qe-primary` reviewer, plus `qe-precision` when configured.
+`family` is `codex`, `claude`, or an explicitly authorized `owner-exception`. Existing family/routing
+policy remains binding; this receipt does not authorize an exception. Only the host calls `prepare`.
+It retains originating reviewer roles and prior condition meanings in the existing feature checkpoint
+`.fa-state/review-convergence-<phase>-host.json`; neither the latest report nor an empty request array
+can replace that lineage. Do not edit/delete host lineage to obtain a clean bootstrap. A new nonce is
+issued when measured bytes/path membership change; repeated preparation cannot remove conditions. Pending changed paths accumulate across every prepare, including path additions/deletions, until an established closure; failed/refused evaluations never clear them.
+
+The snapshot measures requirements, every direct ADR, architecture, and other available design
+inputs. QE also measures the plan, ideation report, every declared target, and host-discovered Git
+changes/additions/deletions against `.fa-state/base-ref` (HEAD when absent). Receipt/checkpoint files,
+QE report and generated `architecture/map.json` are outputs excluded to avoid circular hashes.
+Explicit planned deletions carry a null digest. Traversal, symlinks and non-files refuse. The host
+must include relevant unchanged dependencies in declared targets; hashing cannot discover semantic
+dependencies. Parallel Workflow design may change after ideation review: that stale review pauses
+before planning and needs focused review of the settled snapshot.
+
+Each independent reviewer writes its OWN entry, preserving other reviewer entries and the actual
+author handoff, in `.fa-state/review-convergence-<phase>-review.json`. A genuinely clean initial
+review needs no invented condition or extra review. Its complete receipt shape is:
+
+```json
+{
+  "schema": "fa-review-convergence-1", "phase": "ideation",
+  "nonce": "<copy host snapshot nonce>", "revision": "<copy host snapshot revision>",
+  "author": null,
+  "reviews": [{
+    "reviewer": "qcsd", "family": "owner-exception", "independent": true, "verdict": "clean",
+    "conditions": [], "verifications": [],
+    "newRisks": {"assessment": "none identified after complete scope review", "evidence": "<actual review evidence>", "conditions": []},
+    "authorAssessmentChecked": false, "deltaVerification": null
+  }]
+}
+```
+
+`verdict` is `clean`, `conditional`, or `no-go`. Conditions have closed fields
+`{id, owner, severity, classification, requirement, scope, evidence}`: stable unique ID, originating
+role ID, BLOCKER/CRITICAL/HIGH/WARNING/SUGGESTION, structural/wording, exact acceptance meaning,
+nonempty repo-relative scope paths, and original evidence. Carry every prior own condition unchanged
+on every pass. Reviewer verifications have closed fields
+`{id, revision, classification, evidence, implementationVerified}`. Only the originating independent
+role can verify its own condition at the current revision; author/lead/scribe assertions cannot.
+
+Rework requires the actual author object
+`{addressed, changedScope, classification, delta, evidence, newRisks}`. Addressed IDs name prior
+conditions; changedScope includes ALL host-measured changes and affected dependencies. Delta/evidence
+explain the actual fix. Both author and reviewer `newRisks` require explicit assessment/evidence and a
+conditions array, including an explicit none-identified assessment when empty. The reviewer must set
+`authorAssessmentChecked:true` and supply independent
+`deltaVerification:{classification,evidence,implementationVerified}`. Structural changes affect
+behavior, contracts, safeguards, architecture or acceptance meaning and require affected implementation
+and test verification. Wording changes affect expression only; the independent reviewer checks that
+classification, so an author's wording label cannot weaken structural verification.
+
+Focused scope is outstanding conditions plus actual changes and affected dependencies. New serious
+risks always expand that scope. Retain ALL conditions and serious primary/precision findings until
+own-reviewer verification; a token/round ceiling escalates unresolved risk, never approves it.
+
+Gate exits: 0 with `prepared` (prepare only) or `closed` (evaluate only); 1 `unresolved`; 3
+`not-established`. Inspect the structured reasons/unresolved IDs. Missing executable/report, malformed
+or contradictory output, foreign/duplicate/omitted conditions, stale phase/nonce/manifest or unavailable
+reviewer refuses. Native Workflow strictly checks stdout AND exit before planning and before
+completion/delivery/success tags. Supported native/Mode-B/fallback/precision reviewers receive this
+contract; the read-only Codex mode-A route cannot accept it and pauses for a supported independent
+review. A scribe never creates reviewer evidence from grade. Historical resume without this contract
+needs fresh evidence; resume rechecks bytes and every configured route, including unwitnessed precision.
+
+Host prepare first reads the existing reviewer receipt, including valid partial own entries written
+before an agent/transport failure. It preserves independently written conditions under their original
+role/family before binding any actual fallback. This imports findings, never closure or author/scribe
+claims. A stale receipt cannot originate new host conditions; known prior meanings remain immutable.
+`pending-reviewer-receipt-needs-origin-review` pauses before native fallback dispatch when pending
+evidence cannot be reconciled. Keep the original receipt and host lineage. Have its originating
+reviewer repair malformed/foreign fields or refresh unknown stale own findings at the unchanged
+host identity/current snapshot. Repeat prepare for the selected actual base-role families, complete
+the returned full reviewer roster with actual own verification, then evaluate and resume the same
+slug. No receipt/lineage deletion or relabeling is a recovery action. The existing QE checkpoint
+validator rejects a paused non-QE result, so same-slug resume re-enters only that reviewer stage;
+unrelated coder checkpoints remain eligible for reuse.
+
+Bind the actual fallback family with host prepare BEFORE reviewer dispatch. An unused role may change family; once review evidence originated, its role/family and prior conditions remain required, and the new family receives a distinct `<base-id>:<family>` role. Reviewers read the returned full roster and never relabel old ownership.
+
+On refusal, the host settles artifacts, calls prepare with the selected actual base-role families, supplies
+the author handoff, requests focused own-condition verification, then evaluates and resumes the same
+slug. This is host-driven repair, not an automatic repair loop. Existing Confirmation, amendment,
+scope, testing, independent-family and budget gates remain conjunctive. This gate establishes receipt
+consistency and current artifact binding, not semantic truth or authenticated reviewer identity.
+
+For a same-slug QE resume blocked by historical serious findings, read-only mode A, or an
+unwitnessed precision append, preserve the complete original checkpoint, findings and grades.
+Prepare returns `checkpointDigest`: SHA-256 of `JSON.stringify` of the latest `qe` result in
+`.fa-state/checkpoints.jsonl`. Each actual originating reviewer supplies optional closed-field
+`checkpointVerification:{checkpointDigest,evidence,supported:true,route,findings,reportDigest}`
+in its own review entry, in addition to the ordinary current-revision independent verification.
+`route` is native/mode-b/fallback and evidence describes the actual supported focused review;
+mode A, author/scribe flags, or the old grade cannot establish this proof. `findings` maps EVERY
+original serious gap with `{digest,conditionId}`, where digest is SHA-256(JSON.stringify(gap))
+and conditionId names that reviewer's preserved serious condition with its current structural
+implementation verification. Both primary and precision origins must verify their own findings.
+Use `reportDigest:null` normally; an unwitnessed precision append requires that originating
+precision reviewer to verify the actual complete `08_qe_report.md` and supply its SHA-256.
+The report must contain Primary QE pass, Precision QE pass, and Combined Step-8 grade sections.
+Then evaluate with the same phase/repo/feature and re-invoke the same slug. Only a closed gate
+with complete checkpoint binding can reconcile historical refusals on an actual resumed QE stage;
+live findings, changed checkpoints/artifacts and a failed Confirmation gate still block delivery.
+This procedure runs no coder or automatic repair loop, and retains the historical result for audit.
+
+
 ### Bridge identity for plain Step 8
 
 When the plain host invokes the existing Claude review bridge, take round number, pipeline run and
@@ -56,7 +182,7 @@ a live Claude model roundtrip or secure every native Codex QE receipt.
 - [ ] Type checker passes (if configured)
 ```
 
-For S-tier: if all pass, proceed to checkpoint. Done.
+For S-tier: passing smoke tests still requires the review-convergence contract above before checkpoint/completion; a smoke pass alone is not closure.
 
 ### 2. Test Generation (M+)
 

package/templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs

@@ -0,0 +1,316 @@
+#!/usr/bin/env node
+// Host checkpoint lineage, not a reviewer-supplied prior array, owns historical conditions.
+// This checks consistency/freshness; it does not authenticate models or judge their evidence.
+import { createHash, randomUUID } from 'node:crypto'
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname, relative, resolve, sep } from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+export const SCHEMA = 'fa-review-convergence-1'
+const phases = ['ideation', 'qe']
+const severities = ['BLOCKER', 'CRITICAL', 'HIGH', 'WARNING', 'SUGGESTION']
+const kinds = ['structural', 'wording']
+const digest = value => createHash('sha256').update(value).digest('hex')
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b)
+const text = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 65536
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+const array = (value, limit = 512) => Array.isArray(value) && value.length <= limit
+function dictionary(value, keys, required = keys) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).every(key => keys.includes(key)) && required.every(key => Object.hasOwn(value, key))
+}
+function strings(value, nonempty = false) { return array(value) && (!nonempty || value.length > 0) && value.every(text) && new Set(value).size === value.length }
+function condition(c, owners) {
+  return dictionary(c, ['id', 'owner', 'severity', 'classification', 'requirement', 'scope', 'evidence']) && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(c.id) && owners.includes(c.owner) && severities.includes(c.severity) && kinds.includes(c.classification) && text(c.requirement) && strings(c.scope, true) && text(c.evidence)
+}
+function risks(r, owners) { return dictionary(r, ['assessment', 'evidence', 'conditions']) && text(r.assessment) && text(r.evidence) && array(r.conditions) && r.conditions.every(c => condition(c, owners)) }
+function checkpointProof(p) {
+  return dictionary(p, ['checkpointDigest', 'evidence', 'supported', 'route', 'findings', 'reportDigest']) && hash(p.checkpointDigest) && text(p.evidence) && p.supported === true && ['native', 'mode-b', 'fallback'].includes(p.route) && array(p.findings) && p.findings.every(v => dictionary(v, ['digest', 'conditionId']) && hash(v.digest) && text(v.conditionId)) && (p.reportDigest === null || hash(p.reportDigest))
+}
+function reviewerFamily(stage) { return stage.qeReviewerUsed === 'codex-fallback' ? 'codex' : stage.qeReviewerUsed }
+function reviewerEntry(r, roster) {
+  const owners = roster.map(p => p.id)
+  return !(!dictionary(r, ['reviewer', 'family', 'independent', 'verdict', 'conditions', 'verifications', 'newRisks', 'authorAssessmentChecked', 'deltaVerification', 'checkpointVerification'], ['reviewer', 'family', 'independent', 'verdict', 'conditions', 'verifications', 'newRisks', 'authorAssessmentChecked', 'deltaVerification']) || !owners.includes(r.reviewer) || roster.find(p => p.id === r.reviewer)?.family !== r.family || r.independent !== true || !['clean', 'conditional', 'no-go'].includes(r.verdict) || !array(r.conditions) || !r.conditions.every(c => condition(c, owners) && c.owner === r.reviewer) || !array(r.verifications) || !risks(r.newRisks, owners) || !r.newRisks.conditions.every(c => c.owner === r.reviewer) || typeof r.authorAssessmentChecked !== 'boolean')
+}
+function result(phase, verdict, revision, reasons, unresolved = []) { return { schema: SCHEMA, phase, verdict, revision, unresolved, reasons } }
+
+export function evaluateReviewConvergence(host, receipt, currentManifest) {
+  const phase = host?.phase
+  const refuse = reason => result(phase || 'qe', 'not-established', host?.snapshot?.revision || null, [reason], (host?.conditions || []).map(c => c.id))
+  if (!dictionary(host, ['schema', 'phase', 'reviewers', 'snapshot', 'conditions', 'reviewSeen', 'rework', 'changedPaths']) || host.schema !== SCHEMA || !phases.includes(phase) || !array(host.reviewers, 16) || host.reviewers.length === 0) return refuse('host-lineage-invalid')
+  const owners = host.reviewers.map(r => r.id)
+  if (new Set(owners).size !== owners.length || !host.reviewers.every(r => dictionary(r, ['id', 'family']) && text(r.id) && ['codex', 'claude', 'owner-exception'].includes(r.family))) return refuse('host-reviewers-invalid')
+  if (!dictionary(host.snapshot, ['nonce', 'revision', 'manifest']) || !text(host.snapshot.nonce) || !hash(host.snapshot.revision) || !array(host.conditions) || !host.conditions.every(c => condition(c, owners)) || typeof host.reviewSeen !== 'boolean' || typeof host.rework !== 'boolean' || !strings(host.changedPaths)) return refuse('host-snapshot-invalid')
+  if (!same(host.snapshot.manifest, currentManifest) || digest(JSON.stringify(currentManifest)) !== host.snapshot.revision) return refuse('artifact-manifest-changed')
+  if (!dictionary(receipt, ['schema', 'phase', 'nonce', 'revision', 'reviews', 'author']) || receipt.schema !== SCHEMA || receipt.phase !== phase || receipt.nonce !== host.snapshot.nonce || receipt.revision !== host.snapshot.revision) return refuse('receipt-phase-or-revision-invalid')
+  if (!array(receipt.reviews, 16) || receipt.reviews.length !== owners.length || new Set(receipt.reviews.map(r => r?.reviewer)).size !== owners.length) return refuse('reviewer-set-invalid')
+  const all = new Map(host.conditions.map(c => [c.id, c]))
+  const verified = new Set()
+  const reasons = []
+  const needsAuthor = host.rework || (host.reviewSeen && host.conditions.length > 0)
+  if (needsAuthor && !receipt.author) return refuse('author-delta-missing')
+  if (receipt.author !== null) {
+    const a = receipt.author
+    if (!dictionary(a, ['addressed', 'changedScope', 'classification', 'delta', 'evidence', 'newRisks']) || !strings(a.addressed) || !strings(a.changedScope, true) || !kinds.includes(a.classification) || !text(a.delta) || !text(a.evidence) || !risks(a.newRisks, owners)) return refuse('author-delta-invalid')
+    if (host.changedPaths.some(path => !a.changedScope.includes(path))) return refuse('author-delta-omits-measured-changes')
+    if (a.addressed.some(id => !all.has(id))) return refuse('author-addressed-unknown-condition')
+    for (const c of a.newRisks.conditions) {
+      if (all.has(c.id) && !same(all.get(c.id), c)) return refuse('author-risk-condition-redefined')
+      all.set(c.id, c)
+    }
+  }
+  for (const r of receipt.reviews) {
+    if (!reviewerEntry(r, host.reviewers)) return refuse('reviewer-contract-invalid')
+    if (Object.hasOwn(r, 'checkpointVerification') && !checkpointProof(r.checkpointVerification)) return refuse('checkpoint-verification-contract-invalid')
+    if (receipt.author && !r.authorAssessmentChecked) return refuse('author-risk-assessment-not-reviewed')
+    if (receipt.author) {
+      const d = r.deltaVerification
+      if (!dictionary(d, ['classification', 'evidence', 'implementationVerified']) || !kinds.includes(d.classification) || !text(d.evidence) || typeof d.implementationVerified !== 'boolean') return refuse('independent-delta-classification-missing')
+      if ((receipt.author.classification === 'structural' || d.classification === 'structural') && (!d.implementationVerified || d.classification !== 'structural')) reasons.push('structural-delta-not-verified:' + r.reviewer)
+    } else if (r.deltaVerification !== null) return refuse('unexpected-delta-verification')
+    const own = r.conditions.concat(r.newRisks.conditions)
+    if (new Set(own.map(c => c.id)).size !== own.length) return refuse('duplicate-condition')
+    for (const c of host.conditions.filter(c => c.owner === r.reviewer)) if (!own.some(n => same(n, c))) return refuse('prior-condition-omitted-or-redefined:' + c.id)
+    for (const c of own) {
+      if (c.scope.some(path => !currentManifest.some(p => p.path === path))) return refuse('condition-scope-unmeasured:' + c.id)
+      if (all.has(c.id) && !same(all.get(c.id), c)) return refuse('condition-redefined:' + c.id)
+      all.set(c.id, c)
+    }
+    if (r.verdict === 'clean' && own.length > 0 && r.verifications.length === 0) return refuse('clean-verdict-contradicts-conditions')
+    if (r.verdict === 'conditional' && own.length === 0) return refuse('conditional-without-conditions')
+    if (r.verdict === 'no-go') reasons.push('reviewer-no-go:' + r.reviewer)
+    const seen = new Set()
+    for (const v of r.verifications) {
+      if (!dictionary(v, ['id', 'revision', 'classification', 'evidence', 'implementationVerified']) || seen.has(v.id) || !all.has(v.id) || all.get(v.id).owner !== r.reviewer || v.revision !== host.snapshot.revision || !kinds.includes(v.classification) || !text(v.evidence) || typeof v.implementationVerified !== 'boolean') return refuse('verification-invalid-or-foreign')
+      seen.add(v.id)
+      // A semantic change cannot become a weaker check by the author's label.
+      const structural = all.get(v.id).classification === 'structural' || receipt.author?.classification === 'structural' || v.classification === 'structural'
+      if (structural && (!v.implementationVerified || v.classification !== 'structural')) reasons.push('structural-verification-missing:' + v.id)
+      else verified.add(v.id)
+    }
+  }
+  const unresolved = [...all.keys()].filter(id => !verified.has(id))
+  for (const id of unresolved) reasons.push('unresolved:' + id)
+  if (receipt.author?.newRisks.conditions.some(c => !receipt.reviews.some(r => r.conditions.concat(r.newRisks.conditions).some(n => same(n, c))))) reasons.push('author-risk-not-adopted-by-reviewer')
+  return result(phase, reasons.length ? 'unresolved' : 'closed', host.snapshot.revision, reasons, unresolved)
+}
+
+function safePath(root, rel, allowMissing = true) {
+  if (!text(rel) || rel.startsWith('/') || rel.includes('\\') || rel.split('/').some(p => !p || p === '.' || p === '..') || /[\x00-\x1f]/.test(rel)) throw Error('unsafe-artifact-path')
+  let path = root
+  for (const part of rel.split('/')) {
+    path = resolve(path, part)
+    if (!existsSync(path)) { if (allowMissing) return resolve(root, rel); throw Error('artifact-missing:' + rel) }
+    if (lstatSync(path).isSymbolicLink()) throw Error('symlink-artifact:' + rel)
+  }
+  return path
+}
+function readJson(path) { return JSON.parse(readFileSync(path, 'utf8')) }
+function writeJson(path, value) {
+  if (existsSync(path) && (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())) throw Error('unsafe-checkpoint')
+  const temporary = path + '.' + randomUUID() + '.tmp'
+  writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' })
+  renameSync(temporary, path)
+}
+function pathsFor(repo, feature, phase) {
+  const prefix = relative(repo, feature).split(sep).join('/')
+  if (!prefix || prefix.startsWith('../')) throw Error('feature-must-be-inside-repo')
+  safePath(repo, prefix, false)
+  const targets = ['00_complexity_assessment.md', '01_requirements.md', '02_research.md', '04_domain_model.md', '05_architecture.md']
+  if (phase === 'qe') targets.push('06_implementation_plan.md', '03.5_ideation_report.md')
+  const adr = safePath(repo, prefix + '/03_adr')
+  if (existsSync(adr) && !lstatSync(adr).isDirectory()) throw Error('adr-not-directory')
+  const decisions = existsSync(adr) ? readdirSync(adr).filter(p => /^[0-9]{3}-.+\.md$/.test(p)).sort() : []
+  if (phase === 'ideation' && !decisions.length) throw Error('adr-missing')
+  const paths = targets.filter(p => existsSync(resolve(feature, p))).concat(decisions.map(p => '03_adr/' + p)).map(p => prefix + '/' + p)
+  for (const required of phase === 'ideation' ? ['01_requirements.md', '05_architecture.md'] : ['01_requirements.md', '06_implementation_plan.md']) if (!paths.includes(prefix + '/' + required)) throw Error('design-input-missing:' + required)
+  if (phase === 'qe') {
+    const plan = readFileSync(safePath(repo, prefix + '/06_implementation_plan.md', false), 'utf8')
+    const block = plan.split(/^EXPECTED_CODE_TARGETS:\s*$/m)
+    if (block.length !== 2) throw Error('target-block-missing-or-duplicate')
+    const planned = block[1].split('\n').filter(line => line.trim()).map(line => {
+      const match = /^- (.+)$/.exec(line)
+      if (!match) throw Error('target-block-malformed')
+      return match[1]
+    })
+    if (!planned.length) throw Error('target-block-empty')
+    if (planned.some(p => /^(features|\.dz|\.agentic-qe|roam)\//.test(p))) throw Error('circular-review-target')
+    paths.push(...planned)
+    // Additions/deletions are discovered by the host, not the author delta request.
+    const baseFile = resolve(feature, '.fa-state/base-ref')
+    const base = existsSync(baseFile) ? readFileSync(baseFile, 'utf8').trim() : 'HEAD'
+    if (!/^[A-Za-z0-9_./:-]+$/.test(base) || base.startsWith('-')) throw Error('base-ref-invalid')
+    for (const command of [['diff', '--name-only', '-z', base, '--'], ['ls-files', '--others', '--exclude-standard', '-z']]) {
+      const names = execFileSync('git', command, { cwd: repo, encoding: 'utf8', maxBuffer: 4 * 1024 * 1024 }).split('\0').filter(Boolean)
+      paths.push(...names.filter(p => !p.startsWith('features/') && !p.startsWith('.dz/') && !p.startsWith('.agentic-qe/') && !p.startsWith('roam/') && p !== 'architecture/map.json'))
+    }
+  }
+  return [...new Set(paths)].sort()
+}
+export function measureManifest(repo, feature, phase) {
+  return pathsFor(repo, feature, phase).map(path => {
+    const absolute = safePath(repo, path)
+    if (!existsSync(absolute)) return { path, digest: null }
+    if (!lstatSync(absolute).isFile()) throw Error('non-file-artifact:' + path)
+    return { path, digest: digest(readFileSync(absolute)) }
+  })
+}
+function checkpointPaths(repo, feature, phase) {
+  const stateRel = relative(repo, feature).split(sep).join('/') + '/.fa-state'
+  const state = safePath(repo, stateRel)
+  mkdirSync(state, { recursive: true })
+  return { host: safePath(repo, stateRel + '/review-convergence-' + phase + '-host.json'), review: safePath(repo, stateRel + '/review-convergence-' + phase + '-review.json') }
+}
+function qeCheckpoint(repo, feature) {
+  const rel = relative(repo, feature).split(sep).join('/') + '/.fa-state/checkpoints.jsonl'
+  const file = safePath(repo, rel)
+  if (!existsSync(file)) return null
+  let checkpoint = null
+  for (const line of readFileSync(file, 'utf8').split('\n').filter(Boolean)) {
+    const item = JSON.parse(line)
+    if (item.stage === 'qe') checkpoint = item.result
+  }
+  return checkpoint ? { checkpointDigest: digest(JSON.stringify(checkpoint)), checkpoint } : null
+}
+function seriousFindings(source) {
+  return (array(source?.gaps) ? source.gaps : []).filter(gap => [gap.sev, gap.severity, gap.priority].some(v => /(?:^|[^A-Z0-9])(BLOCKER|CRITICAL|HIGH|P0|P1)(?:$|[^A-Z0-9])/.test(String(v || '').toUpperCase())))
+}
+function reconcileCheckpoint(host, receipt, measured, repo, feature) {
+  if (!measured) return null
+  const stage = measured.checkpoint
+  for (const [base, source, family, missing] of [
+    ['qe-primary', stage.qe, reviewerFamily(stage), !stage.qe || Boolean(stage.qe?.convergenceUnavailable)],
+    ['qe-precision', stage.qe2, 'claude', host.reviewers.some(r => r.id.startsWith('qe-precision')) && (!stage.qe2 || !stage.qe2.reportWritten)],
+  ]) {
+    const findings = seriousFindings(source)
+    if (!missing && !findings.length) continue
+    const origin = host.reviewers.find(r => (r.id === base || r.id === base + ':' + family) && r.family === family)
+    const review = receipt.reviews.find(r => r.reviewer === origin?.id)
+    const proof = review?.checkpointVerification
+    if (!origin || !checkpointProof(proof) || proof.checkpointDigest !== measured.checkpointDigest || !text(proof.evidence) || proof.supported !== true || !['native', 'mode-b', 'fallback'].includes(proof.route) || !array(proof.findings) || proof.findings.length !== findings.length || !(proof.reportDigest === null || hash(proof.reportDigest))) return null
+    const mapped = new Set()
+    for (const gap of findings) {
+      const item = proof.findings.find(v => v.digest === digest(JSON.stringify(gap)))
+      if (!dictionary(item, ['digest', 'conditionId']) || mapped.has(item.conditionId) || !host.conditions.some(c => c.id === item.conditionId && c.owner === origin.id && ['BLOCKER', 'CRITICAL', 'HIGH'].includes(c.severity)) || !review.verifications.some(v => v.id === item.conditionId && v.revision === host.snapshot.revision && v.implementationVerified === true && v.classification === 'structural')) return null
+      mapped.add(item.conditionId)
+    }
+    if (base === 'qe-precision' && missing) {
+      const file = safePath(repo, relative(repo, feature).split(sep).join('/') + '/08_qe_report.md', false)
+      const report = readFileSync(file)
+      if (digest(report) !== proof.reportDigest || !/## Primary QE pass/.test(report.toString()) || !/## Precision QE pass/.test(report.toString()) || !/Combined Step-8 grade:/.test(report.toString())) return null
+    }
+  }
+  return { ...measured, revision: host.snapshot.revision }
+}
+function retainPendingReceipt(host, path) {
+  if (!host || !existsSync(path)) return host
+  let receipt
+  try { receipt = readJson(path) } catch (_) { throw Error('pending-reviewer-receipt-needs-origin-review') }
+  if (!dictionary(receipt, ['schema', 'phase', 'nonce', 'revision', 'reviews', 'author']) || receipt.schema !== SCHEMA || receipt.phase !== host.phase || !text(receipt.nonce) || !hash(receipt.revision) || !array(receipt.reviews, 16) || !receipt.reviews.length || new Set(receipt.reviews.map(r => r?.reviewer)).size !== receipt.reviews.length) throw Error('pending-reviewer-receipt-needs-origin-review')
+  const owners = host.reviewers.map(r => r.id), preserved = new Map(host.conditions.map(c => [c.id, c]))
+  const fresh = receipt.nonce === host.snapshot.nonce && receipt.revision === host.snapshot.revision
+  let problem = false, witnessed = false
+  for (const r of receipt.reviews) {
+    if (!reviewerEntry(r, host.reviewers) || Object.hasOwn(r, 'checkpointVerification') && !checkpointProof(r.checkpointVerification)) { problem = true; continue }
+    const own = r.conditions.concat(r.newRisks.conditions)
+    if (new Set(own.map(c => c.id)).size !== own.length) { problem = true; continue }
+    witnessed = true
+    for (const c of own) {
+      // Stale evidence may preserve a known condition; it cannot originate new host authority.
+      if (preserved.has(c.id)) { if (!same(preserved.get(c.id), c)) problem = true }
+      else if (!fresh || c.scope.some(path => !host.snapshot.manifest.some(p => p.path === path))) problem = true
+      else if (condition(c, owners) && c.owner === r.reviewer) preserved.set(c.id, c)
+    }
+  }
+  const next = { ...host, conditions: [...preserved.values()], reviewSeen: host.reviewSeen || witnessed }
+  // This imports original independent findings only, never closure, author claims or a grade.
+  return { next, problem }
+}
+function bindReviewers(host, requested, measured) {
+  if (!host) return requested
+  const bound = host.reviewers.map(r => ({ ...r }))
+  for (const actual of requested) {
+    const prior = bound.find(r => r.id === actual.id)
+    if (!prior) throw Error('host-lineage-conflict')
+    if (prior.family === actual.family) continue
+    const originated = host.reviewSeen || host.conditions.some(c => c.owner === prior.id) || measured && (prior.id === 'qe-primary' && reviewerFamily(measured.checkpoint) === prior.family || prior.id === 'qe-precision' && measured.checkpoint.qe2)
+    if (!originated) prior.family = actual.family
+    else if (!bound.some(r => r.id === actual.id + ':' + actual.family)) bound.push({ id: actual.id + ':' + actual.family, family: actual.family })
+  }
+  if (host.reviewers.some(r => !r.id.includes(':') && !requested.some(n => n.id === r.id)) || bound.length > 16) throw Error('host-lineage-conflict')
+  return bound
+}
+export function runGate({ action, repo, feature, phase, reviewers }) {
+  if (!phases.includes(phase) || !['prepare', 'evaluate'].includes(action)) throw Error('invalid-command')
+  repo = realpathSync(repo); feature = resolve(repo, feature)
+  const current = measureManifest(repo, feature, phase)
+  const paths = checkpointPaths(repo, feature, phase)
+  let host = existsSync(paths.host) ? readJson(paths.host) : null
+  const measuredCheckpoint = phase === 'qe' ? qeCheckpoint(repo, feature) : null
+  if (action === 'prepare') {
+    if (!array(reviewers, 16) || !reviewers.length || !reviewers.every(r => dictionary(r, ['id', 'family']) && text(r.id) && ['codex', 'claude', 'owner-exception'].includes(r.family)) || new Set(reviewers.map(r => r.id)).size !== reviewers.length) throw Error('reviewers-invalid')
+    if (host && (host.phase !== phase || host.schema !== SCHEMA || !array(host.conditions) || typeof host.reviewSeen !== 'boolean')) throw Error('host-lineage-conflict')
+    if (host && existsSync(paths.review)) {
+      const pending = retainPendingReceipt(host, paths.review)
+      host = pending.next; writeJson(paths.host, host)
+      if (pending.problem) throw Error('pending-reviewer-receipt-needs-origin-review')
+    }
+    reviewers = bindReviewers(host, reviewers, measuredCheckpoint)
+    const revision = digest(JSON.stringify(current))
+    const snapshot = host?.snapshot?.revision === revision ? host.snapshot : { nonce: randomUUID(), revision, manifest: current }
+    const priorManifest = new Map((host?.snapshot?.manifest || []).map(p => [p.path, p.digest]))
+    const newManifest = new Map(current.map(p => [p.path, p.digest]))
+    const changedPaths = host?.snapshot?.revision === revision ? host.changedPaths : host ? [...new Set([...(host.changedPaths || []), ...[...new Set([...priorManifest.keys(), ...newManifest.keys()])].filter(path => priorManifest.get(path) !== newManifest.get(path))])].sort() : []
+    const next = { schema: SCHEMA, phase, reviewers, snapshot, conditions: host?.conditions || [], reviewSeen: host?.reviewSeen || false, rework: Boolean(host && (host.rework || host.reviewSeen && (host.snapshot.revision !== revision || host.conditions.length > 0))), changedPaths }
+    writeJson(paths.host, next)
+    return { ...result(phase, 'prepared', revision, []), nonce: snapshot.nonce, manifest: current, conditions: next.conditions, reviewers, checkpointDigest: measuredCheckpoint?.checkpointDigest || null }
+  }
+  if (!host) return result(phase, 'not-established', null, ['host-lineage-missing'])
+  if (!existsSync(paths.review)) return result(phase, 'not-established', host.snapshot.revision, ['reviewer-receipt-missing'], host.conditions.map(c => c.id))
+  const receipt = readJson(paths.review)
+  let verdict = evaluateReviewConvergence(host, receipt, current)
+  let closure = null
+  if (phase === 'qe' && verdict.verdict === 'closed' && measuredCheckpoint) {
+    closure = reconcileCheckpoint(host, receipt, measuredCheckpoint, repo, feature)
+    if (!closure) verdict = result(phase, 'not-established', host.snapshot.revision, ['historical-checkpoint-own-verification-missing'])
+  }
+  // Preserve independently owned findings even on refusal. Never import author/scribe claims.
+  // Invalid ownership/meaning refuses without overwriting the prior host authority.
+  const owners = host.reviewers.map(r => r.id)
+  const preserved = new Map(host.conditions.map(c => [c.id, c]))
+  if (receipt?.schema === SCHEMA && receipt.phase === phase && array(receipt.reviews)) {
+    for (const r of receipt.reviews) if (owners.includes(r?.reviewer) && host.reviewers.find(p => p.id === r.reviewer)?.family === r.family && r.independent === true) {
+      for (const c of [...(array(r.conditions) ? r.conditions : []), ...(array(r.newRisks?.conditions) ? r.newRisks.conditions : [])]) {
+        if (condition(c, owners) && c.owner === r.reviewer && !preserved.has(c.id)) preserved.set(c.id, c)
+      }
+    }
+  }
+  if (receipt?.phase === phase && receipt.nonce === host.snapshot.nonce && receipt.revision === host.snapshot.revision && risks(receipt.author?.newRisks, owners)) {
+    for (const c of receipt.author.newRisks.conditions) if (!preserved.has(c.id)) preserved.set(c.id, c)
+  }
+  writeJson(paths.host, { ...host, conditions: [...preserved.values()], reviewSeen: true, changedPaths: verdict.verdict === 'closed' ? [] : host.changedPaths })
+  if (closure && verdict.verdict === 'closed') return { ...verdict, checkpointClosure: closure }
+  return verdict
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  let phase = 'qe'
+  try {
+    const args = process.argv.slice(2)
+    const action = args.shift()
+    const options = {}
+    while (args.length) {
+      const key = args.shift()
+      if (!['--repo', '--feature', '--phase', '--reviewers'].includes(key) || !args.length || Object.hasOwn(options, key)) throw Error('invalid-arguments')
+      options[key] = args.shift()
+    }
+    phase = options['--phase']
+    if (!options['--repo'] || !options['--feature'] || !phases.includes(phase)) throw Error('invalid-arguments')
+    const output = runGate({ action, repo: options['--repo'], feature: options['--feature'], phase, reviewers: options['--reviewers'] ? JSON.parse(options['--reviewers']) : undefined })
+    process.stdout.write(JSON.stringify(output) + '\n')
+    process.exitCode = ['closed', 'prepared'].includes(output.verdict) ? 0 : output.verdict === 'unresolved' ? 1 : 3
+  } catch (error) {
+    process.stdout.write(JSON.stringify(result(phases.includes(phase) ? phase : 'qe', 'not-established', null, [String(error.message)])) + '\n')
+    process.exitCode = 3
+  }
+}

package/templates/.claude/workflows/feature-adr.js

@@ -3597,6 +3597,67 @@ function parseCoderContextEnvelope(raw, tier) {
   return value
 }
 
+// Review convergence host contract BEGIN. No Node imports in the Workflow sandbox.
+const REVIEW_CONVERGENCE_SCHEMA = 'fa-review-convergence-1'
+function reviewConvergenceCommand(action, reviewPhase, reviewers) {
+  const script = '.claude/skills/feature-adr/scripts/check-review-convergence.mjs'
+  const q = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'"
+  const flags = ' ' + q(action) + ' --repo ' + q(REPO) + ' --feature ' + q(FDIR) + ' --phase ' + q(reviewPhase) + (action === 'prepare' ? ' --reviewers ' + q(JSON.stringify(reviewers)) : '')
+  return [
+    'RC_WORKSPACE=' + (WS ? q(WS) : '$(pwd -P)') + "; RC_SCRIPT=''",
+    'for c in "$RC_WORKSPACE/' + script + '" ' + q(REPO + '/' + script) + '; do [ -f "$c" ] && { RC_SCRIPT="$c"; break; }; done',
+    'if [ -n "$RC_SCRIPT" ]; then node "$RC_SCRIPT"' + flags + '; RC_STATUS=$?; else printf \'%s\\n\' ' + q(JSON.stringify({ schema: REVIEW_CONVERGENCE_SCHEMA, phase: reviewPhase, verdict: 'not-established', revision: null, unresolved: [], reasons: ['installed-helper-missing'] })) + '; RC_STATUS=3; fi',
+    'printf \'RC_EXIT=%s\\n\' "$RC_STATUS"',
+  ].join('\n')
+}
+function parseReviewConvergenceRelay(raw, reviewPhase, action) {
+  const failed = (reason) => ({ schema: REVIEW_CONVERGENCE_SCHEMA, phase: reviewPhase, verdict: 'not-established', revision: null, unresolved: [], reasons: [reason] })
+  if (typeof raw !== 'string' || raw.length > 2 * 1024 * 1024) return failed('relay-invalid')
+  const match = /^([^\r\n]+)\r?\nRC_EXIT=(0|1|3)\r?\n?$/.exec(raw)
+  if (!match) return failed('relay-not-exact-stdout')
+  let v
+  try { v = JSON.parse(match[1]) } catch (_) { return failed('relay-invalid-json') }
+  const keys = action === 'prepare' && v && v.verdict === 'prepared' ? ['schema', 'phase', 'verdict', 'revision', 'unresolved', 'reasons', 'nonce', 'manifest', 'conditions', 'reviewers', 'checkpointDigest'] : ['schema', 'phase', 'verdict', 'revision', 'unresolved', 'reasons']
+  if (action === 'evaluate' && v && Object.prototype.hasOwnProperty.call(v, 'checkpointClosure')) keys.push('checkpointClosure')
+  if (!v || typeof v !== 'object' || Array.isArray(v) || Object.keys(v).length !== keys.length || Object.keys(v).some(k => keys.indexOf(k) === -1) || v.schema !== REVIEW_CONVERGENCE_SCHEMA || v.phase !== reviewPhase || !Array.isArray(v.unresolved) || !v.unresolved.every(s => typeof s === 'string') || !Array.isArray(v.reasons) || !v.reasons.every(s => typeof s === 'string') || !(v.revision === null || typeof v.revision === 'string' && /^[a-f0-9]{64}$/.test(v.revision))) return failed('relay-invalid-envelope')
+  const expected = v.verdict === 'closed' || v.verdict === 'prepared' ? '0' : v.verdict === 'unresolved' ? '1' : v.verdict === 'not-established' ? '3' : null
+  if (expected === null || match[2] !== expected || action === 'evaluate' && v.verdict === 'prepared' || action === 'prepare' && v.verdict === 'closed') return failed('relay-verdict-exit-conflict')
+  if ((v.verdict === 'closed' || v.verdict === 'prepared') && (!v.revision || v.reasons.length || v.unresolved.length)) return failed('relay-contradictory-success')
+  if (v.verdict === 'prepared' && (typeof v.nonce !== 'string' || !v.nonce || !Array.isArray(v.manifest) || !Array.isArray(v.conditions) || !Array.isArray(v.reviewers) || !(v.checkpointDigest === null || typeof v.checkpointDigest === 'string' && /^[a-f0-9]{64}$/.test(v.checkpointDigest)))) return failed('relay-invalid-snapshot')
+  if (v.checkpointClosure && (v.verdict !== 'closed' || Object.keys(v.checkpointClosure).sort().join(',') !== 'checkpoint,checkpointDigest,revision' || v.checkpointClosure.revision !== v.revision || typeof v.checkpointClosure.checkpointDigest !== 'string' || !/^[a-f0-9]{64}$/.test(v.checkpointClosure.checkpointDigest) || !v.checkpointClosure.checkpoint || typeof v.checkpointClosure.checkpoint !== 'object')) return failed('relay-invalid-checkpoint-closure')
+  return v
+}
+async function reviewConvergenceGate(action, reviewPhase, reviewers) {
+  const command = reviewConvergenceCommand(action, reviewPhase, reviewers)
+  const raw = await dispatchAgent(newRung(), 'Run EXACTLY this via Bash. Return ONLY its stdout, including RC_EXIT, with no fences, narration, or synthesized result:\n' + command, { label: 'review-convergence:' + reviewPhase + ':' + action, phase: reviewPhase === 'ideation' ? 'Design' : 'QE', effort: 'low' })
+  return parseReviewConvergenceRelay(raw, reviewPhase, action)
+}
+function reviewConvergencePrompt(reviewPhase, reviewerId, family, prepared) {
+  if (prepared && Array.isArray(prepared.reviewers)) {
+    const actual = prepared.reviewers.find(r => r.id === reviewerId && r.family === family) || prepared.reviewers.find(r => r.id === reviewerId + ':' + family && r.family === family)
+    if (actual) reviewerId = actual.id
+  }
+  const identity = reviewerId === 'qcsd' ? 'Coordinate the actual qcsd-quality, qcsd-risk, qcsd-testability independent reviewers; each must write and verify only its own entry. The coordinator cannot manufacture their receipts from grades or report prose. Use the host role for each base id with actual family ' + family + ' (a retained other-family owner remains a separate required reviewer)'  : 'Your originating independent role is ' + reviewerId + ', actual family ' + family
+  return ' REVIEW CONVERGENCE: read ' + FDIR + '/.fa-state/review-convergence-' + reviewPhase + '-host.json and the installed feature-adr module receipt contract. ' + identity + '. Preserve every prior own condition with identical meaning/ID and every serious finding. Review the complete measured manifest at its revision/nonce; if any required input is missing or moving, report not-established rather than inventing approval. Write your own structured review entry into ' + FDIR + '/.fa-state/review-convergence-' + reviewPhase + '-review.json, preserving other reviewer entries and the actual author handoff. Never infer closure from grade. Each entry must contain reviewer, family, independent:true, verdict, conditions, verifications, explicit newRisks assessment/evidence/conditions, authorAssessmentChecked, and deltaVerification (null on initial review; independent classification/evidence/implementationVerified on rework). If your agent/transport fails after writing, your existing own entry remains original evidence: the host imports it before any family transition. Only verify your own conditions at the current revision; structural changes require implementation/test verification. The host gate will refuse missing/stale evidence. If a host snapshot is unavailable, preserve provisional findings in the ordinary report and name the repair. Do not call prepare or edit host lineage.'
+}
+function reviewConvergenceRefusal(reviewPhase, verdict, evidence) {
+  return { phase: 'review-convergence-' + reviewPhase, outcome: 'unverified', slug: SLUG, artifactsDir: FDIR, convergence: verdict, reviewerEvidence: evidence || null, note: 'Review closure is ' + verdict.verdict + ': ' + verdict.reasons.join(', ') + '. Host-driven repair: settle current artifacts; invoke the installed check-review-convergence.mjs prepare --repo <repo> --feature <feature-dir> --phase ' + reviewPhase + ' --reviewers <the selected actual base-role families JSON; host retains originated owner roles>; provide an author delta/addressed IDs/evidence/explicit new-risk assessment; have each originating independent reviewer verify its own conditions and actual structural/wording delta at the host revision/nonce, writing the reviewer receipt named in the Step ' + (reviewPhase === 'ideation' ? '3.5' : '8') + ' module; run evaluate with the same repo/feature/phase; re-invoke the same slug. Prior conditions stay in the host checkpoint. pending-reviewer-receipt-needs-origin-review pauses before fallback dispatch: keep the original receipt, have its originating reviewer repair malformed/foreign fields or refresh unknown stale findings at the unchanged host identity/current snapshot, then repeat prepare for the selected actual family. Valid partial own entries are retained without claiming closure; complete the full returned roster and own verifications before evaluate. Do not delete or replace original evidence to bootstrap. For same-slug QE resume, read prepare checkpointDigest and the complete latest qe result in .fa-state/checkpoints.jsonl. Each originating reviewer must additionally write checkpointVerification with that digest, supported:true, route native/mode-b/fallback, independent evidence, findings mapping every original serious gap SHA-256(JSON.stringify(gap)) to its own preserved conditionId, and reportDigest (null except a failed precision append requires SHA-256 of the current complete 08_qe_report.md). Own current structural verifications are required for every mapped finding. The gate binds the complete old checkpoint and current manifest; resume retains historical gaps/grade. A scribe or author cannot produce this reviewer proof. Outstanding serious risks at the round ceiling require owner escalation. No automatic repair loop ran.' }
+}
+function currentSeriousReviewFindings(stage) {
+  const serious = []
+  for (const source of [stage && stage.qe, stage && stage.qe2]) {
+    for (const gap of source && Array.isArray(source.gaps) ? source.gaps : []) {
+      const seriousSeverity = [gap.sev, gap.severity, gap.priority].some(value => /(?:^|[^A-Z0-9])(BLOCKER|CRITICAL|HIGH|P0|P1)(?:$|[^A-Z0-9])/.test(String(value || '').toUpperCase()))
+      if (seriousSeverity) serious.push(gap)
+    }
+  }
+  return serious
+}
+function historicalReviewClosure(verdict, stage) {
+  return resumedStages.indexOf('qe') !== -1 && verdict.checkpointClosure && verdict.checkpointClosure.revision === verdict.revision && JSON.stringify(verdict.checkpointClosure.checkpoint) === JSON.stringify(stage)
+}
+// Review convergence host contract END.
+
 // ── K2 plan-completeness gate (feature fa-plan-gate-wiring) ────────────────────────────────────
 // The coder (Step-7) must NOT start on an incomplete plan. Mirrors of the pure halves in
 // harness-core/src/feature-adr-routing.ts (planCompletenessGateCmd / parsePlanGateVerdict) —
@@ -3938,6 +3999,12 @@ function setDesignProvenance(baseLabel, label) {
 }
 
 async function designStage(promptText, opts, artifactPath, baseLabel) {
+  const convergenceBasePrompt = promptText
+  if (baseLabel === 'qcsd') {
+    const initialConvergence = await reviewConvergenceGate('prepare', 'ideation', ['qcsd-quality', 'qcsd-risk', 'qcsd-testability'].map(id => ({ id: id, family: tpFamily(modelLabel(opts)) })))
+    if (initialConvergence.verdict !== 'prepared') return reviewConvergenceRefusal('ideation', initialConvergence, null)
+    promptText += reviewConvergencePrompt('ideation', 'qcsd', tpFamily(modelLabel(opts)))
+  }
   if (!needsLandedBarrier(opts)) { return await dispatchAgent(newRung(), promptText, opts) }
   const codexOpts = {}
   for (const k in opts) if (k !== 'schema') codexOpts[k] = opts[k]
@@ -3964,8 +4031,14 @@ async function designStage(promptText, opts, artifactPath, baseLabel) {
   // separate sentence, unchanged), but the LINE's reason now comes from the rung's three-valued
   // outcome so no branch here can silently re-flatten it back to "the previous rung ran".
   const designRung = designProbeFailed ? { state: 'probe-failed', reason: null } : designRungHolder
+  // Review convergence design fallback boundary BEGIN.
+  if (baseLabel === 'qcsd') {
+    const fallbackConvergence = await reviewConvergenceGate('prepare', 'ideation', ['qcsd-quality', 'qcsd-risk', 'qcsd-testability'].map(id => ({ id: id, family: 'claude' })))
+    if (fallbackConvergence.verdict !== 'prepared') return reviewConvergenceRefusal('ideation', fallbackConvergence, null)
+  }
   setDesignProvenance(baseLabel, modelLabel(fallbackOpts) + codexFallbackProvenance(designRung, 'codex not-landed', false))
-  const fb = await dispatchAgent(newRung(), promptText, mergeOpts({ label: stageLabel((baseLabel || 'design') + ':claude-fb', fallbackOpts), phase: 'Design', schema: ARTIFACT }, fallbackOpts), mergeOpts(fallbackOpts, { _stage: opts._stage, _reason: 'fallback-rung' }))
+  const fb = await dispatchAgent(newRung(), convergenceBasePrompt + (baseLabel === 'qcsd' ? reviewConvergencePrompt('ideation', 'qcsd', 'claude') : ''), mergeOpts({ label: stageLabel((baseLabel || 'design') + ':claude-fb', fallbackOpts), phase: 'Design', schema: ARTIFACT }, fallbackOpts), mergeOpts(fallbackOpts, { _stage: opts._stage, _reason: 'fallback-rung' }))
+  // Review convergence design fallback boundary END.
   // d926ee89: the fallback used to keep CODEX provenance — modelsUsed, the checkpoint label and the
   // training-pair family all still said codex after Claude wrote the artifact. The WRITER is the
   // provenance; overwrite it here, at the one place that knows the fallback fired.
@@ -4670,6 +4743,14 @@ if (registryOutcome !== 'unverified') registryOutcome = designIncompleteOutcome
   return { tier: tier, phase: 'design-incomplete', outcome: designIncompleteOutcome, slug: SLUG, artifactsDir: FDIR, missingSubstages: fanVerdict.missingSubstages, missingArtifacts: fanVerdict.missingArtifacts, reason: fanVerdict.reason, modelsUsed: modelsUsed, dispatchOutcomes: dispatchOutcomes, gates: designIncompleteGates, resumedStages: resumedStages, checkpointing: CHECKPOINTS_ON ? RESUME_MODE : 'off', trainingPairs: CAPTURE_PAIRS ? TP_DIR : 'off', captureFailures: captureFailures, recordFailures: recordFailures, decisionRecallFailures: decisionRecallFailures, usageEvents: usageEvents, usageThreshold: USAGE_THRESHOLD, polymorphism: POLY.hasManifest ? POLY.report : null, note: 'REFUSED at the Step-5/6 boundary: ' + what + ', so the design is incomplete and Step 6 was NOT dispatched. Planning off a partial design produces a plan with no ADR behind it. ' + repair + ' If a sibling died on a Claude limit, add usage-adaptive routing or route that stage to Codex first (args.models). To rebuild the whole design from scratch instead, re-invoke with args.resume=\'never\'.' }
 }
 
+// Review convergence ideation boundary BEGIN.
+let ideationConvergence = null
+if (isMplus) {
+  ideationConvergence = await reviewConvergenceGate('evaluate', 'ideation')
+  if (ideationConvergence.verdict !== 'closed') return reviewConvergenceRefusal('ideation', ideationConvergence, design)
+}
+// Review convergence ideation boundary END.
+
 // Step 6: Plan — optionally routed to Codex's top model (opt-in via args.planner='codex').
 // The user opts in at pre-flight ('use the top Codex model for planning?'); we route the Plan step to
 // the codex:codex-rescue runtime and GRACEFULLY FALL BACK to the default (Claude) planner if Codex is
@@ -5438,6 +5519,9 @@ const qe2Spec = qePrecisionPassSpec(PRIMARY, BUDGET_MODE, tier)
 // isolated-scope one, or vice versa) instead of re-QEing under the new setting.
 const qeHash = ckptHash('qe', [fnv1a64(JSON.stringify(codeStage === undefined ? null : codeStage)), tier, DESC, QE_REVIEWER, MODELS.qe === undefined ? null : MODELS.qe, CODEX_MODEL, coderUsed, PRIMARY, BUDGET_MODE, qe2Spec, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, QE_SCOPE, QE_SCOPE_REF, confirmationFileGate, QE_ISOLATED_SCOPE])
 let crossFamilyQeReport = null
+const qeConvergenceReviewers = [{ id: 'qe-primary', family: tpFamily(modelLabel(qeModel)) }]
+if (qe2Spec) qeConvergenceReviewers.push({ id: 'qe-precision', family: 'claude' })
+let qeConvergencePrepared = await reviewConvergenceGate('prepare', 'qe', qeConvergenceReviewers)
 const qeStage = await withCheckpoint('qe', 'QE', qeHash, async () => {
 let qe = null
 let qeReviewerUsed = 'claude'
@@ -5456,13 +5540,17 @@ if (!qeIsCodex) {
   // entry that does not say which family reviewed, and it correctly rejected the first shape of this
   // fix. The SAME verdict object then serves the success branch, so there is still one call here.
   const cfCl = crossFamilyQe({ requestedSpec: modelLabel(qeModel), actualLabel: modelLabel(qeClaudeOpts), coderFamily: tpFamily(coderUsed), reviewerFamily: 'claude', declineReason: null })
+  qeConvergencePrepared = await reviewConvergenceGate('prepare', 'qe', [{ id: 'qe-primary', family: 'claude' }].concat(qe2Spec ? [{ id: 'qe-precision', family: 'claude' }] : []))
+  if (qeConvergencePrepared.verdict !== 'prepared') return reviewConvergenceRefusal('qe', qeConvergencePrepared, qe)
   modelsUsed.qe = cfCl.label
-  qe = await dispatchAgent(newRung(), qePrompt, qeClaudeOpts)
+  qe = await dispatchAgent(newRung(), qePrompt + reviewConvergencePrompt('qe', 'qe-primary', 'claude', qeConvergencePrepared), qeClaudeOpts)
   if (qe) { qeReviewerUsed = 'claude'; crossFamilyQeReport = cfCl.report }
   else modelsUsed.qe = cfCl.label + ' (no deliverable)'
 }
 if (qe === null && !qeIsCodex) reactiveBelt('QE')
 if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
+  qeConvergencePrepared = await reviewConvergenceGate('prepare', 'qe', [{ id: 'qe-primary', family: 'codex' }].concat(qe2Spec ? [{ id: 'qe-precision', family: 'claude' }] : []))
+  if (qeConvergencePrepared.verdict !== 'prepared') return reviewConvergenceRefusal('qe', qeConvergencePrepared, qe)
   if (QE_REVIEWER === 'codex-fallback' && !qeIsCodex) log('QE: Claude unavailable (limit?) — falling back to Codex ' + CODEX_MODEL)
   // R5-2: reaching this branch with !qeIsCodex means the cross-family rule had routed QE to Claude
   // and that FIRST rung returned null. This dispatch is therefore a fallback AND — with a codex coder
@@ -5663,7 +5751,7 @@ if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
       const modeBRungHolder = newRung()
       qeLastRungHolder = modeBRungHolder
       const modeBLabelOpts = mergeOpts(qeCodexLabelOpts, { _reason: 'fallback-rung' })
-      codexQe = await codexExecAgent('qe', modeBPrompt + CODEX_HINT + codexEffortHint(modeBLabelOpts), 'QE', true, modeBFiles, modeBLabelOpts, modeBRungHolder)
+      codexQe = await codexExecAgent('qe', modeBPrompt + reviewConvergencePrompt('qe', 'qe-primary', 'codex', qeConvergencePrepared) + CODEX_HINT + codexEffortHint(modeBLabelOpts), 'QE', true, modeBFiles, modeBLabelOpts, modeBRungHolder)
       if (codexQe === null) lastCodexDecline = 'mode A: ' + String(modeADecline) + ' | mode B: ' + String(lastCodexDecline)
     }
   }
@@ -5672,6 +5760,7 @@ if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
     // STATED by the reviewer or DERIVED from its findings, because mode A cannot be asked for one.
     qe = enforceConfirmationFileGate({ grade: codexQe.grade, gaps: codexQe.findings, codeTestsAdequate: null, docTestsPresent: null, summary: String(codexQe.text).slice(0, 1500), gradeSource: codexQe.gradeSource, qeScope: { mode: codexQe.mode, ref: codexQe.scopeRef, files: codexQe.files } }, confirmationFileGate)
     qeReviewerUsed = qeIsCodex ? 'codex' : 'codex-fallback'
+    if (codexQe.mode === 'A') qe = mergeOpts(qe, { convergenceUnavailable: 'read-only Codex mode A cannot accept the reviewer contract; host-driven supported review required' })
     log('QE: cross-family review by codex, mode ' + codexQe.mode + ' (scope ' + codexQe.scopeRef + ', grade ' + codexQe.grade + ' ' + codexQe.gradeSource + ', ' + codexQe.elapsedSeconds + 's)')
     // ARTIFACT SCRIBE. The old dispatch handed Codex the whole Step-8 prompt, so the reviewer itself
     // was asked to write 08_qe_report.md and close the teach loop. Neither mode can be asked that
@@ -5735,8 +5824,10 @@ if (qe === null && qeIsCodex) {
   // belt that returned null left the preceding Codex label standing and omitted the Claude dispatch
   // that had just been announced. The same verdict object still serves the success branch.
   const cfBelt = crossFamilyQe({ requestedSpec: modelLabel(qeModel), actualLabel: modelLabel(qeBeltOpts), coderFamily: tpFamily(coderUsed), reviewerFamily: 'claude', declineReason: lastCodexDecline })
+  qeConvergencePrepared = await reviewConvergenceGate('prepare', 'qe', [{ id: 'qe-primary', family: 'claude' }].concat(qe2Spec ? [{ id: 'qe-precision', family: 'claude' }] : []))
+  if (qeConvergencePrepared.verdict !== 'prepared') return reviewConvergenceRefusal('qe', qeConvergencePrepared, qe)
   modelsUsed.qe = cfBelt.label
-  qe = await dispatchAgent(newRung(), qePrompt, qeBeltOpts)
+  qe = await dispatchAgent(newRung(), qePrompt + reviewConvergencePrompt('qe', 'qe-primary', 'claude', qeConvergencePrepared), qeBeltOpts)
   if (qe) { qeReviewerUsed = 'claude'; crossFamilyQeReport = cfBelt.report }
   else modelsUsed.qe = cfBelt.label + ' (no deliverable)'
 }
@@ -5745,6 +5836,8 @@ qe = enforceConfirmationFileGate(qe, confirmationFileGate)
 // independent precision pass. It is advisory but real — never a table-only half-wire — and its
 // provenance stays separate in both the return object and 08_qe_report.md.
 let qe2 = null
+// Record the primary's conditions before the precision reviewer can append its receipt.
+await reviewConvergenceGate('evaluate', 'qe')
 if (qe !== null && qe2Spec !== null) {
   const qe2Model = specToOpts(qe2Spec)
   const primaryGrade = String(qe.grade || '').trim().toUpperCase()
@@ -5764,7 +5857,7 @@ if (qe !== null && qe2Spec !== null) {
   // R13-2: claimed at DISPATCH. The run completes on the primary verdict even when this reviewer
   // returns null, so a success-only write let the report silently omit a reviewer it had announced.
   modelsUsed.qe2 = modelLabel(qe2Model)
-  qe2 = await dispatchAgent(newRung(), qe2Prompt, qe2Opts)
+  qe2 = await dispatchAgent(newRung(), qe2Prompt + reviewConvergencePrompt('qe', 'qe-precision', 'claude'), qe2Opts)
   if (!qe2) modelsUsed.qe2 = modelLabel(qe2Model) + ' (no deliverable)'
   if (qe2) {
     const qe2After = await qe2ReportState('qe:precision-after')
@@ -5791,6 +5884,20 @@ return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe, qe2:
 }, { validate: function (r) { return !!(r && typeof r === 'object' && r.qe && typeof r.qe === 'object' && typeof r.qeReviewerUsed === 'string' && (r.bridge == null || (typeof r.bridge === 'object' && !Array.isArray(r.bridge)))) } })
 qe = qeStage ? qeStage.qe : null
 let qeReviewerUsed = qeStage ? qeStage.qeReviewerUsed : 'claude'
+// Review convergence QE boundary BEGIN. Runs for live and resumed checkpoints.
+let qeConvergence = null
+{
+  qeConvergence = await reviewConvergenceGate('evaluate', 'qe')
+  const serious = currentSeriousReviewFindings(qeStage)
+  const historicalClosure = historicalReviewClosure(qeConvergence, qeStage)
+  const confirmationClosed = confirmationFileGate && (confirmationFileGate.verdict === 'pass' || confirmationFileGate.verdict === 'skipped')
+  const routeMissing = !qeStage || !qe || qe.convergenceUnavailable || (qe2Spec && (!qeStage.qe2 || !qeStage.qe2.reportWritten))
+  if (qeConvergencePrepared.verdict !== 'prepared' || qeConvergence.verdict !== 'closed' || !confirmationClosed || (!historicalClosure && (routeMissing || serious.length > 0))) {
+    const reasons = qeConvergence.reasons.concat(routeMissing ? [String(qe && qe.convergenceUnavailable || 'reviewer-route-or-precision-evidence-not-established')] : [], serious.length ? ['current-serious-review-findings-remain'] : [], qeConvergencePrepared.verdict !== 'prepared' ? qeConvergencePrepared.reasons : [], !confirmationClosed ? ['confirmation-file-gate-not-closed'] : [])
+    return reviewConvergenceRefusal('qe', Object.assign({}, qeConvergence, { verdict: serious.length ? 'unresolved' : 'not-established', reasons: reasons }), qeStage)
+  }
+}
+// Review convergence QE boundary END.
 if (qeStage && qeStage.modelUsed) modelsUsed.qe = qeStage.modelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
 if (qeStage && qeStage.qe2ModelUsed) modelsUsed.qe2 = qeStage.qe2ModelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
 if (qeStage && qeStage.bridge == null && resumedStages.indexOf('qe') !== -1) {
@@ -6183,6 +6290,15 @@ function runOutcomeOf(input) {
   // A crashed run cannot classify itself; an external consumer assigns that outcome later.
   return 'unclassified'
 }
+// Review convergence completion boundary BEGIN.
+{
+  const terminalConvergence = await reviewConvergenceGate('evaluate', 'qe')
+  const terminalHistorical = historicalReviewClosure(terminalConvergence, qeStage)
+  const terminalRouteMissing = !qeStage || !qe || qe.convergenceUnavailable || (qe2Spec && (!qeStage.qe2 || !qeStage.qe2.reportWritten))
+  const terminalConfirmation = confirmationFileGate && (confirmationFileGate.verdict === 'pass' || confirmationFileGate.verdict === 'skipped')
+  if (terminalConvergence.verdict !== 'closed' || !terminalConfirmation || (!terminalHistorical && (terminalRouteMissing || currentSeriousReviewFindings(qeStage).length > 0))) return reviewConvergenceRefusal('qe', Object.assign({}, terminalConvergence, { verdict: 'not-established', reasons: terminalConvergence.reasons.concat(!terminalConfirmation ? ['confirmation-file-gate-not-closed'] : [], !terminalHistorical && terminalRouteMissing ? ['terminal-reviewer-route-not-established'] : [], !terminalHistorical && currentSeriousReviewFindings(qeStage).length > 0 ? ['terminal-serious-findings-remain'] : []) }), qeStage)
+}
+// Review convergence completion boundary END.
 const designEvidence = Array.isArray(design) && design.filter(Boolean).length > 0
 const implementedEvidence = code !== null && code !== undefined && (needsCodeLandedBarrier(coderUsed) ? landingStatus === 'landed' : true)
 const tags = [