@dzhechkov/skills-feature-adr 1.5.7 → 1.5.8

package/.dz-manifest.json

@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "4ab808507be5c64cfa7b74ef3c186145d0654cd9c2fad86229685edaac6edb10"
+        "sha256": "dc985b443d8ac9d4091b09367330f7f610c35572d99f635855989fd893c5e6ac"
       },
       {
         "path": "bin/cli.js",
@@ -25,7 +25,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "1efad8edf817286284ef35578e3b5046205350603b7e9cb9b979993a69f85c8a"
+        "sha256": "d57357d1feb9f111d0674f1c307a4d15a41cb005074351d37ebaf7dc1afe3575"
       },
       {
         "path": "src/cli.js",
@@ -313,7 +313,7 @@
       },
       {
         "path": "templates/.claude/workflows/feature-adr.js",
-        "sha256": "f5454faf9cca12a3cbef5444a3fe586823bfe2a164ab391c9589ed206a0b9b9f"
+        "sha256": "f287a73bdf8c11c99eedbc071c6babb3201a6cec7d644d65f20ece3cd4ca51c1"
       },
       {
         "path": "templates/lib/memory-protocol.md",
@@ -325,5 +325,5 @@
       }
     ]
   },
-  "signature": "iuNdrUAvCEsJrxokWl6qDVTsiQJb9/v+oSUREgL2dkMEEzslnKnzYH144Cxg/qxpNZqocyHqvsH2A8I1Eu2wCQ=="
+  "signature": "t3rY38fu7zb8GjsIjG0OOeqtw04W4nlzawE//PhPKbHbtLUMgT/1SOaXFUWEyjQvNTb13dCJXrHggR0yf/5RBA=="
 }

package/README.md

@@ -169,7 +169,7 @@ refused BY NAME: `path traversal ('..' segment)`, `degenerate path segment`, `em
 `illegal character '<c>'`, `empty stem after the leading dot`. The old substring traversal test also
 rejected the ordinary filename `foo..bar.ts`; it is a segment test now.
 
-### The Step-8 amendment gate runs a command instead of judging (v1.5.7)
+### The Step-8 amendment gate runs a command instead of judging (v1.5.8)
 
 Every `AM-N` row must resolve to a test found INSIDE the file the row names, and the check is
 `dz amendment-check --slug <slug> --json` rather than a paragraph asking the reviewer to confirm it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.5.7",
+  "version": "1.5.8",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"
@@ -42,12 +42,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/djd1m/dz-harness-hub.git",
+    "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/skills-feature-adr"
   },
-  "homepage": "https://github.com/djd1m/dz-skill-bundles/blob/main/docs/feature-adr-team-onboarding.md",
+  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/skills-feature-adr#readme",
   "bugs": {
-    "url": "https://github.com/djd1m/dz-skill-bundles/issues"
+    "url": "https://github.com/djd1m/dz-harness/issues"
   },
   "peerDependencies": {
     "@dzhechkov/keysarium-core": "^1.0.0"

package/sbom.json

@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4ab808507be5c64cfa7b74ef3c186145d0654cd9c2fad86229685edaac6edb10"
+          "content": "dc985b443d8ac9d4091b09367330f7f610c35572d99f635855989fd893c5e6ac"
         }
       ]
     },
@@ -69,7 +69,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "1efad8edf817286284ef35578e3b5046205350603b7e9cb9b979993a69f85c8a"
+          "value": "d57357d1feb9f111d0674f1c307a4d15a41cb005074351d37ebaf7dc1afe3575"
         }
       ]
     },
@@ -789,7 +789,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f5454faf9cca12a3cbef5444a3fe586823bfe2a164ab391c9589ed206a0b9b9f"
+          "content": "f287a73bdf8c11c99eedbc071c6babb3201a6cec7d644d65f20ece3cd4ca51c1"
         }
       ]
     },

package/templates/.claude/workflows/feature-adr.js

@@ -184,7 +184,7 @@ const CKPT_FILE = FDIR + '/.fa-state/checkpoints.jsonl'
 // M10 Stage-A, feature loop-designer). This region is now a GENERATED BLOB (regen-diff-gated by
 // loop-blobs-regen.test.ts): edit the canonical TS FIRST, run node scripts/gen-loop-blobs.mjs,
 // then re-splice. The value-pinned wiring tests in feature-adr-checkpoints.test.ts stay the net.
-// ── BEGIN BLOB checkpoints@1.1.0 sha256:a44560c6036fd143b7a3f125fec00fa8b91c3c06ac5b9e1ecfb83d27a5211e9b src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
+// ── BEGIN BLOB checkpoints@1.2.0 sha256:a44560c6036fd143b7a3f125fec00fa8b91c3c06ac5b9e1ecfb83d27a5211e9b src=packages/@dzhechkov/harness-core/src/feature-adr-checkpoints.ts ──
 const CHECKPOINT_STAGES = ['router', 'design', 'plan', 'code', 'qe', 'fleet'];
 const STAGE_ARTIFACTS = {
     router: '00_complexity_assessment.md',
@@ -347,7 +347,7 @@ function parseArtifactProbe(opts) {
         return null;
     return found;
 }
-// ── END BLOB checkpoints@1.1.0 ──
+// ── END BLOB checkpoints@1.2.0 ──
 // glue (workflow-owned, hand-reviewed): legacy mirror names → the blob exports. The hash
 // composition is UNCHANGED (same CKPT_SCHEMA_VERSION salt + JSON-tuple), so recorded
 // checkpoints from pre-wrap runs still resume.
@@ -463,7 +463,7 @@ async function withCheckpoint(stage, phaseName, inputHash, runFn, ckptOpts) {
 // via the reqe-proven sed idiom (the sandbox forbids Date; the pure half takes ts as a parameter).
 const CAPTURE_PAIRS = A.captureTrainingPairs !== false
 const captureFailures = []
-const TP_SCHEMA = 'fa-trainpair-2'
+const TP_SCHEMA = 'fa-trainpair-3'
 const TP_MAX_IO = 48000
 const TP_DIR = REPO + '/.dz/fa-training/' + SLUG
 const TP_MARK_DIR = REPO + '/.dz/fa-training/.backfill-marks'
@@ -505,6 +505,26 @@ function captureFailureRecord(stage, mode, reason, detail) {
 }
 function tpFamily(spec) { return /codex|gpt|openai/i.test(String(spec == null ? '' : spec)) ? 'codex' : 'claude' }
 function tpText(v) { if (typeof v === 'string') return v; if (v === null || v === undefined) return ''; try { const s = JSON.stringify(v); return typeof s === 'string' ? s : String(v) } catch (e) { return String(v) } }
+function tpBudget(raw) {
+  try {
+    if (raw === undefined) return { primary: 'claude', claude: 'normal', codex: 'normal', preset: 'unset' }
+    if (raw === null || typeof raw !== 'object') return null
+    const primary = raw.primary
+    const claude = raw.claude
+    const codex = raw.codex
+    if (primary !== 'claude' && primary !== 'codex') return null
+    if (claude !== 'normal' && claude !== 'eco') return null
+    if (codex !== 'normal' && codex !== 'eco') return null
+    if (raw.preset === 'unset') return { primary: primary, claude: claude, codex: codex, preset: 'unset' }
+    let preset = 'custom'
+    if (claude === 'normal' && codex === 'normal') preset = 'normal'
+    else if (claude === 'eco' && codex === 'eco') preset = 'eco'
+    else if (claude === 'eco' && codex === 'normal') preset = 'hybrid'
+    return { primary: primary, claude: claude, codex: codex, preset: preset }
+  } catch (e) {
+    return null
+  }
+}
 // Operator-profile redaction (mirror of harness-core redactProfileBlock — ADR-001 Decision 5 /
 // CF-6 of operator-profile). The PERSIST seam in `dz feature-adr-record` redacts independently;
 // this mirror exists so the truncation fnv1a64 hashes below are hashes of the REDACTED text and
@@ -526,7 +546,7 @@ function tpRedact(text) {
     rest = rest.slice(end + TP_PROFILE_END.length)
   }
 }
-function buildTrainingPair(slug, stage, ts, inputRaw, outputRaw, evaluation, provenance, captureMode, resumed) {
+function buildTrainingPair(slug, stage, ts, inputRaw, outputRaw, evaluation, provenance, budgetModeRaw, captureMode, resumed) {
   // Redaction FIRST, before the oversize guard — same order as the core builder.
   let input = tpRedact(tpText(inputRaw))
   let output = tpRedact(tpText(outputRaw))
@@ -559,6 +579,7 @@ function buildTrainingPair(slug, stage, ts, inputRaw, outputRaw, evaluation, pro
       tokens: (typeof pv.tokens === 'number' && isFinite(pv.tokens)) ? pv.tokens : null,
       minutes: (typeof pv.minutes === 'number' && isFinite(pv.minutes)) ? pv.minutes : null,
     },
+    budgetMode: tpBudget(budgetModeRaw),
     truncated: truncated,
     captureMode: captureMode === 'backfill' ? 'backfill' : 'capture',
     resumed: resumed === true,
@@ -582,8 +603,9 @@ async function capturePairs(stage, phaseName, records, resumeGuardStage) {
     mode = decideCaptureMode({ enabled: CAPTURE_PAIRS, resumed: resumed, recordCount: filteredRecords.length })
     if (mode === 'skip-disabled' || mode === 'skip-empty') return
     const lines = []
+    const budgetModeInput = { primary: PRIMARY, claude: BUDGET_MODE.claude, codex: BUDGET_MODE.codex, preset: A.budget === undefined ? 'unset' : undefined }
     for (const r of filteredRecords) {
-      lines.push(JSON.stringify(buildTrainingPair(SLUG, stage, null, r.input, r.output, r.evaluation, r.provenance, mode === 'backfill' ? 'backfill' : 'capture', resumed === true)))
+      lines.push(JSON.stringify(buildTrainingPair(SLUG, stage, null, r.input, r.output, r.evaluation, r.provenance, budgetModeInput, mode === 'backfill' ? 'backfill' : 'capture', resumed === true)))
     }
     const file = TP_DIR + '/' + stage + '.jsonl'
     const markStage = String(stage).replace(/\.\./g, '_').replace(/\//g, '_')
@@ -715,8 +737,8 @@ const PLANNER = (A.planner === 'codex') ? 'codex' : 'claude'
 // LOAD-BEARING: when args.models.qe is unset the QE stage is auto-routed to the OTHER family than the
 // coder (a model that codes must not also self-QE). BACKWARD-COMPATIBLE: omitting args.models AND the
 // legacy knobs ⇒ routingRequested is false ⇒ every stage resolves to {} ⇒ byte-identical to today.
-// Precedence: args.models[stage] > legacy planner/coder/qeReviewer/codexModel knobs > DEFAULT_MODELS.
-// gpt-5.6-ready: adding a codex id is a DATA-ONLY edit to KNOWN_CODEX. This block is the parser-safe
+// Precedence: args.models[stage] > legacy planner/coder/qeReviewer/codexModel knobs > primary/budget defaults.
+// KNOWN_CODEX is spellability only; capability selection uses explicit CODEX_TIERS and a live pre-run probe.
 // (string concat, explicit if/return, object-literal tables — NO template literals, NO inline ?:agent())
 // mirror of src/feature-adr-routing.ts; keep the two in lock-step (a drift test asserts it).
 // stage 2 pending (loop-designer M10/ADR-004 D4): still a hand-maintained mirror — the routing
@@ -724,16 +746,24 @@ const PLANNER = (A.planner === 'codex') ? 'codex' : 'claude'
 // regeneration via model-resolver/usage-probes/codex-dispatch blobs is the tracked Stage-B item.
 const MODELS = (A.models && typeof A.models === 'object') ? A.models : {}
 const KNOWN_CODEX = { 'auto': 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 }
+// The allowlist is not an availability check — probe every id before every run; ids drift in both directions.
+const CODEX_TIERS = { flagship: 'gpt-5.6-sol', workhorse: 'gpt-5.6-terra', 'high-volume': 'gpt-5.6-luna' }
 const CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 }
-const VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 }
+const VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 }
 const DEFAULT_MODELS = { router: 'fable', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: null, qe: null, fleet: 'sonnet' }
-const routingRequested = (Object.keys(MODELS).length > 0) || (PLANNER === 'codex') || (CODER === 'codex' || CODER === 'codex-fallback') || (QE_REVIEWER === 'codex' || QE_REVIEWER === 'codex-fallback') || (A.usageAdaptive === true)
+const BUDGET_PRESETS = { normal: { claude: 'normal', codex: 'normal' }, eco: { claude: 'eco', codex: 'eco' }, hybrid: { claude: 'eco', codex: 'normal' } }
+const ROUTING_TABLES = { claude: { claude: { normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' }, eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' } }, codex: { normal: {}, eco: {} } }, codex: { claude: { normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' }, eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' } }, codex: { normal: {}, eco: {} } } }
+const STAGE_EFFORT = { override: { router: 'medium', requirements: 'medium', research: 'medium', adr: 'high', ideation: 'medium', ddd: 'high', architecture: 'high', plan: 'high', code: 'medium', qe: 'high', fleet: 'medium' } }
+const BUDGET_MODE = resolveBudgetMode(A.budget)
+const PRIMARY = (A.primary === 'codex') ? 'codex' : 'claude'
+const routingRequested = (Object.keys(MODELS).length > 0) || (A.primary !== undefined) || (A.budget !== undefined) || (PLANNER === 'codex') || (CODER === 'codex' || CODER === 'codex-fallback') || (QE_REVIEWER === 'codex' || QE_REVIEWER === 'codex-fallback') || (A.usageAdaptive === true)
 const modelsUsed = {}
 
 // ── USAGE-ADAPTIVE ROUTING (pre-emptive codex switch at >= usageThreshold, default 70%) ──
 // At every phase boundary a minimal haiku probe runs 'dz usage --json'; when SESSION or WEEKLY
 // usage crosses the threshold BEFORE a phase launches, ALL remaining stages switch to
-// codex:<topCodexId> (design/code/plan at xhigh, router/qe/fleet at high). When a later probe reads
+// codex:<topCodexId> using STAGE_EFFORT (official medium default; high only where the table names it).
+// When a later probe reads
 // BOTH metrics below threshold (positive numbers, not nulls) the normal mix is RESTORED. The
 // load-bearing asymmetry: an agent-null probe (dispatch died — often MEANS limits) fail-safe-switches
 // TO codex; a value-null (unconfigured limits) flips NOTHING. All additive behind USAGE_ADAPTIVE:
@@ -742,7 +772,7 @@ const modelsUsed = {}
 // the pure library mirror (feature-adr-routing.ts) threads it via RoutingEnv — never a global.
 const USAGE_THRESHOLD = Number(A.usageThreshold) > 0 ? Number(A.usageThreshold) : 70
 const USAGE_ADAPTIVE = (A.usageAdaptive !== false) && (routingRequested || A.usageAdaptive === true)
-const OVERRIDE_REASONING = mergeOpts({ router: 'high', requirements: 'xhigh', research: 'xhigh', adr: 'xhigh', ideation: 'xhigh', ddd: 'xhigh', architecture: 'xhigh', plan: 'xhigh', code: 'xhigh', qe: 'high', fleet: 'high' }, (A.usageReasoning && typeof A.usageReasoning === 'object') ? A.usageReasoning : {})
+const OVERRIDE_REASONING = mergeOpts(STAGE_EFFORT.override, (A.usageReasoning && typeof A.usageReasoning === 'object') ? A.usageReasoning : {})
 const usageReasoning = OVERRIDE_REASONING
 let usageOverride = false
 const usageEvents = []
@@ -804,7 +834,7 @@ function specToOpts(spec) {
     let id = parts[1] || CODEX_MODEL
     if (id !== 'auto' && !KNOWN_CODEX[id]) { log('models: unknown codex id ' + id + ' — using ' + CODEX_MODEL); id = CODEX_MODEL }
     let reasoning = parts[2] || 'high'
-    if (!VALID_REASONING[reasoning]) { log('models: unknown reasoning ' + reasoning + ' — using high'); reasoning = 'high' }
+    if (!VALID_REASONING[reasoning]) throw new RangeError('models: invalid reasoning "' + reasoning + '" — valid: ' + Object.keys(VALID_REASONING).join('|'))
     return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning }
   }
   if (CLAUDE_NAMES[parts[0]]) return { model: parts[0] }
@@ -812,32 +842,94 @@ function specToOpts(spec) {
   return {}
 }
 
+function codexIdForTier(tier) {
+  return CODEX_MODEL !== 'auto' ? CODEX_MODEL : CODEX_TIERS[tier]
+}
+
+function resolveBudgetMode(raw) {
+  if (raw === undefined) return BUDGET_PRESETS.normal
+  if (typeof raw === 'string') {
+    const preset = BUDGET_PRESETS[raw]
+    if (!preset) throw new RangeError('budget: unknown preset "' + raw + '" — valid: normal|eco|hybrid')
+    return preset
+  }
+  if (raw && typeof raw === 'object') {
+    for (const key of Object.keys(raw)) {
+      if (key !== 'claude' && key !== 'codex') throw new RangeError('budget: unknown family key "' + key + '" — valid: claude|codex')
+    }
+    for (const key of ['claude', 'codex']) {
+      const level = raw[key]
+      if (level !== undefined && level !== 'normal' && level !== 'eco') throw new RangeError('budget.' + key + ': unknown level "' + level + '" — valid: normal|eco')
+    }
+    return { claude: raw.claude || 'normal', codex: raw.codex || 'normal' }
+  }
+  throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw)
+}
+
+function budgetPresetName(axis) {
+  for (const name of ['normal', 'eco', 'hybrid']) {
+    const preset = BUDGET_PRESETS[name]
+    if (preset.claude === axis.claude && preset.codex === axis.codex) return name
+  }
+  return null
+}
+
+function budgetTable(primary, mode) {
+  const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude]
+  let codexHalf
+  if (primary === 'claude') {
+    const qeSpec = mode.codex === 'normal' ? 'codex:' + codexIdForTier('flagship') + ':high' : 'codex:' + codexIdForTier('workhorse') + ':medium'
+    codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: A.codexAvailable === false ? 'opus' : qeSpec }
+  } else {
+    const normal = mode.codex === 'normal'
+    const id = codexIdForTier(normal ? 'flagship' : 'workhorse')
+    const design = 'codex:' + id + ':' + (normal ? 'high' : 'medium')
+    codexHalf = { requirements: design, research: design, adr: design, ideation: design, ddd: design, architecture: design, plan: 'codex:' + id + ':' + (normal ? 'high' : 'low'), code: 'codex:' + id + ':medium' }
+  }
+  return { ...claudeHalf, ...codexHalf }
+}
+
+// qe2 is outside the 11 canonical stages: A-normal adds an independent Opus precision pass for L/XL.
+function qePrecisionPassSpec(primary, budget, tier) {
+  if (primary !== 'codex') return null
+  if (budget.claude !== 'normal') return null
+  if (tier !== 'L' && tier !== 'XL') return null
+  return 'opus'
+}
+
+function assertCrossFamilyQe(codeSpec, qeSpec) {
+  const fam = function (s) { return (s && String(s).split(':')[0] === 'codex') ? 'codex' : 'claude' }
+  if (fam(codeSpec) === fam(qeSpec)) throw new Error('cross-family QE violated: code=' + codeSpec + ' qe=' + qeSpec)
+}
+
 function resolveCoderSpec() {
   if (CODER === 'codex' || CODER === 'codex-fallback') return 'codex:' + CODEX_MODEL + ':high'
   return 'opus'
 }
 
 function coderIsCodex() {
-  if (CODER === 'codex' || CODER === 'codex-fallback') return true
   const codeSpec = MODELS.code
-  if (codeSpec && String(codeSpec).split(':')[0] === 'codex') return true
-  return false
+  if (codeSpec !== undefined && codeSpec !== null) return String(codeSpec).split(':')[0] === 'codex'
+  if (CODER === 'codex' || CODER === 'codex-fallback') return true
+  return A.primary === 'codex'
 }
 
 function topCodexId() {
-  let top = CODEX_MODEL
-  if (top === 'auto') {
-    const ids = Object.keys(KNOWN_CODEX)
-    for (let i = 0; i < ids.length; i++) { if (ids[i] !== 'auto') top = ids[i] || top }
-  }
-  return top
+  return CODEX_MODEL !== 'auto' ? CODEX_MODEL : CODEX_TIERS.flagship
 }
 
-function resolveQeSpec() {
-  if (coderIsCodex()) return 'opus'
+function resolveQeSpecForCoder(coderCodex) {
+  if (coderCodex) return 'sonnet'
   const CODEX_AVAILABLE = A.codexAvailable !== false
   if (!CODEX_AVAILABLE) return 'opus'
-  return 'codex:' + topCodexId() + ':high'
+  const budget = BUDGET_MODE
+  return budget.codex === 'eco'
+    ? 'codex:' + codexIdForTier('workhorse') + ':medium'
+    : 'codex:' + codexIdForTier('flagship') + ':high'
+}
+
+function resolveQeSpec() {
+  return resolveQeSpecForCoder(coderIsCodex())
 }
 
 // qeShouldUseCodex: the load-bearing cross-model gate — the model that wrote the code must NEVER self-QE.
@@ -854,7 +946,7 @@ function qeShouldUseCodex() {
 
 function resolveStageModel(stage) {
   if (usageOverride) {
-    const r = (usageReasoning && usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high'
+    const r = (usageReasoning && usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium'
     const o = specToOpts('codex:' + topCodexId() + ':' + r)
     o._usageSwitched = true
     return o
@@ -862,7 +954,17 @@ function resolveStageModel(stage) {
   let spec = MODELS[stage]
   if (spec === undefined) {
     if (!routingRequested) return {}
-    spec = DEFAULT_MODELS[stage]
+    if (stage === 'code' && (CODER === 'codex' || CODER === 'codex-fallback')) {
+      return specToOpts(resolveCoderSpec())
+    }
+    if (stage === 'plan' && PLANNER === 'codex') {
+      return specToOpts('codex:' + CODEX_MODEL + ':high')
+    }
+    if (stage === 'qe') {
+      return specToOpts(resolveQeSpec())
+    }
+    const cell = budgetTable(PRIMARY, BUDGET_MODE)[stage]
+    spec = cell !== undefined ? cell : DEFAULT_MODELS[stage]
   }
   if (stage === 'code' && (spec === null || spec === undefined)) return specToOpts(resolveCoderSpec())
   if (stage === 'qe' && (spec === null || spec === undefined)) return specToOpts(resolveQeSpec())
@@ -1020,11 +1122,13 @@ function codexExecCommand(input) {
   const o = input || {}
   const modelId = String(o.modelId === undefined || o.modelId === null ? '' : o.modelId)
   if (!isSafeCodexId(modelId)) return null
+  const reasoning = (o.reasoning === undefined || o.reasoning === null || o.reasoning === '') ? 'high' : String(o.reasoning)
+  if (!VALID_REASONING[reasoning]) return null
   const raw = Number(o.timeoutSeconds)
   const seconds = (raw === raw && raw !== Infinity && raw > 0) ? Math.floor(raw) : CODEX_EXEC_TIMEOUT_SECONDS
   const repo = String(o.repo === undefined || o.repo === null ? '' : o.repo)
   const cd = repo === '' ? '' : ' -C ' + codexSq(repo)
-  return timeoutBinOrDefault(o.timeoutBin) + ' ' + seconds + ' codex exec' + cd + ' -m ' + codexSq(modelId) + ' ' + codexSq(String(o.prompt === undefined || o.prompt === null ? '' : o.prompt)) + ' < /dev/null'
+  return timeoutBinOrDefault(o.timeoutBin) + ' ' + seconds + ' codex exec' + cd + ' -m ' + codexSq(modelId) + ' -c model_reasoning_effort=' + codexSq(reasoning) + ' ' + codexSq(String(o.prompt === undefined || o.prompt === null ? '' : o.prompt)) + ' < /dev/null'
 }
 
 function codexReviewCommand(input) {
@@ -1268,7 +1372,14 @@ function isAgentTypeMissingError(err) {
 // CX-3: a workflow naming an agent type the harness lacks must FALL BACK, not die. Any other error
 // still propagates — we do not hide real bugs behind a fallback.
 async function safeCodexAgent(prompt, opts) {
-  try { return await agent(prompt, opts) }
+  let dispatchOpts = opts
+  if (opts && opts.agentType === 'codex:codex-rescue') {
+    const requestedId = opts.codexModel !== 'auto' ? opts.codexModel : null
+    const probed = await probeCodexId(requestedId)
+    if (!probed) return null
+    dispatchOpts = mergeOpts(opts, { codexModel: probed })
+  }
+  try { return await agent(prompt, dispatchOpts) }
   catch (err) {
     if (isAgentTypeMissingError(err)) { log('codex: agent type unavailable — falling back to Claude (' + String(err) + ')'); return null }
     throw err
@@ -1276,7 +1387,7 @@ async function safeCodexAgent(prompt, opts) {
 }
 
 // CX-1: the allowlist says a name is spellable; only a probe says it answers. One probe per run.
-let _probedCodexId
+const _probedCodexIds = {}
 // Which timeout binary this machine actually has. ONE cached shell probe, run before either
 // dispatch mode spends a model call.
 //
@@ -1296,24 +1407,26 @@ async function probeTimeoutBin() {
   return _timeoutBin
 }
 
-async function probeCodexId() {
-  if (_probedCodexId !== undefined) return _probedCodexId
-  const raw = (CODEX_MODEL && CODEX_MODEL !== 'auto') ? [CODEX_MODEL, 'gpt-5.6-sol', 'gpt-5.5'] : ['gpt-5.6-sol', 'gpt-5.5']
+async function probeCodexId(requestedId) {
+  const requested = isSafeCodexId(requestedId) ? String(requestedId) : null
+  const raw = requested ? [requested] : ((CODEX_MODEL && CODEX_MODEL !== 'auto') ? [CODEX_MODEL, CODEX_TIERS.flagship, 'gpt-5.5'] : [CODEX_TIERS.flagship, 'gpt-5.5'])
+  const cacheKey = raw.join('|')
+  if (Object.prototype.hasOwnProperty.call(_probedCodexIds, cacheKey)) return _probedCodexIds[cacheKey]
   const ids = raw.filter(isSafeCodexId)
   for (const id of ids) {
     // The probe is built with the SAME binary the real dispatch will use, so a machine that cannot
     // bound a run fails here rather than mid-QE.
     const tbin = await probeTimeoutBin()
-    if (tbin === null) { _probedCodexId = null; return null }
+    if (tbin === null) { _probedCodexIds[cacheKey] = null; return null }
     const cmd = codexProbeCommand(id, tbin)
     if (!cmd) { log('codex: refusing unsafe model id ' + id); continue }
     const out = await agent('Run EXACTLY this via Bash and reply with its stdout only: ' + cmd + ' — if it fails or times out reply with exactly ' + CODEX_UNAVAILABLE, { label: 'probe:' + id, phase: 'Route', model: 'haiku', effort: 'low' })
     if (out && /\bOK\b/.test(String(out)) && String(out).indexOf(CODEX_UNAVAILABLE) === -1) {
-      log('codex: probed ' + id + ' — available'); _probedCodexId = id; return id
+      log('codex: probed ' + id + ' — available'); _probedCodexIds[cacheKey] = id; return id
     }
     log('codex: probed ' + id + ' — NOT available')
   }
-  _probedCodexId = null
+  _probedCodexIds[cacheKey] = null
   return null
 }
 
@@ -1350,9 +1463,9 @@ function codexQeSignalCommand(inner, outPath) {
 // Shared tail of both dispatch modes: run the signal-wrapped command through a shell agent and
 // CLASSIFY what came back. signalExpected is true here — on the pipeline path a swallowed sentinel
 // means the command did not demonstrably run, which is a tool-error, never a pass.
-async function runCodexQeCommand(stage, cmd, phaseName, label, probed, mode, scopeRef, files, allowStatedGrade) {
+async function runCodexQeCommand(stage, cmd, phaseName, label, probed, mode, scopeRef, files, allowStatedGrade, requestedReasoning) {
   const wrapped = 'Run EXACTLY this via Bash and reply with its stdout VERBATIM and nothing else, INCLUDING the final ' + CODEX_QE_SIGNAL_PREFIX + ' line (it is a machine signal, not prose — do not summarise, reformat or omit it). Only if you cannot run the command AT ALL (no shell, command not found) reply with exactly ' + CODEX_UNAVAILABLE + '; a timeout is NOT that case, it reports itself in the signal line.\n\n' + codexQeSignalCommand(cmd, '/tmp/dz-codex-qe-' + SLUG + '-' + stage + '-' + mode + '.out')
-  const raw = await agent(wrapped, { label: stageLabel(label, { agentType: 'codex:codex-rescue', codexModel: probed, _reasoning: 'high' }), phase: phaseName, model: 'haiku', effort: 'low' })
+  const raw = await agent(wrapped, { label: stageLabel(label, { agentType: 'codex:codex-rescue', codexModel: probed, _reasoning: requestedReasoning || 'high' }), phase: phaseName, model: 'haiku', effort: 'low' })
   const sig = parseCodexReviewSignal(raw === null ? '' : String(raw))
   const findings = parseCodexReviewFindings(sig.body)
   // Mode A NEVER asked for a letter (every scope flag rejects a prompt), so any "Grade: X" in its
@@ -1373,28 +1486,32 @@ async function runCodexQeCommand(stage, cmd, phaseName, label, probed, mode, sco
 // MODE A — the primary pass. codex review derives the review scope FROM THE DIFF, which is exactly
 // the reconnaissance we were paying a model to do badly (MEASURED: 146s with a verdict, against 280s
 // and exit 124 without one). It cannot carry our questions: every scope flag refuses [PROMPT].
-async function codexReviewAgent(stage, scope, scopeRef, phaseName) {
+async function codexReviewAgent(stage, scope, scopeRef, phaseName, requestedOpts) {
   lastCodexDecline = null
-  const probed = await probeCodexId()
+  const requestedId = requestedOpts && requestedOpts.codexModel !== 'auto' ? requestedOpts.codexModel : null
+  const requestedReasoning = (requestedOpts && requestedOpts._reasoning) || 'high'
+  const probed = await probeCodexId(requestedId)
   if (!probed) return noteCodexDecline(stage, 'unavailable', { reason: 'no codex model id answered the probe' })
-  const built = codexReviewCommand({ scope: scope, ref: scopeRef, modelId: probed, reasoning: 'high', timeoutSeconds: CODEX_REVIEW_TIMEOUT_SECONDS, timeoutBin: await probeTimeoutBin(), repo: REPO })
+  const built = codexReviewCommand({ scope: scope, ref: scopeRef, modelId: probed, reasoning: requestedReasoning, timeoutSeconds: CODEX_REVIEW_TIMEOUT_SECONDS, timeoutBin: await probeTimeoutBin(), repo: REPO })
   if (built.cmd === null) return noteCodexDecline(stage, 'tool-error', { exit: 2, detail: built.reason })
-  return await runCodexQeCommand(stage, built.cmd, phaseName, stage + ':codex-review', probed, 'A', built.scope + (scopeRef ? ' ' + scopeRef : ''), [], false)
+  return await runCodexQeCommand(stage, built.cmd, phaseName, stage + ':codex-review', probed, 'A', built.scope + (scopeRef ? ' ' + scopeRef : ''), [], false, requestedReasoning)
 }
 
 // MODE B — the narrowed follow-up. Carries OUR questions over files we name, and is refused outright
 // when the prompt was not built by scopedQePrompt (see codexExecPlan).
-async function codexExecAgent(stage, prompt, phaseName, scoped, files) {
+async function codexExecAgent(stage, prompt, phaseName, scoped, files, requestedOpts) {
   lastCodexDecline = null
-  const probed = await probeCodexId()
+  const requestedId = requestedOpts && requestedOpts.codexModel !== 'auto' ? requestedOpts.codexModel : null
+  const requestedReasoning = (requestedOpts && requestedOpts._reasoning) || 'high'
+  const probed = await probeCodexId(requestedId)
   const plan = codexExecPlan(stage, prompt.length, probed, scoped)
   if (plan.mode !== 'exec') return noteCodexDecline(stage, 'unavailable', { reason: plan.reason })
   // Was JSON.stringify(...) — DOUBLE quotes, in which the shell still expands a command substitution, and the
   // prompt carries the user's own feature description. Single-quoted through codexSq closes that
   // as a side effect of pinning the working directory.
-  const inner = codexExecCommand({ modelId: probed, prompt: prompt, timeoutBin: await probeTimeoutBin(), timeoutSeconds: CODEX_EXEC_TIMEOUT_SECONDS, repo: REPO })
+  const inner = codexExecCommand({ modelId: probed, reasoning: requestedReasoning, prompt: prompt, timeoutBin: await probeTimeoutBin(), timeoutSeconds: CODEX_EXEC_TIMEOUT_SECONDS, repo: REPO })
   if (inner === null) return noteCodexDecline(stage, 'unavailable', { reason: 'unsafe codex id ' + String(probed) })
-  return await runCodexQeCommand(stage, inner, phaseName, stage + ':codex-exec', probed, 'B', 'declared-targets(' + (files || []).length + ' declared, <=' + SCOPED_QE_MAX_FILES + ' reviewed)', files || [], true)
+  return await runCodexQeCommand(stage, inner, phaseName, stage + ':codex-exec', probed, 'B', 'declared-targets(' + (files || []).length + ' declared, <=' + SCOPED_QE_MAX_FILES + ' reviewed)', files || [], true, requestedReasoning)
 }
 
 // Widened 2026-08-28 (MEASURED — see feature-adr-routing.ts for the reproducer): slop-lint's coder
@@ -2053,7 +2170,7 @@ async function designStage(promptText, opts, artifactPath, baseLabel) {
   if (!needsLandedBarrier(opts)) return await agent(promptText, opts)
   const codexOpts = {}
   for (const k in opts) if (k !== 'schema') codexOpts[k] = opts[k]
-  const res = await agent(promptText + codexEffortHint(codexOpts) + ' IMPORTANT: run the Codex task in FOREGROUND (synchronous — do NOT pass --background) so this call blocks until the file is fully written to disk.', codexOpts)
+  const res = await safeCodexAgent(promptText + codexEffortHint(codexOpts) + ' IMPORTANT: run the Codex task in FOREGROUND (synchronous — do NOT pass --background) so this call blocks until the file is fully written to disk.', codexOpts)
   const probe = await agent('Confirm a Codex OUT-OF-BAND artifact write has LANDED before the next stage reads it. Run EXACTLY this via Bash and return its stdout verbatim, nothing else:\n' + landedProbeCmd(artifactPath), { label: 'design:confirm-landed', phase: 'Design', effort: 'low' })
   if (res && probe && /landed=/.test(String(probe))) return { wrote: [artifactPath], summary: String(res).slice(0, 300) }
   log('design artifact did not land on codex (' + artifactPath + ') — falling back to Claude')
@@ -2138,7 +2255,7 @@ modelsUsed.router = modelLabel(routerOpts)
 // router checkpoint: its result (tier + recalled-pattern rationale) seeds every downstream hash.
 // The Step-0 RECALL is part of the stage — a resumed router restores the SAME recalled patterns the
 // original run applied (fresh lessons taught since then enter on the next live run, not mid-resume).
-const routerHash = ckptHash('router', [DESC, CODE_HINT, MODE, A.tier === undefined ? null : A.tier, BRAIN, MODELS.router === undefined ? null : MODELS.router, CODEX_MODEL, usageOverride, ROUTER_CONTRACT_TOKEN])
+const routerHash = ckptHash('router', [DESC, CODE_HINT, MODE, A.tier === undefined ? null : A.tier, BRAIN, MODELS.router === undefined ? null : MODELS.router, CODEX_MODEL, PRIMARY, BUDGET_MODE, usageOverride, ROUTER_CONTRACT_TOKEN])
 const router = await withCheckpoint('router', 'Router', routerHash, async () => agent(routerPrompt + codexEffortHint(routerOpts), routerOpts))
 if (resumedStages.indexOf('router') !== -1) modelsUsed.router = modelsUsed.router + ' (resumed)'
 let tier = A.tier || (router ? router.tier : 'M')
@@ -2283,7 +2400,7 @@ if (isMplus) {
 // patterns, the project-skills manifest state, the usage override, and CODEX_MODEL (a bare 'codex'
 // model spec resolves through it). The artifact probe requires EVERY tier-active design artifact
 // (Codex QE #2 — a one-file probe accepted a design missing its ADR/architecture).
-const designHash = ckptHash('design', [tier, DESC, CODE_HINT, fnv1a64(String(LEARNED)), MODELS.requirements === undefined ? null : MODELS.requirements, MODELS.adr === undefined ? null : MODELS.adr, MODELS.ideation === undefined ? null : MODELS.ideation, MODELS.architecture === undefined ? null : MODELS.architecture, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, CODEX_MODEL])
+const designHash = ckptHash('design', [tier, DESC, CODE_HINT, fnv1a64(String(LEARNED)), MODELS.requirements === undefined ? null : MODELS.requirements, MODELS.adr === undefined ? null : MODELS.adr, MODELS.ideation === undefined ? null : MODELS.ideation, MODELS.architecture === undefined ? null : MODELS.architecture, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, CODEX_MODEL, PRIMARY, BUDGET_MODE])
 const designArtifacts = ['01_requirements.md']
 if (isMplus) designArtifacts.push('03_adr/', '03.5_ideation_report.md', '05_architecture.md')
 if (isLplus) designArtifacts.push('02_research.md', '04_domain_model.md')
@@ -2441,7 +2558,7 @@ const planIsCodex = (planModel.agentType === 'codex:codex-rescue') || (MODELS.pl
 // plan checkpoint: keyed on the design fan's RESULT (a stale design invalidates the plan) + the
 // planner spec. Covers the standard L/XL two-phase flow: the stop-after-plan re-invoke resumes
 // router+design+plan instead of re-running them.
-const planHash = ckptHash('plan', [tier, DESC, fnv1a64(JSON.stringify(design === undefined ? null : design)), PLANNER, MODELS.plan === undefined ? null : MODELS.plan, CODEX_MODEL, usageOverride])
+const planHash = ckptHash('plan', [tier, DESC, fnv1a64(JSON.stringify(design === undefined ? null : design)), PLANNER, MODELS.plan === undefined ? null : MODELS.plan, CODEX_MODEL, PRIMARY, BUDGET_MODE, usageOverride])
 let plan = await withCheckpoint('plan', 'Plan', planHash, async () => {
 let plan = null
 if (planIsCodex) {
@@ -2653,7 +2770,7 @@ const codePrompt = 'Step 7 (Code) of /feature-adr for "' + DESC + '" (' + SLUG +
 // code:null sentinel → resolveCoderSpec(). A Claude resolution merges {model} onto the Claude branch;
 // under the BC omit-path it is {} (byte-identical).
 const codeModel = resolveStageModel('code')
-const codeIsCodexFirst = (MODELS.code !== undefined) ? (codeModel.agentType === 'codex:codex-rescue') : (CODER === 'codex')
+const codeIsCodexFirst = (codeModel.agentType === 'codex:codex-rescue') && (MODELS.code !== undefined || CODER !== 'codex-fallback')
 const codeClaudeModel = codeIsCodexFirst ? {} : (codeModel.agentType ? {} : codeModel)
 const codeClaudeOpts = mergeOpts({ label: stageLabel('code', codeClaudeModel), phase: 'Code', schema: ARTIFACT, effort: 'high' }, codeClaudeModel)
 // code checkpoint: COMPOSITE — the branchy claude/codex/fallback block sets three interdependent
@@ -2662,7 +2779,7 @@ const codeClaudeOpts = mergeOpts({ label: stageLabel('code', codeClaudeModel), p
 // the checkpoint (it only feeds the expected-targets parse, already consumed by the original run).
 // R6: the landing token is salted into the code stage's PARTS (not CKPT_SCHEMA_VERSION, which
 // stays 'fa-ckpt-2' deliberately) so ONLY this stage's pre-protocol checkpoints hash stale.
-const codeHash = ckptHash('code', [tier, DESC, fnv1a64(JSON.stringify(plan === undefined ? null : plan)), CODER, MODELS.code === undefined ? null : MODELS.code, CODEX_MODEL, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, LANDING_HASH_TOKEN])
+const codeHash = ckptHash('code', [tier, DESC, fnv1a64(JSON.stringify(plan === undefined ? null : plan)), CODER, MODELS.code === undefined ? null : MODELS.code, CODEX_MODEL, PRIMARY, BUDGET_MODE, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, LANDING_HASH_TOKEN])
 const codeStage = await withCheckpoint('code', 'Code', codeHash, async () => {
 let code = null
 let coderUsed = 'claude'
@@ -2818,13 +2935,16 @@ const wqNote = writerQuiescence.verdict === 'quiet'
   ? ' WRITER-QUIESCENCE: quiet (' + writerQuiescence.note + ').'
   : ' WRITER-QUIESCENCE GATE (MANDATORY to acknowledge): ' + writerQuiescence.note + ' State this standing explicitly in 08_qe_report.md next to the grade.'
 await usageProbe('QE')
-const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test that DISCRIMINATES - the recurring lesson: a test that would still pass with the protection deleted is documentation, not a gate). Run this ADR gate before final grading: ' + ADR_FITNESS_CHECKLIST + ' ' + DISCRIMINATION_GATE + ' ' + MUTATION_GATE + ' ' + NO_STUBS_GATE + ' ' + AMENDMENT_GATE + ' Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md with an ADR Fitness Checklist section showing PASS/FAIL per ADR and evidence for the Confirmation-linked test. MANDATORY SELF-LEARNING STORE (close the loop, never skip): compare every candidate lesson against the Step-0 recalled LEARNED patterns above. Teach ONLY lessons NOT covered by Step-0 recall. On overlap, run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate; if --reinforce is unavailable, skip the duplicate teach and report `reinforced existing pattern <id>` in the QE report. Store every genuinely new lesson in the CANONICAL BRAIN store at `' + BRAIN + '` so it is NOT lost to a target repo you may have cd`d into. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal) — the `cd ' + BRAIN + ' &&` prefix + `--project ' + BRAIN + '` pin guarantee the lesson lands in the brain regardless of your CWD. Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. AUTHORING-TIME CLAIM-CHECK (Deliverable of claim-check-authoring-time): after writing ' + FDIR + '/08_qe_report.md, run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash, parse the {ok, findings, scanned} JSON, and report claimCheck: {findings: N, high: N, medium: N} (counts by severity) in your return object. TAG EVERY QUANTITATIVE CLAIM you write in the report using the convention the checker recognizes as honest — write "1131 tests pass (MEASURED — `npx vitest run`)", never a bare "1131 tests pass" — and where you QUOTE a forbidden phrase as an example (e.g. the retracted "100% passing" framing), backtick the literal so it reads as code, not an assertion, so your own compliant report scans clean. Return {grade, gaps, codeTestsAdequate, docTestsPresent, claimCheck}.' + ABSOLUTE_PATH_NOTE + landedNote + wqNote + PS_GUIDANCE('qe')
+const qePrompt = 'Step 8 (QE - brutal-honesty review, agentic-qe) of /feature-adr for "' + DESC + '" (' + SLUG + '). Adversarially review the SHIPPED code (read it): correctness, edge cases, error handling, and the LOAD-BEARING property the ADR named (ASSERT it has a test that DISCRIMINATES - the recurring lesson: a test that would still pass with the protection deleted is documentation, not a gate). Run this ADR gate before final grading: ' + ADR_FITNESS_CHECKLIST + ' ' + DISCRIMINATION_GATE + ' ' + MUTATION_GATE + ' ' + NO_STUBS_GATE + ' ' + AMENDMENT_GATE + ' Grade A/B/C/D honestly. Assess code-test adequacy + doc-test presence. List CONFIRMED gaps with severity. Write ' + FDIR + '/08_qe_report.md with the primary findings under the exact heading `## Primary QE pass` and an ADR Fitness Checklist section showing PASS/FAIL per ADR and evidence for the Confirmation-linked test. MANDATORY SELF-LEARNING STORE (close the loop, never skip): compare every candidate lesson against the Step-0 recalled LEARNED patterns above. Teach ONLY lessons NOT covered by Step-0 recall. On overlap, run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate; if --reinforce is unavailable, skip the duplicate teach and report `reinforced existing pattern <id>` in the QE report. Store every genuinely new lesson in the CANONICAL BRAIN store at `' + BRAIN + '` so it is NOT lost to a target repo you may have cd`d into. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal) — the `cd ' + BRAIN + ' &&` prefix + `--project ' + BRAIN + '` pin guarantee the lesson lands in the brain regardless of your CWD. Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` (run it verbatim via Bash, do not skip). Do NOT teach trivia or invent gaps. AUTHORING-TIME CLAIM-CHECK (Deliverable of claim-check-authoring-time): after writing ' + FDIR + '/08_qe_report.md, run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash, parse the {ok, findings, scanned} JSON, and report claimCheck: {findings: N, high: N, medium: N} (counts by severity) in your return object. TAG EVERY QUANTITATIVE CLAIM you write in the report using the convention the checker recognizes as honest — write "1131 tests pass (MEASURED — `npx vitest run`)", never a bare "1131 tests pass" — and where you QUOTE a forbidden phrase as an example (e.g. the retracted "100% passing" framing), backtick the literal so it reads as code, not an assertion, so your own compliant report scans clean. Return {grade, gaps, codeTestsAdequate, docTestsPresent, claimCheck}.' + ABSOLUTE_PATH_NOTE + landedNote + wqNote + PS_GUIDANCE('qe')
 // CROSS-MODEL QE (load-bearing): resolveStageModel('qe') derives the OTHER family than the resolved
 // coder when args.models.qe is unset (coder-codex ⇒ opus; coder-Claude ⇒ codex, or opus if codex absent).
 // An explicit args.models.qe wins. A Claude qe spec is merged onto the qe-code-reviewer base (role
 // PRESERVED); a codex qe spec REPLACES agentType with codex:codex-rescue (as today). The codex-null→
 // Claude guard is retained as the runtime belt so codex-unavailable never blocks.
-const qeModel = resolveStageModel('qe')
+let qeModel = resolveStageModel('qe')
+// A codex-fallback coder can finish on either family. Default QE follows the ACTUAL runner, not the
+// pre-code knob; only an explicit models.qe is allowed to opt out of cross-family review.
+if (MODELS.qe === undefined && routingRequested) qeModel = specToOpts(resolveQeSpecForCoder(tpFamily(coderUsed) === 'codex'))
 // Single tested source of truth (feature-adr-routing.ts:qeShouldUseCodex) — closes the self-QE hole where
 // the legacy qeReviewer='codex' knob used to re-route QE back to codex even when the CODER was codex.
 if (MODELS.qe === undefined && QE_REVIEWER === 'codex' && coderIsCodex()) log('QE: coder is codex — enforcing cross-model Claude QE (ignoring qeReviewer=codex to avoid self-review)')
@@ -2832,15 +2952,16 @@ if (MODELS.qe === undefined && QE_REVIEWER === 'codex' && coderIsCodex()) log('Q
 // (which reads the pre-override config) says claude — dispatching that through the "claude" branch
 // would run the stub wrapper AND mislabel qeReviewerUsed='claude' (a codex-on-codex review recorded
 // as cross-family). The resolved agentType is the truth; either signal routes the codex branch.
-const qeIsCodex = qeShouldUseCodex() || (qeModel && qeModel.agentType === 'codex:codex-rescue')
+const qeIsCodex = !!(qeModel && qeModel.agentType === 'codex:codex-rescue')
 const qeClaudeModel = qeIsCodex ? {} : qeModel
 const qeClaudeOpts = mergeOpts({ label: stageLabel('qe:brutal', qeClaudeModel), phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qeClaudeModel)
+const qe2Spec = qePrecisionPassSpec(PRIMARY, BUDGET_MODE, tier)
 // qe checkpoint: COMPOSITE (verdict + reviewer identity) keyed on the CODE stage's result — a re-coded
 // feature always re-QEs. The teach/fa-record side effects belong to the stage: a resumed QE does not
 // re-teach (the original run already stored its lessons — replaying teach would double-store).
 // R6: the review SCOPE is part of what a QE verdict is about, so it enters the hash — a resume must
 // not present a verdict obtained over one scope as if it had been obtained over another.
-const qeHash = ckptHash('qe', [fnv1a64(JSON.stringify(codeStage === undefined ? null : codeStage)), tier, DESC, QE_REVIEWER, MODELS.qe === undefined ? null : MODELS.qe, CODEX_MODEL, coderUsed, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, QE_SCOPE, QE_SCOPE_REF])
+const qeHash = ckptHash('qe', [fnv1a64(JSON.stringify(codeStage === undefined ? null : codeStage)), tier, DESC, QE_REVIEWER, MODELS.qe === undefined ? null : MODELS.qe, CODEX_MODEL, coderUsed, PRIMARY, BUDGET_MODE, qe2Spec, POLY.hasManifest, fnv1a64(String(POLY.report || '')), usageOverride, QE_SCOPE, QE_SCOPE_REF])
 let crossFamilyQeReport = null
 const qeStage = await withCheckpoint('qe', 'QE', qeHash, async () => {
 let qe = null
@@ -2898,7 +3019,7 @@ if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
         }
       }
     }
-  let codexQe = await codexReviewAgent('qe', QE_SCOPE, QE_SCOPE_REF, 'QE')
+  let codexQe = await codexReviewAgent('qe', QE_SCOPE, QE_SCOPE_REF, 'QE', qeCodexLabelOpts)
   // SCOPE THE VERDICT to this feature. Findings about other dirty work are real and are kept, but they
   // may not decide THIS feature's grade. When the change set is unmeasured the partition is 'unscoped'
   // and the grade stands exactly as the reviewer gave it — attributing nothing is the honest move.
@@ -2937,7 +3058,7 @@ if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
       // mode-B bookkeeping note would hide why the independent review did not happen.
       log('QE: mode B not constructible — no declared changed files to scope it to; keeping mode A reason')
     } else {
-      codexQe = await codexExecAgent('qe', modeBPrompt + CODEX_HINT + codexEffortHint(qeCodexLabelOpts), 'QE', true, modeBFiles)
+      codexQe = await codexExecAgent('qe', modeBPrompt + CODEX_HINT + codexEffortHint(qeCodexLabelOpts), 'QE', true, modeBFiles, qeCodexLabelOpts)
       if (codexQe === null) lastCodexDecline = 'mode A: ' + String(modeADecline) + ' | mode B: ' + String(lastCodexDecline)
     }
   }
@@ -2959,7 +3080,7 @@ if (qe === null && (qeIsCodex || QE_REVIEWER === 'codex-fallback')) {
       // with no 08_qe_report.md at all. Named by cross-family review of b6973199. The verdict itself
       // is real (Codex produced it), so a failed transcription DEGRADES the run rather than voiding
       // it — but it must be visible, and it must never read as a clean QE.
-      const scribePrompt = 'Step 8 (QE) of /feature-adr for "' + DESC + '" (' + SLUG + '). The independent cross-family review has ALREADY BEEN DONE, by Codex. You are the SCRIBE, not the reviewer: RECORD it, do NOT re-grade it, do NOT soften it, do NOT add a verdict of your own, and do NOT mark anything resolved that the reviewer flagged. The grade is ' + codexQe.grade + ' and it is FINAL.\n\nWrite ' + FDIR + '/08_qe_report.md with: (1) the grade ' + codexQe.grade + ' stated verbatim; (2) HOW it was obtained — dispatch mode ' + codexQe.mode + ', scope ' + codexQe.scopeRef + ', wall-clock ' + codexQe.elapsedSeconds + 's, gradeSource ' + codexQe.gradeSource + ' (a DERIVED grade means the reviewer could not be asked for a letter and it was computed from the severities it reported — say so plainly); (3) the reviewer text below, verbatim, as the findings section; (4) an ADR Fitness Checklist section with PASS/FAIL per ADR and the evidence pointer for the Confirmation-linked test.\n\nREVIEWER TEXT (verbatim, do not edit or summarise):\n' + String(codexQe.text) + '\n\nMANDATORY SELF-LEARNING STORE (close the loop, never skip): compare candidate lessons against the Step-0 recalled LEARNED patterns. Teach ONLY lessons NOT already covered; on overlap run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal). Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` verbatim via Bash. Finally run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash and TAG every quantitative claim you write the way the checker recognises as honest.' + ABSOLUTE_PATH_NOTE
+      const scribePrompt = 'Step 8 (QE) of /feature-adr for "' + DESC + '" (' + SLUG + '). The independent cross-family review has ALREADY BEEN DONE, by Codex. You are the SCRIBE, not the reviewer: RECORD it, do NOT re-grade it, do NOT soften it, do NOT add a verdict of your own, and do NOT mark anything resolved that the reviewer flagged. The grade is ' + codexQe.grade + ' and it is FINAL.\n\nWrite ' + FDIR + '/08_qe_report.md with: (1) the grade ' + codexQe.grade + ' stated verbatim; (2) HOW it was obtained — dispatch mode ' + codexQe.mode + ', scope ' + codexQe.scopeRef + ', wall-clock ' + codexQe.elapsedSeconds + 's, gradeSource ' + codexQe.gradeSource + ' (a DERIVED grade means the reviewer could not be asked for a letter and it was computed from the severities it reported — say so plainly); (3) the reviewer text below, verbatim, under the exact heading `## Primary QE pass`; (4) an ADR Fitness Checklist section with PASS/FAIL per ADR and the evidence pointer for the Confirmation-linked test.\n\nREVIEWER TEXT (verbatim, do not edit or summarise):\n' + String(codexQe.text) + '\n\nMANDATORY SELF-LEARNING STORE (close the loop, never skip): compare candidate lessons against the Step-0 recalled LEARNED patterns. Teach ONLY lessons NOT already covered; on overlap run `dz teach --reinforce "<recalled pattern id or exact text>" --project ' + BRAIN + '` instead of minting a near-duplicate. Via Bash run EXACTLY `' + DZ_TEACH('<a durable reusable lesson from this feature - a rule/pattern/pitfall, NOT a checkpoint echo>', '<0.7-0.95>', '<area>') + '` for each genuine NEW lesson (1-3 max, high-signal). Then run `' + DZ + ' statusline --fa-record --slug ' + SLUG + ' --step "Step 8 QE" --recalled auto --run fa:' + SLUG + ' --count-project ' + BRAIN + ' --stored <count taught> --reinforced <count reinforced> --mode ' + MODE + ' --project ' + REPO + '` verbatim via Bash. Finally run EXACTLY `dz claim-check ' + FDIR + '/08_qe_report.md --json --fail-on none` via Bash and TAG every quantitative claim you write the way the checker recognises as honest.' + ABSOLUTE_PATH_NOTE
       // WITNESS THE REWRITE, not the existence. On a re-QE or a resume with the same slug an OLD
       // 08_qe_report.md is already sitting there, and an existence probe reports that stale file as
       // landed — so a scribe that wrote nothing still marked the new verdict recorded, and the stage
@@ -3011,12 +3132,49 @@ if (qe === null && qeIsCodex) {
     crossFamilyQeReport = cfBelt.report
   }
 }
+// A-normal L/XL only: Sonnet is the recall-oriented primary reviewer; Opus is a SECOND,
+// independent precision pass. It is advisory but real — never a table-only half-wire — and its
+// provenance stays separate in both the return object and 08_qe_report.md.
+let qe2 = null
+if (qe !== null && qe2Spec !== null) {
+  const qe2Model = specToOpts(qe2Spec)
+  const primaryGrade = String(qe.grade || '').trim().toUpperCase()
+  const qe2ReportState = async function (label) {
+    const report = shq(FDIR + '/08_qe_report.md')
+    const cmd = 'p=' + report + '; h=$(sha256sum -- "$p" 2>/dev/null | awk "{print \\$1}"); [ -n "$h" ] || h=ABSENT; a=$(grep -cFx "## Primary QE pass" "$p" 2>/dev/null || true); b=$(grep -cFx "## Precision QE pass — Claude Opus" "$p" 2>/dev/null || true); c=$(grep -c "Combined Step-8 grade" "$p" 2>/dev/null || true); echo "QE2-REPORT sha=$h primary=$a precision=$b combined=$c"'
+    const out = await agent('Run EXACTLY this via Bash and return only its stdout: ' + cmd, { label: label, phase: 'QE', effort: 'low' })
+    const m = /QE2-REPORT sha=([0-9a-f]{64}|ABSENT) primary=(\d+) precision=(\d+) combined=(\d+)/.exec(String(out || ''))
+    return m ? { sha: m[1], primary: Number(m[2]), precision: Number(m[3]), combined: Number(m[4]) } : null
+  }
+  const qe2Before = await qe2ReportState('qe:precision-before')
+  const qe2Prompt = 'Step 8 precision QE second pass for "' + DESC + '" (' + SLUG + '). This is an INDEPENDENT precision-oriented review after the recall-oriented primary pass. First inspect the shipped code, tests, requirements, architecture, and every ADR and form your own findings WITHOUT consulting 08_qe_report.md. Only after your review is complete, open ' + FDIR + '/08_qe_report.md and APPEND (never replace) your findings under the exact heading `## Precision QE pass — Claude Opus`. Preserve `## Primary QE pass` as a separate provenance section. Grade A/B/C/D honestly. The primary grade was ' + primaryGrade + '; state a `Combined Step-8 grade` equal to the worse of that grade and your precision grade. Return {grade, gaps, codeTestsAdequate, docTestsPresent}.' + ABSOLUTE_PATH_NOTE + landedNote + wqNote
+  const qe2Opts = mergeOpts({ label: stageLabel('qe:precision', qe2Model), phase: 'QE', agentType: 'qe-code-reviewer', schema: QE }, qe2Model)
+  qe2 = await agent(qe2Prompt, qe2Opts)
+  if (qe2) {
+    const qe2After = await qe2ReportState('qe:precision-after')
+    const qe2Recorded = !!(qe2Before && qe2After && qe2After.sha !== 'ABSENT' && qe2After.sha !== qe2Before.sha && qe2After.primary > 0 && qe2After.precision > qe2Before.precision && qe2After.combined > 0)
+    const rank = { A: 0, B: 1, C: 2, D: 3 }
+    const precisionGrade = String(qe2.grade || '').trim().toUpperCase()
+    qe2 = mergeOpts(qe2, { reportWritten: qe2Recorded })
+    if (qe2Recorded && rank[precisionGrade] !== undefined && rank[primaryGrade] !== undefined) {
+      const combinedGrade = rank[precisionGrade] > rank[primaryGrade] ? precisionGrade : primaryGrade
+      qe = mergeOpts(qe, { grade: combinedGrade, primaryGrade: primaryGrade, precisionPass: { reviewer: qe2Spec, grade: precisionGrade, gaps: Array.isArray(qe2.gaps) ? qe2.gaps : [] } })
+      modelsUsed.qe2 = modelLabel(qe2Model)
+    } else {
+      log('QE precision pass: report append NOT WITNESSED or grade invalid — primary verdict remains authoritative')
+      modelsUsed.qe2 = modelLabel(qe2Model) + ' (report-unverified)'
+    }
+  } else {
+    log('QE precision pass: Opus returned null — primary QE verdict remains authoritative; qe2 recorded unavailable')
+  }
+}
 if (qe === null) return null
-return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe }
+return { qe: qe, qeReviewerUsed: qeReviewerUsed, modelUsed: modelsUsed.qe, qe2: qe2, qe2ModelUsed: modelsUsed.qe2 || null }
 }, { validate: function (r) { return !!(r && typeof r === 'object' && r.qe && typeof r.qe === 'object' && typeof r.qeReviewerUsed === 'string') } })
 qe = qeStage ? qeStage.qe : null
 let qeReviewerUsed = qeStage ? qeStage.qeReviewerUsed : 'claude'
 if (qeStage && qeStage.modelUsed) modelsUsed.qe = qeStage.modelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
+if (qeStage && qeStage.qe2ModelUsed) modelsUsed.qe2 = qeStage.qe2ModelUsed + (resumedStages.indexOf('qe') !== -1 ? ' (resumed)' : '')
 
 // Step 8 claim-gate: fold the QE agent's reported claim-check counts into an additive result field.
 const claimGate = step8ClaimGate(qe && qe.claimCheck ? qe.claimCheck : null)
@@ -3135,7 +3293,7 @@ if (isLplus) {
     () => agent(fleetTracePrompt, fleetTraceOpts),
     () => agent(fleetCovPrompt, fleetCovOpts),
   ]
-  const fleetHash = ckptHash('fleet', [fnv1a64(JSON.stringify(qeStage === undefined ? null : qeStage)), tier, MODELS.fleet === undefined ? null : MODELS.fleet, CODEX_MODEL, usageOverride])
+  const fleetHash = ckptHash('fleet', [fnv1a64(JSON.stringify(qeStage === undefined ? null : qeStage)), tier, MODELS.fleet === undefined ? null : MODELS.fleet, CODEX_MODEL, PRIMARY, BUDGET_MODE, usageOverride])
   fleet = await withCheckpoint('fleet', 'FleetQE', fleetHash, async () => {
     const fleetRuns = await parallel(fleetThunks)
     return fleetRuns.every(function (x) { return x !== null && x !== undefined }) ? 'run' : null