@qwen-code/qwen-code 0.21.6-preview.0 → 0.21.7

package/bundled/review/SKILL.md

@@ -76,7 +76,7 @@ At every effort level, the mechanics of obtaining the diff — worktree flow, di
 
 The parser already classified the target, so there is nothing to disambiguate by hand. For a `pr-url` target, determine if the local repo can access this PR:
 
-1. Check if any git remote matches the URL's **host and owner/repo — by exact segment equality, never substring**: run `git remote -v` and parse each remote URL structurally (`git@<host>:<owner>/<repo>.git` and `https://<host>/<owner>/<repo>(.git)` are the two shapes). A remote matches only when its host equals the verdict's `host` AND its `<owner>/<repo>` (with any `.git` suffix stripped) equals the verdict's `owner/repo`, both compared case-insensitively as whole segments — `shao/qwen-code` does NOT match a `wenshao/qwen-code` remote, and a `github.com` PR does not match a same-named repo on another host. Substring "contains" matching once allowed exactly those, which is reviewing one repository and posting to another. This still handles forks — a local clone of `wenshao/jdk` with an `upstream` remote pointing to `openjdk/jdk` still matches `openjdk/jdk` PRs exactly.
+1. Check if any git remote matches the URL's **host and owner/repo — by exact segment equality, never substring**: run `git remote -v` and parse each remote URL structurally (`git@<host>:<owner>/<repo>.git` and `https://<host>/<owner>/<repo>(.git)` are the two shapes). A remote matches only when its host equals the verdict's `host` AND its `<owner>/<repo>` (with any `.git` suffix stripped) equals the verdict's `owner/repo`, both compared case-insensitively as whole segments — `shao/qwen-code` does NOT match a `wenshao/qwen-code` remote, and a `github.com` PR does not match a same-named repo on another host. Substring "contains" matching once allowed exactly those, which is reviewing one repository and posting to another. This still handles forks — a local clone with an `upstream` remote pointing to the target repository matches that repository's PRs exactly.
 2. If a matching remote is found, proceed with the **normal worktree flow** — use that remote name (instead of hardcoded `origin`) for `git fetch <remote> pull/<number>/head:qwen-review/pr-<number>`. In Step 7, use the owner/repo from the URL for posting comments.
 
 For a `pr-url` whose `host` is not `github.com` (GitHub Enterprise), **pass `--host <host>` to every review subcommand that talks to GitHub — `fetch-pr`, `pr-context`, `comment-status`, `presubmit`, and `compose-review`** — which routes all of their `gh` calls via GH_HOST in code; a forgotten host cannot silently retarget them at github.com. The `gh` commands you run directly are still yours to route: prefix Agent 0's `gh pr view`/`gh issue view`, Step 6's residual body fetch, and the Step 7 submission with `GH_HOST=<host> ` (e.g. `GH_HOST=github.example.com gh api ...`). `gh` defaults to `github.com`, so a dropped host makes a call read from and post to the wrong site's `owner/repo`.
@@ -127,7 +127,7 @@ Based on the parsed `target.type`:
     - If SHAs match **and** model matches **but** `--comment` WAS specified → run the full review anyway. Inform the user: "No new code changes. Running review to post inline comments."
     - If SHAs match **but** model differs → continue. Inform: "Previous review used {cached_model}. Running full review with {{model}} for a second opinion."
 
-  - **The setup calls that do not feed each other go out in ONE response — as separate tool calls, never joined with `&&`/`;` into one Shell command** (high and medium effort — at low, Step 2's rules load is skipped and nothing consumes the comment index, so the batch is whatever calls remain). A joined chain changes the failure semantics — a `pr-context` failure must warn-and-continue, not skip the other two — and merges the `warning:` size lines the paging decisions below read. Once `fetch-pr` has returned (and the incremental check, which reads its report, is decided), the next three commands are mutually independent — `pr-context` (below), `comment-status` (below), and Step 2's rules load — every one a read with no side effect the others observe. Issue all three tool calls in a single response, exactly as Step 3 already requires for the agent fan-out, then read their outputs (paging where a file exceeds one read, and those reads can share a response too). The rules load takes `<remote>/<baseRefName>` — the ref `fetch-pr` just updated; no local-existence probe — **except when the fetch report recorded `baseFetchFailed: true`: drop it from the batch and `git fetch <remote> <baseRefName>` first** (on an unresolvable ref `load-rules` reports "no rules found", indistinguishable from a repo that has none, and the review silently enforces nothing). Measured on a real small-PR run: the stretch from `parse-args` to the first agent launch took **7 minutes of wall clock**, one round-trip at a time, on calls that never needed an order. The only orderings that matter: `fetch-pr` before all of them (it creates the worktree and the plan), and `agent-prompt --roster` after the rules load (the roster bakes the rules into every brief).
+  - **The setup calls that do not feed each other go out in ONE response — as separate tool calls, never joined with `&&`/`;` into one Shell command** (high and medium effort — at low, Step 2's rules load is skipped and nothing consumes the comment index, so the batch is whatever calls remain). A joined chain changes the failure semantics — a `pr-context` failure must warn-and-continue, not skip the other two — and merges the `warning:` size lines the paging decisions below read. Once `fetch-pr` has returned (and the incremental check, which reads its report, is decided), the next three commands are mutually independent — `pr-context` (below), `comment-status` (below), and Step 2's rules load — every one a read with no side effect the others observe. Issue all three tool calls in a single response, exactly as Step 3 already requires for the agent fan-out, then read their outputs (paging where a file exceeds one read, and those reads can share a response too). The rules load takes `<remote>/<baseRefName>` — the ref `fetch-pr` just updated; no local-existence probe — **except when the fetch report recorded `baseFetchFailed: true`: drop it from the batch and `git fetch <remote> <baseRefName>` first** (on an unresolvable ref `load-rules` reports "no rules found", indistinguishable from a repo that has none, and the review silently enforces nothing). Measured on a real small-PR run: the stretch from `parse-args` to the first agent launch took **7 minutes of wall clock**, one round-trip at a time, on calls that never needed an order. The only orderings that matter: `fetch-pr` before all of them (it creates the worktree and the plan), `repo-context` before `agent-prompt --roster` (the roster and every brief bake the manifest's required agents and context blocks, so building them first silently drops the context), and `agent-prompt --roster` after the rules load (the roster bakes the rules into every brief).
 
   - **Fetch PR context** (metadata + already-discussed issues) in one pass:
 
@@ -166,6 +166,8 @@ Based on the parsed `target.type`:
 
   - **Do not install dependencies here.** The install belongs to Agent 7, and `qwen review build-test` runs it — nothing before Agent 7 needs `node_modules`: the diff-reading agents read the diff and grep the worktree's _sources_. Run from here it is a **blocking prefix** to the whole fan-out — measured at ~161 seconds on a cold worktree of this repo, because `npm ci` triggers this project's `prepare` hook, which builds and bundles every workspace; run from inside `build-test` (which sets `QWEN_SKIP_PREPARE=1`) the install skips that wasted full build and overlaps the other agents, still reading. At low effort nothing builds or tests at all, so there is no install on that path; medium and high run Agent 7's `build-test`, which does its own install (with `QWEN_SKIP_PREPARE=1`).
 
+  - **Attach repository context** at medium or high effort, before `agent-prompt --roster` (and therefore before launching agents): run `qwen review repo-context` with absolute `--plan`, `--worktree`, and `--out` paths. See the repository-context step in the Diff capture section below; for same-repo PRs the manifest is read from the trusted merge base recorded by `fetch-pr`.
+
 - **`file`** (e.g., `src/foo.ts`):
   - Run `"${QWEN_CODE_CLI:-qwen}" review capture-local --file <file> --target <filename> --out .qwen/tmp/qwen-review-<filename>-plan.json` to get its changes (`--out` is required — see the capture block below for the full form). An **untracked** target file is captured whole (every line reads as added), which is the right frame for a file that does not exist upstream yet. The path is taken relative to **your** working directory and must be inside the repo.
   - If the plan is empty (the file is tracked and unmodified), read the file and review its current state — see the no-diff branch below
@@ -208,6 +210,17 @@ It writes the diff to `.qwen/tmp/qwen-review-<target>-diff.txt` and emits the sa
 - **`untrackedFiles`** — brand-new files, whose contents no `git diff` would have shown. **Name them in the review's summary.** A local review now reads files the user never staged, and the most common untracked-but-unignored file in the wild is a credentials file (`.env`, a key dump). Nothing is filtered — a hardcoded skip-list would reintroduce exactly the silent-skipping this command exists to end — so the user is told instead, and can re-run with `--no-untracked` or fix their `.gitignore`.
 - **`skippedFiles`** — untracked files that were **not** reviewed, each with a reason: too large, an embedded git repository, a symlink to a directory, a total-budget or file-count cap. **List these under "Not reviewed" in Step 6.** A capture that quietly dropped a file is the bug this command exists to fix; dropping one for a subtler reason would be the same bug wearing a hat.
 
+At **medium or high** effort, for local, file-path, and same-repository PR reviews, attach declarative repository context before `agent-prompt --roster` — the roster and every brief bake this context in, so running it later silently drops the manifest's required agents and guidance (and it is therefore also before launching agents):
+
+```bash
+"${QWEN_CODE_CLI:-qwen}" review repo-context \
+  --plan <absolute-plan-path> \
+  --worktree <absolute-worktree-path> \
+  --out <absolute-context-path>
+```
+
+Use the captured plan's absolute path and its resolved worktree path. The only manifest is strict JSON at `.qwen/review-context.json`; matching rules add generic domains, related files, tests, configurations, roles, and verification boundaries. For PRs the command reads that manifest from the trusted merge base, never from the PR head — a PR whose base never resolved degrades to a `null` artifact rather than reading the head. Local reviews read it from the current worktree. All three arguments must be absolute so later agent working directories cannot change their meaning. A `null` artifact means no manifest or no matching rule and is not an error; a NON-ZERO exit is fail-closed — stop the review and report it, do not continue with the step silently skipped. Skip this command at low effort and in cross-repository lightweight mode, where there is no trusted local tree.
+
 Do **not** hand-type a `git diff` here. Two reasons, and the second is why this is a command and not a prose recipe:
 
 - **The flags.** A user's `color.diff=always` alone makes the diff unparseable, and `diff.mnemonicPrefix` rewrites every path. `capture-local` pins the same ten flags `fetch-pr` pins, from the same constant, so the two capture paths cannot drift into producing diffs that parse differently.
@@ -277,7 +290,7 @@ Use **Step 3A** or **Step 3B** as the topology gate in Step 1 decided. The dimen
 
 ## Step 3A: Dimension fan-out (small source change)
 
-Launch **14 agents** for same-repo **PR** reviews (Agent 1 has three procedural variants 1a/1b/1c, Agent 3 has three checklist slices 3a/3b/3c, and Agent 6 has three persona variants 6a/6b/6c — each variant counts as a separate parallel agent), plus up to 2 optional diff-specialized finders (Agent 8) when the diff's domain calls for them. For cross-repo lightweight **PR** mode launch **12 agents** — skip Agent 7 (Build & Test) and Agent 1c (Cross-file tracer), since there is no local codebase to build, test, or grep. (Agent 8 finders need only the diff, so the up-to-2 option applies in every mode — lightweight and local included.) Lightweight mode also degrades Agents 1a and 1b, whose briefs assume a source tree: tell them they have the diff ONLY — 1a reviews hunks without enclosing-function reads, and 1b, when it cannot find a deleted invariant re-established because the evidence would live outside the diff, reports the candidate at `Confidence: low` and says the re-establishment could not be checked, instead of asserting it is missing. Step 4's verifiers operate under the same limit, so lightweight-mode findings that depend on unseen source must stay low-confidence (terminal-only) rather than becoming public blockers. **Agent 0 (Issue Fidelity) runs only when the review target is a PR** — a local-diff or file-path review has no PR and no linked issue, so skip Agent 0 and launch **13 agents** (Agents 1a–7). Each agent should focus exclusively on its dimension. (Agent counts are maxima: on a diff with no removed or replaced lines, Agent 1b has nothing to audit and is skipped — one fewer agent.)
+Launch **14 agents** for same-repo **PR** reviews (Agent 1 has three procedural variants 1a/1b/1c, Agent 3 has three checklist slices 3a/3b/3c, and Agent 6 has three persona variants 6a/6b/6c — each variant counts as a separate parallel agent), plus up to 2 optional diff-specialized finders (Agent 8) when the diff's domain calls for them. For cross-repo lightweight **PR** mode launch **12 agents** — skip Agent 7 (Build & Test) and Agent 1c (Cross-file tracer), since there is no local codebase to build, test, or grep. (Agent 8 finders need only the diff, so the up-to-2 option applies in every mode — lightweight and local included.) Lightweight mode also degrades Agents 1a and 1b, whose briefs assume a source tree: tell them they have the diff ONLY — 1a reviews hunks without enclosing-function reads, and 1b, when it cannot find a deleted invariant re-established because the evidence would live outside the diff, reports the candidate at `Confidence: low` and says the re-establishment could not be checked, instead of asserting it is missing. Step 4's verifiers operate under the same limit, so lightweight-mode findings that depend on unseen source must stay low-confidence (terminal-only) rather than becoming public blockers. **Agent 0 (Issue Fidelity) runs only when the review target is a PR** — a local-diff or file-path review has no PR and no linked issue, so skip Agent 0 and launch **13 agents** (Agents 1a–7). Each agent should focus exclusively on its dimension. (Agent counts are maxima: on a diff with no removed or replaced lines, Agent 1b has nothing to audit and is skipped — one fewer agent — unless a repository context requires it back, which the `--roster` output below shows.)
 
 **At medium effort, launch the reduced set:** skip the three adversarial personas (Agents 6a/6b/6c) and the Agent 8 diff-specialists, launching Agents 0 (PR targets only), 1a, 1b, 1c, 2, 3a, 3b, 3c, 4, 5, and 7 — **11 agents** for a same-repo PR, **10** for a local-diff or file-path review (no Agent 0), **9** for cross-repo lightweight (drop Agent 7 and 1c too, as above). Everything else about 3A is identical — the briefs, the `working_dir` pin, the whiff check, coverage; medium changes only which dimensions launch, not how any agent runs. **Build the roster with `agent-prompt --roster`** — it reads the effort the plan recorded at Step 1 (`plan.effort`), so on a medium plan it omits 6a/6b/6c from the roster it prints (Agent 8 was never in it) and you launch exactly these agents. `check-coverage` (Step 3D) reads the **same** `plan.effort` and requires exactly these too — no flag to pass, and no way for the roster you launched and the gate that checks it to disagree. (The effort lives in the plan, not in a flag, on purpose: a roster a caller could shrink by omitting a flag is a roster that gets shrunk. If Step 1 recorded no effort, the full roster is required, personas included — the fail-safe, not a medium review.)
 
@@ -295,7 +308,7 @@ It prints one labelled block per required agent — which roles this review owes
 
 **What it prints is short — a few hundred characters — and it is short on purpose.** It names the agent's role, points at the **brief file** the command just wrote, and lists the `read_file` calls for the diff. The brief itself — the dimension, the finding format, the severity definitions, the project rules — is on disk, and the agent reads it, exactly as it reads the diff. That is not an optimisation. A real run asked to paste twelve prompts cut nineteen hundred characters out of one and then talked its way past the check that caught it (measured; DESIGN.md — The paraphrased roster prompt). What you are asked to carry is now small enough that you will carry it. Copy it; do not retype it. (Agent 8, when you launch one, is the exception — its brief is the one you write, so give it `--whole-diff` and append your domain brief.)
 
-**Which of them you must launch is not your call either — `check-coverage` reads the roster out of the plan** (Step 3D). It knows this diff removes lines, so it expects `1b`; it knows there is a worktree, so it expects `1c` and `7`; it knows there is a pull request, so it expects `0`. A run that skips one is a run with a dimension nobody reviewed, and it will be named.
+**Which of them you must launch is not your call either — `check-coverage` reads the roster out of the plan** (Step 3D). It knows this diff removes lines (or a repository context requires the audit back), so it expects `1b`; it knows there is a worktree, so it expects `1c` and `7`; it knows there is a pull request, so it expects `0`. A run that skips one is a run with a dimension nobody reviewed, and it will be named.
 
 Why: **the roles this command does not build are the roles that go missing.** Hand-built launches have handed agents prompts naming no diff file at all, and skipped Agent 0 entirely with no check able to see it (measured; DESIGN.md — The roles nobody launched).
 
@@ -335,7 +348,7 @@ Everything below still governs what the agent is asked to do; the command builds
 
 **Whole-diff agents — launched alongside the chunk agents, in the same response.**
 
-**Their blocks are already in the `--roster` output above — you have them.** Roles there: `0` (PR reviews), `1b` (when the diff removes anything), `1c`, `test-matrix`, `7` (same-repo), and for a **heavy** file three more, one per checklist slice (their blocks are labelled `Invariant agent A|B|C: … — <path>`). Pass each **verbatim**. To rebuild one for a relaunch: `--role <role>` (an invariant agent adds `--file <path>`). `check-coverage` derives the same list from the plan and will name any role that did not run.
+**Their blocks are already in the `--roster` output above — you have them.** Roles there: `0` (PR reviews), `1b` (when the diff removes anything, or a repository context requires it), `1c`, `test-matrix`, `7` (same-repo), and for a **heavy** file three more, one per checklist slice (their blocks are labelled `Invariant agent A|B|C: … — <path>`). Pass each **verbatim**. To rebuild one for a relaunch: `--role <role>` (an invariant agent adds `--file <path>`). `check-coverage` derives the same list from the plan and will name any role that did not run.
 
 Why: **the chunk agents got the diff and these did not.** In one real 3B run every one of them was launched with no diff path — and these own exactly the classes a chunk agent is structurally blind to (measured; DESIGN.md — The whole-diff agents launched without the diff).
 
@@ -527,6 +540,8 @@ Before verification, merge findings that refer to the same issue (same file, sam
 
 Launch verification agents that between them receive **all** non-pre-confirmed findings. **Up to `plan.budget.verifyShard` findings per agent** (8), so `ceil(N / verifyShard)` agents, launched together in one response. It is flat rather than size-derived on purpose: it is a fact about how much a verifier can re-trace before its quality collapses on the tail of its list, which is a property of the verifier and not of the diff. It lives in the budget so it has one home instead of being restated here and in whatever reads it.
 
+**At high effort, the verifiers do not launch alone.** Step 5's first reverse-audit launch — the convergence pair on a 3A plan, round 1's per-chunk fan-out on 3B — goes out **in the same response** as these verifier shards, exactly as every later round's verification rides alongside the next round's auditors (Step 5's pipelined loop; this is its k=0 case). The batch is self-contained: write the shard files **and the cumulative findings file** (Step 5 defines its form — every entry **not yet through Step 4** carries the `— [unverified]` tag; a pre-confirmed `[build]`/`[test]` entry is already through it and enters untagged, exactly as the Step 4 close-out line says) first, then build both prompt sets from them, then fire every agent together. Nothing here waits on a verdict: the tagged state is exactly what Step 5's merge rules are built around. A real run has held its round-1 auditor 22 minutes behind a verifier whose verdicts that auditor never needed, while a sibling run of the same skill, the same day, launched the two together (measured; DESIGN.md — The 22-minute serial first verification). At medium there is no reverse audit, so the verifiers launch alone; a Step 4 with no shards — zero findings, or only pre-confirmed ones — has no verifiers, so the first reverse-audit launch goes out alone, on time, its findings file carrying whatever entries exist (empty is fine; the builder accepts it and tells the auditor so).
+
 A single verifier for every finding was cheaper, but on a large review it becomes the most context-starved agent in the pipeline: it must re-read code for each of 30-60 findings inside one context window, and its quality collapses on the tail of the list. Sharding keeps each verifier's job small; the cost is still far below one-agent-per-finding.
 
 **Do not write the verifier's prompt. Ask for it — and hand it the shard's findings so it prints the whole block:**
@@ -540,7 +555,7 @@ Write this shard's findings to a file — each with its file, line, issue and fa
   [--round <k> — on a repeat verification round (new findings arriving from Step 5), so the label and the record key are the CLI's, not yours]
 ```
 
-**`--findings` is required for this role — the command refuses without it**, because a bare block is a block you would assemble by hand, and hand-assembly is the one step this skill measured drifting. **Paste what it prints verbatim — the whole block, findings and all. Do not prepend, append, reword, or add a shard number** (a repeat round passes `--round <k>` and the CLI bakes the label in). Hand-prepending is exactly where the prompt has twice been paraphrased and the verdict capped for it (measured; DESIGN.md — The hand-assembled verifier prompt). The command records the exact block it prints — findings included, keyed per findings digest — so a launch that drops or rewrites the findings matches no record. In worktree mode the verifier's `working_dir` is the PR worktree (same rule as Step 3), so its reads and re-checks resolve against the PR's code.
+**`--findings` is required for this role — the command refuses without it**, because a bare block is a block you would assemble by hand, and hand-assembly is the one step this skill measured drifting. **Paste what it prints verbatim — the whole block. Do not prepend, append, reword, or add a shard number** (a repeat round passes `--round <k>` and the CLI bakes the label in). Hand-prepending is exactly where the prompt has twice been paraphrased and the verdict capped for it (measured; DESIGN.md — The hand-assembled verifier prompt). The command copies the findings list to a digest-named file the block points at and records the exact block it prints — pointer included, keyed per findings digest — so a launch that drops the read matches no record, and the block stays a few hundred characters however long the list is. In worktree mode the verifier's `working_dir` is the PR worktree (same rule as Step 3), so its reads and re-checks resolve against the PR's code.
 
 The brief holds the method the orchestrator used to spell out here and that a paraphrase kept dropping: trace the failure scenario through the real code rather than voting on the finding's prose; engage the diff's own documented intent before calling a documented change a regression (the rule a run skipped when it auto-posted a false "leaks tokens" Critical); the one-way, quote-the-contradiction bar on **rejecting a Critical**; the **falsify-not-verify asymmetry** governing every rejection — a rejection claims direct counter-evidence, and neither "I could not verify it" nor "its evidence is somewhere I did not look" is one (the verifier is told to go read the claimed source first, and to floor at a low-confidence downgrade when it is genuinely unreachable); and — when a finding's claim is **runnable** and the repo has a fast unit harness (`vitest`/`jest`/`pytest`) — the option to **write and run a probe** and let the observed behaviour, not a re-reading, settle the verdict. That last one earns its place: the strongest model has read a live double-execute as correct until a probe ran the path and settled it (measured; DESIGN.md — The double-execute the probe caught). The brief makes the probe evidence rather than theatre with two hard rules — a mandatory self-check that the probe **flips** between buggy and correct, and leaving the tree exactly as found (no probe file, no fix edit, reaches the diff or build). A finding a probe confirmed carries `Source: [probe]`, which `compose-review` treats as deterministic (a run produced it), exactly like `[build]`/`[test]`. Read the brief to know what a verdict means; do not re-derive it here.
 
@@ -571,27 +586,39 @@ After verification, identify **confirmed** findings that describe the **same typ
 
 3. If the same pattern has more than 5 occurrences and severity is **not** Critical, list the first 3 locations plus "and N more locations" **in the text you show the reader**. That is a display rule, not a data rule: keep the complete `(path, anchor, line)` list internally, because Step 7 expands the aggregate into one resolver request per location and an anchor you truncated away is a comment that never gets posted. For **Critical** patterns, always list all locations in the text as well — every instance matters.
 
-All confirmed findings (aggregated or standalone) proceed to Step 5.
+All findings (aggregated or standalone) proceed to Step 5 — confirmed ones untagged, those still under verification carrying the `— [unverified]` tag Step 5's merge rules govern.
 
 ## Step 5: Iterative reverse audit (high effort only)
 
 **Medium skips this step.** A balanced (medium) review stops after Step 4: it goes straight to Step 6, composes the report and verdict from the verified findings, and does not run the reverse audit — which is why `compose-review` caps a clean medium review at `Comment` (Step 6) and why medium never writes the incremental cache or posts (`--comment` forces high). Everything below is high effort only.
 
-After aggregation, run reverse audit **iteratively**. Each round receives the cumulative confirmed findings from all prior rounds, so successive rounds focus on whatever the previous round missed.
+After deduplication, run reverse audit **iteratively** — the first launch rides with the Step 4 verifiers (Step 4 names this), so aggregation and the audit overlap rather than queue. Each round receives the cumulative reported findings from all prior rounds, so successive rounds focus on whatever the previous round missed.
 
 **Why iterative**: A single pass leaves whatever the reverse audit agent itself missed. Each round narrows what's left to discover, until diminishing returns terminate the loop.
 
 **Each round is a fan-out, not one agent.**
 
-- **Small diffs (Step 3A path):** one reverse audit agent per round, reading the whole diff.
+- **Small diffs (Step 3A path):** one reverse audit agent per round, reading the whole diff — except rounds 1 and 2, which are **the convergence pair** and launch together (below).
 - **Large diffs (Step 3B path):** one reverse audit agent **per chunk** per round, launched together in a single response. A single agent asked to re-read a 5 800-line diff with a growing finding list appended is the most context-starved agent in the pipeline — precisely on the PRs where the reverse audit matters most. Each per-chunk auditor gets the same territory as its Step 3B counterpart, plus the cumulative finding list for the **whole** diff (so it knows what is already covered elsewhere).
+- **The builder schedules the 3B fan-out; you do not.** Rounds 1 and 2 audit every chunk — they are what establishes each territory's record. From round 3 on, `--all-chunks` reads the harness transcripts and **retires** any chunk whose own last two audits were substantively dry (the receipt named what it examined AND the transcript shows the diff was opened): a retired chunk is cold-checked on alternating rounds instead of every round, and a cold check that yields anything returns it to every-round auditing. The savings land on the odd rounds — every retired chunk cold-checks together on the even ones, so an even round's fan-out is unchanged; expect rounds 3 and 5 to shrink, not round 4. The blocks it prints are the round; the `retirement:` note after the `end of round` line names each skipped chunk and its certificate — relay that note in your narration, and do not hand-build an auditor for a chunk the builder skipped. Why, measured: on a real 6-chunk run, two chunks were dry in **all five rounds** — a third of the loop's auditors re-certifying territories that had already converged, while the three hot chunks were where every finding came from. Attention follows evidence; the certificate a retired chunk holds (two consecutive substantive dry audits) is exactly the one the whole loop used to end on.
+
+**The convergence pair (3A only).** Rounds 1 and 2 launch **in one response** — together with Step 4's verifier shards (Step 4 names this) — each built by its own `agent-prompt` call: `--round 1` and `--round 2`, the **same** `--findings` file. This is not a loosened criterion; it is the serial shape's own arithmetic made concurrent: a dry round leaves the cumulative list unchanged, so round 2's launch input was already substantively identical to round 1's — the same entries, at most with verification tags the merge had cleared in between — an independent rerun that the serial shape bought with a full round of wall clock, and that one budget-gated run could no longer afford at all, shipping a capped verdict for want of a second dry audit it had time to run in parallel but not in series (measured; DESIGN.md — The serial convergence pair). What the two-consecutive-dry criterion demands is unchanged: two independent, substantively-dry audits of the whole diff. The one delta the pair does introduce is the same one-round suppression window the pipelined loop already accepts (the merge bullet in the termination rules): the round-2 member audits with entries a verifier may be rejecting mid-flight still on its do-not-re-report list.
+
+- **Both members dry** (substantive receipts, per the termination rules): the audit has converged. Wait for the riding verifiers' verdicts, apply the final merge, and proceed to Step 6.
+- **Either member reports findings**: the pair is one reporting round. Its members could not see each other, so first dedup the pair against itself (same defect, same location, same root cause keeps one, at the highest severity), merge into the cumulative list, and continue serially: the pair's verifiers ride with round 3's auditor — verify builds over the **deduped union**, sharded per Step 4's `verifyShard` exactly as any reporting round's findings are, **every shard passed as `--round 2`** (the pair's later label; never one build per member — the dedup already merged cross-member findings, and a per-member split would put one entry in front of two verifiers) — and convergence now needs two consecutive dry rounds from round 3 on. A dry member of a reporting pair is **not** carried forward as half of that evidence — its dry predates the other member's findings entering the list. One exception, and it is the retroactively-dry rule below, not a third rule: if a later merge retires the pair in full — every finding from both members rejected — the pair counts as the dry predecessor, and round 3's dry return ends the loop.
+- The substantive-return check applies per member, relaunch-once included. A twice-whiffed member makes the pair not dry — silence is not convergence evidence — and its scope joins the outstanding-whiffed-scopes list exactly as for any round.
+- If the round-2 build is refused by the deadline gate (exit 4), launch round 1 alone and treat the refusal as the budget stop it is (the termination rules below). Defensive only: under the gate's pricing a paired round 2 admits strictly cheaper than the round 1 just admitted, so this cannot currently fire — the rule exists so a future pricing change degrades to the serial shape instead of to a guess.
+
+On 3B the pair does not apply: rounds already fan out per chunk, rounds 1 and 2 are what establishes each chunk's record, and the retirement schedule is the convergence ledger there. What 3B shares is the launch coupling: its round 1 also rides with the Step 4 verifiers.
 
 **Do not write the reverse auditor's prompt. Ask for it — and hand it the findings so far so it prints the whole block:**
 
-Write **the cumulative list of every confirmed finding so far** (Steps 3-4 plus all prior rounds) to a file, so the auditor hunts what is not already on it. An early round on a clean review may have nothing confirmed yet — pass the file anyway (empty is fine; the command tells the auditor so). Then:
+Write **the cumulative list of every finding reported so far** (Steps 3-4 plus all prior rounds — verified or still under verification; entries a verifier rejected are removed) to a file, so the auditor hunts what is not already on it. **Every entry not yet through Step 4 carries a trailing `— [unverified]` tag** — added at the merge that admits it, removed by the merge after its verdict lands. An early round on a clean review may have nothing confirmed yet — pass the file anyway (empty is fine; the command tells the auditor so). Then:
 
 ```bash
-# Step 3A (small diff): one auditor per round, the whole diff.
+# Step 3A (small diff): one auditor per round, the whole diff. The convergence
+# pair is two of these builds — `--round 1` and `--round 2`, same --findings —
+# launched together (the CLI keys the two records apart by round).
 "${QWEN_CODE_CLI:-qwen}" review agent-prompt --plan <the plan report from Step 1> --role reverse-audit \
   --findings <the cumulative findings file> \
   --round <k> \
@@ -607,7 +634,7 @@ Write **the cumulative list of every confirmed finding so far** (Steps 3-4 plus
 
 Redirect and `read_file` it paged, exactly as with `--roster`: one labelled block per chunk, numbered `auditor k of N`, closed by an `end of round` line — launch one agent per block, verbatim. **Never sample the builder's output** (`| head`, `| tail`, a truncated read): the text IS the deliverable, and sampling it has cost a full repair round (measured; DESIGN.md — The head-sampled roster). To rebuild a single auditor after a gap: `--chunk <id>` in place of `--all-chunks`, keeping the same `--findings`, `--rules` and `--round` — a rebuild that drops one of them is keyed as a different launch and matches no requirement.
 
-**`--findings` is required for this role — the command refuses without it** (an early round with nothing confirmed yet passes an empty file; the command tells the auditor so). **Pass the round as `--round <k>`** — the CLI bakes it into the identity line and the record key, so two rounds are two receipts even when the findings list has not changed between them. **Paste what it prints verbatim — the whole block. Do not write a round label yourself**: hand-written labels and hand-written launches have each cost a repair round or a capped verdict (measured; DESIGN.md — The hand-written reverse-audit launches). The command records the exact block it prints — findings included, keyed per round's findings digest — so a launch that drops the confirmed list matches no record. It also gives each auditor its diff reads — the whole plan in 3A, one chunk's range in 3B (a Step 3B auditor handed the whole 5 800-line diff is the most context-starved agent in the pipeline, on exactly the PRs where the reverse audit matters most). In worktree mode its `working_dir` is the PR worktree.
+**`--findings` is required for this role — the command refuses without it** (an early round with nothing confirmed yet passes an empty file; the command tells the auditor so). **Pass the round as `--round <k>`** — the CLI bakes it into the identity line and the record key, so two rounds are two receipts even when the findings list has not changed between them. **Paste what it prints verbatim — the whole block. Do not write a round label yourself**: hand-written labels and hand-written launches have each cost a repair round or a capped verdict (measured; DESIGN.md — The hand-written reverse-audit launches). The command copies the findings list to a digest-named file the block points at and records the exact block it prints — pointer included, keyed per round's findings digest — so a launch that drops the read matches no record, and the block stays a few hundred characters however long the cumulative list grows: you never re-emit the list, only the pointer. It also gives each auditor its diff reads — the whole plan in 3A, one chunk's range in 3B (a Step 3B auditor handed the whole 5 800-line diff is the most context-starved agent in the pipeline, on exactly the PRs where the reverse audit matters most). In worktree mode its `working_dir` is the PR worktree.
 
 The brief holds what the auditor is for: hunt only the **gaps** no prior agent caught, report only Critical or Suggestion, apply the Exclusion Criteria, and end with a substantive receipt (`No issues found — <what it re-examined>`) — a bare "No issues found." fails the substantive-return check below and triggers the one relaunch.
 
@@ -616,16 +643,19 @@ The brief holds what the auditor is for: hunt only the **gaps** no prior agent c
 - **The substantive-return check applies to every round** — the same rule as Step 3's, enforced here, after each round returns: a bare `No issues found.` with no evidence of what the agent re-examined is a whiff, not a clean bill. Relaunch that agent once, within the round. If the relaunch is also bare, do not spin — take it, but its scope counts as **not audited**: track it in an outstanding-whiffed-scopes list, and clear it only when a later round's agent for that scope returns substantively.
 - A round is **dry** only when _every_ agent in it returned zero new findings **with** the evidence-bearing receipt (`No issues found — <what it re-examined>`). A round containing a twice-whiffed agent is **not dry** — silence is not convergence evidence — so the loop continues (the hard cap below still bounds it).
 - **When the loop ends with any scope still outstanding** (by cap, or by dry rounds elsewhere), terminal prose is not enough: add one self-explained entry per scope to `unreviewedDimensions` — e.g. `reverse audit of chunk 3 — the auditor returned nothing substantive twice` — so compose-review serializes it and caps a would-be Approve at `COMMENT`. The primary Step 3 pass did read that scope (its receipt stands), but this run's contract includes the reverse audit, and a verdict must not silently claim an audit that never ran.
-- Stop after **two consecutive dry rounds**. One dry round is not evidence of convergence: on PR #6457 the review returned "no blockers" twice and the very next round surfaced five Criticals, three of them in code that had been in the diff since the first commit. A single lazy agent must not be able to end the loop.
-- Stop after **5 rounds** regardless (hard cap), and say so in the output rather than implying convergence.
-- New findings from each round are merged into the cumulative list **before** the next round begins, so each round sees an updated baseline.
-- **The round builder is also the loop's clock.** In a time-budgeted run (CI exports `QWEN_REVIEW_DEADLINE_EPOCH`; a local run normally has no deadline and is untouched), `agent-prompt --role reverse-audit` refuses to build a round that no longer fits: the remaining time must cover **the round itself** (estimated from the previous round's measured cost — the builder stamps each admission — or a conservative constant for round 1) **plus** the reserve kept for its verification, compose-review and submission. On refusal it prints a `BUDGET:` line to stderr and exits **4**. That refusal is a termination rule, not an error — do not rebuild the round, do not relaunch auditors, and do not retry the command. The builder also records a budget-stop marker that `compose-review` reads directly, so the verdict is capped whether or not you relay anything; still add the exact entry the message names (`reverse audit — stopped before round <k> by the review time budget`) to `unreviewedDimensions` so the terminal report and the body agree, and proceed to Step 6 with the findings already confirmed — spending what remains only on verifying findings already in hand, composing, and submitting. Why this exists, measured: a +1699-line PR's CI review ran the audit loop to the 5-round cap, spent 3.5 of its 4 budgeted hours there, and was killed by the outer CI timeout while round 5's findings were still being verified — every confirmed finding died with it. A review that stops on the budget still reports everything it proved; one that runs past it reports nothing.
+- Stop after **two consecutive dry rounds** (the 3A criterion — one auditor, so round-dry and territory-dry are the same thing). One dry round is not evidence of convergence: on PR #6457 the review returned "no blockers" twice and the very next round surfaced five Criticals, three of them in code that had been in the diff since the first commit. A single lazy agent must not be able to end the loop. A dry convergence pair satisfies this rule in one launch — its two members are exactly the two independent audits the rule demands; what the pair removes is the wall clock between them, not either audit. When the loop ends on this rule, the last reporting round's verifiers are already in flight (they launched with the next round's auditors) — wait for their verdicts and apply them in the final merge before Step 6.
+- **On the 3B path the builder is also the convergence ledger**: when every chunk holds two consecutive substantive dry audits and none is due a cold check, `--all-chunks` builds nothing, prints a `CONVERGED` explanation to stderr and exits **5**. Stop the loop and proceed to Step 6 — this is a **clean** convergence, not a gap: no `unreviewedDimensions` entry is owed, because each chunk holds the two-dry rule's evidence chunk by chunk — two consecutive dry **audits**, though not necessarily in consecutive rounds (a chunk dry in rounds 1 and 2 skips round 3 and cold-checks dry in round 4, holding rounds 2 and 4). Exit 5 is mainly the CLI enforcing the stop the two-dry-rounds rule above used to leave to orchestrator discretion; the new savings are the odd-round skips and a round-5 convergence. (It cannot owe a verification launch: a reporting round makes its chunk hot, so every verifier launched with a later round that did run.)
+- Stop after **5 rounds** regardless (hard cap), and say so in the output rather than implying convergence. If round 5 reported findings, its verifiers have NOT launched — that launch rides the next round's build, which the cap forbids — so launch them alone before Step 6 and wait for their verdicts; the tag backstop below (and `compose-review`'s machine-read of it) is what catches a miss.
+- Findings **reported** by each round are merged into the cumulative list **before** the next round begins, so each round sees an updated baseline. **The merge runs unconditionally — before every round build and before Step 6, whether or not the previous round reported findings**: under the pipelined loop below, round _k_'s verdicts land during round _k+1_, and every termination mode (two dry rounds, CONVERGED, budget stop, the 5-round cap) can arrive with the final rounds dry — a merge keyed to "some round reported something" would never apply the last verdicts that landed. Each merge applies every Step 4 verdict that has landed: confirmed removes the tag, rejected removes the entry. Verification status does not gate the merge — the list exists so auditors do not re-report what is already filed, and an unverified entry serves that purpose exactly as well as a confirmed one. The trade, named: an entry a verifier later rejects will have suppressed one round of rediscovery in its neighbourhood — the window is one round in one location, and the 5-round cap still bounds the loop. The tag is what keeps this mechanical rather than remembered: an entry enters the list tagged `— [unverified]`; the merge after its Step 4 verdict removes the tag (confirmed) or the entry (rejected). Step 6's confirmed-only read then has something to key on — anything still tagged is left out of the confirmed set — instead of a memory of which round each entry arrived in. The tag rides inside the findings file, which is hashed into the record key and copied to the digest-named list file each block points at — so a launch that drops the pointer matches no record, and the delivery floor counts the agent's read of that file exactly as it counts the brief's.
+- **A reporting round whose every finding the verifier rejected is retroactively dry.** The merge already removes a rejected entry from the cumulative list; from the merge that applies the last of a round's rejections, the round also stops counting as a reporting round, and the two-consecutive-dry rule reads rounds' **effective** status. Rejected means rejected — an entry confirmed at low confidence keeps its round a reporting round. Under the pipelined loop a round's verdicts land while the next round runs, so the upgrade usually arrives one round late, and that is still one round saved: a measured run held round 2 dry, watched round 3's sole finding be rejected, and then ran rounds 4 **and 5** — round 4's dry return plus the rejection already in hand was the two-dry evidence, and the fifth round audited nothing the loop had not already answered (measured; DESIGN.md — The rounds a rejected finding bought (PR #8353)). The rule leans on the rejection bar the verifier's brief already enforces — a rejection claims direct counter-evidence, never mere unverifiability — so a round retired by rejections is retired on evidence, not on doubt. **It pairs forward only, and is consulted when a round returns**: on round _k_'s dry return, first apply every verdict that has landed (the unconditional merge — the retirement takes effect at this application, not at some earlier moment), then end the loop if round _k−1_ was dry or is now retired. Round _k−1_ counts **launches, not labels**: the convergence pair is one round here — a pair member is never round _k−1_ on its own (the pair bullet's not-carried-forward rule stands), and a reporting pair retires only when every finding from **both** members is rejected. The upgrade never ends the loop by itself — a preceding dry round plus a freshly-retired round stops nothing while the next round is already in flight: that round was launched, and its return is taken whatever it says, because a launched auditor can be carrying a real Critical. This is the measured shape (round 4's return is where the loop closes under this rule — the measured run, which predates it, ran a fifth round) and the only pairing licensed here. It softens nothing else: a whiffed scope stays not-audited whatever the verdicts say, and on 3B the retirement ledger's per-chunk certificates are untouched — this rule reads at the level the round counter reads.
+- **Verification rides alongside the next round, not ahead of it.** When round _k_ returns with new findings, one response launches BOTH round _k_'s verifiers (Step 4, `--role verify --round k` with that round's new findings) AND round _k+1_'s auditors — build the two prompt sets first, then fire every agent together, exactly as Step 3 fans out. (Step 4's initial verification is the k=0 case of the same rule: its shards ride with the first reverse-audit launch — the convergence pair on 3A, round 1's fan-out on 3B.) The serial shape (audit → wait for verification → next round) spent 5-8 minutes per round waiting for verifiers whose results the next round's auditors never needed. Two orderings still hold: the **last** round's verification must complete before Step 6 (that ordering is what keeps unverified entries out of the report and the PR, backed by the tag backstop at the end of this step — which `compose-review` machine-checks from `findingsPath`, Step 6), and a rejected finding leaves the cumulative list at the next merge.
+- **The round builder is also the loop's clock.** In a time-budgeted run (CI exports `QWEN_REVIEW_DEADLINE_EPOCH`; a local run normally has no deadline and is untouched), `agent-prompt --role reverse-audit` refuses to build a round that no longer fits: the remaining time must cover **the round itself** (estimated from the costliest round's measured cost so far — a repair relaunch can make one round the expensive one, and the gate prices the worst case the run has proved, not the newest dip — or a conservative constant for round 1) **plus** the reserve kept for its verification, compose-review and submission. On refusal it prints a `BUDGET:` line to stderr and exits **4**. That refusal is a termination rule, not an error — do not rebuild the round, do not relaunch auditors, and do not retry the command. The builder also records a budget-stop marker that `compose-review` reads directly, so the verdict is capped whether or not you relay anything; still add the exact entry the message names (`reverse audit — stopped before round <k> by the review time budget`) to `unreviewedDimensions` so the terminal report and the body agree, and proceed to Step 6 with the findings already confirmed — spending what remains only on verifying findings already in hand, composing, and submitting. Why this exists, measured: a +1699-line PR's CI review ran the audit loop to the 5-round cap, spent 3.5 of its 4 budgeted hours there, and was killed by the outer CI timeout while round 5's findings were still being verified — every confirmed finding died with it. A review that stops on the budget still reports everything it proved; one that runs past it reports nothing.
 
 **Reverse audit findings go through Step 4 verification like any other finding.** They used to skip it on the theory that the auditor "already has full context." That premise fails exactly when the diff is large — the auditor with the least room to think was the one whose output nobody checked.
 
-If the very first round finds nothing, that is a good sign — but run the second round anyway before believing it.
+If both members of the convergence pair find nothing, the second opinion has already run — that is what the pair is for. (On 3B, a first dry round is still only half the evidence: the second round runs before believing it.)
 
-All confirmed findings (from aggregation + all reverse audit rounds) proceed to Step 6.
+All confirmed findings (from aggregation + all reverse audit rounds) proceed to Step 6. An entry still tagged `— [unverified]` when the loop ends is not among them: the final merge before Step 6 applies every verdict that landed, so a tag that survives means the verifier never ruled on that entry — relaunch it once, and if the tag still survives, add `reverse audit finding <id> — the verifier never ruled on it` to `unreviewedDimensions` (which caps a would-be Approve at COMMENT) and treat that entry as low-confidence (terminal-only, "Needs Human Review"), never as confirmed. This is also machine-checked: Step 6 passes this file to `compose-review` as `findingsPath`, and any tag still in it there caps the verdict at Comment and says so in the body — a tag you forgot to exclude cannot ride an Approve or a Request changes out the door.
 
 ## Step 6: Present findings
 
@@ -735,7 +765,7 @@ Run it on a same-repo **PR** review only. A **local** or **file** review has no
 
 - A **path** the Test Plan names that is in neither the diff nor the tree at the reviewed commit is `contradicted` — the sentence describes a commit that is not this one. A path that exists but the diff does not touch is fine: "ran the existing suite at X" is a legitimate thing to write.
 - An **npm script** the Test Plan tells the reviewer to run that no workspace manifest defines is `contradicted` — the Test Plan cannot be followed. A command this review actually ran is settled by its exit code instead, which outranks the manifest lookup.
-- A **test count** that differs from what this review's suites reported is `differs`, and **never** `contradicted`. A count is only falsifiable against the suite the author meant, and a Test Plan almost never says which one; `build-test` runs the subset of workspaces the diff touched, which is frequently a different set. Ruling "471 ≠ 472, contradiction" off that mismatch would file a defect on arithmetic the command cannot do. Both numbers are reported side by side, and the reader decides.
+- A **test count** that differs from what this review's suites reported is `differs`, and **never** `contradicted`. A count is only falsifiable against the suite the author meant, and a Test Plan almost never says which one; `build-test` runs the workspaces the diff touches plus the workspaces that depend on them, which is frequently a different set. Ruling "471 ≠ 472, contradiction" off that mismatch would file a defect on arithmetic the command cannot do. Both numbers are reported side by side, and the reader decides.
 
 **None of it blocks, and none of it caps.** A Test Plan defect is not a code defect — the diff is unaffected — and the verdict is about the code. The notes are disclosed in the body on every event including Approve, the same disclosed-but-not-capping treatment a deferred checker gets, and for the same reason: an author cannot fix "you wrote a sentence I could not check", so it must never become a permanent cap.
 
@@ -774,7 +804,7 @@ Each entry carries `id` (unique — outcomes and resolved anchors both join on i
 # description to pick the body language, and that gh call must hit the PR's host.
 ```
 
-It prints a `Verdict:` line to stderr. **That line is the verdict — print it, and nothing else.** It writes nothing, posts nothing, and needs no authorisation, so run it on every verified review — **high and medium** — whether or not you are going to post. The state file is the same one Step 7 uses (see there for every field): your findings and the states you established — the body Criticals, the discarded suggestions, the `cannot tell` blockers, the unreviewed dimensions, the `planPath`, the presubmit flags, the model id. It does **not** take the coverage or the inline counts, and it **refuses** a state JSON carrying `criticalsInline`/`suggestionsInline`. It derives coverage from the harness's transcripts, and it **counts** the inline findings from `--comments`: write the drafted inline comments to that file first — the same `[{path, line, body, …}]` array the Step 7 payload will carry, each body opening with its `**[Critical]**`/`**[Suggestion]**` marker; a review with nothing anchored inline passes a file containing `[]`. A report-only run has read Approve over a blocker its own report listed (measured; DESIGN.md — The Approve over a relocated Critical); counted from the draft, that finding cannot fall out of the computation. **If the comment set changes after composing** — an anchor fails to resolve, a finding relocates to the body, a comment is dropped — update the comments file (and the state), and run `compose-review` again: the verdict must be computed from the set you actually post, and Step 7's `submit` recounts from the payload to hold you to it.
+It prints a `Verdict:` line to stderr. **That line is the verdict — print it, and nothing else.** It writes nothing, posts nothing, and needs no authorisation, so run it on every verified review — **high and medium** — whether or not you are going to post. The state file is the same one Step 7 uses (see there for every field): your findings and the states you established — the body Criticals, the discarded suggestions, the `cannot tell` blockers, the unreviewed dimensions, the `planPath`, the `findingsPath` (high effort — the cumulative reverse-audit findings file, for the `— [unverified]` check), the presubmit flags, the model id. It does **not** take the coverage or the inline counts, and it **refuses** a state JSON carrying `criticalsInline`/`suggestionsInline`. It derives coverage from the harness's transcripts, and it **counts** the inline findings from `--comments`: write the drafted inline comments to that file first — the same `[{path, line, body, …}]` array the Step 7 payload will carry, each body opening with its `**[Critical]**`/`**[Suggestion]**` marker; a review with nothing anchored inline passes a file containing `[]`. A report-only run has read Approve over a blocker its own report listed (measured; DESIGN.md — The Approve over a relocated Critical); counted from the draft, that finding cannot fall out of the computation. **If the comment set changes after composing** — an anchor fails to resolve, a finding relocates to the body, a comment is dropped — update the comments file (and the state), and run `compose-review` again: the verdict must be computed from the set you actually post, and Step 7's `submit` recounts from the payload to hold you to it.
 
 **It also proves Step 4 and Step 5 ran — the way `check-coverage` proves Step 3.** `check-coverage` runs at Step 3D, before verify and reverse audit exist, so its roster cannot reach them; and their count is not in the plan (verify shards on the finding count, the reverse audit loops until it goes dry), so there is no exact roster to check. What there is is a floor, and `compose-review` — which runs at **high and medium** effort — checks it from the same transcripts: at least one **verifier** ran and opened its brief (whenever the review posts findings), and, **at high effort**, at least one **reverse auditor** did. A **medium** review runs no reverse audit by design, so that floor is legitimately unmet and `compose-review` caps a would-be Approve to **Comment** — the honest ceiling for a balanced pass that never looked twice for what Step 3 missed; a verified Critical still yields **Request changes**, so medium flags real blockers, it just never certifies Approve (only high does). At high effort a reverse audit **skipped wholesale**, or run with agents that never opened their brief, is named in `unreviewedDimensions` and caps the verdict, exactly like a dimension nobody reviewed. You do not pass a flag for this and cannot turn it off: the proof is the intersection of the prompt the CLI recorded building (`--role verify` / `--role reverse-audit`) and the harness's transcript of an agent that ran it. So a run cannot approve a diff by skipping the pass that looks for what Step 3 missed — the highest-value catch here is a clean, zero-finding review that never ran its reverse audit.
 
@@ -1009,7 +1039,7 @@ Then reference each finding's `assets` URLs in its inline comment body as `![evi
 - **Immutable references** — files land on `pr-assets/<pr>-review` of the assets repo (the manual `pr-assets/<PR>-verify` convention, suffixed so the two flows never collide), and every URL is pinned to the **commit**, not the branch, so a posted comment's evidence cannot be changed from under it. Content-hashed remote names make a re-run idempotent rather than accumulative.
 - **Auditable** — the manifest names every file pushed and the commit they landed on, next to the other review artifacts, where Step 9's sweep and a curious human can find it.
 
-**What you must still judge: the image's content.** The command can check extensions and sizes; it cannot see that a terminal screenshot has an env dump in the scrollback. Publish only evidence the review itself produced — a capture of a rendering the verification ran, a before/after the A/B produced — and never a capture of the user's own terminal or editor. When in doubt, keep the finding's evidence as prose and local paths.
+**What you must still judge: the image's content.** The command checks extensions, sizes and image magic bytes (a shell script named `evidence.png` refuses on content) — that catches mislabeled or corrupted captures, not a deliberate payload riding behind a real image header; it cannot see that a terminal screenshot has an env dump in the scrollback. Publish only evidence the review itself produced — a capture of a rendering the verification ran, a before/after the A/B produced — and never a capture of the user's own terminal or editor. When in doubt, keep the finding's evidence as prose and local paths.
 
 **Build the review JSON** with `write_file` to create `.qwen/tmp/qwen-review-{target}-review.json`. It carries three things and **no verdict** — `submit` computes the event and body itself, from the `state` you hand it and the comments you attach, and **refuses a payload that carries `event` or `body`** (a run that skipped the computation and typed its own Approve is exactly what that refusal stops). Every high-confidence Critical or Suggestion finding that maps to a diff line is an entry in `comments`:
 
@@ -1041,6 +1071,7 @@ Then reference each finding's `assets` URLs in its inline comment body as `![evi
 - `suggestionsDiscarded` — Suggestions whose anchors failed offline validation or the 422 recovery. They still count toward `S`: dropping every anchor must never upgrade the verdict.
 - `cannotTellCriticals` — one line per existing PR Critical whose Step 6 re-check landed on `cannot tell` (location + what could not be determined).
 - `planPath` — the plan report from Step 1. **Coverage is not an input.** `submit` recomputes it from the harness's transcripts, because a `coverage` object you typed is a document you write — and the last time this skill trusted one, it was fabricated.
+- `findingsPath` — the cumulative reverse-audit findings file at loop end (high effort only): the same file every round's `--findings` received, after the final merge. `compose-review` reads it for surviving `— [unverified]` tags — a tag at compose time is an entry no verifier ruled on, and it caps the verdict at Comment, disclosed in the body. Omit at medium and low; they run no Step 5.
 - `uncoverableChunks` / `unreviewedDimensions` — any _additional_ not-reviewed scope from Step 3 (e.g. `"chunk 5 (src/big.min.js)"`, `"security"`). A bare dimension name gets the standard whiffed-agent explanation; an entry carrying its own reason after an em-dash (`"issue-fidelity — linked issue #123 could not be fetched"`) is rendered verbatim.
 - `contextUnavailable` — the Step 1 state.
 - `presubmit` — `downgradeApprove` / `downgradeRequestChanges` / `downgradeReasons` from the presubmit report. Do not apply a downgrade by hand; hand it over and let `submit` own the semantics (a Suggestion-only review is already `COMMENT`, so nothing is downgraded and no "downgraded from Approve" sentence is emitted).
@@ -1088,6 +1119,8 @@ Clean up the JSON files in Step 9.
 
 ## Step 8: Save review report and cache
 
+**Steps 8 and 9 are four responses, not ten.** Every command in this tail is cheap; the model turns between them are not — and this stretch runs after the verdict is already computed (and, on a posting run, already posted), so every extra turn is pure latency to the reader. Measured across six CI reviews, the one-command-per-turn shape cost 4–6 minutes after submission, before the artifact-root fumbling below stretched it further (measured; DESIGN.md — The one-command-per-turn tail). The dependency chain is short, so batch to it, issuing each group as separate tool calls in one response exactly as the Step 1 setup batch does: (1) `cost-ledger` plus the `read_file` of the findings artifact — everything the report's content still needs; (2) write the Markdown report; (3) `save-artifact` and the incremental-cache write, when this run owes one — both read only files that already exist, and neither reads the other; (4) `record_artifact` (its `workspacePath` comes from save-artifact's stdout, which is why it is not in group 3) together with Step 9's `cleanup`. **Group (4) fires only after group (3) succeeded**: `cleanup` deletes the `.qwen/tmp` side files `save-artifact` reads, so a failed group (3) is resolved first — the JSON helper is fail-closed (below), and destroying its only inputs would convert a recoverable failure into a permanent one. When it **cannot** be resolved (a malformed input, a disk error — synthesizing a replacement is forbidden by the same fail-closed rule), the run still ends properly: disclose the failure, skip `record_artifact` (there is nothing valid to register), copy the findings/composed inputs beside the Markdown report so the artifact stays rebuildable, and **still run `cleanup`** — Step 9's bypass audit and the completion line are never gated behind a success that will not come. A group's remaining reads may join its response; nothing here needs a turn of its own. Lower tiers drop the commands they never owed (low saves no artifact and writes no cache), not the batching.
+
 ### Report persistence
 
 Save the review results to a Markdown file for future reference:
@@ -1112,12 +1145,13 @@ Report content should include:
 - All findings with verification status. Read them out of the findings artifact `qwen review findings` wrote (`.qwen/tmp/qwen-review-{target}-findings.json`) rather than re-typing them from the terminal — a third transcription of the same list is a third chance for a severity to drift, which has happened inside a single review.
 - **Per-finding outcomes, when Step 6B ran** — `fixed` / `skipped` / `no_change_needed`, with the reason for every `skipped`. The artifact already carries them; a `--fix` run whose archive does not say which findings were applied is a report that reads as if all of them were.
 - Verdict (high and medium effort — a low quick pass claims none; a medium verdict never exceeds Comment, since it runs no reverse audit — see Step 5)
+- **The cost ledger — run it, do not compute it.** `"${QWEN_CODE_CLI:-qwen}" review cost-ledger --plan <the plan report from Step 1> --out .qwen/reviews/<report>-cost-ledger.json` aggregates the model calls the harness recorded for this review — the main loop and each agent, with input / cached / output / thinking token counts and wall time — from the harness's own usage records, the same records the coverage gate trusts. The window is bounded: it starts at the plan's mtime, and the ledger runs at this step, so the pre-plan bootstrap turns and the composition after this snapshot are not captured, and side queries such as chat compression leave no usage records to capture at all. Paste its printed block into the report verbatim, and relay the first line in the terminal summary. The printed block lists only the eight biggest agents; the `--out` JSON keeps every one, so the diffable record survives in full (worktree mode: resolve `--out` against the main project directory, like the report itself). If it prints `cost-ledger unavailable`, note that instead — it is informational and never blocks a review. Why it is in the archive: a "this version got slower" report is unanswerable from memory, and the one time it was answered properly took hours of telemetry forensics to find a repair round that had silently doubled a run. The ledger makes the next such question a diff of two saved reports.
 
 **The report's verdict is not yours to type.** `compose-review` printed the exact `Verdict:` line in Step 6 and persisted the same line as `verdictLine` inside `.qwen/tmp/qwen-review-{target}-composed.json` — copy either, verbatim. Do not reconstruct it from `event` + `cappedBy`: a presubmit downgrade also depends on fields that pair does not carry, and a rebuilt line can differ from the computed one. (And not `$(jq …)`: a `jq` binary is not guaranteed on the host, and a substitution that fails leaves the archived verdict blank or literal — worse than absent, because it looks written.)
 
 A run has written an Approve into its saved report minutes after reading the capped verdict (measured; DESIGN.md — The narrated-away cap). The terminal is prose and the archive is forever; this line is the one place the archive can be made to tell the truth for free. If the composed event is not the one you expected, fix the run — not the report.
 
-After the Markdown report exists, and before cleanup, create and register the structured review artifact for **medium and high** effort (low has no canonical composed verdict and must not invent one). Use the same filename stem as the Markdown report with a `.json` extension:
+After the Markdown report exists, create and register the structured review artifact for **medium and high** effort (low has no canonical composed verdict and must not invent one) — the creation is group (3) of the batching rule above; the registration rides group (4) alongside cleanup, which never touches `.qwen/reviews/`. Use the same filename stem as the Markdown report with a `.json` extension:
 
 ```bash
 "${QWEN_CODE_CLI:-qwen}" review save-artifact \
@@ -1126,9 +1160,12 @@ After the Markdown report exists, and before cleanup, create and register the st
   --report .qwen/reviews/<report>.md \
   --target <target> \
   --effort <effort> \
+  --workspace-root <absolute path to the main project directory> \
   --out .qwen/reviews/<report>.json
 ```
 
+`save-artifact` resolves relative paths and its containment root against `--workspace-root` — **pass the main project directory explicitly, as the block above does**; without the flag it falls back to its own working directory. The flag is not decoration: the root anchors the containment checks (`isWithin` and the symlink walk), and an ambient-cwd root is only as trustworthy as wherever the command happened to run — from inside the untrusted PR worktree it would be the PR's own tree, the exact threat `comment-status`'s run-from-the-main-checkout rule exists to prevent. It used to prefer `QWEN_CODE_PROJECT_DIR`, which does not name the main checkout in any environment — the harness exports it as the session-storage directory under the runtime base — and every measured CI run burned minutes rediscovering that before improvising a workaround (measured; DESIGN.md — The artifact root that pointed at qwen-home).
+
 For PR worktree mode, the findings and composed inputs were created inside `worktreePath`, while the durable report and output belong to the main project directory. Pass absolute paths for all four: resolve `--findings` and `--composed` against `worktreePath`, and resolve `--report` and `--out` against the main project directory. The worktree lives under the main project's `.qwen/tmp/`, so all four remain inside the session workspace accepted by the helper. `save-artifact` prints one JSON object on stdout — `{"path": "<absolute path>", "workspacePath": "<path relative to the main project directory>"}`. Then call `record_artifact` in the current session with exactly this registration shape, copying `workspacePath` from that stdout object verbatim (do not re-derive it from the absolute path):
 
 ```json

package/chunks/{MaxSizedBox-A3UYJS6B.js → MaxSizedBox-ANWZBPTS.js}

@@ -4,79 +4,79 @@ import {
   MINIMUM_MAX_HEIGHT,
   MaxSizedBox,
   setMaxSizedBoxDebugging
-} from "./chunk-LBWNSLJK.js";
-import "./chunk-U25CMJYY.js";
+} from "./chunk-ONSZH6VM.js";
+import "./chunk-EKPKKXY2.js";
 import "./chunk-SV5PQVQE.js";
 import "./chunk-2IIJTXYF.js";
 import "./chunk-5QWWOFGG.js";
-import "./chunk-KKN2IE7Q.js";
+import "./chunk-CTJLZLB5.js";
 import "./chunk-4NFY2S7N.js";
 import "./chunk-2MIN6GRR.js";
 import "./chunk-QHTIBUWB.js";
 import "./chunk-RKUWKYED.js";
-import "./chunk-DOA7MCDY.js";
+import "./chunk-Y7E5LNLO.js";
 import "./chunk-GOFAQQZA.js";
 import "./chunk-5M6IDOMF.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-H6XPXXMH.js";
-import "./chunk-Z7JILXGX.js";
-import "./chunk-I7JDGNG6.js";
-import "./chunk-A6SX5TAH.js";
-import "./chunk-33FNCQSY.js";
+import "./chunk-CNIID3TV.js";
+import "./chunk-MVUQRLOH.js";
+import "./chunk-XCWO3SMQ.js";
+import "./chunk-7MH4J33A.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-6D6V55ZQ.js";
+import "./chunk-RMH5OWLD.js";
 import "./chunk-IRH27ZC2.js";
 import "./chunk-QHWCP53L.js";
-import "./chunk-MOHAWIAW.js";
-import "./chunk-3PRJYMXC.js";
+import "./chunk-GNPNYXJB.js";
+import "./chunk-Y4NGLFGJ.js";
 import "./chunk-O6GEWCJA.js";
 import "./chunk-T26EAKDL.js";
 import "./chunk-ZPJWUGCS.js";
 import "./chunk-CPBF7KYF.js";
-import "./chunk-MISUEWB4.js";
+import "./chunk-J6SZID63.js";
 import "./chunk-KRXPRVGL.js";
-import "./chunk-A5YZ3FA2.js";
-import "./chunk-YAVY33G4.js";
-import "./chunk-2UISUFHQ.js";
-import "./chunk-MBEMTXQT.js";
-import "./chunk-6WBWIPBF.js";
+import "./chunk-GM463R2B.js";
+import "./chunk-SEZ556DZ.js";
+import "./chunk-CJXIIILK.js";
+import "./chunk-3K7FH2KQ.js";
+import "./chunk-BVWVWGLE.js";
 import "./chunk-S6LOFUVP.js";
-import "./chunk-WVAESIM6.js";
+import "./chunk-LZC3B5N2.js";
 import "./chunk-K623ENWT.js";
 import "./chunk-AQ37AY7B.js";
-import "./chunk-432XCUHF.js";
-import "./chunk-HU5TUALO.js";
-import "./chunk-XC656O42.js";
+import "./chunk-EQL65XGA.js";
+import "./chunk-IIJEYBNH.js";
+import "./chunk-22NBYCPD.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-QYPT3QUD.js";
-import "./chunk-QMBEW7EW.js";
+import "./chunk-3ULCB3NE.js";
+import "./chunk-BGG4MBYD.js";
 import "./chunk-DGEIYUC3.js";
 import "./chunk-MPHPFVKK.js";
-import "./chunk-GLNBDYUX.js";
+import "./chunk-AXMWHKXA.js";
 import "./chunk-DJ2GSRLV.js";
-import "./chunk-AU3XNTMV.js";
-import "./chunk-MGSSJT27.js";
+import "./chunk-33ACCIIY.js";
+import "./chunk-L4N6TIP7.js";
 import "./chunk-2J3OJGTL.js";
 import "./chunk-P3QQPMQA.js";
-import "./chunk-6O5DVH27.js";
+import "./chunk-M6HMMKVG.js";
 import "./chunk-GLCZKT5V.js";
-import "./chunk-2DNKEBXY.js";
-import "./chunk-O656RSMC.js";
+import "./chunk-EI3HZX6C.js";
+import "./chunk-2U3WZGZG.js";
 import "./chunk-WOJZWRAZ.js";
 import "./chunk-VGC4I5JJ.js";
-import "./chunk-E4WHKETF.js";
-import "./chunk-ZPPP6VCL.js";
-import "./chunk-D7D7RXIJ.js";
-import "./chunk-P7LKADIT.js";
+import "./chunk-FVKHVJZQ.js";
+import "./chunk-NG2R4N5O.js";
+import "./chunk-IC4Z6LX6.js";
+import "./chunk-6EOI4HOK.js";
 import "./chunk-46UV252V.js";
 import "./chunk-ZBVS26BY.js";
-import "./chunk-BFHXDAR7.js";
-import "./chunk-TYERNYH4.js";
-import "./chunk-UH7Z7Y45.js";
-import "./chunk-5L6CQ4ZU.js";
+import "./chunk-KKBPOU75.js";
+import "./chunk-EUNWC2VS.js";
+import "./chunk-FOGU3LJX.js";
+import "./chunk-6M26GBKX.js";
 import "./chunk-W4RQUHY3.js";
 import "./chunk-LKRMNRSN.js";
-import "./chunk-3RXUYQJI.js";
+import "./chunk-OIVKILPI.js";
 import "./chunk-VOQXFAY5.js";
 import "./chunk-75DOP5OR.js";
 import "./chunk-DMTGGOSA.js";