@tokenfactory/acc-runner 0.44.0 → 0.44.2

package/dist/runtime/reviewer.js

@@ -15,16 +15,43 @@
  * cron's poll-merge loop can advance.
  */
 import { execa } from "execa";
-import { priceUsdCents, normalizeUsage, modelFallbackChain, } from "../cost-pricing.js";
+import { priceUsdCents, normalizeUsage, modelFallbackChain, toReviewerApiId, toReviewerCliAlias, } from "../cost-pricing.js";
 import { extractResetTime, isReviewerAuthFailure, isEnvBrokenReviewerProbe, } from "../failure-classifier.js";
 import { buildEnv } from "../bin-resolve.js";
-import { getEngine } from "../engines/registry.js";
+import { engineIds, getEngine } from "../engines/registry.js";
+import { resolveCodexSpawnMode } from "../engines/codex.js";
 import { ensureRepoClone } from "./clone-cache.js";
 import { prepareReviewWorktree, ReviewFetchError } from "./worktree.js";
 import { isEmptyReviewDiff } from "../review-diff-guard.js";
 import { diffFilePaths, splitDiffByFile } from "./review-diff.js";
 import { planReviewChunks, partitionAbsenceClaims, MAX_REVIEW_CHUNKS, REVIEWER_ABSENCE_ESCALATION_REASON, DISCARDED_CLAIM_PREFIX, } from "./review-chunking.js";
+import { decisionProvenanceReason, reconcileReviewDecision, PROSE_KEYWORD_OVERRIDE_REASON, } from "./decision-provenance.js";
+import { describePromptRenderBleed, findPromptRenderBleed, substitutePlaceholders, } from "./prompt-substitute.js";
+import { abstainReasons, describeAbstainForLog, } from "./reviewer-abstain.js";
+import { chargeReviewAttempt, classifyReviewCost, openReviewCostContext, reviewCostLedger, reviewCostOverrunReason, reviewCostRunawayReason, } from "./review-cost-cap.js";
 import { classifyTeardownFailure } from "../review-worktree-cleanup.js";
+import { failureDiagnostics } from "../output-diagnostics.js";
+/** Stable marker keying every reviewer tooling-failure reason (mirrors
+ *  TOOLING_FAILURE_MARKER in api/_lib/review-retry.ts — the runner is a
+ *  standalone package and cannot import from api/_lib). // keep in sync */
+const REVIEWER_TOOLING_FAILURE_MARKER = "reviewer tooling failure:";
+const REVIEWER_UNRESOLVABLE_ENGINE_REASON = `${REVIEWER_TOOLING_FAILURE_MARKER} assigned runner could not resolve the ` +
+    "task's agent engine. This is fleet configuration infra, not a review " +
+    "verdict; review budget untouched.";
+/* The stamp above is for OPERATOR legibility, not for correctness. The server's
+ * MARKER classifier (isUnresolvableEngineReviewerOutcome in api/_lib/review-retry.ts)
+ * matches ONLY this marker — it deliberately does NOT free-text-match the raw
+ * `runtime_threw: unknown agent engine:` text, so a row from an un-upgraded runner
+ * is not exempted there. Instead the capability-reset in countReviewerErrors (keyed
+ * on LEGACY_UNRESOLVABLE_ENGINE_RAW) amnesties BOTH stamped and legacy rows — but
+ * only once the fleet regains the engine (engineServedByFleet). So an
+ * already-stranded PR recovers when a codex-capable runner comes online: recovery
+ * does not wait on THIS package being republished across the fleet, but it IS
+ * conditional on the engine being served again (while unserved the rows still
+ * count and strand — AC3). */
+function isUnresolvableEngineError(err) {
+    return err?.message?.startsWith("unknown agent engine:") === true;
+}
 // Byte-identical to prompts/reviewer-agent.md. The runner does not have
 // the markdown file at runtime (the package ships without prompts/) so
 // the prompt is embedded. Keep this string in sync with the markdown
@@ -74,6 +101,18 @@ export const REVIEWER_PROMPT_TEMPLATE = [
     "  (security/tenant-isolation, build/typecheck, unsafe migration, secret,",
     "  forbidden file, out-of-scope edits present in the diff).",
     "- Only approve if EVERY acceptance criterion is clearly met by the diff.",
+    "- **A LOC / line-count cap acceptance criterion is ADVISORY, not blocking (operator",
+    "  decision D-7, 2026-09-05).** An acceptance criterion whose ONLY content is a numeric",
+    '  line-count / LOC / added-lines BUDGET (e.g. "implementation additions <= 200 LOC") is',
+    "  a budget, not a behaviour. When the diff exceeds it, emit that overrun as its OWN",
+    "  reason in the EXACT machine form `loc_cap: measured=<N> limit=<M>` (nothing else in",
+    "  that reason), and approve when every OTHER acceptance criterion is met. Put every",
+    "  OTHER finding in its OWN separate reason — a forbidden file in the diff, a named",
+    "  acceptance criterion whose mechanism the diff does not implement, a defect the diff",
+    "  introduces, scope creep, a PR body whose numbers contradict the diff — those ALL",
+    "  still reject. NEVER fold a real finding into the `loc_cap:` reason: a reason that",
+    "  mixes any other clause with the overrun is NOT the cap tag and still rejects. Only a",
+    "  reason that is EXACTLY the `loc_cap:` tag is advisory.",
     "- Reject if the diff adds files outside the task's stated scope.",
     "- Reject if the diff makes changes beyond what the task asked for",
     "  (refactors, drive-by cleanups, dependency bumps that weren't requested).",
@@ -156,6 +195,46 @@ export const REVIEWER_PROMPT_TEMPLATE = [
     "  pointing at a specific part of the diff or the task spec. No prose",
     "  paragraphs. No re-stating the task.",
 ].join("\n");
+/**
+ * D-7 (operator decision, 2026-09-05): the reviewer emits a LOC/line-count cap overrun
+ * as a STRUCTURED, machine-tagged finding — a reason that is EXACTLY
+ * `loc_cap: measured=<N> limit=<M>` and nothing else — so a cap overrun is a typed
+ * object, not English the seam has to interpret. This matcher is a WHITELIST, not a
+ * blacklist: it flips only on that exact tag, anchored END TO END (^…$), so a reason
+ * that mixes any other clause — a defect, a forbidden file, a scope note, a body-vs-diff
+ * contradiction — cannot be the tag and stays a reject. Fail-CLOSED by construction:
+ * anything not positively proven the pure cap tag keeps the REJECT. A mixed finding is
+ * structurally impossible because the defect half is its OWN separate, untagged reason.
+ */
+const LOC_CAP_TAG_RE = /^\s*loc_cap:\s*measured=(\d+)\s+limit=(\d+)[.\s]*$/i;
+export function isLocCapAdvisoryReason(reason) {
+    return LOC_CAP_TAG_RE.test(reason ?? "");
+}
+/** Render the machine tag into an operator-legible advisory line (measured/limit kept
+ *  visible), or return the reason unchanged when it is not a cap tag. */
+export function renderLocCapAdvisory(reason) {
+    const m = LOC_CAP_TAG_RE.exec(reason ?? "");
+    return m
+        ? `LOC-cap advisory (D-7): implementation additions ${m[1]} exceed the ${m[2]}-line ` +
+            `budget — recorded, not blocking.`
+        : reason;
+}
+/**
+ * D-7: reduce a reviewer verdict under the cap-advisory rule. A `reject` whose EVERY
+ * substantive reason is the pure `loc_cap:` tag is not a rejection — it becomes an
+ * `approve` that STILL carries the measured overrun (rendered) in `reasons`. Any reason
+ * that is not exactly the tag — a defect, forbidden file, unmet AC, body mismatch, scope
+ * creep, or even a cap stated in free prose — keeps the reject (fail-closed). A
+ * non-reject verdict is returned untouched.
+ */
+export function applyLocCapAdvisory(verdict) {
+    if (verdict.decision !== "reject")
+        return verdict;
+    const substantive = (verdict.reasons ?? []).filter((r) => r && r.trim());
+    if (substantive.length === 0 || !substantive.every(isLocCapAdvisoryReason))
+        return verdict;
+    return { ...verdict, decision: "approve", reasons: verdict.reasons.map(renderLocCapAdvisory) };
+}
 /* ──────── RF-1 (NOT-IMPLEMENTED-CARVE-OUT): completion-signal scoping ────────
  *
  * The reviewer prompt's completion-negative rule used to fire on the WHOLE PR
@@ -437,9 +516,9 @@ export function truncationInfraNote(omitted, partialFile = null, reordered = fal
 const RETRY_DELAYS_MS = [2000, 4000, 8000];
 /* ───────────────── REVFB (G1): in-process capacity retry/backoff ────────────
  *
- * A `reviewer_capacity` outcome (Claude-subscription 429 / momentary brownout)
+ * A `reviewer_capacity` outcome (engine subscription 429 / momentary brownout)
  * is often transient. Rather than immediately yielding reviewer_capacity — which
- * pauses the WHOLE runner via watch.ts until a resume timer fires — we retry the
+ * pauses review claims via watch.ts until a resume timer fires — we retry the
  * claude spawn IN-PROCESS a bounded number of times with exponential backoff,
  * but ONLY for a brownout with no stated reset time. A hard session cap (which
  * carries a "resets <time>" reset instant) is yielded immediately, since there
@@ -516,7 +595,7 @@ export function isRetriableError(stderr) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-export function renderReviewerPrompt(args) {
+export function renderReviewerPromptChecked(args) {
     // RF-3: ONE truncation policy — float the AC-named proof files to the front,
     // cut at a whole-file boundary, and name what was withheld. Under the cap
     // nothing reorders and no notice renders, so the prompt is byte-identical to
@@ -538,14 +617,41 @@ export function renderReviewerPrompt(args) {
     const acceptance = (args.acceptance_criteria ?? [])
         .map((a, i) => `${i + 1}. ${a}`)
         .join("\n");
-    const rendered = REVIEWER_PROMPT_TEMPLATE
-        .replace("{{task_description}}", args.task_description ?? "")
-        .replace("{{acceptance_criteria}}", acceptance)
-        .replace("{{pr_title}}", args.pr_title ?? "")
-        .replace("{{pr_body}}", args.pr_body ?? "")
-        .replace("{{pr_diff}}", diff);
+    // S15-FU/REVIEW-1 (AC1): substitute VERBATIM. `String.replace` with a string
+    // replacement expands `$$`/`$&`/`` $` ``/`$'`/`$n`, so a diff containing `$'`
+    // — e.g. the clean literal `... where seq ~ '^[0-9]+$' order by 1` — used to
+    // splice the template text FOLLOWING `{{pr_diff}}` ("Now answer in this exact
+    // JSON shape…") into the diff, and the reviewer then reported that prose as a
+    // corruption defect in the file (#1933). Never re-introduce a string
+    // replacement here; see ./prompt-substitute.ts.
+    const pairs = reviewerPlaceholderPairs(args, diff, acceptance);
+    const rendered = substitutePlaceholders(REVIEWER_PROMPT_TEMPLATE, pairs);
     const note = truncationInfraNote(omitted, partialFile, prioritized.reordered);
-    return note.length > 0 ? `${rendered}\n\n${note}\n` : rendered;
+    const prompt = note.length > 0 ? `${rendered}\n\n${note}\n` : rendered;
+    return { prompt, bleed: findPromptRenderBleed(REVIEWER_PROMPT_TEMPLATE, prompt, pairs) };
+}
+/**
+ * S15-FU/REVIEW-1 (AC1): the ORDERED placeholder/value pairs a reviewer prompt
+ * substitutes, so the render-integrity check (and its test) can assert that every
+ * one of these values survived into the prompt VERBATIM.
+ * // keep in sync with reviewerPlaceholderPairs in api/_lib/reviewer-agent.ts
+ */
+export function reviewerPlaceholderPairs(args, diff, acceptance) {
+    return [
+        ["{{task_description}}", args.task_description ?? ""],
+        ["{{acceptance_criteria}}", acceptance],
+        ["{{pr_title}}", args.pr_title ?? ""],
+        ["{{pr_body}}", args.pr_body ?? ""],
+        ["{{pr_diff}}", diff],
+    ];
+}
+/**
+ * String façade over `renderReviewerPromptChecked` — the signature every existing
+ * caller and the RF-3 parity tests use. Integrity is enforced at the review seam,
+ * which needs the `bleed` list to build its abstain.
+ */
+export function renderReviewerPrompt(args) {
+    return renderReviewerPromptChecked(args).prompt;
 }
 /* ─────────── REVIEWER-DIFF-CAP: chunked review of an over-cap diff ───────────
  *
@@ -740,7 +846,18 @@ export function extractReviewerDecision(text) {
             "parsed from prose reviewer output (no JSON found)",
             `decision_keyword: ${decision}`,
         ];
-    return { decision, reasons, confidence };
+    // REVIEW-DECISION-PROVENANCE: this verdict was INFERRED from a keyword, not
+    // asserted. PR #1913 persisted a reject this way over an all-"Met." analysis
+    // with no trace of the inference; runReview stamps the marker at submit time.
+    return {
+        decision,
+        reasons,
+        confidence,
+        decision_provenance: {
+            decision_source: "prose_keyword",
+            override_reason: PROSE_KEYWORD_OVERRIDE_REASON,
+        },
+    };
 }
 async function defaultFetchPRMeta(repo, prNumber) {
     const { stdout } = await execa("gh", ["pr", "view", String(prNumber), "-R", repo, "--json", "title,body"], { env: buildEnv() });
@@ -877,21 +994,126 @@ async function cleanupReviewTree(tree, supabase, assignment) {
         await emitReviewWorktreeOrphaned(supabase, assignment, tree.path ?? "", result);
     }
 }
-// M2 (ENGINE-EXTRACT): the coding engine the reviewer drives. Wave 1 fixed
-// this to a single module-level `claude-code` constant — spawn/argv/result-
-// parse/failure-class behavior was byte-identical to the pre-refactor inline
-// logic now owned by src/engines/claude-code.ts. buildEnv() is the reviewer's
-// base env (mirrors v0.74-B): the engine forwards ANTHROPIC_API_KEY over it
-// when set.
+// M2 (ENGINE-EXTRACT): the coding engine the reviewer drives. buildEnv() is the
+// reviewer's base env (mirrors v0.74-B): the engine forwards provider auth over
+// it when set.
 //
-// NS MM-2 (BATCH-ENGINE-DISPATCH): the reviewer now resolves the engine PER
-// REVIEW from the reviewed task's `engine` column (`driveReview` below), so it
-// drives the same CLI the runner built the PR with instead of always assuming
-// claude-code. `getEngine(id)` defaults to claude-code on a null/blank id —
-// unstamped/pre-MM-1 rows are byte-identical to Wave 1.
+// CROSS-ENGINE-REVIEW-1: the reviewed task's engine is now only the AUTHORING
+// engine. The reviewer engine is selected from an org policy per review, with a
+// default that prefers a different provider family but advances to the next
+// local engine when the preferred provider is capacity-blocked.
 function defaultSpawnClaude(modelId, engine) {
     return engine.spawn({ modelId, baseEnv: buildEnv() });
 }
+export const DEFAULT_REVIEWER_ENGINE_SELECTION_POLICY = "prefer_different_family";
+function engineFamily(engineId) {
+    const id = engineId.trim().toLowerCase();
+    if (id.startsWith("claude"))
+        return "anthropic";
+    if (id.startsWith("codex"))
+        return "openai";
+    if (id.startsWith("gemini"))
+        return "google";
+    return id;
+}
+export function resolveReviewerEngineSelectionPolicy(policy) {
+    const raw = policy && typeof policy === "object"
+        ? policy.reviewer_engine_policy
+        : null;
+    return raw === "prefer_same_family" || raw === "capacity_first" || raw === "prefer_different_family"
+        ? raw
+        : DEFAULT_REVIEWER_ENGINE_SELECTION_POLICY;
+}
+function uniqueEngineIds(ids) {
+    const out = [];
+    for (const id of ids) {
+        const v = id.trim().toLowerCase();
+        if (v && !out.includes(v))
+            out.push(v);
+    }
+    return out;
+}
+export function selectReviewerEngineIds(authorEngine, policy, availableEngineIds = engineIds()) {
+    const resolvedPolicy = resolveReviewerEngineSelectionPolicy(policy);
+    const authorId = (authorEngine ?? "").trim().toLowerCase() || "claude-code";
+    const authorFamily = engineFamily(authorId);
+    const available = uniqueEngineIds(availableEngineIds);
+    // FAIL CLOSED: an empty available set is a FAILURE (the runner advertised no
+    // engine, or the capability probe failed), not a licence to route to the author
+    // engine anyway — that would review on an engine the assigned runner may not be
+    // able to spawn. Yield NO candidate; runReview then surfaces a no-route infra
+    // error instead of dispatching blind.
+    if (available.length === 0)
+        return { engineIds: [], policy: resolvedPolicy };
+    const same = available.filter((id) => engineFamily(id) === authorFamily);
+    const different = available.filter((id) => engineFamily(id) !== authorFamily);
+    const ordered = resolvedPolicy === "prefer_same_family"
+        ? [...same, ...different]
+        : resolvedPolicy === "capacity_first"
+            ? available
+            : [...different, ...same];
+    return { engineIds: ordered.length > 0 ? ordered : available, policy: resolvedPolicy };
+}
+/**
+ * CROSS-ENGINE-REVIEW-1 (AC10): map the org policy's single reviewer `model_id`
+ * onto the engine actually chosen for THIS review. The policy historically
+ * carries a Claude id (default 'claude-sonnet-4-6'). Cross-engine selection now
+ * routes a review to codex even when the PR was authored by Claude — so that
+ * Claude model id is meaningless to the reviewer engine and MUST NOT be pinned:
+ *
+ *   - codex → run UNPINNED (model_id → `null`) unless an OpenAI-valid id is
+ *     explicitly configured on an api-key channel (a Claude id is never valid
+ *     for codex and is always dropped to `null`).
+ *   - claude-family → keep the existing catalog fallback chain unchanged.
+ *
+ * Returning `null` tells `engine.spawn` to omit `--model`, so codex never sees
+ * `claude-sonnet-4-6` on argv.
+ */
+export function reviewerModelChain(engine, policyModelId, modelChainMax) {
+    const baseModel = policyModelId ?? "claude-sonnet-4-6";
+    if (engine.id === "codex") {
+        // ChatGPT-account Codex rejects every explicit --model, including valid
+        // OpenAI ids; and a Claude model id can never drive codex. Both collapse to
+        // a single unpinned attempt. An OpenAI-valid id on an api-key channel is the
+        // only case that pins.
+        const codexAuthMode = resolveCodexSpawnMode(buildEnv());
+        return codexAuthMode === "api-key" && !baseModel.startsWith("claude-")
+            ? [baseModel]
+            : [null];
+    }
+    // #2169 namespace split: build the fallback chain from the CANONICAL API id so
+    // a configured CLI alias ('sonnet') never lands in the recorded chain; the
+    // spawn call CLI-alias-translates each entry with toReviewerCliAlias.
+    return modelFallbackChain(toReviewerApiId(baseModel), modelChainMax);
+}
+/**
+ * CROSS-ENGINE-REVIEW-1 (AC3): resolve the assigned runner's advertised
+ * caps.engines. Prefers the explicitly-injected list (watch.ts threads the
+ * runner's ALREADY-PUBLISHED `acc.runners.caps.engines` — the value the
+ * assignment was made against), then an async `detectEngines` override, and only
+ * as a last resort falls back to the local registry (`engineIds()`). The
+ * production path always injects, so the reviewer only ever selects an engine
+ * THIS runner can spawn, never a registry entry it cannot.
+ *
+ * FAIL CLOSED: if the `detectEngines` probe THROWS we return an EMPTY set, never
+ * the full local registry. A failed capability probe is not licence to route to
+ * an engine the assigned runner never advertised; the empty set makes
+ * `selectReviewerEngineIds` yield no candidate, so the review surfaces a no-route
+ * infra error rather than silently reviewing on an unadvertised engine.
+ */
+async function resolveAdvertisedEngineIds(deps) {
+    if (deps.advertisedEngineIds)
+        return deps.advertisedEngineIds;
+    if (deps.detectEngines) {
+        try {
+            return await deps.detectEngines();
+        }
+        catch {
+            return [];
+        }
+    }
+    return engineIds();
+}
 function parseEnvelope(stdout, fallbackModel, engine) {
     const parsed = engine.parseResult(stdout);
     if (!parsed) {
@@ -920,8 +1142,8 @@ function parseEnvelope(stdout, fallbackModel, engine) {
 export async function runReview(assignment, deps) {
     const fetchMeta = deps.fetchPRMeta ?? defaultFetchPRMeta;
     const prepareTree = deps.prepareReviewTree ?? defaultPrepareReviewTree;
-    // NS MM-2: `spawnFn`'s default needs the REVIEWED task's `engine` column,
-    // which driveReview fetches — so its binding moves there instead of here.
+    // CROSS-ENGINE-REVIEW-1: `spawnFn`'s default needs the selected REVIEWER
+    // engine, which driveReview resolves from policy after it fetches the task.
     // `deps.spawnClaude` (test override) is unaffected either way.
     let outcome;
     try {
@@ -937,9 +1159,12 @@ export async function runReview(assignment, deps) {
             outcome = null;
         }
         else {
+            const runtimeReason = `runtime_threw: ${err.message?.slice(0, 200)}`;
             outcome = {
                 decision: "reviewer_error",
-                reasons: [`runtime_threw: ${err.message?.slice(0, 200)}`],
+                reasons: isUnresolvableEngineError(err)
+                    ? [REVIEWER_UNRESOLVABLE_ENGINE_REASON, runtimeReason]
+                    : [runtimeReason],
                 confidence: 0,
                 session_id: null,
                 cost_usd: 0,
@@ -959,32 +1184,258 @@ export async function runReview(assignment, deps) {
             cost_usd: 0,
         };
     }
+    // REVIEW-DECISION-PROVENANCE — the persistence seam. Two stamps, both purely
+    // additive to `reasons` and neither touching the verdict:
+    //   1. a SYNTHESIZED decision (prose fallback) renders its marker, so a
+    //      keyword-inferred verdict is never stored as if the analysis argued it;
+    //   2. reconcile catches a reject whose own reasons record a clean full pass
+    //      and no override rationale (the PR #1913 shape) and flags it.
+    // Applied here, immediately before the RPC, so EVERY path that reaches
+    // submit_review — chunked, single-pass, capacity fallback — is covered.
+    const provenanceNote = outcome.decision_provenance
+        ? [decisionProvenanceReason(outcome.decision_provenance)]
+        : [];
+    const reconciled = reconcileReviewDecision({
+        decision: outcome.decision,
+        reasons: [...outcome.reasons, ...provenanceNote],
+    });
+    const submitted = { ...outcome, reasons: reconciled.reasons };
     const { error } = await deps.supabase.rpc("submit_review", {
         p_review_id: assignment.review_id,
-        p_decision: outcome.decision,
-        p_reasons: outcome.reasons,
-        p_confidence: outcome.confidence,
-        p_session_id: outcome.session_id,
-        p_cost_usd: outcome.cost_usd,
+        p_decision: submitted.decision,
+        p_reasons: submitted.reasons,
+        p_confidence: submitted.confidence,
+        p_session_id: submitted.session_id,
+        p_cost_usd: submitted.cost_usd,
     });
     if (error) {
         process.stderr.write(`[acc-runner] submit_review(${assignment.review_id}) failed: ${error.message}\n`);
     }
-    return outcome;
+    // REVIEWER-SPEND-TO-COST-PIPE: emit this completed review's spend into
+    // acc.cost_events AT COMPLETION (best-effort), only when the review actually
+    // completed (submit_review did not error). See recordReviewCost.
+    if (!error) {
+        await recordReviewCost(deps.supabase, assignment.task_id, submitted.cost_usd);
+    }
+    // RUNNER-DISCARDS-STDOUT-ON-FAILURE-1: submit_review is reasons-only (frozen
+    // RPC), so preserve the captured child stdout/stderr tails of a genuine
+    // reviewer_error through the additive log_activity seam — otherwise the real
+    // failure is discarded and only the reason banner survives.
+    if (submitted.decision === "reviewer_error" &&
+        (submitted.stdout_tail || submitted.stderr_tail)) {
+        await emitReviewerErrorDiagnostics(deps.supabase, assignment, submitted);
+    }
+    return submitted;
+}
+/**
+ * RUNNER-DISCARDS-STDOUT-ON-FAILURE-1 — record the credential-scrubbed,
+ * end-truncated child stdout/stderr tails of a reviewer_error on the additive
+ * `task.reviewer_error` `log_activity` verb (no RPC-signature or protocol-shape
+ * change). Best-effort: a logging failure must never turn a settled review row
+ * into a crash.
+ */
+async function emitReviewerErrorDiagnostics(supabase, assignment, outcome) {
+    try {
+        const { error } = await supabase.rpc("log_activity", {
+            p_verb: "task.reviewer_error",
+            p_target_id: assignment.task_id,
+            p_target_type: "task",
+            p_payload: {
+                review_id: assignment.review_id,
+                pr_number: assignment.pr_number,
+                model_used: outcome.model_used ?? null,
+                reasons: outcome.reasons,
+                stdout_tail: outcome.stdout_tail ?? null,
+                stderr_tail: outcome.stderr_tail ?? null,
+            },
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] task.reviewer_error log_activity(${assignment.task_id}) failed: ${error.message}\n`);
+        }
+    }
+    catch (logErr) {
+        process.stderr.write(`[acc-runner] task.reviewer_error emit failed: ${logErr.message}\n`);
+    }
+}
+/** REVIEWER-SPEND-TO-COST-PIPE: the runner's thin mirror of the api-side
+ *  emitReviewCostEvent — a call site of the shared acc.record_cost_event RPC
+ *  (model='reviewer', zero-cost skipped, best-effort), NOT shared logic (the
+ *  runner cannot import api/_lib). Exactly-once HALTed per AC7. Returns the
+ *  outcome for the runner-package test (which root CI does NOT run — see PR body). */
+export async function recordReviewCost(supabase, taskId, costUsd) {
+    const cents = Math.max(Math.round((costUsd ?? 0) * 100), 0);
+    if (cents <= 0)
+        return "skipped_zero";
+    let res;
+    try {
+        res = await supabase.rpc("record_cost_event", {
+            p_task_id: taskId,
+            p_model: "reviewer",
+            p_input_tokens: 0,
+            p_output_tokens: 0,
+            p_cache_read_tokens: 0,
+            p_cache_write_tokens: 0,
+            p_usd_cents: cents,
+            p_runner_id: null,
+        });
+    }
+    catch (err) {
+        res = { error: { message: err.message } };
+    }
+    if (res?.error) {
+        process.stderr.write(`[acc-runner] review cost-event(${taskId}) failed: ${res.error.message}\n`);
+        return "error";
+    }
+    return "emitted";
 }
 async function invokeClaude(spawnFn, modelId, prompt) {
     const spawnedAt = Date.now();
     const child = spawnFn(modelId);
-    if (child.stdin) {
-        child.stdin.write(prompt);
-        child.stdin.end();
+    const stdoutP = collectStream(child.stdout);
+    const stderrP = collectStream(child.stderr);
+    const exitP = child;
+    const delivery = await deliverReviewerPrompt(child.stdin, prompt);
+    const [stdout, stderr, exit] = await Promise.all([stdoutP, stderrP, exitP]);
+    const durationMs = Date.now() - spawnedAt;
+    const exitCode = exit.exitCode ?? null;
+    const signal = exit.signal ?? null;
+    // Clean delivery — the child's own exit is authoritative.
+    if (!delivery) {
+        return { stdout, stderr, exitCode: exitCode ?? 1, durationMs };
+    }
+    // REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — STARTUP DEATH: the child never
+    // accepted a byte (`bytesWritten === 0`) AND exited abnormally (non-zero or by
+    // signal). Only bytes_written distinguishes this from a genuine delivery break:
+    // a write that failed with NOTHING delivered means the child was already dead
+    // before it read input, so its OWN exit code / signal / stderr are the
+    // diagnosable cause and pass through here VERBATIM. Everything downstream that
+    // reads them — engine.classifyFailure, isRetriableError, extractResetTime AND
+    // the stderr_tail recorded by emitReviewerErrorDiagnostics — sees the real child
+    // signal, so the capacity class and the infra-retry ladder are decided by the
+    // child, never by a reason string (AC1/AC4). The failed write is the parent's
+    // SYMPTOM only: recorded SEPARATELY in `deliverySymptom` (appended after the
+    // child cause, never fed back into classification).
+    //
+    // A MID-WRITE break (`bytesWritten > 0`) is NOT a startup death — the child WAS
+    // reading and the pipe broke mid-stream, so the review ran on partial input and
+    // the DELIVERY failure is the reported cause (falls through below). Branching on
+    // exitCode/signal ALONE mislabelled that shape as a startup death — the exact
+    // misattribution this card removes.
+    if (delivery.bytesWritten === 0 && (exitCode !== 0 || signal !== null)) {
+        // AC4 INVARIANT: the prompt was never delivered (bytesWritten === 0), so this
+        // result MUST reach runClaudeAndDecide as a FAILURE whatever the child's exit
+        // code says. A child killed by a signal can still report exitCode 0; passing
+        // that 0 through (`?? 1` did) makes runClaudeAndDecide take the exitCode === 0
+        // path and finalizeReviewerSuccess on an undelivered prompt. `|| 1` forces a
+        // non-zero code (0/null → 1) while preserving a real non-zero exit for the
+        // retry ladder; the child's TRUE exit/signal are named in deliverySymptom.
+        return {
+            stdout,
+            stderr,
+            exitCode: exitCode || 1,
+            durationMs,
+            deliverySymptom: reviewerStartupDeathSymptom(delivery, { exitCode, signal }),
+        };
+    }
+    // The prompt never fully landed while the child was NOT dead-before-reading —
+    // it exited 0 on no/partial input, or a MID-WRITE break (bytesWritten > 0) gave
+    // it partial input. Its "success" is not a real verdict, so the delivery write
+    // is the reported cause; exitCode is forced non-zero so an exit-0 partial run is
+    // not mistaken for a verdict. The marker is PREPENDED (not appended) so it is the
+    // first-useful stderr line failureDiagnostics reports — surfacing in `reasons`
+    // (budget-exempt) even when the child had its OWN stderr, while that child stderr
+    // is still carried through for stderr_tail + classification. Prepending also keeps
+    // the stderr non-empty, so an exit-0 empty child is never misread as a silent
+    // capacity exit.
+    return {
+        stdout,
+        stderr: [reviewerPromptDeliveryFailure(delivery), stderr].filter(Boolean).join("\n"),
+        exitCode: 1,
+        durationMs,
+    };
+}
+/**
+ * REVIEWER-EPIPE — a prompt-delivery write failure when the child itself exited
+ * CLEANLY (exit 0). The review ran on no / partial input, so its "success" is not a
+ * real verdict and THIS is the one shape where the delivery write is the reported
+ * cause. Worded off bytes_written so a 0-byte failure never contradicts itself by
+ * claiming a "mid-write" break (the stdin-unavailable and bytes_written=0 cases now
+ * read "before any byte reached the child", not "mid-write ... bytes_written=0").
+ */
+function reviewerPromptDeliveryFailure(f) {
+    const phase = f.bytesWritten > 0
+        ? `mid-write (${f.bytesWritten} of ${f.promptBytes} bytes delivered)`
+        : "before any byte reached the child";
+    return (`${REVIEWER_TOOLING_FAILURE_MARKER} reviewer prompt delivery failed ${phase} ` +
+        `(mechanism=stdin_pipe, prompt_bytes=${f.promptBytes}, bytes_written=${f.bytesWritten}). ` +
+        `${f.detail.slice(0, 160)}. Review budget untouched (not a verdict).`);
+}
+/**
+ * REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — the child EXITED ABNORMALLY before it
+ * finished reading the prompt. Its OWN exit code / signal / stderr are the
+ * diagnosable cause and are passed through UNTOUCHED by invokeClaude (so the
+ * classifier, the retry ladder and the verbatim stderr_tail all see the real child
+ * signal). This line records the parent's failed stdin write SEPARATELY and
+ * explicitly as the SYMPTOM that first surfaced the death — never in place of the
+ * child stderr. It is appended to the outcome reasons AFTER the child cause and
+ * carries the tooling-failure marker so the row stays budget-exempt (a startup
+ * death is infra, not a verdict); it is NEVER fed back into classification.
+ *
+ * Scope of the class this names: the subset of "exited 1" reviewer_errors that are
+ * EPIPE-masked startup deaths. Rows that already carry the child's own stderr are
+ * NOT touched here. How many rows this newly names is a POST-DEPLOY measurement,
+ * carried by the follow-up card (D-1) — no count is asserted here.
+ */
+function reviewerStartupDeathSymptom(f, exit) {
+    return (`${REVIEWER_TOOLING_FAILURE_MARKER} reviewer child died at startup ` +
+        `(exit=${exit.exitCode ?? "null"}, signal=${exit.signal ?? "none"}) — the cause is the ` +
+        `child's own exit/stderr recorded above (verbatim in stderr_tail); the parent stdin write ` +
+        `is only the symptom (bytes_written=${f.bytesWritten}/${f.promptBytes}: ${f.detail.slice(0, 160)}). ` +
+        `Review budget untouched (not a verdict).`);
+}
+async function deliverReviewerPrompt(stdin, prompt) {
+    const promptBytes = Buffer.byteLength(prompt);
+    if (!stdin) {
+        return { detail: "child stdin pipe was unavailable", promptBytes, bytesWritten: 0 };
+    }
+    let bytesWritten = 0;
+    try {
+        await new Promise((resolve, reject) => {
+            const onError = (err) => {
+                stdin.off("error", onError);
+                reject(err);
+            };
+            stdin.once("error", onError);
+            stdin.write(prompt, (err) => {
+                stdin.off("error", onError);
+                if (err)
+                    reject(err);
+                else {
+                    bytesWritten = promptBytes;
+                    resolve();
+                }
+            });
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (err) => {
+                stdin.off("error", onError);
+                reject(err);
+            };
+            stdin.once("error", onError);
+            stdin.end(() => {
+                stdin.off("error", onError);
+                resolve();
+            });
+        });
+        return null;
+    }
+    catch (err) {
+        return {
+            detail: err.message || String(err),
+            promptBytes,
+            bytesWritten,
+        };
     }
-    const [stdout, stderr, exit] = await Promise.all([
-        collectStream(child.stdout),
-        collectStream(child.stderr),
-        child,
-    ]);
-    return { stdout, stderr, exitCode: exit.exitCode ?? 1, durationMs: Date.now() - spawnedAt };
 }
 async function driveReview(assignment, deps, fetchMeta, prepareTree) {
     const { data, error } = await deps.supabase.rpc("fetch_task_for_runner", {
@@ -1011,12 +1462,6 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
             cost_usd: 0,
         };
     }
-    // NS MM-2 (BATCH-ENGINE-DISPATCH): resolve the reviewed task's engine ONCE,
-    // right after the task itself is known — mirrors task-runner.ts's
-    // per-task resolution. `getEngine(null)` (an unstamped/pre-MM-1 row)
-    // resolves the same claude-code default Wave 1 always used.
-    const engine = getEngine(task.engine ?? null);
-    const spawnFn = deps.spawnClaude ?? ((modelId) => defaultSpawnClaude(modelId, engine));
     // Look up the org's reviewer policy. The runner-side reviewer needs
     // confidence_threshold + max_cost_usd_per_review to stay consistent
     // with the cron-side gate, since the cron now just lifts the decision
@@ -1024,6 +1469,13 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
     const policy = deps.loadPolicy
         ? await deps.loadPolicy("")
         : await loadReviewerPolicy(deps.supabase);
+    // CROSS-ENGINE-REVIEW-1 (AC3): constrain reviewer-engine selection to the
+    // engines THIS (the assigned) runner actually advertises in caps.engines —
+    // NOT the full local registry. `resolveAdvertisedEngineIds` prefers an
+    // explicitly-injected list and otherwise re-runs the same capability probe
+    // the runner published at register time.
+    const advertisedEngineIds = await resolveAdvertisedEngineIds(deps);
+    const reviewerEngineSelection = selectReviewerEngineIds(task.engine ?? null, policy, advertisedEngineIds);
     const meta = await fetchMeta(repo, assignment.pr_number);
     // R0-D-REVIEWER-WORKSPACE-INTEGRITY: materialize the EXACT PR head before
     // forming any verdict, or fail closed. On failure we post NO verdict and emit
@@ -1083,13 +1535,86 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
         throw err;
     }
     try {
-        return await produceVerdict({
+        let lastCapacity = null;
+        // The engine that ACTUALLY produced the returned outcome. After a capacity
+        // fallback this is NOT engineIds[0] — recording the first candidate would make
+        // every same-vs-cross-family row in the AC4 measurement wrong whenever a
+        // fallback fired (and fallbacks are common). Set to each engine as it is tried,
+        // so it names the winning engine on success and the last-tried on a whole-chain
+        // capacity cap.
+        let reviewerEngineId = null;
+        let outcome = null;
+        const input = {
             task_description: task.description ?? "",
             acceptance_criteria: task.acceptance ?? [],
             pr_title: meta.title,
             pr_body: meta.body,
             pr_diff: tree.diff,
-        }, policy, deps, spawnFn, engine);
+        };
+        for (let i = 0; i < reviewerEngineSelection.engineIds.length; i++) {
+            const engineId = reviewerEngineSelection.engineIds[i];
+            // CAPS-ENGINES-STALE-KEYCHAIN-1 (AC12): the reviewer only selects an
+            // ADVERTISED engine, so a getEngine throw here is a caps-vs-registry SELF-
+            // INCONSISTENCY. Drop it from caps (onUnknownAdvertisedEngine) — AC12's
+            // "dropped from caps immediately" — THEN re-throw, so upstream's #2129
+            // (REVIEWER-INFRA-ERROR-BURNS-BUDGET) still stamps it as a budget-exempt
+            // tooling-failure `reviewer_error` that recovers (ns04-mm2 / riebb). Mirrors
+            // the task-runner guard: AC12 side-effect + upstream's outcome, both kept.
+            let engine;
+            try {
+                engine = getEngine(engineId);
+            }
+            catch (err) {
+                await deps.onUnknownAdvertisedEngine?.(engineId, err);
+                throw err;
+            }
+            const spawnFn = deps.spawnClaude
+                ? ((modelId) => deps.spawnClaude(modelId))
+                : ((modelId) => defaultSpawnClaude(modelId, engine));
+            const out = await produceVerdict(input, policy, deps, spawnFn, engine);
+            reviewerEngineId = engineId; // the engine this outcome actually came from
+            if (out.decision !== "reviewer_capacity") {
+                outcome = lastCapacity ? { ...out, capacity_degraded: true } : out;
+                break;
+            }
+            lastCapacity = out;
+        }
+        if (outcome === null) {
+            outcome = lastCapacity ?? {
+                decision: "reviewer_error",
+                reasons: ["no reviewer engine resolved from policy/runner caps.engines"],
+                confidence: 0,
+                session_id: null,
+                cost_usd: 0,
+            };
+        }
+        // AC4 + AC8: record WHICH engine reviewed (submit_review is frozen reasons-only;
+        // task.review_submitted carries no engine), so same-vs-cross-family outcomes are
+        // computable. Emitted AFTER the decision comes back, keyed on the engine that
+        // ACTUALLY produced it (`reviewerEngineId`) — the routing OUTCOME, never the
+        // first candidate at selection time. Additive log_activity seam, fire-and-
+        // forget. docs/acc/CROSS_ENGINE_REVIEW_MEASUREMENT.md.
+        const authorEngineId = (task.engine ?? "claude-code").trim().toLowerCase();
+        void deps.supabase
+            .rpc("log_activity", {
+            p_verb: "review.engine_selected",
+            p_target_id: assignment.task_id,
+            p_target_type: "task",
+            p_payload: {
+                pr_number: assignment.pr_number,
+                review_id: assignment.review_id,
+                policy: reviewerEngineSelection.policy,
+                author_engine: authorEngineId,
+                author_family: engineFamily(authorEngineId),
+                reviewer_engine: reviewerEngineId,
+                reviewer_family: engineFamily(reviewerEngineId ?? ""),
+                cross_family: engineFamily(reviewerEngineId ?? "") !== engineFamily(authorEngineId),
+                candidate_engines: reviewerEngineSelection.engineIds,
+                advertised_engines: advertisedEngineIds,
+            },
+        })
+            .then?.(undefined, () => undefined);
+        return outcome;
     }
     finally {
         // Remove the dedicated review worktree so it can never become a stale
@@ -1111,9 +1636,34 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
  * settles as an INFRA outcome the escalation path owns — never a reject.
  */
 async function produceVerdict(input, policy, deps, spawnFn, engine) {
+    // REV-COST: ONE cost context per review — the SIZE-SCALED cap plus the
+    // attempt ledger every pass charges into. Derived from the ASSEMBLED diff this
+    // function already holds, so no caller has to change. At or under
+    // REVIEW_CAP_REFERENCE_DIFF_CHARS the cap is EXACTLY the org's flat
+    // `max_cost_usd_per_review` (an ordinary PR is judged against today's number);
+    // above it the cap ramps, bounded by REVIEW_CAP_MAX_MULTIPLE.
+    const costCtx = openReviewCostContext(policy?.max_cost_usd_per_review ?? 0, input.pr_diff.length);
     const chunks = planReviewChunks(input.pr_diff, MAX_DIFF_CHARS);
     if (chunks.length <= 1) {
-        return runClaudeAndDecide(renderReviewerPrompt(input), policy, deps, spawnFn, engine);
+        // S15-FU/REVIEW-1 (AC1 + AC2): render, then PROVE the prompt carries the PR
+        // content verbatim. If any value did not survive substitution, the reviewer
+        // would be judging text the repo does not contain (the #1933 corruption
+        // class) — so ABSTAIN before spawning anything. Never a reject, never a cost.
+        const render = renderReviewerPromptChecked(input);
+        if (render.bleed.length > 0) {
+            const detail = describePromptRenderBleed(render.bleed);
+            process.stderr.write(describeAbstainForLog("prompt_render", detail));
+            return {
+                decision: "reviewer_error",
+                reasons: abstainReasons("prompt_render", [
+                    `rendered reviewer prompt did not carry PR content verbatim: ${detail}`,
+                ]),
+                confidence: 0,
+                session_id: null,
+                cost_usd: 0,
+            };
+        }
+        return stampReviewCost(await runClaudeAndDecide(render.prompt, policy, deps, spawnFn, engine, costCtx), costCtx);
     }
     if (chunks.length > MAX_REVIEW_CHUNKS) {
         return {
@@ -1130,7 +1680,7 @@ async function produceVerdict(input, policy, deps, spawnFn, engine) {
             cost_usd: 0,
         };
     }
-    return runChunkedReview(input, chunks, policy, deps, spawnFn, engine);
+    return runChunkedReview(input, chunks, policy, deps, spawnFn, engine, costCtx);
 }
 /**
  * REVIEWER-DIFF-CAP — read an over-cap diff in `chunks.length` part passes, then
@@ -1143,13 +1693,13 @@ async function produceVerdict(input, policy, deps, spawnFn, engine) {
  * env-broken — short-circuits the whole review with the spend accumulated so far,
  * so an infra fault never degrades into a partial-evidence verdict.
  */
-async function runChunkedReview(input, chunks, policy, deps, spawnFn, engine) {
-    // The cap is checked ONCE against the whole chunked spend below; per-pass it is
-    // disabled so a single part is never judged against the whole-review budget.
-    const passPolicy = policy ? { ...policy, max_cost_usd_per_review: 0 } : null;
-    const cap = policy?.max_cost_usd_per_review ?? 0;
+async function runChunkedReview(input, chunks, policy, deps, spawnFn, engine, costCtx) {
+    // REV-COST: the cap is judged ONCE against the WHOLE chunked spend, because
+    // the shared ledger in `costCtx` accumulates across every part pass. That
+    // replaces the old cap-0 `passPolicy` clone: a single part is still never
+    // judged against the whole-review budget, and the whole review is no longer
+    // judged against a FLAT cap.
     const passes = [];
-    let cost = 0;
     let degraded = false;
     let modelUsed;
     for (const chunk of chunks) {
@@ -1157,53 +1707,80 @@ async function runChunkedReview(input, chunks, policy, deps, spawnFn, engine) {
         // a probe for every chunk. Only the first pass carries it.
         const passDeps = chunk.index === 1 ? deps : { ...deps, authCanary: undefined };
         const prompt = `${renderReviewerPrompt({ ...input, pr_diff: chunk.text })}\n\n${chunkScopeNotice(chunk)}\n`;
-        const out = await runClaudeAndDecide(prompt, passPolicy, passDeps, spawnFn, engine);
-        cost += out.cost_usd;
+        // The RUNAWAY brake lives in finalizeReviewerSuccess, right where the spend
+        // is charged, so a part pass that pushes the WHOLE-review total past the
+        // tolerance short-circuits here as a non-verdict outcome and the remaining
+        // passes never run. An overrun INSIDE the band deliberately does not stop the
+        // review: it finishes and the paid verdict is kept (see the tail).
+        const out = await runClaudeAndDecide(prompt, policy, passDeps, spawnFn, engine, costCtx);
+        const partLedger = reviewCostLedger(costCtx);
         modelUsed = out.model_used ?? modelUsed;
         degraded = degraded || out.capacity_degraded === true;
         if (out.decision !== "approve" && out.decision !== "reject") {
-            return { ...out, cost_usd: cost, capacity_degraded: degraded ? true : out.capacity_degraded };
+            return {
+                ...out,
+                cost_usd: partLedger.total_usd,
+                cost_cap: costCtx.cap,
+                cost_breakdown: partLedger,
+                capacity_degraded: degraded ? true : out.capacity_degraded,
+            };
         }
-        if (cap > 0 && cost > cap)
-            return overChunkedCostCap(cost, cap, modelUsed);
         passes.push({ decision: out.decision, reasons: out.reasons, confidence: out.confidence });
     }
     const allPaths = diffFilePaths(input.pr_diff);
     const evidence = renderSynthesisEvidence(chunks, passes, allPaths);
     const synthPrompt = `${renderReviewerPrompt({ ...input, pr_diff: evidence })}\n\n${synthesisScopeNotice(chunks.length)}\n`;
-    const final = await runClaudeAndDecide(synthPrompt, passPolicy, { ...deps, authCanary: undefined }, spawnFn, engine);
-    cost += final.cost_usd;
+    const final = await runClaudeAndDecide(synthPrompt, policy, { ...deps, authCanary: undefined }, spawnFn, engine, costCtx);
+    const ledger = reviewCostLedger(costCtx);
     modelUsed = final.model_used ?? modelUsed;
     degraded = degraded || final.capacity_degraded === true;
     if (final.decision !== "approve" && final.decision !== "reject") {
-        return { ...final, cost_usd: cost, capacity_degraded: degraded ? true : final.capacity_degraded };
+        return {
+            ...final,
+            cost_usd: ledger.total_usd,
+            cost_cap: costCtx.cap,
+            cost_breakdown: ledger,
+            capacity_degraded: degraded ? true : final.capacity_degraded,
+        };
     }
-    if (cap > 0 && cost > cap)
-        return overChunkedCostCap(cost, cap, modelUsed);
     // Guard FIRST (so a coverage claim can never survive as a verdict), then stamp
     // the coverage telemetry — which must never itself be partitioned as a claim.
     const guarded = guardCoverageClaims({
         ...final,
-        cost_usd: cost,
+        cost_usd: ledger.total_usd,
         model_used: modelUsed,
         capacity_degraded: degraded ? true : undefined,
     });
+    // REV-COST: the overrun note (when the paid spend landed in the tolerance
+    // band) sits between the findings and the coverage telemetry — a real reason,
+    // so it must precede chunkedCoverageReason to keep THAT last.
+    const stamped = stampReviewCost(guarded, costCtx);
     return {
-        ...guarded,
-        reasons: [...guarded.reasons, chunkedCoverageReason(chunks.length, allPaths.length, input.pr_diff.length)],
+        ...stamped,
+        reasons: [...stamped.reasons, chunkedCoverageReason(chunks.length, allPaths.length, input.pr_diff.length)],
     };
 }
-/** Cost-cap parity for the chunked path: the cap applies to the WHOLE review. */
-function overChunkedCostCap(cost, cap, modelUsed) {
+/**
+ * REV-COST — stamp the cost ledger onto a FINISHED review outcome and, when
+ * the chargeable spend landed in the OVERRUN band (over the effective cap, under
+ * the runaway threshold), keep the verdict and add the advisory note.
+ *
+ * Called exactly once per review, after the verdict is assembled — never on a
+ * chunked PART pass, so a budget note can never leak into the synthesis evidence
+ * and be re-read as a finding.
+ */
+function stampReviewCost(out, costCtx) {
+    const ledger = reviewCostLedger(costCtx);
+    const isVerdict = out.decision === "approve" || out.decision === "reject";
+    const overrun = isVerdict && classifyReviewCost(ledger.chargeable_usd, costCtx.cap) === "overrun";
     return {
-        decision: "cost_cap_exceeded",
-        reasons: [
-            `reviewer cost $${cost.toFixed(4)} exceeded cap $${cap.toFixed(2)} across the chunked review`,
-        ],
-        confidence: 0,
-        session_id: null,
-        cost_usd: cost,
-        model_used: modelUsed,
+        ...out,
+        reasons: overrun
+            ? [...out.reasons, reviewCostOverrunReason(costCtx.cap, ledger)]
+            : out.reasons,
+        cost_cap: costCtx.cap,
+        cost_breakdown: ledger,
+        ...(overrun ? { cost_overrun: true } : {}),
     };
 }
 /**
@@ -1261,57 +1838,90 @@ async function invokeReviewerModel(spawnFn, modelId, prompt, sleepFn, maxCapacit
 /** RVU-2: a budget-exempt env-broken (auth) reviewer_error. Decision stays
  *  `reviewer_error` (frozen); the marker reason makes the shared cron treat it
  *  as budget-exempt and alert once. */
-function envBrokenOutcome(modelId, detail) {
+function envBrokenOutcome(modelId, detail, ledger) {
     return {
         decision: "reviewer_error",
         reasons: [REVIEWER_ENV_BROKEN_REASON, `detail: ${(detail ?? "").slice(0, 160)}`],
         confidence: 0,
+        // REV-COST: an auth fault costs nothing and is charged to INFRA, never to
+        // the per-review budget — the review still needs its productive attempt.
+        cost_usd: ledger?.total_usd ?? 0,
         session_id: null,
-        cost_usd: 0,
         model_used: modelId,
         env_broken: true,
+        ...(ledger ? { cost_breakdown: ledger } : {}),
     };
 }
 /** RVU-2: assemble the outcome from a clean (exit 0) reviewer envelope. Cost-cap
- *  parity + parse are unchanged; `degraded` marks a re-routed (lower-tier) run. */
-function finalizeReviewerSuccess(stdout, modelId, degraded, policy, engine) {
+ *  parity + parse are unchanged; `degraded` marks a re-routed (lower-tier) run.
+ *  REV-COST: the cap is now the size-scaled decision carried in `costCtx`, and
+ *  only the RUNAWAY band refuses the verdict here. */
+function finalizeReviewerSuccess(stdout, modelId, degraded, costCtx, engine) {
     const envelope = parseEnvelope(stdout, modelId, engine);
-    // Cost cap parity with api/_lib/reviewer-agent.ts. A cap of 0 disables it.
-    if (policy &&
-        policy.max_cost_usd_per_review > 0 &&
-        envelope.cost_usd > policy.max_cost_usd_per_review) {
+    // REV-COST: the spawn returned a readable envelope, so this is the review's
+    // PRODUCTIVE attempt — the only class charged to the per-review cap. Parity
+    // with api/_lib/reviewer-agent.ts, which charges at exactly this point.
+    const ledger = chargeReviewAttempt(costCtx, modelId, "productive", envelope.cost_usd);
+    // REV-COST RUNAWAY BACKSTOP. Past `cap × REVIEW_COST_OVERRUN_TOLERANCE`
+    // something is pathological, so the verdict is still refused. Inside the band
+    // the spend is judged AFTER the verdict is assembled (stampReviewCost): the
+    // money is already gone, and discarding a paid verdict only stranded the PR
+    // (#1937 — $18 spent, $8 flat cap, NO verdict) and re-charged the same review
+    // on the next tick. A cap of 0 disables the whole check, as before.
+    if (classifyReviewCost(ledger.chargeable_usd, costCtx.cap) === "runaway") {
         return {
             decision: "cost_cap_exceeded",
-            reasons: [
-                `reviewer cost $${envelope.cost_usd.toFixed(4)} exceeded cap $${policy.max_cost_usd_per_review.toFixed(2)}`,
-            ],
+            reasons: [reviewCostRunawayReason(costCtx.cap, ledger)],
             confidence: 0,
             session_id: envelope.session_id,
-            cost_usd: envelope.cost_usd,
+            cost_usd: ledger.total_usd,
             model_used: modelId,
+            cost_cap: costCtx.cap,
+            cost_breakdown: ledger,
         };
     }
     const decision = extractReviewerDecision(envelope.result);
     if (!decision) {
+        // S15-FU/REVIEW-1 (AC2): a PARSE FAULT is an explicit ABSTAIN. The unparsed
+        // output head is carried as QUARANTINED context (never a finding) so an
+        // operator can diagnose the format drift without any of that text being
+        // scored as a defect.
+        process.stderr.write(describeAbstainForLog("verdict_parse"));
         return {
             decision: "reviewer_error",
-            reasons: [
+            reasons: abstainReasons("verdict_parse", [
                 "could not parse reviewer JSON from claude output",
                 `output_head: ${envelope.result.slice(0, 200)}`,
-            ],
+            ]),
             confidence: 0,
             session_id: envelope.session_id,
-            cost_usd: envelope.cost_usd,
+            cost_usd: ledger.total_usd,
             model_used: modelId,
+            cost_cap: costCtx.cap,
+            cost_breakdown: ledger,
         };
     }
-    return {
+    // D-7 (2026-09-05): a reject whose ONLY reasons are pure LOC-cap advisories is
+    // not a rejection — flip to approve, keeping the measured overrun in `reasons`.
+    // The prompt already instructs the model to do this; the guard makes the operator
+    // decision deterministic. Conservative: a single non-cap reason keeps the reject,
+    // so the reviewer's bias-to-reject is untouched for every other finding.
+    const adjudicated = applyLocCapAdvisory({
         decision: decision.decision,
         reasons: decision.reasons,
+    });
+    return {
+        decision: adjudicated.decision,
+        reasons: adjudicated.reasons,
         confidence: decision.confidence,
         session_id: envelope.session_id,
         cost_usd: envelope.cost_usd,
         model_used: modelId,
+        // REVIEW-DECISION-PROVENANCE: carried as a field (never a reason) so it
+        // survives the coverage/absence guards without being read as a finding.
+        ...(decision.decision_provenance
+            ? { decision_provenance: decision.decision_provenance }
+            : {}),
         // Signal capacity pressure to watch.ts only when the review actually
         // re-routed to a lower tier (leave undefined on the primary-model path).
         capacity_degraded: degraded ? true : undefined,
@@ -1326,12 +1936,17 @@ function finalizeReviewerSuccess(stdout, modelId, degraded, policy, engine) {
  * explicit broken CLI-auth signal surfaces as budget-exempt env_broken rather
  * than looping. Cost-cap / parse behaviour is unchanged.
  */
-async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine) {
+async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine, costCtx) {
     const sleepFn = deps.sleep ?? defaultSleep;
-    const baseModel = policy?.model_id ?? "claude-sonnet-4-6";
     const maxCapacityRetries = resolveCapacityRetries(process.env[CAPACITY_RETRIES_ENV]);
-    const chain = modelFallbackChain(baseModel, deps.modelChainMax ?? DEFAULT_MODEL_CHAIN_MAX);
-    const primaryModel = chain[0] ?? baseModel;
+    // CROSS-ENGINE-REVIEW-1 (AC10): map policy.model_id onto the SELECTED reviewer
+    // engine. For codex this drops a Claude id (e.g. 'claude-sonnet-4-6') to an
+    // unpinned run so the reviewer engine never receives a foreign model id;
+    // Claude keeps its catalog fallback chain (built from the CANONICAL API id via
+    // toReviewerApiId — the #2169 namespace split — and CLI-alias-translated only
+    // at the spawn call inside the loop). See `reviewerModelChain`.
+    const chain = reviewerModelChain(engine, policy?.model_id, deps.modelChainMax ?? DEFAULT_MODEL_CHAIN_MAX);
+    const primaryModel = chain[0] ?? `${engine.id}-default`;
     // RVU-2: optional env-broken CLI-auth PREFLIGHT canary. A broken login /
     // rejected key is caught BEFORE spawning the reviewer against a dead
     // credential, so it never loops as a spurious reviewer_error.
@@ -1344,18 +1959,23 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine) {
             probes = [];
         }
         if (isEnvBrokenReviewerProbe(probes)) {
-            return envBrokenOutcome(primaryModel, "preflight auth canary: repeated silent CLI exit (broken login / rejected key)");
+            return envBrokenOutcome(primaryModel, "preflight auth canary: repeated silent CLI exit (broken login / rejected key)", chargeReviewAttempt(costCtx, primaryModel, "infra_auth", 0));
         }
     }
     let lastCapacityDetail = "reviewer capacity exhausted across all fallback tiers";
     let lastResumeMs = null;
     for (let i = 0; i < chain.length; i++) {
-        const modelId = chain[i];
+        // `modelId` is the CANONICAL id recorded on every outcome / cost row below.
+        const modelId = chain[i] ?? `${engine.id}-default`;
+        // Alias→CLI translation is one-way, for the spawn call ONLY — never recorded.
+        // Codex passes its own id (or null, its unpinned default) straight through;
+        // Claude spawns the CLI alias derived from the canonical id.
+        const spawnModelId = chain[i] === null || engine.id === "codex" ? chain[i] : toReviewerCliAlias(modelId);
         const isLast = i === chain.length - 1;
-        const invokeResult = await invokeReviewerModel(spawnFn, modelId, prompt, sleepFn, maxCapacityRetries, engine);
-        const { stdout, exitCode, stderr: claudeStderr, durationMs } = invokeResult;
+        const invokeResult = await invokeReviewerModel(spawnFn, spawnModelId, prompt, sleepFn, maxCapacityRetries, engine);
+        const { stdout, exitCode, stderr: claudeStderr, durationMs, deliverySymptom } = invokeResult;
         if (exitCode === 0) {
-            return finalizeReviewerSuccess(stdout, modelId, modelId !== primaryModel, policy, engine);
+            return finalizeReviewerSuccess(stdout, modelId, modelId !== primaryModel, costCtx, engine);
         }
         const classified = engine.classifyFailure(exitCode, claudeStderr, stdout, durationMs);
         const combined = `${claudeStderr}\n${stdout}`;
@@ -1367,7 +1987,7 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine) {
         if (classified.class === "auth_expired" ||
             classified.class === "env_broken" ||
             isReviewerAuthFailure(combined)) {
-            return envBrokenOutcome(modelId, classified.detail);
+            return envBrokenOutcome(modelId, classified.detail, chargeReviewAttempt(costCtx, modelId, "infra_auth", 0));
         }
         const isCapacity = classified.class === "capacity_exhausted" ||
             classified.class === "claude_unavailable";
@@ -1376,6 +1996,10 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine) {
             const resumeMs = extractResetTime(combined);
             if (resumeMs !== null)
                 lastResumeMs = resumeMs;
+            // REV-COST: a 429/overload brownout is INFRA. Recording it makes "N
+            // attempts on one review" visible WITHOUT any of those attempts consuming
+            // the per-review budget the productive attempt needs.
+            const capacityLedger = chargeReviewAttempt(costCtx, modelId, "infra_capacity", 0);
             // Re-route to the next lower catalog tier instead of stalling the lane.
             if (!isLast)
                 continue;
@@ -1389,22 +2013,39 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine) {
                 session_id: null,
                 cost_usd: 0,
                 resume_at: lastResumeMs !== null ? new Date(lastResumeMs).toISOString() : null,
+                engine: engine.id,
                 model_used: modelId,
                 capacity_degraded: true,
+                cost_cap: costCtx.cap,
+                cost_breakdown: capacityLedger,
             };
         }
         // Genuine error (task_error / usage_limit) — legacy reviewer_error, no
         // re-route (a lower tier would just repeat the failure/cost).
+        const diagnostics = failureDiagnostics({
+            exitCode,
+            stdout,
+            stderr: claudeStderr,
+            detail: classified.detail,
+            label: engine.id,
+        });
+        // REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — the child cause is already named by
+        // `diagnostics` (its first-useful stderr line) and its FULL stderr is preserved
+        // verbatim in stderr_tail. When a startup-death write symptom was recorded, append
+        // it AFTER the child cause: it names the masked exit/signal, labels the parent
+        // write a symptom, and carries the tooling marker so the row is budget-exempt.
+        const reasons = deliverySymptom
+            ? [...diagnostics.reasons, deliverySymptom]
+            : diagnostics.reasons;
         return {
             decision: "reviewer_error",
-            reasons: [
-                `claude exited ${exitCode}`,
-                ...(claudeStderr ? [`stderr: ${claudeStderr.slice(0, 200)}`] : []),
-            ],
+            reasons,
             confidence: 0,
             session_id: null,
             cost_usd: 0,
             model_used: modelId,
+            stdout_tail: diagnostics.stdoutTail,
+            stderr_tail: diagnostics.stderrTail,
         };
     }
     // Unreachable in practice (chain always has ≥1 entry): a blank policy model