gentle-pi 2.4.0 → 2.6.0

package/extensions/gentle-ai.ts

@@ -1,3 +1,7 @@
+import { consumeReviewMutation, pendingReviewMutation, recordReviewMutation } from "../lib/review-reminder-receipt.ts";
+import { resolveSessionWorktree } from "../lib/session-worktree-registry.ts";
+import { resolveResearchCapabilities, renderResearchCapabilities } from "../lib/sdd-research-capabilities.ts";
+import { declareReviewRelayHandshake } from "../lib/review-relay-contract.ts";
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import {
@@ -28,15 +32,20 @@ import type {
 	ThemeColor,
 	ToolCallEventResult,
 } from "@earendil-works/pi-coding-agent";
-import { matchesKey, truncateToWidth } from "@earendil-works/pi-tui";
+import { Key, isKeyRelease, matchesKey, truncateToWidth, type KeybindingsManager, type TuiMouseEvent, type TuiMouseEventResult } from "@earendil-works/pi-tui";
 import { resolveGentlePiAgentHome } from "../lib/agent-home.ts";
 import {
 	ensureSddPreflight,
 	getSddPreflightPreferences,
-	installSddAssets,
+	installPackageAssets,
+	getPackageAssetOwner,
+	hasPackageAssetOwnerInstallation,
+	type PackageAssetOwner,
 	isPackageManagedSddAsset,
 	isSddPreflightTrigger,
 	renderSddPreflightPrompt,
+	isParentConfirmedSddPreflightContext,
+	SHIPPED_SDD_AGENT_NAMES,
 	SDD_PREFLIGHT_FIELDS,
 	type SddPreflightField,
 	type SddPreflightPreferences,
@@ -54,13 +63,46 @@ import {
 	type ModelConfigFileResult,
 	type ThinkingLevel,
 } from "../lib/model-routing-authority.ts";
+import {
+	bootstrapProfilesFile,
+	buildProfileListItems,
+	createProfile,
+	deleteProfile,
+	duplicateProfile,
+	formatOrchestratorSelection,
+	formatRoutingRow,
+	isProfileOrchestratorKey,
+	parseProfileExportTextWithDrops,
+	PROFILE_ORCHESTRATOR_KEY,
+	profileExportPath,
+	profileRoutingRows,
+	profilesFilePath,
+	readProfileOrchestrator,
+	readProfilesFileResult,
+	renameProfile,
+	routingColumnWidths,
+	serializeProfileExport,
+	setActiveProfile,
+	updateProfile,
+	writeProfilesFileSync,
+	type AgentProfilesFile,
+	type ProfileListItem,
+	type ProfileRoutingRow,
+	type ProfilesParseDrops,
+} from "../lib/agent-profiles.ts";
+import {
+	applyOrchestratorSettings,
+	readOrchestratorSettings,
+	restoreOrchestratorSettings,
+	type OrchestratorSettingsReadResult,
+} from "../lib/profiles-orchestrator.ts";
+import { measureAgentsViewLayout, type AgentsViewLayout } from "../lib/agents-view-layout.ts";
+import { NativeChoiceList } from "../lib/native-choice-list.ts";
+import { createNativeFullscreenInteraction } from "../lib/native-fullscreen-interaction.ts";
 import {
 	parseSddStatusCommandArgs,
 	renderNativeSddPhasePrompt,
-	renderSddDispatcherMarkdown,
-	renderSddStatusMarkdown,
 	resolveSddStatus,
-	sddStatusSeverity,
 	type SddPhase,
 } from "../lib/sdd-status.ts";
 import {
@@ -71,6 +113,8 @@ import {
 	REVIEW_HOST_RELAY_UNAVAILABLE_MESSAGE,
 	ReviewHostRelayError,
 	reviewHostRelaySlots,
+	reviewHostRelayUnachievableDetail,
+	reviewHostRelayUnachievableReason,
 	reviewProviderRoleVectorSlots,
 	resolveReviewHostRelaySubmission,
 	runReviewHostRelayReviewerGroup,
@@ -106,15 +150,24 @@ import { sanitizeTerminalText, stripAnsi } from "../lib/terminal-theme.ts";
 import { CandidateViewError, CandidateViewRegistry, injectReviewCandidateView, readCandidateContextManifestPage, resolveCanonicalCandidateBase, type CandidateView } from "../lib/review-candidate-view.ts";
 import {
 	GentleAiDevBinaryOverrideError,
+	GENTLE_AI_INSTALL_RECOVERY_COMMAND,
+	GENTLE_AI_INSTALL_RECOVERY_INSTRUCTIONS,
 	registerGentleAiDevBinary,
+	resolveGentleAiBinary,
 	resolveGentleAiDevBinaryOverride,
 	unregisterGentleAiDevBinary,
 	type GentleAiDevBinaryOverride,
 } from "../lib/gentle-ai-binary.ts";
+import {
+	spawnTelemetryTrigger,
+	type TelemetryTriggerSpawn,
+} from "../lib/telemetry-trigger.ts";
 import {
 	createNativeReviewCli,
 	createNodeExecFileAdapter,
+	decodeNativeSddStatusV2,
 	isCanonicalProcessString,
+	isNativeReviewUnachievableVerbRefused,
 	nativeReviewAbandonAuthorization,
 	nativeReviewLegacyAliasRepairAuthorization,
 	nativeReviewLegacyQuarantineAuthorization,
@@ -134,15 +187,32 @@ import {
 	NATIVE_REVIEW_RECONCILE_ANOMALIES,
 	sanitizeForeignNativeReviewDiagnostics,
 	type NativeReviewCli,
+	type NativeSddStatusV2,
 	type NativeIntendedUntrackedSelectionSubmission,
 	type NativeReviewAcknowledgeApprovedOutcome,
 	type NativeReviewAcknowledgeApprovedRequest,
 	type NativeTargetStatusRequest,
 	type NativeReviewModeOperation,
 	type NativeReviewModeSource,
+	type NativeReviewModeStatus,
 	type NativeReviewProcessDiagnostics,
+	type NativeReviewUnachievableLensCaptureArtifact,
 	type NativeStartResult,
+	type NativeReviewAssessRequest,
+	type ExecFileAdapter,
+	type ExecFileResult,
 } from "../lib/native-review-cli.ts";
+import {
+	verificationPlan,
+	resolveWriterProfile,
+	RDD_LINE,
+	VERIFICATION_TIER,
+	NATIVE_REVIEW_OUTCOME,
+	type RddLine,
+	type VerificationTier,
+	type ReviewAssessmentV1,
+	type NativeReviewOutcome,
+} from "../lib/review-risk-assessment.ts";
 import {
 	assertReviewApprovedAcknowledgementExecuteV1,
 	decodeReviewLastEventClosureV1,
@@ -153,7 +223,19 @@ import {
 	type ReviewStatusV3,
 } from "../lib/review-integration-v2.ts";
 import { reconcileUnknownReviewLastEventCapture } from "../lib/review-last-event-controller.ts";
-import { recordReviewConsentLatch } from "../lib/review-consent-latch.ts";
+import { acquireChildStandingReviewPermissionClient, type ChildStandingReviewPermissionClient } from "../lib/review-session-standing-permission-ipc.ts";
+import { isPiConsentV3, presentReviewConsentUi } from "../lib/review-consent-ui.ts";
+import {
+	captureReviewSessionIdentity,
+	grantReviewSessionPermission,
+	hasReviewSessionPermission,
+	resolveCanonicalGitRepositoryIdentity,
+	revokeReviewSessionPermission,
+	reviewSessionPermissionEpoch,
+	revokeReviewSessionPermissionsForSession,
+	sameReviewSessionIdentity,
+	type ReviewSessionIdentity,
+} from "../lib/review-session-standing-permission.ts";
 
 const GRAPH_V1_ORDINARY_READ_ONLY = "Graph-v1 ordinary review authority is read-only; use native compact-v2 review operations";
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -163,8 +245,9 @@ function gentlePiAgentHome(): string {
 	return resolveGentlePiAgentHome();
 }
 
-function sddGlobalAssetDriftCount(): number {
+function packageAssetAudit(owner: PackageAssetOwner): { stale: number; overrides: number } {
 	let stale = 0;
+	let overrides = 0;
 	for (const [assetSubdir, installedSubdir, ownershipPrefix] of [
 		["agents", "agents", "agents"],
 		["chains", "chains", "chains"],
@@ -173,7 +256,7 @@ function sddGlobalAssetDriftCount(): number {
 		const assetDir = join(ASSETS_DIR, assetSubdir);
 		if (!existsSync(assetDir)) continue;
 		for (const entry of readdirSync(assetDir, { withFileTypes: true })) {
-			if (!entry.isFile()) continue;
+			if (!entry.isFile() || getPackageAssetOwner(`${ownershipPrefix}/${entry.name}`) !== owner) continue;
 			const installedPath = join(gentlePiAgentHome(), installedSubdir, entry.name);
 			try {
 				if (!existsSync(installedPath)) {
@@ -186,6 +269,7 @@ function sddGlobalAssetDriftCount(): number {
 						`${ownershipPrefix}/${entry.name}`,
 					)
 				) {
+					overrides += 1;
 					continue;
 				}
 				const packaged = readFileSync(join(assetDir, entry.name), "utf8");
@@ -206,26 +290,47 @@ function sddGlobalAssetDriftCount(): number {
 			}
 		}
 	}
-	return stale;
+	return { stale, overrides };
+}
+
+function packageAssetDiagnosticLines(cwd: string): string[] {
+	return (["delegation", "review", "sdd"] as const).flatMap((owner) => {
+		const label = owner === "sdd" ? "SDD" : owner;
+		const onDemand = owner === "sdd" && !hasPackageAssetOwnerInstallation(owner);
+		const { stale, overrides } = packageAssetAudit(owner);
+		const local = localAgentOverrideCount(cwd, owner);
+		const lines = [onDemand
+			? `info: Global ${label} assets: on demand (not installed)`
+			: `${stale > 0 ? "warn" : "pass"}: Global ${label} assets stale: ${stale} file(s)`];
+		if (!onDemand && stale > 0) {
+			lines[0] += ` — run /gentle:install-${owner} --force to refresh managed assets`;
+		}
+		if (overrides > 0) {
+			lines.push(`info: Global ${label} user overrides: ${overrides} file(s); preserved, not package drift`);
+		}
+		if (local > 0) {
+			lines.push(`warn: Active ${label} agent overrides: ${local} file(s) — active non-builtin ${label} agents shadow package assets; keep only intentional overrides`);
+		}
+		return lines;
+	});
 }
 
-function sddLocalAgentOverrideCount(cwd: string): number {
+function localAgentOverrideCount(cwd: string, owner: PackageAssetOwner): number {
 	const packageSddAgentsDir = join(ASSETS_DIR, "agents");
-	const packageSddAgentNames = existsSync(packageSddAgentsDir)
-		? new Set(
-				readdirSync(packageSddAgentsDir, { withFileTypes: true })
-					.filter((entry) => entry.isFile() && /^sdd-.*\.md$/i.test(entry.name))
-					.map((entry) => entry.name),
+	const packageSddAgentNames = new Set(
+		listAgentsFromDir(packageSddAgentsDir, "builtin")
+			.filter((agent) =>
+				getPackageAssetOwner(
+					`agents/${relative(packageSddAgentsDir, agent.filePath).split(sep).join("/")}`,
+				) === owner,
 			)
-		: new Set<string>();
+			.map((agent) => agent.name),
+	);
 	let count = 0;
-	for (const installedDir of [
-		join(cwd, ".pi", "agents"),
-		join(cwd, ".pi", "subagents"),
-	]) {
-		if (!existsSync(installedDir)) continue;
-		for (const entry of readdirSync(installedDir, { withFileTypes: true })) {
-			if (entry.isFile() && packageSddAgentNames.has(entry.name)) count += 1;
+	for (const { dir, source, packageManaged } of discoverableNonBuiltinAgentRoots(cwd)) {
+		if (packageManaged || !existsSync(dir)) continue;
+		for (const agent of listAgentsFromDir(dir, source)) {
+			if (packageSddAgentNames.has(agent.name)) count += 1;
 		}
 	}
 	return count;
@@ -465,7 +570,13 @@ function renderBackgroundSubagentsReport(
 
 const SUBAGENTS_PACKAGE_NAMES = ["pi-subagents-j0k3r", "pi-subagents"] as const;
 const SUBAGENT_RUN_TOOL = "subagent_run";
-const BOUNDED_WRITER_AGENT_NAMES = ["gentle-ai-worker", "worker"] as const;
+const JUDGMENT_DAY_FIX_AGENT_NAME = "jd-fix-agent";
+const BOUNDED_WRITER_AGENT_NAMES = ["gentle-ai-worker", "worker", JUDGMENT_DAY_FIX_AGENT_NAME] as const;
+const JUDGMENT_DAY_ACTIVATION_HEADING = "## Judgment Day activation";
+const JUDGMENT_DAY_ACTIVATION_SENTENCE = "User explicitly requested Judgment Day.";
+const JUDGMENT_DAY_AUTHORIZED_SEVERE_IDS_HEADING = "## Exact authorized severe IDs";
+const JUDGMENT_DAY_CORRECTION_BATCH_HEADING = "## Judgment Day correction batch";
+const JUDGMENT_DAY_FROZEN_FINDING_ROWS_HEADING = "## Exact frozen finding rows";
 const ALLOWED_EDIT_SURFACES_HEADING = /^## Allowed edit surfaces[ \t]*$/gim;
 const MARKDOWN_HEADING_LINE = /^ {0,3}#{1,6} /;
 const MARKDOWN_LIST_MARKER = /^(?:[-*+]|\d+[.)]) +/;
@@ -569,6 +680,15 @@ function hasTaskScopedAllowedEditSurfaces(...values: unknown[]): boolean {
 	return hasSection;
 }
 
+function sddDispatchAgentName(input: unknown): string | undefined {
+	if (!isRecord(input)) return undefined;
+	if (typeof input.agent === "string" && SDD_AGENT_NAME_SET.has(input.agent)) return input.agent;
+	if (Array.isArray(input.agent) && input.agent.some((agent) => typeof agent === "string" && SDD_AGENT_NAME_SET.has(agent))) {
+		return "invalid";
+	}
+	return undefined;
+}
+
 function rejectUnscopedBoundedWriterDispatch(input: unknown): { block: true; reason: string } | undefined {
 	if (
 		!isRecord(input) ||
@@ -583,6 +703,165 @@ function rejectUnscopedBoundedWriterDispatch(input: unknown): { block: true; rea
 	return { block: true, reason: WRITER_EDIT_SURFACE_REJECTION };
 }
 
+function hasJudgmentDayFixAgentReference(input: Record<string, unknown>): boolean {
+	return input.agent === JUDGMENT_DAY_FIX_AGENT_NAME ||
+		(Array.isArray(input.agent) && input.agent.includes(JUDGMENT_DAY_FIX_AGENT_NAME)) ||
+		input.agents === JUDGMENT_DAY_FIX_AGENT_NAME ||
+		(Array.isArray(input.agents) && input.agents.includes(JUDGMENT_DAY_FIX_AGENT_NAME));
+}
+
+function canonicalJudgmentDaySectionBodies(value: unknown, heading: string): string[][] {
+	if (typeof value !== "string") return [];
+	const headingPattern = new RegExp(`^${heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "gm");
+	return [...value.matchAll(headingPattern)].map((match) => {
+		const body = value.slice((match.index ?? 0) + match[0].length);
+		const nextHeading = body.search(/^ {0,3}#{1,6} /m);
+		return body
+			.slice(0, nextHeading === -1 ? undefined : nextHeading)
+			.split(/\r?\n/)
+			.filter((line) => line.length > 0);
+	});
+}
+
+const JUDGMENT_DAY_SEVERE_ID_ENTRY = /^- `(JD-[A-Z][A-Z0-9]*-\d+)`$/;
+const JUDGMENT_DAY_CORRECTION_ROUND_ENTRY = /^Round: [12] of 2\.$/;
+const JUDGMENT_DAY_FROZEN_LEDGER_SHA256_ENTRY = /^Frozen ledger SHA-256: `([0-9a-f]{64})`$/;
+const JUDGMENT_DAY_FROZEN_ROW_FIELDS = [
+	"id",
+	"lens",
+	"location",
+	"severity",
+	"status_at_freeze",
+	"evidence_class",
+	"evidence_claim",
+] as const;
+const JUDGMENT_DAY_FIX_SECTION_HEADINGS = [
+	JUDGMENT_DAY_ACTIVATION_HEADING,
+	JUDGMENT_DAY_AUTHORIZED_SEVERE_IDS_HEADING,
+	JUDGMENT_DAY_CORRECTION_BATCH_HEADING,
+	JUDGMENT_DAY_FROZEN_FINDING_ROWS_HEADING,
+	"## Allowed edit surfaces",
+] as const;
+
+function canonicalJudgmentDaySevereIds(entries: readonly string[]): string[] | undefined {
+	const ids = entries.map((entry) => entry.match(JUDGMENT_DAY_SEVERE_ID_ENTRY)?.[1]);
+	return ids.length > 0 && ids.every((id): id is string => id !== undefined) && new Set(ids).size === ids.length
+		? ids
+		: undefined;
+}
+
+function canonicalJudgmentDayCorrectionBatchHash(entries: readonly string[]): string | undefined {
+	if (entries.length !== 2 || !JUDGMENT_DAY_CORRECTION_ROUND_ENTRY.test(entries[0]!)) return undefined;
+	return entries[1]!.match(JUDGMENT_DAY_FROZEN_LEDGER_SHA256_ENTRY)?.[1];
+}
+
+function isNonEmptyJudgmentDayFrozenField(value: unknown): value is string {
+	return typeof value === "string" && value.trim().length > 0;
+}
+
+function parseCanonicalJudgmentDayFrozenRows(
+	entries: readonly string[],
+	authorizedIds: readonly string[],
+): Record<string, unknown>[] | undefined {
+	if (entries.length !== authorizedIds.length) return undefined;
+	const rows: Record<string, unknown>[] = [];
+	const rowIds: string[] = [];
+	for (const entry of entries) {
+		let row: unknown;
+		try {
+			row = JSON.parse(entry) as unknown;
+		} catch {
+			return undefined;
+		}
+		if (!isRecord(row)) return undefined;
+		const keys = Object.keys(row);
+		if (keys.length !== JUDGMENT_DAY_FROZEN_ROW_FIELDS.length ||
+			!JUDGMENT_DAY_FROZEN_ROW_FIELDS.every((field) => field in row) ||
+			!isNonEmptyJudgmentDayFrozenField(row.id) ||
+			!JUDGMENT_DAY_SEVERE_ID_ENTRY.test(`- \`${row.id}\``) ||
+			row.lens !== "judgment-day" ||
+			!isNonEmptyJudgmentDayFrozenField(row.location) ||
+			(row.severity !== "BLOCKER" && row.severity !== "CRITICAL") ||
+			row.status_at_freeze !== "open" ||
+			!isNonEmptyJudgmentDayFrozenField(row.evidence_class) ||
+			!isNonEmptyJudgmentDayFrozenField(row.evidence_claim)
+		) return undefined;
+		rows.push(row);
+		rowIds.push(row.id);
+	}
+	return new Set(rowIds).size === rowIds.length &&
+		rowIds.every((id, index) => id === authorizedIds[index])
+		? rows
+		: undefined;
+}
+
+function hasCanonicalJudgmentDayFixSectionOrder(...values: unknown[]): boolean {
+	const dispatch = values.filter((value): value is string => typeof value === "string").join("\n");
+	let previousPosition = -1;
+	for (const heading of JUDGMENT_DAY_FIX_SECTION_HEADINGS) {
+		const matches = [...dispatch.matchAll(new RegExp(`^${heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "gm"))];
+		if (matches.length !== 1 || (matches[0]!.index ?? -1) <= previousPosition) return false;
+		previousPosition = matches[0]!.index ?? -1;
+	}
+	return true;
+}
+
+function hasCanonicalJudgmentDayFixActivation(...values: unknown[]): boolean {
+	const hasMalformedHeading = values.some((value) =>
+		typeof value === "string" && value.split(/\r?\n/).some((line) => {
+			const candidate = line.match(/^ {0,3}#{1,6} (Judgment Day activation|Exact authorized severe IDs|Judgment Day correction batch|Exact frozen finding rows)[ \t]*$/i);
+			return candidate !== null &&
+				line !== JUDGMENT_DAY_ACTIVATION_HEADING &&
+				line !== JUDGMENT_DAY_AUTHORIZED_SEVERE_IDS_HEADING &&
+				line !== JUDGMENT_DAY_CORRECTION_BATCH_HEADING &&
+				line !== JUDGMENT_DAY_FROZEN_FINDING_ROWS_HEADING;
+		}),
+	);
+	const activationBodies = values.flatMap((value) =>
+		canonicalJudgmentDaySectionBodies(value, JUDGMENT_DAY_ACTIVATION_HEADING),
+	);
+	const severeIdBodies = values.flatMap((value) =>
+		canonicalJudgmentDaySectionBodies(value, JUDGMENT_DAY_AUTHORIZED_SEVERE_IDS_HEADING),
+	);
+	const correctionBatchBodies = values.flatMap((value) =>
+		canonicalJudgmentDaySectionBodies(value, JUDGMENT_DAY_CORRECTION_BATCH_HEADING),
+	);
+	const frozenFindingRowBodies = values.flatMap((value) =>
+		canonicalJudgmentDaySectionBodies(value, JUDGMENT_DAY_FROZEN_FINDING_ROWS_HEADING),
+	);
+	const authorizedIds = severeIdBodies.length === 1
+		? canonicalJudgmentDaySevereIds(severeIdBodies[0]!)
+		: undefined;
+	const correctionBatchHash = correctionBatchBodies.length === 1
+		? canonicalJudgmentDayCorrectionBatchHash(correctionBatchBodies[0]!)
+		: undefined;
+	const frozenFindingRows = authorizedIds !== undefined && frozenFindingRowBodies.length === 1
+		? parseCanonicalJudgmentDayFrozenRows(frozenFindingRowBodies[0]!, authorizedIds)
+		: undefined;
+	return !hasMalformedHeading && hasCanonicalJudgmentDayFixSectionOrder(...values) &&
+		activationBodies.length === 1 &&
+		activationBodies[0]!.length === 1 &&
+		activationBodies[0]![0] === JUDGMENT_DAY_ACTIVATION_SENTENCE &&
+		authorizedIds !== undefined && correctionBatchHash !== undefined &&
+		frozenFindingRows !== undefined && correctionBatchHash === canonicalHash(frozenFindingRows);
+}
+
+const JUDGMENT_DAY_FIX_DISPATCH_REJECTION =
+	"Judgment Day fix dispatch requires exactly one `agent: \"jd-fix-agent\"`, one exact `## Judgment Day activation` section containing only `User explicitly requested Judgment Day.`, one non-empty unique canonical `## Exact authorized severe IDs` section, one exact `## Judgment Day correction batch` section with `Round: 1 of 2.` or `Round: 2 of 2.` and the matching canonical lowercase SHA-256 of one exact `## Exact frozen finding rows` section whose BLOCKER/CRITICAL open Judgment Day rows equal the authorized IDs in the same order, and the existing exact `## Allowed edit surfaces` guard. The parent must provide the canonical bounded dispatch; do not infer activation, authorization, or frozen findings.";
+
+function rejectInvalidJudgmentDayFixDispatch(input: unknown): { block: true; reason: string } | undefined {
+	if (!isRecord(input) || !hasJudgmentDayFixAgentReference(input)) return undefined;
+	if (
+		input.agent === JUDGMENT_DAY_FIX_AGENT_NAME &&
+		!("agents" in input) &&
+		hasCanonicalJudgmentDayFixActivation(input.task, input.context) &&
+		hasTaskScopedAllowedEditSurfaces(input.task, input.context)
+	) {
+		return undefined;
+	}
+	return { block: true, reason: JUDGMENT_DAY_FIX_DISPATCH_REJECTION };
+}
+
 /**
  * Roots where an installed subagents package may live. These are the same
  * roots builtinAgentDirs() walks, minus its `/agents` suffix.
@@ -671,21 +950,288 @@ function renderBackgroundSubagentsStatusLine(
 	return `Background subagent policy: ${background.policy} (capability: ${background.capability})`;
 }
 
-// Rendered prompts are memoized per background policy/capability key for the
-// process lifetime; the assets bytes themselves are read once per key.
+/**
+ * A `status` object is only trusted when `effective` is exactly `on`/`off`
+ * and `source` is one of the exported `NATIVE_REVIEW_MODE_SOURCE` values.
+ * `resolveRddModeStatus` only ever produces a value shaped like this, but
+ * `renderRddStatusLine` validates at the render boundary anyway -- a
+ * malformed or partial object (a bad decode upstream, a future field
+ * change, a hand-built test fixture) must fail closed to the "unknown"
+ * line, never render an unrecognized value verbatim.
+ */
+function isValidRddModeStatus(
+	status: NativeReviewModeStatus | undefined,
+): status is NativeReviewModeStatus {
+	if (status === undefined || status === null || typeof status !== "object") return false;
+	if (status.effective !== "on" && status.effective !== "off") return false;
+	const validSources: readonly string[] = Object.values(NATIVE_REVIEW_MODE_SOURCE);
+	return typeof status.source === "string" && validSources.includes(status.source);
+}
+
+/**
+ * Renders the receipt-driven-development status line rendered next to
+ * `Background subagent policy` (gentle-pi#661). Renders the fail-closed
+ * "unknown" line whenever `status` is not a validated on/off status with a
+ * recognized source -- `undefined` (the native reader could not answer:
+ * binary absent, timed out, aborted, or a native CLI failure) or any
+ * malformed/partial object. This is a pure render, never a native call, so
+ * it never throws.
+ */
+function renderRddStatusLine(
+	status: NativeReviewModeStatus | undefined,
+): string {
+	return isValidRddModeStatus(status)
+		? `Receipt-driven development: ${status.effective} (decided by ${status.source})`
+		: "Receipt-driven development: unknown (native status unavailable)";
+}
+
+// The primary-session prompt awaits this on every non-SDD, non-named agent
+// start, so an unbounded native read would stall session start behind a
+// hung `gentle-ai` child (gentle-pi#661 native-review escalation). The
+// production call site (before_agent_start) passes
+// `AbortSignal.timeout(RDD_STATUS_TIMEOUT_MS)`; resolveRddModeStatus also
+// races the call against that same signal itself (not just the CLI's own
+// signal handling) so an abort is honored even against a stub/mock
+// reviewMode that ignores its `signal` argument, as tests do.
+const RDD_STATUS_TIMEOUT_MS = 3000;
+// Repeated session/agent-start builds within this window reuse the last
+// resolved status instead of respawning the native binary. Deliberately
+// memoizes a failed/undefined resolution too (a sustained outage should not
+// retry every agent start), trading a slower recovery signal for far fewer
+// spawns; the one-shot notify below still surfaces a sustained outage.
+const RDD_STATUS_MEMO_TTL_MS = 30_000;
+const rddStatusMemo = new Map<string, { readonly status: NativeReviewModeStatus | undefined; readonly expiresAt: number }>();
+
+/** @internal test seam: clears the per-cwd RDD status memo. */
+function clearRddStatusMemoForTesting(): void {
+	rddStatusMemo.clear();
+}
+
+// gentle-pi#668 (corrected): last-known outcome for ONE candidate, keyed by
+// repository realpath AND targetIdentity -- never repository alone, or one
+// candidate's outcome would leak into every other candidate's `assess` call.
+// Only declined/unavailable are ever written (from ANSWER_CONSENT); `closed`
+// is never written/derived -- pass it explicitly. A missing entry reads back
+// `undefined`, treated as `unknown` (fail closed, exactly like `off`).
+const nativeReviewOutcomeByCandidate = new Map<string, "declined" | "unavailable">();
+
+function nativeReviewOutcomeMemoKey(cwd: string, targetIdentity: string): string {
+	try {
+		return `${realpathSync(cwd)}\u0000${targetIdentity}`;
+	} catch {
+		return `${cwd}\u0000${targetIdentity}`;
+	}
+}
+
+function recordNativeReviewOutcome(cwd: string, targetIdentity: string, outcome: "declined" | "unavailable"): void {
+	nativeReviewOutcomeByCandidate.set(nativeReviewOutcomeMemoKey(cwd, targetIdentity), outcome);
+}
+
+/** Returns the recorded outcome for exactly this candidate, or `undefined` when none is recorded. */
+function readNativeReviewOutcome(cwd: string, targetIdentity: string): "declined" | "unavailable" | undefined {
+	return nativeReviewOutcomeByCandidate.get(nativeReviewOutcomeMemoKey(cwd, targetIdentity));
+}
+
+/** @internal test seam: clears the per-candidate native review outcome memo. */
+function clearNativeReviewOutcomeMemoForTesting(): void {
+	nativeReviewOutcomeByCandidate.clear();
+}
+
+// Best-effort current-candidate target identity for `assess` (gentle-pi#668):
+// reuses `targetStatus`, a native call this tool already makes elsewhere.
+async function readCurrentTargetIdentityBestEffort(
+	nativeReviewCli: Pick<NativeReviewCli, "targetStatus"> | null | undefined,
+	cwd: string,
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	if (nativeReviewCli?.targetStatus === undefined) return undefined;
+	try {
+		const status = await nativeReviewCli.targetStatus({ cwd, ...(signal === undefined ? {} : { signal }) });
+		return status.applicability === "current_target" ? status.targetIdentity : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function rddAbortRejection(signal: AbortSignal): Promise<never> {
+	return new Promise((_resolve, reject) => {
+		if (signal.aborted) {
+			reject(signal.reason ?? new Error("aborted"));
+			return;
+		}
+		signal.addEventListener("abort", () => reject(signal.reason ?? new Error("aborted")), { once: true });
+	});
+}
+
+async function readRddModeStatusOnce(
+	nativeReviewCli: Pick<NativeReviewCli, "reviewMode"> | null | undefined,
+	cwd: string,
+	signal?: AbortSignal,
+): Promise<NativeReviewModeStatus | undefined> {
+	if (!nativeReviewCli?.reviewMode) return undefined;
+	try {
+		const call = nativeReviewCli.reviewMode({ cwd, operation: NATIVE_REVIEW_MODE_OPERATION.STATUS, signal });
+		const result = signal === undefined ? await call : await Promise.race([call, rddAbortRejection(signal)]);
+		return result.status;
+	} catch {
+		return undefined;
+	}
+}
+
+// gentle-pi#662: read-only combined native risk assessment plus the computed
+// verification plan (`lib/review-risk-assessment.ts`), for the `gentle_review`
+// tool's `assess` operation. Never throws: an unavailable/failed native
+// assess call (older binary without the verb, timeout, malformed response)
+// resolves to the `unassessable` tier, which `verificationPlan` treats the
+// same as `high` -- the fail-closed rule from gentle-pi#662.
+interface ReviewAssessmentPlanDetails {
+	schema: "gentle-pi.review-assessment-plan/v1";
+	risk: VerificationTier;
+	reasons: readonly { code: string; path: string; detail: string }[];
+	changedPaths: number;
+	changedLines: number;
+	candidate: { kind: string; baseRef: string | undefined } | null;
+	rddLine: RddLine;
+	nativeReviewOutcome: NativeReviewOutcome;
+	// gentle-pi#668: where nativeReviewOutcome came from -- explicit (caller
+	// passed it), derived (matched this exact candidate), or unknown.
+	outcome_source: "explicit" | "derived" | "unknown";
+	writerProfile: "small" | "large";
+	plan: {
+		writerSelfVerification: boolean;
+		structuralReadbackOnly: boolean;
+		independentVerifier: boolean;
+		reason: string;
+	};
+}
+
+async function resolveReviewAssessmentPlan(
+	nativeReviewCli: Pick<NativeReviewCli, "reviewMode" | "assess" | "targetStatus"> | null | undefined,
+	cwd: string,
+	input: ReviewAssessInput,
+	signal?: AbortSignal,
+): Promise<ReviewAssessmentPlanDetails> {
+	if (input.baseRef !== undefined && input.committedOnly !== true) throw new Error("Review assess baseRef requires committedOnly: true");
+	if (input.baseRef === undefined && input.committedOnly !== undefined) throw new Error("Review assess committedOnly requires an explicit baseRef");
+
+	const status = await readRddModeStatusOnce(nativeReviewCli, cwd, signal);
+	const rddLine: RddLine = isValidRddModeStatus(status) ? status.effective : RDD_LINE.UNKNOWN;
+	const writerProfile = resolveWriterProfile({
+		...(input.writerModelId === undefined ? {} : { model: { id: input.writerModelId } }),
+		thinking: input.writerEffort,
+	});
+
+	let assessment: ReviewAssessmentV1 | undefined;
+	let unassessableDetail: string | undefined;
+	if (nativeReviewCli?.assess === undefined) {
+		unassessableDetail = "native review assess is unavailable: the installed gentle-ai binary does not expose the assess command.";
+	} else {
+		try {
+			const request: NativeReviewAssessRequest = {
+				cwd,
+				...(input.baseRef === undefined ? {} : { baseRef: input.baseRef, committedOnly: true as const }),
+				...(signal === undefined ? {} : { signal }),
+			};
+			assessment = await nativeReviewCli.assess(request);
+		} catch (error) {
+			unassessableDetail = `native review assess failed: ${error instanceof Error ? error.message : String(error)}`;
+		}
+	}
+
+	const risk: VerificationTier = assessment?.risk ?? VERIFICATION_TIER.UNASSESSABLE;
+	// gentle-pi#668: explicit always wins; otherwise derive only for THIS
+	// candidate's own target identity, never repository-only. `closed` is
+	// never derived.
+	const targetIdentity = input.nativeReviewOutcome === undefined ? await readCurrentTargetIdentityBestEffort(nativeReviewCli, cwd, signal) : undefined;
+	const derived = targetIdentity === undefined ? undefined : readNativeReviewOutcome(cwd, targetIdentity);
+	const nativeReviewOutcome: NativeReviewOutcome = input.nativeReviewOutcome ?? derived ?? NATIVE_REVIEW_OUTCOME.UNKNOWN;
+	const outcomeSource: "explicit" | "derived" | "unknown" = input.nativeReviewOutcome !== undefined ? "explicit" : derived === undefined ? "unknown" : "derived";
+	const plan = verificationPlan({ rddLine, risk, writerProfile, nativeReviewOutcome });
+	return {
+		schema: "gentle-pi.review-assessment-plan/v1",
+		risk,
+		reasons: assessment?.reasons ?? (unassessableDetail === undefined ? [] : [{ code: "native-assess-unavailable", path: "", detail: unassessableDetail }]),
+		changedPaths: assessment?.changedPaths ?? 0,
+		changedLines: assessment?.changedLines ?? 0,
+		candidate: assessment === undefined ? null : { kind: assessment.candidate.kind, baseRef: assessment.candidate.baseRef },
+		rddLine,
+		nativeReviewOutcome,
+		outcome_source: outcomeSource,
+		writerProfile,
+		plan,
+	};
+}
+
+let rddStatusUnavailableWarned = false;
+
+/**
+ * Best-effort native RDD mode status read for prompt rendering, memoized per
+ * cwd for `RDD_STATUS_MEMO_TTL_MS`. Reuses the `reviewMode` STATUS reader
+ * (`gentle-ai review mode status --json`, decoded to
+ * `NativeReviewModeStatus`) that the `/gentle:review-mode` command also
+ * calls. Never throws and never hangs past `signal`'s deadline when one is
+ * given: an absent binary, a timed-out/aborted process, or a native CLI
+ * failure all resolve to `undefined`. `ctx` is optional and used only for a
+ * one-shot (per process) UI notice when the read is swallowed, so a
+ * sustained native outage is observable beyond the rendered "unknown" line.
+ */
+async function resolveRddModeStatus(
+	nativeReviewCli: Pick<NativeReviewCli, "reviewMode"> | null | undefined,
+	cwd: string,
+	signal?: AbortSignal,
+	now: () => number = Date.now,
+	ctx?: Pick<ExtensionContext, "hasUI" | "ui">,
+): Promise<NativeReviewModeStatus | undefined> {
+	const nowMs = now();
+	const cached = rddStatusMemo.get(cwd);
+	if (cached !== undefined && cached.expiresAt > nowMs) return cached.status;
+	const status = await readRddModeStatusOnce(nativeReviewCli, cwd, signal);
+	rddStatusMemo.set(cwd, { status, expiresAt: nowMs + RDD_STATUS_MEMO_TTL_MS });
+	if (status === undefined && !rddStatusUnavailableWarned) {
+		rddStatusUnavailableWarned = true;
+		if (ctx?.hasUI) {
+			ctx.ui.notify(
+				"Gentle AI: receipt-driven-development status is unavailable (native review CLI absent, timed out, or failed). The parent prompt renders \"unknown\" until this recovers; this notice will not repeat this session.",
+				"warning",
+			);
+		}
+	}
+	return status;
+}
+
+/** Resolves and renders the RDD status line for a production call site in one call. */
+async function resolveRddStatusLine(
+	nativeReviewCli: Pick<NativeReviewCli, "reviewMode"> | null | undefined,
+	cwd: string,
+	signal?: AbortSignal,
+	now: () => number = Date.now,
+	ctx?: Pick<ExtensionContext, "hasUI" | "ui">,
+): Promise<string> {
+	return renderRddStatusLine(await resolveRddModeStatus(nativeReviewCli, cwd, signal, now, ctx));
+}
+
+// Rendered prompts are memoized per background policy/capability/RDD-status
+// key for the process lifetime; the assets bytes themselves are read once
+// per key. `rddStatusLine` defaults to the "unknown" fallback line (the
+// longest of the three renderable forms), not "", so the default no-argument
+// render IS the worst case the canonical 8 KiB budget in
+// tests/orchestrator-budget.test.ts measures; assets/orchestrator.md is
+// sized with that worst case already included. Production still resolves
+// and passes the real line (on/off/unknown) via resolveRddStatusLine.
 const orchestratorPromptCache = new Map<string, string>();
 function getOrchestratorPrompt(
 	cwd: string = process.cwd(),
 	activeTools?: readonly string[],
+	rddStatusLine: string = renderRddStatusLine(undefined),
 ): string {
 	const background: BackgroundSubagentsRendering = {
 		policy: loadBackgroundSubagentsPolicy(cwd),
 		capability: resolveBackgroundSubagentsCapability(cwd, activeTools),
 	};
-	const cacheKey = `${background.policy}:${background.capability}`;
+	const cacheKey = `${background.policy}:${background.capability}:${rddStatusLine}`;
 	let prompt = orchestratorPromptCache.get(cacheKey);
 	if (prompt === undefined) {
-		prompt = renderOrchestratorPrompt(ASSETS_DIR, background);
+		prompt = renderOrchestratorPrompt(ASSETS_DIR, background, rddStatusLine);
 		orchestratorPromptCache.set(cacheKey, prompt);
 	}
 	return prompt;
@@ -694,12 +1240,14 @@ function getOrchestratorPrompt(
 function renderOrchestratorPrompt(
 	assetsDir: string,
 	background: BackgroundSubagentsRendering = DEFAULT_BACKGROUND_SUBAGENTS_RENDERING,
+	rddStatusLine: string = renderRddStatusLine(undefined),
 ): string {
+	const backgroundPolicyBlock = `${renderBackgroundSubagentsStatusLine(background)}\n${rddStatusLine}`;
 	return readFileSync(join(assetsDir, "orchestrator.md"), "utf8")
 		.replaceAll("{{GENTLE_PI_ASSETS_ROOT}}", assetsDir)
 		.replaceAll(
 			"{{GENTLE_PI_BACKGROUND_POLICY}}",
-			renderBackgroundSubagentsStatusLine(background),
+			backgroundPolicyBlock,
 		)
 		.trim();
 }
@@ -798,6 +1346,7 @@ function buildGentlePrompt(
 	persona: PersonaMode,
 	cwd: string = process.cwd(),
 	activeTools?: readonly string[],
+	rddStatusLine: string = renderRddStatusLine(undefined),
 ): string {
 	const personaPrompt =
 		persona === "neutral" ? NEUTRAL_PERSONA_PROMPT : GENTLEMAN_PERSONA_PROMPT;
@@ -832,13 +1381,13 @@ Harness principles:
 - Protect the human reviewer: avoid oversized changes, surface review workload risk, and ask before turning one task into a large multi-area change.
 - Never claim persistent memory is available because of this package. Memory is provided by separate packages or MCP tools when installed and callable.
 
-${getOrchestratorPrompt(cwd, activeTools)}`;
+${getOrchestratorPrompt(cwd, activeTools, rddStatusLine)}`;
 }
 
 // Matches `git [global-flags] push` — tolerates flags like -C /repo or --work-tree=/tmp
 // between `git` and the subcommand. Short flags may be followed by a separate value token.
 const GIT_GLOBAL_FLAGS_SRC = String.raw`(?:\s+--?\S+(?:\s+[^-\s]\S*)?)* `;
-const GIT_PUSH_RE = new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}push\b`);
+const GIT_PUSH_RE = new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}(push)\b`);
 
 const DENIED_BASH_PATTERNS: RegExp[] = [
 	// Block rm -rf targeting /, ~ or ~/subdir, $HOME or $HOME/subdir, .. or .
@@ -865,6 +1414,19 @@ const GUARD_ACTION = {
 type GuardAction = (typeof GUARD_ACTION)[keyof typeof GUARD_ACTION];
 type GuardClassification = GuardAction | "not-guarded";
 
+interface GuardMatch {
+	key: GuardedCommandKey;
+	action: GuardAction;
+	triggerIndex: number;
+}
+
+interface GuardEvaluation {
+	action: GuardClassification;
+	key?: GuardedCommandKey;
+	triggerIndex: number;
+	matches: GuardMatch[];
+}
+
 const GUARDED_COMMAND_KEY = {
 	GIT_PUSH: "gitPush",
 	GIT_REBASE: "gitRebase",
@@ -889,10 +1451,10 @@ interface LoadGuardrailsOptions {
 
 const GUARDED_KEY_PATTERNS: Record<GuardedCommandKey, RegExp> = {
 	gitPush: GIT_PUSH_RE,
-	gitRebase: /\bgit\s+rebase\b/,
-	gitBranchDeleteForce: /\bgit\s+branch\s+(?:-[a-zA-Z]*D[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|--delete\b[^\n]*--force\b|--force\b[^\n]*--delete\b)/,
-	npmPublish: /\bnpm\s+publish\b/,
-	piRemove: /\bpi\s+remove\b/,
+	gitRebase: /\bgit\s+(rebase)\b/,
+	gitBranchDeleteForce: /\bgit\s+(branch)\s+(?:-[a-zA-Z]*D[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|--delete\b[^\r\n;&|]*--force\b|--force\b[^\r\n;&|]*--delete\b)/,
+	npmPublish: /\bnpm\s+(publish)\b/,
+	piRemove: /\bpi\s+(remove)\b/,
 };
 
 const AUTONOMOUS_DEFAULT_ACTIONS: Record<GuardedCommandKey, GuardAction> = {
@@ -903,6 +1465,14 @@ const AUTONOMOUS_DEFAULT_ACTIONS: Record<GuardedCommandKey, GuardAction> = {
 	piRemove: "confirm",
 };
 
+const GUARDED_COMMAND_LABELS: Record<GuardedCommandKey, string> = {
+	gitPush: "git push",
+	gitRebase: "git rebase",
+	gitBranchDeleteForce: "forced git branch deletion",
+	npmPublish: "npm publish",
+	piRemove: "pi remove",
+};
+
 const SAFE_GUARDRAILS_CONFIG: RuntimeGuardrailsConfig = {
 	autonomousMode: false,
 	guardedCommands: {},
@@ -918,31 +1488,83 @@ const SAFE_GUARDRAILS_CONFIG: RuntimeGuardrailsConfig = {
  *      (applying AUTONOMOUS_DEFAULT_ACTIONS for any key not set in guardedCommands)
  *   4. No match → "not-guarded"
  */
-function classifyGuardedCommand(
+function collectGuardedMatches(
 	command: string,
 	config: RuntimeGuardrailsConfig,
-): GuardClassification {
-	// Step 1: hard-deny always wins, regardless of any config
+): GuardMatch[] {
+	const matches: GuardMatch[] = [];
+	for (const [key, pattern] of Object.entries(GUARDED_KEY_PATTERNS) as [
+		GuardedCommandKey,
+		RegExp,
+	][]) {
+		const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
+		for (const match of command.matchAll(globalPattern)) {
+			const action = config.autonomousMode
+				? (config.guardedCommands[key] ?? AUTONOMOUS_DEFAULT_ACTIONS[key])
+				: "confirm";
+			matches.push({
+				key,
+				action,
+				triggerIndex: match.index + match[0].lastIndexOf(match[1]),
+			});
+		}
+	}
+	return matches.sort((left, right) => left.triggerIndex - right.triggerIndex);
+}
+
+function evaluateGuardedCommand(
+	command: string,
+	config: RuntimeGuardrailsConfig,
+): GuardEvaluation {
+	const matches = collectGuardedMatches(command, config);
+
+	// Hard denies override every configured action across the complete command.
 	for (const pattern of DENIED_BASH_PATTERNS) {
-		if (pattern.test(command)) return "block";
+		const denied = pattern.exec(command);
+		if (!denied) continue;
+		const matchedAction = matches.find((match) =>
+			match.triggerIndex >= denied.index && match.triggerIndex < denied.index + denied[0].length,
+		);
+		return {
+			action: "block",
+			key: matchedAction?.key,
+			triggerIndex: matchedAction?.triggerIndex ?? denied.index,
+			matches,
+		};
 	}
 
-	// Step 2 & 3: find which guarded key (if any) this command matches
-	for (const [key, pattern] of Object.entries(GUARDED_KEY_PATTERNS) as [GuardedCommandKey, RegExp][]) {
-		if (!pattern.test(command)) continue;
+	// Configured block, then confirmation, then allow win across all matches.
+	const selected = matches.find((match) => match.action === "block")
+		?? matches.find((match) => match.action === "confirm")
+		?? matches.find((match) => match.action === "allow");
+	if (selected) return { ...selected, matches };
+	return { action: "not-guarded", triggerIndex: 0, matches };
+}
 
-		// Matched a guarded key
-		if (!config.autonomousMode) {
-			// Legacy behavior: any match → confirm
-			return "confirm";
-		}
+function classifyGuardedCommand(
+	command: string,
+	config: RuntimeGuardrailsConfig,
+): GuardClassification {
+	return evaluateGuardedCommand(command, config).action;
+}
 
-		// Autonomous mode: use configured action, fall back to sensible defaults
-		const configuredAction = config.guardedCommands[key];
-		return configuredAction ?? AUTONOMOUS_DEFAULT_ACTIONS[key];
-	}
+function guardedCommandPreview(command: string, triggerIndex: number): string {
+	const start = Math.max(0, triggerIndex - 60);
+	const prefix = start > 0 ? "…" : "";
+	return `${prefix}${truncateToWidth(command.slice(start).replace(/\s+/g, " ").trim(), 180 - prefix.length, "…")}`;
+}
 
-	return "not-guarded";
+/** Confirmation headline for all guarded actions; generic when no key matched. */
+function guardedCommandTitle(
+	key?: GuardedCommandKey,
+	matches: readonly GuardMatch[] = [],
+): string {
+	if (matches.length > 1) {
+		return `Allow guarded actions: ${matches.map((match) => GUARDED_COMMAND_LABELS[match.key]).join("; ")}?`;
+	}
+	return key === undefined
+		? "Allow guarded command?"
+		: `Allow guarded ${GUARDED_COMMAND_LABELS[key]}?`;
 }
 
 function parseGuardrailsConfigFile(
@@ -1050,22 +1672,9 @@ const SENSITIVE_PATH_PATTERNS: RegExp[] = [
 	/\.(?:pem|key|p12|pfx)$/,
 ];
 
-const SDD_AGENT_NAMES = [
-	"sdd-init",
-	"sdd-onboard",
-	"sdd-explore",
-	"sdd-research",
-	"sdd-proposal",
-	"sdd-spec",
-	"sdd-design",
-	"sdd-tasks",
-	"sdd-status",
-	"sdd-apply",
-	"sdd-verify",
-	"sdd-sync",
-	"sdd-archive",
-] as const;
-const SDD_AGENT_NAME_SET = new Set<string>(SDD_AGENT_NAMES);
+const SDD_AGENT_NAME_SET = new Set<string>(SHIPPED_SDD_AGENT_NAMES);
+const SDD_CHANGE_FLAG = "gentle-sdd-change";
+const SDD_CHANGE_KEYS = ["changeName", "phase", "workspaceRoot"] as const;
 
 const JUDGMENT_DAY_AGENT_NAMES = [
 	"jd-judge-a",
@@ -1074,7 +1683,7 @@ const JUDGMENT_DAY_AGENT_NAMES = [
 ] as const;
 
 const CORE_MODEL_AGENT_NAMES = [
-	...SDD_AGENT_NAMES,
+	...SHIPPED_SDD_AGENT_NAMES,
 	...JUDGMENT_DAY_AGENT_NAMES,
 ] as const;
 const CORE_MODEL_AGENT_NAME_SET = new Set<string>(CORE_MODEL_AGENT_NAMES);
@@ -1116,10 +1725,10 @@ function readStringPath(value: unknown, path: string[]): string | undefined {
 
 function isSddAgentStartEvent(event: unknown): boolean {
 	const candidates = readAgentStartNames(event);
-	if (candidates.some((value) => SDD_AGENT_NAME_SET.has(value))) return true;
+	if (candidates.some((value) => SDD_AGENT_NAME_SET.has(value)) || sddPhaseFromAgentStartEvent(event) !== undefined) return true;
 
 	const systemPrompt = readStringPath(event, ["systemPrompt"]) ?? "";
-	return SDD_AGENT_NAMES.some((name) => {
+	return SHIPPED_SDD_AGENT_NAMES.some((name) => {
 		const phase = name.replace(/^sdd-/, "");
 		return new RegExp(`\\bSDD ${phase} executor\\b`, "i").test(systemPrompt);
 	});
@@ -1142,19 +1751,107 @@ function isNamedAgentStartEvent(event: unknown): boolean {
 	return readAgentStartNames(event).length > 0;
 }
 
-function sddPhaseFromAgentStartEvent(event: unknown): SddPhase | undefined {
-	for (const name of readAgentStartNames(event)) {
-		if (name === "sdd-apply") return "apply";
-		if (name === "sdd-verify") return "verify";
-		if (name === "sdd-sync") return "sync";
-		if (name === "sdd-archive") return "archive";
-	}
+function sddPhaseFromAgentStartEvent(event: unknown): SddPhase | "remediate" | undefined {
+	const phases = ["apply", "verify", "sync", "archive", "remediate"] as const;
+	const names = readAgentStartNames(event);
 	const systemPrompt = readStringPath(event, ["systemPrompt"]) ?? "";
-	if (/\bSDD apply executor\b/i.test(systemPrompt)) return "apply";
-	if (/\bSDD verify executor\b/i.test(systemPrompt)) return "verify";
-	if (/\bSDD sync executor\b/i.test(systemPrompt)) return "sync";
-	if (/\bSDD archive executor\b/i.test(systemPrompt)) return "archive";
-	return undefined;
+	const promptPhases = phases.filter((phase) => new RegExp(`\\bSDD ${phase} executor\\b`, "i").test(systemPrompt));
+	if (promptPhases.length > 1) return undefined;
+	if (names.length === 0) return promptPhases[0];
+	return phases.find((phase) => names.every((name) => name === `sdd-${phase}`) &&
+		(promptPhases.length === 0 || promptPhases[0] === phase));
+}
+
+function resolveSddChangeSelection(serialized: unknown, cwd: string, agentName: string) {
+	if (typeof serialized !== "string") throw new Error("SDD selection must be a JSON string.");
+	let value: unknown;
+	try {
+		value = JSON.parse(serialized);
+	} catch {
+		throw new Error("SDD selection is malformed.");
+	}
+	if (!isRecord(value) || Object.keys(value).sort().join(",") !== (value.phase === "remediate" ? "changeName,failedEvidenceRevision,phase,workspaceRoot" : SDD_CHANGE_KEYS.join(","))) {
+		throw new Error("SDD selection must contain only changeName, workspaceRoot, and phase.");
+	}
+	const { changeName, workspaceRoot, phase } = value;
+	if (typeof changeName !== "string" || changeName.length === 0 ||
+		typeof workspaceRoot !== "string" || workspaceRoot.length === 0 ||
+		(phase !== "apply" && phase !== "verify" && phase !== "sync" && phase !== "archive" && phase !== "remediate")) {
+		throw new Error("SDD selection has an invalid identity.");
+	}
+	if (agentName !== `sdd-${phase}`) throw new Error("SDD selection phase does not match the child agent.");
+	let canonicalCwd: string;
+	let canonicalSelectionRoot: string;
+	try {
+		canonicalCwd = realpathSync(cwd);
+		canonicalSelectionRoot = realpathSync(workspaceRoot);
+	} catch {
+		throw new Error("SDD selection workspaceRoot cannot be resolved.");
+	}
+	if (canonicalCwd !== canonicalSelectionRoot || workspaceRoot !== canonicalSelectionRoot) {
+		throw new Error("SDD selection workspaceRoot does not match the canonical child root.");
+	}
+	if (phase === "remediate" && (typeof value.failedEvidenceRevision !== "string" || !/^sha256:[0-9a-f]{64}$/.test(value.failedEvidenceRevision))) throw new Error("Invalid remediation revision");
+	return { changeName, workspaceRoot: canonicalCwd, phase, ...(phase === "remediate" ? { failedEvidenceRevision: value.failedEvidenceRevision as string } : {}) };
+}
+
+function resolveSddChangeStartup(
+	serialized: unknown,
+	cwd: string,
+	agentName: string,
+	resolver: (options: Parameters<typeof resolveSddStatus>[0]) => ReturnType<typeof resolveSddStatus> = resolveSddStatus,
+) {
+	const selection = resolveSddChangeSelection(serialized, cwd, agentName);
+	const status = resolver({ cwd: selection.workspaceRoot, workspaceRoot: selection.workspaceRoot, changeName: selection.changeName, includeInstructions: true });
+	if (status.actionContext.workspaceRoot !== selection.workspaceRoot || status.changeName !== selection.changeName) {
+		throw new Error("SDD selection resolver returned a mismatched status.");
+	}
+	return { selection, status };
+}
+
+async function resolveSelectedNativeSddChangeStartup(
+	serialized: unknown,
+	cwd: string,
+	agentName: string,
+	native: Pick<NativeReviewCli, "sddStatus"> | null | undefined,
+	localResolver: (options: Parameters<typeof resolveSddStatus>[0]) => ReturnType<typeof resolveSddStatus> = resolveSddStatus,
+): Promise<{ selection: { changeName: string; workspaceRoot: string; phase: SddPhase | "remediate"; failedEvidenceRevision?: string }; status: NativeSddStatusV2 | ReturnType<typeof resolveSddStatus> }> {
+	const selection = resolveSddChangeSelection(serialized, cwd, agentName);
+	if (selection.phase === "sync") {
+		const status = localResolver({ cwd: selection.workspaceRoot, workspaceRoot: selection.workspaceRoot, changeName: selection.changeName, includeInstructions: true });
+		if (status.actionContext.workspaceRoot !== selection.workspaceRoot || status.changeName !== selection.changeName) {
+			throw new Error("SDD selection resolver returned a mismatched status.");
+		}
+		return { selection, status };
+	}
+	if (native?.sddStatus === undefined) throw new Error("SDD selection native status is unavailable.");
+	let status: NativeSddStatusV2;
+	try {
+		status = decodeNativeSddStatusV2(
+			await native.sddStatus({ changeName: selection.changeName, workspaceRoot: selection.workspaceRoot }),
+			{ changeName: selection.changeName, workspaceRoot: selection.workspaceRoot },
+		);
+	} catch (error) {
+		throw new Error(`SDD selection native status is blocked: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if ((selection.phase !== "remediate" && !(selection.phase in status.dependencies)) || status.phaseInstructions === undefined || !(selection.phase in status.phaseInstructions)) {
+		throw new Error(`SDD selection native status cannot represent phase ${selection.phase}.`);
+	}
+	if (selection.phase === "remediate") {
+		if (status.nextRecommended !== "remediate" || status.remediationState?.failedEvidenceRevision !== selection.failedEvidenceRevision) throw new Error("Stale remediation selection");
+	} else if (status.nextRecommended !== selection.phase || status.dependencies[selection.phase] !== "ready" || status.blockedReasons.length > 0) {
+		throw new Error(`SDD selection native status blocks phase ${selection.phase}; it cannot execute.`);
+	}
+	return { selection, status };
+}
+
+function readSddChangeFlag(pi: ExtensionAPI): unknown {
+	try {
+		const value = (pi as unknown as { getFlag?: (name: string) => unknown }).getFlag?.(SDD_CHANGE_FLAG);
+		return value === false ? undefined : value;
+	} catch {
+		return null;
+	}
 }
 
 function normalizePolicyPath(value: string): string {
@@ -1274,7 +1971,8 @@ async function confirmCommand(
 	herdrLifecycle: HerdrConfirmationLifecycle,
 ): Promise<ToolCallEventResult | undefined> {
 	const guardrailsConfig = loadRuntimeGuardrailsConfig(ctx.cwd);
-	const classification = classifyGuardedCommand(command, guardrailsConfig);
+	const evaluation = evaluateGuardedCommand(command, guardrailsConfig);
+	const { action: classification } = evaluation;
 
 	if (classification === "block") {
 		return {
@@ -1297,11 +1995,8 @@ async function confirmCommand(
 				"Gentle AI safety policy requires interactive confirmation before this command.",
 		};
 	}
-	const preview = truncateToWidth(
-		command.replace(/\s+/g, " ").trim(),
-		180,
-		"…",
-	);
+	const title = guardedCommandTitle(evaluation.key, evaluation.matches);
+	const preview = guardedCommandPreview(command, evaluation.triggerIndex);
 	const requestId = randomUUID();
 	const emitPermissionRequest = (
 		state: "waiting" | "approved" | "denied",
@@ -1320,7 +2015,7 @@ async function confirmCommand(
 	emitPermissionRequest("waiting");
 	herdrLifecycle.begin();
 	try {
-		approved = await ctx.ui.confirm("Allow guarded command?", preview);
+		approved = await ctx.ui.confirm(title, preview);
 	} catch (error) {
 		confirmationFailed = true;
 		confirmationError = error;
@@ -1452,7 +2147,10 @@ function parseModelExport(value: unknown): AgentModelConfig | undefined {
 }
 
 async function exportSavedModelConfig(ctx: ExtensionContext): Promise<number> {
-	const saved = await readSavedModelConfigAsync(ctx.cwd);
+	const saved = await readModelRoutingAuthorityAsync(
+		modelConfigPath(ctx.cwd),
+		legacyProjectModelConfigPath(ctx.cwd),
+	);
 	if (saved.status === "invalid") throw new Error(`Invalid model config: ${saved.path}`);
 	const agents = saved.status === "valid" ? saved.config : {};
 	const path = modelExportPath(ctx.cwd);
@@ -1603,6 +2301,49 @@ async function listAgentsFromDirAsync(
 	return entries;
 }
 
+interface DiscoverableNonBuiltinAgentRoot {
+	dir: string;
+	source: AgentSource;
+	/** The package installer owns this directory, so packageAssetAudit reports it. */
+	packageManaged: boolean;
+}
+
+function discoverableNonBuiltinAgentRoots(cwd: string): DiscoverableNonBuiltinAgentRoot[] {
+	const globalAgentHome = gentlePiAgentHome();
+	const roots: DiscoverableNonBuiltinAgentRoot[] = [
+		{ dir: join(globalAgentHome, "agents"), source: "user", packageManaged: true },
+		{ dir: join(globalAgentHome, "subagents"), source: "user", packageManaged: false },
+		{ dir: join(homedir(), ".agents"), source: "user", packageManaged: false },
+		{ dir: join(cwd, ".agents"), source: "project", packageManaged: false },
+		{ dir: join(cwd, ".pi", "agents"), source: "project", packageManaged: false },
+		{ dir: join(cwd, ".pi", "subagents"), source: "project", packageManaged: false },
+	];
+	const unique = new Map<string, DiscoverableNonBuiltinAgentRoot>();
+	for (const root of roots) {
+		let canonical: string;
+		try {
+			canonical = realpathSync(root.dir);
+		} catch {
+			canonical = resolve(root.dir);
+		}
+		const existing = unique.get(canonical);
+		if (existing) {
+			// Reinsert so a later alias keeps true later-root precedence even when
+			// another physical root appears between the duplicate entries. A merged
+			// package-managed root must keep its installer-owned path: ownership
+			// updates validate that lexical path against the managed manifest root.
+			const managedRoot = existing.packageManaged ? existing : root.packageManaged ? root : undefined;
+			unique.delete(canonical);
+			unique.set(canonical, {
+				dir: managedRoot?.dir ?? root.dir,
+				source: root.source,
+				packageManaged: managedRoot !== undefined,
+			});
+		} else unique.set(canonical, root);
+	}
+	return [...unique.values()];
+}
+
 function builtinAgentDirs(cwd: string): string[] {
 	return [
 		join(PACKAGE_ROOT, "..", "pi-subagents-j0k3r", "agents"),
@@ -1633,16 +2374,12 @@ async function listBuiltinAgentNamesAsync(cwd: string): Promise<Set<string>> {
 }
 
 function listDiscoverableAgents(cwd: string): AgentEntry[] {
-	const globalAgentHome = gentlePiAgentHome();
 	const builtinDirs = builtinAgentDirs(cwd);
 	const agents = [
 		...builtinDirs.flatMap((dir) => listAgentsFromDir(dir, "builtin")),
-		...listAgentsFromDir(join(globalAgentHome, "agents"), "user"),
-		...listAgentsFromDir(join(globalAgentHome, "subagents"), "user"),
-		...listAgentsFromDir(join(homedir(), ".agents"), "user"),
-		...listAgentsFromDir(join(cwd, ".agents"), "project"),
-		...listAgentsFromDir(join(cwd, ".pi", "agents"), "project"),
-		...listAgentsFromDir(join(cwd, ".pi", "subagents"), "project"),
+		...discoverableNonBuiltinAgentRoots(cwd).flatMap(({ dir, source }) =>
+			listAgentsFromDir(dir, source),
+		),
 	];
 	const byName = new Map<string, AgentEntry>();
 	for (const agent of agents) byName.set(agent.name, agent);
@@ -1650,21 +2387,12 @@ function listDiscoverableAgents(cwd: string): AgentEntry[] {
 }
 
 async function listDiscoverableAgentsAsync(cwd: string): Promise<AgentEntry[]> {
-	const globalAgentHome = gentlePiAgentHome();
 	const builtinDirs = builtinAgentDirs(cwd);
 	const agents: AgentEntry[] = [];
 	for (const dir of builtinDirs) {
 		agents.push(...(await listAgentsFromDirAsync(dir, "builtin")));
 	}
-	const otherDirs: Array<[string, AgentSource]> = [
-		[join(globalAgentHome, "agents"), "user"],
-		[join(globalAgentHome, "subagents"), "user"],
-		[join(homedir(), ".agents"), "user"],
-		[join(cwd, ".agents"), "project"],
-		[join(cwd, ".pi", "agents"), "project"],
-		[join(cwd, ".pi", "subagents"), "project"],
-	];
-	for (const [dir, source] of otherDirs) {
+	for (const { dir, source } of discoverableNonBuiltinAgentRoots(cwd)) {
 		agents.push(...(await listAgentsFromDirAsync(dir, source)));
 	}
 	const byName = new Map<string, AgentEntry>();
@@ -1781,6 +2509,15 @@ function projectSettingsPath(cwd: string): string {
 	return join(cwd, ".pi", "settings.json");
 }
 
+/**
+ * Pi's own global settings file, which is where the orchestrator model lives.
+ * Profiles own the three `default*` keys there; nothing else in this extension
+ * reads or writes that file.
+ */
+function orchestratorSettingsPath(): string {
+	return join(gentlePiAgentHome(), "settings.json");
+}
+
 function removeLegacyAgentOverridesFromSettings(
 	settingsPath: string,
 	settings: Record<string, unknown>,
@@ -1805,6 +2542,30 @@ function isValidJsonObjectFileOrMissing(path: string): boolean {
 	}
 }
 
+const PROVIDER_REVIEW_ROLES = ["review-refuter", "review-validator"] as const;
+
+function isProviderReviewRole(name: string): boolean {
+	return PROVIDER_REVIEW_ROLES.some((role) => role === name);
+}
+
+function modelAssignmentNames(cwd: string): string[] {
+	return [...new Set([
+		...PROVIDER_REVIEW_ROLES,
+		...listDiscoverableAgents(cwd).map((agent) => agent.name),
+	])];
+}
+
+const PROVIDER_ROUTING_DEFAULT_LABELS = {
+	model: "Pi persisted default model",
+	effort: "Pi persisted default effort",
+} as const;
+
+type RoutingDefaultField = keyof typeof PROVIDER_ROUTING_DEFAULT_LABELS;
+
+function routingDefaultLabel(name: string, field: RoutingDefaultField): string {
+	return isProviderReviewRole(name) ? PROVIDER_ROUTING_DEFAULT_LABELS[field] : "inherit";
+}
+
 function migrateLegacyProjectModelOverrides(cwd: string): number {
 	const settingsPath = projectSettingsPath(cwd);
 	if (!existsSync(settingsPath)) return 0;
@@ -1823,6 +2584,7 @@ function migrateLegacyProjectModelOverrides(cwd: string): number {
 	if (!agentOverrides) return 0;
 	const agentsByName = new Map(listDiscoverableAgents(cwd).map((agent) => [agent.name, agent]));
 	const migratableEntries = Object.entries(agentOverrides)
+		.filter(([name]) => !isProviderReviewRole(name))
 		.map(([name, value]) => ({ name, entry: normalizeRoutingEntry(value) }))
 		.filter((item): item is { name: string; entry: AgentRoutingEntry } =>
 			item.entry !== undefined && !isClearRoutingEntry(item.entry),
@@ -1865,30 +2627,40 @@ export function applyModelConfig(
 	let skipped = 0;
 	const seenAgents = new Set<string>();
 	for (const agent of listDiscoverableAgents(cwd)) {
+		if (isProviderReviewRole(agent.name)) continue;
 		seenAgents.add(agent.name);
 		const entry = config[agent.name];
 		if (entry === undefined) {
 			skipped += 1;
 			continue;
 		}
-		if (updateSubagentModelProfile(cwd, agent.source, agent.name, entry)) updated += 1;
-		else skipped += 1;
-		if (agent.source === "builtin") continue;
-		if (!agent.filePath || !existsSync(agent.filePath)) {
-			skipped += 1;
+		if (agent.source === "builtin") {
+			if (updateSubagentModelProfile(cwd, agent.source, agent.name, entry)) updated += 1;
+			else skipped += 1;
 			continue;
 		}
-		const original = readFileSync(agent.filePath, "utf8");
-		const next = updateFrontmatterRouting(original, entry);
-		if (next === original) {
+		if (!agent.filePath || !existsSync(agent.filePath)) {
 			skipped += 1;
-			continue;
+		} else {
+			const original = readFileSync(agent.filePath, "utf8");
+			const next = updateFrontmatterRouting(original, entry);
+			if (next === original) {
+				skipped += 1;
+			} else {
+				if (!updatePackageManagedSddAgentOwnership(agent.filePath, original, next)) {
+					writeFileSync(agent.filePath, next);
+				}
+				updated += 1;
+			}
 		}
-		writeFileSync(agent.filePath, next);
-		updatePackageManagedSddAgentOwnership(agent.filePath, original, next);
-		updated += 1;
+		if (updateSubagentModelProfile(cwd, agent.source, agent.name, entry)) updated += 1;
+		else skipped += 1;
 	}
 	for (const [name, entry] of Object.entries(config)) {
+		if (isProviderReviewRole(name)) continue;
+		// The orchestrator is routing, not an agent: its model lives in Pi's global
+		// settings.json and must never reach subagents.json.
+		if (isProfileOrchestratorKey(name)) continue;
 		if (!seenAgents.has(name) && isClearRoutingEntry(entry)) {
 			if (updateSubagentModelProfile(cwd, "user", name, entry)) updated += 1;
 			else skipped += 1;
@@ -1905,31 +2677,40 @@ export async function applyModelConfigAsync(
 	let skipped = 0;
 	const seenAgents = new Set<string>();
 	for (const agent of await listDiscoverableAgentsAsync(cwd)) {
+		if (isProviderReviewRole(agent.name)) continue;
 		seenAgents.add(agent.name);
 		const entry = config[agent.name];
 		if (entry === undefined) {
 			skipped += 1;
 			continue;
 		}
-		if (await updateSubagentModelProfileAsync(cwd, agent.source, agent.name, entry))
-			updated += 1;
-		else skipped += 1;
-		if (agent.source === "builtin") continue;
-		if (!agent.filePath || !(await pathExists(agent.filePath))) {
-			skipped += 1;
-			continue;
+		if (agent.source === "builtin") {
+			if (await updateSubagentModelProfileAsync(cwd, agent.source, agent.name, entry))
+				updated += 1;
+			else skipped += 1;
+			continue;
 		}
-		const original = await readFile(agent.filePath, "utf8");
-		const next = updateFrontmatterRouting(original, entry);
-		if (next === original) {
+		if (!agent.filePath || !(await pathExists(agent.filePath))) {
 			skipped += 1;
-			continue;
+		} else {
+			const original = await readFile(agent.filePath, "utf8");
+			const next = updateFrontmatterRouting(original, entry);
+			if (next === original) {
+				skipped += 1;
+			} else {
+				if (!updatePackageManagedSddAgentOwnership(agent.filePath, original, next)) {
+					await writeFile(agent.filePath, next);
+				}
+				updated += 1;
+			}
 		}
-		await writeFile(agent.filePath, next);
-		updatePackageManagedSddAgentOwnership(agent.filePath, original, next);
-		updated += 1;
+		if (await updateSubagentModelProfileAsync(cwd, agent.source, agent.name, entry))
+			updated += 1;
+		else skipped += 1;
 	}
 	for (const [name, entry] of Object.entries(config)) {
+		if (isProviderReviewRole(name)) continue;
+		if (isProfileOrchestratorKey(name)) continue;
 		if (!seenAgents.has(name) && isClearRoutingEntry(entry)) {
 			if (await updateSubagentModelProfileAsync(cwd, "user", name, entry))
 				updated += 1;
@@ -1957,11 +2738,11 @@ export async function applySavedModelConfig(
 }
 
 function describeModelConfig(cwd: string, config: AgentModelConfig): string[] {
-	return listDiscoverableAgents(cwd).map((agent) => {
-		const entry = config[agent.name];
-		const model = entry?.model ?? "inherit";
-		const thinking = entry?.thinking ?? "inherit";
-		return `${sanitizeTerminalText(agent.name)}: model=${sanitizeTerminalText(model)}, effort=${sanitizeTerminalText(thinking)}`;
+	return modelAssignmentNames(cwd).map((name) => {
+		const entry = config[name];
+		const model = entry?.model ?? routingDefaultLabel(name, "model");
+		const thinking = entry?.thinking ?? routingDefaultLabel(name, "effort");
+		return `${sanitizeTerminalText(name)}: model=${sanitizeTerminalText(model)}, effort=${sanitizeTerminalText(thinking)}`;
 	});
 }
 
@@ -2329,7 +3110,7 @@ class SddModelPanel implements OverlayComponent {
 		lines.push("");
 		lines.push(
 			line(
-				"j/k scroll • enter model/save • e effort • i inherit • c custom • x export • r restore • ctrl+s save • esc back",
+				`j/k scroll • enter model/save • e effort • i ${isProviderReviewRole(this.rows[this.cursor] ?? "") ? "Pi persisted defaults" : "inherit"} • c custom • x export • r restore • ctrl+s save • esc back`,
 				"muted",
 			),
 		);
@@ -2361,7 +3142,9 @@ class SddModelPanel implements OverlayComponent {
 			const focused = i === this.modelCursor;
 			lines.push(
 				`${this.renderCursor(focused)} ${this.renderText(
-					options[i] ?? "",
+					options[i] === INHERIT_MODEL && isProviderReviewRole(this.selectedRow)
+						? routingDefaultLabel(this.selectedRow, "model")
+						: (options[i] ?? ""),
 					focused ? "status" : "text",
 				)}`,
 			);
@@ -2413,7 +3196,9 @@ class SddModelPanel implements OverlayComponent {
 			const focused = i === this.effortCursor;
 			lines.push(
 				`${this.renderCursor(focused)} ${this.renderText(
-					THINKING_OPTIONS[i] ?? "",
+					THINKING_OPTIONS[i] === INHERIT_THINKING && isProviderReviewRole(this.selectedRow)
+						? routingDefaultLabel(this.selectedRow, "effort")
+						: (THINKING_OPTIONS[i] ?? ""),
 					focused ? "status" : "text",
 				)}`,
 			);
@@ -2426,10 +3211,10 @@ class SddModelPanel implements OverlayComponent {
 	private renderSetAllLabel(row: string): string {
 		const models = this.rows
 			.slice(1)
-			.map((name) => this.draft[name]?.model ?? "inherit");
+			.map((name) => this.draft[name]?.model ?? routingDefaultLabel(name, "model"));
 		const efforts = this.rows
 			.slice(1)
-			.map((name) => this.draft[name]?.thinking ?? "inherit");
+			.map((name) => this.draft[name]?.thinking ?? routingDefaultLabel(name, "effort"));
 		const firstModel = models[0] ?? "inherit";
 		const firstEffort = efforts[0] ?? "inherit";
 		const modelLabel = models.every((value) => value === firstModel)
@@ -2445,8 +3230,8 @@ class SddModelPanel implements OverlayComponent {
 	}
 
 	private renderAgentLabel(row: string): string {
-		const model = this.draft[row]?.model ?? "inherit";
-		const effort = this.draft[row]?.thinking ?? "inherit";
+		const model = this.draft[row]?.model ?? routingDefaultLabel(row, "model");
+		const effort = this.draft[row]?.thinking ?? routingDefaultLabel(row, "effort");
 		return `${this.renderText(sanitizeTerminalText(row).padEnd(20), "text")} ${this.renderText("model=", "muted")}${this.renderText(model, "status")}${this.renderText(
 			", effort=",
 			"muted",
@@ -2471,7 +3256,7 @@ async function showSddModelPanel(
 	config: AgentModelConfig,
 ): Promise<ModelPanelResult> {
 	const modelOptions = await getPiModelOptions(ctx);
-	const agents = listDiscoverableAgents(ctx.cwd).map((agent) => agent.name);
+	const agents = modelAssignmentNames(ctx.cwd);
 	return ctx.ui.custom<ModelPanelResult>(
 		(_tui, theme, _keybindings, done) =>
 			new SddModelPanel(config, modelOptions, agents, done, theme),
@@ -2489,7 +3274,10 @@ async function showSddModelPanel(
 
 async function handleModelsCommand(ctx: ExtensionContext): Promise<void> {
 	migrateLegacyProjectModelOverrides(ctx.cwd);
-	const savedConfig = await readSavedModelConfigAsync(ctx.cwd);
+	const savedConfig = await readModelRoutingAuthorityAsync(
+		modelConfigPath(ctx.cwd),
+		legacyProjectModelConfigPath(ctx.cwd),
+	);
 	if (savedConfig.status === "invalid") {
 		ctx.ui.notify(
 			`el Gentleman cannot open model config because ${savedConfig.path} is invalid JSON or not an object. Fix or remove the file, then run /gentle:models again.`,
@@ -2569,9 +3357,9 @@ async function handleModelsCommand(ctx: ExtensionContext): Promise<void> {
 			}
 			if (result.agent === "all") {
 				const next: AgentModelConfig = { ...config };
-				for (const agent of listDiscoverableAgents(ctx.cwd)) {
-					next[agent.name] = {
-						...(next[agent.name] ?? {}),
+				for (const name of modelAssignmentNames(ctx.cwd)) {
+					next[name] = {
+						...(next[name] ?? {}),
 						model,
 					};
 				}
@@ -2602,6 +3390,667 @@ async function handleModelsCommand(ctx: ExtensionContext): Promise<void> {
 	);
 }
 
+type ProfilesPanelResult =
+	| { type: "apply"; name: string }
+	| { type: "create" }
+	| { type: "update"; name: string }
+	| { type: "duplicate"; name: string }
+	| { type: "rename"; name: string }
+	| { type: "delete"; name: string }
+	| { type: "export"; name: string }
+	| { type: "import" }
+	| { type: "close" };
+
+const PROFILES_PANEL_MIN_BODY_ROWS = 6;
+
+type ProfilesPanelPointerLayout = AgentsViewLayout & { listTop: number };
+
+function hasOwnProfile(profiles: Record<string, unknown>, name: string): boolean {
+	return Object.prototype.hasOwnProperty.call(profiles, name);
+}
+
+function profilesErrorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+/** Keep a detail-pane scroll offset inside the bounds of its own content. */
+function clampDetailScroll(offset: number, lineCount: number, bodyRows: number): number {
+	return Math.max(0, Math.min(offset, Math.max(0, lineCount - bodyRows)));
+}
+
+// Left profile list, right detail panes. Rendering and pointer routing share
+// one measured layout; the list rows keep native keyboard, hover, press,
+// click, and wheel handling through NativeChoiceList. The frame takes the full
+// overlay, so its height follows the terminal rows the same way AgentsView does.
+class ProfilesPanel implements OverlayComponent {
+	private completed = false;
+	private pointerLayout: ProfilesPanelPointerLayout | undefined;
+	private detailScroll = 0;
+	private lastDetailLineCount = 0;
+	private lastDetailRows = 0;
+	private lastSelectedId: string | undefined;
+	readonly list: NativeChoiceList<ProfileListItem>;
+	private readonly file: AgentProfilesFile;
+	private readonly currentConfig: AgentModelConfig;
+	private readonly done: (result: ProfilesPanelResult) => void;
+	private readonly theme: Theme | undefined;
+	private readonly rows: () => number;
+	private readonly orchestratorSettings: OrchestratorSettingsReadResult;
+
+	constructor(
+		file: AgentProfilesFile,
+		currentConfig: AgentModelConfig,
+		done: (result: ProfilesPanelResult) => void,
+		keybindings: KeybindingsManager | undefined,
+		theme: Theme | undefined,
+		selectedName: string | undefined,
+		rows: () => number,
+		orchestratorSettings: OrchestratorSettingsReadResult,
+	) {
+		this.file = file;
+		this.currentConfig = currentConfig;
+		this.done = done;
+		this.theme = theme;
+		this.rows = rows;
+		this.orchestratorSettings = orchestratorSettings;
+		const items = buildProfileListItems(file);
+		this.list = new NativeChoiceList<ProfileListItem>(
+			items,
+			{
+				selectedPrefix: (text) => this.renderText(text, "accent"),
+				selectedText: (text) => this.renderText(text, "accent"),
+				description: (text) => this.renderText(text, "muted"),
+				hoverBackground: (text) => (this.theme ? this.theme.bg("toolPendingBg", text) : text),
+			},
+			keybindings,
+		);
+		this.list.onSelect = (item) => this.finish({ type: "apply", name: item.id });
+		this.list.onCancel = () => this.finish({ type: "close" });
+		const selected = selectedName ? items.findIndex((item) => item.id === selectedName) : -1;
+		if (selected >= 0) this.list.setSelectedIndex(selected);
+	}
+
+	invalidate(): void {
+		this.pointerLayout = undefined;
+		this.list.invalidate();
+	}
+
+	handleInput(data: string): void {
+		if (isKeyRelease(data)) return;
+		if (matchesKey(data, "ctrl+c") || matchesKey(data, "escape")) {
+			this.finish({ type: "close" });
+			return;
+		}
+		const name = this.list.getSelectedItem()?.id;
+		if (matchesKey(data, Key.pageDown) || matchesKey(data, Key.ctrl("j"))) {
+			this.scrollDetail(this.pageRows());
+			return;
+		}
+		if (matchesKey(data, Key.pageUp) || matchesKey(data, Key.ctrl("k"))) {
+			this.scrollDetail(-this.pageRows());
+			return;
+		}
+		// Agents-view line scroll: j/k move the routing one line at a time. The
+		// arrow keys stay with the profile list, exactly as the letters below stay
+		// profile actions.
+		if (data === "j") {
+			this.scrollDetail(1);
+			return;
+		}
+		if (data === "k") {
+			this.scrollDetail(-1);
+			return;
+		}
+		if (data === "c") return this.finish({ type: "create" });
+		if (data === "i") return this.finish({ type: "import" });
+		if (!name) return this.list.handleInput(data);
+		if (data === "s") return this.finish({ type: "update", name });
+		if (data === "d") return this.finish({ type: "duplicate", name });
+		if (data === "r") return this.finish({ type: "rename", name });
+		if (data === "x") return this.finish({ type: "delete", name });
+		if (data === "e") return this.finish({ type: "export", name });
+		this.list.handleInput(data);
+	}
+
+	handleMouse(event: TuiMouseEvent): TuiMouseEventResult | undefined {
+		const layout = this.pointerLayout;
+		if (!layout) return undefined;
+		const inBody = event.y >= layout.listTop && event.y < layout.listTop + layout.bodyRows;
+		if (
+			inBody &&
+			event.type === "wheel" &&
+			event.wheelDelta &&
+			layout.mode === "panes" &&
+			event.x >= layout.threadX &&
+			event.x < layout.threadX + layout.threadWidth
+		) {
+			this.scrollDetail(event.wheelDelta);
+			return { handled: true, render: true };
+		}
+		if (!inBody) return undefined;
+		if (event.x < layout.listX || event.x >= layout.listX + layout.listWidth) return undefined;
+		return this.list.handleMouse({
+			...event,
+			x: event.x - layout.listX,
+			y: event.y - layout.listTop,
+			width: layout.listWidth,
+			height: layout.bodyRows,
+		});
+	}
+
+	render(width: number): string[] {
+		const safeWidth = Math.max(1, width);
+		const listWidth = measureAgentsViewLayout(safeWidth, PROFILES_PANEL_MIN_BODY_ROWS + 3).listWidth;
+		const listLines = this.list.render(listWidth);
+		// The frame fills the overlay, and the overlay fills the terminal, so the
+		// body height comes from the terminal rows rather than from the content.
+		const rows = Math.max(PROFILES_PANEL_MIN_BODY_ROWS + 3, Math.floor(this.rows()));
+		const layout = measureAgentsViewLayout(safeWidth, rows);
+		if (layout.mode === "fallback" || layout.width === 0) {
+			this.pointerLayout = undefined;
+			return [];
+		}
+		const selectedId = this.list.getSelectedItem()?.id;
+		if (selectedId !== this.lastSelectedId) {
+			this.lastSelectedId = selectedId;
+			this.detailScroll = 0;
+		}
+		const detailLines = this.renderDetailLines(layout.threadWidth, layout.mode === "panes");
+		this.lastDetailLineCount = detailLines.length;
+		this.lastDetailRows = layout.bodyRows;
+		this.detailScroll = clampDetailScroll(this.detailScroll, detailLines.length, layout.bodyRows);
+		this.pointerLayout = { ...layout, listTop: 1 };
+		const rule = "─".repeat(Math.max(0, layout.width - 2));
+		const lines: string[] = [this.renderText(`╭${rule}╮`, "border")];
+		for (let row = 0; row < layout.bodyRows; row += 1) {
+			lines.push(this.renderBodyRow(row, layout, listLines, detailLines));
+		}
+		lines.push(this.renderFooterRow(layout.width));
+		lines.push(this.renderText(`╰${rule}╯`, "border"));
+		return lines;
+	}
+
+	private scrollDetail(delta: number): void {
+		this.detailScroll = clampDetailScroll(
+			this.detailScroll + Math.trunc(delta),
+			this.lastDetailLineCount,
+			this.lastDetailRows,
+		);
+	}
+
+	private pageRows(): number {
+		return Math.max(1, this.lastDetailRows - 1);
+	}
+
+	private finish(result: ProfilesPanelResult): void {
+		if (this.completed) return;
+		this.completed = true;
+		this.list.setDisabled(true);
+		this.done(result);
+	}
+
+	private renderBodyRow(
+		row: number,
+		layout: AgentsViewLayout,
+		listLines: string[],
+		detailLines: string[],
+	): string {
+		if (layout.mode === "panes") {
+			return [
+				this.renderText("│", "border"),
+				" ",
+				this.fitPaneLine(listLines[row] ?? "", layout.listWidth),
+				" ",
+				this.renderText("│", "border"),
+				" ",
+				this.fitPaneLine(detailLines[this.detailScroll + row] ?? "", layout.threadWidth),
+				this.renderText("│", "border"),
+			].join("");
+		}
+		return [
+			this.renderText("│", "border"),
+			" ",
+			this.fitPaneLine(listLines[row] ?? "", layout.listWidth),
+			" ",
+			this.renderText("│", "border"),
+		].join("");
+	}
+
+	private renderFooterRow(width: number): string {
+		const hints =
+			"enter apply · c create · s update · d duplicate · r rename · x delete · e export · i import · j/k line · ctrl+j/k page · esc close";
+		return [
+			this.renderText("│", "border"),
+			" ",
+			this.fitPaneLine(this.renderText(hints, "muted"), width - 4),
+			" ",
+			this.renderText("│", "border"),
+		].join("");
+	}
+
+	private renderDetailLines(width: number, showDetail: boolean): string[] {
+		if (!showDetail) return [];
+		const name = this.list.getSelectedItem()?.id;
+		if (!name || !hasOwnProfile(this.file.profiles, name)) {
+			return [this.renderLine("No profile selected.", width, "muted")];
+		}
+		const config = this.file.profiles[name];
+		const profileRows = profileRoutingRows(config);
+		const currentRows = profileRoutingRows(this.currentConfig);
+		// One shared measurement across both tables, so the same agent sits in the
+		// same column whether it comes from the profile or from models.json.
+		const widths = routingColumnWidths(profileRows, currentRows);
+		return [
+			this.renderLine(name === this.file.active ? `${name} (active)` : name, width, "title"),
+			this.renderLine(
+				`orchestrator  ${formatOrchestratorSelection(readProfileOrchestrator(config))}`,
+				width,
+				"text",
+			),
+			this.renderLine(`now           ${this.effectiveOrchestratorLabel()}`, width, "muted"),
+			"",
+			this.renderLine("Profile routing", width, "accent"),
+			...this.indentLines(this.routingLines(profileRows, widths), width),
+			"",
+			this.renderLine("Current routing (models.json)", width, "accent"),
+			...this.indentLines(this.routingLines(currentRows, widths), width),
+		];
+	}
+
+	private effectiveOrchestratorLabel(): string {
+		const settings = this.orchestratorSettings;
+		if (settings.status === "invalid") {
+			return `unreadable (${sanitizeTerminalText(settings.reason)})`;
+		}
+		return formatOrchestratorSelection(settings.status === "valid" ? settings.entry : undefined);
+	}
+
+	private routingLines(
+		rows: ProfileRoutingRow[],
+		widths: { agent: number; model: number },
+	): string[] {
+		if (rows.length === 0) {
+			return ["No routing entries — every agent inherits its default model."];
+		}
+		return rows.map((row) => formatRoutingRow(row, widths));
+	}
+
+	private indentLines(lines: string[], width: number): string[] {
+		return lines.map((line) => this.renderLine(`  ${line}`, width, "text"));
+	}
+
+	private fitPaneLine(line: string, width: number): string {
+		const visible = stripAnsi(line);
+		if (visible.length > width) {
+			return truncateToWidth(visible, Math.max(1, width), "…", true);
+		}
+		return `${line}${" ".repeat(Math.max(0, width - visible.length))}`;
+	}
+
+	private renderLine(text: string, width: number, tone?: PanelTone): string {
+		const safe = truncateToWidth(
+			sanitizeTerminalText(text),
+			Math.max(1, width),
+			"…",
+			true,
+		);
+		return tone ? this.renderText(safe, tone) : safe;
+	}
+
+	private renderText(text: string, tone: PanelTone): string {
+		const safe = sanitizeTerminalText(text);
+		if (!this.theme) return safe;
+		return this.theme.fg(PANEL_TONE_COLOR[tone], safe);
+	}
+}
+
+async function showProfilesPanel(
+	ctx: ExtensionContext,
+	file: AgentProfilesFile,
+	currentConfig: AgentModelConfig,
+	selectedName?: string,
+): Promise<ProfilesPanelResult> {
+	// Read once, for the panel lifetime. The orchestrator shown as "now" is the
+	// state the panel opened on, not a value that changes mid-panel.
+	const orchestratorSettings = readOrchestratorSettings(orchestratorSettingsPath());
+	return ctx.ui.custom<ProfilesPanelResult>(
+		(tui, theme, keybindings, done) => {
+			const panel = new ProfilesPanel(
+				file,
+				currentConfig,
+				done,
+				keybindings,
+				theme,
+				selectedName,
+				() => Math.max(0, tui.terminal.rows),
+				orchestratorSettings,
+			);
+			const container = createNativeFullscreenInteraction({
+				keyboardTarget: panel,
+				requestRender: () => tui.requestRender(),
+				mouseObserver: panel.list.createMouseObserver(() => tui.requestRender()),
+			});
+			container.addChild(panel);
+			return container;
+		},
+		{
+			overlay: true,
+			overlayOptions: {
+				anchor: "center",
+				width: "100%",
+				maxHeight: "100%",
+				margin: 0,
+			},
+		},
+	);
+}
+
+function reportProfilesDrops(ctx: ExtensionContext, path: string, drops: ProfilesParseDrops): void {
+	// Dropped names are by definition the ones that failed validation, so they are
+	// untrusted input reaching the terminal and must be sanitized like any other
+	// externally supplied text.
+	const parts: string[] = [];
+	if (drops.droppedProfiles.length > 0) {
+		parts.push(`profiles: ${drops.droppedProfiles.map((name) => sanitizeTerminalText(name)).join(", ")}`);
+	}
+	if (drops.droppedAgents.length > 0) {
+		parts.push(
+			`routing entries: ${drops.droppedAgents.map(({ profile, agent }) => `${sanitizeTerminalText(profile)}/${sanitizeTerminalText(agent)}`).join(", ")}`,
+		);
+	}
+	if (drops.droppedActive !== undefined) {
+		parts.push(`active marker: ${sanitizeTerminalText(drops.droppedActive)}`);
+	}
+	if (parts.length > 0) {
+		ctx.ui.notify(
+			`el Gentleman dropped invalid entries while loading ${sanitizeTerminalText(path)} — ${parts.join("; ")}.`,
+			"warning",
+		);
+	}
+}
+
+async function runProfilesPanelAction(
+	ctx: ExtensionContext,
+	path: string,
+	file: AgentProfilesFile,
+	result: Exclude<ProfilesPanelResult, { type: "close" }>,
+): Promise<AgentProfilesFile> {
+	switch (result.type) {
+		case "apply": {
+			if (!hasOwnProfile(file.profiles, result.name)) return file;
+			const normalized = normalizeModelConfig(file.profiles[result.name]) ?? {};
+			const orchestratorEntry = readProfileOrchestrator(normalized);
+			// Applying spans three files — the store, models.json, and Pi's global
+			// settings.json — and there is no cross-file rename, so order the writes to
+			// keep the store truthful and compensate on failure: claim the profile in
+			// the store first, then materialise routing, then the orchestrator. A claim
+			// that fails leaves routing untouched; anything that fails after the claim
+			// restores the previous claim and, when the previously active profile is
+			// known, the routing that profile implies.
+			const claimed = setActiveProfile(file, result.name);
+			try {
+				writeProfilesFileSync(path, claimed);
+			} catch (error) {
+				ctx.ui.notify(
+					`el Gentleman could not update ${sanitizeTerminalText(path)}: ${profilesErrorMessage(error)}`,
+					"warning",
+				);
+				return file;
+			}
+			const previousActiveConfig =
+				file.active !== undefined && hasOwnProfile(file.profiles, file.active)
+					? normalizeModelConfig(file.profiles[file.active]) ?? {}
+					: undefined;
+			// Set only when the orchestrator write succeeded, so the revert knows it has
+			// something to undo. A rollback closure (not a previous-bytes value) is used
+			// because "the file did not exist before" is a real state that must restore
+			// by removing the file, and `undefined` bytes cannot carry that distinction.
+			let orchestratorRollback: (() => void) | undefined;
+			const revertClaim = async (routingWritten: boolean): Promise<AgentProfilesFile> => {
+				let restored = previousActiveConfig === undefined ? "" : "routing";
+				if (routingWritten && previousActiveConfig !== undefined) {
+					try {
+						await writeModelConfigAsync(ctx.cwd, previousActiveConfig);
+					} catch {
+						restored = "";
+					}
+				}
+				if (orchestratorRollback) {
+					try {
+						orchestratorRollback();
+						restored = restored === "" ? "settings" : `${restored} and settings`;
+					} catch {
+						restored = restored === "" ? "" : restored;
+					}
+				}
+				try {
+					writeProfilesFileSync(path, file);
+					restored = restored === "" ? "active marker" : `${restored} and active marker`;
+				} catch {
+					restored = restored === "" ? "nothing" : restored;
+				}
+				const unresolved =
+					routingWritten && previousActiveConfig === undefined
+						? ` ${sanitizeTerminalText(modelConfigPath(ctx.cwd))} still holds this profile's routing because no previously active profile was recorded to restore.`
+						: "";
+				ctx.ui.notify(
+					`el Gentleman could not apply profile "${result.name}". Restored: ${restored}.${unresolved}`,
+					"warning",
+				);
+				return file;
+			};
+			try {
+				await writeModelConfigAsync(ctx.cwd, normalized);
+			} catch (error) {
+				ctx.ui.notify(
+					`el Gentleman could not write ${sanitizeTerminalText(modelConfigPath(ctx.cwd))}: ${profilesErrorMessage(error)}`,
+					"warning",
+				);
+				return revertClaim(false);
+			}
+			const applyResult = await applySavedModelConfig(ctx);
+			if (applyResult.invalidPath) {
+				return revertClaim(true);
+			}
+			let orchestratorNote = "";
+			if (orchestratorEntry !== undefined) {
+				const settingsPath = orchestratorSettingsPath();
+				const written = applyOrchestratorSettings(settingsPath, orchestratorEntry);
+				if (written.status === "invalid") {
+					ctx.ui.notify(
+						`el Gentleman could not set the orchestrator from profile "${result.name}": ${sanitizeTerminalText(written.reason)}. ${sanitizeTerminalText(settingsPath)} was left unchanged.`,
+						"warning",
+					);
+					return revertClaim(true);
+				}
+				if (written.status === "written") {
+					const previous = written.previous;
+					orchestratorRollback = () => restoreOrchestratorSettings(settingsPath, previous);
+					orchestratorNote = `\nOrchestrator set to ${formatOrchestratorSelection(orchestratorEntry)} in ${sanitizeTerminalText(settingsPath)}.`;
+				}
+			}
+			ctx.ui.notify(
+				[
+					`el Gentleman applied profile "${result.name}" — ${applyResult.updated} agent${applyResult.updated === 1 ? "" : "s"} updated.`,
+					"New routing takes effect on the next subagent launch.",
+				].join("\n") + orchestratorNote,
+				"info",
+			);
+			return claimed;
+		}
+		case "create": {
+			const name = await ctx.ui.input("New profile name", "e.g. deep-work");
+			if (name === undefined) return file;
+			try {
+				const next = createProfile(file, name.trim(), {});
+				writeProfilesFileSync(path, next);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile not created: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+		case "update": {
+			const current = await readModelConfigAsync(ctx.cwd);
+			// A profile is a complete snapshot, so capturing the current routing also
+			// captures the orchestrator the routing is running under. A settings file
+			// that cannot be read leaves the snapshot without an orchestrator entry
+			// rather than inventing one.
+			const settings = readOrchestratorSettings(orchestratorSettingsPath());
+			const snapshot: AgentModelConfig = cloneModelConfig(current);
+			if (settings.status === "valid" && settings.entry !== undefined) {
+				snapshot[PROFILE_ORCHESTRATOR_KEY] = { ...settings.entry };
+			}
+			try {
+				const next = updateProfile(file, result.name, snapshot);
+				writeProfilesFileSync(path, next);
+				ctx.ui.notify(
+					`el Gentleman updated profile "${result.name}" from the current routing in ${modelConfigPath(ctx.cwd)}.`,
+					"info",
+				);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile not updated: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+		case "duplicate": {
+			const name = await ctx.ui.input(`Duplicate profile "${result.name}" as`, `${result.name}-copy`);
+			if (name === undefined) return file;
+			try {
+				const next = duplicateProfile(file, result.name, name.trim());
+				writeProfilesFileSync(path, next);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile not duplicated: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+		case "rename": {
+			const name = await ctx.ui.input(`Rename profile "${result.name}" to`, result.name);
+			if (name === undefined) return file;
+			try {
+				const next = renameProfile(file, result.name, name.trim());
+				writeProfilesFileSync(path, next);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile not renamed: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+		case "delete": {
+			const approved = await ctx.ui.confirm(
+				"Delete profile?",
+				`Delete profile "${result.name}" from ${path}? The routing in ${modelConfigPath(ctx.cwd)} is not changed.`,
+			);
+			if (!approved) return file;
+			try {
+				const next = deleteProfile(file, result.name);
+				writeProfilesFileSync(path, next);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile not deleted: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+		case "export": {
+			if (!hasOwnProfile(file.profiles, result.name)) return file;
+			const exportPath = profileExportPath(gentleAiConfigHome());
+			try {
+				const text = serializeProfileExport(result.name, file.profiles[result.name]);
+				await mkdir(dirname(exportPath), { recursive: true });
+				await writeFile(exportPath, text);
+				ctx.ui.notify(`el Gentleman exported profile "${result.name}" to ${exportPath}.`, "info");
+			} catch (error) {
+				ctx.ui.notify(`Profile export failed: ${profilesErrorMessage(error)}`, "warning");
+			}
+			return file;
+		}
+		case "import": {
+			const importPath = profileExportPath(gentleAiConfigHome());
+			let text: string;
+			try {
+				text = await readFile(importPath, "utf8");
+			} catch {
+				ctx.ui.notify(`Profile import failed: ${importPath} is missing or unreadable.`, "warning");
+				return file;
+			}
+			const parsed = parseProfileExportTextWithDrops(text);
+			if (!parsed) {
+				ctx.ui.notify(
+					`Profile import failed: ${importPath} is not a valid agent-model profile export.`,
+					"warning",
+				);
+				return file;
+			}
+			if (parsed.droppedAgents.length > 0) {
+				ctx.ui.notify(
+					`el Gentleman dropped invalid routing entries while importing profile "${parsed.name}": ${parsed.droppedAgents.join(", ")}.`,
+					"warning",
+				);
+			}
+			if (hasOwnProfile(file.profiles, parsed.name)) {
+				const approved = await ctx.ui.confirm(
+					"Replace existing profile?",
+					`Profile "${parsed.name}" already exists in ${path}. Replace its routing with the import?`,
+				);
+				if (!approved) return file;
+			}
+			try {
+				const next = hasOwnProfile(file.profiles, parsed.name)
+					? updateProfile(file, parsed.name, parsed.config)
+					: createProfile(file, parsed.name, parsed.config);
+				writeProfilesFileSync(path, next);
+				const entries = Object.keys(parsed.config).length;
+				ctx.ui.notify(
+					`el Gentleman imported profile "${parsed.name}" (${entries} routing ${entries === 1 ? "entry" : "entries"}) from ${importPath}.`,
+					"info",
+				);
+				return next;
+			} catch (error) {
+				ctx.ui.notify(`Profile import failed: ${profilesErrorMessage(error)}`, "warning");
+				return file;
+			}
+		}
+	}
+}
+
+async function handleProfilesCommand(ctx: ExtensionContext): Promise<void> {
+	const path = profilesFilePath(gentleAiConfigHome());
+	const read = readProfilesFileResult(path);
+	if (read.status === "invalid") {
+		ctx.ui.notify(
+			`el Gentleman cannot open agent profiles because ${path} is invalid JSON or not a profiles file. Fix or remove the file, then run /gentle:profiles again.`,
+			"warning",
+		);
+		return;
+	}
+	let file: AgentProfilesFile;
+	if (read.status === "missing") {
+		file = bootstrapProfilesFile(await readModelConfigAsync(ctx.cwd));
+		try {
+			writeProfilesFileSync(path, file);
+		} catch (error) {
+			ctx.ui.notify(
+				`el Gentleman could not create ${path}: ${profilesErrorMessage(error)}`,
+				"warning",
+			);
+			return;
+		}
+		ctx.ui.notify(`el Gentleman seeded the "current" profile in ${path} from the saved model routing.`, "info");
+	} else {
+		file = read.file;
+		reportProfilesDrops(ctx, path, read.drops);
+	}
+	let selectedName: string | undefined;
+	let result = await showProfilesPanel(ctx, file, await readModelConfigAsync(ctx.cwd), selectedName);
+	while (result.type !== "close") {
+		selectedName = "name" in result ? result.name : undefined;
+		file = await runProfilesPanelAction(ctx, path, file, result);
+		result = await showProfilesPanel(ctx, file, await readModelConfigAsync(ctx.cwd), selectedName);
+	}
+}
+
 async function handlePersonaCommand(ctx: ExtensionContext): Promise<void> {
 	const current = readPersonaMode(ctx.cwd);
 	const selected = await ctx.ui.select(
@@ -2645,6 +4094,9 @@ const REVIEW_CONTROLLER_OPERATION = {
 	RECONCILE_AUTHORITY: "reconcile-authority",
 	REPAIR_LEGACY_ALIAS: "repair-legacy-alias",
 	REPAIR: "repair",
+	// gentle-pi#662: read-only native risk assessment (gentle-ai#4295). Never
+	// mutates review authority state and never requires a lineageId.
+	ASSESS: "assess",
 } as const;
 
 type ReviewControllerOperation =
@@ -2676,7 +4128,8 @@ const REVIEW_CONTROLLER_PARAMETERS = {
 			description: "Bounded review lineage identifier. A failed start creates no lineage; do not use it with status or advance.",
 		},
 		selectionBinding: { type: "string", description: "Opaque provider-issued pre-lineage intended-untracked selection binding." },
-		intendedUntracked: { type: "array", items: { type: "string" }, description: "Repository-relative paths selected from the provider binding." },
+		intendedUntracked: { type: "array", items: { type: "string" }, description: 'Repository-relative paths selected from the provider binding; on inspect they are accepted only with untrackedScope "select".' },
+		untrackedScope: { type: "string", enum: ["exclude", "select"], description: 'Inspect-only: resolve the intended-untracked selection stop in one call. "exclude" excludes every eligible untracked path and forbids intendedUntracked; "select" includes exactly the supplied intendedUntracked paths.' },
 		changeName: {
 			type: "string",
 			description: "Canonical OpenSpec change name required to resolve a recovered authority during lifecycle validate.",
@@ -2691,7 +4144,7 @@ const REVIEW_CONTROLLER_PARAMETERS = {
 		},
 		input: {
 			type: "string",
-			description: "A JSON-serialized object string, not a nested object. New native ordinary START uses {\"mode\":\"ordinary\"}; answer-consent uses exactly {\"consentBinding\":\"<opaque id>\",\"answer\":\"granted|declined\"}. Ordinary provider capture belongs only to gentle_review_capture. An explicit baseRef requires committedOnly: true and requests a committed range, while repository-local policyPath remains optional. Legacy controller input remains separate.",
+			description: "A JSON-serialized object string, not a nested object. New native ordinary START uses {\"mode\":\"ordinary\"}; answer-consent uses exactly {\"consentBinding\":\"<opaque id>\",\"answer\":\"granted|declined\"}. Ordinary provider capture belongs only to gentle_review_capture. An explicit baseRef requires committedOnly: true and requests a committed range, while repository-local policyPath remains optional. ASSESS accepts an optional object with baseRef, committedOnly, writerModelId, writerEffort, and nativeReviewOutcome (gentle-pi#662/#668); omitting writerModelId and writerEffort assesses the ambient working tree and fails closed to a small writer profile (never large) because the writer's actual profile is unknown to this call. nativeReviewOutcome (one of closed, declined, unavailable, unknown) tells ASSESS whether the native review actually closed for this candidate: when Receipt-driven development reads on but the review was declined for this candidate, is unavailable, or its outcome is unknown, ASSESS falls back to the exact risk-gated plan it returns when RDD is off, re-enabling the separate verifier -- a decline is candidate-scoped and never lowers the bar below the RDD-off path. Omitting it lets ASSESS try to derive declined/unavailable from what this process itself recorded for this exact candidate (never a different one, and never from repository state alone), failing closed to unknown when it cannot; `closed` is never derived -- pass it explicitly, and only right after acknowledging the approved review for this same candidate. The returned outcome_source (explicit|derived|unknown) says which of these produced the value. Legacy controller input remains separate.",
 		},
 		outputPath: { type: "string", description: "Retired with legacy bundle export; ignored. Export returns legacy-operation-retired." },
 		inputPath: { type: "string", description: "Repository-local JSON input file for the separate legacy controller flow (alternative to input). Legacy bundle import is retired." },
@@ -2779,11 +4232,57 @@ interface ReviewScopeParameters {
 	cursor?: number;
 }
 
+// gentle-pi#662: read-only native risk assessment, gating the separate
+// verifier on native risk instead of a task-description judgment when the
+// rendered `Receipt-driven development:` line is `off` or `unknown`. Exposed
+// as `gentle_review` operation `assess` (not a dedicated tool), taking its
+// optional fields through the controller's existing generic `input` JSON
+// string, exactly like START's `{"mode":...,"baseRef":...}`.
+interface ReviewAssessInput {
+	baseRef?: string;
+	committedOnly?: boolean;
+	writerModelId?: string;
+	writerEffort?: string;
+	// gentle-pi#668: the caller's own known outcome for this candidate.
+	// Omitted tries to auto-derive declined/unavailable for this EXACT
+	// candidate's own target identity (never a different one); `closed` is
+	// never auto-derived -- pass it explicitly.
+	nativeReviewOutcome?: NativeReviewOutcome;
+}
+
+function isNativeReviewOutcome(value: unknown): value is NativeReviewOutcome {
+	return typeof value === "string" && (Object.values(NATIVE_REVIEW_OUTCOME) as readonly string[]).includes(value);
+}
+
+function parseReviewAssessInput(operation: ReviewControllerOperation, raw: string | undefined): ReviewAssessInput {
+	if (raw === undefined) return {};
+	const value = parseControllerJson(raw, operation);
+	const allowed = new Set(["baseRef", "committedOnly", "writerModelId", "writerEffort", "nativeReviewOutcome"]);
+	const unexpected = Object.keys(value).find((key) => !allowed.has(key));
+	if (unexpected !== undefined) throw new Error(`Review controller ${operation} input does not accept ${unexpected}`);
+	const { baseRef, committedOnly, writerModelId, writerEffort, nativeReviewOutcome } = value;
+	if (baseRef !== undefined && typeof baseRef !== "string") throw new Error(`Review controller ${operation} input baseRef must be a string`);
+	if (committedOnly !== undefined && typeof committedOnly !== "boolean") throw new Error(`Review controller ${operation} input committedOnly must be a boolean`);
+	if (writerModelId !== undefined && typeof writerModelId !== "string") throw new Error(`Review controller ${operation} input writerModelId must be a string`);
+	if (writerEffort !== undefined && typeof writerEffort !== "string") throw new Error(`Review controller ${operation} input writerEffort must be a string`);
+	if (nativeReviewOutcome !== undefined && !isNativeReviewOutcome(nativeReviewOutcome)) {
+		throw new Error(`Review controller ${operation} input nativeReviewOutcome must be one of ${Object.values(NATIVE_REVIEW_OUTCOME).join(", ")}`);
+	}
+	return {
+		...(baseRef === undefined ? {} : { baseRef: baseRef as string }),
+		...(committedOnly === undefined ? {} : { committedOnly: committedOnly as boolean }),
+		...(writerModelId === undefined ? {} : { writerModelId: writerModelId as string }),
+		...(writerEffort === undefined ? {} : { writerEffort: writerEffort as string }),
+		...(nativeReviewOutcome === undefined ? {} : { nativeReviewOutcome: nativeReviewOutcome as NativeReviewOutcome }),
+	};
+}
+
 interface ReviewControllerParameters {
 	operation: ReviewControllerOperation;
 	lineageId?: string;
 	selectionBinding?: string;
 	intendedUntracked?: readonly string[];
+	untrackedScope?: NativeStartUntrackedScope;
 	changeName?: string;
 	idempotencyKey?: string;
 	transition?: string;
@@ -2823,13 +4322,50 @@ function parseReviewControllerParameters(value: unknown): ReviewControllerParame
 		if (unexpected !== undefined || typeof value.selectionBinding !== "string" || !Array.isArray(value.intendedUntracked) || (value.workspaceRoot !== undefined && typeof value.workspaceRoot !== "string")) throw new Error("Review intended-untracked selection accepts exactly selectionBinding and intendedUntracked, with optional workspaceRoot");
 		return { operation: value.operation, selectionBinding: value.selectionBinding, intendedUntracked: value.intendedUntracked, ...(typeof value.workspaceRoot === "string" ? { workspaceRoot: value.workspaceRoot } : {}) };
 	}
-	const needsLineage = ![REVIEW_CONTROLLER_OPERATION.START, REVIEW_CONTROLLER_OPERATION.ANSWER_CONSENT, REVIEW_CONTROLLER_OPERATION.STATUS, REVIEW_CONTROLLER_OPERATION.EXPORT, REVIEW_CONTROLLER_OPERATION.IMPORT, REVIEW_CONTROLLER_OPERATION.INSPECT, REVIEW_CONTROLLER_OPERATION.RESET, REVIEW_CONTROLLER_OPERATION.RECOVER, REVIEW_CONTROLLER_OPERATION.RECOVER_LOCK, REVIEW_CONTROLLER_OPERATION.ABANDON, REVIEW_CONTROLLER_OPERATION.QUARANTINE_LEGACY, REVIEW_CONTROLLER_OPERATION.RECONCILE_AUTHORITY, REVIEW_CONTROLLER_OPERATION.REPAIR_LEGACY_ALIAS, REVIEW_CONTROLLER_OPERATION.REPAIR].includes(value.operation as ReviewControllerOperation);
+	// gentle-pi#706: top-level untrackedScope/intendedUntracked resolve the
+	// intended-untracked stop through inspect alone. intendedUntracked is not a
+	// standalone selector: inspect accepts it only for an explicit select scope.
+	const hasIntendedUntracked = "intendedUntracked" in value;
+	if (hasIntendedUntracked && value.operation !== REVIEW_CONTROLLER_OPERATION.INSPECT) {
+		throw new Error(
+			`Review controller ${value.operation} does not accept intendedUntracked; it is accepted only by inspect with untrackedScope select`,
+		);
+	}
+	if (value.untrackedScope !== undefined) {
+		if (value.operation !== REVIEW_CONTROLLER_OPERATION.INSPECT)
+			throw new Error(
+				`Review controller ${value.operation} does not accept untrackedScope; it is accepted only by inspect`,
+			);
+		if (
+			value.untrackedScope !== NATIVE_START_UNTRACKED_SCOPE.EXCLUDE &&
+			value.untrackedScope !== NATIVE_START_UNTRACKED_SCOPE.SELECT
+		)
+			throw new Error(
+				"Review controller inspect untrackedScope must be exclude or select",
+			);
+	}
+	if (hasIntendedUntracked) {
+		if (value.untrackedScope !== NATIVE_START_UNTRACKED_SCOPE.SELECT) {
+			throw new Error(
+				"Review controller inspect intendedUntracked requires untrackedScope select",
+			);
+		}
+		if (!Array.isArray(value.intendedUntracked)) {
+			throw new Error(
+				"Review controller inspect intendedUntracked must be an array of repository-relative paths",
+			);
+		}
+	}
+
+	const needsLineage = ![REVIEW_CONTROLLER_OPERATION.START, REVIEW_CONTROLLER_OPERATION.ANSWER_CONSENT, REVIEW_CONTROLLER_OPERATION.STATUS, REVIEW_CONTROLLER_OPERATION.EXPORT, REVIEW_CONTROLLER_OPERATION.IMPORT, REVIEW_CONTROLLER_OPERATION.INSPECT, REVIEW_CONTROLLER_OPERATION.RESET, REVIEW_CONTROLLER_OPERATION.RECOVER, REVIEW_CONTROLLER_OPERATION.RECOVER_LOCK, REVIEW_CONTROLLER_OPERATION.ABANDON, REVIEW_CONTROLLER_OPERATION.QUARANTINE_LEGACY, REVIEW_CONTROLLER_OPERATION.RECONCILE_AUTHORITY, REVIEW_CONTROLLER_OPERATION.REPAIR_LEGACY_ALIAS, REVIEW_CONTROLLER_OPERATION.REPAIR, REVIEW_CONTROLLER_OPERATION.ASSESS].includes(value.operation as ReviewControllerOperation);
 	if (needsLineage && (typeof value.lineageId !== "string" || value.lineageId.trim().length === 0)) {
 		throw new Error("Review controller requires a lineageId");
 	}
 	const parameters: ReviewControllerParameters = {
 		operation: value.operation,
 		...(typeof value.lineageId === "string" ? { lineageId: value.lineageId } : {}),
+		...(value.operation === REVIEW_CONTROLLER_OPERATION.INSPECT && value.untrackedScope !== undefined ? { untrackedScope: value.untrackedScope } : {}),
+		...(value.operation === REVIEW_CONTROLLER_OPERATION.INSPECT && value.intendedUntracked !== undefined ? { intendedUntracked: [...value.intendedUntracked] } : {}),
 	};
 	for (const key of ["changeName", "idempotencyKey", "transition", "input", "outputPath", "inputPath", "operationId", "lineageIds", "acknowledgeUntrustedBundleSource", "workspaceRoot"] as const) {
 		const optional = value[key];
@@ -3107,6 +4643,15 @@ async function resolveReviewModeGate(
 	}
 }
 
+// gentle-pi#185: a native CLI without negotiated STATUS support (no
+// `targetStatus`, or a version-incompatible provider) hits this boundary
+// before any candidate-view restoration is attempted, so it can never
+// reproduce the #176 empty-registry failure — but the boundary's own
+// `next_action` was a machine token with nothing a human or an agent could
+// run. `remediation_command` names the exact upstream command that
+// re-establishes negotiated STATUS for this session's Pi host identity.
+const NATIVE_STATUS_UNSUPPORTED_REMEDIATION_COMMAND = "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --agent pi --next-transition";
+
 function nativeStatusUnsupported(operation: ReviewControllerOperation): Record<string, unknown> {
 	return {
 		operation,
@@ -3115,6 +4660,7 @@ function nativeStatusUnsupported(operation: ReviewControllerOperation): Record<s
 		...(operation === REVIEW_CONTROLLER_OPERATION.START ? nativeStartPreAuthorityRejection() : { mutation_performed: false }),
 		inventory_complete: false,
 		next_action: "require-upstream-read-only-native-status-inventory",
+		remediation_command: NATIVE_STATUS_UNSUPPORTED_REMEDIATION_COMMAND,
 		evidence: {
 			native_contract: "gentle-ai/2.1.4",
 			general_status: "unsupported",
@@ -3126,8 +4672,8 @@ function nativeStatusUnsupported(operation: ReviewControllerOperation): Record<s
 // Bundled and source module instances can coexist, making instanceof insufficient.
 function asNativeReviewCliError(error: unknown): { code: string; diagnostics: NativeReviewProcessDiagnostics } | undefined {
 	if (error instanceof NativeReviewCliError) return error;
-	if (!(error instanceof Error) || error.name !== "NativeReviewCliError") return undefined;
-	const value = error as unknown as { code?: unknown; diagnostics?: unknown };
+	if (!isRecord(error) || error.name !== "NativeReviewCliError") return undefined;
+	const value = error as { code?: unknown; diagnostics?: unknown };
 	if (typeof value.code !== "string") return undefined;
 	const diagnostics = sanitizeForeignNativeReviewDiagnostics(value.diagnostics);
 	return diagnostics === undefined || value.code !== diagnostics.error_code ? undefined : { code: value.code, diagnostics };
@@ -3149,7 +4695,9 @@ function nativeStatusPackageBinaryMissing(operation: ReviewControllerOperation,
 		...(operation === REVIEW_CONTROLLER_OPERATION.START ? nativeStartPreAuthorityRejection() : { lineage_created: false, mutation_performed: false, mutation_outcome: "none" }),
 		inventory_complete: false,
 		diagnostics,
-		next_action: "reinstall-package-local-gentle-ai",
+		reason: `The verified package-local binary is unavailable. ${GENTLE_AI_INSTALL_RECOVERY_INSTRUCTIONS} This does not prove install lifecycle scripts were disabled.`,
+		recovery_command: GENTLE_AI_INSTALL_RECOVERY_COMMAND,
+		next_action: GENTLE_AI_INSTALL_RECOVERY_INSTRUCTIONS,
 	};
 }
 
@@ -3165,6 +4713,23 @@ function nativeStatusFailed(operation: ReviewControllerOperation, error: unknown
 			next_action: "require-complete-native-authority-inventory",
 		};
 	}
+	// gentle-pi#599: a negotiated STATUS/inspect request the native provider
+	// rejects with a decoded failure/v2 envelope (for example a preflight
+	// `invalid_request` refusal for a nested foreign Git repository) used to
+	// fall through to the generic outcome below, discarding the envelope's own
+	// cause, code, retry_safe, and next_action -- the one piece of information
+	// that makes the refusal actionable (pass the intended nested repo as
+	// workspaceRoot). `nativeOperationFailure` already renders this exact
+	// failure-envelope shape faithfully for every mutating operation; reuse it
+	// here instead of masking the refusal as opaque authority-inventory
+	// corruption.
+	if (error instanceof NativeReviewIntegrationError) {
+		return {
+			...nativeOperationFailure(operation, error),
+			outcome: "native-status-unavailable",
+			inventory_complete: false,
+		};
+	}
 	return {
 		operation,
 		status: "blocked",
@@ -3203,7 +4768,6 @@ function missingNativeMaintenanceInputs(operation: NativeMaintenanceOperation, i
 		...missing,
 		...(Array.isArray(input.capturedLensResults) && input.capturedLensResults.every((entry) => isCanonicalProcessString(entry)) ? [] : ["capturedLensResults"]),
 		...(typeof input.findingsPresent === "boolean" ? [] : ["findingsPresent"]),
-		...(typeof input.evidenceRecordsPresent === "boolean" ? [] : ["evidenceRecordsPresent"]),
 	];
 }
 
@@ -3213,7 +4777,7 @@ function invalidNativeMaintenanceInput(operation: NativeMaintenanceOperation, in
 }
 
 function nativeMaintenanceAuthorization(operation: NativeMaintenanceOperation, input: Record<string, unknown>): string {
-	if (operation === "abandon") return nativeReviewAbandonAuthorization({ lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), snapshotIdentity: String(input.snapshotIdentity), capturedLensResults: (input.capturedLensResults as readonly unknown[]).map(String), findingsPresent: input.findingsPresent === true, evidenceRecordsPresent: input.evidenceRecordsPresent === true, actor: String(input.actor), reason: String(input.reason) });
+	if (operation === "abandon") return nativeReviewAbandonAuthorization({ lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), snapshotIdentity: String(input.snapshotIdentity), capturedLensResults: (input.capturedLensResults as readonly unknown[]).map(String), findingsPresent: input.findingsPresent === true, actor: String(input.actor), reason: String(input.reason) });
 	if (operation === "quarantineLegacy") return nativeReviewLegacyQuarantineAuthorization({ repository: String(input.repository), lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), diagnostic: NATIVE_REVIEW_LEGACY_QUARANTINE.DIAGNOSTIC, disposition: NATIVE_REVIEW_LEGACY_QUARANTINE.DISPOSITION, actor: String(input.actor), reason: String(input.reason) });
 	return nativeReviewReconcileAuthorization({ predecessorLineage: String(input.predecessorLineage), expectedPredecessorRevision: String(input.expectedPredecessorRevision), successorLineage: String(input.successorLineage), expectedSuccessorRevision: String(input.expectedSuccessorRevision), actor: String(input.actor), reason: String(input.reason), ...(input.anomalies === undefined ? {} : { anomalies: NATIVE_REVIEW_RECONCILE_ANOMALIES.COMBINED }) });
 }
@@ -3240,7 +4804,7 @@ async function executeNativeAuthorityMaintenance(
 	}
 	try {
 		const result = nativeOperation === "abandon"
-			? await nativeReviewCli.abandon!({ cwd, lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), snapshotIdentity: String(input.snapshotIdentity), capturedLensResults: (input.capturedLensResults as readonly unknown[]).map(String), findingsPresent: input.findingsPresent === true, evidenceRecordsPresent: input.evidenceRecordsPresent === true, actor: String(input.actor), reason: String(input.reason), maintainerAuthorization: nativeMaintenanceAuthorization(nativeOperation, input), ...(signal === undefined ? {} : { signal }) })
+			? await nativeReviewCli.abandon!({ cwd, lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), snapshotIdentity: String(input.snapshotIdentity), capturedLensResults: (input.capturedLensResults as readonly unknown[]).map(String), findingsPresent: input.findingsPresent === true, actor: String(input.actor), reason: String(input.reason), maintainerAuthorization: nativeMaintenanceAuthorization(nativeOperation, input), ...(signal === undefined ? {} : { signal }) })
 			: nativeOperation === "quarantineLegacy"
 				? await nativeReviewCli.quarantineLegacy!({ cwd, repository: String(input.repository), lineage: String(input.lineage), expectedRevision: String(input.expectedRevision), diagnostic: NATIVE_REVIEW_LEGACY_QUARANTINE.DIAGNOSTIC, disposition: NATIVE_REVIEW_LEGACY_QUARANTINE.DISPOSITION, actor: String(input.actor), reason: String(input.reason), maintainerAuthorization: nativeMaintenanceAuthorization(nativeOperation, input), ...(signal === undefined ? {} : { signal }) })
 				: await nativeReviewCli.reconcileAuthority!({ cwd, predecessorLineage: String(input.predecessorLineage), expectedPredecessorRevision: String(input.expectedPredecessorRevision), successorLineage: String(input.successorLineage), expectedSuccessorRevision: String(input.expectedSuccessorRevision), actor: String(input.actor), reason: String(input.reason), ...(input.anomalies === undefined ? {} : { anomalies: NATIVE_REVIEW_RECONCILE_ANOMALIES.COMBINED }), maintainerAuthorization: nativeMaintenanceAuthorization(nativeOperation, input), ...(signal === undefined ? {} : { signal }) });
@@ -3454,6 +5018,31 @@ function mapNativeTargetStatus(operation: ReviewControllerOperation, status: Rev
 			required_status_action: "Use only the provider-selected recovery disposition; do not substitute scope_changed, invalidated, or escalated.",
 		};
 	}
+	// gentle-pi#627: a stale managed-asset set stops the transition with the
+	// exact `gentle-ai sync` invocation that resolves it. Render that command
+	// as the one actionable next step; every other reason code keeps rendering
+	// as a plain blocked result.
+	if (status.nextTransition?.kind === "stop" && status.nextTransition.reasonCode === "managed_assets_outdated" && status.nextTransition.continuation !== undefined) {
+		return {
+			operation,
+			status: "blocked",
+			result: status.raw,
+			...(requestedLineageId === undefined ? {} : { requested_lineage_id: requestedLineageId }),
+			hint: `run ${status.nextTransition.continuation.command}`,
+		};
+	}
+	// gentle-pi#638: an unachievable-lens stop carries the exact withdraw command for every declared slot, mirroring the managed_assets_outdated precedent. A restart that never saw the collect offer still finds its way back from this hint alone.
+	// gentle-pi#822: when the caller asked about one lineage, render only that lineage's withdraw command; the first entry may belong to an unrelated lineage, so an unmatched request omits the hint instead of surfacing a potentially unrelated withdraw command. Without a requested lineage the first entry stays the fallback.
+	if (status.nextTransition?.kind === "stop" && status.nextTransition.reasonCode === "unachievable_lens_slot" && status.nextTransition.unachievableLensSlots !== undefined) {
+		const withdrawSlot = requestedLineageId === undefined ? status.nextTransition.unachievableLensSlots[0] : status.nextTransition.unachievableLensSlots.find((slot) => slot.withdraw.binding.lineageId === requestedLineageId);
+		return {
+			operation,
+			status: "blocked",
+			result: status.raw,
+			...(requestedLineageId === undefined ? {} : { requested_lineage_id: requestedLineageId }),
+			...(withdrawSlot === undefined ? {} : { hint: `run ${withdrawSlot.withdraw.command}` }),
+		};
+	}
 	return {
 		operation,
 		status: status.action === "start" ? "ready" : "blocked",
@@ -3547,6 +5136,12 @@ interface RetainedNativeUntrackedSelection {
 	readonly untrackedScope: NativeStartUntrackedScope;
 	readonly expectedUntrackedInventory: string;
 	readonly intendedUntracked: readonly string[];
+	readonly submission?: NativeIntendedUntrackedSelectionSubmission;
+}
+
+interface RetainedPreLineageNativeUntrackedSelection extends RetainedNativeUntrackedSelection {
+	readonly targetIdentity: string;
+	readonly candidateTree: string;
 }
 
 interface RetainedNativeCaptureRoute { readonly workspaceRoot: string; readonly lineageId: string; readonly baseRef?: string; readonly committedOnly?: true; }
@@ -3622,6 +5217,8 @@ function nativeStatusInputRejection(reason: string, field?: string): Record<stri
 }
 
 const PENDING_REVIEW_CONSENT_TTL_MS = 10 * 60 * 1000;
+const REVIEW_SESSION_PERMISSION_STATUS_KEY = "gentle-review-session-permission";
+const REVIEW_SESSION_PERMISSION_STATUS_TEXT = "reviews allowed for this session";
 
 type PendingReviewConsentSessionKey = string | symbol;
 
@@ -3656,7 +5253,13 @@ const PENDING_REVIEW_CONSENT_STALE_DISPOSITION_LIMIT = 32;
  */
 export class PendingReviewConsentRegistry {
 	private readonly sessions = new Map<PendingReviewConsentSessionKey, Map<string, PendingReviewConsent>>();
-	private readonly staleDispositions = new Map<PendingReviewConsentSessionKey, Map<string, PendingReviewConsentDisposition>>();
+	// gentle-pi#455: a binding id is globally unique (randomUUID), so its live
+	// owner and its stale disposition are tracked by binding id alone. This
+	// index lets answer-consent resolve and atomically take exactly once a
+	// binding another active Pi session's START created; the per-session map
+	// above stays authoritative for session-scoped listings and shutdown cleanup.
+	private readonly byBinding = new Map<string, PendingReviewConsentSessionKey>();
+	private readonly staleDispositions = new Map<string, PendingReviewConsentDisposition>();
 
 	get(sessionKey: PendingReviewConsentSessionKey): Map<string, PendingReviewConsent> | undefined {
 		return this.sessions.get(sessionKey);
@@ -3671,34 +5274,46 @@ export class PendingReviewConsentRegistry {
 		return pending;
 	}
 
+	// Registers a freshly created pending binding under its owning session and
+	// the cross-session binding index in one step so the two never drift.
+	add(sessionKey: PendingReviewConsentSessionKey, pending: PendingReviewConsent): void {
+		this.ensure(sessionKey).set(pending.id, pending);
+		this.byBinding.set(pending.id, sessionKey);
+	}
+
+	// Resolves a live binding to its owning session regardless of which
+	// session asks, so answer-consent can reach a binding another session's
+	// START created (gentle-pi#455).
+	resolve(bindingId: string): { sessionKey: PendingReviewConsentSessionKey; pending: PendingReviewConsent } | undefined {
+		const sessionKey = this.byBinding.get(bindingId);
+		const pending = sessionKey === undefined ? undefined : this.sessions.get(sessionKey)?.get(bindingId);
+		return pending === undefined ? undefined : { sessionKey, pending };
+	}
+
 	private remove(sessionKey: PendingReviewConsentSessionKey, pending: PendingReviewConsent): boolean {
 		const session = this.sessions.get(sessionKey);
 		if (session?.get(pending.id) !== pending) return false;
 		session.delete(pending.id);
 		if (session.size === 0) this.sessions.delete(sessionKey);
+		if (this.byBinding.get(pending.id) === sessionKey) this.byBinding.delete(pending.id);
 		return true;
 	}
 
-	private rememberDisposition(sessionKey: PendingReviewConsentSessionKey, pending: PendingReviewConsent, disposition: PendingReviewConsentDisposition): void {
-		let stale = this.staleDispositions.get(sessionKey);
-		if (stale === undefined) {
-			stale = new Map<string, PendingReviewConsentDisposition>();
-			this.staleDispositions.set(sessionKey, stale);
-		}
-		stale.delete(pending.id);
-		stale.set(pending.id, disposition);
-		while (stale.size > PENDING_REVIEW_CONSENT_STALE_DISPOSITION_LIMIT) stale.delete(stale.keys().next().value!);
+	private rememberDisposition(pending: PendingReviewConsent, disposition: PendingReviewConsentDisposition): void {
+		this.staleDispositions.delete(pending.id);
+		this.staleDispositions.set(pending.id, disposition);
+		while (this.staleDispositions.size > PENDING_REVIEW_CONSENT_STALE_DISPOSITION_LIMIT) this.staleDispositions.delete(this.staleDispositions.keys().next().value!);
 	}
 
 	consume(sessionKey: PendingReviewConsentSessionKey, pending: PendingReviewConsent): boolean {
 		if (!this.remove(sessionKey, pending)) return false;
-		this.rememberDisposition(sessionKey, pending, PENDING_REVIEW_CONSENT_DISPOSITION.CONSUMED);
+		this.rememberDisposition(pending, PENDING_REVIEW_CONSENT_DISPOSITION.CONSUMED);
 		return true;
 	}
 
 	expire(sessionKey: PendingReviewConsentSessionKey, pending: PendingReviewConsent): boolean {
 		if (!this.remove(sessionKey, pending)) return false;
-		this.rememberDisposition(sessionKey, pending, PENDING_REVIEW_CONSENT_DISPOSITION.EXPIRED);
+		this.rememberDisposition(pending, PENDING_REVIEW_CONSENT_DISPOSITION.EXPIRED);
 		return true;
 	}
 
@@ -3706,14 +5321,14 @@ export class PendingReviewConsentRegistry {
 		this.remove(sessionKey, pending);
 	}
 
-	staleDisposition(sessionKey: PendingReviewConsentSessionKey, binding: string): PendingReviewConsentDisposition | undefined {
-		return this.staleDispositions.get(sessionKey)?.get(binding);
+	staleDisposition(binding: string): PendingReviewConsentDisposition | undefined {
+		return this.staleDispositions.get(binding);
 	}
 
 	take(sessionKey: PendingReviewConsentSessionKey): PendingReviewConsent[] {
 		const session = this.sessions.get(sessionKey);
 		this.sessions.delete(sessionKey);
-		this.staleDispositions.delete(sessionKey);
+		if (session !== undefined) for (const pending of session.values()) if (this.byBinding.get(pending.id) === sessionKey) this.byBinding.delete(pending.id);
 		return session === undefined ? [] : [...session.values()];
 	}
 }
@@ -3729,16 +5344,17 @@ const processRetainedNativeStatusSelections = new Map<PendingReviewConsentSessio
 // and a fresh primary-loop start resets it to 0.
 const processAgentEndSubagentDepth = new Map<PendingReviewConsentSessionKey, number>();
 
-// Target identities already nudged once per session, so the read-only
-// `agent_end` preflight reminder fires at most once per unreviewed candidate.
-const processAgentEndPreflightNudgedTargets = new Map<PendingReviewConsentSessionKey, Set<string>>();
+// gentle-pi#677: gentle-ai#4309 owns anonymous usage telemetry end to end;
+// Pi only nudges it once per process. This is a plain process-lifetime
+// guard, not a session-keyed map, because the nudge is meant to fire at most
+// once no matter how many primary-session `before_agent_start` events this
+// process observes.
+let processTelemetryTriggerAttempted = false;
 
-// gentle-pi#568: the target identity negotiated STATUS reported at
-// `session_start`, before this session touched the worktree. A candidate
-// already present at that point is the user's own pre-session work, not
-// something this session produced, so `agent_end` must not treat it as an
-// unreviewed candidate this session should be reminded about.
-const processAgentEndSessionBaseline = new Map<PendingReviewConsentSessionKey, string>();
+/** Testing-only reset for the once-per-process telemetry trigger guard. */
+function resetTelemetryTriggerGuardForTesting(): void {
+	processTelemetryTriggerAttempted = false;
+}
 
 function pendingReviewConsentSessionKey(context: ExtensionContext | undefined, fallbackKey: symbol): PendingReviewConsentSessionKey {
 	try {
@@ -3797,6 +5413,61 @@ function reviewConsentDigest(consent: ReviewConsentEnvelope): string {
 	return createHash("sha256").update(JSON.stringify(consent)).digest("hex");
 }
 
+function reviewSessionManagerAndId(context: ExtensionContext): { manager: object; sessionId: string } | undefined {
+	try {
+		const manager = context.sessionManager as unknown as { getSessionId?: () => unknown };
+		const sessionId = manager.getSessionId?.();
+		if (typeof manager !== "object" || manager === null || typeof sessionId !== "string" || sessionId.length === 0) return undefined;
+		return { manager, sessionId };
+	} catch {
+		return undefined;
+	}
+}
+
+function isDirectOrdinaryReviewStart(parametersValue: unknown): boolean {
+	try {
+		const parameters = parseReviewControllerParameters(parametersValue);
+		if (parameters.operation !== REVIEW_CONTROLLER_OPERATION.START) return false;
+		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
+		return input.mode === REVIEW_MODE.ORDINARY;
+	} catch {
+		return false;
+	}
+}
+
+function isHostReviewConsentEligibleOperation(parametersValue: unknown): boolean {
+	if (isDirectOrdinaryReviewStart(parametersValue)) return true;
+	try {
+		return parseReviewControllerParameters(parametersValue).operation === REVIEW_CONTROLLER_OPERATION.SELECT_INTENDED_UNTRACKED;
+	} catch {
+		return false;
+	}
+}
+
+function completedGrantedReviewConsent(outcome: Record<string, unknown>): boolean {
+	if (
+		outcome.operation !== REVIEW_CONTROLLER_OPERATION.ANSWER_CONSENT ||
+		outcome.status !== undefined ||
+		outcome.outcome !== undefined ||
+		outcome.native_invocation_attempted === false ||
+		outcome.mutation_performed === false ||
+		outcome.lineage_created === false ||
+		!isCanonicalProcessString(outcome.workspace_root)
+	) return false;
+	const result = outcome.result;
+	if (!isRecord(result)) return false;
+	const nonnegativeInteger = (value: unknown): boolean => Number.isInteger(value) && Number(value) >= 0;
+	return isCanonicalProcessString(result.lineage_id) &&
+		isCanonicalProcessString(result.state) &&
+		isCanonicalProcessString(result.risk_tier) &&
+		Array.isArray(result.selected_lenses) && result.selected_lenses.every(isCanonicalProcessString) &&
+		nonnegativeInteger(result.changed_files) &&
+		nonnegativeInteger(result.original_changed_lines) &&
+		nonnegativeInteger(result.correction_budget) &&
+		(result.action === "created" || result.action === "resumed" || result.action === "replayed" || result.action === "closed") &&
+		typeof result.lenses_required === "boolean";
+}
+
 // gentle-pi#516: a binding this session does not hold (already answered,
 // expired, or issued by another Pi session or process) used to fall through
 // to the plain negotiated STATUS, which reads exactly like a healthy pre-start
@@ -3842,6 +5513,50 @@ function staleConsentBindingOutcome(operation: ReviewControllerOperation, bindin
 	};
 }
 
+// gentle-pi#455 correction: cross-session resolution looks a binding up by
+// its opaque id alone, so it must independently confirm the answering
+// invocation addresses the same repository its owning START minted it for.
+// This is a typed, non-bearer refusal in the same shape family as the
+// stale-binding outcome -- it never runs the mode gate or native
+// answerConsent, and never consumes the binding, so it stays answerable from
+// the correct repository afterwards.
+function consentBindingRepositoryMismatchOutcome(operation: ReviewControllerOperation, binding: string, mintingRepositoryCwd: string, answeringRepositoryCwd: string): Record<string, unknown> {
+	return {
+		operation,
+		status: "blocked",
+		outcome: "consent-binding-repository-mismatch",
+		consent_binding: binding,
+		diagnostics: {
+			code: "consent-binding-repository-mismatch",
+			message: `consent binding ${binding} was minted for repository ${mintingRepositoryCwd}, not ${answeringRepositoryCwd}. Answer this binding from a session addressing ${mintingRepositoryCwd}; do not resend this binding from a different repository.`,
+		},
+		native_invocation_attempted: false,
+		...nativeStartPreAuthorityRejection(),
+		next_action: "answer-from-minting-repository",
+	};
+}
+
+// gentle-pi#874: the committed-range selector a current STATUS owns. A
+// selectorless STATUS on a clean, fully committed worktree answers with a
+// review.start execute transition naming the exact merge-base the provider
+// wants, so a plain START can adopt the route the provider just rendered
+// instead of making the caller hand-copy `base-ref` into its input. Only the
+// provider's own offered argument is read -- never a guess, a persisted value,
+// or a stale transition -- and anything that is not a full commit id paired
+// with committed-only is refused, so every other STATUS keeps today's
+// behaviour byte-for-byte.
+const OFFERED_COMMITTED_RANGE_BASE_REF = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+
+function offeredCommittedRangeBaseRef(target: ReviewStatusV3): string | undefined {
+	const execute = target.nextTransition?.kind === "execute" ? target.nextTransition.execute : undefined;
+	if (execute?.operation !== "review.start") return undefined;
+	if (execute.arguments.some((argument) => argument.name === "workspace-overlay")) return undefined;
+	const baseRef = execute.arguments.find((argument) => argument.name === "base-ref")?.value;
+	if (baseRef === undefined || !OFFERED_COMMITTED_RANGE_BASE_REF.test(baseRef)) return undefined;
+	if (execute.arguments.find((argument) => argument.name === "committed-only")?.value !== "true") return undefined;
+	return baseRef;
+}
+
 function assertNativeStartCandidateBinding(candidateView: CandidateView, target: ReviewStatusV3): void {
 	candidateView.verify();
 	if (
@@ -3887,7 +5602,7 @@ function completeNativeStart(
 }
 
 function nativeOperationFailure(operation: ReviewControllerOperation | "gentle_review_capture", error: unknown): Record<string, unknown> {
-	const value = error as { mutationOutcome?: unknown; nextAction?: unknown; diagnostics?: unknown; auditRecord?: unknown; launchAttempted?: unknown; candidateViewPreNative?: unknown; failureEnvelope?: { raw?: unknown; mutationOutcome?: unknown; replayability?: unknown; nextAction?: unknown } };
+	const value = error as { mutationOutcome?: unknown; nextAction?: unknown; diagnostics?: unknown; auditRecord?: unknown; launchAttempted?: unknown; candidateViewPreNative?: unknown; failureEnvelope?: { raw?: unknown; mutationOutcome?: unknown; replayability?: unknown; nextAction?: unknown; code?: unknown; continuation?: { command?: unknown } } };
 	if (isRecord(value.failureEnvelope) && isRecord(value.failureEnvelope.raw)) {
 		const mutationOutcome = value.failureEnvelope.mutationOutcome;
 		return {
@@ -3901,6 +5616,12 @@ function nativeOperationFailure(operation: ReviewControllerOperation | "gentle_r
 					: { mutation_performed: false, mutation_outcome: "none" }),
 			...(typeof value.failureEnvelope.replayability === "string" ? { replayability: value.failureEnvelope.replayability } : {}),
 			...(typeof value.failureEnvelope.nextAction === "string" ? { next_action: value.failureEnvelope.nextAction } : {}),
+			// gentle-pi#627: START's preflight failure envelope for a stale
+			// managed-asset set carries a top-level continuation; render its
+			// `gentle-ai sync` command as the one actionable next step.
+			...(value.failureEnvelope.code === "managed_assets_outdated" && typeof value.failureEnvelope.continuation?.command === "string"
+				? { hint: `run ${value.failureEnvelope.continuation.command}` }
+				: {}),
 		};
 	}
 	// Every consent binding guard runs before the provider is launched, so this
@@ -3998,7 +5719,9 @@ async function reconcileNativeMutationFailure(
 	try {
 		const status = await nativeReviewCli.targetStatus(target);
 		syncRetainedNativeStatusSelections(retainedSelections, canonicalRetentionRoot, status, target.baseRef);
-		const { required_status_action: staleStatusDirective, ...reconciledBase } = failure;
+		const projectedStatus = mapNativeTargetStatus(operation, status, target.lineageId);
+		const { next_action: staleNextAction, required_status_action: staleStatusDirective, ...reconciledBase } = failure;
+		void staleNextAction;
 		void staleStatusDirective;
 		// Field defect (fambig, 2026-08-16): an envelope-less mutating failure
 		// is stamped mutationOutcome "unknown", but a reconciled authority
@@ -4012,6 +5735,8 @@ async function reconcileNativeMutationFailure(
 			void staleReplayability;
 			return {
 				...provenBase,
+				...projectedStatus,
+				status: "blocked",
 				outcome: "native-mutation-status-reconciled",
 				reconciliation: status.raw,
 				authority_applicability: status.applicability,
@@ -4019,17 +5744,19 @@ async function reconcileNativeMutationFailure(
 				mutation_performed: false,
 				mutation_outcome: "none",
 				mutation_outcome_reason: `authority revision unchanged across reconciliation (${preOperationRevision}); the failed operation provably did not mutate`,
-				next_action: status.action,
 			};
 		}
 		return {
 			...reconciledBase,
+			...projectedStatus,
+			status: "blocked",
 			outcome: "native-mutation-status-reconciled",
 			reconciliation: status.raw,
 			authority_applicability: status.applicability,
 			provider_action: status.action,
 			replayability: status.replayability,
-			next_action: status.action,
+			...(status.action === "start" && projectedStatus.next_action === undefined ? { next_action: "start" } : {}),
+			required_status_action: projectedStatus.required_status_action ?? requiredStatusActionText(target.lineageId),
 		};
 	} catch (statusError) {
 		return {
@@ -4131,6 +5858,41 @@ function readRetainedNativeUntrackedSelection(selections: Map<string, RetainedNa
 		};
 }
 
+// gentle-pi#706: inspect's untrackedScope round trip retains the resolved
+// selection under the pre-lineage empty-lineage key so the next plain START in
+// that worktree adopts it without re-deriving the selection.
+function nativePreLineageCandidateIdentity(
+	status: ReviewStatusV3,
+): { targetIdentity: string; candidateTree: string } | undefined {
+	const candidateTree = status.projection.currentCandidateTree;
+	return isCanonicalProcessString(status.targetIdentity) && isCanonicalProcessString(candidateTree)
+		? { targetIdentity: status.targetIdentity, candidateTree }
+		: undefined;
+}
+
+function readRetainedPreLineageNativeUntrackedSelection(
+	selections: Map<string, RetainedNativeStatusSelection>,
+	workspaceRoot: string,
+): RetainedPreLineageNativeUntrackedSelection | undefined {
+	const selection = selections.get(reviewLifecycleStorageKey(workspaceRoot, ""));
+	return selection !== undefined &&
+		!("baseRef" in selection) &&
+		typeof (selection as Partial<RetainedPreLineageNativeUntrackedSelection>).targetIdentity === "string" &&
+		typeof (selection as Partial<RetainedPreLineageNativeUntrackedSelection>).candidateTree === "string"
+		? selection as RetainedPreLineageNativeUntrackedSelection
+		: undefined;
+}
+
+function sameNativePreLineageCandidate(
+	selection: RetainedPreLineageNativeUntrackedSelection,
+	status: ReviewStatusV3,
+): boolean {
+	const identity = nativePreLineageCandidateIdentity(status);
+	return identity !== undefined &&
+		identity.targetIdentity === selection.targetIdentity &&
+		identity.candidateTree === selection.candidateTree;
+}
+
 function isRetainedNativeCaptureRoute(selection: RetainedNativeStatusSelection | undefined): selection is RetainedNativeCaptureRoute {
 	return selection !== undefined && "workspaceRoot" in selection;
 }
@@ -4201,6 +5963,16 @@ const REVIEW_HOST_RELAY_REFUSED_ACTION =
 	"gentle-ai refused this submission at admission and did not consume the lens slot; the reason is in failure.stderr. "
 	+ "Call fresh STATUS and run only the exact slot it reoffers so the reviewer produces a new result that satisfies that refusal; never resubmit the refused bytes.";
 
+// gentle-pi#638: the declaration recorded, so fresh STATUS stops the review with one withdraw binding per declared slot instead of reoffering the reviewer. The withdraw command is the only way back to the same slot; everything else needs a smaller candidate and a new review.
+const REVIEW_HOST_RELAY_UNACHIEVABLE_ACTION =
+	"A deterministic relay failure was declared unachievable for this bound slot, and fresh STATUS now stops this review instead of reoffering the reviewer. "
+	+ "If the failure was transient, run the withdraw command in unachievable_lens_slots with the same binding so the review re-offers this exact reviewer; otherwise reduce the candidate scope and start a new review.";
+
+// gentle-pi#638: the relay failure was deterministic but gentle-ai refused the declaration, so no slot state changed and the review still needs a provider-bound continuation.
+const REVIEW_HOST_RELAY_DECLARATION_FAILED_ACTION =
+	"The relay failure was deterministic for this slot, but gentle-ai refused the unachievable declaration, so no slot state changed. "
+	+ "Call fresh STATUS and follow only its declared action; never replay this capture from transcript inference.";
+
 function reviewHostRelayTimeoutNextAction(error: ReviewHostRelayError): string {
 	const measured = error.elapsedMs === null || error.timeoutMs === null
 		? ""
@@ -4290,11 +6062,13 @@ async function reconcileUnknownReviewCaptureFailure(
 	selections: Map<string, RetainedNativeStatusSelection>,
 	route: RetainedNativeCaptureRoute | undefined,
 	expectedReviewCaptureSuffix?: readonly string[],
+	agent?: "pi",
 ): Promise<Record<string, unknown>> {
 	const failure = error === undefined ? undefined : nativeOperationFailure("gentle_review_capture", error);
 	if (error !== undefined && !nativeMutationRequiresStatus(error)) return failure;
 	try {
-		const status = await reconcileUnknownReviewLastEventCapture(nativeReviewCli, cwd, binding, route);
+		const selector = agent === undefined ? route : { ...route, agent };
+		const status = await reconcileUnknownReviewLastEventCapture(nativeReviewCli, cwd, binding, selector);
 		syncRetainedNativeStatusSelections(selections, cwd, status, route?.baseRef);
 		if (expectedReviewCaptureSuffix !== undefined && !hasExactReviewCaptureSuffix(status, expectedReviewCaptureSuffix)) return captureGroupAuthorityDrift(status);
 		return {
@@ -4355,10 +6129,10 @@ async function executeReviewHostRelayCapture(
 			},
 		};
 	} catch (error) {
-		if (!(error instanceof ReviewHostRelayError)) return await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, binding, selections, route);
+		if (!(error instanceof ReviewHostRelayError)) return await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, binding, selections, route, undefined, REVIEW_HOST_AGENT);
 		if (error.mutationOutcome === "unknown") {
 			return {
-				...(await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, binding, selections, route)),
+				...(await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, binding, selections, route, undefined, REVIEW_HOST_AGENT)),
 				failure: reviewHostRelayFailureReport(error),
 				reason: error.message,
 			};
@@ -4384,6 +6158,101 @@ async function executeReviewHostRelayCapture(
 				mutation_outcome: "none",
 			};
 		}
+		// gentle-pi#638: the two deterministic relay failure classes end the slot, not the transport. Declaring the slot unachievable through the native verb records the provider-owned fact that this reviewer cannot complete under current conditions, then exactly one bound STATUS re-query renders the typed stop with its withdraw binding instead of reoffering the same slot. The declaration binding is re-derived from the slot's own provider-issued `--name=value` tokens, never from transcript state.
+		const unachievableReason = reviewHostRelayUnachievableReason(error);
+		const declarationBinding = unachievableSlotDeclarationBinding(slot);
+		if (unachievableReason !== undefined && declarationBinding !== undefined && nativeReviewCli.captureUnachievableLens !== undefined) {
+			let declared: NativeReviewUnachievableLensCaptureArtifact | undefined;
+			try {
+				declared = await nativeReviewCli.captureUnachievableLens({ cwd, ...declarationBinding, reason: unachievableReason, ...(reviewHostRelayUnachievableDetail(error) === undefined ? {} : { detail: reviewHostRelayUnachievableDetail(error)! }), ...(signal === undefined ? {} : { signal }) });
+			} catch (declarationError) {
+				// Fail open only on the unknown-verb capability refusal: an older binary without `capture-unachievable` keeps today's transport-failure behavior below. Every other declaration failure is surfaced, never hidden behind the relay failure it followed.
+				if (!isNativeReviewUnachievableVerbRefused(declarationError)) {
+					// gentle-pi#822 (outside-diff): the declaration failure's own envelope carries the mutation truth — the process may have recorded the declaration before failing — so the mutation fields are derived from it instead of hardcoded none, and an unknown outcome is proven or disproven by one bound STATUS re-query without ever changing the failure outcome.
+					const declarationFailureReport = nativeOperationFailure("gentle_review_capture", declarationError);
+					let declarationMutationPerformed = declarationFailureReport.mutation_performed === true;
+					let declarationMutationOutcome: "none" | "unknown" | "committed" = declarationFailureReport.mutation_outcome === "committed" ? "committed" : declarationFailureReport.mutation_outcome === "unknown" ? "unknown" : "none";
+					if (declarationMutationOutcome === "unknown") {
+						try {
+							const status = await reconcileUnknownReviewLastEventCapture(nativeReviewCli, cwd, binding, route === undefined ? { agent: REVIEW_HOST_AGENT } : { ...route, agent: REVIEW_HOST_AGENT });
+							syncRetainedNativeStatusSelections(selections, cwd, status, route?.baseRef);
+							const stop = status.nextTransition?.kind === "stop" && status.nextTransition.reasonCode === "unachievable_lens_slot" ? status.nextTransition : undefined;
+							const declaredSlot = stop?.unachievableLensSlots?.find((candidate) => candidate.lens === slot.lens && String(candidate.selectedOrder) === slot.order && candidate.subjectHash === declarationBinding.requestHash && candidate.withdraw.binding.targetIdentity === declarationBinding.targetIdentity && candidate.withdraw.binding.lineageId === declarationBinding.lineageId && candidate.withdraw.binding.revision === declarationBinding.expectedRevision);
+							if (stop !== undefined && declaredSlot !== undefined) {
+								declarationMutationPerformed = true;
+								declarationMutationOutcome = "committed";
+							}
+						} catch {
+							// Without proof the mutation stays unknown; the declaration failure is already the reported outcome.
+						}
+					}
+					return {
+						tool: "gentle_review_capture",
+						status: "blocked",
+						outcome: "unachievable-lens-declaration-failed",
+						reason: error.message,
+						failure: reviewHostRelayFailureReport(error),
+						declaration_failure: declarationFailureReport,
+						mutation_performed: declarationMutationPerformed,
+						mutation_outcome: declarationMutationOutcome,
+						next_action: REVIEW_HOST_RELAY_DECLARATION_FAILED_ACTION,
+					};
+					}
+			}
+			if (declared !== undefined) {
+				const declaration = { lens: declared.lens, selected_order: declared.selectedOrder, subject_hash: declarationBinding.requestHash, reason: declared.reason };
+				try {
+					const status = await reconcileUnknownReviewLastEventCapture(nativeReviewCli, cwd, binding, route === undefined ? { agent: REVIEW_HOST_AGENT } : { ...route, agent: REVIEW_HOST_AGENT });
+					syncRetainedNativeStatusSelections(selections, cwd, status, route?.baseRef);
+					const stop = status.nextTransition?.kind === "stop" && status.nextTransition.reasonCode === "unachievable_lens_slot" ? status.nextTransition : undefined;
+					// gentle-pi#822: the stop may also carry slots declared by other runs, so expose only the entry matching the identity this session just declared. A stop with slots but no matching entry is a reconciliation failure, never a success rendering someone else's withdraw command.
+					const declaredSlot = stop?.unachievableLensSlots?.find((slot) => slot.lens === declaration.lens && slot.selectedOrder === declaration.selected_order && slot.subjectHash === declaration.subject_hash && slot.withdraw.binding.targetIdentity === declarationBinding.targetIdentity && slot.withdraw.binding.lineageId === declarationBinding.lineageId && slot.withdraw.binding.revision === declarationBinding.expectedRevision);
+					// gentle-pi#822: success is proven, never assumed — a STATUS with no unachievable_lens_slot stop at all (no transition, a different reason code, or a collect reoffer) is a reconciliation failure exactly like a stop whose entries do not match the declared identity.
+					if (declaredSlot === undefined) {
+						return {
+							tool: "gentle_review_capture",
+							status: "blocked",
+							outcome: "unachievable-lens-declaration-reconciliation-failed",
+							reason: error.message,
+							failure: reviewHostRelayFailureReport(error),
+							declaration,
+							reconciliation_failure: { operation: "gentle_review_capture", status: "blocked", outcome: "unachievable-lens-slot-declaration-unmatched", reason: stop === undefined ? "the bound STATUS did not return the unachievable_lens_slot stop" : "no unachievable_lens_slots entry matches the declared slot identity", declared_slot: { lens: declaration.lens, selected_order: declaration.selected_order, subject_hash: declaration.subject_hash }, mutation_performed: true, mutation_outcome: "committed" },
+							mutation_performed: true,
+							mutation_outcome: "committed",
+							next_action: REVIEW_HOST_RELAY_DECLARATION_FAILED_ACTION,
+						};
+					}
+					return {
+						tool: "gentle_review_capture",
+						status: "blocked",
+						outcome: "unachievable-lens-slot-declared",
+						reason: error.message,
+						failure: reviewHostRelayFailureReport(error),
+						declaration,
+						provider_action: status.action,
+						...(status.nextTransition === undefined ? {} : { next_transition: status.nextTransition }),
+						unachievable_lens_slots: [{ lens: declaredSlot.lens, selected_order: declaredSlot.selectedOrder, subject_hash: declaredSlot.subjectHash, reason: declaredSlot.reason, ...(declaredSlot.detail === undefined ? {} : { detail: declaredSlot.detail }), withdraw: declaredSlot.withdraw.command }],
+						result: status.raw,
+						next_action: REVIEW_HOST_RELAY_UNACHIEVABLE_ACTION,
+						mutation_performed: true,
+						mutation_outcome: "committed",
+					};
+				} catch (statusError) {
+					return {
+						tool: "gentle_review_capture",
+						status: "blocked",
+						outcome: "unachievable-lens-declaration-reconciliation-failed",
+						reason: error.message,
+						failure: reviewHostRelayFailureReport(error),
+						declaration,
+						reconciliation_failure: nativeOperationFailure("gentle_review_capture", statusError),
+						mutation_performed: true,
+						mutation_outcome: "committed",
+						next_action: REVIEW_HOST_RELAY_DECLARATION_FAILED_ACTION,
+					};
+				}
+			}
+		}
 		return {
 			tool: "gentle_review_capture",
 			status: "blocked",
@@ -4404,6 +6273,21 @@ async function executeReviewHostRelayCapture(
 const REVIEW_PROVIDER_ROLE_RETRY_ACTION =
 	"Call fresh STATUS and execute only the exact one-slot role vector it reoffers; never relaunch from transcript inference.";
 
+// gentle-pi#638: re-derives the capture-unachievable declaration binding from one materialize slot's own provider-issued tokens. The provider renders those tokens as `--name=value` pairs (review-host-relay.ts renderToken), and Go verifies every value against the frozen authority before recording, so a missing required value or subject hash means the slot cannot be declared and the caller keeps its fall-back behavior.
+function unachievableSlotDeclarationBinding(slot: ReviewHostRelaySlot): { lineageId: string; targetIdentity: string; expectedRevision: string; requestHash: string; repositoryContext?: string } | undefined {
+	const tokenValue = (name: string): string | undefined => {
+		const prefix = `--${name}=`;
+		const token = slot.captureArgumentTokens.find((candidate) => candidate.startsWith(prefix));
+		return token === undefined ? undefined : token.slice(prefix.length);
+	};
+	const lineageId = tokenValue("lineage");
+	const targetIdentity = tokenValue("target");
+	const expectedRevision = tokenValue("expected-revision");
+	const repositoryContext = tokenValue("repository-context");
+	if (lineageId === undefined || targetIdentity === undefined || expectedRevision === undefined || slot.subjectHash === undefined) return undefined;
+	return { lineageId, targetIdentity, expectedRevision, requestHash: slot.subjectHash, ...(repositoryContext === undefined ? {} : { repositoryContext }) };
+}
+
 async function executeProviderRoleVectorCapture(
 	slot: ReviewProviderRoleVectorSlot,
 	nativeReviewCli: NativeReviewCli,
@@ -4573,9 +6457,9 @@ async function negotiatedStatusForHostTransport(
 // under the exact guards `agent_end` uses to decide whether to nudge: a
 // native review CLI with both `reviewMode` and `targetStatus`, a UI-bearing
 // context, and RDD effectively on. Returns `undefined` on any missing guard,
-// an effective-off mode, or any STATUS error or transport refusal, so both
-// `session_start` (recording a baseline) and `agent_end` (deciding whether to
-// nudge) resolve the same target identity through the same path.
+// an effective-off mode, or any STATUS error or transport refusal. Startup
+// negotiation and mutation-gated `agent_end` use the same native whole-target
+// path; neither derives candidate scope from local mutation receipts.
 async function resolveNegotiatedReviewStatusForSession(
 	nativeReviewCli: NativeReviewCli | null,
 	ctx: ExtensionContext,
@@ -4600,12 +6484,12 @@ async function resolveNegotiatedReviewStatusForSession(
 	}
 }
 
-// gentle-pi#556 / gentle-ai#4051: the exact once-per-candidate reminder sent
+// gentle-pi#556 / gentle-ai#4051: the mutation-gated reminder sent
 // through `agent_end`. It never runs START itself, so it names the one
 // supported continuation (gentle_review inspect) and defers the resulting
 // consent envelope to the human.
 function renderAgentEndReviewPreflightMessage(targetIdentity: string): string {
-	return `Receipt-driven development is enabled, and this worktree holds an unreviewed candidate (target ${targetIdentity}). By the review contract entry rule, run the review preflight before reporting completion.\n\nCall the gentle_review tool with {"operation":"inspect"} and follow the transition it returns; it currently offers review.start for this target. Relay the resulting gentle-ai.review-integration.consent/v3 envelope to the human losslessly, and never answer it on the human's behalf.\n\nThis extension never runs START itself. This reminder is sent once per candidate.`;
+	return `Receipt-driven development is enabled, and this worktree holds an unreviewed candidate (target ${targetIdentity}). First determine whether the user explicitly left this exact target unreviewed. If yes, do not invoke review; report that disposition and continue. Only otherwise, call the gentle_review tool with {"operation":"inspect"} and follow the transition it returns; it currently offers review.start for this target. An eligible interactive Pi host may resolve consent directly with its own three-action UI. If gentle_review instead returns an unresolved gentle-ai.review-integration.consent/v3 envelope, relay that original two-choice provider envelope to the human losslessly. Never answer consent from model prose or tool arguments.\n\nThis extension never runs START itself. This reminder consumes only this session's observed mutation generation.`;
 }
 
 function canonicalReviewCaptureBinding(value: unknown): string {
@@ -4631,8 +6515,18 @@ function exactCollectArgument(input: ReviewCollectInputV3, name: string): string
 	return matches.length === 1 ? matches[0]!.value : undefined;
 }
 
+// The intended-untracked collect input arrived with status/v6 and every later
+// status version keeps it; matching one exact version left every workspace
+// with untracked files unable to start a review once gentle-ai answered v7
+// (gentle-pi#610, gentle-ai#4187).
+const INTENDED_UNTRACKED_STATUS_SCHEMA = /^gentle-ai\.review-integration\.status\/v(\d+)$/;
+function statusCarriesIntendedUntrackedSelection(schema: unknown): boolean {
+	const match = typeof schema === "string" ? INTENDED_UNTRACKED_STATUS_SCHEMA.exec(schema) : null;
+	return match !== null && Number(match[1]) >= 6;
+}
+
 function reviewIntendedUntrackedInput(status: ReviewStatusV3): ReviewCollectInputV3 | undefined {
-	if (status.raw.schema !== "gentle-ai.review-integration.status/v6" || status.nextTransition?.kind !== "collect") return undefined;
+	if (!statusCarriesIntendedUntrackedSelection(status.raw.schema) || status.nextTransition?.kind !== "collect") return undefined;
 	const matches = (status.nextTransition.collect?.inputs ?? []).filter((input) => {
 		const value = input.submission?.values[0];
 		return input.name === "intended_untracked_selection" && input.schema === "gentle-ai.review-intended-untracked-selection/v1" && input.captureOperation === "external.select_intended_untracked" && input.submission?.operationToken === "status" && input.submission.values.length === 1 && value?.slot === "intended_untracked_selection" && value.domain === "schema_bound_json";
@@ -4640,6 +6534,13 @@ function reviewIntendedUntrackedInput(status: ReviewStatusV3): ReviewCollectInpu
 	return matches.length === 1 ? matches[0] : undefined;
 }
 
+// gentle-pi#706: the inspect stop on the intended-untracked selection carries no
+// continuation, so the blocked result names it exactly: the inventory digest
+// covers path names only, and the round trip resolves either through the select
+// operation or through inspect's own top-level untrackedScope.
+const INSPECT_UNTRACKED_SELECTION_NEXT_STEP =
+	'The intended-untracked selection is required before START. The expected_untracked_inventory digest covers untracked path names only (git ls-files --others --exclude-standard); nothing is read or hashed at inventory time, and file content is hashed only for selected paths at candidate freeze. Either call gentle_review with operation "select-intended-untracked" passing this selectionBinding and intendedUntracked ([] excludes every eligible path, a subset includes only those paths), or call inspect again with untrackedScope ("exclude", or "select" with intendedUntracked) to resolve the round trip in one call. To keep a path out of the inventory permanently, ignore it through .gitignore or .git/info/exclude.';
+
 interface PublicReviewCaptureBinding { collectBinding: string; }
 function publicReviewCaptureBindings(status: ReviewStatusV3): readonly PublicReviewCaptureBinding[] {
 	if (status.nextTransition?.kind !== "collect") return [];
@@ -5012,11 +6913,11 @@ async function executeReviewCaptureGroupOperation(
 			}
 		} catch (error) {
 			if (error instanceof ReviewHostRelayError && error.mutationOutcome !== "unknown") return reviewHostRelayGroupFailure(error, group.slots, prepared, index);
-			const reconciled = await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, current.binding, retainedUntrackedSelections, route);
+			const reconciled = await reconcileUnknownReviewCaptureFailure(error, nativeReviewCli, cwd, current.binding, retainedUntrackedSelections, route, undefined, REVIEW_HOST_AGENT);
 			return { ...reconciled, tool: "gentle_review_capture_group", ...reviewHostRelayGroupProgress(group.slots, prepared, index, true), ...(error instanceof ReviewHostRelayError ? { failure: reviewHostRelayFailureReport(error), reason: error.message } : {}) };
 		}
 	}
-	const reconciled = await reconcileUnknownReviewCaptureFailure(undefined, nativeReviewCli, cwd, group.binding, retainedUntrackedSelections, route, canonicalBindings.slice(prepared.length));
+	const reconciled = await reconcileUnknownReviewCaptureFailure(undefined, nativeReviewCli, cwd, group.binding, retainedUntrackedSelections, route, canonicalBindings.slice(prepared.length), REVIEW_HOST_AGENT);
 	return { ...reconciled, tool: "gentle_review_capture_group", outcome: reconciled.outcome === "capture-group-authority-drift" ? reconciled.outcome : reconciled.status === "reconciled" ? "native-reviewer-group-status-reconciled" : "native-reviewer-group-status-reconciliation-failed", ...reviewHostRelayGroupProgress(group.slots, prepared, prepared.length) };
 }
 
@@ -5057,7 +6958,6 @@ async function executeReviewControllerOperation(
 	retainedUntrackedSelections: Map<string, RetainedNativeStatusSelection> = new Map(),
 	pendingReviewConsentRegistry: PendingReviewConsentRegistry = processPendingReviewConsentRegistry,
 	pendingReviewConsentFallbackKey: symbol = Symbol("pending-review-consent-fallback"),
-	writeReviewConsentLatch: typeof recordReviewConsentLatch = recordReviewConsentLatch,
 	reviewConsentNow: () => number = Date.now,
 	reviewConsentScheduleTimer: (callback: () => void, delayMs: number) => { unref: () => void } = setTimeout,
 	intendedUntrackedSelection?: NativeIntendedUntrackedSelectionSubmission,
@@ -5065,7 +6965,7 @@ async function executeReviewControllerOperation(
 	const parameters = parseReviewControllerParameters(parametersValue);
 	const defaultCwd = resolveReviewControllerWorkspaceRoot(parameters.workspaceRoot, sessionCwd, candidateViews, parameters.lineageId);
 	const pendingReviewConsentSession = pendingReviewConsentSessionKey(context, pendingReviewConsentFallbackKey);
-	const useTargetLifecycleRoot = requiresExplicitTargetLifecycleRoot(parameters.workspaceRoot, sessionCwd, defaultCwd);
+	const _useTargetLifecycleRoot = requiresExplicitTargetLifecycleRoot(parameters.workspaceRoot, sessionCwd, defaultCwd);
 	const includeWorkspaceRoot = parameters.workspaceRoot !== undefined || defaultCwd !== sessionCwd;
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.EXPORT || parameters.operation === REVIEW_CONTROLLER_OPERATION.IMPORT) {
 		// Legacy bundle transport rode on the retired pre-integration graph/compact
@@ -5082,6 +6982,15 @@ async function executeReviewControllerOperation(
 			next_action: "Use the native `gentle-ai review` CLI (start/finalize/validate/status/recover) against the repository review authority; receipts and canonical artifacts live in the Git common-directory store at .git/gentle-ai/reviews and travel with the repository through normal Git replication.",
 		};
 	}
+	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.ASSESS) {
+		// Read-only native risk assessment (gentle-ai#4295, gentle-pi#662). Never
+		// mutates, never requires a lineageId, and never routes through
+		// authorizeDestructiveReviewOperation (it returns early for any
+		// operation that is neither RESET nor a maintenance operation).
+		const input = parseReviewAssessInput(parameters.operation, parameters.input);
+		const details = await resolveReviewAssessmentPlan(nativeReviewCli, defaultCwd, input, signal);
+		return { operation: parameters.operation, ...details, ...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}) };
+	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.REPAIR_LEGACY_ALIAS) {
 		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
 		return await executeNativeLegacyAliasRepair(input, defaultCwd, nativeReviewCli, signal, context);
@@ -5091,20 +7000,138 @@ async function executeReviewControllerOperation(
 		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);
 		return await executeNativeAuthorityMaintenance(parameters.operation, maintenance, input, defaultCwd, nativeReviewCli, signal);
 	}
-	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.INSPECT && nativeReviewCli !== null) {
+	if (
+		parameters.operation === REVIEW_CONTROLLER_OPERATION.INSPECT &&
+		nativeReviewCli !== null
+	) {
+		// A new inspect supersedes every pre-lineage selection before its first
+		// STATUS attempt. A failed or changed-candidate inspect cannot leave an
+		// older selection available for a later START.
+		clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, "");
 		try {
 			if (nativeReviewCli.targetStatus !== undefined) {
-				const negotiated = await negotiatedStatusForHostTransport(nativeReviewCli, {
-					cwd: defaultCwd,
-					...(signal === undefined ? {} : { signal }),
-				}, retainedUntrackedSelections, defaultCwd);
+				const negotiated = await negotiatedStatusForHostTransport(
+					nativeReviewCli,
+					{
+						cwd: defaultCwd,
+						...(signal === undefined ? {} : { signal }),
+					},
+					retainedUntrackedSelections,
+					defaultCwd,
+				);
 				if (negotiated.transport !== undefined) {
 					return {
 						...hostTransportUnavailable(parameters.operation, negotiated.transport),
 						...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}),
 					};
 				}
-				return { ...mapNativeTargetStatus(parameters.operation, negotiated.status!, undefined, defaultCwd), ...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}) };
+				const status = negotiated.status!;
+				const plainMapped = mapNativeTargetStatus(
+					parameters.operation,
+					status,
+					undefined,
+				);
+				if (parameters.untrackedScope === undefined) {
+					// gentle-pi#706: the stop alone never tells the caller what to do next.
+					return {
+						...plainMapped,
+						...("selectionBinding" in plainMapped
+							? { nextStep: INSPECT_UNTRACKED_SELECTION_NEXT_STEP }
+							: {}),
+						...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}),
+					};
+				}
+				const input = reviewIntendedUntrackedInput(status);
+				if (input === undefined)
+					return {
+						...plainMapped,
+						untracked_selection: "not-required",
+						...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}),
+					};
+				const eligibleJson = exactCollectArgument(input, "eligible_paths_json"),
+					inventory = exactCollectArgument(input, "expected_untracked_inventory");
+				let eligible: unknown;
+				try {
+					eligible = JSON.parse(eligibleJson ?? "");
+				} catch {
+					eligible = undefined;
+				}
+				const selected = validateNativeStartUntrackedSelection({
+					untrackedScope: parameters.untrackedScope,
+					expectedUntrackedInventory: inventory,
+					intendedUntracked: parameters.intendedUntracked,
+				});
+				if (
+					!Array.isArray(eligible) ||
+					selected.reason !== undefined ||
+					selected.intendedUntracked!.some((path) => !eligible.includes(path))
+				) {
+					return {
+						operation: parameters.operation,
+						status: "blocked",
+						outcome: "inspect-untracked-scope-invalid",
+						reason:
+							"The requested untrackedScope/intendedUntracked combination is invalid for the current intended-untracked stop: paths must be members of the eligible inventory, exclude selects none, and select selects at least one.",
+						mutation_performed: false,
+						mutation_outcome: "none",
+					};
+				}
+				const submission: NativeIntendedUntrackedSelectionSubmission = {
+					argumentTokens: input.submission!.argumentTokens,
+					value: JSON.stringify({
+						schema: "gentle-ai.review-intended-untracked-selection/v1",
+						untracked_scope: parameters.untrackedScope,
+						expected_untracked_inventory: inventory,
+						intended_untracked: selected.intendedUntracked,
+					}),
+				};
+				const resolved = await negotiatedStatusForHostTransport(
+					nativeReviewCli,
+					{
+						cwd: defaultCwd,
+						untrackedScope: parameters.untrackedScope,
+						expectedUntrackedInventory: inventory,
+						intendedUntracked: selected.intendedUntracked,
+						intendedUntrackedSelection: submission,
+						...(signal === undefined ? {} : { signal }),
+					},
+					retainedUntrackedSelections,
+					defaultCwd,
+				);
+				if (resolved.transport !== undefined) {
+					return {
+						...hostTransportUnavailable(parameters.operation, resolved.transport),
+						...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}),
+					};
+				}
+				const resolvedStatus = resolved.status!;
+				const candidateIdentity = nativePreLineageCandidateIdentity(resolvedStatus);
+				if (candidateIdentity !== undefined) {
+					retainNativeUntrackedSelection(
+						retainedUntrackedSelections,
+						defaultCwd,
+						"",
+						Object.freeze({
+							untrackedScope: parameters.untrackedScope,
+							expectedUntrackedInventory: inventory!,
+							intendedUntracked: Object.freeze([...selected.intendedUntracked!]),
+							submission,
+							...candidateIdentity,
+						}),
+					);
+				}
+				const resolvedMapped = mapNativeTargetStatus(
+					parameters.operation,
+					resolvedStatus,
+					undefined,
+				);
+				return {
+					...resolvedMapped,
+					...("selectionBinding" in resolvedMapped
+						? { nextStep: INSPECT_UNTRACKED_SELECTION_NEXT_STEP }
+						: {}),
+					...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}),
+				};
 			}
 			return nativeStatusUnsupported(parameters.operation);
 		} catch (error) {
@@ -5324,6 +7351,9 @@ async function executeReviewControllerOperation(
 			// The registry owns restoring writability of its 0555 views before
 			// removal; a terminal approved cleanup keeps the lineage projection.
 			candidateViews?.cleanupTerminal(parameters.lineageId, "approved", defaultCwd);
+			// gentle-pi#668: `closed` is never auto-derived or recorded here --
+			// a parent that wants the on-path passes nativeReviewOutcome:
+			// "closed" explicitly on its next assess call for this candidate.
 			return {
 				operation: parameters.operation,
 				status: "closed",
@@ -5347,13 +7377,18 @@ async function executeReviewControllerOperation(
 		if (Object.keys(input).some((key) => key !== "consentBinding" && key !== "answer") || Object.keys(input).length !== 2) throw new Error("Review controller answer-consent input must contain exactly consentBinding and answer");
 		if (typeof input.consentBinding !== "string" || input.consentBinding.length === 0) throw new Error("Review controller answer-consent requires an opaque consentBinding");
 		if (input.answer !== "granted" && input.answer !== "declined") throw new Error("Review controller answer-consent answer must be granted or declined");
-		const pending = pendingReviewConsentRegistry.get(pendingReviewConsentSession)?.get(input.consentBinding);
+		// gentle-pi#455: resolve the binding by its opaque id alone, so a
+		// binding one active Pi session's START created is answerable from any
+		// active session presenting it -- not only the session that created it.
+		const resolved = pendingReviewConsentRegistry.resolve(input.consentBinding);
+		const pending = resolved?.pending;
+		const owningSession = resolved?.sessionKey ?? pendingReviewConsentSession;
 		if (pending === undefined || pending.expiresAt <= reviewConsentNow()) {
 			const disposition = pending === undefined
-				? pendingReviewConsentRegistry.staleDisposition(pendingReviewConsentSession, input.consentBinding)
+				? pendingReviewConsentRegistry.staleDisposition(input.consentBinding)
 				: PENDING_REVIEW_CONSENT_DISPOSITION.EXPIRED;
 			const stale = staleConsentBindingDiagnostics(input.consentBinding, disposition);
-			if (pending !== undefined) expirePendingReviewConsent(pending, pendingReviewConsentRegistry, pendingReviewConsentSession);
+			if (pending !== undefined) expirePendingReviewConsent(pending, pendingReviewConsentRegistry, owningSession);
 			if (nativeReviewCli?.targetStatus === undefined) return nativeStatusUnsupported(parameters.operation);
 			try {
 				const negotiated = await negotiatedStatusForHostTransport(nativeReviewCli, {
@@ -5366,14 +7401,15 @@ async function executeReviewControllerOperation(
 				return nativeStatusFailed(parameters.operation, error);
 			}
 		}
-		if (realpathSync(defaultCwd) !== pending.repositoryCwd) throw new Error("Review controller consent repository binding changed");
+		const answeringRepositoryCwd = realpathSync(defaultCwd);
+		if (answeringRepositoryCwd !== pending.repositoryCwd) return consentBindingRepositoryMismatchOutcome(parameters.operation, input.consentBinding, pending.repositoryCwd, answeringRepositoryCwd);
 		if (reviewConsentDigest(pending.consent) !== pending.consentDigest) throw new Error("Review controller consent envelope binding changed");
 		pending.verifyCandidate();
 		if (nativeReviewCli?.answerConsent === undefined) throw new Error("Native review consent follow-up is unavailable");
-		if (!consumePendingReviewConsent(pending, pendingReviewConsentRegistry, pendingReviewConsentSession)) {
+		if (!consumePendingReviewConsent(pending, pendingReviewConsentRegistry, owningSession)) {
 			const stale = staleConsentBindingDiagnostics(
 				input.consentBinding,
-				pendingReviewConsentRegistry.staleDisposition(pendingReviewConsentSession, input.consentBinding),
+				pendingReviewConsentRegistry.staleDisposition(input.consentBinding),
 			);
 			if (nativeReviewCli.targetStatus === undefined) return nativeStatusUnsupported(parameters.operation);
 			try {
@@ -5390,11 +7426,14 @@ async function executeReviewControllerOperation(
 		try {
 			const gated = await resolveReviewModeGate(nativeReviewCli, parameters.operation, defaultCwd, signal);
 			if (gated !== undefined) {
-				cleanupPendingReviewConsent(pending, pendingReviewConsentRegistry, pendingReviewConsentSession);
+				// gentle-pi#668: mode disabled for this exact candidate -- keyed by
+				// its targetIdentity, never by repository alone.
+				recordNativeReviewOutcome(pending.authorityCwd, pending.consent.targetIdentity, NATIVE_REVIEW_OUTCOME.UNAVAILABLE);
+				cleanupPendingReviewConsent(pending, pendingReviewConsentRegistry, owningSession);
 				return gated;
 			}
 		} catch (error) {
-			cleanupPendingReviewConsent(pending, pendingReviewConsentRegistry, pendingReviewConsentSession);
+			cleanupPendingReviewConsent(pending, pendingReviewConsentRegistry, owningSession);
 			return nativeOperationFailure(parameters.operation, error);
 		}
 		// The one-shot binding is consumed before the first answer-path await. Any
@@ -5408,6 +7447,9 @@ async function executeReviewControllerOperation(
 				...(signal === undefined ? {} : { signal }),
 			});
 			if (answered.kind === "declined") {
+				// gentle-pi#668: candidate-scoped decline, keyed by this exact
+				// candidate's targetIdentity, never by repository alone.
+				recordNativeReviewOutcome(pending.authorityCwd, pending.consent.targetIdentity, NATIVE_REVIEW_OUTCOME.DECLINED);
 				pending.cleanupCandidate();
 				return {
 					operation: parameters.operation,
@@ -5418,6 +7460,9 @@ async function executeReviewControllerOperation(
 				};
 			}
 			retainNativeUntrackedSelection(retainedUntrackedSelections, pending.authorityCwd, answered.start.lineageId, pending.untrackedSelection);
+			// gentle-pi#706: a START completed through answer-consent consumed the
+			// adopted pre-lineage selection too; clear it like the direct path.
+			clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, pending.authorityCwd, "");
 			completed = completeNativeStart(parameters.operation, answered.start, pending.repositoryCwd, pending.candidateView, pending.candidateViews);
 		} catch (error) {
 			const value = error as { mutationOutcome?: unknown };
@@ -5428,15 +7473,6 @@ async function executeReviewControllerOperation(
 				projection: "workspace",
 			}, retainedUntrackedSelections);
 		}
-		if (input.answer === "granted") {
-			try {
-				writeReviewConsentLatch(pending.repositoryCwd);
-			} catch (error) {
-				try {
-					context?.ui.notify(`Native review start completed, but Pi could not record the local consent latch: ${error instanceof Error ? error.message : String(error)}`, "warning");
-				} catch { /* Reporting is best effort; native completion remains authoritative. */ }
-			}
-		}
 		return completed;
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.SELECT_INTENDED_UNTRACKED) {
@@ -5456,7 +7492,7 @@ async function executeReviewControllerOperation(
 		const rejected = input === undefined || canonicalReviewCaptureBinding(input) !== canonicalBinding || exactCollectArgument(input, "target_identity") !== status.targetIdentity || exactCollectArgument(input, "projection") !== status.projection.projection || exactCollectArgument(input, "base_tree") !== status.projection.baseTree || exactCollectArgument(input, "candidate_tree") !== status.projection.currentCandidateTree || !Array.isArray(eligible) || selected.reason !== undefined || selected.intendedUntracked!.some((path) => !eligible.includes(path));
 		if (rejected) return { operation: parameters.operation, status: "blocked", outcome: "intended-untracked-selection-binding-rejected", mutation_performed: false, mutation_outcome: "none" };
 		const submission = { argumentTokens: input.submission!.argumentTokens, value: JSON.stringify({ schema: "gentle-ai.review-intended-untracked-selection/v1", untracked_scope: scope, expected_untracked_inventory: inventory, intended_untracked: selected.intendedUntracked }) };
-		const result = await executeReviewControllerOperation({ operation: REVIEW_CONTROLLER_OPERATION.START, ...(parameters.workspaceRoot === undefined ? {} : { workspaceRoot: parameters.workspaceRoot }), input: JSON.stringify({ mode: REVIEW_MODE.ORDINARY, untrackedScope: scope, expectedUntrackedInventory: inventory, intendedUntracked: selected.intendedUntracked }) }, sessionCwd, nativeReviewCli, signal, candidateViews, context, retainedUntrackedSelections, pendingReviewConsentRegistry, pendingReviewConsentFallbackKey, writeReviewConsentLatch, reviewConsentNow, reviewConsentScheduleTimer, submission);
+		const result = await executeReviewControllerOperation({ operation: REVIEW_CONTROLLER_OPERATION.START, ...(parameters.workspaceRoot === undefined ? {} : { workspaceRoot: parameters.workspaceRoot }), input: JSON.stringify({ mode: REVIEW_MODE.ORDINARY, untrackedScope: scope, expectedUntrackedInventory: inventory, intendedUntracked: selected.intendedUntracked }) }, sessionCwd, nativeReviewCli, signal, candidateViews, context, retainedUntrackedSelections, pendingReviewConsentRegistry, pendingReviewConsentFallbackKey, reviewConsentNow, reviewConsentScheduleTimer, submission);
 		return { ...result, operation: parameters.operation };
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.START) {
@@ -5478,9 +7514,35 @@ async function executeReviewControllerOperation(
 			if (baseRef !== undefined && !isCanonicalProcessString(baseRef)) return nativeStartRejection("base-ref-invalid");
 			if (baseRef !== undefined && rawStart.committedOnly !== true) return nativeStartRejection("committed-only-required");
 			if (baseRef === undefined && "committedOnly" in rawStart) return nativeStartRejection("committed-only-invalid");
-			const untrackedSelection = validateNativeStartUntrackedSelection(rawStart);
-			if (untrackedSelection.reason !== undefined) return nativeStartRejection(untrackedSelection.reason);
-			const retainedUntrackedSelection = cloneRetainedNativeUntrackedSelection(untrackedSelection);
+			const explicitUntrackedSelection =
+				validateNativeStartUntrackedSelection(rawStart);
+			if (explicitUntrackedSelection.reason !== undefined)
+				return nativeStartRejection(explicitUntrackedSelection.reason);
+			// gentle-pi#706: a plain START adopts the selection an inspect
+			// untrackedScope round trip retained pre-lineage; explicit input or a
+			// carried submission always wins over the retained entry.
+			const retainedPreLineageSelection =
+				explicitUntrackedSelection.untrackedScope === undefined &&
+				intendedUntrackedSelection === undefined
+					? readRetainedPreLineageNativeUntrackedSelection(
+							retainedUntrackedSelections,
+							defaultCwd,
+						)
+					: undefined;
+			const untrackedSelection: NativeStartUntrackedSelection =
+				retainedPreLineageSelection === undefined
+					? explicitUntrackedSelection
+					: {
+							untrackedScope: retainedPreLineageSelection.untrackedScope,
+							expectedUntrackedInventory:
+								retainedPreLineageSelection.expectedUntrackedInventory,
+							intendedUntracked: [...retainedPreLineageSelection.intendedUntracked],
+						};
+			const untrackedSubmission =
+				intendedUntrackedSelection ?? retainedPreLineageSelection?.submission;
+			const retainedUntrackedSelection =
+				retainedPreLineageSelection ??
+				cloneRetainedNativeUntrackedSelection(explicitUntrackedSelection);
 			let canonicalBaseRef: string | undefined;
 			if (baseRef !== undefined) {
 				try {
@@ -5505,16 +7567,64 @@ async function executeReviewControllerOperation(
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 					...(canonicalBaseRef === undefined ? {} : { baseRef: canonicalBaseRef, committedOnly: true }),
 					...(untrackedSelection.untrackedScope === undefined ? {} : untrackedSelection),
-					...(intendedUntrackedSelection === undefined ? {} : { intendedUntrackedSelection }),
+					...(untrackedSubmission === undefined ? {} : { intendedUntrackedSelection: untrackedSubmission }),
 					...(signal === undefined ? {} : { signal }),
 				}, retainedUntrackedSelections, defaultCwd);
 				if (negotiated.transport !== undefined) return hostTransportUnavailable(parameters.operation, negotiated.transport);
 				target = negotiated.status!;
+				// gentle-pi#874: the STATUS this START already fetched can itself
+				// offer the committed-range START for an empty workspace candidate.
+				// Adopt its own base commit *here*, before the candidate view and the
+				// native START are resolved, and re-derive the target for that range,
+				// so all three agree on one base-diff identity. Adopting the offer
+				// later left the workspace target and the base-diff candidate view
+				// disagreeing, and START failed with identity-mismatch. Both an
+				// explicit caller baseRef and any START with an untracked selection in
+				// play keep today's single-STATUS flow; only an adopted offer pays the
+				// second read-only STATUS.
+				if (canonicalBaseRef === undefined && untrackedSelection.untrackedScope === undefined && untrackedSubmission === undefined) {
+					const offeredBaseRef = offeredCommittedRangeBaseRef(target);
+					if (offeredBaseRef !== undefined) {
+						const renegotiated = await negotiatedStatusForHostTransport(nativeReviewCli, {
+							cwd: defaultCwd,
+							...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
+							baseRef: offeredBaseRef,
+							committedOnly: true,
+							...(signal === undefined ? {} : { signal }),
+						}, retainedUntrackedSelections, defaultCwd);
+						if (renegotiated.transport !== undefined) return hostTransportUnavailable(parameters.operation, renegotiated.transport);
+						canonicalBaseRef = offeredBaseRef;
+						target = renegotiated.status!;
+					}
+				}
+				if (
+					retainedPreLineageSelection !== undefined &&
+					!sameNativePreLineageCandidate(retainedPreLineageSelection, target)
+				) {
+					clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, "");
+					return {
+						operation: parameters.operation,
+						status: "blocked",
+						outcome: "native-start-retained-selection-candidate-mismatch",
+						mutation_performed: false,
+						mutation_outcome: "none",
+						next_action: "inspect-and-resolve-the-current-intended-untracked-selection",
+					};
+				}
 				if (target.nextTransition?.kind === "collect" || target.applicability !== "unrelated" || target.action !== "start") return mapNativeTargetStatus(parameters.operation, target, parameters.lineageId);
 			} catch (error) {
 				return nativeOperationFailure(parameters.operation, error);
 			}
-			const replayKey = JSON.stringify({ cwd: defaultCwd, lineageId: parameters.lineageId ?? null, input: parameters.input ?? null, inputPath: parameters.inputPath ?? null });
+			// gentle-pi#323: the replay key must fold in the current candidate
+			// content identity. Without it, a second START with identical
+			// {cwd, lineageId, input, inputPath} reuses a still-live (never
+			// lineage-bound) frozen candidate view from within the consent TTL
+			// window even after the live candidate content changed underneath
+			// it, and dead-ends at candidate-target-projection-drift with no
+			// recovery. Folding in currentCandidateTree makes a content change
+			// mint a fresh replay key -- and therefore a fresh candidate view --
+			// instead of reusing the stale one.
+			const replayKey = JSON.stringify({ cwd: defaultCwd, lineageId: parameters.lineageId ?? null, input: parameters.input ?? null, inputPath: parameters.inputPath ?? null, candidateTree: target.projection.currentCandidateTree });
 			// Synchronously drop any binding whose TTL has already elapsed
 			// before reusing its retained candidate view, so a fresh-candidate
 			// retry cannot reuse a view tied to an expired binding and trip
@@ -5543,7 +7653,7 @@ async function executeReviewControllerOperation(
 						targetIdentity: target.targetIdentity,
 						projection: target.projection.projection,
 						...(untrackedSelection.untrackedScope === undefined ? {} : untrackedSelection),
-						...(intendedUntrackedSelection === undefined ? {} : { intendedUntrackedSelection }),
+						...(untrackedSubmission === undefined ? {} : { intendedUntrackedSelection: untrackedSubmission }),
 						...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 						...(policy.policyPath === undefined ? {} : { policyPath: policy.policyPath }),
 						...(focus === undefined ? {} : { focus }),
@@ -5577,14 +7687,14 @@ async function executeReviewControllerOperation(
 							cleanupCandidate: () => {
 								if (candidateCleaned) return;
 								candidateCleaned = true;
-								consentCandidateView.cleanup();
+								try { consentCandidateView.cleanup(); } catch { /* Failed ownership proof preserves the view; consent expiry/teardown still completes. */ }
 							},
 							...(retainedUntrackedSelection === undefined ? {} : { untrackedSelection: retainedUntrackedSelection }),
 							consent: error.consent,
 							consentDigest,
 							expiresAt: reviewConsentNow() + PENDING_REVIEW_CONSENT_TTL_MS,
 						};
-						pendingReviewConsentRegistry.ensure(pendingReviewConsentSession).set(id, pending);
+						pendingReviewConsentRegistry.add(pendingReviewConsentSession, pending);
 						pending.expiry = reviewConsentScheduleTimer(
 							() => expirePendingReviewConsent(pending, pendingReviewConsentRegistry, pendingReviewConsentSession),
 							PENDING_REVIEW_CONSENT_TTL_MS,
@@ -5601,22 +7711,30 @@ async function executeReviewControllerOperation(
 					};
 				}
 				retainNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, result.lineageId, retainedUntrackedSelection);
+				// gentle-pi#706: the adopted pre-lineage selection dies with the START
+				// that consumed it; it must never leak to the next candidate.
+				clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, "");
 				return completeNativeStart(parameters.operation, result, defaultCwd, candidateView, candidateViews);
 			} catch (error) {
-				if (error instanceof CandidateViewError && error.diagnostics !== undefined) return nativeOperationFailure(parameters.operation, Object.assign(error, { candidateViewPreNative: true }));
+				if (!nativeStartAttempted && error instanceof CandidateViewError && error.diagnostics !== undefined) return nativeOperationFailure(parameters.operation, Object.assign(error, { candidateViewPreNative: true }));
 				if (error instanceof CandidateViewError && (error.reason === "base-ref-ambiguous" || error.reason === "base-ref-unresolvable" || error.reason === "base-ref-moved")) return nativeStartRejection(error.reason);
 				const value = error as { mutationOutcome?: unknown; nextAction?: unknown };
 				const provenNoMutation = value.mutationOutcome === "none";
-				const preNativeCandidateFailure = !nativeStartAttempted && error instanceof CandidateViewError;
-				if (candidateView && candidateViews && (provenNoMutation || preNativeCandidateFailure)) candidateViews.cleanup(candidateView.token);
+				const preNativeFailure = !nativeStartAttempted;
+				if (candidateView && candidateViews && (provenNoMutation || preNativeFailure)) candidateViews.cleanup(candidateView.token);
+				const nativeCliError = asNativeReviewCliError(error);
 				const failure = provenNoMutation
 					? error
-					: preNativeCandidateFailure
-						? Object.assign(error, { candidateViewPreNative: true })
-						: Object.assign(error instanceof Error ? error : new Error(String(error)), {
-							mutationOutcome: "unknown",
-							nextAction: "review.status",
-						});
+					: preNativeFailure
+						? error instanceof CandidateViewError ? Object.assign(error, { candidateViewPreNative: true }) : error
+						: Object.assign(
+							error instanceof Error
+								? error
+								: nativeCliError === undefined
+									? new Error(String(error))
+									: { name: "NativeReviewCliError", code: nativeCliError.code, diagnostics: nativeCliError.diagnostics },
+							{ mutationOutcome: "unknown", nextAction: "review.status" },
+						);
 				return reconcileNativeMutationFailure(parameters.operation, failure, nativeReviewCli, {
 					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
@@ -5725,12 +7843,16 @@ async function executeReviewControllerOperation(
 		const effectiveUntrackedSelection = rawStatus === undefined && parameters.lineageId !== undefined
 			? readRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, parameters.lineageId)
 			: untrackedSelection;
+		const retainedCommittedTarget = rawStatus === undefined && parameters.lineageId !== undefined && candidateViews?.hasProjection(parameters.lineageId, defaultCwd)
+			? candidateViews.resolveProjection(parameters.lineageId, defaultCwd)
+			: undefined;
+		const effectiveBaseRef = baseRef ?? (retainedCommittedTarget?.committedOnly === true ? retainedCommittedTarget.baseCommit : undefined);
 		if (nativeReviewCli?.targetStatus !== undefined) {
 			try {
 				const negotiated = await negotiatedStatusForHostTransport(nativeReviewCli, {
 					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
-					...(baseRef === undefined ? {} : { baseRef, committedOnly: true }),
+					...(effectiveBaseRef === undefined ? {} : { baseRef: effectiveBaseRef, committedOnly: true }),
 					...(effectiveUntrackedSelection.untrackedScope === undefined ? {} : effectiveUntrackedSelection),
 					...(signal === undefined ? {} : { signal }),
 				}, retainedUntrackedSelections, defaultCwd);
@@ -5749,7 +7871,7 @@ async function executeReviewControllerOperation(
 				) retainNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, parameters.lineageId, retainedUntrackedSelection);
 				clearRetainedNativeStatusSelectionsOnTerminal(retainedUntrackedSelections, defaultCwd, status.authority?.lineageId, status.authority?.state);
 				hydrateDispatchBindingFromStatus(candidateViews, defaultCwd, status);
-				return { ...mapNativeTargetStatus(parameters.operation, status, parameters.lineageId, defaultCwd), ...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}) };
+				return { ...mapNativeTargetStatus(parameters.operation, status, parameters.lineageId), ...(includeWorkspaceRoot ? { workspace_root: defaultCwd } : {}) };
 			} catch (error) {
 				return nativeOperationFailure(parameters.operation, error);
 			}
@@ -5767,6 +7889,9 @@ export const __testing = {
 	listDiscoverableAgents,
 	orderDiscoverableAgents,
 	classifyGuardedCommand,
+	evaluateGuardedCommand,
+	guardedCommandPreview,
+	guardedCommandTitle,
 	loadRuntimeGuardrailsConfig,
 	buildGentlePrompt,
 	nativeStatusUnsupported,
@@ -5789,8 +7914,22 @@ export const __testing = {
 	resolveBackgroundSubagentsCapability,
 	readActiveToolNames,
 	renderBackgroundSubagentsStatusLine,
+	renderRddStatusLine,
+	isValidRddModeStatus,
+	resolveRddModeStatus,
+	resolveRddStatusLine,
+	RDD_STATUS_TIMEOUT_MS,
+	RDD_STATUS_MEMO_TTL_MS,
+	clearRddStatusMemoForTesting,
+	readNativeReviewOutcome,
+	recordNativeReviewOutcome,
+	clearNativeReviewOutcomeMemoForTesting,
 	resolveControllerSddStatus,
 	resolveStartupControllerSddStatus,
+	resolveSddChangeStartup,
+	resolveSelectedNativeSddChangeStartup,
+	readSddChangeFlag,
+	resetTelemetryTriggerGuardForTesting,
 	createGentleAiExtension: createGentleAiExtensionForTesting,
 };
 
@@ -5824,6 +7963,22 @@ export interface GentleAiRuntimeDependencies {
 	// sleep and without relying on the queued cleanup macrotask firing.
 	now?: () => number;
 	scheduleTimer?: (callback: () => void, delayMs: number) => { unref: () => void };
+	// The environment the session's child processes inherit; tests inject a
+	// plain object so the handshake declaration is observable without
+	// touching the test runner's own process.env.
+	processEnv?: NodeJS.ProcessEnv;
+	// Package-owned children use this parent-bound channel only to ask whether
+	// their own pending ordinary START may replay a grant locally.
+	childStandingReviewPermissionClient?: Pick<ChildStandingReviewPermissionClient, "requestAuthorization" | "close">;
+	// gentle-pi#677: test-only seams for the telemetry trigger. Production
+	// leaves both undefined: the real package-local resolveGentleAiBinary()
+	// and the real detached child_process spawn run.
+	resolveTelemetryTriggerBinary?: () => string;
+	telemetryTriggerSpawn?: TelemetryTriggerSpawn;
+	// Test-only seam for the foreground `/gentle:telemetry` slash command's
+	// bounded exec; production leaves this undefined and uses the real node
+	// exec-file adapter shared with the rest of the extension.
+	telemetryExecFileAdapter?: ExecFileAdapter;
 }
 
 export function createGentleAiExtension(dependencies: GentleAiRuntimeDependencies = {}): (pi: ExtensionAPI) => void {
@@ -5832,28 +7987,79 @@ export function createGentleAiExtension(dependencies: GentleAiRuntimeDependencie
 
 function createGentleAiExtensionForTesting(
 	dependencies: GentleAiRuntimeDependencies = {},
-	writeReviewConsentLatch: typeof recordReviewConsentLatch = recordReviewConsentLatch,
 ): (pi: ExtensionAPI) => void {
 	const nativeReviewCli = dependencies.nativeReviewCli === undefined ? createNativeReviewCli() : dependencies.nativeReviewCli;
+	const childStandingReviewPermissionLease = dependencies.childStandingReviewPermissionClient === undefined
+		? acquireChildStandingReviewPermissionClient(dependencies.processEnv ?? process.env)
+		: undefined;
+	const childStandingReviewPermission = dependencies.childStandingReviewPermissionClient ?? childStandingReviewPermissionLease?.client;
 	const reviewConsentNow = dependencies.now ?? (() => Date.now());
 	const reviewConsentScheduleTimer = dependencies.scheduleTimer ?? ((callback, delayMs) => setTimeout(callback, delayMs));
 	const pendingReviewConsentRegistry = dependencies.pendingReviewConsentRegistry ?? processPendingReviewConsentRegistry;
+	const resolveTelemetryTriggerBinary = dependencies.resolveTelemetryTriggerBinary ?? resolveGentleAiBinary;
+	const telemetryExecFileAdapter = dependencies.telemetryExecFileAdapter ?? createNodeExecFileAdapter();
 	return function gentleAi(pi: ExtensionAPI): void {
+		const flags = pi as unknown as { registerFlag?: (name: string, definition: { description: string; type: "string"; default?: string }) => void };
+		flags.registerFlag?.(SDD_CHANGE_FLAG, {
+			description: "Internal launch-local selected SDD change identity for package-owned child agents.",
+			type: "string",
+		});
+	declareReviewRelayHandshake(dependencies.processEnv ?? process.env);
 	const pendingReviewConsentFallbackKey = Symbol("pending-review-consent-fallback");
 	const candidateViews = dependencies.candidateViews === undefined ? new CandidateViewRegistry() : dependencies.candidateViews;
 	const herdrLifecycle = createHerdrConfirmationLifecycle(pi.events);
+	const permissionEnvironment = dependencies.processEnv ?? process.env;
+
+	const setReviewSessionPermissionStatus = (context: ExtensionContext, active: boolean): void => {
+		try {
+			(context.ui as unknown as { setStatus?: (key: string, text?: string) => void }).setStatus?.(
+				REVIEW_SESSION_PERMISSION_STATUS_KEY,
+				active ? REVIEW_SESSION_PERMISSION_STATUS_TEXT : undefined,
+			);
+		} catch { /* Status is nonblocking and never permission authority. */ }
+	};
+	const capturePermissionIdentity = (context: ExtensionContext, cwd: string = context.cwd): Promise<ReviewSessionIdentity | undefined> =>
+		captureReviewSessionIdentity({ ...context, cwd }, permissionEnvironment);
+	const refreshReviewSessionPermissionStatus = async (context: ExtensionContext): Promise<ReviewSessionIdentity | undefined> => {
+		const identity = await capturePermissionIdentity(context);
+		setReviewSessionPermissionStatus(context, identity !== undefined && hasReviewSessionPermission(identity));
+		return identity;
+	};
+	const revokeCurrentReviewSessionPermission = (context: ExtensionContext): boolean => {
+		const coordinates = reviewSessionManagerAndId(context);
+		const revoked = coordinates === undefined ? false : revokeReviewSessionPermissionsForSession(coordinates.manager, coordinates.sessionId);
+		setReviewSessionPermissionStatus(context, false);
+		return revoked;
+	};
+	const revokeCurrentRepositoryReviewSessionPermission = async (context: ExtensionContext): Promise<boolean> => {
+		const identity = await capturePermissionIdentity(context);
+		const revoked = identity === undefined ? false : revokeReviewSessionPermission(identity);
+		setReviewSessionPermissionStatus(context, false);
+		return revoked;
+	};
 
-	pi.on("session_shutdown", (_event, context) => {
+	let reminderSessionActive = true;
+	let reminderEpoch = 0;
+	pi.on("session_shutdown", (event, context) => {
+		reminderSessionActive = false;
+		reminderEpoch += 1;
+		// Pi tears down this registry on reload as well as session replacement/quit.
+		try { candidateViews?.cleanupAll(); } catch { /* Preserve failed owned views for later recovery. */ }
+		const reason = (event as { reason?: unknown }).reason;
+		if (reason !== "reload") {
+			if (childStandingReviewPermissionLease !== undefined) childStandingReviewPermissionLease.closeIfCurrent();
+			else childStandingReviewPermission?.close();
+			revokeCurrentReviewSessionPermission(context);
+		}
 		const sessionKey = pendingReviewConsentSessionKey(context, pendingReviewConsentFallbackKey);
 		cleanupAllPendingReviewConsents(pendingReviewConsentRegistry, sessionKey);
 		processRetainedNativeStatusSelections.delete(sessionKey);
 		processAgentEndSubagentDepth.delete(sessionKey);
-		processAgentEndPreflightNudgedTargets.delete(sessionKey);
-		processAgentEndSessionBaseline.delete(sessionKey);
 	});
 
 	pi.registerTool({
 		name: "gentle_review_scope",
+		renderShell: "self",
 		label: "Gentle Review Scope",
 		description: "Read one bounded, integrity-checked page of the controller-owned frozen changed scope. This read-only tool never inspects the ambient or candidate tree.",
 		parameters: REVIEW_SCOPE_PARAMETERS,
@@ -5865,8 +8071,8 @@ function createGentleAiExtensionForTesting(
 				context as GentleAiRenderContext | undefined,
 			);
 		},
-		renderResult(result, options) {
-			return renderGentleAiResult(result, options);
+		renderResult(result, options, theme, context) {
+			return renderGentleAiResult(result, options, theme, context as GentleAiRenderContext | undefined);
 		},
 		async execute(_toolCallId, parameters) {
 			const input = parameters as ReviewScopeParameters;
@@ -5875,8 +8081,28 @@ function createGentleAiExtensionForTesting(
 		},
 	});
 
+	// The lens a reviewer capture runs is inside its collect binding, so the
+	// card can say "review capture · risk" instead of a bare operation name.
+	const lensLabel = (lens: unknown): string | undefined =>
+		typeof lens === "string" && lens.length > 0 ? lens.replace(/^review-/, "") : undefined;
+	const collectBindingLens = (binding: unknown): string | undefined => {
+		if (typeof binding !== "string") return undefined;
+		try {
+			const parsed = JSON.parse(binding) as Record<string, unknown>;
+			const subject = (parsed.artifactSubject ?? parsed.artifact_subject) as Record<string, unknown> | undefined;
+			return lensLabel(subject?.lens);
+		} catch {
+			return undefined;
+		}
+	};
+	const withLenses = (operation: string, lenses: readonly (string | undefined)[]): string => {
+		const named = lenses.filter((lens): lens is string => lens !== undefined);
+		return named.length === 0 ? operation : `${operation} · ${named.join(" · ")}`;
+	};
+
 	pi.registerTool({
 		name: "gentle_review_capture_group",
+		renderShell: "self",
 		label: "Gentle Review Capture Group",
 		description: "Capture one complete provider-issued materialize reviewer group. It validates the exact ordered current collect set, forecasts its bounded model cost, runs reviewers concurrently, and admits outputs one at a time in provider order.",
 		promptSnippet: "Use one complete exact current STATUS materialize reviewer group; acknowledge its forecast before the grouped run.",
@@ -5886,11 +8112,13 @@ function createGentleAiExtensionForTesting(
 		],
 		parameters: REVIEW_CAPTURE_GROUP_PARAMETERS,
 		executionMode: "sequential",
-		renderCall(_args, theme, context) {
-			return renderGentleAiLifecycleCall("review capture group", theme, context as GentleAiRenderContext | undefined);
+		renderCall(args, theme, context) {
+			const bindings = (args as { collectBindings?: unknown }).collectBindings;
+			const lenses = Array.isArray(bindings) ? bindings.map(collectBindingLens) : [];
+			return renderGentleAiLifecycleCall(withLenses("review capture group", lenses), theme, context as GentleAiRenderContext | undefined);
 		},
-		renderResult(result, options) {
-			return renderGentleAiResult(result, options);
+		renderResult(result, options, theme, context) {
+			return renderGentleAiResult(result, options, theme, context as GentleAiRenderContext | undefined);
 		},
 		async execute(_toolCallId, parameters, signal, _onUpdate, ctx) {
 			if (signal?.aborted) throw new Error("Review capture group was cancelled");
@@ -5909,6 +8137,7 @@ function createGentleAiExtensionForTesting(
 
 	pi.registerTool({
 		name: "gentle_review_capture",
+		renderShell: "self",
 		label: "Gentle Review Capture",
 		description: "Capture exactly one provider-issued ordinary native review collect slot. This is not a controller operation: it validates one opaque collect binding against current target-scoped STATUS, executes at most one capture, and never follows a transition.",
 		promptSnippet: "Use one exact current STATUS collectBinding for one ordinary native capture; call fresh STATUS before every additional capture.",
@@ -5919,15 +8148,15 @@ function createGentleAiExtensionForTesting(
 		],
 		parameters: REVIEW_CAPTURE_PARAMETERS,
 		executionMode: "sequential",
-		renderCall(_args, theme, context) {
+		renderCall(args, theme, context) {
 			return renderGentleAiLifecycleCall(
-				"review capture",
+				withLenses("review capture", [collectBindingLens((args as { collectBinding?: unknown }).collectBinding)]),
 				theme,
 				context as GentleAiRenderContext | undefined,
 			);
 		},
-		renderResult(result, options) {
-			return renderGentleAiResult(result, options);
+		renderResult(result, options, theme, context) {
+			return renderGentleAiResult(result, options, theme, context as GentleAiRenderContext | undefined);
 		},
 		async execute(_toolCallId, parameters, signal, _onUpdate, ctx) {
 			if (signal?.aborted) throw new Error("Review capture was cancelled");
@@ -5949,18 +8178,21 @@ function createGentleAiExtensionForTesting(
 
 	pi.registerTool({
 		name: "gentle_review",
+		renderShell: "self",
 		label: "Gentle Review Controller",
 		description:
 			"Inspect and recover review authority and start native ordinary review. Ordinary capture is available only through the separate gentle_review_capture tool. Review outcomes never authorize delivery: commit, push, pull-request, and release commands follow ordinary repository policy. RESET/RECOVER remain destructive and are executed by the audited native CLI.",
 		promptSnippet: "Inspect authority, then start native ordinary review; use gentle_review_capture for one current collect slot",
 		promptGuidelines: [
 			'Call {"operation":"inspect"} before START. New native ordinary START uses a JSON string such as "{\\"mode\\":\\"ordinary\\"}"; an explicit baseRef must be paired with committedOnly: true to request a committed range, while policyPath remains repository-local. policyHash is legacy compact-only. The controller derives lineage, Git/untracked scope, tier, lenses, authored lines, and budget; the frozen correction budget counts logical corrections, while correction-plan correctionLines count diff lines (one replaced source line is one deletion plus one addition).',
+			'An inspect blocked on the intended-untracked selection returns nextStep naming the exact continuation: call select-intended-untracked with the returned selectionBinding, or call inspect again with top-level untrackedScope ("exclude", or "select" with intendedUntracked) to resolve the round trip in one call; the retained selection is adopted by the next plain START.',
 			"Use RECONCILE_AUTHORITY only to quarantine one invalid native recovery successor. Supply exact predecessorLineage, expectedPredecessorRevision, successorLineage, expectedSuccessorRevision, actor, and reason values; Pi derives and displays the seven-line native authorization binding for fresh UI approval. The predecessor stays untouched, native returns the durable audit record, and Pi never falls back to RESET or RECOVER.",
-			"Use ABANDON or QUARANTINE_LEGACY only after an explicit user decision and with exact native inputs. ABANDON needs lineage, expectedRevision, snapshotIdentity, capturedLensResults, findingsPresent, evidenceRecordsPresent, actor, and reason; QUARANTINE_LEGACY accepts only the published malformed freeze-findings diagnostic/disposition. A dual reconciliation may supply only anomalies `unchanged_target,malformed_recovery_authorization` in that exact order. Use REPAIR_LEGACY_ALIAS only with lineage, actor, and reason: Pi freshly reads native inventory and derives repository, revision, diagnostic, disposition, and the exact eight-line binding before interactive approval. `review dispose-result` is unsupported pending design.",
+			"Use ABANDON or QUARANTINE_LEGACY only after an explicit user decision and with exact native inputs. ABANDON needs lineage, expectedRevision, snapshotIdentity, capturedLensResults, findingsPresent, actor, and reason; QUARANTINE_LEGACY accepts only the published malformed freeze-findings diagnostic/disposition. A dual reconciliation may supply only anomalies `unchanged_target,malformed_recovery_authorization` in that exact order. Use REPAIR_LEGACY_ALIAS only with lineage, actor, and reason: Pi freshly reads native inventory and derives repository, revision, diagnostic, disposition, and the exact eight-line binding before interactive approval. `review dispose-result` is unsupported pending design.",
 			"Lens, refuter, and validator verdicts are admitted natively, never Pi-authored. Use gentle_review_capture with exactly one current provider-owned collectBinding for ordinary native capture; it never follows another transition.",
 			"For blocked-legacy or blocked-mixed, do not call START repeatedly. Explain invalidation, request explicit user authorization, then call RESET or RECOVER only after authorization. RESET and RECOVER_LOCK route to audited native `gentle-ai review reclaim`; only RESET carries the legacy repositoryId, commonDirHash, inventoryHash, and confirmation challenge. RECOVER routes to native `gentle-ai review recover` with exactly six inputs: predecessorLineage, expectedPredecessorRevision, successorLineage, disposition, actor, and reason. Never send RECOVER the reset challenge and never send it a maintainerAuthorization: Pi reads fresh native target status, pins the predecessor lineage, revision, provider-selected disposition, and target identity, derives the exact six-line native authorization binding, displays it for fresh UI approval, and re-reads status before mutating. Negotiated target status supplies the sole accepted recovery disposition, and a caller-supplied substitute is rejected. Treat a native-input-required envelope as a request for exact values, never as permission to invent them. After a committed native recovery record, INSPECT before any fresh ordinary START.",
-			"A consent-required START returns the complete provider envelope and an opaque consent_binding, then stops. The parent presents and localizes that envelope without changing machine tokens, commands, target IDs, or invocations. After one explicit human answer, call answer-consent exactly once with a JSON string containing only consentBinding and answer (`granted` or `declined`). A reported lineage_created false or pre-authority validation error proves no lineage was created. After ambiguous START output, the controller calls target-scoped native status once and returns only its declared action. An ambiguous gentle_review_capture outcome independently reconciles once and never replays the capture.",
+			"A consent-required START may be resolved inside the eligible interactive Pi host. Its third UI action is host-owned: it runs this envelope's exact provider grant once and allows later fresh validated envelopes only for the same live SessionManager, nonempty session ID, and canonical Git common-directory identity, including sibling worktrees; an unrelated repository requires a new explicit human grant. Revoke removes the current repository grant, while nonreload replacement, quit, and process exit remove all session grants; reload preserves them. It grants no provider mode, verdict, acknowledgement, maintenance, delivery, or cross-repository authority. A package-owned child may ask its parent only with the canonical digest of its exact pending target; the parent binds that digest to the task repository and fails closed otherwise. If the tool returns an unresolved envelope, present the original two provider choices without changing machine tokens, commands, target IDs, or invocations; never add the host action to the decoded provider envelope. After one explicit relayed human answer, call answer-consent exactly once with only consentBinding and answer (`granted` or `declined`). Never create host permission from tool arguments, model prose, child/headless responses, or an uncertain native result. A reported lineage_created false or pre-authority validation error proves no lineage was created. After ambiguous START output, the controller calls target-scoped native status once and returns only its declared action. An ambiguous gentle_review_capture outcome independently reconciles once and never replays the capture.",
 			"Use gentle_review only for native review authority operations; delivery commands follow ordinary repository policy.",
+			'ASSESS (gentle-pi#662/#668) is read-only and needs no lineageId: after a delegated writer returns, call {"operation":"assess"} over its diff and follow the returned plan (writerSelfVerification, structuralReadbackOnly, independentVerifier, reason) instead of judging non-triviality from the task description. Pass input as JSON only to assess a committed range ({"baseRef":"<ref>","committedOnly":true}), to record the writer profile ({"writerModelId":"...", "writerEffort":"..."}), or to state the native review\'s outcome for this candidate ({"nativeReviewOutcome":"closed|declined|unavailable|unknown"}). Omitting writerModelId and writerEffort is treated as a small writer profile (fail closed), never large, because the writer\'s actual profile is then unknown to this call; pass the writer\'s real model id/effort to get credit for a known large profile. The on-path (writer self-verification is the record, no separate verifier) holds only when nativeReviewOutcome is "closed" for this candidate; a decline, an unavailable review, or an omitted/unknown outcome falls back to the exact risk-gated plan RDD off would return, re-enabling the separate verifier -- a decline is candidate-scoped and never lowers the bar below RDD off. "closed" is never inferred: pass it only right after this same caller acknowledged the approved review for this same candidate; omitting nativeReviewOutcome only ever auto-derives declined/unavailable, bound to that exact candidate\'s own target identity, never to a different candidate or to bare repository state. The result\'s outcome_source (explicit|derived|unknown) states which. A failed or unavailable native assessment reports risk "unassessable", verified exactly like "high". This never mutates review authority state.',
 		],
 		parameters: REVIEW_CONTROLLER_PARAMETERS,
 		executionMode: "sequential",
@@ -5971,26 +8203,120 @@ function createGentleAiExtensionForTesting(
 				context as GentleAiRenderContext | undefined,
 			);
 		},
-		renderResult(result, options) {
-			return renderGentleAiResult(result, options);
+		renderResult(result, options, theme, context) {
+			return renderGentleAiResult(result, options, theme, context as GentleAiRenderContext | undefined);
 		},
 		async execute(_toolCallId, parameters, signal, _onUpdate, ctx) {
 			if (signal?.aborted) throw new Error("Review controller operation was cancelled");
 			await authorizeDestructiveReviewOperation(parameters, ctx);
-			const details = await executeReviewControllerOperation(
+			const sessionKey = pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey);
+			const retainedSelections = processRetainedNativeStatusSelections.get(sessionKey)
+				?? processRetainedNativeStatusSelections.set(sessionKey, new Map()).get(sessionKey)!;
+			// Snapshot before native awaits: a concurrent own write is a new generation.
+			const acknowledgementEpoch = reminderEpoch;
+			let acknowledgementRoot: string | undefined;
+			let acknowledgementMutation: string | undefined;
+			try {
+				const parsed = parseReviewControllerParameters(parameters);
+				if (parsed.operation === REVIEW_CONTROLLER_OPERATION.ACKNOWLEDGE_APPROVED) {
+					acknowledgementRoot = resolveReviewControllerWorkspaceRoot(parsed.workspaceRoot, ctx.cwd, candidateViews, parsed.lineageId);
+					acknowledgementMutation = pendingReviewMutation(ctx.sessionManager, acknowledgementRoot);
+				}
+			} catch { /* Controller validation owns invalid parameters and unavailable roots. */ }
+			let details = await executeReviewControllerOperation(
 				parameters,
 				ctx.cwd,
 				nativeReviewCli,
 				signal,
 				candidateViews,
 				ctx,
-				((sessionKey: PendingReviewConsentSessionKey) => processRetainedNativeStatusSelections.get(sessionKey) ?? processRetainedNativeStatusSelections.set(sessionKey, new Map()).get(sessionKey)!)(pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey)),
+				retainedSelections,
 				pendingReviewConsentRegistry,
 				pendingReviewConsentFallbackKey,
-				writeReviewConsentLatch,
 				reviewConsentNow,
 				reviewConsentScheduleTimer,
 			);
+			if (details.operation === REVIEW_CONTROLLER_OPERATION.ACKNOWLEDGE_APPROVED &&
+				details.outcome === "native-approved-acknowledgement-completed" &&
+				details.status === "closed" && details.authority === "burned" &&
+				typeof details.target_identity === "string") {
+				try {
+					if (reminderSessionActive && acknowledgementEpoch === reminderEpoch && acknowledgementRoot && pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey) === sessionKey) {
+						consumeReviewMutation(pi, ctx.sessionManager, acknowledgementRoot, acknowledgementMutation, "acknowledged", details.target_identity);
+					}
+				} catch { /* Bookkeeping cannot hide a confirmed native burn. */ }
+			}
+			if (
+				isHostReviewConsentEligibleOperation(parameters) &&
+				details.outcome === "native-review-consent-required" &&
+				typeof details.consent_binding === "string"
+			) {
+				const resolved = pendingReviewConsentRegistry.resolve(details.consent_binding);
+				const pending = resolved?.pending;
+				const eligiblePending = pending !== undefined && isPiConsentV3(pending.consent)
+					? pending
+					: undefined;
+				const answerPendingConsent = async (answer: "granted" | "declined") => executeReviewControllerOperation(
+					{
+						operation: REVIEW_CONTROLLER_OPERATION.ANSWER_CONSENT,
+						input: JSON.stringify({ consentBinding: eligiblePending!.id, answer }),
+						workspaceRoot: eligiblePending!.authorityCwd,
+					},
+					ctx.cwd,
+					nativeReviewCli,
+					signal,
+					candidateViews,
+					ctx,
+					retainedSelections,
+					pendingReviewConsentRegistry,
+					pendingReviewConsentFallbackKey,
+					reviewConsentNow,
+					reviewConsentScheduleTimer,
+				);
+				let permissionWorkspaceRoot: string | undefined;
+				try {
+					const parsed = parseReviewControllerParameters(parameters);
+					permissionWorkspaceRoot = resolveReviewControllerWorkspaceRoot(parsed.workspaceRoot, ctx.cwd, candidateViews, parsed.lineageId);
+				} catch {
+					// The successful native operation above remains authoritative; an
+					// unresolvable local binding simply cannot consume host permission.
+				}
+				const initialIdentity = permissionWorkspaceRoot === undefined
+					? undefined
+					: await capturePermissionIdentity(ctx, permissionWorkspaceRoot);
+				if (eligiblePending !== undefined && initialIdentity === undefined) {
+					// A package child has no local standing grant. It may ask its
+					// inherited parent only for the canonical repository identity of
+					// this exact pending target, then replay this local binding once.
+					const repositoryIdentity = permissionWorkspaceRoot === undefined
+						? undefined
+						: await resolveCanonicalGitRepositoryIdentity(permissionWorkspaceRoot);
+					if (repositoryIdentity !== undefined && await childStandingReviewPermission?.requestAuthorization(repositoryIdentity) === true) details = await answerPendingConsent("granted");
+				} else if (eligiblePending !== undefined && initialIdentity !== undefined) {
+					const initialEpoch = reviewSessionPermissionEpoch(initialIdentity);
+					const permissionAlreadyActive = hasReviewSessionPermission(initialIdentity);
+					const selection = initialEpoch === undefined
+						? undefined
+						: permissionAlreadyActive
+							? { kind: "host-session" as const }
+							: await presentReviewConsentUi(ctx, eligiblePending.consent);
+					if (selection !== undefined) {
+						const confirmedIdentity = await capturePermissionIdentity(ctx, permissionWorkspaceRoot);
+						if (initialEpoch !== undefined && confirmedIdentity !== undefined && sameReviewSessionIdentity(initialIdentity, confirmedIdentity) && reviewSessionPermissionEpoch(confirmedIdentity) === initialEpoch) {
+							const answer = selection.kind === "provider" ? selection.answer : "granted";
+							details = await answerPendingConsent(answer);
+							if (!permissionAlreadyActive && selection.kind === "host-session" && completedGrantedReviewConsent(details)) {
+								if (grantReviewSessionPermission(confirmedIdentity, initialEpoch)) {
+									setReviewSessionPermissionStatus(ctx, true);
+									try { ctx.ui.notify("Reviews are allowed for this Pi session and this Git repository.", "info"); } catch { /* Nonblocking indication only. */ }
+								} else {
+									try { ctx.ui.notify("This review started, but the in-memory session permission registry was incompatible, so later candidates will ask again.", "warning"); } catch { /* Best effort. */ }
+								}
+							}
+						}
+					}
+				}
+			}
 			return {
 				content: [{ type: "text", text: JSON.stringify(details) }],
 				details,
@@ -5999,10 +8325,16 @@ function createGentleAiExtensionForTesting(
 	});
 
 	function runSddPreflight(ctx: ExtensionContext, promptFields: readonly SddPreflightField[] = []): Promise<SddPreflightPreferences> {
-		return ensureSddPreflight(ctx, { pi, installAssets: (cwd) => installSddAssets(cwd, false), applyModelConfig: async () => applySavedModelConfig(ctx) }, { promptFields });
+		return ensureSddPreflight(ctx, { pi, installAssets: (cwd) => installPackageAssets(cwd, true, ["sdd"]), applyModelConfig: async () => applySavedModelConfig(ctx) }, { promptFields });
 	}
 
-	pi.on("session_start", async (_event, ctx) => {
+	pi.on("session_start", async (event, ctx) => {
+		reminderSessionActive = true;
+		reminderEpoch += 1;
+		try { candidateViews?.sweepOrphans(ctx.cwd); } catch { /* Ownership sweeping must not block startup. */ }
+		const reason = (event as { reason?: unknown }).reason;
+		if (reason !== "reload") revokeCurrentReviewSessionPermission(ctx);
+		await refreshReviewSessionPermissionStatus(ctx);
 		// Loud, every session: an active dev-binary override means this session
 		// runs an unpinned gentle-ai. Announce which one before anything else.
 		try {
@@ -6013,7 +8345,7 @@ function createGentleAiExtensionForTesting(
 			if (ctx.hasUI) ctx.ui.notify(`Gentle AI dev binary override check failed: ${error instanceof Error ? error.message : String(error)}`, "warning");
 		}
 		try {
-			const installResult = installSddAssets(ctx.cwd, true);
+			const installResult = installPackageAssets(ctx.cwd, true, ["delegation", "review"]);
 			migrateLegacyProjectModelOverrides(ctx.cwd);
 			const modelResult = await applySavedModelConfig(ctx);
 			if (ctx.hasUI && modelResult.invalidPath) {
@@ -6025,7 +8357,7 @@ function createGentleAiExtensionForTesting(
 			}
 			if (ctx.hasUI && modelResult.updated > 0) {
 				ctx.ui.notify(
-					`el Gentleman applied SDD model config to ${modelResult.updated} agent(s). Global SDD assets ready: ${installResult.agents} new agent(s), ${installResult.chains} new chain(s), ${installResult.support} new support file(s).`,
+					`el Gentleman applied saved model config to ${modelResult.updated} agent(s). Global delegation/review assets ready: ${installResult.agents} new agent(s), ${installResult.chains} new chain(s), ${installResult.support} new support file(s).`,
 					"info",
 				);
 			}
@@ -6039,18 +8371,13 @@ function createGentleAiExtensionForTesting(
 				);
 			}
 		}
-		// gentle-pi#568: record the target identity STATUS reports right now,
-		// before this session does anything, as the baseline `agent_end` skips
-		// later. Best-effort and silent: it never notifies and never lets a
-		// STATUS failure fail session start.
+		// Keep the startup transport negotiation, but do not treat its target as
+		// an ownership baseline: reload may have outstanding durable receipts.
 		try {
 			const sessionKey = pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey);
-			const status = await resolveNegotiatedReviewStatusForSession(nativeReviewCli, ctx, sessionKey);
-			if (status?.targetIdentity !== undefined) {
-				processAgentEndSessionBaseline.set(sessionKey, status.targetIdentity);
-			}
+			await resolveNegotiatedReviewStatusForSession(nativeReviewCli, ctx, sessionKey);
 		} catch {
-			// Baseline recording is best-effort only; never surface or throw.
+			// Startup negotiation is best-effort only; never surface or throw.
 		}
 	});
 
@@ -6058,11 +8385,17 @@ function createGentleAiExtensionForTesting(
 		if (typeof event.text !== "string" || !isSddPreflightTrigger(event.text)) {
 			return { action: "continue" };
 		}
-		await runSddPreflight(ctx);
+		try { await runSddPreflight(ctx); }
+		catch (error) {
+			if (ctx.hasUI) ctx.ui.notify(error instanceof Error ? error.message : String(error), "warning");
+			return { action: "handled" };
+		}
 		return { action: "continue" };
 	});
 
+	let nativeSddStartupBlock: string | undefined;
 	pi.on("before_agent_start", async (event, ctx) => {
+		nativeSddStartupBlock = undefined;
 		const isSddAgent = isSddAgentStartEvent(event);
 		const isNamedAgent = isNamedAgentStartEvent(event);
 		const subagentDepthKey = pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey);
@@ -6071,26 +8404,92 @@ function createGentleAiExtensionForTesting(
 		} else {
 			processAgentEndSubagentDepth.set(subagentDepthKey, 0);
 		}
-		if (isSddAgent && !getSddPreflightPreferences(ctx)) {
-			await runSddPreflight(ctx);
+		// gentle-pi#677: nudge gentle-ai's own telemetry trigger for a primary
+		// session only, reusing the exact isNamedAgent/isSddAgent predicate that
+		// decides the orchestrator prompt below. At most one attempt per
+		// process regardless of how many primary-session before_agent_start
+		// events this process observes; a missing/old binary or a spawn error
+		// must never affect activation, so every failure is swallowed silently.
+		if (!isNamedAgent && !isSddAgent && !processTelemetryTriggerAttempted) {
+			processTelemetryTriggerAttempted = true;
+			try {
+				const executable = resolveTelemetryTriggerBinary();
+				spawnTelemetryTrigger({
+					executable,
+					cwd: ctx.cwd,
+					env: dependencies.processEnv ?? process.env,
+					spawn: dependencies.telemetryTriggerSpawn,
+				});
+			} catch {
+				// Best-effort only; never surfaced and never affects activation.
+			}
+		}
+		try {
+			if (isSddAgent && !getSddPreflightPreferences(ctx) && ctx.mode !== "rpc") {
+				await runSddPreflight(ctx);
+			}
+		} catch (error) {
+			// Pi logs thrown before_agent_start errors and continues. Return an
+			// unresolved gate instead of silently losing the preflight instructions.
+			return { systemPrompt: `${event.systemPrompt}\n\nSDD preflight unresolved: ${error instanceof Error ? error.message : String(error)}\nSTOP: Do not initialize the project, launch phases, write artifacts, or infer consent. Request session preflight confirmation before continuing.` };
 		}
 		const prefs = getSddPreflightPreferences(ctx);
+		// RPC children never resolve or persist defaults. The parent dispatch gate
+		// transports the rendered block in the existing task context, and Gentle
+		// Agents refuses a missing/malformed payload before spawning the child.
 		const sddPrompt =
 			prefs && (!isNamedAgent || isSddAgent)
 				? `\n\n${renderSddPreflightPrompt(prefs)}`
 				: "";
 		const phase = isSddAgent ? sddPhaseFromAgentStartEvent(event) : undefined;
+		const launchSddChange = readSddChangeFlag(pi);
+		if (launchSddChange !== undefined && !phase) nativeSddStartupBlock = "Receiving agent has no recognized SDD phase";
 		const nativeStatusPrompt = phase
-			? `\n\n${renderNativeSddPhasePrompt(resolveStartupControllerSddStatus(
-				ctx.cwd,
-				undefined,
-				true,
-				prefs?.artifactStore,
-			), phase)}`
-			: "";
+			? await (async () => {
+				try {
+					if (launchSddChange === undefined) {
+						if (phase === "sync") return `\n\n${renderNativeSddPhasePrompt(resolveStartupControllerSddStatus(ctx.cwd, undefined, true, prefs?.artifactStore), phase)}`;
+						const { status } = await readCommandSddStatus("", ctx);
+						if (status.changeName === null || !status.phaseInstructions || status.nextRecommended !== phase) throw new Error(`Native SDD discovery cannot run ${phase}.`);
+						return `\n\n${renderNativeSddPhasePrompt(status, phase)}`;
+					}
+					const agentName = `sdd-${phase}`;
+					const startup = await resolveSelectedNativeSddChangeStartup(
+						launchSddChange,
+						ctx.cwd,
+						agentName,
+						nativeReviewCli,
+						(options) => resolveControllerSddStatus(
+							options.cwd,
+							options.changeName,
+							true,
+							prefs?.artifactStore,
+						),
+					);
+					return `\n\n${renderNativeSddPhasePrompt(startup.status, phase)}`;
+				} catch (error) {
+					nativeSddStartupBlock = error instanceof Error ? error.message : String(error);
+					return `\n\n## Native SDD Status Engine\nSDD selection blocked: ${nativeSddStartupBlock}\nDo not run phase work; return this blocker to the parent.`;
+				}
+			})()
+			: launchSddChange === undefined
+				? ""
+				: "\n\n## Native SDD Status Engine\nSDD selection blocked: the receiving agent has no recognized SDD phase.\nDo not run phase work; return this blocker to the parent.";
+		// gentle-pi#661: the RDD status line (and the rest of the gentle prompt)
+		// is built only for the primary session, mirrored on the
+		// reviewContractPrompt condition below -- named/SDD agents never reach
+		// this branch, so no line is resolved or computed for them.
+		// resolveRddStatusLine never throws and never hangs past
+		// RDD_STATUS_TIMEOUT_MS: an absent/timed-out/aborted/failing native
+		// binary renders the fail-closed "unknown" line instead.
 		const gentlePrompt = isNamedAgent || isSddAgent
 			? ""
-			: `\n\n${buildGentlePrompt(readPersonaMode(ctx.cwd), ctx.cwd, readActiveToolNames(pi))}`;
+			: `\n\n${buildGentlePrompt(
+					readPersonaMode(ctx.cwd),
+					ctx.cwd,
+					readActiveToolNames(pi),
+					await resolveRddStatusLine(nativeReviewCli, ctx.cwd, AbortSignal.timeout(RDD_STATUS_TIMEOUT_MS), undefined, ctx),
+				)}`;
 		// gentle-pi#560 / gentle-ai#4056, #4057: inject the mirrored provider
 		// contract bundle's review execution contract for the primary session
 		// only, and only when a native review CLI is actually present.
@@ -6102,7 +8501,7 @@ function createGentleAiExtensionForTesting(
 				})()
 				: "";
 		return {
-			systemPrompt: `${event.systemPrompt}${gentlePrompt}${sddPrompt}${nativeStatusPrompt}${reviewContractPrompt}`,
+			systemPrompt: `${event.systemPrompt}${gentlePrompt}${sddPrompt}${nativeStatusPrompt}${reviewContractPrompt}${!isNamedAgent && !isSddAgent ? `\n\n${renderResearchCapabilities(resolveResearchCapabilities(pi))}` : ""}`,
 		};
 	});
 
@@ -6110,33 +8509,30 @@ function createGentleAiExtensionForTesting(
 	// an authorized implementation and report completion without ever running
 	// the review STATUS preflight or offering the consent question. This
 	// handler is read-only and idempotent: it never runs START, never answers
-	// consent, and never writes a file. It only sends one turn-triggering
-	// reminder, at most once per unreviewed target identity per session.
-	// gentle-pi#568: a candidate matching the baseline `session_start`
-	// recorded predates this session's own work and is skipped rather than
-	// nudged, so a worktree already dirty from the user's own edits does not
-	// draw a reminder about work this session never produced.
+	// consent, or chooses a partial candidate. Durable own-mutation receipts
+	// gate STATUS and consume only the generation captured before that await.
 	pi.on("agent_end", async (_event, ctx) => {
 		if (nativeReviewCli?.reviewMode === undefined || nativeReviewCli.targetStatus === undefined) return;
-		if (ctx.hasUI !== true) return;
+		if (ctx.hasUI !== true || !reminderSessionActive) return;
 		const sessionKey = pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey);
 		const subagentDepth = processAgentEndSubagentDepth.get(sessionKey) ?? 0;
 		if (subagentDepth > 0) {
 			processAgentEndSubagentDepth.set(sessionKey, subagentDepth - 1);
 			return;
 		}
+		const root = resolveSessionWorktree(ctx.cwd, ctx.cwd)?.root;
+		if (!root) return;
+		let mutation: string | undefined;
+		try { mutation = pendingReviewMutation(ctx.sessionManager, root); }
+		catch { return; }
+		if (!mutation) return;
+		const epoch = reminderEpoch;
 		const status = await resolveNegotiatedReviewStatusForSession(nativeReviewCli, ctx, sessionKey);
-		if (status === undefined) return;
+		if (status === undefined || !reminderSessionActive || epoch !== reminderEpoch || pendingReviewConsentSessionKey(ctx, pendingReviewConsentFallbackKey) !== sessionKey) return;
+		// Another concurrent end or ACK may already have consumed this prefix.
+		if (!pendingReviewMutation(ctx.sessionManager, root, mutation)) return;
 		if (status.nextTransition?.kind !== "execute" || status.nextTransition.execute.operation !== "review.start") return;
 		const targetIdentity = status.targetIdentity;
-		if (processAgentEndSessionBaseline.get(sessionKey) === targetIdentity) return;
-		let nudged = processAgentEndPreflightNudgedTargets.get(sessionKey);
-		if (nudged === undefined) {
-			nudged = new Set<string>();
-			processAgentEndPreflightNudgedTargets.set(sessionKey, nudged);
-		}
-		if (nudged.has(targetIdentity)) return;
-		nudged.add(targetIdentity);
 		pi.sendMessage(
 			{
 				customType: "gentle-pi.review-preflight",
@@ -6145,15 +8541,70 @@ function createGentleAiExtensionForTesting(
 			},
 			{ triggerTurn: true, deliverAs: "followUp" },
 		);
+		consumeReviewMutation(pi, ctx.sessionManager, root, mutation, "nudged", targetIdentity);
+	});
+
+	pi.on("tool_result", (event, ctx) => {
+		if (!reminderSessionActive || event.isError !== false || (event.toolName !== "write" && event.toolName !== "edit")) return;
+		if (!isRecord(event.input) || typeof event.input.path !== "string" || !event.input.path.trim()) return;
+		try {
+			const root = resolveSessionWorktree(event.input.path, ctx.cwd)?.root;
+			if (root) recordReviewMutation(pi, ctx.sessionManager, root, { source: "direct", toolName: event.toolName, toolCallId: event.toolCallId });
+		} catch { /* Receipt persistence must not change a successful tool result. */ }
 	});
 
 	pi.on("tool_call", async (event, ctx) => {
+		if (nativeSddStartupBlock && event.toolName !== "subagent_parent_message") return { block: true, reason: `SDD selection blocked: ${nativeSddStartupBlock}` };
 		const sensitivePathDenied = evaluateSensitivePathTool(
 			event.toolName,
 			event.input,
 		);
 		if (sensitivePathDenied) return sensitivePathDenied;
 		if (event.toolName === "subagent_run") {
+			const sddAgent = sddDispatchAgentName(event.input);
+			if (sddAgent === "invalid") {
+				return { block: true, reason: "SDD dispatch requires exactly one shipped SDD agent name." };
+			}
+			if (sddAgent !== undefined) {
+				// An RPC child is a delegated actor, never an authority originator. It
+				// must receive the already-confirmed block from its interactive parent.
+				if (ctx.mode === "rpc") {
+					return { block: true, reason: "SDD dispatch refused: an RPC child cannot originate or persist SDD preflight defaults." };
+				}
+				try {
+					const prefs = getSddPreflightPreferences(ctx) ?? await runSddPreflight(ctx);
+					const rendered = renderSddPreflightPrompt(prefs);
+					if (!prefs.prompted && ctx.hasUI) {
+						return { block: true, reason: "SDD dispatch refused: interactive parent preflight lacks current-session confirmation." };
+					}
+					if (!isRecord(event.input)) {
+						return { block: true, reason: "SDD dispatch refused: child input is malformed." };
+					}
+					if (event.input.context !== undefined && typeof event.input.context !== "string") {
+						return { block: true, reason: "SDD dispatch refused: child context must be text." };
+					}
+					// The existing context payload is the sole parent-to-child transport.
+					// Refuse a caller-authored lookalike so the child receives one exact,
+					// parent-rendered authority block rather than an ambiguous mixture.
+					const context = typeof event.input.context === "string" ? event.input.context.trim() : "";
+					if (/^## SDD Session Preflight[ \t]*$/m.test(context)) {
+						return { block: true, reason: "SDD dispatch refused: child context already contains an untrusted preflight block." };
+					}
+					event.input.context = context.length === 0
+						? rendered
+						: `${rendered}\n\n${context}`;
+					if (!isParentConfirmedSddPreflightContext(event.input.context)) {
+						return { block: true, reason: "SDD dispatch refused: rendered preflight transport is malformed." };
+					}
+				} catch (error) {
+					return {
+						block: true,
+						reason: `SDD dispatch refused before child launch: ${error instanceof Error ? error.message : String(error)}`,
+					};
+				}
+			}
+			const judgmentDayFixDenied = rejectInvalidJudgmentDayFixDispatch(event.input);
+			if (judgmentDayFixDenied) return judgmentDayFixDenied;
 			const writerScopeDenied = rejectUnscopedBoundedWriterDispatch(event.input);
 			if (writerScopeDenied) return writerScopeDenied;
 			try {
@@ -6173,39 +8624,50 @@ function createGentleAiExtensionForTesting(
 		return await confirmCommand(event.input.command, ctx, pi.events, herdrLifecycle);
 	});
 
-	pi.registerCommand("gentle:install-sdd", {
-		description:
-			"Repair or refresh global Gentle AI SDD subagent and chain assets.",
-		handler: async (args, ctx) => {
-			const force = args.includes("--force");
-			const result = installSddAssets(ctx.cwd, force);
-			ctx.ui.notify(
-				`Global Gentle AI SDD assets installed: ${result.agents} agent(s), ${result.chains} chain(s), ${result.support} support file(s), ${result.skipped} already present.`,
-				"info",
-			);
-		},
-	});
+	for (const owner of ["delegation", "review", "sdd"] as const) {
+		const label = owner === "sdd" ? "SDD" : owner;
+		pi.registerCommand(`gentle:install-${owner}`, {
+			description: `Repair or refresh only global Gentle AI ${label} assets.`,
+			handler: async (args, ctx) => {
+				const force = args.includes("--force");
+				const result = installPackageAssets(ctx.cwd, force, [owner]);
+				ctx.ui.notify(
+					`Global Gentle AI ${label} assets installed: ${result.agents} agent(s), ${result.chains} chain(s), ${result.support} support file(s), ${result.skipped} already present.`,
+					"info",
+				);
+			},
+		});
+	}
 
 	pi.registerCommand("gentle:sdd-preflight", {
 		description:
-			"Run or reuse the lazy SDD preflight for this Pi session.",
-		handler: async (_args, ctx) => {
-			await runSddPreflight(ctx, SDD_PREFLIGHT_FIELDS);
+			"Run or reuse session SDD preflight; use --edit to change preferences.",
+		handler: async (args, ctx) => {
+			if (args.trim() !== "" && args.trim() !== "--edit") {
+				ctx.ui.notify("Usage: /gentle:sdd-preflight [--edit]", "warning");
+				return;
+			}
+			try {
+				await runSddPreflight(ctx, args.trim() === "--edit" ? SDD_PREFLIGHT_FIELDS : []);
+			} catch (error) {
+				ctx.ui?.notify(error instanceof Error ? error.message : String(error), "warning");
+			}
 		},
 	});
 
-	const handleSddStatusCommand = async (args: string, ctx: ExtensionContext) => {
+	const readCommandSddStatus = async (args: string, ctx: ExtensionContext) => {
 		const parsed = parseSddStatusCommandArgs(args);
-		const status = resolveControllerSddStatus(
-			ctx.cwd,
-			parsed.changeName,
-			true,
-			getSddPreflightPreferences(ctx)?.artifactStore,
-		);
-		ctx.ui.notify(
-			parsed.json ? JSON.stringify(status, null, 2) : renderSddStatusMarkdown(status),
-			sddStatusSeverity(status),
-		);
+		const request = { changeName: parsed.changeName, workspaceRoot: realpathSync(ctx.cwd) };
+		if (!nativeReviewCli?.sddStatus) throw new Error("Native SDD status capability unavailable; no local fallback.");
+		const status = decodeNativeSddStatusV2(await nativeReviewCli.sddStatus(request), request);
+		return { parsed, request, status };
+	};
+	const showCommandSddStatus = (status: NativeSddStatusV2, json: boolean, ctx: ExtensionContext) => {
+		ctx.ui?.notify(json ? JSON.stringify(status, null, 2) : renderNativeSddPhasePrompt(status), "info");
+	};
+	const handleSddStatusCommand = async (args: string, ctx: ExtensionContext) => {
+		const { parsed, status } = await readCommandSddStatus(args, ctx);
+		showCommandSddStatus(status, parsed.json, ctx);
 	};
 
 	pi.registerCommand("gentle-sdd-status", {
@@ -6216,17 +8678,34 @@ function createGentleAiExtensionForTesting(
 	});
 
 	const handleSddContinueCommand = async (args: string, ctx: ExtensionContext) => {
-		const parsed = parseSddStatusCommandArgs(args);
-		const status = resolveControllerSddStatus(
-			ctx.cwd,
-			parsed.changeName,
-			true,
-			getSddPreflightPreferences(ctx)?.artifactStore,
-		);
-		ctx.ui.notify(
-			parsed.json ? JSON.stringify(status, null, 2) : renderSddDispatcherMarkdown(status),
-			sddStatusSeverity(status),
-		);
+		const { parsed, request, status } = await readCommandSddStatus(args, ctx);
+		const planning = status.planningHome;
+		const changeRoot = status.changeRoot;
+		// Native context is an upper bound, never the human's per-call grant.
+		if (status.changeName === null || !ctx.hasUI || typeof ctx.ui?.confirm !== "function" || !nativeReviewCli?.sddContinue) {
+			showCommandSddStatus(status, parsed.json, ctx);
+			return;
+		}
+		if (typeof planning !== "object" || planning === null || !("path" in planning) || typeof planning.path !== "string" || typeof changeRoot !== "string") throw new Error("Native SDD continuation lacks an exact planning path.");
+		if (!["openspec", "both"].includes(String(status.artifactStore)) || !["repo-local", "workspace-planning"].includes(String(status.actionContext.mode))) throw new Error("Native SDD continuation has unsupported planning context.");
+		const marker = join(changeRoot, ".gentle-ai-instance");
+		const checkMarker = () => {
+			try {
+				if (!lstatSync(marker).isFile() || realpathSync(marker) !== marker) throw new Error("Native SDD marker is not a canonical regular file.");
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+			}
+		};
+		checkMarker();
+		if (realpathSync(changeRoot) !== changeRoot || realpathSync(planning.path) !== planning.path || changeRoot !== join(planning.path, "changes", status.changeName) || !isStrictDescendantPath(request.workspaceRoot, marker)) throw new Error("Native SDD continuation workspace or planning path mismatch.");
+		if (await ctx.ui.confirm("Prepare SDD marker?", `Authorize only continuation-time preparation of ${marker}? This grants no source roots and no persistent authority.`) !== true) {
+			showCommandSddStatus(status, parsed.json, ctx);
+			return;
+		}
+		if (realpathSync(ctx.cwd) !== request.workspaceRoot || realpathSync(changeRoot) !== changeRoot) throw new Error("Native SDD continuation workspace changed during confirmation.");
+		checkMarker();
+		const selected = { ...request, changeName: status.changeName };
+		showCommandSddStatus(decodeNativeSddStatusV2(await nativeReviewCli.sddContinue(selected), selected), parsed.json, ctx);
 	};
 
 	pi.registerCommand("gentle-sdd-continue", {
@@ -6243,6 +8722,13 @@ function createGentleAiExtensionForTesting(
 		},
 	});
 
+	pi.registerCommand("gentle:profiles", {
+		description: "Create, switch, and manage global agent-model profiles for el Gentleman.",
+		handler: async (_args, ctx) => {
+			await handleProfilesCommand(ctx);
+		},
+	});
+
 	pi.registerCommand("gentle:persona", {
 		description: "Switch el Gentleman persona between gentleman and neutral.",
 		handler: async (_args, ctx) => {
@@ -6313,29 +8799,19 @@ function createGentleAiExtensionForTesting(
 	pi.registerCommand("gentle:doctor", {
 		description: "Run read-only Gentle AI diagnostics for this Pi workspace.",
 		handler: async (_args, ctx) => {
-			const agentsInstalled = existsSync(
-				join(gentlePiAgentHome(), "agents", "sdd-apply.md"),
-			);
-			const chainsInstalled = existsSync(
-				join(gentlePiAgentHome(), "chains", "sdd-full.chain.md"),
-			);
+			const assetLines = packageAssetDiagnosticLines(ctx.cwd);
 			const openspecConfigured = existsSync(
 				join(ctx.cwd, "openspec", "config.yaml"),
 			);
 			const skillRegistryPresent = existsSync(
 				join(ctx.cwd, ".atl", "skill-registry.md"),
 			);
-			const staleSddAssets = sddGlobalAssetDriftCount();
-			const localSddAgentOverrides = sddLocalAgentOverrideCount(ctx.cwd);
 			const modelConfig = await readSavedModelConfigAsync(ctx.cwd);
 			const engramActive = hasWritableEngramTool(pi);
 			const devBinary = await describeDevBinaryOverride();
 			const lines = [
 				"el Gentleman doctor",
-				`${agentsInstalled ? "pass" : "fail"}: Global SDD agents ${agentsInstalled ? "installed" : "missing"}`,
-				`${chainsInstalled ? "pass" : "fail"}: Global SDD chains ${chainsInstalled ? "installed" : "missing"}`,
-				`${staleSddAssets === 0 ? "pass" : "warn"}: Global SDD asset drift ${staleSddAssets} file(s)`,
-				`${localSddAgentOverrides === 0 ? "pass" : "warn"}: Project-local SDD agent overrides ${localSddAgentOverrides} file(s)`,
+				...assetLines,
 				`${openspecConfigured ? "pass" : "warn"}: OpenSpec config ${openspecConfigured ? "present" : "missing"}`,
 				`${skillRegistryPresent ? "pass" : "warn"}: Skill registry ${skillRegistryPresent ? "present" : "missing"}`,
 				`${modelConfig.status === "invalid" ? "fail" : "pass"}: Global model config ${modelConfig.status}`,
@@ -6344,24 +8820,42 @@ function createGentleAiExtensionForTesting(
 				...(devBinary.state === "active" ? [`warn: ${devBinary.line}`] : []),
 				...(devBinary.state === "invalid" ? [`fail: ${devBinary.line}`, "remedy: fix the dev binary override or clear it with /gentle:dev-binary off (or unset GENTLE_PI_GENTLE_AI_DEV_BINARY)"] : []),
 			];
-			if (!agentsInstalled || !chainsInstalled) {
-				lines.push("remedy: run /gentle:install-sdd --force to refresh global SDD assets intentionally");
-			}
 			if (modelConfig.status === "invalid") {
 				lines.push(`remedy: fix or remove ${modelConfig.path}`);
 			}
-			if (localSddAgentOverrides > 0) {
-				lines.push("remedy: remove project-local SDD agent overrides unless intentionally debugging package assets");
-			}
 			ctx.ui.notify(
 				lines.join("\n"),
-				lines.some((line) => line.startsWith("fail:")) ? "warning" : "info",
+				lines.some((line) => line.startsWith("fail:")) || assetLines.some((line) => line.startsWith("warn:")) ? "warning" : "info",
 			);
 		},
 	});
 
+	pi.registerCommand("gentle:review-session-permission", {
+		description: "Show or revoke the process-memory review permission for this exact Pi session and Git repository (status|revoke).",
+		handler: async (args, ctx) => {
+			const subAction = args.trim().length === 0 ? "status" : args.trim();
+			if (subAction !== "status" && subAction !== "revoke") {
+				ctx.ui.notify(`Unknown /gentle:review-session-permission sub-action "${subAction}". Use status or revoke.`, "warning");
+				return;
+			}
+			if (subAction === "revoke") {
+				const revoked = await revokeCurrentRepositoryReviewSessionPermission(ctx);
+				ctx.ui.notify(revoked ? "Review permission revoked for this Git repository in this Pi session. Provider review mode and authority were not changed." : "No review permission is active for this Git repository in this Pi session. Provider review mode and authority were not changed.", "info");
+				return;
+			}
+			const identity = await refreshReviewSessionPermissionStatus(ctx);
+			if (identity === undefined) {
+				ctx.ui.notify("Review session permission is unavailable: it requires the interactive Pi TUI, a non-child session, a nonempty session ID, and a canonical Git worktree.", "info");
+				return;
+			}
+			ctx.ui.notify(hasReviewSessionPermission(identity)
+				? "Reviews are allowed for this Pi session and Git repository. Use /gentle:review-session-permission revoke to ask again."
+				: "Reviews are not pre-authorized for this Pi session; each medium- or high-risk candidate asks normally.", "info");
+		},
+	});
+
 	pi.registerCommand("gentle:review-mode", {
-		description: "Show or set the Gentle AI review-driven-development kill switch (status|disable|enable). Every sub-action is user-initiated only; Pi automation never toggles it.",
+		description: "Show or set the Gentle AI receipt-driven development kill switch (status|enable|disable). Every sub-action is user-initiated only; Pi automation never toggles it.",
 		handler: async (args, ctx) => {
 			const subAction = args.trim().length === 0 ? NATIVE_REVIEW_MODE_OPERATION.STATUS : args.trim();
 			if (subAction !== NATIVE_REVIEW_MODE_OPERATION.STATUS && subAction !== NATIVE_REVIEW_MODE_OPERATION.ENABLE && subAction !== NATIVE_REVIEW_MODE_OPERATION.DISABLE) {
@@ -6405,6 +8899,56 @@ function createGentleAiExtensionForTesting(
 		},
 	});
 
+	// gentle-pi#677: gentle-ai owns telemetry end to end (status, the opt-out
+	// switches, and rate limiting); this command only runs the corresponding
+	// `gentle-ai telemetry <op> --json` in the foreground and relays its
+	// output, so a Pi user never has to leave Pi to check or change it.
+	pi.registerCommand("gentle:telemetry", {
+		description: "Show or change the local Gentle AI telemetry trigger (status|enable|disable|preview); gentle-ai owns the data and the opt-out.",
+		handler: async (args, ctx) => {
+			const subAction = args.trim().length === 0 ? "status" : args.trim();
+			if (subAction !== "status" && subAction !== "enable" && subAction !== "disable" && subAction !== "preview") {
+				ctx.ui.notify(`Unknown /gentle:telemetry sub-action "${subAction}". Use status, enable, disable, or preview.`, "warning");
+				return;
+			}
+			let executable: string;
+			try {
+				executable = resolveTelemetryTriggerBinary();
+			} catch (error) {
+				ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+				return;
+			}
+			let result: ExecFileResult;
+			try {
+				result = await telemetryExecFileAdapter({
+					file: executable,
+					arguments: ["telemetry", subAction, "--json"],
+					cwd: ctx.cwd,
+					timeoutMs: 5_000,
+					maxBufferBytes: 1024 * 1024,
+				});
+			} catch (error) {
+				ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+				return;
+			}
+			if (result.exitCode !== 0) {
+				ctx.ui.notify(`gentle-ai telemetry ${subAction} failed (exit ${result.exitCode}): ${(result.stderr || result.stdout || "no output").trim()}`, "error");
+				return;
+			}
+			let relayed: string;
+			try {
+				relayed = JSON.stringify(JSON.parse(result.stdout), null, 2);
+			} catch {
+				relayed = result.stdout.trim();
+			}
+			if (subAction === "disable") {
+				ctx.ui.notify("Gentle AI telemetry disabled.", "info");
+				return;
+			}
+			ctx.ui.notify(relayed, "info");
+		},
+	});
+
 	// Mirrors gentle:review-mode: a user-owned switch, never an automated one.
 	// It matters more here than there, because this policy governs whether
 	// background subagents may be launched at all, so nothing in Pi may write
@@ -6433,41 +8977,27 @@ function createGentleAiExtensionForTesting(
 	pi.registerCommand("gentle:status", {
 		description: "Show Gentle AI package status for this project.",
 		handler: async (_args, ctx) => {
-			const agentsInstalled = existsSync(
-				join(gentlePiAgentHome(), "agents", "sdd-apply.md"),
-			);
-			const chainsInstalled = existsSync(
-				join(gentlePiAgentHome(), "chains", "sdd-full.chain.md"),
-			);
+			const assetLines = packageAssetDiagnosticLines(ctx.cwd);
 			const openspecConfigured = existsSync(
 				join(ctx.cwd, "openspec", "config.yaml"),
 			);
-			const staleSddAssets = sddGlobalAssetDriftCount();
-			const localSddAgentOverrides = sddLocalAgentOverrideCount(ctx.cwd);
-			const modelConfig = await readModelConfigAsync(ctx.cwd);
+			const savedConfig = await readModelRoutingAuthorityAsync(
+				modelConfigPath(ctx.cwd),
+				legacyProjectModelConfigPath(ctx.cwd),
+			);
 			const devBinary = await describeDevBinaryOverride();
 			ctx.ui.notify(
 				[
 					"el Gentleman package is active.",
 					...(devBinary.state === "inactive" ? [] : [devBinary.line]),
 					`Persona: ${readPersonaMode(ctx.cwd)}`,
-					`Global SDD agents: ${agentsInstalled ? "installed" : "not installed"}`,
-					`Global SDD chains: ${chainsInstalled ? "installed" : "not installed"}`,
-					`Global SDD assets stale: ${staleSddAssets} file(s)${
-						staleSddAssets > 0
-							? " — run /gentle:install-sdd --force to refresh intentionally"
-							: ""
-					}`,
-					`Project-local SDD agent overrides: ${localSddAgentOverrides} file(s)${
-						localSddAgentOverrides > 0
-							? " — local SDD agents shadow package assets; remove them unless intentionally debugging"
-							: ""
-					}`,
+					...assetLines,
 					`OpenSpec config: ${openspecConfigured ? "present" : "missing"}`,
 					`Global model config: ${existsSync(modelConfigPath(ctx.cwd)) ? "present" : "missing"}`,
-					...describeModelConfig(ctx.cwd, modelConfig),
+					`Saved model routing: ${savedConfig.status}${savedConfig.status === "invalid" ? ` (${savedConfig.path})` : ""}`,
+					...(savedConfig.status === "invalid" ? [] : describeModelConfig(ctx.cwd, savedConfig.status === "valid" ? savedConfig.config : {})),
 				].join("\n"),
-				staleSddAssets > 0 || localSddAgentOverrides > 0 || devBinary.state !== "inactive" ? "warning" : "info",
+				savedConfig.status === "invalid" || assetLines.some((line) => line.startsWith("warn:")) || devBinary.state !== "inactive" ? "warning" : "info",
 			);
 		},
 	});