From 77baa944bdde26bead7c54ef53aae64abf27ace5 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Wed, 23 Sep 2026 07:46:53 -0700
Subject: [PATCH 01/22] feat(source-review): review a checkout's first-party
 source with Opus, Astra, or Grok

Separate from diff review. Keeps Classify-Code UTF-8 product files and drops tests, vendor, generated code, config, and docs. A short citation maps to the one kept path that ends with it. A finding that still does not match is skipped. Writes findings.json and a self-contained HTML page.
---
 bin/ci                                        |   4 +
 cmd/metareview/main.go                        |   7 +
 cmd/metareview/main_test.go                   |  11 +
 docs/ARCHITECTURE.md                          |   8 +-
 internal/sourcereview/fixture_test.go         |  89 +++
 internal/sourcereview/git.go                  | 120 ++++
 internal/sourcereview/model.go                | 152 +++++
 internal/sourcereview/model_test.go           | 220 +++++++
 internal/sourcereview/pack.go                 | 148 +++++
 internal/sourcereview/pack_test.go            | 178 ++++++
 internal/sourcereview/page.go                 | 143 +++++
 internal/sourcereview/page_test.go            | 261 ++++++++
 internal/sourcereview/parse.go                | 228 +++++++
 internal/sourcereview/parse_test.go           | 195 ++++++
 internal/sourcereview/run.go                  | 302 ++++++++++
 internal/sourcereview/run_test.go             | 565 ++++++++++++++++++
 internal/sourcereview/select.go               | 150 +++++
 internal/sourcereview/select_test.go          | 330 ++++++++++
 metareview-whole-repo-source-review-goal.md   | 265 ++++++++
 ...eview-whole-repo-source-review-progress.md |  91 +++
 20 files changed, 3466 insertions(+), 1 deletion(-)
 create mode 100755 bin/ci
 create mode 100644 internal/sourcereview/fixture_test.go
 create mode 100644 internal/sourcereview/git.go
 create mode 100644 internal/sourcereview/model.go
 create mode 100644 internal/sourcereview/model_test.go
 create mode 100644 internal/sourcereview/pack.go
 create mode 100644 internal/sourcereview/pack_test.go
 create mode 100644 internal/sourcereview/page.go
 create mode 100644 internal/sourcereview/page_test.go
 create mode 100644 internal/sourcereview/parse.go
 create mode 100644 internal/sourcereview/parse_test.go
 create mode 100644 internal/sourcereview/run.go
 create mode 100644 internal/sourcereview/run_test.go
 create mode 100644 internal/sourcereview/select.go
 create mode 100644 internal/sourcereview/select_test.go
 create mode 100644 metareview-whole-repo-source-review-goal.md
 create mode 100644 metareview-whole-repo-source-review-progress.md

diff --git a/bin/ci b/bin/ci
new file mode 100755
index 00000000..9121eef7
--- /dev/null
+++ b/bin/ci
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+exec make cover
diff --git a/cmd/metareview/main.go b/cmd/metareview/main.go
index 9d88cd47..547176c0 100644
--- a/cmd/metareview/main.go
+++ b/cmd/metareview/main.go
@@ -32,6 +32,7 @@ import (
 	"github.com/dsifry/metareview/internal/reviewprompt"
 	"github.com/dsifry/metareview/internal/reviewstate"
 	"github.com/dsifry/metareview/internal/setup"
+	"github.com/dsifry/metareview/internal/sourcereview"
 	"github.com/dsifry/metareview/internal/status"
 	"github.com/dsifry/metareview/internal/taskdone"
 	"github.com/dsifry/metareview/internal/version"
@@ -120,6 +121,7 @@ Usage:
   metareview review pr-ready [--base <ref>] [--previous-run <run-id>] [--max-attempts <n>] [--evidence <path>] [--mutation-report <path>]... [--github-pr <number>] [--include-working-tree] [--shard-result <path>]... [--cross-shard-result <path>]
   metareview review record-lenses [--scope pr-ready|task-done|epic-ready] [--base <ref>] [--verdict <v>] [--mode subagent-adjudicated|in-session-emulated] [--lenses a,b,c] [--from-run <fsm-run-id>]
   metareview learn --post-merge <pr-number> [--base <ref>] [--github-pr <number>] [--session-root <path>]
+  metareview source-review --model astra|opus|grok --output <dir> [<repo>]
 
 Commands:
   setup --check              Detect repository mode and prerequisites without writing files
@@ -142,6 +144,7 @@ Commands:
   review pr-ready            Run PR-ready branch review
   review record-lenses       Record an adjudicated lens review over HEAD (satisfies the require-lenses gate)
   learn --post-merge         Curate post-merge repository learning
+  source-review              Review first-party source with Astra, Opus, or Grok
 `, version.Version)
 }
 
@@ -167,6 +170,10 @@ func dispatch(args []string) {
 		return
 	}
 
+	if args[0] == "source-review" {
+		exit(sourcereview.CLI(args[1:], workdir, stdout, stderr))
+	}
+
 	if len(args) >= 1 && args[0] == "setup" {
 		handleSetup(args[1:])
 		return
diff --git a/cmd/metareview/main_test.go b/cmd/metareview/main_test.go
index b414457e..8e75c38f 100644
--- a/cmd/metareview/main_test.go
+++ b/cmd/metareview/main_test.go
@@ -85,6 +85,17 @@ func TestRunHelpAndVersion(t *testing.T) {
 	}
 }
 
+func TestRunSourceReviewHelp(t *testing.T) {
+	code, out, errOut := runCLI(t, t.TempDir(), nil, "source-review", "--help")
+	if code != 0 || !strings.Contains(out, "source-review --model astra|opus|grok --output <dir>") || errOut != "" {
+		t.Fatalf("code=%d out=%q err=%q", code, out, errOut)
+	}
+	code, help, _ := runCLI(t, t.TempDir(), nil, "--help")
+	if code != 0 || !strings.Contains(help, "metareview source-review --model astra|opus|grok --output <dir> [<repo>]") {
+		t.Fatalf("top-level help missing source-review: %q", help)
+	}
+}
+
 func TestRunUnknownCommand(t *testing.T) {
 	code, _, errOut := runCLI(t, t.TempDir(), nil, "bogus")
 	if code != 2 || !strings.Contains(errOut, "Unknown command") {
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index e685cfe5..cf4c749b 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -39,6 +39,11 @@ abbreviated — task-done/epic-ready/pr-ready also take `--evidence <file>` (a v
 | **epic-ready** | `review epic-ready <id>` | the epic's **integration diff** (base..HEAD, the union of the children's changes), **with the roll-up as context** — child evidence present? contradictions? intent drift? registry coverage? | deterministic heuristics (roll-up freshness) **+ a required adjudicated review** over the integration diff (base..HEAD) via the `epic-review-loop` workflow — same require-lenses gate as pr-ready/task-done |
 | **learn** | `learn --post-merge <pr>` | what the merged PR + bot findings teach us | learning extraction |
 
+`source-review` is a separate command (`source-review --model astra|opus|grok --output <dir> [<repo>]`).
+It reviews the first-party source at HEAD — code `Classify` keeps, minus tests, vendored trees,
+generated files, and non-UTF-8 — by calling the logged-in `claude`, `codex`, or `grok` CLI.
+It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
+
 `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
 (base..HEAD, the union of the children's changes) **with the roll-up — child review logs, evidence, parent
 intent — as context**; the roll-up's own freshness is guarded by the deterministic pre-checks (re-read every
@@ -201,7 +206,8 @@ list below is illustrative, omitting e.g. `judge`, `gate`, `converge`, `export`)
   `BuildForBranch`, coverage/unreviewed), `githooktest` (black-box hook tests), `covergate` (floor gate).
 - **Context & evidence:** `gitcontext` (exclude-filtered diff), `githubcontext`, `contextpack`,
   `contextprofile`, `shardpack` (shard packs), `evidence`, `mutation` (Stryker/gremlins report), `knowledge`,
-  `markdown`, `classify` (file class), `testconv` (test-file convention).
+  `markdown`, `classify` (file class), `testconv` (test-file convention),
+  `sourcereview` (whole-repo first-party source review; not the diff gate).
 - **FSM:** `fsm/{cli,machine,workflow,run,record,sandbox,kind}`.
 - **Sources & learning:** `tasksource`, `epicsource` (Beads etc.), `learning`, `learnsource`,
   `sessionhistory`, `integration` (metaswarm).
diff --git a/internal/sourcereview/fixture_test.go b/internal/sourcereview/fixture_test.go
new file mode 100644
index 00000000..5c596fbb
--- /dev/null
+++ b/internal/sourcereview/fixture_test.go
@@ -0,0 +1,89 @@
+package sourcereview
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func gitEnv() []string {
+	return append(os.Environ(),
+		"GIT_CONFIG_GLOBAL=/dev/null",
+		"GIT_CONFIG_SYSTEM=/dev/null",
+		"GIT_AUTHOR_NAME=Test",
+		"GIT_AUTHOR_EMAIL=t@example.com",
+		"GIT_COMMITTER_NAME=Test",
+		"GIT_COMMITTER_EMAIL=t@example.com",
+	)
+}
+
+func gitRun(t *testing.T, root string, args ...string) {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = root
+	cmd.Env = gitEnv()
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, out)
+	}
+}
+
+func newRepoBytes(t *testing.T, files map[string][]byte) (root, commit string) {
+	t.Helper()
+	root = t.TempDir()
+	gitRun(t, root, "init", "-b", "main")
+	gitRun(t, root, "config", "user.email", "t@example.com")
+	gitRun(t, root, "config", "user.name", "Test")
+	for p, body := range files {
+		abs := filepath.Join(root, filepath.FromSlash(p))
+		if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(abs, body, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	gitRun(t, root, "add", "-A")
+	gitRun(t, root, "commit", "-m", "fixture")
+	cmd := exec.Command("git", "rev-parse", "HEAD")
+	cmd.Dir = root
+	cmd.Env = gitEnv()
+	out, err := cmd.Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return root, strings.TrimSpace(string(out))
+}
+
+func specFiles() map[string][]byte {
+	return map[string][]byte{
+		"pkg/app.go":      []byte("package pkg\n\nfunc App() int { return 1 }\n"),
+		"pkg/note.go":     []byte("DO NOT EDIT\npackage pkg\n\nfunc Note() string { return \"n\" }\n"),
+		"pkg/app_test.go": []byte("package pkg\n\nfunc TestApp(t *testing.T) {}\n"),
+		"vendor/lib.go":   []byte("package vendor\n\nfunc Lib() {}\n// DROPME-vendor\n"),
+		"go.sum":          []byte("example.com/mod v1.0.0 h1:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=\n"),
+		"pkg/gen.go":      []byte("// Code generated by fixture. DO NOT EDIT.\npackage pkg\n\nfunc Gen() {}\n"),
+		"pkg/blob.dat":    {0xff, 0xfe, 0x00, 0x01},
+		"README.md":       []byte("# Demo\n\nDROPME-readme\n"),
+		"config.yaml":     []byte("name: demo\nDROPME-config\n"),
+	}
+}
+
+func droppedOnlyFiles() map[string][]byte {
+	all := specFiles()
+	delete(all, "pkg/app.go")
+	delete(all, "pkg/note.go")
+	return all
+}
+
+var specDropped = []string{
+	"README.md",
+	"config.yaml",
+	"go.sum",
+	"pkg/app_test.go",
+	"pkg/blob.dat",
+	"pkg/gen.go",
+	"vendor/lib.go",
+}
diff --git a/internal/sourcereview/git.go b/internal/sourcereview/git.go
new file mode 100644
index 00000000..5212d12f
--- /dev/null
+++ b/internal/sourcereview/git.go
@@ -0,0 +1,120 @@
+package sourcereview
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+// GitFunc runs git with optional stdin and returns stdout. A nil GitFunc means realGit.
+type GitFunc func(root string, args []string, stdin []byte) ([]byte, error)
+
+// gitBin is the git executable. Tests point it at a missing name to cover a failed start.
+var gitBin = "git"
+
+func realGit(root string, args []string, stdin []byte) ([]byte, error) {
+	cmd := exec.Command(gitBin, append([]string{"-C", root}, args...)...)
+	if stdin != nil {
+		cmd.Stdin = bytes.NewReader(stdin)
+	}
+	out, err := cmd.Output()
+	if err != nil {
+		var ee *exec.ExitError
+		if errors.As(err, &ee) {
+			return nil, fmt.Errorf("git %s: %s", strings.Join(args, " "), bytes.TrimSpace(ee.Stderr))
+		}
+		return nil, err
+	}
+	return out, nil
+}
+
+func resolveTop(root string, git GitFunc) (string, error) {
+	out, err := git(root, []string{"rev-parse", "--show-toplevel"}, nil)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+// parseTree reads `git ls-tree -r -z` records and returns blob paths.
+func parseTree(out []byte) ([]string, error) {
+	var paths []string
+	rest := out
+	for len(rest) > 0 {
+		rec, next, _ := bytes.Cut(rest, []byte{0})
+		rest = next
+		if len(rec) == 0 {
+			continue
+		}
+		tab := bytes.IndexByte(rec, '\t')
+		if tab < 0 {
+			return nil, fmt.Errorf("bad ls-tree record")
+		}
+		fields := strings.Fields(string(rec[:tab]))
+		if len(fields) < 2 {
+			return nil, fmt.Errorf("bad ls-tree meta")
+		}
+		if fields[1] != "blob" {
+			continue
+		}
+		p := string(rec[tab+1:])
+		if p == "" {
+			continue
+		}
+		paths = append(paths, p)
+	}
+	return paths, nil
+}
+
+func readBlobs(root string, paths []string, git GitFunc) (map[string][]byte, error) {
+	if len(paths) == 0 {
+		return map[string][]byte{}, nil
+	}
+	var stdin bytes.Buffer
+	for _, p := range paths {
+		if strings.Contains(p, "\n") {
+			return nil, fmt.Errorf("path contains a newline")
+		}
+		fmt.Fprintf(&stdin, "HEAD:%s\n", p)
+	}
+	out, err := git(root, []string{"cat-file", "--batch"}, stdin.Bytes())
+	if err != nil {
+		return nil, err
+	}
+	return parseBatch(out, paths)
+}
+
+func parseBatch(out []byte, paths []string) (map[string][]byte, error) {
+	files := make(map[string][]byte, len(paths))
+	rest := out
+	for _, p := range paths {
+		nl := bytes.IndexByte(rest, '\n')
+		if nl < 0 {
+			return nil, fmt.Errorf("short cat-file header for %s", p)
+		}
+		header := string(rest[:nl])
+		rest = rest[nl+1:]
+		parts := strings.Split(header, " ")
+		if len(parts) < 3 || parts[1] != "blob" {
+			return nil, fmt.Errorf("cat-file %s: %s", p, header)
+		}
+		size, err := strconv.Atoi(parts[2])
+		if err != nil {
+			return nil, fmt.Errorf("cat-file %s: %w", p, err)
+		}
+		if size < 0 || len(rest) < size+1 {
+			return nil, fmt.Errorf("short cat-file blob %s", p)
+		}
+		if rest[size] != '\n' {
+			return nil, fmt.Errorf("cat-file %s: missing trailing newline", p)
+		}
+		body := make([]byte, size)
+		copy(body, rest[:size])
+		files[p] = body
+		rest = rest[size+1:]
+	}
+	return files, nil
+}
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
new file mode 100644
index 00000000..922fca7e
--- /dev/null
+++ b/internal/sourcereview/model.go
@@ -0,0 +1,152 @@
+package sourcereview
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// Runner runs one logged-in CLI. stdin is the prompt for claude and codex;
+// grok receives the prompt as the argument of -p and stdin is nil.
+type Runner interface {
+	Run(name string, args []string, stdin []byte) ([]byte, error)
+}
+
+// OSRunner is the real process runner. It does not read an API key and does not
+// add a token to the command.
+type OSRunner struct{}
+
+func (OSRunner) Run(name string, args []string, stdin []byte) ([]byte, error) {
+	cmd := exec.Command(name, args...)
+	if stdin != nil {
+		cmd.Stdin = bytes.NewReader(stdin)
+	}
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	err := cmd.Run()
+	if err != nil {
+		// Codex puts the turn failure on stdout and a snapshot warning on
+		// stderr. Keep both so a non-zero exit records the CLI's reason.
+		msg := strings.TrimSpace(stderr.String())
+		if out := strings.TrimSpace(stdout.String()); out != "" {
+			if msg != "" {
+				msg = msg + "\n" + out
+			} else {
+				msg = out
+			}
+		}
+		if msg == "" {
+			msg = err.Error()
+		}
+		return stdout.Bytes(), fmt.Errorf("%s: %s", name, msg)
+	}
+	return stdout.Bytes(), nil
+}
+
+// ModelID is the id shown on the page and passed to the CLI.
+func ModelID(model string) (string, error) {
+	switch strings.ToLower(strings.TrimSpace(model)) {
+	case "opus":
+		return "opus", nil
+	case "astra":
+		return "gpt-6-astra", nil
+	case "grok":
+		return "grok-4.7", nil
+	default:
+		return "", fmt.Errorf("unknown model %q (want astra, opus, or grok)", model)
+	}
+}
+
+// Call is the one function that runs claude, codex, or grok. The prompt text
+// and the parser stay the same; only the CLI and the model id change.
+func Call(runner Runner, model string, prompt []byte) (string, error) {
+	switch strings.ToLower(strings.TrimSpace(model)) {
+	case "opus":
+		out, err := runner.Run("claude", []string{"-p", "--model", "opus", "--output-format", "json"}, prompt)
+		if err != nil {
+			return "", err
+		}
+		return claudeModelText(out)
+	case "astra":
+		out, err := runner.Run("codex", []string{"exec", "--json", "-m", "gpt-6-astra", "-"}, prompt)
+		if err != nil {
+			return "", err
+		}
+		return codexModelText(out)
+	case "grok":
+		out, err := runner.Run("grok", []string{"-p", string(prompt), "-m", "grok-4.7", "--output-format", "json"}, nil)
+		if err != nil {
+			return "", err
+		}
+		return grokModelText(out)
+	default:
+		return "", fmt.Errorf("unknown model %q", model)
+	}
+}
+
+func claudeModelText(stdout []byte) (string, error) {
+	var doc struct {
+		IsError bool    `json:"is_error"`
+		Result  *string `json:"result"`
+	}
+	if err := json.Unmarshal(stdout, &doc); err != nil {
+		return "", fmt.Errorf("missing model text: %w", err)
+	}
+	if doc.IsError {
+		msg := ""
+		if doc.Result != nil {
+			msg = *doc.Result
+		}
+		return "", fmt.Errorf("claude: is_error: %s", msg)
+	}
+	if doc.Result == nil || *doc.Result == "" {
+		return "", errors.New("missing model text")
+	}
+	return *doc.Result, nil
+}
+
+func codexModelText(stdout []byte) (string, error) {
+	var text string
+	found := false
+	for _, line := range strings.Split(string(stdout), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		var ev struct {
+			Type string `json:"type"`
+			Item struct {
+				Type string `json:"type"`
+				Text string `json:"text"`
+			} `json:"item"`
+		}
+		if json.Unmarshal([]byte(line), &ev) != nil {
+			continue
+		}
+		if ev.Type == "item.completed" && ev.Item.Type == "agent_message" {
+			text = ev.Item.Text
+			found = true
+		}
+	}
+	if !found || text == "" {
+		return "", errors.New("missing model text")
+	}
+	return text, nil
+}
+
+func grokModelText(stdout []byte) (string, error) {
+	var doc struct {
+		Text *string `json:"text"`
+	}
+	if err := json.Unmarshal(stdout, &doc); err != nil {
+		return "", fmt.Errorf("missing model text: %w", err)
+	}
+	if doc.Text == nil || *doc.Text == "" {
+		return "", errors.New("missing model text")
+	}
+	return *doc.Text, nil
+}
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
new file mode 100644
index 00000000..d143f31e
--- /dev/null
+++ b/internal/sourcereview/model_test.go
@@ -0,0 +1,220 @@
+package sourcereview
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+type fakeRunner struct {
+	calls []fakeCall
+	reply func(n int, name string, args []string, stdin []byte) ([]byte, error)
+	onRun func()
+}
+
+type fakeCall struct {
+	name  string
+	args  []string
+	stdin []byte
+}
+
+func (f *fakeRunner) Run(name string, args []string, stdin []byte) ([]byte, error) {
+	if f.onRun != nil {
+		f.onRun()
+	}
+	f.calls = append(f.calls, fakeCall{name, append([]string(nil), args...), append([]byte(nil), stdin...)})
+	if f.reply == nil {
+		return nil, errors.New("no reply")
+	}
+	return f.reply(len(f.calls)-1, name, args, stdin)
+}
+
+func TestModelID(t *testing.T) {
+	cases := map[string]string{"opus": "opus", " astra ": "gpt-6-astra", "GROK": "grok-4.7"}
+	for in, want := range cases {
+		got, err := ModelID(in)
+		if err != nil || got != want {
+			t.Fatalf("%q -> %q %v", in, got, err)
+		}
+	}
+	if _, err := ModelID("sonnet"); err == nil {
+		t.Fatal("expected unknown model")
+	}
+}
+
+func TestCallShapes(t *testing.T) {
+	prompt := []byte("review this")
+	for _, model := range []string{"opus", "astra", "grok"} {
+		fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+			switch model {
+			case "opus":
+				return []byte(`{"is_error":false,"result":"{\"findings\":[]}"}`), nil
+			case "astra":
+				return []byte("not json\n{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"first\"}}\n{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"{\\\"findings\\\":[]}\"}}\n"), nil
+			default:
+				return []byte(`{"text":"{\"findings\":[]}"}`), nil
+			}
+		}}
+		text, err := Call(fr, model, prompt)
+		if err != nil {
+			t.Fatal(model, err)
+		}
+		if model == "astra" {
+			if text != `{"findings":[]}` {
+				t.Fatalf("astra text %q", text)
+			}
+		} else if text != `{"findings":[]}` {
+			t.Fatalf("%s text %q", model, text)
+		}
+		c := fr.calls[0]
+		switch model {
+		case "opus":
+			if c.name != "claude" || !reflectArgs(c.args, []string{"-p", "--model", "opus", "--output-format", "json"}) || !bytes.Equal(c.stdin, prompt) {
+				t.Fatalf("claude call %+v", c)
+			}
+		case "astra":
+			if c.name != "codex" || !reflectArgs(c.args, []string{"exec", "--json", "-m", "gpt-6-astra", "-"}) || !bytes.Equal(c.stdin, prompt) {
+				t.Fatalf("codex call %+v", c)
+			}
+		case "grok":
+			if c.name != "grok" || !reflectArgs(c.args, []string{"-p", string(prompt), "-m", "grok-4.7", "--output-format", "json"}) || c.stdin != nil {
+				t.Fatalf("grok call %+v", c)
+			}
+		}
+	}
+}
+
+func reflectArgs(got, want []string) bool {
+	if len(got) != len(want) {
+		return false
+	}
+	for i := range got {
+		if got[i] != want[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func TestCallErrors(t *testing.T) {
+	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		return nil, errors.New("executable file not found")
+	}}
+	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+		t.Fatal("start failure")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte(`{"is_error":true,"result":"boom"}`), nil
+	}
+	if _, err := Call(fr, "opus", []byte("p")); err == nil || !strings.Contains(err.Error(), "is_error") {
+		t.Fatal(err)
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte(`{"is_error":false}`), nil
+	}
+	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+		t.Fatal("missing result")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte(`{"is_error":false,"result":""}`), nil
+	}
+	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+		t.Fatal("empty result")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte("not-json"), nil
+	}
+	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+		t.Fatal("bad claude json")
+	}
+	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+		t.Fatal("bad grok json")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte(`{"text":""}`), nil
+	}
+	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+		t.Fatal("empty grok text")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte(`{}`), nil
+	}
+	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+		t.Fatal("nil grok text")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte("{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"\"}}\n"), nil
+	}
+	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+		t.Fatal("empty codex text")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return []byte("nope\n"), nil
+	}
+	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+		t.Fatal("no agent message")
+	}
+	if _, err := Call(fr, "nope", []byte("p")); err == nil {
+		t.Fatal("unknown model")
+	}
+	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
+		return nil, errors.New("exit status 1")
+	}
+	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+		t.Fatal("nonzero")
+	}
+	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+		t.Fatal("grok nonzero")
+	}
+}
+
+func TestOSRunner(t *testing.T) {
+	out, err := OSRunner{}.Run("echo", []string{"hi"}, nil)
+	if err != nil || !bytes.Contains(out, []byte("hi")) {
+		t.Fatalf("echo: %v %q", err, out)
+	}
+	out, err = OSRunner{}.Run("cat", nil, []byte("yo"))
+	if err != nil || !bytes.Equal(out, []byte("yo")) {
+		t.Fatalf("cat: %v %q", err, out)
+	}
+	if _, err := (OSRunner{}).Run("false", nil, nil); err == nil {
+		t.Fatal("false should fail")
+	}
+	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo boom >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "boom") {
+		t.Fatal(err)
+	}
+	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo usage-limit; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "usage-limit") {
+		t.Fatal(err)
+	}
+	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo out-line; echo err-line >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "err-line") || !strings.Contains(err.Error(), "out-line") {
+		t.Fatal(err)
+	}
+	if _, err := (OSRunner{}).Run("no-such-binary-xyz", nil, nil); err == nil {
+		t.Fatal("missing binary")
+	}
+	// exec.Command is used; a lookup failure is *exec.Error, not ExitError.
+	if _, err := exec.LookPath("echo"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestClaudeIsErrorWithoutResult(t *testing.T) {
+	if _, err := claudeModelText([]byte(`{"is_error":true}`)); err == nil {
+		t.Fatal("expected is_error")
+	}
+}
+
+func TestCodexSkipsBlank(t *testing.T) {
+	raw := "\n  \n{\"type\":\"turn.completed\"}\n{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"{\\\"findings\\\":[]}\"}}\n"
+	text, err := codexModelText([]byte(raw))
+	if err != nil || text != `{"findings":[]}` {
+		t.Fatalf("%q %v", text, err)
+	}
+	b, err := json.Marshal(map[string]string{"text": "ok"})
+	if err != nil || !bytes.Contains(b, []byte("ok")) {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/sourcereview/pack.go b/internal/sourcereview/pack.go
new file mode 100644
index 00000000..0237b631
--- /dev/null
+++ b/internal/sourcereview/pack.go
@@ -0,0 +1,148 @@
+package sourcereview
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"unicode/utf8"
+)
+
+// MaxPromptBytes is the prompt budget. AGENTS.md uses 120000 as the size that
+// cannot be held in one review context.
+const MaxPromptBytes = 120000
+
+// instruction is the same text for every model. Only the CLI and the model id change.
+const instruction = `Review the first-party source below and return only {"findings":[...]}.
+Each finding's tag is bug or advisory. Each finding's severity is P0, P1, P2, or P3.
+Every field is present: tag, file, start_line, end_line, issue, consequence, confidence, severity.
+confidence is an integer from 0 to 100.
+file is one of the paths given below. start_line and end_line are line numbers in that file.
+Return {"findings":[]} when there is nothing to report.
+Do not write anything outside that JSON object.`
+
+func sliceNote(path string, line int) string {
+	return fmt.Sprintf("This prompt contains a byte slice of %s starting at original line %d. Citations use the original path and the original line numbers.", path, line)
+}
+
+func sliceHeader(path string, line int) string {
+	return instruction + "\n" + sliceNote(path, line) + "\n"
+}
+
+// promptWith writes the instruction header and each path on its own line
+// immediately before that file's bytes. A following path stays on its own line
+// when the previous body does not end in a newline.
+func promptWith(header string, files []File) []byte {
+	var b bytes.Buffer
+	b.WriteString(header)
+	if !strings.HasSuffix(header, "\n") {
+		b.WriteByte('\n')
+	}
+	for i, f := range files {
+		if i > 0 && (len(files[i-1].Body) == 0 || files[i-1].Body[len(files[i-1].Body)-1] != '\n') {
+			b.WriteByte('\n')
+		}
+		b.WriteString(f.Path)
+		b.WriteByte('\n')
+		b.Write(f.Body)
+	}
+	return b.Bytes()
+}
+
+// Pack packs whole kept files into the smallest number of prompts that stay
+// within budget (first-fit decreasing). A file that cannot fit in one prompt
+// is cut into consecutive non-empty UTF-8 slices that partition it.
+func Pack(files []File, budget int) ([][]byte, error) {
+	if budget <= 0 {
+		return nil, fmt.Errorf("prompt budget must be positive")
+	}
+	var whole, big []File
+	for _, f := range files {
+		if len(promptWith(instruction, []File{f})) <= budget {
+			whole = append(whole, f)
+		} else {
+			big = append(big, f)
+		}
+	}
+	prompts := packWhole(whole, budget)
+	sort.Slice(big, func(i, j int) bool { return big[i].Path < big[j].Path })
+	for _, f := range big {
+		parts, err := sliceFile(f, budget)
+		if err != nil {
+			return nil, err
+		}
+		prompts = append(prompts, parts...)
+	}
+	return prompts, nil
+}
+
+func packWhole(files []File, budget int) [][]byte {
+	sorted := append([]File(nil), files...)
+	sort.Slice(sorted, func(i, j int) bool {
+		if len(sorted[i].Body) == len(sorted[j].Body) {
+			return sorted[i].Path < sorted[j].Path
+		}
+		return len(sorted[i].Body) > len(sorted[j].Body)
+	})
+	var bins [][]File
+	for _, f := range sorted {
+		placed := false
+		for i := range bins {
+			candidate := append(append([]File{}, bins[i]...), f)
+			if len(promptWith(instruction, candidate)) <= budget {
+				bins[i] = candidate
+				placed = true
+				break
+			}
+		}
+		if !placed {
+			bins = append(bins, []File{f})
+		}
+	}
+	out := make([][]byte, 0, len(bins))
+	for _, bin := range bins {
+		out = append(out, promptWith(instruction, bin))
+	}
+	return out
+}
+
+func sliceFile(f File, budget int) ([][]byte, error) {
+	var out [][]byte
+	start := 0
+	for start < len(f.Body) {
+		line := lineAt(f.Body, start)
+		header := sliceHeader(f.Path, line)
+		room := budget - len(header) - len(f.Path) - 1
+		end, err := cutEnd(f.Body, start, room)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", f.Path, err)
+		}
+		out = append(out, promptWith(header, []File{{Path: f.Path, Body: f.Body[start:end]}}))
+		start = end
+	}
+	return out, nil
+}
+
+func lineAt(content []byte, offset int) int {
+	return bytes.Count(content[:offset], []byte("\n")) + 1
+}
+
+// cutEnd returns the byte end of a non-empty slice that starts at start, is at
+// most room bytes, and ends on a UTF-8 character boundary.
+func cutEnd(content []byte, start, room int) (int, error) {
+	if room < 1 {
+		return 0, fmt.Errorf("prompt overhead exceeds the budget")
+	}
+	end := start + room
+	if end > len(content) {
+		end = len(content)
+	} else {
+		for end > start && !utf8.RuneStart(content[end]) {
+			end--
+		}
+	}
+	if end == start {
+		return 0, fmt.Errorf("a character does not fit in one prompt")
+	}
+	return end, nil
+}
diff --git a/internal/sourcereview/pack_test.go b/internal/sourcereview/pack_test.go
new file mode 100644
index 00000000..0506ecb2
--- /dev/null
+++ b/internal/sourcereview/pack_test.go
@@ -0,0 +1,178 @@
+package sourcereview
+
+import (
+	"bytes"
+	"strconv"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+func TestPackWholeFilesSmallest(t *testing.T) {
+	files := []File{
+		{Path: "a.go", Body: bytes.Repeat([]byte("x"), 100000)},
+		{Path: "b.go", Body: bytes.Repeat([]byte("y"), 50000)},
+		{Path: "c.go", Body: bytes.Repeat([]byte("z"), 60000)},
+	}
+	prompts, err := Pack(files, MaxPromptBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(prompts) != 2 {
+		t.Fatalf("prompts = %d, want 2", len(prompts))
+	}
+	seen := map[string]int{}
+	for _, p := range prompts {
+		if len(p) > MaxPromptBytes {
+			t.Fatalf("prompt is %d bytes", len(p))
+		}
+		if !bytes.Contains(p, []byte(instruction)) {
+			t.Fatal("missing instruction")
+		}
+		if bytes.Contains(p, []byte("byte slice of")) {
+			t.Fatal("whole file prompt has a slice note")
+		}
+		for _, f := range files {
+			needle := append([]byte(f.Path+"\n"), f.Body...)
+			if bytes.Contains(p, needle) {
+				seen[f.Path]++
+			}
+		}
+	}
+	for _, f := range files {
+		if seen[f.Path] != 1 {
+			t.Fatalf("%s seen %d times", f.Path, seen[f.Path])
+		}
+	}
+}
+
+func TestPackSlicesPartitionUTF8(t *testing.T) {
+	body := bytes.Repeat([]byte("世"), 70000)
+	f := File{Path: "pkg/wide.go", Body: body}
+	prompts, err := Pack([]File{f}, MaxPromptBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(prompts) < 2 {
+		t.Fatalf("prompts = %d", len(prompts))
+	}
+	off := 0
+	files := map[string][]byte{f.Path: body}
+	for _, p := range prompts {
+		if len(p) > MaxPromptBytes {
+			t.Fatalf("prompt is %d bytes", len(p))
+		}
+		header := sliceHeader(f.Path, lineAt(body, off))
+		prefix := header + f.Path + "\n"
+		if !strings.HasPrefix(string(p), prefix) {
+			t.Fatalf("prompt missing slice header at offset %d", off)
+		}
+		part := p[len(prefix):]
+		if len(part) == 0 {
+			t.Fatal("empty slice")
+		}
+		if !utf8.Valid(part) {
+			t.Fatal("slice is not valid UTF-8")
+		}
+		if !bytes.HasPrefix(body[off:], part) {
+			t.Fatal("slice is not the next bytes of the file")
+		}
+		line := lineAt(body, off)
+		text := `{"findings":[{"tag":"bug","file":"pkg/wide.go","start_line":` + strconv.Itoa(line) + `,"end_line":` + strconv.Itoa(line) + `,"issue":"i","consequence":"c","confidence":80,"severity":"P1"}]}`
+		got, _, err := Parse(text, files)
+		if err != nil {
+			t.Fatalf("finding at original line %d: %v", line, err)
+		}
+		if got[0].File != f.Path || got[0].StartLine != line {
+			t.Fatalf("citation %+v", got[0])
+		}
+		off += len(part)
+	}
+	if off != len(body) {
+		t.Fatalf("partition covered %d of %d", off, len(body))
+	}
+}
+
+func TestPackMixedAndSeparators(t *testing.T) {
+	small := File{Path: "small.go", Body: []byte("package small\n")}
+	empty := File{Path: "empty.go", Body: nil}
+	nonl := File{Path: "nonl.go", Body: []byte("package nonl")}
+	big := File{Path: "big.go", Body: bytes.Repeat([]byte("世"), 70000)}
+	prompts, err := Pack([]File{small, empty, nonl, big}, MaxPromptBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var whole, slices int
+	for _, p := range prompts {
+		if bytes.Contains(p, []byte("byte slice of")) {
+			slices++
+			if !bytes.Contains(p, []byte("big.go\n")) {
+				t.Fatal("slice prompt missing path")
+			}
+			continue
+		}
+		whole++
+		for _, f := range []File{small, empty, nonl} {
+			if !bytes.Contains(p, []byte(f.Path+"\n")) {
+				t.Fatalf("whole prompt missing %s", f.Path)
+			}
+		}
+		if bytes.Contains(p, []byte("big.go\n")) {
+			t.Fatal("big file packed whole")
+		}
+	}
+	if whole != 1 || slices < 2 {
+		t.Fatalf("whole=%d slices=%d", whole, slices)
+	}
+}
+
+func TestCutEndAndSliceErrors(t *testing.T) {
+	if _, err := cutEnd([]byte("世"), 0, 0); err == nil {
+		t.Fatal("room 0")
+	}
+	if _, err := cutEnd([]byte("世"), 0, 1); err == nil {
+		t.Fatal("rune does not fit")
+	}
+	end, err := cutEnd([]byte("世世"), 0, 4)
+	if err != nil || end != 3 {
+		t.Fatalf("end=%d err=%v", end, err)
+	}
+	end, err = cutEnd([]byte("ab"), 0, 10)
+	if err != nil || end != 2 {
+		t.Fatalf("short end=%d err=%v", end, err)
+	}
+	header := sliceHeader("p.go", 1)
+	if _, err := sliceFile(File{Path: "p.go", Body: []byte("世")}, len(header)+len("p.go")+1+1); err == nil {
+		t.Fatal("sliceFile should reject a rune that does not fit")
+	}
+	if _, err := sliceFile(File{Path: "p.go", Body: []byte("hello")}, 10); err == nil {
+		t.Fatal("sliceFile should reject a tiny budget")
+	}
+	if _, err := Pack([]File{{Path: "a.go", Body: []byte("package a\n")}}, 0); err == nil {
+		t.Fatal("budget 0")
+	}
+	if _, err := Pack([]File{{Path: "a.go", Body: bytes.Repeat([]byte("x"), 50)}}, 10); err == nil {
+		t.Fatal("pack should surface the slice error")
+	}
+	if prompts, err := Pack(nil, MaxPromptBytes); err != nil || len(prompts) != 0 {
+		t.Fatalf("empty pack %v %v", prompts, err)
+	}
+	two, err := Pack([]File{
+		{Path: "z.go", Body: bytes.Repeat([]byte("世"), 70000)},
+		{Path: "a.go", Body: bytes.Repeat([]byte("世"), 70000)},
+	}, MaxPromptBytes)
+	if err != nil || len(two) < 2 {
+		t.Fatalf("two big files: %v %d", err, len(two))
+	}
+}
+
+func TestPromptNamesPathBeforeBody(t *testing.T) {
+	body := []byte("package pkg\nfunc A() {}\n")
+	p := promptWith(instruction, []File{{Path: "pkg/app.go", Body: body}})
+	if !bytes.Contains(p, append([]byte("pkg/app.go\n"), body...)) {
+		t.Fatalf("path is not immediately before the body:\n%s", p)
+	}
+	if !bytes.Contains(p, []byte(`{"findings":[...]}`)) {
+		t.Fatal("instruction missing findings object")
+	}
+}
diff --git a/internal/sourcereview/page.go b/internal/sourcereview/page.go
new file mode 100644
index 00000000..8d65e81f
--- /dev/null
+++ b/internal/sourcereview/page.go
@@ -0,0 +1,143 @@
+package sourcereview
+
+import (
+	"fmt"
+	"html"
+	"path"
+	"sort"
+	"strings"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+// Page is the input to the self-contained HTML file.
+type Page struct {
+	Repo     string
+	Commit   string
+	ModelID  string
+	Findings []lensoutput.TypedFinding
+	Files    map[string][]byte
+}
+
+func severityCounts(fs []lensoutput.TypedFinding) (p0, p1, p2, p3 int) {
+	for _, f := range fs {
+		switch f.Severity {
+		case "P0":
+			p0++
+		case "P1":
+			p1++
+		case "P2":
+			p2++
+		case "P3":
+			p3++
+		}
+	}
+	return p0, p1, p2, p3
+}
+
+func findingDirs(fs []lensoutput.TypedFinding) []string {
+	seen := map[string]bool{}
+	var dirs []string
+	for _, f := range fs {
+		d := path.Dir(f.File)
+		if !seen[d] {
+			seen[d] = true
+			dirs = append(dirs, d)
+		}
+	}
+	sort.Strings(dirs)
+	return dirs
+}
+
+func excerpt(body []byte, start, end int) string {
+	lines := splitLines(body)
+	if start < 1 || end > len(lines) || end < start {
+		return ""
+	}
+	return strings.Join(lines[start-1:end], "\n")
+}
+
+const pageScript = `
+(function () {
+  var severity = document.getElementById("severity");
+  var directory = document.getElementById("directory");
+  var findings = document.querySelectorAll("#findings .finding");
+  function apply() {
+    var s = severity.value;
+    var d = directory.value;
+    for (var i = 0; i < findings.length; i++) {
+      var el = findings[i];
+      var okS = s === "" || el.getAttribute("data-severity") === s;
+      var okD = d === "" || el.getAttribute("data-dir") === d;
+      el.style.display = (okS && okD) ? "" : "none";
+    }
+  }
+  severity.addEventListener("change", apply);
+  directory.addEventListener("change", apply);
+  var buttons = document.querySelectorAll("#findings .finding > button");
+  for (var j = 0; j < buttons.length; j++) {
+    buttons[j].addEventListener("click", function () {
+      var detail = this.parentNode.querySelector(".detail");
+      detail.hidden = !detail.hidden;
+    });
+  }
+})();
+`
+
+const pageCSS = `
+body { font: 16px/1.4 ui-sans-serif, system-ui, sans-serif; margin: 1.5rem; color: #1a1a1a; background: #f7f5f2; }
+header { margin-bottom: 1rem; }
+.meta { margin: 0.15rem 0; }
+.counts { display: flex; gap: 1rem; padding: 0; list-style: none; }
+.filters { display: flex; gap: 1rem; margin: 1rem 0; }
+article.finding { background: #fff; border: 1px solid #ccc; margin: 0.5rem 0; padding: 0.5rem 0.75rem; }
+article.finding > button { font: inherit; background: none; border: 0; padding: 0; cursor: pointer; text-align: left; }
+.detail { display: none; gap: 1.5rem; margin-top: 0.75rem; }
+.detail:not([hidden]) { display: flex; }
+.detail pre { margin: 0; background: #f0ece6; padding: 0.5rem; overflow: auto; }
+`
+
+// Render returns one HTML document. It has no external assets. The quote is the
+// excerpt of the cited lines; it is not a field of the findings file.
+func Render(p Page) []byte {
+	p0, p1, p2, p3 := severityCounts(p.Findings)
+	var b strings.Builder
+	b.WriteString("<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>Source review</title>\n<style>")
+	b.WriteString(pageCSS)
+	b.WriteString("</style>\n</head>\n<body>\n<header>\n")
+	fmt.Fprintf(&b, "<p class=\"meta\" id=\"repo\">%s</p>\n", html.EscapeString(p.Repo))
+	fmt.Fprintf(&b, "<p class=\"meta\" id=\"commit\">%s</p>\n", html.EscapeString(p.Commit))
+	fmt.Fprintf(&b, "<p class=\"meta\" id=\"model\">%s</p>\n", html.EscapeString(p.ModelID))
+	b.WriteString("<ul class=\"counts\">\n")
+	fmt.Fprintf(&b, "<li id=\"count-p0\">P0 %d</li>\n", p0)
+	fmt.Fprintf(&b, "<li id=\"count-p1\">P1 %d</li>\n", p1)
+	fmt.Fprintf(&b, "<li id=\"count-p2\">P2 %d</li>\n", p2)
+	fmt.Fprintf(&b, "<li id=\"count-p3\">P3 %d</li>\n", p3)
+	b.WriteString("</ul>\n</header>\n<div class=\"filters\">\n")
+	b.WriteString("<label>Severity <select id=\"severity\">\n")
+	b.WriteString("<option value=\"\">all</option>\n<option value=\"P0\">P0</option>\n<option value=\"P1\">P1</option>\n<option value=\"P2\">P2</option>\n<option value=\"P3\">P3</option>\n")
+	b.WriteString("</select></label>\n")
+	b.WriteString("<label>Directory <select id=\"directory\">\n<option value=\"\">all</option>\n")
+	for _, d := range findingDirs(p.Findings) {
+		fmt.Fprintf(&b, "<option value=\"%s\">%s</option>\n", html.EscapeString(d), html.EscapeString(d))
+	}
+	b.WriteString("</select></label>\n</div>\n<div id=\"findings\">\n")
+	for _, f := range p.Findings {
+		dir := path.Dir(f.File)
+		quote := ""
+		if p.Files != nil {
+			quote = excerpt(p.Files[f.File], f.StartLine, f.EndLine)
+		}
+		fmt.Fprintf(&b, "<article class=\"finding\" data-severity=\"%s\" data-dir=\"%s\">\n", html.EscapeString(f.Severity), html.EscapeString(dir))
+		fmt.Fprintf(&b, "<button type=\"button\">%s:%d-%d</button>\n", html.EscapeString(f.File), f.StartLine, f.EndLine)
+		b.WriteString("<div class=\"detail\" hidden>\n")
+		fmt.Fprintf(&b, "<p class=\"issue\">%s</p>\n", html.EscapeString(f.Issue))
+		fmt.Fprintf(&b, "<p class=\"consequence\">%s</p>\n", html.EscapeString(f.Consequence))
+		fmt.Fprintf(&b, "<pre class=\"quote\">%s</pre>\n", html.EscapeString(quote))
+		b.WriteString("</div>\n</article>\n")
+	}
+	b.WriteString("</div>\n<script id=\"page\">")
+	b.WriteString(pageScript)
+	b.WriteString("</script>\n</body>\n</html>\n")
+	return []byte(b.String())
+}
diff --git a/internal/sourcereview/page_test.go b/internal/sourcereview/page_test.go
new file mode 100644
index 00000000..370a5f79
--- /dev/null
+++ b/internal/sourcereview/page_test.go
@@ -0,0 +1,261 @@
+package sourcereview
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+func TestRenderFiltersAndQuote(t *testing.T) {
+	files := map[string][]byte{
+		"main.go":    []byte("package main\n"),
+		"pkg/app.go": []byte("alpha\nbeta\n"),
+		"a.go":       []byte("a\n"),
+		"b/c.go":     []byte("c\n"),
+	}
+	findings := []lensoutput.TypedFinding{
+		{Tag: lensoutput.TagBug, File: "main.go", StartLine: 1, EndLine: 1, Issue: "root broke", Consequence: "no entry", Confidence: 90, Severity: "P0"},
+		{Tag: lensoutput.TagAdvisory, File: "pkg/app.go", StartLine: 1, EndLine: 2, Issue: "alpha broke", Consequence: "wrong answer", Confidence: 70, Severity: "P1"},
+		{Tag: lensoutput.TagBug, File: "a.go", StartLine: 1, EndLine: 1, Issue: "a", Consequence: "a", Confidence: 60, Severity: "P2"},
+		{Tag: lensoutput.TagBug, File: "b/c.go", StartLine: 1, EndLine: 1, Issue: "c", Consequence: "c", Confidence: 50, Severity: "P3"},
+	}
+	page := Render(Page{Repo: "/repo", Commit: "abc123", ModelID: "opus", Findings: findings, Files: files})
+	html := string(page)
+	for _, want := range []string{
+		`id="repo">/repo`, `id="commit">abc123`, `id="model">opus`,
+		`id="count-p0">P0 1`, `id="count-p1">P1 1`, `id="count-p2">P2 1`, `id="count-p3">P3 1`,
+		`id="severity"`, `id="directory"`, `value="."`, `value="pkg"`,
+		"root broke", "no entry", "package main", "alpha broke", "wrong answer", "alpha\nbeta",
+	} {
+		if !strings.Contains(html, want) {
+			t.Fatalf("page missing %q", want)
+		}
+	}
+	if strings.Contains(html, "http://") || strings.Contains(html, "https://") || strings.Contains(html, "fetch(") || strings.Contains(html, "<form") || strings.Contains(html, "src=") {
+		t.Fatal("page is not self-contained")
+	}
+	if !strings.Contains(html, `<script id="page">`) {
+		t.Fatal("shipped script missing")
+	}
+	report := runPage(t, page)
+	if report.Counts["p0"] != "P0 1" || report.Counts["p3"] != "P3 1" {
+		t.Fatalf("counts %+v", report.Counts)
+	}
+	// The two findings the filter drives are the first two, which differ in
+	// severity and directory. The harness records what the shipped script did.
+	if len(report.Steps) < 2 {
+		t.Fatalf("steps %+v", report)
+	}
+	sev := report.Steps[0]
+	if sev.Displays[0] != "" || sev.Displays[1] != "none" {
+		t.Fatalf("severity filter displays %v", sev.Displays)
+	}
+	dir := report.Steps[1]
+	if dir.Displays[0] != "" || dir.Displays[1] != "none" {
+		t.Fatalf("directory filter displays %v", dir.Displays)
+	}
+	if report.Opened.Hidden || report.Opened.Issue != "root broke" || report.Opened.Consequence != "no entry" || report.Opened.Quote != "package main" {
+		t.Fatalf("opened %+v", report.Opened)
+	}
+}
+
+func TestRenderEmpty(t *testing.T) {
+	page := Render(Page{Repo: "r", Commit: "c", ModelID: "gpt-6-astra", Findings: nil, Files: nil})
+	html := string(page)
+	for _, id := range []string{"count-p0", "count-p1", "count-p2", "count-p3"} {
+		if !strings.Contains(html, `id="`+id+`">`) || !strings.Contains(html, "0") {
+			t.Fatalf("missing zero %s", id)
+		}
+	}
+	if strings.Contains(html, `class="finding"`) {
+		t.Fatal("empty page has a finding")
+	}
+	if !strings.Contains(html, `id="severity"`) || !strings.Contains(html, `id="directory"`) {
+		t.Fatal("filters missing")
+	}
+	report := runPage(t, page)
+	if report.FindingCount != 0 {
+		t.Fatalf("findings %d", report.FindingCount)
+	}
+	for _, k := range []string{"p0", "p1", "p2", "p3"} {
+		if !strings.HasSuffix(report.Counts[k], " 0") {
+			t.Fatalf("%s = %s", k, report.Counts[k])
+		}
+	}
+}
+
+type pageReport struct {
+	FindingCount int               `json:"findingCount"`
+	Counts       map[string]string `json:"counts"`
+	Steps        []struct {
+		Displays []string `json:"displays"`
+	} `json:"steps"`
+	Opened struct {
+		Hidden      bool   `json:"hidden"`
+		Issue       string `json:"issue"`
+		Consequence string `json:"consequence"`
+		Quote       string `json:"quote"`
+	} `json:"opened"`
+}
+
+func runPage(t *testing.T, page []byte) pageReport {
+	t.Helper()
+	dir := t.TempDir()
+	htmlPath := filepath.Join(dir, "page.html")
+	scriptPath := filepath.Join(dir, "dom.js")
+	if err := os.WriteFile(htmlPath, page, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(scriptPath, []byte(pageHarness), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command("node", scriptPath, htmlPath)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("node: %v\n%s", err, out)
+	}
+	var report pageReport
+	if err := json.Unmarshal(out, &report); err != nil {
+		t.Fatalf("report: %v\n%s", err, out)
+	}
+	return report
+}
+
+const pageHarness = `
+const fs = require("fs");
+const html = fs.readFileSync(process.argv[2], "utf8");
+const m = html.match(/<script id="page">([\s\S]*)<\/script>/);
+if (!m) { console.error("no shipped script"); process.exit(1); }
+const script = m[1];
+
+function decode(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&");
+}
+function parseAttrs(s) {
+  const attrs = {};
+  const re = /([A-Za-z0-9:-]+)(?:\s*=\s*"([^"]*)")?/g;
+  let mm;
+  while ((mm = re.exec(s))) attrs[mm[1]] = decode(mm[2] ?? "");
+  return attrs;
+}
+class El {
+  constructor(name, attrs) {
+    this.name = name;
+    this.attrs = attrs || {};
+    this.children = [];
+    this.parentNode = null;
+    this.style = { display: "" };
+    this.hidden = Object.prototype.hasOwnProperty.call(this.attrs, "hidden");
+    this.value = this.attrs.value || "";
+    this._listeners = {};
+  }
+  getAttribute(k) { return Object.prototype.hasOwnProperty.call(this.attrs, k) ? this.attrs[k] : null; }
+  addEventListener(type, fn) { (this._listeners[type] ||= []).push(fn); }
+  dispatchEvent(type) { for (const fn of this._listeners[type] || []) fn.call(this); }
+  get textContent() { return this.children.map(c => c.textContent || "").join(""); }
+  querySelector(sel) { const a = queryAll(this, sel); return a[0] || null; }
+  querySelectorAll(sel) { return queryAll(this, sel); }
+}
+function classHas(n, c) { return (" " + (n.attrs.class || "") + " ").includes(" " + c + " "); }
+function matchesSimple(n, sel) {
+  if (!n || !n.name) return false;
+  if (sel.startsWith("#")) return n.attrs.id === sel.slice(1);
+  if (sel.startsWith(".")) return classHas(n, sel.slice(1));
+  return n.name === sel;
+}
+function descendants(n) {
+  const out = [];
+  for (const c of n.children || []) {
+    if (!c.name) continue;
+    out.push(c);
+    out.push(...descendants(c));
+  }
+  return out;
+}
+function queryAll(root, sel) {
+  sel = sel.trim();
+  const gt = sel.indexOf(">");
+  if (gt >= 0) {
+    const left = sel.slice(0, gt).trim();
+    const right = sel.slice(gt + 1).trim();
+    const out = [];
+    for (const p of queryAll(root, left)) {
+      for (const c of p.children) if (c.name && matchesSimple(c, right)) out.push(c);
+    }
+    return out;
+  }
+  const parts = sel.split(/\s+/).filter(Boolean);
+  let cur = [root];
+  for (const part of parts) {
+    const next = [];
+    for (const n of cur) for (const d of descendants(n)) if (matchesSimple(d, part)) next.push(d);
+    cur = next;
+  }
+  return cur;
+}
+const voidTags = new Set(["meta", "link", "br", "img", "input"]);
+function parseHTML(src) {
+  const root = new El("#document", {});
+  const stack = [root];
+  const re = /<!DOCTYPE[^>]*>|<!--[\s\S]*?-->|<\/([A-Za-z0-9]+)>|<([A-Za-z0-9]+)([^>]*)>|([^<]+)/g;
+  let mm;
+  while ((mm = re.exec(src))) {
+    if (mm[1]) {
+      const name = mm[1].toLowerCase();
+      while (stack.length > 1 && stack[stack.length - 1].name !== name) stack.pop();
+      if (stack.length > 1) stack.pop();
+    } else if (mm[2]) {
+      const name = mm[2].toLowerCase();
+      const el = new El(name, parseAttrs(mm[3] || ""));
+      const parent = stack[stack.length - 1];
+      parent.children.push(el);
+      el.parentNode = parent;
+      const selfClose = /\/\s*$/.test(mm[3] || "") || voidTags.has(name);
+      if (!selfClose) stack.push(el);
+    } else if (mm[4]) {
+      stack[stack.length - 1].children.push({ textContent: decode(mm[4]), name: "" });
+    }
+  }
+  return root;
+}
+const root = parseHTML(html);
+const document = {
+  getElementById(id) {
+    const hit = descendants(root).filter(n => n.attrs && n.attrs.id === id);
+    return hit[0] || null;
+  },
+  querySelectorAll(sel) { return queryAll(root, sel); },
+};
+try { new Function("document", script)(document); }
+catch (e) { console.error(String(e)); process.exit(1); }
+const findings = document.querySelectorAll("#findings .finding");
+const counts = {};
+for (const id of ["p0", "p1", "p2", "p3"]) counts[id] = document.getElementById("count-" + id).textContent.trim();
+const report = { findingCount: findings.length, counts, steps: [], opened: {} };
+if (findings.length >= 2) {
+  const sev = document.getElementById("severity");
+  sev.value = findings[0].getAttribute("data-severity");
+  sev.dispatchEvent("change");
+  report.steps.push({ displays: findings.map(f => f.style.display) });
+  sev.value = "";
+  const dir = document.getElementById("directory");
+  dir.value = findings[0].getAttribute("data-dir");
+  dir.dispatchEvent("change");
+  report.steps.push({ displays: findings.map(f => f.style.display) });
+  const btn = findings[0].querySelector("button");
+  btn.dispatchEvent("click");
+  const detail = findings[0].querySelector(".detail");
+  report.opened = {
+    hidden: detail.hidden,
+    issue: findings[0].querySelector(".issue").textContent.trim(),
+    consequence: findings[0].querySelector(".consequence").textContent.trim(),
+    quote: findings[0].querySelector(".quote").textContent.trim(),
+  };
+}
+process.stdout.write(JSON.stringify(report));
+`
diff --git a/internal/sourcereview/parse.go b/internal/sourcereview/parse.go
new file mode 100644
index 00000000..bccb20a9
--- /dev/null
+++ b/internal/sourcereview/parse.go
@@ -0,0 +1,228 @@
+package sourcereview
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"path"
+	"strings"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+// wireEntry matches internal/lensoutput.wireEntry: a missing field is a nil
+// pointer. This command fails the run on that pointer; it does not call
+// ValidatePayload.
+type wireEntry struct {
+	Tag         *string `json:"tag"`
+	File        *string `json:"file"`
+	StartLine   *int    `json:"start_line"`
+	EndLine     *int    `json:"end_line"`
+	Issue       *string `json:"issue"`
+	Consequence *string `json:"consequence"`
+	Confidence  *int    `json:"confidence"`
+	Severity    *string `json:"severity"`
+}
+
+// Parse reads model text as {"findings":[...]}. files maps a kept path to its
+// committed bytes so line numbers can be checked against that file. A finding
+// that does not resolve to one kept file is skipped. The skipped messages are
+// the second result. The whole text fails only when it has no findings object.
+func Parse(text string, files map[string][]byte) ([]lensoutput.TypedFinding, []string, error) {
+	body, err := extractFindings(text)
+	if err != nil {
+		return nil, nil, err
+	}
+	var top struct {
+		Findings []json.RawMessage `json:"findings"`
+	}
+	_ = json.Unmarshal([]byte(body), &top)
+	out := make([]lensoutput.TypedFinding, 0, len(top.Findings))
+	var skipped []string
+	for _, raw := range top.Findings {
+		f, err := decodeEntry(raw)
+		if err != nil {
+			skipped = append(skipped, err.Error())
+			continue
+		}
+		if err := f.Validate(); err != nil {
+			skipped = append(skipped, err.Error())
+			continue
+		}
+		kept, err := resolveKept(f.File, files)
+		if err != nil {
+			skipped = append(skipped, err.Error())
+			continue
+		}
+		f.File = kept
+		if f.EndLine > lineCount(files[kept]) {
+			skipped = append(skipped, fmt.Sprintf("line numbers do not exist in %s", f.File))
+			continue
+		}
+		out = append(out, f)
+	}
+	return out, skipped, nil
+}
+
+// resolveKept accepts the path the model wrote. An exact kept path wins.
+// Otherwise a path matches when exactly one kept path ends with "/" plus the
+// citation, so "vite.config.js" means "web/vite.config.js" when that is the
+// only such file. Zero matches or two matches fail the run.
+func resolveKept(cited string, files map[string][]byte) (string, error) {
+	shown := cited
+	cited = strings.ReplaceAll(strings.TrimSpace(cited), "\\", "/")
+	if cited == "" || strings.Contains(cited, "..") {
+		return "", fmt.Errorf("file is not kept: %s", shown)
+	}
+	cited = strings.TrimPrefix(cited, "./")
+	cited = strings.TrimPrefix(cited, "/")
+	cited = path.Clean(cited)
+	if cited == "." {
+		return "", fmt.Errorf("file is not kept: %s", shown)
+	}
+	if _, ok := files[cited]; ok {
+		return cited, nil
+	}
+	match := ""
+	for p := range files {
+		if strings.HasSuffix(p, "/"+cited) {
+			if match != "" {
+				return "", fmt.Errorf("file matches more than one kept path: %s", cited)
+			}
+			match = p
+		}
+	}
+	if match == "" {
+		return "", fmt.Errorf("file is not kept: %s", cited)
+	}
+	return match, nil
+}
+
+func decodeEntry(raw json.RawMessage) (lensoutput.TypedFinding, error) {
+	var w wireEntry
+	if err := json.Unmarshal(raw, &w); err != nil {
+		return lensoutput.TypedFinding{}, fmt.Errorf("finding: %w", err)
+	}
+	if w.Tag == nil || w.File == nil || w.StartLine == nil || w.EndLine == nil ||
+		w.Issue == nil || w.Consequence == nil || w.Confidence == nil || w.Severity == nil {
+		return lensoutput.TypedFinding{}, errors.New("missing field")
+	}
+	return lensoutput.TypedFinding{
+		Tag:         lensoutput.Tag(*w.Tag),
+		File:        *w.File,
+		StartLine:   *w.StartLine,
+		EndLine:     *w.EndLine,
+		Issue:       *w.Issue,
+		Consequence: *w.Consequence,
+		Confidence:  *w.Confidence,
+		Severity:    *w.Severity,
+	}, nil
+}
+
+// extractFindings returns the findings object. A clean object or one fence is
+// preferred. If the model wrote prose around the object, the first JSON value
+// that contains a findings array is used.
+func extractFindings(text string) (string, error) {
+	if body, err := objectText(text); err == nil && findingsObject(body) {
+		return body, nil
+	}
+	for i := 0; i < len(text); i++ {
+		if text[i] != '{' {
+			continue
+		}
+		dec := json.NewDecoder(strings.NewReader(text[i:]))
+		var raw json.RawMessage
+		if err := dec.Decode(&raw); err != nil {
+			continue
+		}
+		if findingsObject(string(raw)) {
+			return string(raw), nil
+		}
+	}
+	if strings.TrimSpace(text) == "" {
+		return "", errors.New("missing model text")
+	}
+	return "", errors.New("missing findings object")
+}
+
+func findingsObject(s string) bool {
+	dec := json.NewDecoder(strings.NewReader(s))
+	var top struct {
+		Findings []json.RawMessage `json:"findings"`
+	}
+	if err := dec.Decode(&top); err != nil || top.Findings == nil {
+		return false
+	}
+	var extra struct{}
+	return errors.Is(dec.Decode(&extra), io.EOF)
+}
+
+// objectText trims surrounding whitespace and, when the text is one fence whose
+// body is the object, returns that body. Any other extra text fails.
+func objectText(text string) (string, error) {
+	s := strings.TrimSpace(text)
+	if s == "" {
+		return "", errors.New("missing model text")
+	}
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	lines := strings.Split(s, "\n")
+	for i := range lines {
+		lines[i] = strings.TrimSuffix(lines[i], "\r")
+	}
+	if strings.HasPrefix(lines[0], "```") {
+		word := strings.TrimSpace(lines[0][3:])
+		if word != "" && !lettersOnly(word) {
+			return "", errors.New("malformed fence")
+		}
+		if len(lines) < 2 || strings.TrimSpace(lines[len(lines)-1]) != "```" {
+			return "", errors.New("malformed fence")
+		}
+		body := strings.TrimSpace(strings.Join(lines[1:len(lines)-1], "\n"))
+		if body == "" {
+			return "", errors.New("missing findings object")
+		}
+		return body, nil
+	}
+	return s, nil
+}
+
+func lettersOnly(s string) bool {
+	for _, r := range s {
+		if r < 'A' || (r > 'Z' && r < 'a') || r > 'z' {
+			return false
+		}
+	}
+	return true
+}
+
+func lineCount(b []byte) int {
+	if len(b) == 0 {
+		return 0
+	}
+	n := bytes.Count(b, []byte("\n"))
+	if b[len(b)-1] != '\n' {
+		n++
+	}
+	return n
+}
+
+func splitLines(body []byte) []string {
+	n := lineCount(body)
+	if n == 0 {
+		return nil
+	}
+	lines := make([]string, 0, n)
+	rest := body
+	for len(lines) < n {
+		i := bytes.IndexByte(rest, '\n')
+		if i < 0 {
+			lines = append(lines, string(rest))
+			break
+		}
+		lines = append(lines, string(rest[:i]))
+		rest = rest[i+1:]
+	}
+	return lines
+}
diff --git a/internal/sourcereview/parse_test.go b/internal/sourcereview/parse_test.go
new file mode 100644
index 00000000..9ae4f04e
--- /dev/null
+++ b/internal/sourcereview/parse_test.go
@@ -0,0 +1,195 @@
+package sourcereview
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+func keptFiles() map[string][]byte {
+	return map[string][]byte{
+		"pkg/app.go": []byte("package pkg\nfunc App() int { return 1 }\n"),
+		"main.go":    []byte("package main\n"),
+	}
+}
+
+func validEntry() string {
+	return `{"tag":"bug","file":"pkg/app.go","start_line":1,"end_line":2,"issue":"off by one","consequence":"wrong answer","confidence":80,"severity":"P1"}`
+}
+
+func TestParseAccepts(t *testing.T) {
+	files := keptFiles()
+	got, _, err := Parse(`{"findings":[]}`, files)
+	if err != nil || len(got) != 0 {
+		t.Fatalf("empty: %v %v", got, err)
+	}
+	got, _, err = Parse(" \n"+`{"findings":[`+validEntry()+"]}\n", files)
+	if err != nil || len(got) != 1 {
+		t.Fatal(err)
+	}
+	if err := got[0].Validate(); err != nil {
+		t.Fatal(err)
+	}
+	if got[0].File != "pkg/app.go" || got[0].StartLine != 1 || got[0].EndLine != 2 || got[0].Confidence != 80 {
+		t.Fatalf("%+v", got[0])
+	}
+	fenced := "```json\n{\"findings\":[" + validEntry() + "]}\n```"
+	if _, _, err := Parse(fenced, files); err != nil {
+		t.Fatal(err)
+	}
+	bare := "```\n{\"findings\":[]}\n```"
+	if _, _, err := Parse(bare, files); err != nil {
+		t.Fatal(err)
+	}
+	crlf := "```json\r\n{\"findings\":[]}\r\n```"
+	if _, _, err := Parse(crlf, files); err != nil {
+		t.Fatal(err)
+	}
+	adv := strings.Replace(validEntry(), `"tag":"bug"`, `"tag":"advisory"`, 1)
+	adv = strings.Replace(adv, `"confidence":80`, `"confidence":0`, 1)
+	adv = strings.Replace(adv, `"severity":"P1"`, `"severity":"P0"`, 1)
+	if _, _, err := Parse(`{"findings":[`+adv+`]}`, files); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestParseRejects(t *testing.T) {
+	files := keptFiles()
+	bad := []string{
+		"",
+		"   ",
+		`{"findings":null}`,
+		`{}`,
+		"```\n```",
+		"```json\nnot json\n```",
+		`not json`,
+		`{not json`,
+	}
+	for _, text := range bad {
+		if _, _, err := Parse(text, files); err == nil {
+			t.Fatalf("accepted %q", text)
+		}
+	}
+	for _, text := range []string{
+		"```json5\n{\"findings\":[]}\n```",
+		"```json\n{\"findings\":[]}",
+		`{"findings":[]} trailing`,
+		`{"nope":1} {"findings":[]}`,
+	} {
+		if _, _, err := Parse(text, files); err != nil {
+			t.Fatalf("object inside fence: %v %q", err, text)
+		}
+	}
+	prose := "The review follows.\n" + `{"findings":[]}` + "\nThanks."
+	if got, _, err := Parse(prose, files); err != nil || len(got) != 0 {
+		t.Fatalf("prose around object: %v %v", got, err)
+	}
+}
+
+func TestParseSkipsBadFindings(t *testing.T) {
+	files := keptFiles()
+	good := validEntry()
+	bad := strings.Replace(validEntry(), `"pkg/app.go"`, `"missing.go"`, 1)
+	got, skipped, err := Parse(`{"findings":[`+good+`,`+bad+`]}`, files)
+	if err != nil || len(got) != 1 || got[0].File != "pkg/app.go" || len(skipped) != 1 {
+		t.Fatalf("got %d skipped %v err %v", len(got), skipped, err)
+	}
+	over := strings.Replace(validEntry(), `"confidence":80`, `"confidence":101`, 1)
+	got, skipped, err = Parse(`{"findings":[`+over+`]}`, files)
+	if err != nil || len(got) != 0 || len(skipped) != 1 {
+		t.Fatalf("confidence 101: got %d skipped %v err %v", len(got), skipped, err)
+	}
+	full := strings.Replace(validEntry(), `"confidence":80`, `"confidence":100`, 1)
+	got, _, err = Parse(`{"findings":[`+full+`]}`, files)
+	if err != nil || got[0].Confidence != 100 || got[0].Tag != lensoutput.TagBug {
+		t.Fatal(err)
+	}
+	line := strings.Replace(validEntry(), `"end_line":2`, `"end_line":9`, 1)
+	if _, skipped, err = Parse(`{"findings":[`+line+`]}`, files); err != nil || len(skipped) != 1 {
+		t.Fatal(err, skipped)
+	}
+	if _, skipped, err = Parse(`{"findings":[1]}`, files); err != nil || len(skipped) != 1 {
+		t.Fatal(err, skipped)
+	}
+	if _, skipped, err = Parse(`{"findings":[{"tag":"bug"}]}`, files); err != nil || len(skipped) != 1 {
+		t.Fatal(err, skipped)
+	}
+}
+
+func TestResolveShortPath(t *testing.T) {
+	files := map[string][]byte{
+		"web/vite.config.js": []byte("export default {}\n"),
+		"pkg/app.go":         []byte("package pkg\n"),
+		"cmd/app.go":         []byte("package cmd\n"),
+	}
+	text := `{"findings":[{"tag":"bug","file":"vite.config.js","start_line":1,"end_line":1,"issue":"i","consequence":"c","confidence":80,"severity":"P1"}]}`
+	got, _, err := Parse(text, files)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got[0].File != "web/vite.config.js" {
+		t.Fatalf("file %s", got[0].File)
+	}
+	dotted := strings.Replace(text, `"vite.config.js"`, `"./web/vite.config.js"`, 1)
+	got, _, err = Parse(dotted, files)
+	if err != nil || got[0].File != "web/vite.config.js" {
+		t.Fatalf("%v %+v", err, got)
+	}
+	slash := strings.Replace(text, `"vite.config.js"`, `"web\\\\vite.config.js"`, 1)
+	got, _, err = Parse(slash, files)
+	if err != nil || got[0].File != "web/vite.config.js" {
+		t.Fatalf("backslash %v %+v", err, got)
+	}
+	short := strings.Replace(text, `"vite.config.js"`, `"app.go"`, 1)
+	if _, skipped, err := Parse(short, files); err != nil || len(skipped) != 1 || !strings.Contains(skipped[0], "more than one") {
+		t.Fatal(err, skipped)
+	}
+	missing := strings.Replace(text, `"vite.config.js"`, `"nope.js"`, 1)
+	if _, skipped, err := Parse(missing, files); err != nil || len(skipped) != 1 || !strings.Contains(skipped[0], "not kept") {
+		t.Fatal(err, skipped)
+	}
+	escape := strings.Replace(text, `"vite.config.js"`, `"../vite.config.js"`, 1)
+	if _, skipped, err := Parse(escape, files); err != nil || len(skipped) != 1 {
+		t.Fatal(err, skipped)
+	}
+	if _, err := resolveKept("  ", files); err == nil {
+		t.Fatal("blank")
+	}
+	if _, err := resolveKept("./", files); err == nil {
+		t.Fatal("dot")
+	}
+}
+
+func TestLineCountAndSplit(t *testing.T) {
+	if lineCount(nil) != 0 || splitLines(nil) != nil {
+		t.Fatal("empty")
+	}
+	if lineCount([]byte("a\n")) != 1 || len(splitLines([]byte("a\n"))) != 1 {
+		t.Fatal("one line")
+	}
+	if lineCount([]byte("a\nb")) != 2 {
+		t.Fatal("no trailing newline")
+	}
+	if lineCount([]byte("\n")) != 1 || splitLines([]byte("\n"))[0] != "" {
+		t.Fatal("blank line")
+	}
+	if lineCount([]byte("\n\n")) != 2 || len(splitLines([]byte("\n\n"))) != 2 {
+		t.Fatal("two blanks")
+	}
+	if excerpt([]byte("a\nb\n"), 1, 2) != "a\nb" {
+		t.Fatal(excerpt([]byte("a\nb\n"), 1, 2))
+	}
+	if excerpt([]byte("a\n"), 0, 1) != "" || excerpt([]byte("a\n"), 1, 3) != "" || excerpt([]byte("a\n"), 2, 1) != "" {
+		t.Fatal("excerpt guards")
+	}
+}
+
+func TestObjectTextFenceWord(t *testing.T) {
+	if _, err := objectText("```JSON\n{\"findings\":[]}\n```"); err != nil {
+		t.Fatal(err)
+	}
+	if lettersOnly("json") != true || lettersOnly("json5") != false || lettersOnly("") != true {
+		t.Fatal("lettersOnly")
+	}
+}
diff --git a/internal/sourcereview/run.go b/internal/sourcereview/run.go
new file mode 100644
index 00000000..0e78fe15
--- /dev/null
+++ b/internal/sourcereview/run.go
@@ -0,0 +1,302 @@
+package sourcereview
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+const usageText = `Usage: metareview source-review --model astra|opus|grok --output <dir> [<repo>]
+
+Reviews the first-party source at HEAD. Prints the kept list and the dropped
+list before any model call. Writes <dir>/findings.json and <dir>/review.html.
+The output directory must be outside the repository.`
+
+var errHelp = errors.New("help")
+
+// Path seams. Production uses the stdlib functions. Tests replace them to
+// cover the error returns filepath and os do not produce on this OS.
+var (
+	pathAbs  = filepath.Abs
+	pathEval = filepath.EvalSymlinks
+	pathRel  = filepath.Rel
+	statPath = os.Stat
+)
+
+// Options is one source-review run. A nil Runner, Git, MkdirAll, WriteFile, or
+// Remove uses the real process, git, or filesystem. Budget 0 means MaxPromptBytes.
+type Options struct {
+	Repo      string
+	Model     string
+	OutputDir string
+	Stdout    io.Writer
+	Stderr    io.Writer
+	Budget    int
+	Runner    Runner
+	Git       GitFunc
+	MkdirAll  func(string, os.FileMode) error
+	WriteFile func(string, []byte, os.FileMode) error
+	Remove    func(string) error
+}
+
+// Run reviews one repository. It writes the findings file and the page only
+// after every prompt succeeds. A failed prompt leaves the output directory empty.
+func Run(opts Options) error {
+	if opts.Stdout == nil {
+		opts.Stdout = io.Discard
+	}
+	if opts.Stderr == nil {
+		opts.Stderr = io.Discard
+	}
+	if strings.TrimSpace(opts.OutputDir) == "" {
+		return errors.New("missing output directory")
+	}
+	modelID, err := ModelID(opts.Model)
+	if err != nil {
+		return err
+	}
+	git := opts.Git
+	if git == nil {
+		git = realGit
+	}
+	top, err := resolveTop(opts.Repo, git)
+	if err != nil {
+		return err
+	}
+	if err := refuseInside(top, opts.OutputDir); err != nil {
+		return err
+	}
+	kept, dropped, commit, err := Select(top, git)
+	if err != nil {
+		return err
+	}
+	writeLists(opts.Stdout, kept, dropped)
+	files := make(map[string][]byte, len(kept))
+	for _, f := range kept {
+		files[f.Path] = f.Body
+	}
+	if len(kept) == 0 {
+		return writeOutputs(opts, top, commit, modelID, nil, files)
+	}
+	budget := opts.Budget
+	if budget == 0 {
+		budget = MaxPromptBytes
+	}
+	prompts, err := Pack(kept, budget)
+	if err != nil {
+		return err
+	}
+	if opts.Runner == nil {
+		return errors.New("no runner")
+	}
+	var all []lensoutput.TypedFinding
+	for _, p := range prompts {
+		fmt.Fprintln(opts.Stdout, "prompt-begin")
+		_, _ = opts.Stdout.Write(p)
+		if len(p) == 0 || p[len(p)-1] != '\n' {
+			fmt.Fprintln(opts.Stdout)
+		}
+		fmt.Fprintln(opts.Stdout, "prompt-end")
+		text, err := Call(opts.Runner, opts.Model, p)
+		if err != nil {
+			return err
+		}
+		got, skipped, err := Parse(text, files)
+		if err != nil {
+			return err
+		}
+		for _, msg := range skipped {
+			fmt.Fprintln(opts.Stderr, msg)
+		}
+		all = append(all, got...)
+	}
+	return writeOutputs(opts, top, commit, modelID, all, files)
+}
+
+func writeLists(w io.Writer, kept []File, dropped []string) {
+	fmt.Fprintln(w, "kept:")
+	for _, f := range kept {
+		fmt.Fprintln(w, f.Path)
+	}
+	fmt.Fprintln(w, "dropped:")
+	for _, p := range dropped {
+		fmt.Fprintln(w, p)
+	}
+}
+
+func writeOutputs(opts Options, repo, commit, modelID string, findings []lensoutput.TypedFinding, files map[string][]byte) error {
+	body := findingsJSON(findings)
+	page := Render(Page{Repo: repo, Commit: commit, ModelID: modelID, Findings: findings, Files: files})
+	mkdir := opts.MkdirAll
+	if mkdir == nil {
+		mkdir = os.MkdirAll
+	}
+	write := opts.WriteFile
+	if write == nil {
+		write = os.WriteFile
+	}
+	remove := opts.Remove
+	if remove == nil {
+		remove = os.Remove
+	}
+	if err := mkdir(opts.OutputDir, 0o755); err != nil {
+		return err
+	}
+	findingsPath := filepath.Join(opts.OutputDir, "findings.json")
+	pagePath := filepath.Join(opts.OutputDir, "review.html")
+	if err := write(findingsPath, body, 0o644); err != nil {
+		return err
+	}
+	if err := write(pagePath, page, 0o644); err != nil {
+		_ = remove(findingsPath)
+		return err
+	}
+	return nil
+}
+
+func findingsJSON(fs []lensoutput.TypedFinding) []byte {
+	if fs == nil {
+		fs = []lensoutput.TypedFinding{}
+	}
+	body, _ := json.Marshal(struct {
+		Findings []lensoutput.TypedFinding `json:"findings"`
+	}{Findings: fs})
+	return append(body, '\n')
+}
+
+func refuseInside(repo, out string) error {
+	repoAbs, outAbs, err := absBoth(repo, out)
+	if err != nil {
+		return err
+	}
+	repoReal, err := pathEval(repoAbs)
+	if err != nil {
+		return err
+	}
+	outReal, err := evalExisting(outAbs)
+	if err != nil {
+		return err
+	}
+	rel, err := pathRel(repoReal, outReal)
+	if err != nil {
+		return err
+	}
+	if insideRel(rel) {
+		return fmt.Errorf("refusing output directory inside the tree under review: %s", out)
+	}
+	return nil
+}
+
+func absBoth(a, b string) (string, string, error) {
+	aa, err := pathAbs(a)
+	if err != nil {
+		return "", "", err
+	}
+	bb, err := pathAbs(b)
+	if err != nil {
+		return "", "", err
+	}
+	return aa, bb, nil
+}
+
+func evalExisting(p string) (string, error) {
+	cur := p
+	var tail []string
+	for {
+		if _, err := statPath(cur); err == nil {
+			real, err := pathEval(cur)
+			if err != nil {
+				return "", err
+			}
+			for i := len(tail) - 1; i >= 0; i-- {
+				real = filepath.Join(real, tail[i])
+			}
+			return real, nil
+		}
+		parent := filepath.Dir(cur)
+		if parent == cur {
+			return "", fmt.Errorf("cannot resolve %s", p)
+		}
+		tail = append(tail, filepath.Base(cur))
+		cur = parent
+	}
+}
+
+func insideRel(rel string) bool {
+	if rel == "." {
+		return true
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return false
+	}
+	return true
+}
+
+// CLI is the source-review command. repo defaults to cwd.
+func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
+	model, out, repo, err := parseArgs(args)
+	if err != nil {
+		if errors.Is(err, errHelp) {
+			fmt.Fprintln(stdout, usageText)
+			return 0
+		}
+		fmt.Fprintln(stderr, err.Error())
+		fmt.Fprintln(stderr, usageText)
+		return 2
+	}
+	if repo == "" {
+		repo = cwd
+	}
+	err = Run(Options{
+		Repo:      repo,
+		Model:     model,
+		OutputDir: out,
+		Stdout:    stdout,
+		Stderr:    stderr,
+		Runner:    OSRunner{},
+	})
+	if err != nil {
+		fmt.Fprintln(stderr, err.Error())
+		return 1
+	}
+	return 0
+}
+
+func parseArgs(args []string) (model, out, repo string, err error) {
+	for i := 0; i < len(args); i++ {
+		a := args[i]
+		switch {
+		case a == "--help" || a == "-h":
+			return "", "", "", errHelp
+		case a == "--model":
+			if i+1 >= len(args) {
+				return "", "", "", errors.New("missing value for --model")
+			}
+			i++
+			model = args[i]
+		case a == "--output":
+			if i+1 >= len(args) {
+				return "", "", "", errors.New("missing value for --output")
+			}
+			i++
+			out = args[i]
+		case strings.HasPrefix(a, "--"):
+			return "", "", "", fmt.Errorf("unknown option: %s", a)
+		default:
+			if repo != "" {
+				return "", "", "", fmt.Errorf("unexpected argument: %s", a)
+			}
+			repo = a
+		}
+	}
+	if model == "" || out == "" {
+		return "", "", "", errors.New("missing --model or --output")
+	}
+	return model, out, repo, nil
+}
diff --git a/internal/sourcereview/run_test.go b/internal/sourcereview/run_test.go
new file mode 100644
index 00000000..fc89d386
--- /dev/null
+++ b/internal/sourcereview/run_test.go
@@ -0,0 +1,565 @@
+package sourcereview
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/dsifry/metareview/internal/lensoutput"
+)
+
+func cliStdout(model, text string) []byte {
+	switch model {
+	case "opus":
+		b, _ := json.Marshal(map[string]any{"is_error": false, "result": text})
+		return b
+	case "grok":
+		b, _ := json.Marshal(map[string]any{"text": text})
+		return b
+	default:
+		quoted, _ := json.Marshal(text)
+		return []byte(`{"type":"item.completed","item":{"type":"agent_message","text":` + string(quoted) + "}}\n")
+	}
+}
+
+func TestRunSpecFixtureThreeModels(t *testing.T) {
+	const sentinel = "super-secret-api-key-9f3a"
+	t.Setenv("ANTHROPIC_API_KEY", sentinel)
+	t.Setenv("OPENAI_API_KEY", sentinel)
+	t.Setenv("XAI_API_KEY", sentinel)
+	root, commit := newRepoBytes(t, specFiles())
+	for _, model := range []string{"opus", "astra", "grok"} {
+		var buf bytes.Buffer
+		var prompts [][]byte
+		fr := &fakeRunner{
+			onRun: func() {
+				out := buf.String()
+				if !strings.Contains(out, "kept:\npkg/app.go\npkg/note.go\n") || !strings.Contains(out, "dropped:\n") {
+					t.Fatalf("%s lists before model call:\n%s", model, out)
+				}
+				idx := strings.Index(out, "prompt-begin")
+				keptAt := strings.Index(out, "kept:")
+				if keptAt < 0 || idx < 0 || keptAt > idx {
+					t.Fatalf("%s kept list is not before the prompt", model)
+				}
+				for _, p := range specDropped {
+					if !strings.Contains(out[:idx], p) {
+						t.Fatalf("%s dropped list missing %s", model, p)
+					}
+				}
+			},
+			reply: func(_ int, name string, args []string, stdin []byte) ([]byte, error) {
+				var prompt []byte
+				if model == "grok" {
+					if stdin != nil {
+						t.Fatal("grok prompt must be an argument")
+					}
+					prompt = []byte(args[1])
+				} else {
+					prompt = stdin
+				}
+				prompts = append(prompts, append([]byte(nil), prompt...))
+				if name == "" {
+					t.Fatal("empty binary")
+				}
+				return cliStdout(model, `{"findings":[]}`), nil
+			},
+		}
+		outDir := t.TempDir()
+		err := Run(Options{Repo: root, Model: model, OutputDir: outDir, Stdout: &buf, Runner: fr})
+		if err != nil {
+			t.Fatal(model, err)
+		}
+		if strings.Contains(buf.String(), sentinel) {
+			t.Fatal("api key leaked into stdout")
+		}
+		if len(prompts) != 1 {
+			t.Fatalf("%s prompts %d", model, len(prompts))
+		}
+		p := prompts[0]
+		if len(p) > MaxPromptBytes {
+			t.Fatalf("%s prompt %d", model, len(p))
+		}
+		if !bytes.Contains(p, []byte(instruction)) || !bytes.Contains(p, []byte(`{"findings":[...]}`)) {
+			t.Fatal("instruction missing")
+		}
+		for path, body := range specFiles() {
+			needle := append([]byte(path+"\n"), body...)
+			has := bytes.Contains(p, needle)
+			if path == "pkg/app.go" || path == "pkg/note.go" {
+				if !has {
+					t.Fatalf("%s prompt missing %s immediately before its text", model, path)
+				}
+			} else if bytes.Contains(p, []byte(path)) || bytes.Contains(p, []byte("DROPME")) {
+				t.Fatalf("%s prompt contains dropped %s", model, path)
+			}
+		}
+		raw, err := os.ReadFile(filepath.Join(outDir, "findings.json"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.TrimSpace(string(raw)) != `{"findings":[]}` {
+			t.Fatalf("findings %s", raw)
+		}
+		page, err := os.ReadFile(filepath.Join(outDir, "review.html"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		html := string(page)
+		id, _ := ModelID(model)
+		for _, want := range []string{id, commit, `id="severity"`, `id="directory"`, "P0 0", "P1 0", "P2 0", "P3 0"} {
+			if !strings.Contains(html, want) {
+				t.Fatalf("%s page missing %q", model, want)
+			}
+		}
+		if strings.Contains(html, `class="finding"`) {
+			t.Fatal("empty findings rendered a finding")
+		}
+		entries, _ := os.ReadDir(outDir)
+		if len(entries) != 2 {
+			t.Fatalf("output entries %d", len(entries))
+		}
+	}
+	srcHasGetenv(t)
+}
+
+func srcHasGetenv(t *testing.T) {
+	t.Helper()
+	ents, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range ents {
+		if !strings.HasSuffix(e.Name(), ".go") || strings.HasSuffix(e.Name(), "_test.go") {
+			continue
+		}
+		b, err := os.ReadFile(e.Name())
+		if err != nil {
+			t.Fatal(err)
+		}
+		if bytes.Contains(b, []byte("Getenv")) || bytes.Contains(b, []byte("API_KEY")) {
+			t.Fatalf("%s reads an API key", e.Name())
+		}
+	}
+}
+
+func TestRunEmptyKeptWritesZeros(t *testing.T) {
+	root, commit := newRepoBytes(t, droppedOnlyFiles())
+	outDir := t.TempDir()
+	var buf bytes.Buffer
+	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		t.Fatal("model called")
+		return nil, nil
+	}}
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &buf, Runner: fr}); err != nil {
+		t.Fatal(err)
+	}
+	if len(fr.calls) != 0 {
+		t.Fatal("model called")
+	}
+	out := buf.String()
+	if !strings.HasPrefix(out, "kept:\ndropped:\n") {
+		t.Fatalf("lists:\n%s", out)
+	}
+	for _, p := range specDropped {
+		if !strings.Contains(out, p+"\n") {
+			t.Fatalf("missing dropped %s", p)
+		}
+	}
+	raw, _ := os.ReadFile(filepath.Join(outDir, "findings.json"))
+	if strings.TrimSpace(string(raw)) != `{"findings":[]}` {
+		t.Fatalf("%s", raw)
+	}
+	page, _ := os.ReadFile(filepath.Join(outDir, "review.html"))
+	html := string(page)
+	for _, want := range []string{commit, "opus", `id="severity"`, `id="directory"`, "P0 0", "P1 0", "P2 0", "P3 0"} {
+		if !strings.Contains(html, want) {
+			t.Fatalf("page missing %s\n%s", want, html)
+		}
+	}
+}
+
+func TestRunMergesPromptOrder(t *testing.T) {
+	files := map[string][]byte{
+		"a.go": bytes.Repeat([]byte("a"), 100000),
+		"b.go": bytes.Repeat([]byte("b"), 50000),
+		"c.go": bytes.Repeat([]byte("c"), 60000),
+	}
+	root, _ := newRepoBytes(t, files)
+	var order []string
+	fr := &fakeRunner{reply: func(_ int, _ string, _ []string, stdin []byte) ([]byte, error) {
+		var path string
+		for _, p := range []string{"a.go", "b.go", "c.go"} {
+			if bytes.Contains(stdin, []byte(p+"\n")) {
+				path = p
+				break
+			}
+		}
+		order = append(order, path)
+		text := `{"findings":[{"tag":"bug","file":"` + path + `","start_line":1,"end_line":1,"issue":"i-` + path + `","consequence":"c","confidence":80,"severity":"P2"}]}`
+		return cliStdout("opus", text), nil
+	}}
+	outDir := t.TempDir()
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Runner: fr}); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := os.ReadFile(filepath.Join(outDir, "findings.json"))
+	var doc struct {
+		Findings []lensoutput.TypedFinding `json:"findings"`
+	}
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatal(err)
+	}
+	if len(doc.Findings) != len(order) {
+		t.Fatalf("findings %d order %v", len(doc.Findings), order)
+	}
+	for i, f := range doc.Findings {
+		if err := f.Validate(); err != nil {
+			t.Fatal(err)
+		}
+		if f.File != order[i] || f.Issue != "i-"+order[i] {
+			t.Fatalf("order[%d]=%s finding %+v", i, order[i], f)
+		}
+		blob, ok := files[f.File]
+		if !ok || f.EndLine > lineCount(blob) {
+			t.Fatal("line missing")
+		}
+		asMap := map[string]any{}
+		one, _ := json.Marshal(f)
+		_ = json.Unmarshal(one, &asMap)
+		if _, ok := asMap["model"]; ok {
+			t.Fatal("model field")
+		}
+	}
+	page, _ := os.ReadFile(filepath.Join(outDir, "review.html"))
+	if !bytes.Contains(page, []byte("opus")) || bytes.Count(page, []byte(`class="finding"`)) != len(order) {
+		t.Fatal("page findings")
+	}
+}
+
+func TestRunFailuresLeaveDirEmpty(t *testing.T) {
+	root, _ := newRepoBytes(t, specFiles())
+	cases := []struct {
+		name  string
+		reply func() ([]byte, error)
+	}{
+		{"nonzero", func() ([]byte, error) { return nil, errors.New("exit status 1") }},
+		{"cannot-start", func() ([]byte, error) { return nil, errors.New("executable file not found") }},
+		{"is-error", func() ([]byte, error) { return []byte(`{"is_error":true,"result":"boom"}`), nil }},
+		{"null", func() ([]byte, error) { return cliStdout("opus", `{"findings":null}`), nil }},
+		{"prose", func() ([]byte, error) { return cliStdout("opus", "There are no findings."), nil }},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			outDir := t.TempDir()
+			before, _ := os.ReadDir(outDir)
+			fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) { return tc.reply() }}
+			err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Runner: fr})
+			if err == nil {
+				t.Fatal("expected error")
+			}
+			after, _ := os.ReadDir(outDir)
+			if len(before) != 0 || len(after) != 0 {
+				t.Fatalf("dir before %d after %d", len(before), len(after))
+			}
+		})
+	}
+}
+
+func TestRunSkipsABadFinding(t *testing.T) {
+	root, _ := newRepoBytes(t, specFiles())
+	var stderr bytes.Buffer
+	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		return cliStdout("opus", `{"findings":[{"tag":"bug","file":"vite.config.js","start_line":1,"end_line":1,"issue":"i","consequence":"c","confidence":10,"severity":"P1"},{"tag":"bug","file":"pkg/app.go","start_line":1,"end_line":1,"issue":"real","consequence":"c","confidence":10,"severity":"P1"}]}`), nil
+	}}
+	outDir := t.TempDir()
+	err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Stderr: &stderr, Runner: fr})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(stderr.String(), "not kept") {
+		t.Fatalf("stderr %q", stderr.String())
+	}
+	raw, err := os.ReadFile(filepath.Join(outDir, "findings.json"))
+	if err != nil || !bytes.Contains(raw, []byte(`"file":"pkg/app.go"`)) || bytes.Contains(raw, []byte("vite.config.js")) {
+		t.Fatalf("%v %s", err, raw)
+	}
+}
+
+func TestRunSecondPromptFails(t *testing.T) {
+	files := map[string][]byte{
+		"a.go": bytes.Repeat([]byte("a"), 100000),
+		"b.go": bytes.Repeat([]byte("b"), 100000),
+	}
+	root, _ := newRepoBytes(t, files)
+	fr := &fakeRunner{reply: func(n int, _ string, _ []string, _ []byte) ([]byte, error) {
+		if n == 0 {
+			return cliStdout("opus", `{"findings":[]}`), nil
+		}
+		return nil, errors.New("exit status 1")
+	}}
+	outDir := t.TempDir()
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Runner: fr}); err == nil {
+		t.Fatal("expected error")
+	}
+	ents, _ := os.ReadDir(outDir)
+	if len(ents) != 0 {
+		t.Fatal("wrote files after a failed prompt")
+	}
+}
+
+func TestRunRefusesInsideAndWritesOutside(t *testing.T) {
+	root, _ := newRepoBytes(t, droppedOnlyFiles())
+	inside := filepath.Join(root, "out")
+	if err := os.MkdirAll(inside, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	err := Run(Options{Repo: root, Model: "opus", OutputDir: inside, Stdout: &bytes.Buffer{}, Runner: OSRunner{}})
+	if err == nil || !strings.Contains(err.Error(), "refusing") {
+		t.Fatal(err)
+	}
+	ents, _ := os.ReadDir(inside)
+	if len(ents) != 0 {
+		t.Fatal("wrote inside the tree")
+	}
+	nested := filepath.Join(t.TempDir(), "nested", "out")
+	if err := Run(Options{Repo: root, Model: "grok", OutputDir: nested, Stdout: ioDiscard(), Runner: &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		t.Fatal("model called")
+		return nil, nil
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(nested, "review.html")); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func ioDiscard() *bytes.Buffer { return &bytes.Buffer{} }
+
+func TestRunSelectError(t *testing.T) {
+	root, _ := newRepoBytes(t, map[string][]byte{"a.go": []byte("package a\n")})
+	git := func(dir string, args []string, stdin []byte) ([]byte, error) {
+		if args[0] == "ls-tree" {
+			return nil, errors.New("ls-tree")
+		}
+		return realGit(dir, args, stdin)
+	}
+	err := Run(Options{Repo: root, Model: "opus", OutputDir: t.TempDir(), Stdout: &bytes.Buffer{}, Git: git, Runner: &fakeRunner{}})
+	if err == nil || !strings.Contains(err.Error(), "ls-tree") {
+		t.Fatal(err)
+	}
+}
+
+func TestRunBudgetAndMissingRunner(t *testing.T) {
+	root, _ := newRepoBytes(t, map[string][]byte{"a.go": []byte("package a\n")})
+	outDir := t.TempDir()
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Budget: -1, Stdout: &bytes.Buffer{}, Runner: &fakeRunner{}}); err == nil {
+		t.Fatal("negative budget")
+	}
+	ents, _ := os.ReadDir(outDir)
+	if len(ents) != 0 {
+		t.Fatal("wrote on pack error")
+	}
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}}); err == nil || !strings.Contains(err.Error(), "no runner") {
+		t.Fatal(err)
+	}
+	if err := Run(Options{Repo: root, Model: "nope", OutputDir: outDir}); err == nil {
+		t.Fatal("bad model")
+	}
+	if err := Run(Options{Repo: root, Model: "opus", Stdout: nil}); err == nil {
+		t.Fatal("missing output")
+	}
+	if err := Run(Options{Repo: t.TempDir(), Model: "opus", OutputDir: outDir, Stdout: nil}); err == nil {
+		t.Fatal("not a repo")
+	}
+}
+
+func TestRunWriteErrors(t *testing.T) {
+	root, _ := newRepoBytes(t, droppedOnlyFiles())
+	outDir := t.TempDir()
+	err := Run(Options{
+		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
+		MkdirAll: func(string, os.FileMode) error { return errors.New("mkdir") },
+	})
+	if err == nil || !strings.Contains(err.Error(), "mkdir") {
+		t.Fatal(err)
+	}
+	err = Run(Options{
+		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
+		WriteFile: func(string, []byte, os.FileMode) error { return errors.New("write") },
+	})
+	if err == nil || !strings.Contains(err.Error(), "write") {
+		t.Fatal(err)
+	}
+	removed := false
+	n := 0
+	err = Run(Options{
+		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
+		WriteFile: func(path string, data []byte, mode os.FileMode) error {
+			n++
+			if n == 2 {
+				return errors.New("page")
+			}
+			return os.WriteFile(path, data, mode)
+		},
+		Remove: func(string) error { removed = true; return nil },
+	})
+	if err == nil || !removed {
+		t.Fatalf("err=%v removed=%v", err, removed)
+	}
+	// real Remove deletes the findings file when the page write fails
+	n = 0
+	err = Run(Options{
+		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
+		WriteFile: func(path string, data []byte, mode os.FileMode) error {
+			n++
+			if strings.HasSuffix(path, "review.html") {
+				return errors.New("page")
+			}
+			return os.WriteFile(path, data, mode)
+		},
+	})
+	if err == nil {
+		t.Fatal("expected page error")
+	}
+	if _, statErr := os.Stat(filepath.Join(outDir, "findings.json")); !os.IsNotExist(statErr) {
+		t.Fatal("findings file left behind")
+	}
+}
+
+func TestRefuseSeams(t *testing.T) {
+	root, _ := newRepoBytes(t, map[string][]byte{"a.go": []byte("package a\n")})
+	out := t.TempDir()
+	prevAbs, prevEval, prevRel, prevStat := pathAbs, pathEval, pathRel, statPath
+	t.Cleanup(func() {
+		pathAbs, pathEval, pathRel, statPath = prevAbs, prevEval, prevRel, prevStat
+	})
+	pathAbs = func(string) (string, error) { return "", errors.New("abs") }
+	if err := refuseInside(root, out); err == nil {
+		t.Fatal("abs1")
+	}
+	n := 0
+	pathAbs = func(p string) (string, error) {
+		n++
+		if n == 2 {
+			return "", errors.New("abs2")
+		}
+		return prevAbs(p)
+	}
+	if err := refuseInside(root, out); err == nil {
+		t.Fatal("abs2")
+	}
+	pathAbs = prevAbs
+	pathEval = func(string) (string, error) { return "", errors.New("eval") }
+	if err := refuseInside(root, out); err == nil {
+		t.Fatal("eval repo")
+	}
+	calls := 0
+	pathEval = func(p string) (string, error) {
+		calls++
+		if calls > 1 {
+			return "", errors.New("eval out")
+		}
+		return prevEval(p)
+	}
+	if err := refuseInside(root, out); err == nil {
+		t.Fatal("eval out")
+	}
+	pathEval = prevEval
+	pathRel = func(string, string) (string, error) { return "", errors.New("rel") }
+	if err := refuseInside(root, out); err == nil {
+		t.Fatal("rel")
+	}
+	pathRel = prevRel
+	statPath = func(string) (os.FileInfo, error) { return nil, errors.New("stat") }
+	if _, err := evalExisting(out); err == nil {
+		t.Fatal("stat walk")
+	}
+	if !insideRel(".") || insideRel("..") || insideRel("../x") || !insideRel("foo") {
+		t.Fatal("insideRel")
+	}
+}
+
+func TestPromptWithoutTrailingNewline(t *testing.T) {
+	root, _ := newRepoBytes(t, map[string][]byte{"nonl.go": []byte("package nonl")})
+	var buf bytes.Buffer
+	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		return cliStdout("opus", `{"findings":[]}`), nil
+	}}
+	outDir := t.TempDir()
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &buf, Runner: fr}); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(buf.String(), "prompt-end\n") {
+		t.Fatalf("prompt marker missing:\n%s", buf.String())
+	}
+	if !bytes.Contains(fr.calls[0].stdin, []byte("nonl.go\npackage nonl")) {
+		t.Fatal("path not immediately before text")
+	}
+}
+
+func TestCLI(t *testing.T) {
+	code, _ := cliCapture(t, "", "--help")
+	if code != 0 {
+		t.Fatal(code)
+	}
+	code, errOut := cliCapture(t, "", "-h")
+	if code != 0 || errOut != "" {
+		t.Fatalf("h code=%d err=%q", code, errOut)
+	}
+	for _, args := range [][]string{
+		{},
+		{"--model"},
+		{"--output"},
+		{"--model", "opus"},
+		{"--output", t.TempDir()},
+		{"--nope"},
+		{"--model", "opus", "--output", t.TempDir(), "extra", "more"},
+	} {
+		code, errOut = cliCapture(t, "", args...)
+		if code != 2 || errOut == "" {
+			t.Fatalf("args %v code=%d err=%q", args, code, errOut)
+		}
+	}
+	root, commit := newRepoBytes(t, droppedOnlyFiles())
+	outDir := t.TempDir()
+	code, errOut = cliCapture(t, root, "--model", "opus", "--output", outDir)
+	if code != 0 || errOut != "" {
+		t.Fatalf("cli code=%d err=%q", code, errOut)
+	}
+	page, err := os.ReadFile(filepath.Join(outDir, "review.html"))
+	if err != nil || !bytes.Contains(page, []byte(commit)) {
+		t.Fatal(err)
+	}
+	code, errOut = cliCapture(t, root, "--model", "opus", "--output", root)
+	if code != 1 || !strings.Contains(errOut, "refusing") {
+		t.Fatalf("refuse code=%d err=%q", code, errOut)
+	}
+}
+
+func cliCapture(t *testing.T, cwd string, args ...string) (int, string) {
+	t.Helper()
+	if cwd == "" {
+		cwd = t.TempDir()
+	}
+	var stdout, stderr bytes.Buffer
+	code := CLI(args, cwd, &stdout, &stderr)
+	return code, stderr.String()
+}
+
+func TestFindingsJSONNil(t *testing.T) {
+	if strings.TrimSpace(string(findingsJSON(nil))) != `{"findings":[]}` {
+		t.Fatal(findingsJSON(nil))
+	}
+	body := findingsJSON([]lensoutput.TypedFinding{{
+		Tag: lensoutput.TagBug, File: "a.go", StartLine: 1, EndLine: 1,
+		Issue: "i", Consequence: "c", Confidence: 1, Severity: "P3",
+	}})
+	if !bytes.Contains(body, []byte(`"severity":"P3"`)) || bytes.Contains(body, []byte(`"model"`)) {
+		t.Fatalf("%s", body)
+	}
+}
diff --git a/internal/sourcereview/select.go b/internal/sourcereview/select.go
new file mode 100644
index 00000000..188df801
--- /dev/null
+++ b/internal/sourcereview/select.go
@@ -0,0 +1,150 @@
+package sourcereview
+
+import (
+	"regexp"
+	"sort"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+
+	"github.com/dsifry/metareview/internal/claimcheck"
+	"github.com/dsifry/metareview/internal/classify"
+)
+
+// File is one kept source file. Body is the committed blob, untrimmed.
+type File struct {
+	Path string
+	Body []byte
+}
+
+// generatedLine is the Go generated-file marker. A line that only says
+// "DO NOT EDIT" does not match.
+var generatedLine = regexp.MustCompile(`^// Code generated .* DO NOT EDIT\.$`)
+
+// Select lists HEAD blobs and splits them into kept first-party source and
+// everything this command drops. Classify is unchanged: config and docs are
+// still Code/Config/Docs for the diff review; this command drops Config and Docs.
+func Select(root string, git GitFunc) (kept []File, dropped []string, commit string, err error) {
+	if git == nil {
+		git = realGit
+	}
+	top, err := resolveTop(root, git)
+	if err != nil {
+		return nil, nil, "", err
+	}
+	head, err := git(top, []string{"rev-parse", "HEAD"}, nil)
+	if err != nil {
+		return nil, nil, "", err
+	}
+	commit = strings.TrimSpace(string(head))
+	tree, err := git(top, []string{"ls-tree", "-r", "-z", "HEAD"}, nil)
+	if err != nil {
+		return nil, nil, "", err
+	}
+	paths, err := parseTree(tree)
+	if err != nil {
+		return nil, nil, "", err
+	}
+	blobs, err := readBlobs(top, paths, git)
+	if err != nil {
+		return nil, nil, "", err
+	}
+	for _, p := range paths {
+		body := blobs[p]
+		if keepPath(p, body) {
+			kept = append(kept, File{Path: p, Body: body})
+		} else {
+			dropped = append(dropped, p)
+		}
+	}
+	sort.Slice(kept, func(i, j int) bool { return kept[i].Path < kept[j].Path })
+	sort.Strings(dropped)
+	return kept, dropped, commit, nil
+}
+
+// keepPath is the whole-repo cut. An unrecognised path is still Code to Classify
+// and is kept when the other cuts do not apply.
+func keepPath(p string, body []byte) bool {
+	if classify.Classify(p) != classify.Code {
+		return false
+	}
+	if claimcheck.IsTestPath(p) {
+		return false
+	}
+	if vendored(p) {
+		return false
+	}
+	if !utf8.Valid(body) {
+		return false
+	}
+	if isGenerated(body) {
+		return false
+	}
+	return true
+}
+
+func vendored(p string) bool {
+	for _, s := range strings.Split(p, "/") {
+		switch s {
+		case "vendor", "node_modules", "third_party":
+			return true
+		}
+	}
+	return false
+}
+
+// isGenerated reports whether a line matches the generated marker and every
+// line before that match is blank or a comment.
+func isGenerated(body []byte) bool {
+	inBlock := false
+	allComment := true
+	for _, line := range strings.Split(string(body), "\n") {
+		line = strings.TrimSuffix(line, "\r")
+		if allComment && generatedLine.MatchString(line) {
+			return true
+		}
+		comment, next := classifyLine(line, inBlock)
+		inBlock = next
+		if !comment {
+			allComment = false
+		}
+	}
+	return false
+}
+
+// classifyLine reports whether line has no code outside a comment, and whether
+// a block comment remains open. A blank line is a comment line. A line whose
+// first non-whitespace characters are // is a comment line. /* opens a block
+// and */ closes it. Code before /* or after */ means the line is not a comment,
+// and the block still runs from /* to */.
+func classifyLine(line string, inBlock bool) (comment bool, still bool) {
+	code := false
+	i := 0
+	for i < len(line) {
+		if inBlock {
+			j := strings.Index(line[i:], "*/")
+			if j < 0 {
+				return !code, true
+			}
+			i += j + 2
+			inBlock = false
+			continue
+		}
+		r, size := utf8.DecodeRuneInString(line[i:])
+		if unicode.IsSpace(r) {
+			i += size
+			continue
+		}
+		if strings.HasPrefix(line[i:], "//") {
+			return !code, false
+		}
+		if strings.HasPrefix(line[i:], "/*") {
+			inBlock = true
+			i += 2
+			continue
+		}
+		code = true
+		i += size
+	}
+	return !code, inBlock
+}
diff --git a/internal/sourcereview/select_test.go b/internal/sourcereview/select_test.go
new file mode 100644
index 00000000..a1b4a556
--- /dev/null
+++ b/internal/sourcereview/select_test.go
@@ -0,0 +1,330 @@
+package sourcereview
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestSelectSpecFixture(t *testing.T) {
+	root, commit := newRepoBytes(t, specFiles())
+	kept, dropped, gotCommit, err := Select(root, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotCommit != commit {
+		t.Fatalf("commit %s want %s", gotCommit, commit)
+	}
+	var paths []string
+	for _, f := range kept {
+		paths = append(paths, f.Path)
+		if !bytes.Equal(f.Body, specFiles()[f.Path]) {
+			t.Fatalf("%s body = %q", f.Path, f.Body)
+		}
+	}
+	if !reflect.DeepEqual(paths, []string{"pkg/app.go", "pkg/note.go"}) {
+		t.Fatalf("kept %v", paths)
+	}
+	if !reflect.DeepEqual(dropped, specDropped) {
+		t.Fatalf("dropped %v", dropped)
+	}
+}
+
+func TestSelectDroppedOnlyFixture(t *testing.T) {
+	root, _ := newRepoBytes(t, droppedOnlyFiles())
+	kept, dropped, _, err := Select(root, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(kept) != 0 {
+		t.Fatalf("kept %v", kept)
+	}
+	if !reflect.DeepEqual(dropped, specDropped) {
+		t.Fatalf("dropped %v", dropped)
+	}
+}
+
+func TestSelectEdges(t *testing.T) {
+	files := map[string][]byte{
+		"node_modules/x.go":    []byte("package x\n"),
+		"third_party/y.go":     []byte("package y\n"),
+		"internal/foo_test.go": []byte("package internal\n"),
+		"fixtures/a.go":        []byte("package fixtures\nfunc A() {}\n"),
+		"pkg/after_code.go":    []byte("package pkg\n// Code generated by x. DO NOT EDIT.\n"),
+		"pkg/after_comment.go": []byte("\n// header\n// Code generated by x. DO NOT EDIT.\npackage pkg\n"),
+		"pkg/block.go":         []byte("/*\n header\n*/\n// Code generated by x. DO NOT EDIT.\npackage pkg\n"),
+		"pkg/code_block.go":    []byte("x := 1 /* comment\n*/\n// Code generated by x. DO NOT EDIT.\n"),
+		"pkg/after_close.go":   []byte("/* c */ code\n// Code generated by x. DO NOT EDIT.\n"),
+		"pkg/not_marker.go":    []byte("// Code generated by x. DO NOT EDIT. extra\npackage pkg\n"),
+		"pkg/crlf.go":          []byte("// note\r\n// Code generated by x. DO NOT EDIT.\r\n"),
+		"Gemfile.lock":         []byte("GEM\n"),
+		"pkg/empty.go":         {},
+		"pkg/nbsp.go":          []byte("\u00a0// comment\n世\n"),
+	}
+	root, _ := newRepoBytes(t, files)
+	kept, dropped, _, err := Select(root, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantKept := []string{"fixtures/a.go", "pkg/after_close.go", "pkg/after_code.go", "pkg/code_block.go", "pkg/empty.go", "pkg/nbsp.go", "pkg/not_marker.go"}
+	var got []string
+	for _, f := range kept {
+		got = append(got, f.Path)
+	}
+	if !reflect.DeepEqual(got, wantKept) {
+		t.Fatalf("kept %v\ndropped %v", got, dropped)
+	}
+}
+
+func TestClassifyLine(t *testing.T) {
+	cases := []struct {
+		line    string
+		in      bool
+		comment bool
+		still   bool
+	}{
+		{"", false, true, false},
+		{"   \t", false, true, false},
+		{"// hi", false, true, false},
+		{"  // hi", false, true, false},
+		{"code // hi", false, false, false},
+		{"/* c */", false, true, false},
+		{"/* c", false, true, true},
+		{"still", true, true, true},
+		{"*/", true, true, false},
+		{"*/ code", true, false, false},
+		{"code /* c", false, false, true},
+		{"a /* b */ c", false, false, false},
+		{"/* a */ // tail", false, true, false},
+		{"/*/", false, true, true},
+		{"/**/", false, true, false},
+		{"世", false, false, false},
+	}
+	for _, tc := range cases {
+		comment, still := classifyLine(tc.line, tc.in)
+		if comment != tc.comment || still != tc.still {
+			t.Errorf("%q in=%v -> comment=%v still=%v, want %v %v", tc.line, tc.in, comment, still, tc.comment, tc.still)
+		}
+	}
+}
+
+func TestVendored(t *testing.T) {
+	if !vendored("vendor/lib.go") || !vendored("a/node_modules/b.go") || !vendored("third_party/c.go") {
+		t.Fatal("expected vendor segments")
+	}
+	if vendored("pkg/app.go") || vendored("notvendor/a.go") {
+		t.Fatal("unexpected vendor")
+	}
+}
+
+func TestSelectNotARepo(t *testing.T) {
+	if _, _, _, err := Select(t.TempDir(), nil); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestSelectNoCommit(t *testing.T) {
+	root := t.TempDir()
+	gitRun(t, root, "init", "-b", "main")
+	if _, _, _, err := Select(root, nil); err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestSelectEmptyCommit(t *testing.T) {
+	root := t.TempDir()
+	gitRun(t, root, "init", "-b", "main")
+	gitRun(t, root, "config", "user.email", "t@example.com")
+	gitRun(t, root, "config", "user.name", "Test")
+	gitRun(t, root, "commit", "--allow-empty", "-m", "empty")
+	kept, dropped, commit, err := Select(root, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if commit == "" || len(kept) != 0 || len(dropped) != 0 {
+		t.Fatalf("kept=%v dropped=%v commit=%q", kept, dropped, commit)
+	}
+}
+
+func TestParseTree(t *testing.T) {
+	in := []byte("\x00100644 blob abc\tfile.go\x00120000 blob def\tlink\x00160000 commit zzz\tsub\x00100644 blob hash\t\x00")
+	paths, err := parseTree(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(paths, []string{"file.go", "link"}) {
+		t.Fatalf("%v", paths)
+	}
+	if _, err := parseTree([]byte("no-tab\x00")); err == nil {
+		t.Fatal("expected bad record")
+	}
+	if _, err := parseTree([]byte("only\tpath\x00")); err == nil {
+		t.Fatal("expected bad meta")
+	}
+}
+
+func TestParseBatch(t *testing.T) {
+	body := []byte("hello")
+	var buf bytes.Buffer
+	buf.WriteString("abc blob 5\n")
+	buf.Write(body)
+	buf.WriteByte('\n')
+	got, err := parseBatch(buf.Bytes(), []string{"a.go"})
+	if err != nil || !bytes.Equal(got["a.go"], body) {
+		t.Fatalf("%v %q", err, got["a.go"])
+	}
+	empty, err := parseBatch([]byte("abc blob 0\n\n"), []string{"e.go"})
+	if err != nil || len(empty["e.go"]) != 0 {
+		t.Fatalf("empty: %v %q", err, empty["e.go"])
+	}
+	if _, err := parseBatch(nil, []string{"a"}); err == nil {
+		t.Fatal("short header")
+	}
+	if _, err := parseBatch([]byte("abc missing\n"), []string{"a"}); err == nil {
+		t.Fatal("missing blob")
+	}
+	if _, err := parseBatch([]byte("abc blob zz\n"), []string{"a"}); err == nil {
+		t.Fatal("bad size")
+	}
+	if _, err := parseBatch([]byte("abc blob 1\nXY"), []string{"a"}); err == nil {
+		t.Fatal("missing newline")
+	}
+	if _, err := parseBatch([]byte("abc blob -1\n"), []string{"a"}); err == nil {
+		t.Fatal("negative size")
+	}
+}
+
+func TestReadBlobsErrors(t *testing.T) {
+	git := func(string, []string, []byte) ([]byte, error) {
+		t.Fatal("git should not run")
+		return nil, nil
+	}
+	if _, err := readBlobs(".", []string{"a\nb"}, git); err == nil {
+		t.Fatal("newline path")
+	}
+	boom := func(string, []string, []byte) ([]byte, error) {
+		return nil, errors.New("git down")
+	}
+	if _, err := readBlobs(".", []string{"a.go"}, boom); err == nil {
+		t.Fatal("git error")
+	}
+	if files, err := readBlobs(".", nil, boom); err != nil || len(files) != 0 {
+		t.Fatalf("empty paths: %v %v", files, err)
+	}
+}
+
+func TestRealGitCannotStart(t *testing.T) {
+	prev := gitBin
+	gitBin = "no-such-git-binary-xyz"
+	t.Cleanup(func() { gitBin = prev })
+	if _, err := realGit(t.TempDir(), []string{"rev-parse", "HEAD"}, nil); err == nil {
+		t.Fatal("expected start failure")
+	}
+}
+
+func TestSelectFromSubdir(t *testing.T) {
+	root, commit := newRepoBytes(t, specFiles())
+	sub := filepath.Join(root, "pkg")
+	kept, _, got, err := Select(sub, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != commit || len(kept) != 2 {
+		t.Fatalf("kept %d commit %s", len(kept), got)
+	}
+}
+
+func TestSelectGitCommandErrors(t *testing.T) {
+	git := func(_ string, args []string, _ []byte) ([]byte, error) {
+		switch args[0] {
+		case "rev-parse":
+			if args[1] == "--show-toplevel" {
+				return []byte("/repo\n"), nil
+			}
+			return []byte("abc\n"), nil
+		case "ls-tree":
+			return nil, errors.New("ls-tree")
+		default:
+			return nil, errors.New("unexpected")
+		}
+	}
+	if _, _, _, err := Select("/repo", git); err == nil {
+		t.Fatal("ls-tree")
+	}
+	git = func(_ string, args []string, _ []byte) ([]byte, error) {
+		switch args[0] {
+		case "rev-parse":
+			if args[1] == "--show-toplevel" {
+				return []byte("/repo\n"), nil
+			}
+			return []byte("abc\n"), nil
+		case "ls-tree":
+			return []byte("100644 blob abc\ta.go\x00"), nil
+		default:
+			return nil, errors.New("cat-file")
+		}
+	}
+	if _, _, _, err := Select("/repo", git); err == nil {
+		t.Fatal("cat-file")
+	}
+}
+
+func TestSelectBadTree(t *testing.T) {
+	git := func(_ string, args []string, _ []byte) ([]byte, error) {
+		if args[0] == "rev-parse" && args[1] == "--show-toplevel" {
+			return []byte("/repo\n"), nil
+		}
+		if args[0] == "rev-parse" {
+			return []byte("abc\n"), nil
+		}
+		return []byte("no-tab\x00"), nil
+	}
+	if _, _, _, err := Select("/repo", git); err == nil {
+		t.Fatal("expected bad tree")
+	}
+}
+
+func TestKeepPathInvalidUTF8(t *testing.T) {
+	if keepPath("pkg/a.go", []byte{0xff}) {
+		t.Fatal("invalid utf-8 kept")
+	}
+	if !keepPath("pkg/a.go", []byte("package pkg\n")) {
+		t.Fatal("code dropped")
+	}
+	if keepPath("README.md", []byte("hi\n")) {
+		t.Fatal("docs kept")
+	}
+}
+
+func TestIsGeneratedBareDoNotEdit(t *testing.T) {
+	if isGenerated([]byte("DO NOT EDIT\n")) {
+		t.Fatal("bare DO NOT EDIT matched")
+	}
+	if !isGenerated([]byte("// Code generated by x. DO NOT EDIT.\n")) {
+		t.Fatal("marker did not match")
+	}
+	if isGenerated([]byte("package p\n")) {
+		t.Fatal("plain code matched")
+	}
+}
+
+func TestResolveTopTrims(t *testing.T) {
+	root, _ := newRepoBytes(t, map[string][]byte{"a.go": []byte("package a\n")})
+	top, err := resolveTop(root, realGit)
+	if err != nil || top != root && !strings.HasPrefix(top, root) {
+		// macOS may resolve /var -> /private/var; accept either the temp dir or its eval.
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if top == "" {
+		t.Fatal("empty top")
+	}
+	if _, err := os.Stat(filepath.Join(top, "a.go")); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/metareview-whole-repo-source-review-goal.md b/metareview-whole-repo-source-review-goal.md
new file mode 100644
index 00000000..4e6404b7
--- /dev/null
+++ b/metareview-whole-repo-source-review-goal.md
@@ -0,0 +1,265 @@
+# Whole-repo source review
+
+<!-- CODING-GOAL-BEGIN -->
+
+/goal Add a whole-repo source review to /Users/ben/code/metareview.
+
+This file is the contract. Do not edit it during the walk. Scores, the
+session id, and evidence paths go in
+/Users/ben/code/metareview/metareview-whole-repo-source-review-progress.md.
+Create that progress file at the start. A new session starts at the first
+checkpoint. Do not resume an older progress file unless Ben points at it.
+
+## Authority
+
+Repository: /Users/ben/code/metareview. Origin is
+https://github.com/benkruger/metareview. Upstream is
+https://github.com/dsifry/metareview.
+
+This goal is the approval to implement this scope. Do not commit, push, or
+open a pull request.
+
+Read docs/ARCHITECTURE.md before writing code. Leave the diff review and
+its anchor gate alone. This run is a separate command.
+
+## Outcome
+
+A run reviews the first-party source of a repository. It keeps the files the
+project builds or runs as the product. It drops tests, vendored and
+third-party dependencies, lockfiles, generated code, documentation, and
+configuration. It prints the kept list and the dropped list before any model
+call.
+
+`internal/classify` frames a path as code, config, or docs and still sends
+all three to review (`internal/classify/classify.go`). Leave that behavior
+in place. This cut drops a path when `Classify` returns Config or Docs.
+That drops lockfiles, configuration, and documentation, including the
+lockfile names in `configBase`.
+
+It drops a path when `claimcheck.IsTestPath` is true
+(`internal/claimcheck/claimcheck.go`). `internal/foo_test.go` is Code to
+`Classify` and a test to `IsTestPath`.
+
+It drops a path whose segments include `vendor`, `node_modules`, or
+`third_party`.
+
+It drops a file with a line matching
+`^// Code generated .* DO NOT EDIT\.$` when every line before that
+match is blank or a comment. A blank line is a comment line. A line whose first non-whitespace
+characters are `//` is a comment line, and the rest of that line is the
+comment. A `/*` starts a block and `*/` ends it. A line with no code
+outside that block is a comment line. A line with code before `/*` or
+code after `*/` is not a comment line. The block still runs from `/*`
+to `*/` on the following lines.
+A line that only says `DO NOT EDIT` does not match and the file is
+kept. It drops a file that is not valid UTF-8. `Classify` calls an
+unrecognised path Code.
+
+`gitcontext.generatedExcludedFiles` stays the path exclude for
+metareview's own artifacts. The whole-repo cut is a new selection in
+front of this run.
+
+The user picks Astra, Opus, or Grok. One function runs all three. It
+reads the kept files, sends one or more prompts, and parses
+`lensoutput.TypedFinding`. The prompt text and the parser stay the
+same for every choice. The choice changes only the CLI and the model
+id. Each CLI is the subscription already logged in. The run never sees
+a token. Do not add an HTTP provider or an API key.
+
+Each prompt contains the instruction, then each kept path on its own
+line immediately before that file's text. A dropped file never appears.
+The instruction tells the model to return only `{"findings":[...]}`,
+with `tag` of `bug` or `advisory`, `severity` of `P0`, `P1`, `P2`, or
+`P3`, and every field present: `tag`, `file`, `start_line`, `end_line`,
+`issue`, `consequence`, `confidence`, `severity`. `confidence` is an
+integer from 0 to 100. The whole prompt, which is the instruction, the
+path lines, and the file text, is at most 120,000 bytes. `AGENTS.md` uses 120,000 bytes as the size that
+cannot be held in one review context. Whole kept files are packed into
+the smallest number of prompts that stay under that size. A kept file
+that cannot fit in one prompt is cut into
+consecutive byte slices that partition the file in order. Each slice
+is non-empty and starts and ends on a UTF-8 character boundary. Each
+slice prompt names the original path and the line
+that contains the slice's first byte, tells the model that citations
+use original line numbers, and the whole slice prompt is at most
+120,000 bytes. A finding cites the original path and the original line
+numbers. The findings file is one `{"findings":[...]}` whose array is
+every accepted finding from every prompt, in order. It is not the raw
+answers glued together. The page is still one page. The counts are the
+number of findings for each of `P0`, `P1`, `P2`, and `P3`.
+
+- Opus is `claude` with model id `opus`.
+- Astra is `codex` with model id `gpt-6-astra`. The live Astra command
+  passes it to `-m`. If the CLI rejects it, stop and record the CLI's
+  error.
+- Grok is `grok` with model id `grok-4.7`. That is the default
+  `grok models` prints.
+
+`claude` takes `-p`, `--model`, and `--output-format json`, and reads
+the prompt on stdin. Its stdout is one JSON document. The model text
+is the `result` string (`claudeResult` in
+`internal/fsm/judge/claude.go`). `codex` takes `exec`, `--json`, and
+`-m`, reads the prompt on stdin, and the argv includes `-`. Its stdout
+is a JSON event stream. The model text is `item.text` of the last
+`item.completed` event whose `item.type` is `agent_message`
+(`parseCodexEvents` in `internal/fsm/judge/codex.go`). `grok` takes
+`-p`, `-m`, and `--output-format json`, and `-p` takes the prompt as
+its argument. Its stdout is one JSON document. The model text is the
+`text` string in its JSON output. Use those flags.
+Do not invent flags. The parser reads that model text as `{"findings":[...]}`. Surrounding
+whitespace is ignored. A surrounding fence is a first line of three
+backticks, optionally followed by one word of letters, and a last line
+of three backticks. When the body of that fence is the object, the
+parser uses the body. Any other extra text fails the run. Each
+element is unmarshaled as `wireEntry`
+(`internal/lensoutput/lensoutput.go`). An element that does not
+unmarshal fails the run. A missing field is a nil pointer and fails
+the run. A present element must then pass
+`TypedFinding.Validate`. The path must be a kept file, and the line
+numbers must exist in that file. This run does not call
+`ValidatePayload`. An empty answer is `{"findings":[]}`.
+`{"findings":null}`, a CLI error, missing model text, a missing field,
+or text that is not that object fails the run. A CLI error is a
+process that cannot start, a non-zero exit status, or `is_error` true
+on the Claude document. It is not stored as an empty list. One failed prompt fails the run.
+That run writes neither the findings file nor the page. When no file
+is kept, the run still prints the kept list and the dropped list,
+calls no model, and writes `{"findings":[]}` and the page. The page
+shows that run's commit, the chosen model id, both filters, and four
+zero counts.
+
+`internal/shardpack` and `review-lenses` stay on diff reviews. A finding
+in this run is a `lensoutput.TypedFinding`: tag, file, start_line,
+end_line, issue, consequence, confidence, severity. The cited range
+must fall inside a kept file. The page quotes those lines from the
+file. That quote is the excerpt. It is not a schema field. The page
+shows which model ran. The finding record does not carry a model field.
+
+The output directory is an argument. The proof points it outside the
+fixture. The run refuses an output directory inside the tree under review.
+
+- A findings file.
+- One self-contained HTML file. It opens in a browser with no server and no
+  sibling assets. It shows the repo, commit, model, and counts. Findings
+  filter by severity and by the directory component of `file`. A file
+  in the repo root has parent `.`. Opening a
+  finding shows the
+  issue and consequence beside the quoted lines. The page does not modify
+  the repo, post anywhere, or start another review.
+
+A fake exec proves the call shape for all three. For each one it
+records the binary, the model id, where the prompt was passed, and that
+every prompt contains the instruction and names each kept path before
+that file's text, and contains no dropped file. The whole prompt is at
+most 120,000 bytes. One test packs kept files that do not fit in one
+prompt and shows more than one prompt, each file whole, each prompt at
+most 120,000 bytes. Another test feeds one kept file that does not fit
+in one prompt and shows consecutive non-empty byte slices that
+partition the file on UTF-8 character boundaries, with findings citing
+the original path and original line numbers. A parser test accepts `{"findings":[]}`, accepts an entry with all
+eight fields present that passes `Validate`, and rejects
+`{"findings":null}`, a missing `confidence`, a CLI error, missing model
+text, and an entry that fails `Validate`. A non-zero exit, Claude `is_error` true, and a process that cannot
+start each write neither file. The output directory is empty before
+the failure and still empty after it.
+A renderer test loads two findings with different severities and
+directories, the directory being the directory component of `file`,
+and shows the
+severity filter and the directory filter each
+hide the finding that does not match. The same page shows the `P0`,
+`P1`, `P2`, and `P3` counts, and those counts match the findings. No
+API key is read.
+
+The goal is not done on a fake exec. Three live commands run Astra,
+Opus, and Grok against the fixture. Each command writes to its own
+output directory. Each prompt asks for
+`{"findings":[...]}`. The only source text in each prompt is
+`pkg/app.go` and `pkg/note.go`, and each path is printed before that
+file's text. Each command prints the kept list and the dropped list
+before the model call. Each command writes a findings file and an HTML
+page from that model's answer. Each page shows that model id, the
+fixture commit, both filters, and the `P0`, `P1`, `P2`, and `P3`
+counts, and those counts match the findings. An empty `findings` list
+shows no findings and four zero counts. A mock run does not satisfy
+this.
+
+## Checkpoints
+
+Record Pass or Fail in the progress file only. A later checkpoint starts
+only after every earlier one is Pass. The first checkpoint is Unverified.
+
+1. Seams. Name the files and symbols for the new file selection, the one
+   function that calls `claude`, `codex`, or `grok`, `wireEntry`, and
+   `TypedFinding.Validate`. Cite file:line in the progress file. No
+   product change in this checkpoint.
+2. Source cut. A fixture is a git repository with one commit containing
+   `pkg/app.go`, `pkg/note.go`, `pkg/app_test.go`, `vendor/lib.go`,
+   `go.sum`, `pkg/gen.go`, `pkg/blob.dat`, `README.md`, and
+   `config.yaml`. `pkg/blob.dat` is not valid UTF-8. `pkg/gen.go`
+   has a first line matching `^// Code generated .* DO NOT EDIT\.$`.
+   `pkg/note.go`'s first line is `DO NOT EDIT`.
+   The run prints `pkg/app.go` and `pkg/note.go` as kept, and prints
+   `pkg/app_test.go`, `vendor/lib.go`, `go.sum`, `pkg/gen.go`,
+   `pkg/blob.dat`, `README.md`, and `config.yaml` as dropped. A second
+   fixture is a git repository with one commit of only those dropped
+   files. It prints an empty kept list and that dropped list, calls no
+   model, and writes `{"findings":[]}` and a page. The page shows that
+   commit, the chosen model id, both filters, and four zero counts.
+   Existing
+   classify tests still pass unchanged.
+3. Model choice. Astra, Opus, and Grok go through the one function.
+   The fake exec shows `claude` with `opus`, `codex` with `--json` and
+   `-m gpt-6-astra`, and `grok` with `grok-4.7`. The model text is read
+   from `result`, the last `item.text`, and `text` respectively, then
+   read as `{"findings":[...]}`. Each element is a `wireEntry` with all
+   eight fields present and then passes `TypedFinding.Validate`. The
+   path is a kept file and the line numbers exist in that file.
+   `{"findings":[]}` is empty. `{"findings":null}`, a missing field, a
+   CLI error, missing model text, or an entry that fails `Validate`
+   fails the run. A non-zero exit, Claude `is_error` true, and a
+   process that cannot start each write neither file. The output
+   directory is empty before the failure and still empty after it.
+   Every prompt contains the instruction and asks for that object,
+   names each kept path before that file's text, and is at most
+   120,000 bytes. Kept files that do not fit in one prompt become more
+   than one prompt, each file whole, each prompt at most 120,000
+   bytes. One kept file that does not fit
+   in one prompt becomes consecutive non-empty byte slices that
+   partition the file on UTF-8 character boundaries, and a finding
+   cites the original path and
+   original line numbers. No dropped file appears
+   in any prompt. No API key is read.
+4. Findings. The findings file is one `{"findings":[...]}` written
+   outside the fixture. Its array is every accepted finding from every
+   prompt, in order. A record is a complete `wireEntry` that passes
+   `Validate`, its path is a kept file, and its line numbers exist in
+   that file. The page shows the model id. An empty answer is
+   `{"findings":[]}` from the model. A failed call writes neither the
+   findings file nor the page.
+5. Page. The HTML file renders from that findings file, is self-contained,
+   and filters by severity and by the directory component of `file`.
+   A file in the repo root has parent `.`. It
+   shows the fixture commit, the model id, and the `P0`, `P1`, `P2`,
+   and `P3` counts. Opening a finding shows the issue and consequence
+   beside the quoted lines. It is outside the fixture. There is no
+   existing findings-page seam. The page is new.
+6. Proof. The fake-exec tests cover Astra, Opus, and Grok. Input that
+   does not fit in 120,000 bytes is split into whole-file prompts and
+   into non-empty byte slices that partition one large file on UTF-8
+   character boundaries, and every prompt is at most 120,000 bytes. Three live commands against the fixture, one for each model,
+   each writing to its own output directory,
+   each ask for `{"findings":[...]}`. The only source text in each
+   prompt is `pkg/app.go` and `pkg/note.go`, with each path printed
+   before that file's text. Each writes a findings file and an HTML
+   page. Each command prints the kept list and the dropped list from
+   checkpoint 2 before the model call. Each page shows that model id,
+   the fixture commit, both filters, and the `P0`, `P1`, `P2`, and `P3`
+   counts, and those counts match the findings. An empty `findings`
+   list shows no findings and four zero counts.
+   `go test` for
+   every package this goal touched exits 0. A package this goal adds is
+   at 100% statement coverage, which is what `make cover` enforces. The
+   progress file names the three commands, the commit, and the output
+   paths.
+
+<!-- CODING-GOAL-END -->
diff --git a/metareview-whole-repo-source-review-progress.md b/metareview-whole-repo-source-review-progress.md
new file mode 100644
index 00000000..d6672f39
--- /dev/null
+++ b/metareview-whole-repo-source-review-progress.md
@@ -0,0 +1,91 @@
+# Whole-repo source review progress
+
+Session: 01a0ca43-3878-7771-aeec-ddc5f7ae9106
+
+Evidence: /var/folders/88/6w9jsm3s1v757_nzs4ybffj40000gn/T/grok-goal-2c246734b978/implementer
+
+Goal file `metareview-whole-repo-source-review-goal.md` is not edited. No commit, push, or pull request.
+
+## Checkpoint 1 — Seams
+
+Status: Pass
+
+Started Unverified. Named the seams below after reading `docs/ARCHITECTURE.md` and the cited files. No product change in this checkpoint.
+
+Selection (new code will compose these; `Classify` stays unchanged and still returns Code for an unrecognised path):
+
+- `classify.Classify` — `internal/classify/classify.go:72`
+- `configBase` (lockfile basenames, reached only through `Classify`) — `internal/classify/classify.go:65`
+- `claimcheck.IsTestPath` — `internal/claimcheck/claimcheck.go:69`
+
+The new selection function will be `sourcereview.Select` in `internal/sourcereview/select.go`. It is not in the tree at this checkpoint.
+
+The one function that will call `claude`, `codex`, or `grok` will be `sourcereview.Call` in `internal/sourcereview/model.go`. It is not in the tree at this checkpoint. It will read model text the way these do:
+
+- Claude `result` and `is_error` — `claudeResult` at `internal/fsm/judge/claude.go:156`, read in `parseClaudeResult` at `internal/fsm/judge/claude.go:201`
+- Codex last `item.completed` / `agent_message` `item.text` — `parseCodexEvents` at `internal/fsm/judge/codex.go:160` (the assignment is `internal/fsm/judge/codex.go:171`)
+- Grok `text` — no existing helper; `Call` will read that JSON string
+
+Findings:
+
+- `wireEntry` — `internal/lensoutput/lensoutput.go:320`
+- `TypedFinding.Validate` — `internal/lensoutput/lensoutput.go:128`
+
+`ValidatePayload` is not used. Diff review, `gitcontext.generatedExcludedFiles`, `internal/shardpack`, and `review-lenses` stay as they are.
+
+## Checkpoint 2 — Source cut
+
+Status: Pass
+
+`sourcereview.Select` is `internal/sourcereview/select.go:27`. `keepPath` drops Config and Docs from `Classify`, `IsTestPath`, a `vendor` / `node_modules` / `third_party` segment, invalid UTF-8, and a generated line `^// Code generated .* DO NOT EDIT\.$` whose preceding lines are blank or comments. A line that only says `DO NOT EDIT` stays kept. `Classify` is unchanged.
+
+`go test ./internal/classify` exited 0. Evidence: `cover.txt` in the evidence directory.
+
+Fixture `fixture-kept` commit `1720b406e24e6f15e069f8aeb63a723582ce3968`. Kept `pkg/app.go`, `pkg/note.go`. Dropped the other seven. Fixture `fixture-empty` commit `17a0f35d9dd710c9e860d2d7a69b1644afc1db6d` keeps nothing, calls no model, and writes `{"findings":[]}` plus a zero-count page (`empty-kept-1/`, `empty-kept-2/`). The two captures match.
+
+## Checkpoint 3 — Model choice
+
+Status: Pass
+
+`sourcereview.Call` is the one function, `internal/sourcereview/model.go:66`. It runs `claude -p --model opus --output-format json` (prompt on stdin, text in `result`), `codex exec --json -m gpt-6-astra -` (prompt on stdin, text in the last `agent_message` `item.text`), and `grok -p <prompt> -m grok-4.7 --output-format json` (text in `text`). Fake-exec tests record argv, stdin versus `-p`, the instruction, kept paths immediately before file text, no dropped file, and prompts at most 120000 bytes. Whole-file packing and UTF-8 slice partitions are tested. The parser accepts `{"findings":[]}` and a complete entry that passes `TypedFinding.Validate` (`internal/lensoutput/lensoutput.go:128`), and rejects null findings, a missing field, a CLI error, missing model text, a bad entry, a path that is not kept, and line numbers that are not in the file. Local `wireEntry` is `internal/sourcereview/parse.go:19`, same pointer fields as `internal/lensoutput/lensoutput.go:320`.
+
+## Checkpoint 4 — Findings
+
+Status: Pass
+
+Success writes `<dir>/findings.json` as one `{"findings":[...]}` of accepted findings in prompt order, and only after every prompt succeeds. The record has no model field. An output directory inside the reviewed tree is refused (`refuse-inside.txt`); that directory stayed empty. A non-zero exit, Claude `is_error`, a process that cannot start, and a bad payload each leave the output directory empty.
+
+## Checkpoint 5 — Page
+
+Status: Pass
+
+`sourcereview.Render` is `internal/sourcereview/page.go:102`. One self-contained `review.html`. Severity and directory filters are the shipped page script. A repo-root file's parent is `.`. Opening a finding shows issue and consequence beside the quoted lines. Headless Chrome (`browser.json`, `page.png`): zero page exceptions; the severity filter and the directory filter each hide the non-matching finding; the quote is `package main`.
+
+## Checkpoint 6 — Proof
+
+Status: Fail
+
+Opus and Grok passed the structural bar. Astra did not. Codex accepted `-m gpt-6-astra`, then exited 1. Stdout on the retry:
+
+```
+{"type":"error","message":"You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Sep 23rd, 2026 1:41 PM."}
+{"type":"turn.failed","error":{"message":"You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Sep 23rd, 2026 1:41 PM."}}
+```
+
+`live-astra/` is empty. That is a failed proof. No fake CLI was substituted.
+
+Commands, from `/Users/ben/code/metareview`:
+
+```
+go run ./cmd/metareview source-review --model opus --output <evidence>/live-opus <evidence>/fixture-kept
+go run ./cmd/metareview source-review --model astra --output <evidence>/live-astra <evidence>/fixture-kept
+go run ./cmd/metareview source-review --model grok --output <evidence>/live-grok <evidence>/fixture-kept
+```
+
+Fixture commit `1720b406e24e6f15e069f8aeb63a723582ce3968`. Opus wrote `live-opus/findings.json` (`{"findings":[]}`) and `live-opus/review.html` (model `opus`, that commit, both filters, P0 0, P1 0, P2 0, P3 0). Grok wrote `live-grok/findings.json` and `live-grok/review.html` (model `grok-4.7`, same commit and zero counts). Logs: `live-opus.log`, `live-grok.log`, `live-astra.log`. Each log prints the kept pair and the seven dropped paths before the prompt. The prompt's only source text is `pkg/app.go` and `pkg/note.go`, each path immediately before its text, and the prompt asks for `{"findings":[...]}`.
+
+`go test` for `internal/sourcereview`, `internal/classify`, and `cmd/metareview` exited 0 (`go-test.txt`). Coverage is 100.0% of statements for all three (`cover.txt`). `internal/sourcereview` was not added to `tests/coverage-exclude.txt`.
+
+`git log -1` is `02b0527`. No commit, push, or pull request. The goal file was not edited.
+
+User action for the failed proof: wait until the Codex usage limit resets (2026-09-23 13:41) and re-run the astra command above. The shell also logs `codex_core::shell_snapshot` line 20716 `syntax error near unexpected token '('`; the turn still started, and the exit reason on stdout is the usage limit.

From bf3e621d7ab1fd47d6d2bfc9655f2ef9ed6969e6 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Wed, 23 Sep 2026 07:56:14 -0700
Subject: [PATCH 02/22] feat(source-review): restyle the review page

The findings list is a ruled sheet with a severity edge on each row. Opening a row places the issue and consequence beside the quoted lines.
---
 internal/sourcereview/page.go | 148 +++++++++++++++++++++++++++++++---
 1 file changed, 136 insertions(+), 12 deletions(-)

diff --git a/internal/sourcereview/page.go b/internal/sourcereview/page.go
index 8d65e81f..6c97be11 100644
--- a/internal/sourcereview/page.go
+++ b/internal/sourcereview/page.go
@@ -85,16 +85,137 @@ const pageScript = `
 `
 
 const pageCSS = `
-body { font: 16px/1.4 ui-sans-serif, system-ui, sans-serif; margin: 1.5rem; color: #1a1a1a; background: #f7f5f2; }
-header { margin-bottom: 1rem; }
-.meta { margin: 0.15rem 0; }
-.counts { display: flex; gap: 1rem; padding: 0; list-style: none; }
-.filters { display: flex; gap: 1rem; margin: 1rem 0; }
-article.finding { background: #fff; border: 1px solid #ccc; margin: 0.5rem 0; padding: 0.5rem 0.75rem; }
-article.finding > button { font: inherit; background: none; border: 0; padding: 0; cursor: pointer; text-align: left; }
-.detail { display: none; gap: 1.5rem; margin-top: 0.75rem; }
-.detail:not([hidden]) { display: flex; }
-.detail pre { margin: 0; background: #f0ece6; padding: 0.5rem; overflow: auto; }
+:root {
+  --paper: #e4ebf0;
+  --ink: #17202a;
+  --muted: #4e5d6c;
+  --line: #c3cdd6;
+  --sheet: #f4f7f9;
+  --p0: #9b2335;
+  --p1: #c05621;
+  --p2: #8a6d1b;
+  --p3: #1f6f68;
+}
+* { box-sizing: border-box; }
+html { background: var(--paper); }
+body {
+  margin: 0 auto;
+  max-width: 68rem;
+  padding: 2rem 1.5rem 4rem;
+  color: var(--ink);
+  font: 17px/1.5 Charter, "Iowan Old Style", Palatino, Georgia, serif;
+}
+header { padding-bottom: 1.1rem; border-bottom: 1px solid var(--line); }
+#repo {
+  margin: 0;
+  font-family: "Avenir Next", "Segoe UI", sans-serif;
+  font-size: 1.6rem;
+  font-weight: 600;
+  letter-spacing: -0.02em;
+  line-height: 1.2;
+  overflow-wrap: anywhere;
+}
+.identity {
+  display: grid;
+  gap: 0.15rem;
+  margin-top: 0.45rem;
+  color: var(--muted);
+  font-family: "Avenir Next", "Segoe UI", sans-serif;
+  font-size: 0.92rem;
+}
+#commit { overflow-wrap: anywhere; }
+.identity p { margin: 0; }
+.counts {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.55rem;
+  margin: 0.9rem 0 0;
+  padding: 0;
+  list-style: none;
+  font-family: "Avenir Next", "Segoe UI", sans-serif;
+  font-variant-numeric: tabular-nums;
+}
+.counts li {
+  min-width: 4.6rem;
+  padding: 0.35rem 0.7rem 0.28rem;
+  background: var(--sheet);
+  border-top: 3px solid var(--line);
+}
+#count-p0 { border-top-color: var(--p0); }
+#count-p1 { border-top-color: var(--p1); }
+#count-p2 { border-top-color: var(--p2); }
+#count-p3 { border-top-color: var(--p3); }
+.filters {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.8rem 1.6rem;
+  margin: 1.15rem 0;
+  font-family: "Avenir Next", "Segoe UI", sans-serif;
+  font-size: 0.95rem;
+}
+select {
+  margin-left: 0.35rem;
+  padding: 0.28rem 0.4rem;
+  color: var(--ink);
+  background: var(--sheet);
+  border: 1px solid var(--line);
+  border-radius: 2px;
+  font: inherit;
+}
+#findings { border-bottom: 1px solid var(--line); }
+article.finding {
+  margin: 0;
+  background: var(--sheet);
+  border-top: 1px solid var(--line);
+  border-left: 5px solid var(--line);
+}
+article.finding[data-severity="P0"] { border-left-color: var(--p0); }
+article.finding[data-severity="P1"] { border-left-color: var(--p1); }
+article.finding[data-severity="P2"] { border-left-color: var(--p2); }
+article.finding[data-severity="P3"] { border-left-color: var(--p3); }
+article.finding > button {
+  display: block;
+  width: 100%;
+  padding: 0.72rem 1rem;
+  color: var(--ink);
+  background: transparent;
+  border: 0;
+  cursor: pointer;
+  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
+  font-size: 0.9rem;
+  text-align: left;
+  white-space: normal;
+  overflow-wrap: anywhere;
+}
+article.finding > button:hover,
+article.finding > button:focus-visible { background: #e7eef3; }
+article.finding > button:focus-visible { outline: 2px solid var(--ink); outline-offset: -2px; }
+.detail { display: none; }
+.detail:not([hidden]) {
+  display: grid;
+  grid-template-columns: minmax(16rem, 0.9fr) minmax(18rem, 1.15fr);
+  gap: 1rem 1.5rem;
+  padding: 0 1rem 1rem 1.1rem;
+}
+.issue { margin: 0 0 0.55rem; font-size: 1.05rem; }
+.consequence { margin: 0; color: var(--muted); }
+.quote {
+  margin: 0;
+  padding: 0.75rem 0.9rem;
+  overflow: auto;
+  background: #e7eef3;
+  color: var(--ink);
+  border-left: 1px solid var(--line);
+  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
+  font-size: 0.8rem;
+  line-height: 1.45;
+  white-space: pre;
+}
+@media (max-width: 720px) {
+  body { padding: 1rem 0.75rem 2.5rem; }
+  #repo { font-size: 1.25rem; }
+  .detail:not([hidden]) { grid-template-columns: 1fr; }
+}
 `
 
 // Render returns one HTML document. It has no external assets. The quote is the
@@ -102,12 +223,14 @@ article.finding > button { font: inherit; background: none; border: 0; padding:
 func Render(p Page) []byte {
 	p0, p1, p2, p3 := severityCounts(p.Findings)
 	var b strings.Builder
-	b.WriteString("<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<title>Source review</title>\n<style>")
+	b.WriteString("<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Source review</title>\n<style>")
 	b.WriteString(pageCSS)
 	b.WriteString("</style>\n</head>\n<body>\n<header>\n")
 	fmt.Fprintf(&b, "<p class=\"meta\" id=\"repo\">%s</p>\n", html.EscapeString(p.Repo))
+	b.WriteString("<div class=\"identity\">\n")
 	fmt.Fprintf(&b, "<p class=\"meta\" id=\"commit\">%s</p>\n", html.EscapeString(p.Commit))
 	fmt.Fprintf(&b, "<p class=\"meta\" id=\"model\">%s</p>\n", html.EscapeString(p.ModelID))
+	b.WriteString("</div>\n")
 	b.WriteString("<ul class=\"counts\">\n")
 	fmt.Fprintf(&b, "<li id=\"count-p0\">P0 %d</li>\n", p0)
 	fmt.Fprintf(&b, "<li id=\"count-p1\">P1 %d</li>\n", p1)
@@ -130,9 +253,10 @@ func Render(p Page) []byte {
 		}
 		fmt.Fprintf(&b, "<article class=\"finding\" data-severity=\"%s\" data-dir=\"%s\">\n", html.EscapeString(f.Severity), html.EscapeString(dir))
 		fmt.Fprintf(&b, "<button type=\"button\">%s:%d-%d</button>\n", html.EscapeString(f.File), f.StartLine, f.EndLine)
-		b.WriteString("<div class=\"detail\" hidden>\n")
+		b.WriteString("<div class=\"detail\" hidden>\n<div class=\"prose\">\n")
 		fmt.Fprintf(&b, "<p class=\"issue\">%s</p>\n", html.EscapeString(f.Issue))
 		fmt.Fprintf(&b, "<p class=\"consequence\">%s</p>\n", html.EscapeString(f.Consequence))
+		b.WriteString("</div>\n")
 		fmt.Fprintf(&b, "<pre class=\"quote\">%s</pre>\n", html.EscapeString(quote))
 		b.WriteString("</div>\n</article>\n")
 	}

From b1ea9292ac712e482d729fd702f2a948f8f689d7 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Thu, 24 Sep 2026 11:38:20 -0700
Subject: [PATCH 03/22] feat(source-review): make Grok finish, number prompt
 lines, redesign the page

Grok call: `grok -p <prompt>` ran Grok's full agent. It cut the 120 KB prompt
to an excerpt and re-read it with read_file/grep: 11 model calls and 845K
input tokens for one hh prompt. Grok now runs as one turn with no tools:
--prompt-file --verbatim --json-schema --tools "" --max-turns 1
--no-subagents --disable-web-search --system-prompt-override. The prompt file
lives in os.TempDir() and is removed after the call.

Run: --jobs runs up to n prompts at once (default 8), keeping findings in
prompt order. --call-timeout (default 30m) kills a call and its process
group. Each finished prompt prints a progress line.

Line numbers: every prompt line now starts with its number and "| ", and
the instruction says to cite those numbers. Slices of large files number
from their original line, and the size limit counts the prefixes. On one hh
file (5 runs each) this cut Opus from 47 s to 29 s and Grok from 634 s to
540 s per prompt, with no fewer findings. Also fixes cutEnd reading one byte
past the end when the room exactly equals the bytes left.

Page: findings grouped by file, worst first, with the issue's first sentence
in each row; a severity bar and a map of where findings sit, both of which
filter; search; sticky controls; full-width layout; light and dark themes.

Also: ignore .claude/cost/, and add the Grok goal and its progress file.
---
 .gitignore                                |   3 +
 cmd/metareview/main.go                    |   2 +-
 cmd/metareview/main_test.go               |   2 +-
 docs/ARCHITECTURE.md                      |   8 +-
 internal/sourcereview/model.go            |  77 ++-
 internal/sourcereview/model_test.go       | 256 +++++++-
 internal/sourcereview/pack.go             |  63 +-
 internal/sourcereview/pack_test.go        |  97 ++-
 internal/sourcereview/page.go             | 685 ++++++++++++++++++----
 internal/sourcereview/page_test.go        | 156 ++++-
 internal/sourcereview/run.go              | 243 ++++++--
 internal/sourcereview/run_test.go         | 202 ++++++-
 metareview-grok-source-review-goal.md     | 164 ++++++
 metareview-grok-source-review-progress.md | 103 ++++
 14 files changed, 1817 insertions(+), 244 deletions(-)
 create mode 100644 metareview-grok-source-review-goal.md
 create mode 100644 metareview-grok-source-review-progress.md

diff --git a/.gitignore b/.gitignore
index 48e536c7..f8cd8728 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,9 @@ node_modules/
 # Local agent worktrees (never commit)
 .claude/worktrees/
 
+# Local Claude Code cost tracking (never commit)
+.claude/cost/
+
 # findings-index atomic-replace temp files (unique names; only survive a hard crash
 # in the write→rename window — see writeIndexAtomic)
 docs/metareview/.FINDINGS.md.tmp-*
diff --git a/cmd/metareview/main.go b/cmd/metareview/main.go
index 547176c0..34c7e135 100644
--- a/cmd/metareview/main.go
+++ b/cmd/metareview/main.go
@@ -121,7 +121,7 @@ Usage:
   metareview review pr-ready [--base <ref>] [--previous-run <run-id>] [--max-attempts <n>] [--evidence <path>] [--mutation-report <path>]... [--github-pr <number>] [--include-working-tree] [--shard-result <path>]... [--cross-shard-result <path>]
   metareview review record-lenses [--scope pr-ready|task-done|epic-ready] [--base <ref>] [--verdict <v>] [--mode subagent-adjudicated|in-session-emulated] [--lenses a,b,c] [--from-run <fsm-run-id>]
   metareview learn --post-merge <pr-number> [--base <ref>] [--github-pr <number>] [--session-root <path>]
-  metareview source-review --model astra|opus|grok --output <dir> [<repo>]
+  metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [<repo>]
 
 Commands:
   setup --check              Detect repository mode and prerequisites without writing files
diff --git a/cmd/metareview/main_test.go b/cmd/metareview/main_test.go
index 8e75c38f..307f1548 100644
--- a/cmd/metareview/main_test.go
+++ b/cmd/metareview/main_test.go
@@ -91,7 +91,7 @@ func TestRunSourceReviewHelp(t *testing.T) {
 		t.Fatalf("code=%d out=%q err=%q", code, out, errOut)
 	}
 	code, help, _ := runCLI(t, t.TempDir(), nil, "--help")
-	if code != 0 || !strings.Contains(help, "metareview source-review --model astra|opus|grok --output <dir> [<repo>]") {
+	if code != 0 || !strings.Contains(help, "metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [<repo>]") {
 		t.Fatalf("top-level help missing source-review: %q", help)
 	}
 }
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index cf4c749b..d63238c7 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -39,9 +39,13 @@ abbreviated — task-done/epic-ready/pr-ready also take `--evidence <file>` (a v
 | **epic-ready** | `review epic-ready <id>` | the epic's **integration diff** (base..HEAD, the union of the children's changes), **with the roll-up as context** — child evidence present? contradictions? intent drift? registry coverage? | deterministic heuristics (roll-up freshness) **+ a required adjudicated review** over the integration diff (base..HEAD) via the `epic-review-loop` workflow — same require-lenses gate as pr-ready/task-done |
 | **learn** | `learn --post-merge <pr>` | what the merged PR + bot findings teach us | learning extraction |
 
-`source-review` is a separate command (`source-review --model astra|opus|grok --output <dir> [<repo>]`).
+`source-review` is a separate command (`source-review --model astra|opus|grok --output <dir> [--jobs <n>]
+[--call-timeout <duration>] [<repo>]`).
 It reviews the first-party source at HEAD — code `Classify` keeps, minus tests, vendored trees,
-generated files, and non-UTF-8 — by calling the logged-in `claude`, `codex`, or `grok` CLI.
+generated files, and non-UTF-8 — by calling the logged-in `claude`, `codex`, or `grok` CLI, up to `--jobs`
+prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
+Grok runs as one tool-less turn (`--prompt-file --verbatim --json-schema --tools "" --max-turns 1
+--system-prompt-override`): `grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools.
 It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
 
 `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index 922fca7e..1ab601dd 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -2,28 +2,40 @@ package sourcereview
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
+	"syscall"
+	"time"
 )
 
 // Runner runs one logged-in CLI. stdin is the prompt for claude and codex;
-// grok receives the prompt as the argument of -p and stdin is nil.
+// grok reads the prompt from the --prompt-file file and stdin is nil. When ctx
+// ends, the process and its children are killed.
 type Runner interface {
-	Run(name string, args []string, stdin []byte) ([]byte, error)
+	Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error)
 }
 
 // OSRunner is the real process runner. It does not read an API key and does not
 // add a token to the command.
 type OSRunner struct{}
 
-func (OSRunner) Run(name string, args []string, stdin []byte) ([]byte, error) {
-	cmd := exec.Command(name, args...)
+// waitDelay bounds how long Run waits for output pipes after the process group
+// is killed (the internal/fsm/cmdexec pattern).
+const waitDelay = 2 * time.Second
+
+func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, name, args...)
 	if stdin != nil {
 		cmd.Stdin = bytes.NewReader(stdin)
 	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error { return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) }
+	cmd.WaitDelay = waitDelay
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
@@ -61,24 +73,73 @@ func ModelID(model string) (string, error) {
 	}
 }
 
+// grokSchema constrains Grok's answer to {"findings":[...]} with all eight
+// fields present.
+const grokSchema = `{"type":"object","properties":{"findings":{"type":"array","items":{"type":"object","properties":{"tag":{"type":"string","enum":["bug","advisory"]},"file":{"type":"string"},"start_line":{"type":"integer"},"end_line":{"type":"integer"},"issue":{"type":"string"},"consequence":{"type":"string"},"confidence":{"type":"integer"},"severity":{"type":"string","enum":["P0","P1","P2","P3"]}},"required":["tag","file","start_line","end_line","issue","consequence","confidence","severity"]}}},"required":["findings"]}`
+
+// grokSystem replaces Grok's agent system prompt. Without it the model tries
+// to call tools, and --max-turns 1 cancels the turn.
+const grokSystem = "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message."
+
+// grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
+// Grok's agent as an excerpt plus a file to read back with tools, which made
+// one hh prompt take 11 model calls; --prompt-file with --verbatim sends it whole.
+func grokArgs(promptFile string) []string {
+	return []string{
+		"--prompt-file", promptFile, "--verbatim",
+		"-m", "grok-4.7", "--output-format", "json",
+		"--json-schema", grokSchema,
+		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
+		"--system-prompt-override", grokSystem,
+	}
+}
+
+// Temp-file seams. Production uses the os functions. Tests replace them to
+// cover the error returns.
+var (
+	createTemp = os.CreateTemp
+	removeFile = os.Remove
+)
+
+// writePromptFile writes the prompt to a new file in os.TempDir(), which is
+// never inside the reviewed tree or the output directory.
+func writePromptFile(prompt []byte) (string, error) {
+	f, err := createTemp("", "metareview-grok-prompt-*.txt")
+	if err != nil {
+		return "", err
+	}
+	_, werr := f.Write(prompt)
+	cerr := f.Close()
+	if err := errors.Join(werr, cerr); err != nil {
+		_ = removeFile(f.Name())
+		return "", err
+	}
+	return f.Name(), nil
+}
+
 // Call is the one function that runs claude, codex, or grok. The prompt text
 // and the parser stay the same; only the CLI and the model id change.
-func Call(runner Runner, model string, prompt []byte) (string, error) {
+func Call(ctx context.Context, runner Runner, model string, prompt []byte) (string, error) {
 	switch strings.ToLower(strings.TrimSpace(model)) {
 	case "opus":
-		out, err := runner.Run("claude", []string{"-p", "--model", "opus", "--output-format", "json"}, prompt)
+		out, err := runner.Run(ctx, "claude", []string{"-p", "--model", "opus", "--output-format", "json"}, prompt)
 		if err != nil {
 			return "", err
 		}
 		return claudeModelText(out)
 	case "astra":
-		out, err := runner.Run("codex", []string{"exec", "--json", "-m", "gpt-6-astra", "-"}, prompt)
+		out, err := runner.Run(ctx, "codex", []string{"exec", "--json", "-m", "gpt-6-astra", "-"}, prompt)
 		if err != nil {
 			return "", err
 		}
 		return codexModelText(out)
 	case "grok":
-		out, err := runner.Run("grok", []string{"-p", string(prompt), "-m", "grok-4.7", "--output-format", "json"}, nil)
+		path, err := writePromptFile(prompt)
+		if err != nil {
+			return "", err
+		}
+		defer func() { _ = removeFile(path) }()
+		out, err := runner.Run(ctx, "grok", grokArgs(path), nil)
 		if err != nil {
 			return "", err
 		}
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
index d143f31e..a142541e 100644
--- a/internal/sourcereview/model_test.go
+++ b/internal/sourcereview/model_test.go
@@ -2,36 +2,82 @@ package sourcereview
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
+	"os"
 	"os/exec"
+	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 )
 
+// fakeRunner records calls. It is safe for concurrent calls: n is the call's
+// start order, active/maxActive count calls running at the same time, and wait
+// (when set) runs inside the call before reply so a test can block on ctx.
 type fakeRunner struct {
-	calls []fakeCall
-	reply func(n int, name string, args []string, stdin []byte) ([]byte, error)
-	onRun func()
+	mu        sync.Mutex
+	calls     []fakeCall
+	active    int
+	maxActive int
+	reply     func(n int, name string, args []string, stdin []byte) ([]byte, error)
+	wait      func(ctx context.Context, prompt []byte) error
+	onRun     func()
 }
 
 type fakeCall struct {
 	name  string
 	args  []string
 	stdin []byte
+	// prompt is the prompt the CLI received: stdin, or the --prompt-file bytes.
+	prompt []byte
 }
 
-func (f *fakeRunner) Run(name string, args []string, stdin []byte) ([]byte, error) {
+func (f *fakeRunner) Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error) {
 	if f.onRun != nil {
 		f.onRun()
 	}
-	f.calls = append(f.calls, fakeCall{name, append([]string(nil), args...), append([]byte(nil), stdin...)})
+	prompt := append([]byte(nil), stdin...)
+	for i, a := range args {
+		if a == "--prompt-file" && i+1 < len(args) {
+			prompt, _ = os.ReadFile(args[i+1])
+		}
+	}
+	f.mu.Lock()
+	n := len(f.calls)
+	f.calls = append(f.calls, fakeCall{name, append([]string(nil), args...), append([]byte(nil), stdin...), prompt})
+	f.active++
+	if f.active > f.maxActive {
+		f.maxActive = f.active
+	}
+	f.mu.Unlock()
+	defer func() {
+		f.mu.Lock()
+		f.active--
+		f.mu.Unlock()
+	}()
+	if f.wait != nil {
+		if err := f.wait(ctx, prompt); err != nil {
+			return nil, err
+		}
+	}
 	if f.reply == nil {
 		return nil, errors.New("no reply")
 	}
-	return f.reply(len(f.calls)-1, name, args, stdin)
+	return f.reply(n, name, args, stdin)
+}
+
+func (f *fakeRunner) callList() []fakeCall {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]fakeCall(nil), f.calls...)
 }
 
+var bg = context.Background()
+
 func TestModelID(t *testing.T) {
 	cases := map[string]string{"opus": "opus", " astra ": "gpt-6-astra", "GROK": "grok-4.7"}
 	for in, want := range cases {
@@ -58,7 +104,7 @@ func TestCallShapes(t *testing.T) {
 				return []byte(`{"text":"{\"findings\":[]}"}`), nil
 			}
 		}}
-		text, err := Call(fr, model, prompt)
+		text, err := Call(bg, fr, model, prompt)
 		if err != nil {
 			t.Fatal(model, err)
 		}
@@ -80,13 +126,138 @@ func TestCallShapes(t *testing.T) {
 				t.Fatalf("codex call %+v", c)
 			}
 		case "grok":
-			if c.name != "grok" || !reflectArgs(c.args, []string{"-p", string(prompt), "-m", "grok-4.7", "--output-format", "json"}) || c.stdin != nil {
+			if c.name != "grok" || len(c.args) < 2 || !reflectArgs(c.args, grokWant(c.args[1])) || c.stdin != nil || !bytes.Equal(c.prompt, prompt) {
 				t.Fatalf("grok call %+v", c)
 			}
 		}
 	}
 }
 
+// grokWant is the exact Grok argv the goal names, for a given prompt file.
+func grokWant(promptFile string) []string {
+	return []string{
+		"--prompt-file", promptFile, "--verbatim",
+		"-m", "grok-4.7", "--output-format", "json",
+		"--json-schema", grokSchema,
+		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
+		"--system-prompt-override", "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message.",
+	}
+}
+
+func TestGrokPromptFile(t *testing.T) {
+	prompt := []byte("review this ✓\n")
+	tree, out := t.TempDir(), t.TempDir()
+	replies := map[string]func() ([]byte, error){
+		"success":      func() ([]byte, error) { return []byte(`{"text":"{\"findings\":[]}"}`), nil },
+		"nonzero":      func() ([]byte, error) { return nil, errors.New("grok: exit status 1") },
+		"cannot-start": func() ([]byte, error) { return nil, errors.New(`exec: "grok": executable file not found in $PATH`) },
+	}
+	for name, reply := range replies {
+		var path string
+		fr := &fakeRunner{reply: func(_ int, _ string, args []string, _ []byte) ([]byte, error) {
+			path = args[1]
+			got, err := os.ReadFile(path)
+			if err != nil || !bytes.Equal(got, prompt) {
+				t.Fatalf("%s: prompt file during the call: %v %q", name, err, got)
+			}
+			for _, dir := range []string{tree, out} {
+				if strings.HasPrefix(path, dir) {
+					t.Fatalf("%s: prompt file %s inside %s", name, path, dir)
+				}
+			}
+			if filepath.Dir(path) != filepath.Clean(os.TempDir()) {
+				t.Fatalf("%s: prompt file %s not in os.TempDir()", name, path)
+			}
+			return reply()
+		}}
+		_, err := Call(bg, fr, "grok", prompt)
+		if (name == "success") != (err == nil) {
+			t.Fatalf("%s: err %v", name, err)
+		}
+		if _, statErr := os.Stat(path); !os.IsNotExist(statErr) {
+			t.Fatalf("%s: prompt file %s left behind", name, path)
+		}
+	}
+	// A real process that cannot start also removes the file.
+	before, _ := filepath.Glob(filepath.Join(os.TempDir(), "metareview-grok-prompt-*"))
+	t.Setenv("PATH", t.TempDir())
+	if _, err := Call(bg, OSRunner{}, "grok", prompt); err == nil {
+		t.Fatal("grok should not start with an empty PATH")
+	}
+	after, _ := filepath.Glob(filepath.Join(os.TempDir(), "metareview-grok-prompt-*"))
+	if len(after) > len(before) {
+		t.Fatalf("prompt file left behind: %v", after)
+	}
+}
+
+func TestGrokSchema(t *testing.T) {
+	var s struct {
+		Type       string `json:"type"`
+		Required   []string
+		Properties struct {
+			Findings struct {
+				Type  string `json:"type"`
+				Items struct {
+					Required   []string                   `json:"required"`
+					Properties map[string]json.RawMessage `json:"properties"`
+				} `json:"items"`
+			} `json:"findings"`
+		} `json:"properties"`
+	}
+	if err := json.Unmarshal([]byte(grokSchema), &s); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"tag", "file", "start_line", "end_line", "issue", "consequence", "confidence", "severity"}
+	if !reflectArgs(s.Properties.Findings.Items.Required, want) || s.Properties.Findings.Type != "array" {
+		t.Fatalf("schema required %v", s.Properties.Findings.Items.Required)
+	}
+	for _, f := range want {
+		if _, ok := s.Properties.Findings.Items.Properties[f]; !ok {
+			t.Fatalf("schema has no property %s", f)
+		}
+	}
+	for f, typ := range map[string]string{"start_line": "integer", "end_line": "integer", "confidence": "integer"} {
+		if !strings.Contains(string(s.Properties.Findings.Items.Properties[f]), `"`+typ+`"`) {
+			t.Fatalf("%s is not %s", f, typ)
+		}
+	}
+	for f, enum := range map[string]string{"tag": `["bug","advisory"]`, "severity": `["P0","P1","P2","P3"]`} {
+		if !strings.Contains(string(s.Properties.Findings.Items.Properties[f]), enum) {
+			t.Fatalf("%s enum", f)
+		}
+	}
+}
+
+func TestWritePromptFileErrors(t *testing.T) {
+	prevCreate, prevRemove := createTemp, removeFile
+	t.Cleanup(func() { createTemp, removeFile = prevCreate, prevRemove })
+	createTemp = func(string, string) (*os.File, error) { return nil, errors.New("create") }
+	if _, err := Call(bg, &fakeRunner{}, "grok", []byte("p")); err == nil || !strings.Contains(err.Error(), "create") {
+		t.Fatal(err)
+	}
+	// A file that is already closed fails Write; the partial file is removed.
+	var made string
+	createTemp = func(dir, pattern string) (*os.File, error) {
+		f, err := prevCreate(dir, pattern)
+		if err != nil {
+			return nil, err
+		}
+		made = f.Name()
+		_ = f.Close()
+		return f, nil
+	}
+	fr := &fakeRunner{}
+	if _, err := Call(bg, fr, "grok", []byte("p")); err == nil {
+		t.Fatal("write to a closed file")
+	}
+	if len(fr.callList()) != 0 {
+		t.Fatal("grok ran without a prompt file")
+	}
+	if _, err := os.Stat(made); !os.IsNotExist(err) {
+		t.Fatal("partial prompt file left behind")
+	}
+}
+
 func reflectArgs(got, want []string) bool {
 	if len(got) != len(want) {
 		return false
@@ -103,96 +274,96 @@ func TestCallErrors(t *testing.T) {
 	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
 		return nil, errors.New("executable file not found")
 	}}
-	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "opus", []byte("p")); err == nil {
 		t.Fatal("start failure")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte(`{"is_error":true,"result":"boom"}`), nil
 	}
-	if _, err := Call(fr, "opus", []byte("p")); err == nil || !strings.Contains(err.Error(), "is_error") {
+	if _, err := Call(bg, fr, "opus", []byte("p")); err == nil || !strings.Contains(err.Error(), "is_error") {
 		t.Fatal(err)
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte(`{"is_error":false}`), nil
 	}
-	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "opus", []byte("p")); err == nil {
 		t.Fatal("missing result")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte(`{"is_error":false,"result":""}`), nil
 	}
-	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "opus", []byte("p")); err == nil {
 		t.Fatal("empty result")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte("not-json"), nil
 	}
-	if _, err := Call(fr, "opus", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "opus", []byte("p")); err == nil {
 		t.Fatal("bad claude json")
 	}
-	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "grok", []byte("p")); err == nil {
 		t.Fatal("bad grok json")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte(`{"text":""}`), nil
 	}
-	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "grok", []byte("p")); err == nil {
 		t.Fatal("empty grok text")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte(`{}`), nil
 	}
-	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "grok", []byte("p")); err == nil {
 		t.Fatal("nil grok text")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte("{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"\"}}\n"), nil
 	}
-	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "astra", []byte("p")); err == nil {
 		t.Fatal("empty codex text")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return []byte("nope\n"), nil
 	}
-	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "astra", []byte("p")); err == nil {
 		t.Fatal("no agent message")
 	}
-	if _, err := Call(fr, "nope", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "nope", []byte("p")); err == nil {
 		t.Fatal("unknown model")
 	}
 	fr.reply = func(int, string, []string, []byte) ([]byte, error) {
 		return nil, errors.New("exit status 1")
 	}
-	if _, err := Call(fr, "astra", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "astra", []byte("p")); err == nil {
 		t.Fatal("nonzero")
 	}
-	if _, err := Call(fr, "grok", []byte("p")); err == nil {
+	if _, err := Call(bg, fr, "grok", []byte("p")); err == nil {
 		t.Fatal("grok nonzero")
 	}
 }
 
 func TestOSRunner(t *testing.T) {
-	out, err := OSRunner{}.Run("echo", []string{"hi"}, nil)
+	out, err := OSRunner{}.Run(bg, "echo", []string{"hi"}, nil)
 	if err != nil || !bytes.Contains(out, []byte("hi")) {
 		t.Fatalf("echo: %v %q", err, out)
 	}
-	out, err = OSRunner{}.Run("cat", nil, []byte("yo"))
+	out, err = OSRunner{}.Run(bg, "cat", nil, []byte("yo"))
 	if err != nil || !bytes.Equal(out, []byte("yo")) {
 		t.Fatalf("cat: %v %q", err, out)
 	}
-	if _, err := (OSRunner{}).Run("false", nil, nil); err == nil {
+	if _, err := (OSRunner{}).Run(bg, "false", nil, nil); err == nil {
 		t.Fatal("false should fail")
 	}
-	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo boom >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "boom") {
+	if _, err := (OSRunner{}).Run(bg, "sh", []string{"-c", "echo boom >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "boom") {
 		t.Fatal(err)
 	}
-	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo usage-limit; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "usage-limit") {
+	if _, err := (OSRunner{}).Run(bg, "sh", []string{"-c", "echo usage-limit; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "usage-limit") {
 		t.Fatal(err)
 	}
-	if _, err := (OSRunner{}).Run("sh", []string{"-c", "echo out-line; echo err-line >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "err-line") || !strings.Contains(err.Error(), "out-line") {
+	if _, err := (OSRunner{}).Run(bg, "sh", []string{"-c", "echo out-line; echo err-line >&2; exit 1"}, nil); err == nil || !strings.Contains(err.Error(), "err-line") || !strings.Contains(err.Error(), "out-line") {
 		t.Fatal(err)
 	}
-	if _, err := (OSRunner{}).Run("no-such-binary-xyz", nil, nil); err == nil {
+	if _, err := (OSRunner{}).Run(bg, "no-such-binary-xyz", nil, nil); err == nil {
 		t.Fatal("missing binary")
 	}
 	// exec.Command is used; a lookup failure is *exec.Error, not ExitError.
@@ -201,6 +372,35 @@ func TestOSRunner(t *testing.T) {
 	}
 }
 
+func TestOSRunnerKillsProcessGroup(t *testing.T) {
+	pidFile := filepath.Join(t.TempDir(), "child.pid")
+	ctx, cancel := context.WithTimeout(bg, 300*time.Millisecond)
+	defer cancel()
+	start := time.Now()
+	_, err := OSRunner{}.Run(ctx, "sh", []string{"-c", `sleep 30 & echo $! > "$0"; wait`, pidFile}, nil)
+	if err == nil {
+		t.Fatal("expected a killed process")
+	}
+	if took := time.Since(start); took > 10*time.Second {
+		t.Fatalf("kill took %s", took)
+	}
+	raw, rerr := os.ReadFile(pidFile)
+	if rerr != nil {
+		t.Fatal(rerr)
+	}
+	pid, perr := strconv.Atoi(strings.TrimSpace(string(raw)))
+	if perr != nil {
+		t.Fatal(perr)
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for exec.Command("kill", "-0", strconv.Itoa(pid)).Run() == nil {
+		if time.Now().After(deadline) {
+			t.Fatalf("child %d still running", pid)
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
 func TestClaudeIsErrorWithoutResult(t *testing.T) {
 	if _, err := claudeModelText([]byte(`{"is_error":true}`)); err == nil {
 		t.Fatal("expected is_error")
diff --git a/internal/sourcereview/pack.go b/internal/sourcereview/pack.go
index 0237b631..e72b0179 100644
--- a/internal/sourcereview/pack.go
+++ b/internal/sourcereview/pack.go
@@ -19,7 +19,26 @@ Every field is present: tag, file, start_line, end_line, issue, consequence, con
 confidence is an integer from 0 to 100.
 file is one of the paths given below. start_line and end_line are line numbers in that file.
 Return {"findings":[]} when there is nothing to report.
-Do not write anything outside that JSON object.`
+Do not write anything outside that JSON object.
+Each source line below starts with its line number and "| ". That prefix is not part of the file. Cite those numbers.`
+
+// numberLines prefixes each line of body with its line number and "| ",
+// counting from first. Given the numbers, a model does not have to count lines
+// to cite them: on one hh file this cut Opus from 47 s to 29 s and Grok from
+// 634 s to 540 s per prompt, with no fewer findings.
+func numberLines(body []byte, first int) []byte {
+	var b bytes.Buffer
+	n := first
+	for _, line := range bytes.SplitAfter(body, []byte("\n")) {
+		if len(line) == 0 {
+			continue
+		}
+		fmt.Fprintf(&b, "%d| ", n)
+		b.Write(line)
+		n++
+	}
+	return b.Bytes()
+}
 
 func sliceNote(path string, line int) string {
 	return fmt.Sprintf("This prompt contains a byte slice of %s starting at original line %d. Citations use the original path and the original line numbers.", path, line)
@@ -30,21 +49,31 @@ func sliceHeader(path string, line int) string {
 }
 
 // promptWith writes the instruction header and each path on its own line
-// immediately before that file's bytes. A following path stays on its own line
-// when the previous body does not end in a newline.
+// immediately before that file's numbered lines. A following path stays on its
+// own line when the previous body does not end in a newline.
 func promptWith(header string, files []File) []byte {
+	return promptFrom(header, files, 1)
+}
+
+// promptFrom is promptWith with the first file numbered from first: a slice of
+// a large file is numbered from the original line that holds its first byte.
+func promptFrom(header string, files []File, first int) []byte {
 	var b bytes.Buffer
 	b.WriteString(header)
 	if !strings.HasSuffix(header, "\n") {
 		b.WriteByte('\n')
 	}
 	for i, f := range files {
+		start := 1
+		if i == 0 {
+			start = first
+		}
 		if i > 0 && (len(files[i-1].Body) == 0 || files[i-1].Body[len(files[i-1].Body)-1] != '\n') {
 			b.WriteByte('\n')
 		}
 		b.WriteString(f.Path)
 		b.WriteByte('\n')
-		b.Write(f.Body)
+		b.Write(numberLines(f.Body, start))
 	}
 	return b.Bytes()
 }
@@ -113,16 +142,35 @@ func sliceFile(f File, budget int) ([][]byte, error) {
 		line := lineAt(f.Body, start)
 		header := sliceHeader(f.Path, line)
 		room := budget - len(header) - len(f.Path) - 1
-		end, err := cutEnd(f.Body, start, room)
+		end, err := cutNumbered(f.Body, start, room, line)
 		if err != nil {
 			return nil, fmt.Errorf("%s: %w", f.Path, err)
 		}
-		out = append(out, promptWith(header, []File{{Path: f.Path, Body: f.Body[start:end]}}))
+		out = append(out, promptFrom(header, []File{{Path: f.Path, Body: f.Body[start:end]}}, line))
 		start = end
 	}
 	return out, nil
 }
 
+// cutNumbered is cutEnd for a slice whose lines are numbered from line: the
+// numbered slice, not the raw bytes, must fit in room. While it does not, the
+// raw cut shrinks in proportion to the overshoot (numbering can multiply the
+// size of short lines). size > room, so each pass cuts strictly fewer bytes.
+func cutNumbered(content []byte, start, room, line int) (int, error) {
+	raw := room
+	for {
+		end, err := cutEnd(content, start, raw)
+		if err != nil {
+			return 0, err
+		}
+		size := len(numberLines(content[start:end], line))
+		if size <= room {
+			return end, nil
+		}
+		raw = (end - start) * room / size
+	}
+}
+
 func lineAt(content []byte, offset int) int {
 	return bytes.Count(content[:offset], []byte("\n")) + 1
 }
@@ -134,7 +182,8 @@ func cutEnd(content []byte, start, room int) (int, error) {
 		return 0, fmt.Errorf("prompt overhead exceeds the budget")
 	}
 	end := start + room
-	if end > len(content) {
+	// end == len(content) takes the rest of the file; content[end] would be out of range.
+	if end >= len(content) {
 		end = len(content)
 	} else {
 		for end > start && !utf8.RuneStart(content[end]) {
diff --git a/internal/sourcereview/pack_test.go b/internal/sourcereview/pack_test.go
index 0506ecb2..1c26b300 100644
--- a/internal/sourcereview/pack_test.go
+++ b/internal/sourcereview/pack_test.go
@@ -2,6 +2,7 @@ package sourcereview
 
 import (
 	"bytes"
+	"regexp"
 	"strconv"
 	"strings"
 	"testing"
@@ -33,7 +34,7 @@ func TestPackWholeFilesSmallest(t *testing.T) {
 			t.Fatal("whole file prompt has a slice note")
 		}
 		for _, f := range files {
-			needle := append([]byte(f.Path+"\n"), f.Body...)
+			needle := append([]byte(f.Path+"\n"), numberLines(f.Body, 1)...)
 			if bytes.Contains(p, needle) {
 				seen[f.Path]++
 			}
@@ -67,7 +68,14 @@ func TestPackSlicesPartitionUTF8(t *testing.T) {
 		if !strings.HasPrefix(string(p), prefix) {
 			t.Fatalf("prompt missing slice header at offset %d", off)
 		}
-		part := p[len(prefix):]
+		// The body has no newlines, so each slice is one numbered line: the
+		// original line that holds the slice's first byte.
+		numbered := p[len(prefix):]
+		mark := strconv.Itoa(lineAt(body, off)) + "| "
+		if !bytes.HasPrefix(numbered, []byte(mark)) {
+			t.Fatalf("slice at offset %d is not numbered %q", off, mark)
+		}
+		part := numbered[len(mark):]
 		if len(part) == 0 {
 			t.Fatal("empty slice")
 		}
@@ -141,6 +149,11 @@ func TestCutEndAndSliceErrors(t *testing.T) {
 	if err != nil || end != 2 {
 		t.Fatalf("short end=%d err=%v", end, err)
 	}
+	// Room exactly equal to the bytes left takes the rest without reading past the end.
+	end, err = cutEnd([]byte("abc"), 1, 2)
+	if err != nil || end != 3 {
+		t.Fatalf("exact end=%d err=%v", end, err)
+	}
 	header := sliceHeader("p.go", 1)
 	if _, err := sliceFile(File{Path: "p.go", Body: []byte("世")}, len(header)+len("p.go")+1+1); err == nil {
 		t.Fatal("sliceFile should reject a rune that does not fit")
@@ -169,10 +182,82 @@ func TestCutEndAndSliceErrors(t *testing.T) {
 func TestPromptNamesPathBeforeBody(t *testing.T) {
 	body := []byte("package pkg\nfunc A() {}\n")
 	p := promptWith(instruction, []File{{Path: "pkg/app.go", Body: body}})
-	if !bytes.Contains(p, append([]byte("pkg/app.go\n"), body...)) {
-		t.Fatalf("path is not immediately before the body:\n%s", p)
+	if !bytes.Contains(p, []byte("pkg/app.go\n1| package pkg\n2| func A() {}\n")) {
+		t.Fatalf("path is not immediately before the numbered body:\n%s", p)
+	}
+	if !bytes.Contains(p, []byte(`{"findings":[...]}`)) || !bytes.Contains(p, []byte("Cite those numbers.")) {
+		t.Fatal("instruction missing findings object or line-number note")
+	}
+}
+
+func TestNumberLines(t *testing.T) {
+	cases := []struct {
+		body  string
+		first int
+		want  string
+	}{
+		{"", 1, ""},
+		{"a\n", 1, "1| a\n"},
+		{"a\nb", 1, "1| a\n2| b"},
+		{"a\n\nb\n", 7, "7| a\n8| \n9| b\n"},
+	}
+	for _, c := range cases {
+		if got := string(numberLines([]byte(c.body), c.first)); got != c.want {
+			t.Fatalf("numberLines(%q, %d) = %q, want %q", c.body, c.first, got, c.want)
+		}
+	}
+}
+
+func TestSliceNumbersFromOriginalLine(t *testing.T) {
+	// 30,000 two-byte lines do not fit one prompt, and numbering more than
+	// doubles their size, so each cut has to shrink to fit the numbered text.
+	var body bytes.Buffer
+	for i := 1; i <= 30000; i++ {
+		body.WriteString("x\n")
+	}
+	f := File{Path: "short.go", Body: body.Bytes()}
+	const budget = 20000
+	prompts, err := sliceFile(f, budget)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(prompts) < 2 {
+		t.Fatalf("prompts = %d", len(prompts))
+	}
+	number := regexp.MustCompile(`(?m)^(\d+)\| `)
+	off := 0
+	for _, p := range prompts {
+		if len(p) > budget {
+			t.Fatalf("prompt is %d bytes", len(p))
+		}
+		numbered := p[bytes.Index(p, []byte("short.go\n"))+len("short.go\n"):]
+		first := number.FindSubmatch(numbered)
+		if first == nil || string(first[1]) != strconv.Itoa(lineAt(f.Body, off)) {
+			t.Fatalf("slice at offset %d starts at %q, want line %d", off, first, lineAt(f.Body, off))
+		}
+		part := number.ReplaceAll(numbered, nil)
+		if !bytes.HasPrefix(f.Body[off:], part) {
+			t.Fatalf("slice at offset %d is not the next bytes of the file", off)
+		}
+		off += len(part)
+	}
+	if off != len(f.Body) {
+		t.Fatalf("partition covered %d of %d", off, len(f.Body))
+	}
+}
+
+func TestCutNumbered(t *testing.T) {
+	// Numbered, "a\nb\nc" is 14 bytes for a room of 5; the cut shrinks until
+	// the numbered text fits.
+	end, err := cutNumbered([]byte("a\nb\nc\n"), 0, 5, 1)
+	if err != nil || end != 1 {
+		t.Fatalf("end=%d err=%v", end, err)
+	}
+	end, err = cutNumbered([]byte("abcdef"), 0, 5, 1)
+	if err != nil || end != 2 {
+		t.Fatalf("end=%d err=%v", end, err)
 	}
-	if !bytes.Contains(p, []byte(`{"findings":[...]}`)) {
-		t.Fatal("instruction missing findings object")
+	if _, err := cutNumbered([]byte("abc"), 0, 3, 100000); err == nil {
+		t.Fatal("a number wider than the room cannot fit")
 	}
 }
diff --git a/internal/sourcereview/page.go b/internal/sourcereview/page.go
index 6c97be11..08c358c1 100644
--- a/internal/sourcereview/page.go
+++ b/internal/sourcereview/page.go
@@ -19,6 +19,8 @@ type Page struct {
 	Files    map[string][]byte
 }
 
+var severities = []string{"P0", "P1", "P2", "P3"}
+
 func severityCounts(fs []lensoutput.TypedFinding) (p0, p1, p2, p3 int) {
 	for _, f := range fs {
 		switch f.Severity {
@@ -57,28 +59,225 @@ func excerpt(body []byte, start, end int) string {
 	return strings.Join(lines[start-1:end], "\n")
 }
 
+// area is the part of the tree a finding belongs to on the map: the first two
+// segments of its directory ("app/models" for app/models/concerns/x.rb).
+func area(file string) string {
+	parts := strings.Split(path.Dir(file), "/")
+	if len(parts) > 2 {
+		parts = parts[:2]
+	}
+	return strings.Join(parts, "/")
+}
+
+// summary is the first sentence of an issue, for the collapsed row. The full
+// issue is shown when the finding is opened.
+func summary(issue string) string {
+	s := strings.TrimSpace(issue)
+	if i := strings.Index(s, ". "); i >= 0 {
+		s = s[:i+1]
+	}
+	return s
+}
+
+func severityRank(s string) int {
+	for i, v := range severities {
+		if v == s {
+			return i
+		}
+	}
+	return len(severities)
+}
+
+// fileGroup is every finding in one file, in the order the page shows them.
+type fileGroup struct {
+	file     string
+	findings []lensoutput.TypedFinding
+	worst    int
+}
+
+// groupByFile puts the files with the most severe findings first, then the
+// files with the most findings. Inside a file, findings go by severity, then line.
+func groupByFile(fs []lensoutput.TypedFinding) []fileGroup {
+	index := map[string]int{}
+	var groups []fileGroup
+	for _, f := range fs {
+		i, ok := index[f.File]
+		if !ok {
+			i = len(groups)
+			index[f.File] = i
+			groups = append(groups, fileGroup{file: f.File, worst: len(severities)})
+		}
+		groups[i].findings = append(groups[i].findings, f)
+		if r := severityRank(f.Severity); r < groups[i].worst {
+			groups[i].worst = r
+		}
+	}
+	for _, g := range groups {
+		sort.SliceStable(g.findings, func(a, b int) bool {
+			ra, rb := severityRank(g.findings[a].Severity), severityRank(g.findings[b].Severity)
+			if ra != rb {
+				return ra < rb
+			}
+			return g.findings[a].StartLine < g.findings[b].StartLine
+		})
+	}
+	sort.SliceStable(groups, func(a, b int) bool {
+		if groups[a].worst != groups[b].worst {
+			return groups[a].worst < groups[b].worst
+		}
+		if len(groups[a].findings) != len(groups[b].findings) {
+			return len(groups[a].findings) > len(groups[b].findings)
+		}
+		return groups[a].file < groups[b].file
+	})
+	return groups
+}
+
+// areaRow is one line of the map: an area and its findings' severities, worst first.
+type areaRow struct {
+	name       string
+	severities []string
+}
+
+func areaRows(fs []lensoutput.TypedFinding) []areaRow {
+	index := map[string]int{}
+	var rows []areaRow
+	for _, f := range fs {
+		a := area(f.File)
+		i, ok := index[a]
+		if !ok {
+			i = len(rows)
+			index[a] = i
+			rows = append(rows, areaRow{name: a})
+		}
+		rows[i].severities = append(rows[i].severities, f.Severity)
+	}
+	for _, r := range rows {
+		sort.SliceStable(r.severities, func(a, b int) bool {
+			return severityRank(r.severities[a]) < severityRank(r.severities[b])
+		})
+	}
+	sort.SliceStable(rows, func(a, b int) bool {
+		if len(rows[a].severities) != len(rows[b].severities) {
+			return len(rows[a].severities) > len(rows[b].severities)
+		}
+		return rows[a].name < rows[b].name
+	})
+	return rows
+}
+
+// thousands writes n with comma separators: 1346 -> "1,346".
+func thousands(n int) string {
+	s := fmt.Sprint(n)
+	for i := len(s) - 3; i > 0; i -= 3 {
+		s = s[:i] + "," + s[i:]
+	}
+	return s
+}
+
+// lede is the one sentence at the top of the page: what ran, what it found,
+// and where to start.
+func lede(model string, reviewed int, counts []int) string {
+	total := 0
+	for _, c := range counts {
+		total += c
+	}
+	s := fmt.Sprintf("Reviewed %s with %s", plural(reviewed, "file", "files"), model)
+	if total == 0 {
+		return s + " and found nothing to report."
+	}
+	s += "."
+	worst := 0
+	for counts[worst] == 0 {
+		worst++
+	}
+	switch c := counts[worst]; {
+	case total == 1:
+		return s + fmt.Sprintf(" The one finding is a %s.", severities[worst])
+	case c == total:
+		return s + fmt.Sprintf(" All %s findings are %s.", thousands(c), severities[worst])
+	default:
+		return s + fmt.Sprintf(" Start with the %s at %s.", thousands(c), severities[worst])
+	}
+}
+
+func plural(n int, one, many string) string {
+	if n == 1 {
+		return "1 " + one
+	}
+	return thousands(n) + " " + many
+}
+
 const pageScript = `
 (function () {
   var severity = document.getElementById("severity");
   var directory = document.getElementById("directory");
+  var search = document.getElementById("search");
+  var shown = document.getElementById("shown");
   var findings = document.querySelectorAll("#findings .finding");
+  var groups = document.querySelectorAll("#findings .group");
+  var areas = document.querySelectorAll("#map .area");
+  var segments = document.querySelectorAll("#bar .seg");
+  var area = "";
+  function press(list, attr, value) {
+    for (var i = 0; i < list.length; i++) {
+      list[i].setAttribute("aria-pressed", list[i].getAttribute(attr) === value ? "true" : "false");
+    }
+  }
   function apply() {
     var s = severity.value;
     var d = directory.value;
+    var q = search ? search.value.toLowerCase() : "";
+    var n = 0;
     for (var i = 0; i < findings.length; i++) {
       var el = findings[i];
       var okS = s === "" || el.getAttribute("data-severity") === s;
       var okD = d === "" || el.getAttribute("data-dir") === d;
-      el.style.display = (okS && okD) ? "" : "none";
+      var okA = area === "" || el.getAttribute("data-area") === area;
+      var okQ = q === "" || el.textContent.toLowerCase().indexOf(q) >= 0;
+      var ok = okS && okD && okA && okQ;
+      el.style.display = ok ? "" : "none";
+      if (ok) n++;
+    }
+    for (var g = 0; g < groups.length; g++) {
+      var items = groups[g].querySelectorAll(".finding");
+      var any = false;
+      for (var k = 0; k < items.length; k++) {
+        if (items[k].style.display !== "none") any = true;
+      }
+      groups[g].style.display = any ? "" : "none";
+    }
+    press(segments, "data-severity", s);
+    press(areas, "data-area", area);
+    if (shown) {
+      shown.textContent = n === findings.length
+        ? "Showing all " + n
+        : "Showing " + n + " of " + findings.length;
     }
   }
   severity.addEventListener("change", apply);
   directory.addEventListener("change", apply);
+  if (search) search.addEventListener("input", apply);
+  for (var a = 0; a < segments.length; a++) {
+    segments[a].addEventListener("click", function () {
+      var v = this.getAttribute("data-severity");
+      severity.value = severity.value === v ? "" : v;
+      apply();
+    });
+  }
+  for (var b = 0; b < areas.length; b++) {
+    areas[b].addEventListener("click", function () {
+      var v = this.getAttribute("data-area");
+      area = area === v ? "" : v;
+      apply();
+    });
+  }
   var buttons = document.querySelectorAll("#findings .finding > button");
   for (var j = 0; j < buttons.length; j++) {
     buttons[j].addEventListener("click", function () {
       var detail = this.parentNode.querySelector(".detail");
       detail.hidden = !detail.hidden;
+      this.setAttribute("aria-expanded", detail.hidden ? "false" : "true");
     });
   }
 })();
@@ -86,135 +285,320 @@ const pageScript = `
 
 const pageCSS = `
 :root {
-  --paper: #e4ebf0;
-  --ink: #17202a;
-  --muted: #4e5d6c;
-  --line: #c3cdd6;
-  --sheet: #f4f7f9;
-  --p0: #9b2335;
-  --p1: #c05621;
-  --p2: #8a6d1b;
-  --p3: #1f6f68;
+  color-scheme: light;
+  --ground: #ffffff;
+  --ink: #1f232b;
+  --soft: #5b6472;
+  --faint: #8b93a0;
+  --rule: #e3e6eb;
+  --well: #f4f5f7;
+  --hover: #f7f8fa;
+  --p0: #b3122e;
+  --p1: #d9480f;
+  --p2: #c08a1e;
+  --p3: #4a7fa3;
+  --empty: #e3e6eb;
+  --focus: #1f232b;
+  --display: "Avenir Next Condensed", "Avenir Next", "Helvetica Neue", Arial, sans-serif;
+  --ui: "Avenir Next", "Helvetica Neue", "Segoe UI", Arial, sans-serif;
+  --prose: Charter, "Iowan Old Style", "Sitka Text", Georgia, serif;
+  --code: "SF Mono", ui-monospace, Menlo, Consolas, monospace;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --ground: #16191e;
+    --ink: #e8eaee;
+    --soft: #a9b0bb;
+    --faint: #737b87;
+    --rule: #2b3038;
+    --well: #1e2228;
+    --hover: #1c2026;
+    --p0: #f0506b;
+    --p1: #f57c3a;
+    --p2: #e0b14a;
+    --p3: #74a9cf;
+    --empty: #2b3038;
+    --focus: #e8eaee;
+  }
 }
 * { box-sizing: border-box; }
-html { background: var(--paper); }
+html { background: var(--ground); }
 body {
-  margin: 0 auto;
-  max-width: 68rem;
-  padding: 2rem 1.5rem 4rem;
+  margin: 0;
+  padding: 3rem clamp(1rem, 3vw, 3.5rem) 5rem;
   color: var(--ink);
-  font: 17px/1.5 Charter, "Iowan Old Style", Palatino, Georgia, serif;
+  font: 16px/1.5 var(--ui);
+  -webkit-font-smoothing: antialiased;
 }
-header { padding-bottom: 1.1rem; border-bottom: 1px solid var(--line); }
-#repo {
+button, input, select { font: inherit; color: inherit; }
+:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+
+/* Masthead: the repo, what reviewed it, and how much it found. */
+.masthead {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: 0.5rem 2rem;
+  align-items: end;
+}
+.masthead h1 {
   margin: 0;
-  font-family: "Avenir Next", "Segoe UI", sans-serif;
-  font-size: 1.6rem;
-  font-weight: 600;
+  font-family: var(--display);
+  font-size: clamp(2.6rem, 6vw, 4.5rem);
+  font-weight: 700;
+  line-height: 0.95;
   letter-spacing: -0.02em;
-  line-height: 1.2;
-  overflow-wrap: anywhere;
 }
-.identity {
+#repo { margin: 0.5rem 0 0; color: var(--soft); overflow-wrap: anywhere; }
+.lede {
+  max-width: 34rem;
+  margin: 1.4rem 0 0;
+  font-family: var(--prose);
+  font-size: 1.3rem;
+  line-height: 1.4;
+}
+.facts {
   display: grid;
-  gap: 0.15rem;
-  margin-top: 0.45rem;
-  color: var(--muted);
-  font-family: "Avenir Next", "Segoe UI", sans-serif;
-  font-size: 0.92rem;
-}
-#commit { overflow-wrap: anywhere; }
-.identity p { margin: 0; }
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 0.15rem 1rem;
+  margin: 0;
+  font-size: 0.9rem;
+}
+.facts dt { color: var(--faint); }
+.facts dd { margin: 0; font-variant-numeric: tabular-nums; }
+#commit { font-family: var(--code); font-size: 0.82rem; overflow-wrap: anywhere; }
+
+/* The tally: one bar split by severity, with the four counts under it. */
+.tally { margin: 2.5rem 0 0; }
+.total {
+  margin: 0 0 0.6rem;
+  font-family: var(--display);
+  font-size: 1.5rem;
+  font-weight: 600;
+}
+.total span { color: var(--soft); font-weight: 500; }
+#bar {
+  display: flex;
+  gap: 3px;
+  height: 0.9rem;
+}
+#bar .seg {
+  min-width: 0.5rem;
+  padding: 0;
+  border: 0;
+  border-radius: 2px;
+  cursor: pointer;
+}
+#bar .seg[aria-pressed="true"] { box-shadow: 0 0 0 2px var(--ground), 0 0 0 4px var(--ink); }
+#bar .seg:hover { filter: brightness(1.1); }
 .counts {
   display: flex;
   flex-wrap: wrap;
-  gap: 0.55rem;
-  margin: 0.9rem 0 0;
+  gap: 0.3rem 1.8rem;
+  margin: 0.7rem 0 0;
   padding: 0;
   list-style: none;
-  font-family: "Avenir Next", "Segoe UI", sans-serif;
+  font-size: 0.95rem;
   font-variant-numeric: tabular-nums;
 }
-.counts li {
-  min-width: 4.6rem;
-  padding: 0.35rem 0.7rem 0.28rem;
-  background: var(--sheet);
-  border-top: 3px solid var(--line);
-}
-#count-p0 { border-top-color: var(--p0); }
-#count-p1 { border-top-color: var(--p1); }
-#count-p2 { border-top-color: var(--p2); }
-#count-p3 { border-top-color: var(--p3); }
-.filters {
+.counts li::before {
+  content: "";
+  display: inline-block;
+  width: 0.65rem;
+  height: 0.65rem;
+  margin-right: 0.45rem;
+  border-radius: 2px;
+  background: var(--empty);
+}
+#count-p0::before, .sev-P0 { background: var(--p0); }
+#count-p1::before, .sev-P1 { background: var(--p1); }
+#count-p2::before, .sev-P2 { background: var(--p2); }
+#count-p3::before, .sev-P3 { background: var(--p3); }
+
+/* The map: where in the tree the findings sit, one tick per finding. */
+.map-head {
+  margin: 3rem 0 0.25rem;
+  font-family: var(--display);
+  font-size: 1.5rem;
+  font-weight: 600;
+}
+.hint { margin: 0 0 1rem; color: var(--soft); font-size: 0.9rem; }
+#map {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(min(30rem, 100%), 1fr));
+  gap: 0 2.5rem;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+#map .area {
+  display: grid;
+  grid-template-columns: 9.5rem minmax(0, 1fr) 2.2rem;
+  gap: 0.9rem;
+  align-items: center;
+  width: 100%;
+  padding: 0.3rem 0.4rem;
+  background: transparent;
+  border: 0;
+  border-radius: 3px;
+  cursor: pointer;
+  text-align: left;
+}
+#map .area:hover { background: var(--hover); }
+#map .area[aria-pressed="true"] { background: var(--well); box-shadow: inset 3px 0 0 var(--ink); }
+.area-name {
+  overflow: hidden;
+  font-family: var(--code);
+  font-size: 0.8rem;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.track { display: block; }
+.ticks { display: flex; gap: 1px; min-width: 4px; }
+.tick { flex: 1 1 0; min-width: 1px; height: 1rem; border-radius: 1px; }
+.area-count { color: var(--soft); font-size: 0.85rem; text-align: right; font-variant-numeric: tabular-nums; }
+
+/* Controls stay on screen while the list scrolls. */
+.controls {
+  position: sticky;
+  top: 0;
+  z-index: 2;
   display: flex;
   flex-wrap: wrap;
-  gap: 0.8rem 1.6rem;
-  margin: 1.15rem 0;
-  font-family: "Avenir Next", "Segoe UI", sans-serif;
-  font-size: 0.95rem;
+  gap: 0.6rem 1.2rem;
+  align-items: center;
+  margin: 3rem 0 0;
+  padding: 0.9rem 0;
+  background: var(--ground);
+  border-bottom: 1px solid var(--rule);
 }
-select {
-  margin-left: 0.35rem;
-  padding: 0.28rem 0.4rem;
+.controls label { display: flex; gap: 0.45rem; align-items: center; color: var(--soft); font-size: 0.9rem; }
+select, input[type="search"] {
+  padding: 0.35rem 0.55rem;
   color: var(--ink);
-  background: var(--sheet);
-  border: 1px solid var(--line);
-  border-radius: 2px;
-  font: inherit;
+  background: var(--ground);
+  border: 1px solid var(--rule);
+  border-radius: 4px;
 }
-#findings { border-bottom: 1px solid var(--line); }
-article.finding {
-  margin: 0;
-  background: var(--sheet);
-  border-top: 1px solid var(--line);
-  border-left: 5px solid var(--line);
-}
-article.finding[data-severity="P0"] { border-left-color: var(--p0); }
-article.finding[data-severity="P1"] { border-left-color: var(--p1); }
-article.finding[data-severity="P2"] { border-left-color: var(--p2); }
-article.finding[data-severity="P3"] { border-left-color: var(--p3); }
+select { max-width: 17rem; }
+input[type="search"] { width: 16rem; }
+#shown { margin-left: auto; color: var(--soft); font-size: 0.9rem; font-variant-numeric: tabular-nums; }
+
+/* Findings, grouped by file. */
+#findings { margin-top: 0.5rem; }
+.group { padding: 1.4rem 0 0.4rem; border-bottom: 1px solid var(--rule); }
+.group-head {
+  display: flex;
+  gap: 1rem;
+  align-items: baseline;
+  justify-content: space-between;
+  margin: 0 0 0.35rem;
+  font-family: var(--code);
+  font-size: 0.86rem;
+  font-weight: 600;
+  overflow-wrap: anywhere;
+}
+.group-head .dir { color: var(--faint); font-weight: 400; }
+.group-head .n { flex: none; color: var(--faint); font-family: var(--ui); font-weight: 400; }
+article.finding { margin: 0; }
 article.finding > button {
-  display: block;
+  display: grid;
+  grid-template-columns: 2.6rem 5.2rem minmax(0, 1fr) auto;
+  gap: 0.9rem;
+  align-items: baseline;
   width: 100%;
-  padding: 0.72rem 1rem;
-  color: var(--ink);
+  padding: 0.55rem 0.5rem;
   background: transparent;
   border: 0;
+  border-radius: 4px;
   cursor: pointer;
-  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-  font-size: 0.9rem;
   text-align: left;
-  white-space: normal;
-  overflow-wrap: anywhere;
 }
-article.finding > button:hover,
-article.finding > button:focus-visible { background: #e7eef3; }
-article.finding > button:focus-visible { outline: 2px solid var(--ink); outline-offset: -2px; }
+article.finding > button:hover { background: var(--hover); }
+.badge {
+  justify-self: start;
+  padding: 0.05rem 0.4rem;
+  border-radius: 3px;
+  color: #fff;
+  font-size: 0.75rem;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+}
+@media (prefers-color-scheme: dark) { .badge { color: #16191e; } }
+.lines { color: var(--faint); font-family: var(--code); font-size: 0.8rem; font-variant-numeric: tabular-nums; }
+.summary { font-family: var(--prose); font-size: 1rem; line-height: 1.45; overflow-wrap: anywhere; }
+.consequence { overflow-wrap: anywhere; }
+.tag { color: var(--faint); font-size: 0.8rem; }
+.tag-bug { color: var(--soft); }
+/* Open: the rest of the issue appears in place, and the impact and code sit under it. */
+.rest { display: none; }
+article.finding > button[aria-expanded="true"] { background: var(--well); border-radius: 4px 4px 0 0; }
+article.finding > button[aria-expanded="true"] .rest { display: inline; }
+article.finding > button[aria-expanded="true"] .lead { font-weight: 600; }
 .detail { display: none; }
 .detail:not([hidden]) {
   display: grid;
-  grid-template-columns: minmax(16rem, 0.9fr) minmax(18rem, 1.15fr);
-  gap: 1rem 1.5rem;
-  padding: 0 1rem 1rem 1.1rem;
+  grid-template-columns: minmax(0, 36rem) minmax(0, 1fr);
+  gap: 2rem;
+  margin: 0 0 1rem;
+  padding: 0.6rem 0.5rem 1.2rem 10.1rem;
+  background: var(--well);
+  border-radius: 0 0 4px 4px;
 }
-.issue { margin: 0 0 0.55rem; font-size: 1.05rem; }
-.consequence { margin: 0; color: var(--muted); }
-.quote {
-  margin: 0;
-  padding: 0.75rem 0.9rem;
+.prose { font-family: var(--prose); max-width: 38rem; }
+.consequence { margin: 0; color: var(--ink); line-height: 1.55; }
+.consequence::before { content: "Impact: "; color: var(--ink); font-family: var(--ui); font-size: 0.85rem; font-weight: 600; }
+.confidence { margin: 0.9rem 0 0; color: var(--faint); font-family: var(--ui); font-size: 0.82rem; }
+.code {
+  display: flex;
+  max-height: 24rem;
   overflow: auto;
-  background: #e7eef3;
-  color: var(--ink);
-  border-left: 1px solid var(--line);
-  font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-  font-size: 0.8rem;
-  line-height: 1.45;
+  background: var(--ground);
+  border: 1px solid var(--rule);
+  border-radius: 5px;
+  align-self: start;
+}
+.gutter, .quote {
+  margin: 0;
+  padding: 0.8rem 0.9rem;
+  font-family: var(--code);
+  font-size: 0.78rem;
+  line-height: 1.55;
   white-space: pre;
 }
-@media (max-width: 720px) {
-  body { padding: 1rem 0.75rem 2.5rem; }
-  #repo { font-size: 1.25rem; }
-  .detail:not([hidden]) { grid-template-columns: 1fr; }
+.gutter {
+  position: sticky;
+  left: 0;
+  flex: none;
+  padding-right: 0.7rem;
+  color: var(--faint);
+  background: var(--ground);
+  border-right: 1px solid var(--rule);
+  text-align: right;
+  user-select: none;
+}
+.quote { flex: 1; color: var(--ink); }
+.empty {
+  margin: 3rem 0;
+  font-family: var(--prose);
+  font-size: 1.15rem;
+  color: var(--soft);
+}
+@media (max-width: 760px) {
+  body { padding: 1.5rem 1rem 3rem; }
+  .masthead { grid-template-columns: 1fr; }
+  #map { grid-template-columns: 1fr; }
+  #map .area { grid-template-columns: 7rem minmax(0, 1fr) 2rem; }
+  article.finding > button { grid-template-columns: 2.6rem minmax(0, 1fr); }
+  .lines { grid-column: 2; grid-row: 2; }
+  .summary { grid-column: 2; grid-row: 1; }
+  .tag { display: none; }
+  .detail:not([hidden]) { grid-template-columns: 1fr; padding-left: 0.5rem; }
+  input[type="search"] { width: 100%; }
+  #shown { margin-left: 0; }
+}
+@media (prefers-reduced-motion: no-preference) {
+  article.finding > button, #map .area { transition: background-color 120ms ease; }
 }
 `
 
@@ -222,21 +606,54 @@ article.finding > button:focus-visible { outline: 2px solid var(--ink); outline-
 // excerpt of the cited lines; it is not a field of the findings file.
 func Render(p Page) []byte {
 	p0, p1, p2, p3 := severityCounts(p.Findings)
+	counts := []int{p0, p1, p2, p3}
+	total := len(p.Findings)
+	groups := groupByFile(p.Findings)
+	name := path.Base(p.Repo)
 	var b strings.Builder
-	b.WriteString("<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>Source review</title>\n<style>")
+	fmt.Fprintf(&b, "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>%s source review</title>\n<style>", html.EscapeString(name))
 	b.WriteString(pageCSS)
-	b.WriteString("</style>\n</head>\n<body>\n<header>\n")
+	b.WriteString("</style>\n</head>\n<body>\n<header class=\"masthead\">\n<div>\n")
+	fmt.Fprintf(&b, "<h1>%s</h1>\n", html.EscapeString(name))
 	fmt.Fprintf(&b, "<p class=\"meta\" id=\"repo\">%s</p>\n", html.EscapeString(p.Repo))
-	b.WriteString("<div class=\"identity\">\n")
-	fmt.Fprintf(&b, "<p class=\"meta\" id=\"commit\">%s</p>\n", html.EscapeString(p.Commit))
-	fmt.Fprintf(&b, "<p class=\"meta\" id=\"model\">%s</p>\n", html.EscapeString(p.ModelID))
-	b.WriteString("</div>\n")
-	b.WriteString("<ul class=\"counts\">\n")
-	fmt.Fprintf(&b, "<li id=\"count-p0\">P0 %d</li>\n", p0)
-	fmt.Fprintf(&b, "<li id=\"count-p1\">P1 %d</li>\n", p1)
-	fmt.Fprintf(&b, "<li id=\"count-p2\">P2 %d</li>\n", p2)
-	fmt.Fprintf(&b, "<li id=\"count-p3\">P3 %d</li>\n", p3)
-	b.WriteString("</ul>\n</header>\n<div class=\"filters\">\n")
+	fmt.Fprintf(&b, "<p class=\"lede\">%s</p>\n", html.EscapeString(lede(p.ModelID, len(p.Files), counts)))
+	b.WriteString("</div>\n<dl class=\"facts\">\n")
+	fmt.Fprintf(&b, "<dt>Model</dt><dd class=\"meta\" id=\"model\">%s</dd>\n", html.EscapeString(p.ModelID))
+	fmt.Fprintf(&b, "<dt>Commit</dt><dd class=\"meta\" id=\"commit\">%s</dd>\n", html.EscapeString(p.Commit))
+	fmt.Fprintf(&b, "<dt>Reviewed</dt><dd>%s</dd>\n", plural(len(p.Files), "file", "files"))
+	b.WriteString("</dl>\n</header>\n")
+
+	b.WriteString("<section class=\"tally\">\n")
+	fmt.Fprintf(&b, "<p class=\"total\">%s <span>in %s</span></p>\n", plural(total, "finding", "findings"), plural(len(groups), "file", "files"))
+	b.WriteString("<div id=\"bar\">\n")
+	for i, s := range severities {
+		if counts[i] == 0 {
+			continue
+		}
+		fmt.Fprintf(&b, "<button type=\"button\" class=\"seg sev-%s\" data-severity=\"%s\" style=\"flex-grow:%d\" aria-pressed=\"false\" title=\"Show only %s\"><span hidden>%s</span></button>\n", s, s, counts[i], s, s)
+	}
+	b.WriteString("</div>\n<ul class=\"counts\">\n")
+	for i, s := range severities {
+		fmt.Fprintf(&b, "<li id=\"count-%s\">%s %d</li>\n", strings.ToLower(s), s, counts[i])
+	}
+	b.WriteString("</ul>\n</section>\n")
+
+	if total > 0 {
+		b.WriteString("<section>\n<h2 class=\"map-head\">Where the findings are</h2>\n")
+		b.WriteString("<p class=\"hint\">One mark per finding, worst first. Select an area to show only its findings.</p>\n<ul id=\"map\">\n")
+		rows := areaRows(p.Findings)
+		most := len(rows[0].severities)
+		for _, r := range rows {
+			fmt.Fprintf(&b, "<li><button type=\"button\" class=\"area\" data-area=\"%s\" aria-pressed=\"false\"><span class=\"area-name\">%s</span><span class=\"track\"><span class=\"ticks\" style=\"width:%.2f%%\">", html.EscapeString(r.name), html.EscapeString(r.name), 100*float64(len(r.severities))/float64(most))
+			for _, s := range r.severities {
+				fmt.Fprintf(&b, "<i class=\"tick sev-%s\"></i>", html.EscapeString(s))
+			}
+			fmt.Fprintf(&b, "</span></span><span class=\"area-count\">%d</span></button></li>\n", len(r.severities))
+		}
+		b.WriteString("</ul>\n</section>\n")
+	}
+
+	b.WriteString("<div class=\"controls\">\n")
 	b.WriteString("<label>Severity <select id=\"severity\">\n")
 	b.WriteString("<option value=\"\">all</option>\n<option value=\"P0\">P0</option>\n<option value=\"P1\">P1</option>\n<option value=\"P2\">P2</option>\n<option value=\"P3\">P3</option>\n")
 	b.WriteString("</select></label>\n")
@@ -244,21 +661,47 @@ func Render(p Page) []byte {
 	for _, d := range findingDirs(p.Findings) {
 		fmt.Fprintf(&b, "<option value=\"%s\">%s</option>\n", html.EscapeString(d), html.EscapeString(d))
 	}
-	b.WriteString("</select></label>\n</div>\n<div id=\"findings\">\n")
-	for _, f := range p.Findings {
-		dir := path.Dir(f.File)
-		quote := ""
-		if p.Files != nil {
-			quote = excerpt(p.Files[f.File], f.StartLine, f.EndLine)
+	b.WriteString("</select></label>\n")
+	b.WriteString("<label>Search <input type=\"search\" id=\"search\" placeholder=\"Words in the issue, file, or code\"></label>\n")
+	fmt.Fprintf(&b, "<p id=\"shown\">Showing all %d</p>\n", total)
+	b.WriteString("</div>\n<div id=\"findings\">\n")
+	if total == 0 {
+		fmt.Fprintf(&b, "<p class=\"empty\">No findings. %s reviewed %s and reported nothing to fix.</p>\n", html.EscapeString(p.ModelID), plural(len(p.Files), "file", "files"))
+	}
+	for _, g := range groups {
+		b.WriteString("<section class=\"group\">\n")
+		dirPart, base := path.Split(g.file)
+		fmt.Fprintf(&b, "<h3 class=\"group-head\"><span><span class=\"dir\">%s</span>%s</span><span class=\"n\">%s</span></h3>\n", html.EscapeString(dirPart), html.EscapeString(base), plural(len(g.findings), "finding", "findings"))
+		for _, f := range g.findings {
+			dir := path.Dir(f.File)
+			quote := ""
+			if p.Files != nil {
+				quote = excerpt(p.Files[f.File], f.StartLine, f.EndLine)
+			}
+			lines := fmt.Sprintf("L%d", f.StartLine)
+			if f.EndLine != f.StartLine {
+				lines = fmt.Sprintf("L%d–%d", f.StartLine, f.EndLine)
+			}
+			tag := string(f.Tag)
+			fmt.Fprintf(&b, "<article class=\"finding\" data-severity=\"%s\" data-dir=\"%s\" data-area=\"%s\">\n", html.EscapeString(f.Severity), html.EscapeString(dir), html.EscapeString(area(f.File)))
+			// The row shows the issue's first sentence; opening it reveals the rest in place.
+			issue := strings.TrimSpace(f.Issue)
+			lead := summary(issue)
+			fmt.Fprintf(&b, "<button type=\"button\" aria-expanded=\"false\"><span class=\"badge sev-%s\">%s</span><span class=\"lines\">%s</span><span class=\"summary issue\"><span class=\"lead\">%s</span><span class=\"rest\">%s</span></span><span class=\"tag tag-%s\">%s</span></button>\n",
+				html.EscapeString(f.Severity), html.EscapeString(f.Severity), lines, html.EscapeString(lead), html.EscapeString(issue[len(lead):]), html.EscapeString(tag), html.EscapeString(tag))
+			b.WriteString("<div class=\"detail\" hidden>\n<div class=\"prose\">\n")
+			fmt.Fprintf(&b, "<p class=\"consequence\">%s</p>\n", html.EscapeString(f.Consequence))
+			fmt.Fprintf(&b, "<p class=\"confidence\">Model confidence %d of 100</p>\n", f.Confidence)
+			b.WriteString("</div>\n<div class=\"code\">")
+			var gutter []string
+			for n := f.StartLine; quote != "" && n <= f.EndLine; n++ {
+				gutter = append(gutter, fmt.Sprint(n))
+			}
+			fmt.Fprintf(&b, "<pre class=\"gutter\" aria-hidden=\"true\">%s</pre>", strings.Join(gutter, "\n"))
+			fmt.Fprintf(&b, "<pre class=\"quote\">%s</pre>", html.EscapeString(quote))
+			b.WriteString("</div>\n</div>\n</article>\n")
 		}
-		fmt.Fprintf(&b, "<article class=\"finding\" data-severity=\"%s\" data-dir=\"%s\">\n", html.EscapeString(f.Severity), html.EscapeString(dir))
-		fmt.Fprintf(&b, "<button type=\"button\">%s:%d-%d</button>\n", html.EscapeString(f.File), f.StartLine, f.EndLine)
-		b.WriteString("<div class=\"detail\" hidden>\n<div class=\"prose\">\n")
-		fmt.Fprintf(&b, "<p class=\"issue\">%s</p>\n", html.EscapeString(f.Issue))
-		fmt.Fprintf(&b, "<p class=\"consequence\">%s</p>\n", html.EscapeString(f.Consequence))
-		b.WriteString("</div>\n")
-		fmt.Fprintf(&b, "<pre class=\"quote\">%s</pre>\n", html.EscapeString(quote))
-		b.WriteString("</div>\n</article>\n")
+		b.WriteString("</section>\n")
 	}
 	b.WriteString("</div>\n<script id=\"page\">")
 	b.WriteString(pageScript)
diff --git a/internal/sourcereview/page_test.go b/internal/sourcereview/page_test.go
index 370a5f79..b2e03da5 100644
--- a/internal/sourcereview/page_test.go
+++ b/internal/sourcereview/page_test.go
@@ -59,9 +59,103 @@ func TestRenderFiltersAndQuote(t *testing.T) {
 	if dir.Displays[0] != "" || dir.Displays[1] != "none" {
 		t.Fatalf("directory filter displays %v", dir.Displays)
 	}
-	if report.Opened.Hidden || report.Opened.Issue != "root broke" || report.Opened.Consequence != "no entry" || report.Opened.Quote != "package main" {
+	if report.Opened.Hidden || report.Opened.Expanded != "true" || report.Opened.Issue != "root broke" || report.Opened.Consequence != "no entry" || report.Opened.Quote != "package main" {
 		t.Fatalf("opened %+v", report.Opened)
 	}
+	if !report.Closed.Hidden || report.Closed.Expanded != "false" {
+		t.Fatalf("closed %+v", report.Closed)
+	}
+	all := []string{"", "", "", ""}
+	if report.Bar.Severity != "P0" || !reflectArgs(report.Bar.Displays, []string{"", "none", "none", "none"}) || report.Bar.Pressed != "true" || report.Bar.Shown != "Showing 1 of 4" {
+		t.Fatalf("bar %+v", report.Bar)
+	}
+	if report.BarCleared.Severity != "" || !reflectArgs(report.BarCleared.Displays, all) || report.BarCleared.Shown != "Showing all 4" {
+		t.Fatalf("bar cleared %+v", report.BarCleared)
+	}
+	// The biggest area is the repo root: main.go and a.go.
+	if report.Area.Name != "." || !reflectArgs(report.Area.Displays, []string{"", "none", "", "none"}) || !reflectArgs(report.Area.Groups, []string{"", "none", "", "none"}) || report.Area.Pressed != "true" {
+		t.Fatalf("area %+v", report.Area)
+	}
+	if !reflectArgs(report.AreaCleared.Displays, all) || report.AreaCleared.Pressed != "false" {
+		t.Fatalf("area cleared %+v", report.AreaCleared)
+	}
+	if !reflectArgs(report.Search.Displays, []string{"none", "", "none", "none"}) || report.Search.Shown != "Showing 1 of 4" {
+		t.Fatalf("search %+v", report.Search)
+	}
+}
+
+func TestPageHelpers(t *testing.T) {
+	for n, want := range map[int]string{0: "0", 7: "7", 999: "999", 1000: "1,000", 1346: "1,346", 1234567: "1,234,567"} {
+		if got := thousands(n); got != want {
+			t.Fatalf("thousands(%d) = %q", n, got)
+		}
+	}
+	if plural(1, "file", "files") != "1 file" || plural(1346, "file", "files") != "1,346 files" {
+		t.Fatal("plural")
+	}
+	for _, c := range []struct {
+		counts []int
+		want   string
+	}{
+		{[]int{0, 0, 0, 0}, "Reviewed 3 files with opus and found nothing to report."},
+		{[]int{0, 37, 136, 123}, "Reviewed 3 files with opus. Start with the 37 at P1."},
+		{[]int{0, 0, 1, 0}, "Reviewed 3 files with opus. The one finding is a P2."},
+		{[]int{0, 0, 0, 2}, "Reviewed 3 files with opus. All 2 findings are P3."},
+	} {
+		if got := lede("opus", 3, c.counts); got != c.want {
+			t.Fatalf("lede %v = %q", c.counts, got)
+		}
+	}
+	if summary(" One. Two. ") != "One." || summary("No period") != "No period" || summary("v1.2 is out") != "v1.2 is out" {
+		t.Fatal("summary")
+	}
+	if area("main.go") != "." || area("app/x.rb") != "app" || area("app/models/concerns/x.rb") != "app/models" {
+		t.Fatal("area")
+	}
+	if severityRank("P0") != 0 || severityRank("P3") != 3 || severityRank("bogus") != 4 {
+		t.Fatal("severityRank")
+	}
+	f := func(file, sev string, line int) lensoutput.TypedFinding {
+		return lensoutput.TypedFinding{File: file, Severity: sev, StartLine: line, EndLine: line}
+	}
+	groups := groupByFile([]lensoutput.TypedFinding{
+		f("z.go", "P2", 9), f("z.go", "P2", 3), f("z.go", "P1", 5),
+		f("b.go", "P1", 1),
+		f("a.go", "P1", 1),
+		f("c.go", "P3", 1),
+	})
+	var order []string
+	for _, g := range groups {
+		order = append(order, g.file)
+	}
+	// Worst severity first; among equals, more findings first; then by path.
+	if !reflectArgs(order, []string{"z.go", "a.go", "b.go", "c.go"}) {
+		t.Fatalf("group order %v", order)
+	}
+	z := groups[0].findings
+	if z[0].StartLine != 5 || z[1].StartLine != 3 || z[2].StartLine != 9 {
+		t.Fatalf("findings in z.go %+v", z)
+	}
+	rows := areaRows([]lensoutput.TypedFinding{f("b/x.go", "P3", 1), f("a/x.go", "P3", 1), f("c/x.go", "P2", 1), f("c/y.go", "P1", 1)})
+	if rows[0].name != "c" || !reflectArgs(rows[0].severities, []string{"P1", "P2"}) || rows[1].name != "a" || rows[2].name != "b" {
+		t.Fatalf("area rows %+v", rows)
+	}
+}
+
+func TestRenderRangesAndGutter(t *testing.T) {
+	files := map[string][]byte{"pkg/app.go": []byte("alpha\nbeta\ngamma\n")}
+	page := string(Render(Page{Repo: "/src/app", Commit: "c", ModelID: "grok-4.7", Files: files, Findings: []lensoutput.TypedFinding{
+		{Tag: lensoutput.TagBug, File: "pkg/app.go", StartLine: 2, EndLine: 3, Issue: "First sentence. Second sentence.", Consequence: "bad", Confidence: 80, Severity: "P2"},
+	}}))
+	for _, want := range []string{
+		"<h1>app</h1>", "L2–3", `<pre class="gutter" aria-hidden="true">2` + "\n3</pre>", `<pre class="quote">beta` + "\ngamma</pre>",
+		`<span class="lead">First sentence.</span><span class="rest"> Second sentence.</span>`,
+		`<span class="dir">pkg/</span>app.go`, "Model confidence 80 of 100", "The one finding is a P2.", `data-area="pkg"`,
+	} {
+		if !strings.Contains(page, want) {
+			t.Fatalf("page missing %q", want)
+		}
+	}
 }
 
 func TestRenderEmpty(t *testing.T) {
@@ -78,6 +172,9 @@ func TestRenderEmpty(t *testing.T) {
 	if !strings.Contains(html, `id="severity"`) || !strings.Contains(html, `id="directory"`) {
 		t.Fatal("filters missing")
 	}
+	if !strings.Contains(html, "No findings. gpt-6-astra reviewed 0 files and reported nothing to fix.") || strings.Contains(html, `id="map"`) || strings.Contains(html, `class="seg`) {
+		t.Fatal("empty page should explain itself and draw no map or bar segments")
+	}
 	report := runPage(t, page)
 	if report.FindingCount != 0 {
 		t.Fatalf("findings %d", report.FindingCount)
@@ -97,10 +194,40 @@ type pageReport struct {
 	} `json:"steps"`
 	Opened struct {
 		Hidden      bool   `json:"hidden"`
+		Expanded    string `json:"expanded"`
 		Issue       string `json:"issue"`
 		Consequence string `json:"consequence"`
 		Quote       string `json:"quote"`
 	} `json:"opened"`
+	Closed struct {
+		Hidden   bool   `json:"hidden"`
+		Expanded string `json:"expanded"`
+	} `json:"closed"`
+	Bar struct {
+		Severity string   `json:"severity"`
+		Displays []string `json:"displays"`
+		Pressed  string   `json:"pressed"`
+		Shown    string   `json:"shown"`
+	} `json:"bar"`
+	BarCleared struct {
+		Severity string   `json:"severity"`
+		Displays []string `json:"displays"`
+		Shown    string   `json:"shown"`
+	} `json:"barCleared"`
+	Area struct {
+		Name     string   `json:"name"`
+		Displays []string `json:"displays"`
+		Groups   []string `json:"groups"`
+		Pressed  string   `json:"pressed"`
+	} `json:"area"`
+	AreaCleared struct {
+		Displays []string `json:"displays"`
+		Pressed  string   `json:"pressed"`
+	} `json:"areaCleared"`
+	Search struct {
+		Displays []string `json:"displays"`
+		Shown    string   `json:"shown"`
+	} `json:"search"`
 }
 
 func runPage(t *testing.T, page []byte) pageReport {
@@ -155,9 +282,11 @@ class El {
     this._listeners = {};
   }
   getAttribute(k) { return Object.prototype.hasOwnProperty.call(this.attrs, k) ? this.attrs[k] : null; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
   addEventListener(type, fn) { (this._listeners[type] ||= []).push(fn); }
   dispatchEvent(type) { for (const fn of this._listeners[type] || []) fn.call(this); }
   get textContent() { return this.children.map(c => c.textContent || "").join(""); }
+  set textContent(v) { this.children = [{ textContent: String(v), name: "" }]; }
   querySelector(sel) { const a = queryAll(this, sel); return a[0] || null; }
   querySelectorAll(sel) { return queryAll(this, sel); }
 }
@@ -247,15 +376,40 @@ if (findings.length >= 2) {
   dir.value = findings[0].getAttribute("data-dir");
   dir.dispatchEvent("change");
   report.steps.push({ displays: findings.map(f => f.style.display) });
+  dir.value = "";
+  dir.dispatchEvent("change");
   const btn = findings[0].querySelector("button");
   btn.dispatchEvent("click");
   const detail = findings[0].querySelector(".detail");
   report.opened = {
     hidden: detail.hidden,
+    expanded: btn.getAttribute("aria-expanded"),
     issue: findings[0].querySelector(".issue").textContent.trim(),
     consequence: findings[0].querySelector(".consequence").textContent.trim(),
     quote: findings[0].querySelector(".quote").textContent.trim(),
   };
+  btn.dispatchEvent("click");
+  report.closed = { hidden: detail.hidden, expanded: btn.getAttribute("aria-expanded") };
+  const displays = () => findings.map(f => f.style.display);
+  const groupDisplays = () => document.querySelectorAll("#findings .group").map(g => g.style.display);
+  const shown = () => document.getElementById("shown").textContent;
+  // The severity bar: one click selects that severity, a second click clears it.
+  const seg = document.querySelectorAll("#bar .seg")[0];
+  seg.dispatchEvent("click");
+  report.bar = { severity: sev.value, displays: displays(), pressed: seg.getAttribute("aria-pressed"), shown: shown() };
+  seg.dispatchEvent("click");
+  report.barCleared = { severity: sev.value, displays: displays(), shown: shown() };
+  // The map: one click shows only that area and hides the other files' groups.
+  const areaBtn = document.querySelectorAll("#map .area")[0];
+  areaBtn.dispatchEvent("click");
+  report.area = { name: areaBtn.getAttribute("data-area"), displays: displays(), groups: groupDisplays(), pressed: areaBtn.getAttribute("aria-pressed") };
+  areaBtn.dispatchEvent("click");
+  report.areaCleared = { displays: displays(), pressed: areaBtn.getAttribute("aria-pressed") };
+  // Search matches the finding's text, case-insensitively.
+  const search = document.getElementById("search");
+  search.value = findings[1].querySelector(".issue").textContent.trim().toUpperCase();
+  search.dispatchEvent("input");
+  report.search = { displays: displays(), shown: shown() };
 }
 process.stdout.write(JSON.stringify(report));
 `
diff --git a/internal/sourcereview/run.go b/internal/sourcereview/run.go
index 0e78fe15..d24ca28f 100644
--- a/internal/sourcereview/run.go
+++ b/internal/sourcereview/run.go
@@ -1,22 +1,36 @@
 package sourcereview
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
+	"time"
 
 	"github.com/dsifry/metareview/internal/lensoutput"
 )
 
-const usageText = `Usage: metareview source-review --model astra|opus|grok --output <dir> [<repo>]
+const usageText = `Usage: metareview source-review --model astra|opus|grok --output <dir>
+                              [--jobs <n>] [--call-timeout <duration>] [<repo>]
 
 Reviews the first-party source at HEAD. Prints the kept list and the dropped
 list before any model call. Writes <dir>/findings.json and <dir>/review.html.
-The output directory must be outside the repository.`
+The output directory must be outside the repository.
+
+--jobs runs up to n prompts at once (default 8). --call-timeout limits each
+model call (default 30m); a call that runs past it fails the run.`
+
+// DefaultJobs and DefaultCallTimeout apply when Options leaves them zero.
+const (
+	DefaultJobs        = 8
+	DefaultCallTimeout = 30 * time.Minute
+)
 
 var errHelp = errors.New("help")
 
@@ -31,18 +45,21 @@ var (
 
 // Options is one source-review run. A nil Runner, Git, MkdirAll, WriteFile, or
 // Remove uses the real process, git, or filesystem. Budget 0 means MaxPromptBytes.
+// Jobs 0 means DefaultJobs and CallTimeout 0 means DefaultCallTimeout.
 type Options struct {
-	Repo      string
-	Model     string
-	OutputDir string
-	Stdout    io.Writer
-	Stderr    io.Writer
-	Budget    int
-	Runner    Runner
-	Git       GitFunc
-	MkdirAll  func(string, os.FileMode) error
-	WriteFile func(string, []byte, os.FileMode) error
-	Remove    func(string) error
+	Repo        string
+	Model       string
+	OutputDir   string
+	Stdout      io.Writer
+	Stderr      io.Writer
+	Budget      int
+	Jobs        int
+	CallTimeout time.Duration
+	Runner      Runner
+	Git         GitFunc
+	MkdirAll    func(string, os.FileMode) error
+	WriteFile   func(string, []byte, os.FileMode) error
+	Remove      func(string) error
 }
 
 // Run reviews one repository. It writes the findings file and the page only
@@ -95,28 +112,105 @@ func Run(opts Options) error {
 	if opts.Runner == nil {
 		return errors.New("no runner")
 	}
-	var all []lensoutput.TypedFinding
-	for _, p := range prompts {
-		fmt.Fprintln(opts.Stdout, "prompt-begin")
-		_, _ = opts.Stdout.Write(p)
-		if len(p) == 0 || p[len(p)-1] != '\n' {
-			fmt.Fprintln(opts.Stdout)
-		}
-		fmt.Fprintln(opts.Stdout, "prompt-end")
-		text, err := Call(opts.Runner, opts.Model, p)
-		if err != nil {
-			return err
-		}
-		got, skipped, err := Parse(text, files)
-		if err != nil {
-			return err
+	all, err := review(opts, prompts, files)
+	if err != nil {
+		return err
+	}
+	return writeOutputs(opts, top, commit, modelID, all, files)
+}
+
+// review runs the prompts up to opts.Jobs at a time and returns the accepted
+// findings in prompt order. Each prompt block is printed whole, in prompt
+// order, before its call starts. After the first failure no new call starts,
+// running calls are cancelled, and that failure is returned.
+func review(opts Options, prompts [][]byte, files map[string][]byte) ([]lensoutput.TypedFinding, error) {
+	jobs := opts.Jobs
+	if jobs == 0 {
+		jobs = DefaultJobs
+	}
+	if jobs < 1 {
+		return nil, fmt.Errorf("jobs must be at least 1, got %d", jobs)
+	}
+	timeout := opts.CallTimeout
+	if timeout == 0 {
+		timeout = DefaultCallTimeout
+	}
+	if timeout < 0 {
+		return nil, fmt.Errorf("call timeout must be positive, got %s", timeout)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	var (
+		mu       sync.Mutex
+		wg       sync.WaitGroup
+		firstErr error
+	)
+	fail := func(err error) {
+		mu.Lock()
+		defer mu.Unlock()
+		if firstErr == nil {
+			firstErr = err
+			cancel()
 		}
-		for _, msg := range skipped {
-			fmt.Fprintln(opts.Stderr, msg)
+	}
+	n := len(prompts)
+	results := make([][]lensoutput.TypedFinding, n)
+	sem := make(chan struct{}, jobs)
+	for i, p := range prompts {
+		sem <- struct{}{}
+		if ctx.Err() != nil {
+			break
 		}
-		all = append(all, got...)
+		mu.Lock()
+		writePrompt(opts.Stdout, p)
+		mu.Unlock()
+		wg.Add(1)
+		go func(i int, p []byte) {
+			defer wg.Done()
+			defer func() { <-sem }()
+			start := time.Now()
+			callCtx, callCancel := context.WithTimeout(ctx, timeout)
+			defer callCancel()
+			text, err := Call(callCtx, opts.Runner, opts.Model, p)
+			if err != nil {
+				if errors.Is(callCtx.Err(), context.DeadlineExceeded) {
+					err = fmt.Errorf("call timed out after %s: %w", timeout, err)
+				}
+				fail(fmt.Errorf("prompt %d/%d: %w", i+1, n, err))
+				return
+			}
+			got, skipped, err := Parse(text, files)
+			if err != nil {
+				fail(fmt.Errorf("prompt %d/%d: %w", i+1, n, err))
+				return
+			}
+			results[i] = got
+			mu.Lock()
+			defer mu.Unlock()
+			for _, msg := range skipped {
+				fmt.Fprintln(opts.Stderr, msg)
+			}
+			fmt.Fprintf(opts.Stderr, "prompt %d/%d done in %ds (%d findings)\n", i+1, n, int(time.Since(start).Round(time.Second)/time.Second), len(got))
+		}(i, p)
 	}
-	return writeOutputs(opts, top, commit, modelID, all, files)
+	wg.Wait()
+	if firstErr != nil {
+		return nil, firstErr
+	}
+	var all []lensoutput.TypedFinding
+	for _, r := range results {
+		all = append(all, r...)
+	}
+	return all, nil
+}
+
+func writePrompt(w io.Writer, p []byte) {
+	fmt.Fprintln(w, "prompt-begin")
+	_, _ = w.Write(p)
+	if len(p) == 0 || p[len(p)-1] != '\n' {
+		fmt.Fprintln(w)
+	}
+	fmt.Fprintln(w, "prompt-end")
 }
 
 func writeLists(w io.Writer, kept []File, dropped []string) {
@@ -240,7 +334,7 @@ func insideRel(rel string) bool {
 
 // CLI is the source-review command. repo defaults to cwd.
 func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
-	model, out, repo, err := parseArgs(args)
+	a, err := parseArgs(args)
 	if err != nil {
 		if errors.Is(err, errHelp) {
 			fmt.Fprintln(stdout, usageText)
@@ -250,16 +344,18 @@ func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stderr, usageText)
 		return 2
 	}
-	if repo == "" {
-		repo = cwd
+	if a.repo == "" {
+		a.repo = cwd
 	}
 	err = Run(Options{
-		Repo:      repo,
-		Model:     model,
-		OutputDir: out,
-		Stdout:    stdout,
-		Stderr:    stderr,
-		Runner:    OSRunner{},
+		Repo:        a.repo,
+		Model:       a.model,
+		OutputDir:   a.out,
+		Stdout:      stdout,
+		Stderr:      stderr,
+		Jobs:        a.jobs,
+		CallTimeout: a.timeout,
+		Runner:      OSRunner{},
 	})
 	if err != nil {
 		fmt.Fprintln(stderr, err.Error())
@@ -268,35 +364,60 @@ func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
 	return 0
 }
 
-func parseArgs(args []string) (model, out, repo string, err error) {
+type cliArgs struct {
+	model, out, repo string
+	jobs             int
+	timeout          time.Duration
+}
+
+func parseArgs(args []string) (cliArgs, error) {
+	a := cliArgs{jobs: DefaultJobs, timeout: DefaultCallTimeout}
 	for i := 0; i < len(args); i++ {
-		a := args[i]
+		arg := args[i]
 		switch {
-		case a == "--help" || a == "-h":
-			return "", "", "", errHelp
-		case a == "--model":
+		case arg == "--help" || arg == "-h":
+			return cliArgs{}, errHelp
+		case arg == "--model" || arg == "--output" || arg == "--jobs" || arg == "--call-timeout":
 			if i+1 >= len(args) {
-				return "", "", "", errors.New("missing value for --model")
+				return cliArgs{}, fmt.Errorf("missing value for %s", arg)
 			}
 			i++
-			model = args[i]
-		case a == "--output":
-			if i+1 >= len(args) {
-				return "", "", "", errors.New("missing value for --output")
+			if err := a.set(arg, args[i]); err != nil {
+				return cliArgs{}, err
 			}
-			i++
-			out = args[i]
-		case strings.HasPrefix(a, "--"):
-			return "", "", "", fmt.Errorf("unknown option: %s", a)
+		case strings.HasPrefix(arg, "--"):
+			return cliArgs{}, fmt.Errorf("unknown option: %s", arg)
 		default:
-			if repo != "" {
-				return "", "", "", fmt.Errorf("unexpected argument: %s", a)
+			if a.repo != "" {
+				return cliArgs{}, fmt.Errorf("unexpected argument: %s", arg)
 			}
-			repo = a
+			a.repo = arg
 		}
 	}
-	if model == "" || out == "" {
-		return "", "", "", errors.New("missing --model or --output")
+	if a.model == "" || a.out == "" {
+		return cliArgs{}, errors.New("missing --model or --output")
+	}
+	return a, nil
+}
+
+func (a *cliArgs) set(flag, v string) error {
+	switch flag {
+	case "--model":
+		a.model = v
+	case "--output":
+		a.out = v
+	case "--jobs":
+		n, err := strconv.Atoi(v)
+		if err != nil || n < 1 {
+			return fmt.Errorf("--jobs must be an integer of at least 1, got %q", v)
+		}
+		a.jobs = n
+	default:
+		d, err := time.ParseDuration(v)
+		if err != nil || d <= 0 {
+			return fmt.Errorf("--call-timeout must be a positive duration such as 30m, got %q", v)
+		}
+		a.timeout = d
 	}
-	return model, out, repo, nil
+	return nil
 }
diff --git a/internal/sourcereview/run_test.go b/internal/sourcereview/run_test.go
index fc89d386..3e860862 100644
--- a/internal/sourcereview/run_test.go
+++ b/internal/sourcereview/run_test.go
@@ -2,12 +2,17 @@ package sourcereview
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/dsifry/metareview/internal/lensoutput"
 )
@@ -55,10 +60,10 @@ func TestRunSpecFixtureThreeModels(t *testing.T) {
 			reply: func(_ int, name string, args []string, stdin []byte) ([]byte, error) {
 				var prompt []byte
 				if model == "grok" {
-					if stdin != nil {
-						t.Fatal("grok prompt must be an argument")
+					if stdin != nil || args[0] != "--prompt-file" {
+						t.Fatal("grok prompt must be a --prompt-file")
 					}
-					prompt = []byte(args[1])
+					prompt, _ = os.ReadFile(args[1])
 				} else {
 					prompt = stdin
 				}
@@ -88,7 +93,7 @@ func TestRunSpecFixtureThreeModels(t *testing.T) {
 			t.Fatal("instruction missing")
 		}
 		for path, body := range specFiles() {
-			needle := append([]byte(path+"\n"), body...)
+			needle := append([]byte(path+"\n"), numberLines(body, 1)...)
 			has := bytes.Contains(p, needle)
 			if path == "pkg/app.go" || path == "pkg/note.go" {
 				if !has {
@@ -204,7 +209,7 @@ func TestRunMergesPromptOrder(t *testing.T) {
 		return cliStdout("opus", text), nil
 	}}
 	outDir := t.TempDir()
-	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Runner: fr}); err != nil {
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Jobs: 1, Runner: fr}); err != nil {
 		t.Fatal(err)
 	}
 	raw, _ := os.ReadFile(filepath.Join(outDir, "findings.json"))
@@ -241,6 +246,172 @@ func TestRunMergesPromptOrder(t *testing.T) {
 	}
 }
 
+// fivePrompts is a repo whose kept files pack into five prompts, one file
+// each, in path order p1.go..p5.go. Each is 100,000 bytes in 1,000 lines, so
+// numbered it still fits one prompt but two never share one.
+func fivePrompts(t *testing.T) (string, []string) {
+	t.Helper()
+	files := map[string][]byte{}
+	var paths []string
+	for i := 1; i <= 5; i++ {
+		p := fmt.Sprintf("p%d.go", i)
+		files[p] = bytes.Repeat(append(bytes.Repeat([]byte("x"), 99), '\n'), 1000)
+		paths = append(paths, p)
+	}
+	root, _ := newRepoBytes(t, files)
+	return root, paths
+}
+
+// promptPath is the one pN.go path a prompt carries.
+func promptPath(prompt []byte, paths []string) (int, string) {
+	for i, p := range paths {
+		if bytes.Contains(prompt, []byte("\n"+p+"\n")) {
+			return i, p
+		}
+	}
+	return -1, ""
+}
+
+func oneFinding(path string) []byte {
+	return cliStdout("opus", `{"findings":[{"tag":"bug","file":"`+path+`","start_line":1,"end_line":1,"issue":"i-`+path+`","consequence":"c","confidence":80,"severity":"P2"}]}`)
+}
+
+func TestRunJobsKeepPromptOrder(t *testing.T) {
+	root, paths := fivePrompts(t)
+	var mu sync.Mutex
+	var finished []string
+	fr := &fakeRunner{}
+	fr.reply = func(_ int, _ string, _ []string, stdin []byte) ([]byte, error) {
+		i, p := promptPath(stdin, paths)
+		// Later prompts answer first: prompt 5 finishes before prompt 1.
+		time.Sleep(time.Duration(len(paths)-i) * 60 * time.Millisecond)
+		mu.Lock()
+		finished = append(finished, p)
+		mu.Unlock()
+		return oneFinding(p), nil
+	}
+	outDir := t.TempDir()
+	var stdout, stderr bytes.Buffer
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &stdout, Stderr: &stderr, Jobs: 3, Runner: fr}); err != nil {
+		t.Fatal(err)
+	}
+	if fr.maxActive != 3 {
+		t.Fatalf("max concurrent calls %d, want 3", fr.maxActive)
+	}
+	if finished[0] == paths[0] {
+		t.Fatalf("calls finished in prompt order %v; the test needs reverse", finished)
+	}
+	raw, _ := os.ReadFile(filepath.Join(outDir, "findings.json"))
+	var doc struct {
+		Findings []lensoutput.TypedFinding `json:"findings"`
+	}
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatal(err)
+	}
+	if len(doc.Findings) != len(paths) {
+		t.Fatalf("findings %d", len(doc.Findings))
+	}
+	for i, f := range doc.Findings {
+		if f.File != paths[i] {
+			t.Fatalf("finding %d is %s, want %s (finished %v)", i, f.File, paths[i], finished)
+		}
+	}
+	// Prompt blocks are whole and in prompt order.
+	out := stdout.String()
+	last := -1
+	for _, p := range paths {
+		at := strings.Index(out, "\n"+p+"\n")
+		if at < last {
+			t.Fatalf("prompt for %s printed out of order", p)
+		}
+		last = at
+	}
+	if strings.Count(out, "prompt-begin\n") != len(paths) || strings.Count(out, "prompt-end\n") != len(paths) {
+		t.Fatal("prompt markers")
+	}
+	for _, block := range strings.Split(out, "prompt-begin\n")[1:] {
+		if strings.Count(block, "prompt-end\n") != 1 || !strings.HasSuffix(block, "prompt-end\n") {
+			t.Fatal("a prompt block was interleaved")
+		}
+	}
+	for i := 1; i <= len(paths); i++ {
+		re := regexp.MustCompile(fmt.Sprintf(`(?m)^prompt %d/5 done in \d+s \(1 findings\)$`, i))
+		if n := len(re.FindAllString(stderr.String(), -1)); n != 1 {
+			t.Fatalf("progress line for prompt %d appears %d times:\n%s", i, n, stderr.String())
+		}
+	}
+}
+
+func TestRunCallTimeout(t *testing.T) {
+	root, _ := newRepoBytes(t, specFiles())
+	outDir := t.TempDir()
+	fr := &fakeRunner{wait: func(ctx context.Context, _ []byte) error {
+		<-ctx.Done()
+		return errors.New("signal: killed")
+	}}
+	err := Run(Options{Repo: root, Model: "grok", OutputDir: outDir, Stdout: &bytes.Buffer{}, CallTimeout: 50 * time.Millisecond, Runner: fr})
+	if err == nil || !strings.Contains(err.Error(), "prompt 1/1") || !strings.Contains(err.Error(), "timed out after 50ms") {
+		t.Fatal(err)
+	}
+	if ents, _ := os.ReadDir(outDir); len(ents) != 0 {
+		t.Fatal("wrote after a timeout")
+	}
+}
+
+func TestRunFailureStopsNewCalls(t *testing.T) {
+	root, paths := fivePrompts(t)
+	// One job: the first prompt fails, so no other prompt starts.
+	fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		return nil, errors.New("exit status 1")
+	}}
+	outDir := t.TempDir()
+	err := Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Jobs: 1, Runner: fr})
+	if err == nil || !strings.Contains(err.Error(), "prompt 1/5") {
+		t.Fatal(err)
+	}
+	if n := len(fr.callList()); n != 1 {
+		t.Fatalf("calls after the failure: %d", n)
+	}
+	if ents, _ := os.ReadDir(outDir); len(ents) != 0 {
+		t.Fatal("wrote after a failure")
+	}
+	// Two jobs: prompt 1 fails while prompt 2 is running; prompt 2 is
+	// cancelled, nothing else starts, and prompt 1's error is returned.
+	fr = &fakeRunner{}
+	fr.wait = func(ctx context.Context, prompt []byte) error {
+		if i, _ := promptPath(prompt, paths); i == 0 {
+			time.Sleep(50 * time.Millisecond)
+			return errors.New("first failed")
+		}
+		<-ctx.Done()
+		return ctx.Err()
+	}
+	err = Run(Options{Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{}, Jobs: 2, Runner: fr})
+	if err == nil || !strings.Contains(err.Error(), "first failed") {
+		t.Fatal(err)
+	}
+	if n := len(fr.callList()); n != 2 {
+		t.Fatalf("calls %d, want 2", n)
+	}
+	if ents, _ := os.ReadDir(outDir); len(ents) != 0 {
+		t.Fatal("wrote after a failure")
+	}
+}
+
+func TestRunBadJobsAndTimeout(t *testing.T) {
+	root, _ := newRepoBytes(t, specFiles())
+	fr := &fakeRunner{}
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: t.TempDir(), Jobs: -1, Runner: fr}); err == nil || !strings.Contains(err.Error(), "jobs") {
+		t.Fatal(err)
+	}
+	if err := Run(Options{Repo: root, Model: "opus", OutputDir: t.TempDir(), CallTimeout: -time.Second, Runner: fr}); err == nil || !strings.Contains(err.Error(), "timeout") {
+		t.Fatal(err)
+	}
+	if len(fr.callList()) != 0 {
+		t.Fatal("model called")
+	}
+}
+
 func TestRunFailuresLeaveDirEmpty(t *testing.T) {
 	root, _ := newRepoBytes(t, specFiles())
 	cases := []struct {
@@ -497,7 +668,7 @@ func TestPromptWithoutTrailingNewline(t *testing.T) {
 	if !strings.Contains(buf.String(), "prompt-end\n") {
 		t.Fatalf("prompt marker missing:\n%s", buf.String())
 	}
-	if !bytes.Contains(fr.calls[0].stdin, []byte("nonl.go\npackage nonl")) {
+	if !bytes.Contains(fr.calls[0].stdin, []byte("nonl.go\n1| package nonl")) {
 		t.Fatal("path not immediately before text")
 	}
 }
@@ -519,15 +690,30 @@ func TestCLI(t *testing.T) {
 		{"--output", t.TempDir()},
 		{"--nope"},
 		{"--model", "opus", "--output", t.TempDir(), "extra", "more"},
+		{"--model", "opus", "--output", t.TempDir(), "--jobs"},
+		{"--model", "opus", "--output", t.TempDir(), "--jobs", "0"},
+		{"--model", "opus", "--output", t.TempDir(), "--jobs", "two"},
+		{"--model", "opus", "--output", t.TempDir(), "--call-timeout"},
+		{"--model", "opus", "--output", t.TempDir(), "--call-timeout", "0"},
+		{"--model", "opus", "--output", t.TempDir(), "--call-timeout", "-5m"},
+		{"--model", "opus", "--output", t.TempDir(), "--call-timeout", "soon"},
 	} {
 		code, errOut = cliCapture(t, "", args...)
-		if code != 2 || errOut == "" {
+		if code != 2 || errOut == "" || !strings.Contains(errOut, "Usage:") {
 			t.Fatalf("args %v code=%d err=%q", args, code, errOut)
 		}
 	}
+	a, err := parseArgs([]string{"--model", "grok", "--output", "o"})
+	if err != nil || DefaultJobs != 8 || DefaultCallTimeout != 30*time.Minute || a.jobs != DefaultJobs || a.timeout != DefaultCallTimeout {
+		t.Fatalf("defaults %+v %v", a, err)
+	}
+	a, err = parseArgs([]string{"--model", "grok", "--output", "o", "--jobs", "3", "--call-timeout", "90s", "repo"})
+	if err != nil || a.jobs != 3 || a.timeout != 90*time.Second || a.repo != "repo" {
+		t.Fatalf("flags %+v %v", a, err)
+	}
 	root, commit := newRepoBytes(t, droppedOnlyFiles())
 	outDir := t.TempDir()
-	code, errOut = cliCapture(t, root, "--model", "opus", "--output", outDir)
+	code, errOut = cliCapture(t, root, "--model", "opus", "--output", outDir, "--jobs", "2", "--call-timeout", "1m")
 	if code != 0 || errOut != "" {
 		t.Fatalf("cli code=%d err=%q", code, errOut)
 	}
diff --git a/metareview-grok-source-review-goal.md b/metareview-grok-source-review-goal.md
new file mode 100644
index 00000000..927ea8bc
--- /dev/null
+++ b/metareview-grok-source-review-goal.md
@@ -0,0 +1,164 @@
+# Grok source review
+
+<!-- CODING-GOAL-BEGIN -->
+
+/goal Make `metareview source-review --model grok` finish on a real
+repository and write its findings file and page.
+
+This file is the contract. Do not edit it during the walk. Scores, the
+session id, and evidence paths go in
+/Users/ben/code/metareview/metareview-grok-source-review-progress.md.
+Create that progress file at the start. A new session starts at the first
+checkpoint.
+
+## Authority
+
+Repository: /Users/ben/code/metareview, branch
+`whole-repo-source-review`. This goal narrows
+`metareview-whole-repo-source-review-goal.md`. Every rule in that file
+still holds except where this file changes the Grok call or adds to
+`Run`. Do not edit that file.
+
+This goal is the approval to implement this scope. Do not commit, push,
+or open a pull request.
+
+## What went wrong
+
+The command was:
+
+```
+go run ./cmd/metareview source-review --model grok --output /tmp/hh-grok /Users/ben/code/hh
+```
+
+It was killed after 10 hours. `/tmp/hh-grok` is empty. It did not hang.
+
+- `hh` at commit `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` keeps 1,346
+  files, 4,616,754 bytes. `Pack` turns that into 40 prompts.
+- `grok -p <prompt>` runs Grok's full agent, not a single completion.
+  Grok cuts the ~120 KB argument down to an excerpt and saves the full
+  text to `~/.grok/sessions/<cwd>/<id>/prompts/prompt_0.txt`. The model
+  then reads that file back with `read_file` and `grep`. Session
+  `01a0cb4a-3519-7f11-8ffd-628326f49543` made 31 tool calls and 11 model
+  calls and read 844,756 input tokens for one prompt.
+- In 10 hours Grok finished 35 of the 40 prompts, at 10 to 25 minutes
+  each. The kill came during prompt 36. The Grok session folders under
+  `~/.grok/sessions/%2FUsers%2Fben%2Fcode%2Fmetareview/` are the record,
+  from `01a0cb4a…` at 15:43 to `01a0cd6b…` at 01:39.
+- `Run` sends the prompts one at a time. It writes nothing until every
+  prompt succeeds. No call has a time limit.
+
+## Measured call shapes
+
+These were run by hand against prompt 1 of `hh`, the 119,998-byte
+`prompt_0.txt` above. Each was run once. The goal must re-measure.
+
+1. `grok -p "<prompt>" -m grok-4.7 --output-format json --tools ""
+   --max-turns 1 --no-subagents --disable-web-search`: exit 1 after
+   14 s with `max turns reached`. The model text was "The omitted source
+   is required before I can finish the review." The argument was still
+   cut to an excerpt.
+2. `grok --prompt-file <f> --verbatim` plus the flags in 1: exit 1 after
+   170 s with `max turns reached`. The model still tried to call a tool.
+3. The flags in 2 plus `--json-schema <findings schema>` and
+   `--system-prompt-override "You are a code reviewer. You have no tools.
+   Everything you need is in the user message. Answer in a single
+   message."`: exit 0 after 451 s. One turn, `stopReason` `end_turn`,
+   49,803 input tokens, 30,712 output tokens (29,374 of them reasoning).
+   `text` held `{"findings":[...]}` with 11 findings that cite real
+   lines in `data/dumps/schema.sql`.
+
+`-m grok-4.7` shows up as `grok-4.7-build` in `modelUsage`. That is the
+CLI's own mapping. Leave the model id as `grok-4.7`.
+
+## Outcome
+
+1. Grok call shape. `Call` runs Grok as one turn with no tools:
+
+   ```
+   grok --prompt-file <file> --verbatim -m grok-4.7 --output-format json
+        --json-schema <schema> --tools "" --max-turns 1 --no-subagents
+        --disable-web-search --system-prompt-override <text>
+   ```
+
+   `<file>` holds exactly the prompt bytes. It is created in
+   `os.TempDir()`, never inside the reviewed tree or the output
+   directory, and removed after the call whether the call worked or not.
+   `<schema>` is a JSON Schema for `{"findings":[...]}`. It requires all
+   eight fields, limits `tag` to `bug`/`advisory` and `severity` to
+   `P0`–`P3`, and makes `start_line`, `end_line`, and `confidence`
+   integers. The prompt text, the parser, and `Validate` are the same as
+   before. The model text is still `text`. Opus and Astra call shapes do
+   not change. Use only flags that `grok --help` (1.0.40) lists. If a
+   flag in this list turns out not to be needed, keep it anyway. It
+   stops Grok from acting as an agent. If one is rejected, stop and
+   record the CLI's error.
+
+2. Per-call time limit. Each CLI call has a time limit, set with
+   `--call-timeout <duration>` and defaulting to 30m. When the limit is
+   reached, the process and its children are killed, the run fails with
+   an error that names the prompt number, and neither output file is
+   written. This applies to all three models.
+
+3. Concurrency. `--jobs <n>` runs up to n prompts at once. It defaults
+   to 8 and must be at least 1. The findings array stays in prompt order
+   whatever order the calls finish in. When one prompt fails, no new
+   prompts start, calls already running are cancelled, and nothing is
+   written. The `prompt-begin`/`prompt-end` blocks on stdout are still
+   printed in prompt order, and each block is printed whole. This
+   applies to all three models.
+
+4. Progress. After each prompt finishes, stderr gets one line:
+   `prompt <i>/<N> done in <seconds>s (<k> findings)`. A long run is
+   never silent.
+
+## Checkpoints
+
+Record Pass or Fail in the progress file only. A later checkpoint starts
+only after every earlier one is Pass. The first checkpoint is Unverified.
+
+1. Reproduce. Re-run call shape 3 above on one `hh` prompt, built with
+   `Pack` from `Select` at the `hh` commit and not taken from the Grok
+   session folder. Record the exit code, time, turns, and finding count.
+   Then run call shape 1 or 2 once and record that it fails. No product
+   change in this checkpoint.
+2. Grok call. The fake exec shows the exact argv in Outcome 1. The
+   `--prompt-file` file holds the prompt bytes during the call, is
+   outside the tree and the output directory, and is gone after a
+   successful call, a non-zero exit, and a process that cannot start.
+   `--json-schema` parses as JSON and requires the eight fields. Every
+   existing parser and failure test for Grok still passes, updated only
+   for the new argv.
+3. Time limit and concurrency. Fake-exec tests show: a call that runs
+   past `--call-timeout` fails the run, names the prompt, and leaves the
+   output directory empty; with `--jobs 3` and replies that finish in
+   reverse order, the findings array is in prompt order; at most `n`
+   calls run at the same time (checked with a counter in the fake);
+   after a failure no new call starts and the output directory is
+   empty; `--jobs 0` and a bad `--call-timeout` exit 2 with usage. The
+   progress line appears once per prompt.
+4. Fixture proof. The live Grok command from the first goal, run against
+   that goal's `fixture-kept`, writes `findings.json` and `review.html`
+   with model `grok-4.7`, the fixture commit, and counts that match the
+   findings. Record the time.
+5. Real proof. From `/Users/ben/code/metareview`:
+
+   ```
+   go run ./cmd/metareview source-review --model grok --output /tmp/hh-grok /Users/ben/code/hh
+   ```
+
+   Empty `/tmp/hh-grok` first. It exits 0 within 1 hour of wall-clock
+   time, runs all 40 prompts, and writes `/tmp/hh-grok/findings.json` and
+   `/tmp/hh-grok/review.html`. The page shows model `grok-4.7`, commit
+   `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`, both filters, and P0–P3
+   counts that match the findings. Record the wall-clock time, the
+   `--jobs` value, the time of each prompt from the progress lines, and
+   the finding count. If Grok rate-limits at the default `--jobs`,
+   record the CLI's error and the `--jobs` value that worked. A
+   `--call-timeout` that fires is recorded along with its prompt number.
+   It counts as a Fail, not as a reason to raise the limit silently.
+6. Gate. `go test` for every package this goal touched exits 0.
+   `internal/sourcereview` stays at 100% statement coverage (`make
+   cover`). The progress file names the commands, the commits, the
+   output paths, and the Grok session ids of the live runs.
+
+<!-- CODING-GOAL-END -->
diff --git a/metareview-grok-source-review-progress.md b/metareview-grok-source-review-progress.md
new file mode 100644
index 00000000..575bf334
--- /dev/null
+++ b/metareview-grok-source-review-progress.md
@@ -0,0 +1,103 @@
+# Grok source review progress
+
+Session: Claude Code ccb3697d-57f7-43c7-afbe-b80f430f5235
+
+Evidence: /private/tmp/claude-501/-Users-ben-code-metareview/ccb3697d-57f7-43c7-afbe-b80f430f5235/scratchpad/evidence
+
+Goal file `metareview-grok-source-review-goal.md` is not edited. No commit, push, or pull request.
+
+## Checkpoint 1 — Reproduce
+
+Status: Pass
+
+The 40 `hh` prompts were built with `Select` + `Pack` at `hh` commit
+`7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` through a scratch test file overlaid with `go test -overlay`
+(nothing written to the repo) into `hh-prompt-01.txt` … `hh-prompt-40.txt`. `hh-prompt-01.txt` is
+byte-identical to the Grok session's `prompt_0.txt` (`cmp` exit 0). Measured on `hh-prompt-02.txt` (`cp1.sh`):
+
+- Call shape 3: exit 0, 795 s, 1 turn, `stopReason` `end_turn`, 5 findings, 47,994 input tokens,
+  55,233 output tokens (54,532 reasoning). Grok session `01a0cede-8b2d-7ef2-9f24-a4ada8e47544`.
+  Files: `cp1-shape3.json`, `cp1-shape3.meta`.
+- Call shape 1: exit 1, 13 s, `stopReason` `cancelled`, stderr `Error: max turns reached`, text "The
+  omitted middle of the review request is the part I still need." Grok session
+  `01a0cede-8b95-7033-8813-5a2f8b5206df`. Files: `cp1-shape1.json`, `cp1-shape1.err`.
+
+No product change in this checkpoint.
+
+## Checkpoint 2 — Grok call
+
+Status: Pass
+
+`Call` (`internal/sourcereview/model.go`) writes the prompt with `writePromptFile` (`os.CreateTemp("",
+"metareview-grok-prompt-*.txt")`), runs `grok` with `grokArgs(path)`, and removes the file in a `defer`.
+`grokSchema` and `grokSystem` are the schema and system prompt. `TestCallShapes` checks the exact argv
+against `grokWant`, with nil stdin, and checks that the file holds the prompt. `TestGrokPromptFile` checks
+during the call that the file holds the prompt bytes, sits in `os.TempDir()`, and is outside a tree dir and an
+output dir. It checks the file is gone after success, a non-zero exit, and a runner that cannot start, and after
+a real `OSRunner` with an empty `PATH`. `TestWritePromptFileErrors` covers the create and write failures.
+`TestGrokSchema` parses the schema and checks the eight required fields, the integer types, and the enums. The
+existing Grok parser/failure tests in `TestCallErrors` are unchanged apart from the added `ctx` argument.
+`TestRunSpecFixtureThreeModels` now reads the Grok prompt from `--prompt-file`.
+
+## Checkpoint 3 — Time limit and concurrency
+
+Status: Pass
+
+`Runner.Run` takes a `context.Context`. `OSRunner` uses `exec.CommandContext` with the `internal/fsm/cmdexec`
+process-group pattern (`Setpgid`, `Cancel` = `kill(-pgid, SIGKILL)`, `WaitDelay`). `Run` → `review` runs up
+to `Jobs` prompts (default 8) under a semaphore, each call has `context.WithTimeout(CallTimeout)` (default
+30m), and the results come back in prompt order. CLI: `--jobs`, `--call-timeout`. Tests:
+
+- `TestOSRunnerKillsProcessGroup`: a 300 ms deadline kills `sh` and its backgrounded `sleep 30` child
+  (the child pid is gone).
+- `TestRunCallTimeout`: an error with `prompt 1/1` and `timed out after 50ms`, and an empty output directory.
+- `TestRunJobsKeepPromptOrder`: `--jobs 3`, five prompts that finish in reverse. Findings are in prompt
+  order, max concurrent calls is exactly 3, prompt blocks print whole and in order, and each
+  `prompt i/5 done in Ns (1 findings)` line appears once.
+- `TestRunFailureStopsNewCalls`: with 1 job, a failure means 1 call and no more. With 2 jobs, prompt 1 fails
+  while prompt 2 blocks: prompt 2 is cancelled, exactly 2 calls are made, prompt 1's error is returned, and
+  the output directory is empty.
+- `TestCLI`: `--jobs 0`, `--jobs two`, `--call-timeout 0`, `-5m`, `soon`, and a missing value each exit 2 with
+  usage. The defaults are 8 and 30m.
+- `TestRunBadJobsAndTimeout`: a negative `Jobs`/`CallTimeout` in `Options` fails before any call.
+
+`go test -count=5 -race ./internal/sourcereview` exit 0.
+
+## Checkpoint 4 — Fixture proof
+
+Status: Pass
+
+`live.sh live-grok-fixture-2 <fixture-kept>` ran the built binary with `source-review --model grok --output
+<evidence>/live-grok-fixture-2 <first goal's fixture-kept>`. Fixture commit
+`1720b406e24e6f15e069f8aeb63a723582ce3968`. Exit 0 in 32 s. stderr `prompt 1/1 done in 31s (1 findings)`.
+Kept `pkg/app.go`, `pkg/note.go`, and the seven dropped paths printed before `prompt-begin`. `findings.json`
+has 1 finding (P1). The page shows `grok-4.7`, the commit, `id="severity"`, `id="directory"`, P0 0 / P1 1 /
+P2 0 / P3 0, and 1 finding block (`check.sh`). An earlier run (`live-grok-fixture`, 9 s, 0 findings, four zero
+counts) was made before checkpoint 1 finished. It is kept only as a second sample.
+
+## Checkpoint 5 — Real proof
+
+Status: Fail
+
+This is the exact goal command, run from `/Users/ben/code/metareview` by `real.sh`, which emptied `/tmp/hh-grok`
+first (0 entries, `real.before`), with the default `--jobs` 8 and `--call-timeout` 30m. It started 08:38:54.
+Result: exit 1 after 3,631 s. stderr: `prompt 19/40: call timed out after 30m0s: grok: signal: killed`.
+`/tmp/hh-grok` is empty afterwards. No `grok --prompt-file` process was left behind (`pgrep`).
+
+22 of 40 prompts finished before the timeout. Their times in seconds (sorted): 107 624 855 896 951 955 974
+991 1083 1087 1095 1099 1123 1142 1170 1218 1242 1259 1279 1291 1434 1701. The median is about 1,100 s. The
+same prompt shape took 451 s and 795 s alone (checkpoint 1). With 8 at once, each call is slower, and one
+took longer than 30 minutes. At that rate 40 prompts take about 40 × 1,100 / 8 ≈ 92 minutes even without a
+timeout. Neither the 1-hour bound nor the 30-minute call limit is met. The limit was not raised. Log:
+`real.log`, `real.err`, `real.exit`.
+
+Cause: Grok's per-prompt latency is reasoning. Checkpoint 1 was 54,532 reasoning tokens out of 55,233
+output tokens. It is not the call shape (1 turn, no tools). Meeting the bound needs a change this contract
+does not allow, such as `--reasoning-effort` (listed by `grok --help`, not measured) or a different `--jobs`
+/ prompt budget. Those are Ben's decisions.
+
+## Checkpoint 6 — Gate
+
+Status: Unverified. It does not start while checkpoint 5 is Fail. For the record: `make cover` exit 0 with
+`coverage gate passed` and `internal/sourcereview` at 100.0% (`make-cover.txt`). `go test` for
+`internal/sourcereview`, `internal/classify`, and `cmd/metareview` exit 0 at 100.0% each.

From a3b828807cdea5a6c54bfa6f86d3b13c7096459d Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Thu, 24 Sep 2026 12:30:03 -0700
Subject: [PATCH 04/22] feat(source-review): --path reviews a sample of the
 real checkout

`source-review` only reviewed a whole checkout, so any measurement meant an
hour-long run or a fixture repo. --path limits the review to the kept files at
that path or under that directory, and repeats to add more. It runs the real
selection, prompt, call, and parser on the real repo; it only narrows which
kept files are sent. A --path that matches no kept file (a typo, a partial
name, or a file the source cut dropped) fails the run before any model call.
---
 cmd/metareview/main.go            |  2 +-
 cmd/metareview/main_test.go       |  2 +-
 docs/ARCHITECTURE.md              |  4 +--
 internal/sourcereview/run.go      | 60 ++++++++++++++++++++++++++-----
 internal/sourcereview/run_test.go | 50 ++++++++++++++++++++++++--
 5 files changed, 104 insertions(+), 14 deletions(-)

diff --git a/cmd/metareview/main.go b/cmd/metareview/main.go
index 34c7e135..6c696523 100644
--- a/cmd/metareview/main.go
+++ b/cmd/metareview/main.go
@@ -121,7 +121,7 @@ Usage:
   metareview review pr-ready [--base <ref>] [--previous-run <run-id>] [--max-attempts <n>] [--evidence <path>] [--mutation-report <path>]... [--github-pr <number>] [--include-working-tree] [--shard-result <path>]... [--cross-shard-result <path>]
   metareview review record-lenses [--scope pr-ready|task-done|epic-ready] [--base <ref>] [--verdict <v>] [--mode subagent-adjudicated|in-session-emulated] [--lenses a,b,c] [--from-run <fsm-run-id>]
   metareview learn --post-merge <pr-number> [--base <ref>] [--github-pr <number>] [--session-root <path>]
-  metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [<repo>]
+  metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [--path <path>]... [<repo>]
 
 Commands:
   setup --check              Detect repository mode and prerequisites without writing files
diff --git a/cmd/metareview/main_test.go b/cmd/metareview/main_test.go
index 307f1548..a02d06d2 100644
--- a/cmd/metareview/main_test.go
+++ b/cmd/metareview/main_test.go
@@ -91,7 +91,7 @@ func TestRunSourceReviewHelp(t *testing.T) {
 		t.Fatalf("code=%d out=%q err=%q", code, out, errOut)
 	}
 	code, help, _ := runCLI(t, t.TempDir(), nil, "--help")
-	if code != 0 || !strings.Contains(help, "metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [<repo>]") {
+	if code != 0 || !strings.Contains(help, "metareview source-review --model astra|opus|grok --output <dir> [--jobs <n>] [--call-timeout <duration>] [--path <path>]... [<repo>]") {
 		t.Fatalf("top-level help missing source-review: %q", help)
 	}
 }
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index d63238c7..b0861375 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -40,9 +40,9 @@ abbreviated — task-done/epic-ready/pr-ready also take `--evidence <file>` (a v
 | **learn** | `learn --post-merge <pr>` | what the merged PR + bot findings teach us | learning extraction |
 
 `source-review` is a separate command (`source-review --model astra|opus|grok --output <dir> [--jobs <n>]
-[--call-timeout <duration>] [<repo>]`).
+[--call-timeout <duration>] [--path <path>]... [<repo>]`).
 It reviews the first-party source at HEAD — code `Classify` keeps, minus tests, vendored trees,
-generated files, and non-UTF-8 — by calling the logged-in `claude`, `codex`, or `grok` CLI, up to `--jobs`
+generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the real checkout) — by calling the logged-in `claude`, `codex`, or `grok` CLI, up to `--jobs`
 prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
 Grok runs as one tool-less turn (`--prompt-file --verbatim --json-schema --tools "" --max-turns 1
 --system-prompt-override`): `grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools.
diff --git a/internal/sourcereview/run.go b/internal/sourcereview/run.go
index d24ca28f..18bd91b8 100644
--- a/internal/sourcereview/run.go
+++ b/internal/sourcereview/run.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -17,14 +18,16 @@ import (
 )
 
 const usageText = `Usage: metareview source-review --model astra|opus|grok --output <dir>
-                              [--jobs <n>] [--call-timeout <duration>] [<repo>]
+                              [--jobs <n>] [--call-timeout <duration>] [--path <path>]... [<repo>]
 
 Reviews the first-party source at HEAD. Prints the kept list and the dropped
 list before any model call. Writes <dir>/findings.json and <dir>/review.html.
 The output directory must be outside the repository.
 
 --jobs runs up to n prompts at once (default 8). --call-timeout limits each
-model call (default 30m); a call that runs past it fails the run.`
+model call (default 30m); a call that runs past it fails the run. --path
+reviews only the kept files at that path or under that directory; repeat it
+to review several. A --path that matches no kept file fails the run.`
 
 // DefaultJobs and DefaultCallTimeout apply when Options leaves them zero.
 const (
@@ -55,11 +58,14 @@ type Options struct {
 	Budget      int
 	Jobs        int
 	CallTimeout time.Duration
-	Runner      Runner
-	Git         GitFunc
-	MkdirAll    func(string, os.FileMode) error
-	WriteFile   func(string, []byte, os.FileMode) error
-	Remove      func(string) error
+	// Paths, when set, limits the review to kept files at or under these
+	// repo-relative paths. Every path must match at least one kept file.
+	Paths     []string
+	Runner    Runner
+	Git       GitFunc
+	MkdirAll  func(string, os.FileMode) error
+	WriteFile func(string, []byte, os.FileMode) error
+	Remove    func(string) error
 }
 
 // Run reviews one repository. It writes the findings file and the page only
@@ -93,6 +99,10 @@ func Run(opts Options) error {
 	if err != nil {
 		return err
 	}
+	kept, err = onlyPaths(kept, opts.Paths)
+	if err != nil {
+		return err
+	}
 	writeLists(opts.Stdout, kept, dropped)
 	files := make(map[string][]byte, len(kept))
 	for _, f := range kept {
@@ -213,6 +223,36 @@ func writePrompt(w io.Writer, p []byte) {
 	fmt.Fprintln(w, "prompt-end")
 }
 
+// onlyPaths keeps the files at or under any of paths. No paths keeps every
+// file. A path that matches no kept file is an error, so a typo or a file the
+// source cut dropped is reported instead of reviewing nothing.
+func onlyPaths(kept []File, paths []string) ([]File, error) {
+	if len(paths) == 0 {
+		return kept, nil
+	}
+	var out []File
+	matched := make([]bool, len(paths))
+	for _, f := range kept {
+		hit := false
+		for i, p := range paths {
+			p = path.Clean(p)
+			if f.Path == p || strings.HasPrefix(f.Path, p+"/") || p == "." {
+				matched[i] = true
+				hit = true
+			}
+		}
+		if hit {
+			out = append(out, f)
+		}
+	}
+	for i, ok := range matched {
+		if !ok {
+			return nil, fmt.Errorf("--path %s matches no kept file", paths[i])
+		}
+	}
+	return out, nil
+}
+
 func writeLists(w io.Writer, kept []File, dropped []string) {
 	fmt.Fprintln(w, "kept:")
 	for _, f := range kept {
@@ -354,6 +394,7 @@ func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
 		Stdout:      stdout,
 		Stderr:      stderr,
 		Jobs:        a.jobs,
+		Paths:       a.paths,
 		CallTimeout: a.timeout,
 		Runner:      OSRunner{},
 	})
@@ -368,6 +409,7 @@ type cliArgs struct {
 	model, out, repo string
 	jobs             int
 	timeout          time.Duration
+	paths            []string
 }
 
 func parseArgs(args []string) (cliArgs, error) {
@@ -377,7 +419,7 @@ func parseArgs(args []string) (cliArgs, error) {
 		switch {
 		case arg == "--help" || arg == "-h":
 			return cliArgs{}, errHelp
-		case arg == "--model" || arg == "--output" || arg == "--jobs" || arg == "--call-timeout":
+		case arg == "--model" || arg == "--output" || arg == "--jobs" || arg == "--call-timeout" || arg == "--path":
 			if i+1 >= len(args) {
 				return cliArgs{}, fmt.Errorf("missing value for %s", arg)
 			}
@@ -406,6 +448,8 @@ func (a *cliArgs) set(flag, v string) error {
 		a.model = v
 	case "--output":
 		a.out = v
+	case "--path":
+		a.paths = append(a.paths, v)
 	case "--jobs":
 		n, err := strconv.Atoi(v)
 		if err != nil || n < 1 {
diff --git a/internal/sourcereview/run_test.go b/internal/sourcereview/run_test.go
index 3e860862..a5bd3c35 100644
--- a/internal/sourcereview/run_test.go
+++ b/internal/sourcereview/run_test.go
@@ -398,6 +398,49 @@ func TestRunFailureStopsNewCalls(t *testing.T) {
 	}
 }
 
+func TestRunPaths(t *testing.T) {
+	root, _ := newRepoBytes(t, specFiles())
+	run := func(paths ...string) (string, [][]byte, error) {
+		var buf bytes.Buffer
+		fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+			return cliStdout("opus", `{"findings":[]}`), nil
+		}}
+		err := Run(Options{Repo: root, Model: "opus", OutputDir: t.TempDir(), Stdout: &buf, Paths: paths, Runner: fr})
+		var prompts [][]byte
+		for _, c := range fr.callList() {
+			prompts = append(prompts, c.prompt)
+		}
+		return buf.String(), prompts, err
+	}
+	// One file: only it is listed as kept and only it is sent.
+	out, prompts, err := run("pkg/app.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out, "kept:\npkg/app.go\ndropped:\n") || len(prompts) != 1 || !bytes.Contains(prompts[0], []byte("pkg/app.go\n")) || bytes.Contains(prompts[0], []byte("pkg/note.go")) {
+		t.Fatalf("one file:\n%s", out)
+	}
+	// A directory, written with a trailing slash, and "." both keep everything under them.
+	for _, p := range []string{"pkg/", "."} {
+		out, _, err = run(p)
+		if err != nil || !strings.Contains(out, "kept:\npkg/app.go\npkg/note.go\ndropped:\n") {
+			t.Fatalf("%s: %v\n%s", p, err, out)
+		}
+	}
+	// Repeated paths add up.
+	out, _, err = run("pkg/note.go", "pkg/app.go")
+	if err != nil || !strings.Contains(out, "kept:\npkg/app.go\npkg/note.go\n") {
+		t.Fatalf("two paths: %v\n%s", err, out)
+	}
+	// A partial name, a dropped file, and a missing file match nothing and call no model.
+	for _, p := range []string{"pkg/ap", "vendor/lib.go", "nope.go"} {
+		_, prompts, err = run("pkg/app.go", p)
+		if err == nil || !strings.Contains(err.Error(), "--path "+p+" matches no kept file") || len(prompts) != 0 {
+			t.Fatalf("%s: err=%v prompts=%d", p, err, len(prompts))
+		}
+	}
+}
+
 func TestRunBadJobsAndTimeout(t *testing.T) {
 	root, _ := newRepoBytes(t, specFiles())
 	fr := &fakeRunner{}
@@ -707,10 +750,13 @@ func TestCLI(t *testing.T) {
 	if err != nil || DefaultJobs != 8 || DefaultCallTimeout != 30*time.Minute || a.jobs != DefaultJobs || a.timeout != DefaultCallTimeout {
 		t.Fatalf("defaults %+v %v", a, err)
 	}
-	a, err = parseArgs([]string{"--model", "grok", "--output", "o", "--jobs", "3", "--call-timeout", "90s", "repo"})
-	if err != nil || a.jobs != 3 || a.timeout != 90*time.Second || a.repo != "repo" {
+	a, err = parseArgs([]string{"--model", "grok", "--output", "o", "--jobs", "3", "--call-timeout", "90s", "--path", "a.go", "--path", "web/src", "repo"})
+	if err != nil || a.jobs != 3 || a.timeout != 90*time.Second || a.repo != "repo" || !reflectArgs(a.paths, []string{"a.go", "web/src"}) {
 		t.Fatalf("flags %+v %v", a, err)
 	}
+	if _, err := parseArgs([]string{"--model", "grok", "--output", "o", "--path"}); err == nil {
+		t.Fatal("--path needs a value")
+	}
 	root, commit := newRepoBytes(t, droppedOnlyFiles())
 	outDir := t.TempDir()
 	code, errOut = cliCapture(t, root, "--model", "opus", "--output", outDir, "--jobs", "2", "--call-timeout", "1m")

From 0b05fa44beb7a7d9aa9ad926d405a027924bccf9 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Thu, 24 Sep 2026 12:59:43 -0700
Subject: [PATCH 05/22] feat(source-review): run every model with the same
 review setup

Grok ran locked down (one turn, no tools, our system prompt, a findings JSON
schema) while Opus and Astra ran on their CLI defaults, so the comparison was
not like for like. Every model now gets the same system prompt and the same
findings schema, with tools off:

- claude -p: --tools "" --system-prompt --json-schema --strict-mcp-config
  --no-session-persistence
- grok: unchanged (--prompt-file --verbatim --json-schema --tools ""
  --max-turns 1 --no-subagents --disable-web-search --system-prompt-override)
- codex exec: -s read-only --ephemeral --output-schema <temp file>. Codex has
  no switch to remove its tools or replace its system prompt, so it is the one
  model that differs.

The schema now sets "additionalProperties": false on every object; Codex's
strict schema mode rejects it otherwise (HTTP 400 invalid_json_schema).

A real --path web/src/routes/DirectDeposit.svelte run on hh, one per model,
finished cleanly: Opus 24 s / 4 findings, Astra 52 s / 2, Grok 426 s / 7.
---
 docs/ARCHITECTURE.md                |  7 +++-
 internal/sourcereview/model.go      | 62 +++++++++++++++++++++--------
 internal/sourcereview/model_test.go | 55 ++++++++++++++++++-------
 3 files changed, 92 insertions(+), 32 deletions(-)

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index b0861375..ed887233 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -44,8 +44,11 @@ abbreviated — task-done/epic-ready/pr-ready also take `--evidence <file>` (a v
 It reviews the first-party source at HEAD — code `Classify` keeps, minus tests, vendored trees,
 generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the real checkout) — by calling the logged-in `claude`, `codex`, or `grok` CLI, up to `--jobs`
 prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
-Grok runs as one tool-less turn (`--prompt-file --verbatim --json-schema --tools "" --max-turns 1
---system-prompt-override`): `grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools.
+Every model gets the same setup — one system prompt, one findings JSON schema, no tools, one answer — so they
+are compared on the same job: `claude -p --tools "" --system-prompt --json-schema --strict-mcp-config`,
+`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override` (`grok -p` hands
+a large prompt to its agent as an excerpt it re-reads with tools), and `codex exec -s read-only --output-schema`
+(Codex has no switch to remove its tools or replace its system prompt, so it is the one that differs).
 It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
 
 `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index 1ab601dd..053cd3d8 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -73,13 +73,38 @@ func ModelID(model string) (string, error) {
 	}
 }
 
-// grokSchema constrains Grok's answer to {"findings":[...]} with all eight
-// fields present.
-const grokSchema = `{"type":"object","properties":{"findings":{"type":"array","items":{"type":"object","properties":{"tag":{"type":"string","enum":["bug","advisory"]},"file":{"type":"string"},"start_line":{"type":"integer"},"end_line":{"type":"integer"},"issue":{"type":"string"},"consequence":{"type":"string"},"confidence":{"type":"integer"},"severity":{"type":"string","enum":["P0","P1","P2","P3"]}},"required":["tag","file","start_line","end_line","issue","consequence","confidence","severity"]}}},"required":["findings"]}`
+// Every model gets the same review setup: this system prompt, this answer
+// schema, no tools, one answer. The prompt text and the parser are shared too,
+// so the models are compared on the same job.
 
-// grokSystem replaces Grok's agent system prompt. Without it the model tries
-// to call tools, and --max-turns 1 cancels the turn.
-const grokSystem = "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message."
+// findingsSchema constrains the answer to {"findings":[...]} with all eight
+// fields present and no others. Codex's strict schema mode rejects an object
+// without "additionalProperties": false.
+const findingsSchema = `{"type":"object","properties":{"findings":{"type":"array","items":{"type":"object","properties":{"tag":{"type":"string","enum":["bug","advisory"]},"file":{"type":"string"},"start_line":{"type":"integer"},"end_line":{"type":"integer"},"issue":{"type":"string"},"consequence":{"type":"string"},"confidence":{"type":"integer"},"severity":{"type":"string","enum":["P0","P1","P2","P3"]}},"required":["tag","file","start_line","end_line","issue","consequence","confidence","severity"],"additionalProperties":false}}},"required":["findings"],"additionalProperties":false}`
+
+// reviewSystem replaces each CLI's agent system prompt. Without it Grok tries
+// to call tools and --max-turns 1 cancels the turn.
+const reviewSystem = "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message."
+
+// claudeArgs runs Claude as one turn with no tools, no MCP servers, and no
+// saved session. The prompt is on stdin.
+func claudeArgs() []string {
+	return []string{
+		"-p", "--model", "opus", "--output-format", "json",
+		"--tools", "", "--system-prompt", reviewSystem, "--json-schema", findingsSchema,
+		"--strict-mcp-config", "--no-session-persistence",
+	}
+}
+
+// codexArgs runs Codex with the shared schema, a read-only sandbox, and no
+// saved session. The prompt is on stdin ("-"). Codex has no switch to remove
+// its tools or replace its system prompt, so it is the one model that differs.
+func codexArgs(schemaFile string) []string {
+	return []string{
+		"exec", "--json", "-m", "gpt-6-astra",
+		"-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-",
+	}
+}
 
 // grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
 // Grok's agent as an excerpt plus a file to read back with tools, which made
@@ -88,9 +113,9 @@ func grokArgs(promptFile string) []string {
 	return []string{
 		"--prompt-file", promptFile, "--verbatim",
 		"-m", "grok-4.7", "--output-format", "json",
-		"--json-schema", grokSchema,
+		"--json-schema", findingsSchema,
 		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
-		"--system-prompt-override", grokSystem,
+		"--system-prompt-override", reviewSystem,
 	}
 }
 
@@ -101,14 +126,14 @@ var (
 	removeFile = os.Remove
 )
 
-// writePromptFile writes the prompt to a new file in os.TempDir(), which is
-// never inside the reviewed tree or the output directory.
-func writePromptFile(prompt []byte) (string, error) {
-	f, err := createTemp("", "metareview-grok-prompt-*.txt")
+// writeTempFile writes data to a new file in os.TempDir(), which is never
+// inside the reviewed tree or the output directory.
+func writeTempFile(pattern string, data []byte) (string, error) {
+	f, err := createTemp("", pattern)
 	if err != nil {
 		return "", err
 	}
-	_, werr := f.Write(prompt)
+	_, werr := f.Write(data)
 	cerr := f.Close()
 	if err := errors.Join(werr, cerr); err != nil {
 		_ = removeFile(f.Name())
@@ -122,19 +147,24 @@ func writePromptFile(prompt []byte) (string, error) {
 func Call(ctx context.Context, runner Runner, model string, prompt []byte) (string, error) {
 	switch strings.ToLower(strings.TrimSpace(model)) {
 	case "opus":
-		out, err := runner.Run(ctx, "claude", []string{"-p", "--model", "opus", "--output-format", "json"}, prompt)
+		out, err := runner.Run(ctx, "claude", claudeArgs(), prompt)
 		if err != nil {
 			return "", err
 		}
 		return claudeModelText(out)
 	case "astra":
-		out, err := runner.Run(ctx, "codex", []string{"exec", "--json", "-m", "gpt-6-astra", "-"}, prompt)
+		schema, err := writeTempFile("metareview-schema-*.json", []byte(findingsSchema))
+		if err != nil {
+			return "", err
+		}
+		defer func() { _ = removeFile(schema) }()
+		out, err := runner.Run(ctx, "codex", codexArgs(schema), prompt)
 		if err != nil {
 			return "", err
 		}
 		return codexModelText(out)
 	case "grok":
-		path, err := writePromptFile(prompt)
+		path, err := writeTempFile("metareview-grok-prompt-*.txt", prompt)
 		if err != nil {
 			return "", err
 		}
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
index a142541e..de5518f6 100644
--- a/internal/sourcereview/model_test.go
+++ b/internal/sourcereview/model_test.go
@@ -94,11 +94,17 @@ func TestModelID(t *testing.T) {
 func TestCallShapes(t *testing.T) {
 	prompt := []byte("review this")
 	for _, model := range []string{"opus", "astra", "grok"} {
-		fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		var schemaFile string
+		fr := &fakeRunner{reply: func(_ int, _ string, args []string, _ []byte) ([]byte, error) {
 			switch model {
 			case "opus":
 				return []byte(`{"is_error":false,"result":"{\"findings\":[]}"}`), nil
 			case "astra":
+				// The schema file holds the shared schema during the call.
+				schemaFile = args[len(args)-2]
+				if got, err := os.ReadFile(schemaFile); err != nil || string(got) != findingsSchema {
+					t.Fatalf("codex schema file %s: %v %q", schemaFile, err, got)
+				}
 				return []byte("not json\n{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"first\"}}\n{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"{\\\"findings\\\":[]}\"}}\n"), nil
 			default:
 				return []byte(`{"text":"{\"findings\":[]}"}`), nil
@@ -118,13 +124,21 @@ func TestCallShapes(t *testing.T) {
 		c := fr.calls[0]
 		switch model {
 		case "opus":
-			if c.name != "claude" || !reflectArgs(c.args, []string{"-p", "--model", "opus", "--output-format", "json"}) || !bytes.Equal(c.stdin, prompt) {
+			want := []string{"-p", "--model", "opus", "--output-format", "json", "--tools", "", "--system-prompt", sharedSystem, "--json-schema", findingsSchema, "--strict-mcp-config", "--no-session-persistence"}
+			if c.name != "claude" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
 				t.Fatalf("claude call %+v", c)
 			}
 		case "astra":
-			if c.name != "codex" || !reflectArgs(c.args, []string{"exec", "--json", "-m", "gpt-6-astra", "-"}) || !bytes.Equal(c.stdin, prompt) {
+			want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-"}
+			if c.name != "codex" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
 				t.Fatalf("codex call %+v", c)
 			}
+			if filepath.Dir(schemaFile) != filepath.Clean(os.TempDir()) {
+				t.Fatalf("schema file %s not in os.TempDir()", schemaFile)
+			}
+			if _, err := os.Stat(schemaFile); !os.IsNotExist(err) {
+				t.Fatalf("schema file %s left behind", schemaFile)
+			}
 		case "grok":
 			if c.name != "grok" || len(c.args) < 2 || !reflectArgs(c.args, grokWant(c.args[1])) || c.stdin != nil || !bytes.Equal(c.prompt, prompt) {
 				t.Fatalf("grok call %+v", c)
@@ -133,14 +147,18 @@ func TestCallShapes(t *testing.T) {
 	}
 }
 
+// sharedSystem is the system prompt every model gets, spelled out so a change
+// to reviewSystem is a visible test change.
+const sharedSystem = "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message."
+
 // grokWant is the exact Grok argv the goal names, for a given prompt file.
 func grokWant(promptFile string) []string {
 	return []string{
 		"--prompt-file", promptFile, "--verbatim",
 		"-m", "grok-4.7", "--output-format", "json",
-		"--json-schema", grokSchema,
+		"--json-schema", findingsSchema,
 		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
-		"--system-prompt-override", "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message.",
+		"--system-prompt-override", sharedSystem,
 	}
 }
 
@@ -190,23 +208,29 @@ func TestGrokPromptFile(t *testing.T) {
 	}
 }
 
-func TestGrokSchema(t *testing.T) {
+func TestFindingsSchema(t *testing.T) {
 	var s struct {
-		Type       string `json:"type"`
-		Required   []string
-		Properties struct {
+		Type                 string `json:"type"`
+		Required             []string
+		AdditionalProperties *bool `json:"additionalProperties"`
+		Properties           struct {
 			Findings struct {
 				Type  string `json:"type"`
 				Items struct {
-					Required   []string                   `json:"required"`
-					Properties map[string]json.RawMessage `json:"properties"`
+					Required             []string                   `json:"required"`
+					AdditionalProperties *bool                      `json:"additionalProperties"`
+					Properties           map[string]json.RawMessage `json:"properties"`
 				} `json:"items"`
 			} `json:"findings"`
 		} `json:"properties"`
 	}
-	if err := json.Unmarshal([]byte(grokSchema), &s); err != nil {
+	if err := json.Unmarshal([]byte(findingsSchema), &s); err != nil {
 		t.Fatal(err)
 	}
+	// Codex's strict mode rejects any object that allows extra properties.
+	if s.AdditionalProperties == nil || *s.AdditionalProperties || s.Properties.Findings.Items.AdditionalProperties == nil || *s.Properties.Findings.Items.AdditionalProperties {
+		t.Fatal("every object must set additionalProperties to false")
+	}
 	want := []string{"tag", "file", "start_line", "end_line", "issue", "consequence", "confidence", "severity"}
 	if !reflectArgs(s.Properties.Findings.Items.Required, want) || s.Properties.Findings.Type != "array" {
 		t.Fatalf("schema required %v", s.Properties.Findings.Items.Required)
@@ -232,8 +256,11 @@ func TestWritePromptFileErrors(t *testing.T) {
 	prevCreate, prevRemove := createTemp, removeFile
 	t.Cleanup(func() { createTemp, removeFile = prevCreate, prevRemove })
 	createTemp = func(string, string) (*os.File, error) { return nil, errors.New("create") }
-	if _, err := Call(bg, &fakeRunner{}, "grok", []byte("p")); err == nil || !strings.Contains(err.Error(), "create") {
-		t.Fatal(err)
+	for _, model := range []string{"grok", "astra"} {
+		fr := &fakeRunner{}
+		if _, err := Call(bg, fr, model, []byte("p")); err == nil || !strings.Contains(err.Error(), "create") || len(fr.callList()) != 0 {
+			t.Fatalf("%s: %v", model, err)
+		}
 	}
 	// A file that is already closed fails Write; the partial file is removed.
 	var made string

From 060042625583b553aedaa89ab372533e0acf93a7 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Thu, 24 Sep 2026 19:01:34 -0700
Subject: [PATCH 06/22] perf(source-review): run Grok at medium reasoning
 effort

Measured with the real source-review on hh (--path
web/src/routes/DirectDeposit.svelte), 5 runs each, side by side with a fresh
baseline in the same batch:

  default effort: 623 s, 6.4 findings, 2.8 of 3 core bugs
  medium effort:  502 s, 7.8 findings, 3.0 of 3 core bugs

19% faster with no lost findings. Low effort stays out: it is faster still but
loses findings.

Also adds the Grok speed goal and its progress file. Changes tested and
dropped so far: no forced answer format (26% faster but 2.0 fewer findings),
480 KB prompts (64% faster but about half the findings), and
grok-4.7-build-fast (2 of 5 runs produced no structured output).
---
 docs/ARCHITECTURE.md                |   3 +-
 internal/sourcereview/model.go      |   4 +
 internal/sourcereview/model_test.go |   1 +
 metareview-grok-speed-goal.md       | 105 +++++++++++++++++++++++
 metareview-grok-speed-progress.md   | 127 ++++++++++++++++++++++++++++
 5 files changed, 239 insertions(+), 1 deletion(-)
 create mode 100644 metareview-grok-speed-goal.md
 create mode 100644 metareview-grok-speed-progress.md

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index ed887233..63e85557 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -46,7 +46,8 @@ generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the
 prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
 Every model gets the same setup — one system prompt, one findings JSON schema, no tools, one answer — so they
 are compared on the same job: `claude -p --tools "" --system-prompt --json-schema --strict-mcp-config`,
-`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override` (`grok -p` hands
+`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override --reasoning-effort
+medium` (medium was faster than the default with no lost findings; `grok -p` hands
 a large prompt to its agent as an excerpt it re-reads with tools), and `codex exec -s read-only --output-schema`
 (Codex has no switch to remove its tools or replace its system prompt, so it is the one that differs).
 It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index 053cd3d8..b5a887e7 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -109,6 +109,9 @@ func codexArgs(schemaFile string) []string {
 // grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
 // Grok's agent as an excerpt plus a file to read back with tools, which made
 // one hh prompt take 11 model calls; --prompt-file with --verbatim sends it whole.
+// --reasoning-effort medium: on one hh file (5 runs against 5) it took 502 s
+// against 623 s at the default, with more findings and every core bug found.
+// low is faster still but loses findings.
 func grokArgs(promptFile string) []string {
 	return []string{
 		"--prompt-file", promptFile, "--verbatim",
@@ -116,6 +119,7 @@ func grokArgs(promptFile string) []string {
 		"--json-schema", findingsSchema,
 		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
 		"--system-prompt-override", reviewSystem,
+		"--reasoning-effort", "medium",
 	}
 }
 
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
index de5518f6..25c1a7cd 100644
--- a/internal/sourcereview/model_test.go
+++ b/internal/sourcereview/model_test.go
@@ -159,6 +159,7 @@ func grokWant(promptFile string) []string {
 		"--json-schema", findingsSchema,
 		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
 		"--system-prompt-override", sharedSystem,
+		"--reasoning-effort", "medium",
 	}
 }
 
diff --git a/metareview-grok-speed-goal.md b/metareview-grok-speed-goal.md
new file mode 100644
index 00000000..084aef2e
--- /dev/null
+++ b/metareview-grok-speed-goal.md
@@ -0,0 +1,105 @@
+# Grok speed
+
+<!-- CODING-GOAL-BEGIN -->
+
+/goal Make `metareview source-review --model grok` faster without losing
+review quality, by testing six changes one at a time on the real code and
+keeping only the ones that win.
+
+This file is the contract. Do not edit it during the walk. Results go in
+/Users/ben/code/metareview/metareview-grok-speed-progress.md. Create it at
+the start.
+
+## Authority
+
+Repository /Users/ben/code/metareview, branch `whole-repo-source-review`,
+starting at commit `0b05fa4`. This goal approves the code changes below and
+one `flow-pro commit` per kept change. It does not approve anything else.
+
+## Rules
+
+- Every measurement runs the real command on the real `hh` checkout:
+  `metareview source-review --model <m> --path <path>... --output <dir> /Users/ben/code/hh`,
+  built from the working tree. No fixture repos, no scratch harnesses, no
+  direct `grok` or `claude` calls outside `source-review`.
+- Output directories go under `/tmp/grok-speed/`.
+- Astra is out of scope. Do not run it. Keep `codexArgs` compiling and tested.
+- No API keys. Everything goes through the logged-in CLIs.
+- `--reasoning-effort low` is never kept. It loses findings (4.4 against 6.8).
+- Every model keeps the same setup (system prompt, instruction, answer
+  format, tools off). A change to shared setup is measured on Opus too.
+- A change is kept only if `go test` passes with `internal/sourcereview` at
+  100% coverage and `make cover` passes.
+
+## The sample and the score
+
+Sample S1: `--path web/src/routes/DirectDeposit.svelte` (one prompt).
+
+Sample S2: a `--path` set of real `hh` source that packs into at least 4
+prompts at the 120,000-byte limit. Choose it in checkpoint 1 and record it.
+Use it unchanged for the rest of the walk.
+
+The core bugs are three bugs Opus finds on S1 in every run:
+1. `result.data.errors` read without checking `result.data` (lines ~294–306).
+2. bank name, routing and account number only required when `checkPending`
+   is true (lines ~87–134).
+3. Cancel on a saved deposit leaves edited fields changed (lines ~202–208).
+
+A finding covers a core bug when its cited lines overlap that range and its
+issue text is about that bug. Check each finding by reading it, not by line
+numbers alone.
+
+An arm is 5 runs. Its score:
+- time: mean seconds per run (S1), or mean sum of per-prompt seconds from the
+  `prompt i/N done in Ns` lines (S2);
+- findings: mean finding count;
+- core: mean number of the 3 core bugs covered (S1 only).
+
+A change wins when, against the current baseline arm:
+- time is at least 10% lower, and
+- findings is no more than 0.5 lower, and
+- core is not lower.
+
+Otherwise it loses. A loss is reverted from the working tree. A win is
+committed with `flow-pro commit` and becomes the new baseline.
+
+## Changes, in this order
+
+1. Drop the forced answer format: remove `--json-schema` from `claudeArgs`
+   and `grokArgs`. Measure Grok and Opus on S1.
+2. Bigger prompts: raise `MaxPromptBytes` so S2 packs into about a quarter
+   as many prompts. Measure Grok on S2 with `--jobs 1`, and Opus on S2.
+   Also record findings per prompt. First check that Grok accepts a prompt
+   that large; if it rejects it, record the CLI's error and pick the largest
+   size it accepts.
+3. `grok-4.7-build-fast`: change the Grok model id. Measure Grok on S1. The
+   page's model id changes with it.
+4. `--reasoning-effort medium` for Grok. Measure Grok on S1.
+5. Sampling settings: look for a repetition-penalty, temperature, or similar
+   setting the Grok CLI accepts (`grok --help`, `grok inspect`,
+   `~/.grok/config.toml`, `~/.grok/docs`). If none exists, record where you
+   looked and skip this change. If one exists, pass it per call from
+   `grokArgs` (do not edit the user's config) and measure Grok on S1.
+6. Duplicate a slow call: when a Grok call runs past 2× the median of the
+   calls already finished in that run (at least 3 finished), start one
+   duplicate of that prompt and use whichever finishes first; kill the other.
+   Measure Grok on S2 with `--jobs 8` by wall-clock time, not the sum.
+
+## Checkpoints
+
+Record Pass or Fail in the progress file only. A later checkpoint starts only
+after every earlier one is Pass. The first checkpoint is Unverified.
+
+1. Baseline. Choose S2. Run 5 Grok and 5 Opus runs on S1, and 5 Grok (`--jobs 1`)
+   and 5 Opus runs on S2, at commit `0b05fa4`. Record every run and the
+   baseline scores.
+2. through 7. One checkpoint per change, in the order above. Each records
+   every run, the scores against the baseline, the decision (kept or
+   dropped), and for a kept change the commit sha. A dropped change leaves
+   `git status` clean.
+8. Summary. One table: each change, Grok time before and after, findings,
+   core, decision. Then one real `source-review --model grok --jobs 8` on the
+   full `hh` checkout with the final code, recording wall-clock time, total
+   findings, and whether it wrote `findings.json` and `review.html`.
+
+<!-- CODING-GOAL-END -->
diff --git a/metareview-grok-speed-progress.md b/metareview-grok-speed-progress.md
new file mode 100644
index 00000000..7af67721
--- /dev/null
+++ b/metareview-grok-speed-progress.md
@@ -0,0 +1,127 @@
+# Grok speed progress
+
+Session: Claude Code ccb3697d-57f7-43c7-afbe-b80f430f5235
+
+Evidence: /private/tmp/claude-501/-Users-ben-code-metareview/ccb3697d-57f7-43c7-afbe-b80f430f5235/scratchpad/speed
+(`arm.sh` runs the real source-review; `results.tsv` has one row per run; `logs/` holds each run's stdout and stderr;
+outputs are under `/tmp/grok-speed/`).
+
+Goal file `metareview-grok-speed-goal.md` is not edited.
+
+## Checkpoint 1 — Baseline
+
+Status: Pass
+
+Commit `0b05fa4`. S2: `--path app/controllers/admin --path app/models/reporting --path app/models/concerns`
+(488,772 raw bytes across those directories before the source cut). It packs into 5 prompts in every run.
+
+All 20 runs were started together (`baseline.sh`), so up to 10 Grok and 10 Opus calls ran at once. Rows are in
+`results.tsv` with label `base`. An earlier attempt exited 2 on every run because `arm.sh` passed the run number
+as an extra argument; that was a script bug, fixed, and those rows were discarded.
+
+| Arm (5 runs) | Time | Findings | Core |
+|---|---|---|---|
+| Grok S1 | 539 s (381–615) | 6.2 (4–9) | 3.0 |
+| Opus S1 | 63 s (52–76) | 5.8 (5–6) | 3.0 |
+| Grok S2, `--jobs 1`, sum of 5 prompts | 5,644 s (5,183–5,934) | 113 (103–119) | — |
+| Opus S2, `--jobs 1`, sum of 5 prompts | 265 s (234–289) | 33.2 (27–41) | — |
+
+Core: every run of both models covers all three core bugs (read with `show.sh`): the required-field check
+(lines ~87–134), the unguarded `result.data.errors` (~294–306), and Cancel not restoring fields (~202–208).
+
+Method note for later checkpoints: run times depend on how many calls run at once (Opus S1 took ~30 s alone
+earlier and ~63 s here). So each change is measured side by side with a fresh baseline arm in the same batch,
+and the change is judged against that fresh baseline, which is stricter than comparing with this table.
+
+## Checkpoint 2 — No forced answer format
+
+Status: Pass (change dropped)
+
+Change: remove `--json-schema` from `claudeArgs` and `grokArgs`. Measured on S1 in one batch (`cp2.sh`): the
+change (label `c2`) side by side with a fresh baseline built from `0b05fa4` (label `c2base`), 5 runs each,
+for Grok and Opus.
+
+| Arm (5 runs, S1) | Time | Findings | Core |
+|---|---|---|---|
+| Grok, baseline | 717 s (546–914) | 7.8 (4–13) | 2.8 |
+| Grok, no answer format | 530 s (458–589) | 5.8 (5–8) | 2.8 |
+| Opus, baseline | 87 s (62–116) | 4.8 (4–5) | 3.0 |
+| Opus, no answer format | 85 s (64–101) | 5.8 (5–7) | 3.0 |
+
+Core, read finding by finding (`show.sh`): Grok baseline run 3 and Grok change run 1 have no finding on the
+unguarded `result.data.errors`; every other run covers all three.
+
+Decision: dropped. Grok time is 26% lower, but Grok findings are 2.0 lower, past the 0.5 limit. The working
+tree is reverted; `git status` shows only the untracked goal and progress files.
+
+## Checkpoint 3 — Bigger prompts
+
+Status: Pass (change dropped)
+
+Change: `MaxPromptBytes` 120,000 → 480,000, so S2 packs into 2 prompts instead of 5. Grok accepted the larger
+prompts (no size error). Measured on S2 with `--jobs 1` in one batch (`cp3.sh`): the change (label `c3`) side by
+side with a fresh baseline from `0b05fa4` (label `c3base`), 5 runs each, Grok and Opus.
+
+| Arm (S2, `--jobs 1`) | Time (sum of prompts) | Findings | Findings per prompt |
+|---|---|---|---|
+| Grok, 120 KB (4 of 5 runs) | 5,745 s (5,429–6,011) | 105.8 (99–111) | 21.2 |
+| Grok, 480 KB (4 of 5 runs) | 2,087 s (1,886–2,475) | 58.3 (52–64) | 29.1 |
+| Opus, 120 KB | 320 s (290–389) | 36.0 (34–38) | 7.2 |
+| Opus, 480 KB | 168 s (144–186) | 13.2 (12–15) | 6.6 |
+
+One Grok run in each arm failed on the 30-minute call timeout and wrote nothing: `c3base` run 2 at prompt 4/5,
+`c3` run 2 at prompt 1/2. The Grok means cover the 4 runs that finished.
+
+Decision: dropped. Grok time is 64% lower, but Grok findings are 47.5 lower (Opus 22.8 lower), far past the
+0.5 limit. Grok's time per call barely changes at four times the size (about 1,000 s against about 1,100 s),
+but both models report far fewer findings for the same code. The working tree is reverted.
+
+## Checkpoint 4 — grok-4.7-build-fast
+
+Status: Pass (change dropped)
+
+Change: Grok model id `grok-4.7` → `grok-4.7-build-fast` (`ModelID` and `grokArgs`). Measured on S1 in one batch
+(`cp4.sh`): the change (label `c4`) side by side with a fresh baseline from `0b05fa4` (label `c4base`), 5 Grok runs each.
+
+| Arm (Grok, S1) | Runs that wrote output | Time | Findings | Core |
+|---|---|---|---|---|
+| Baseline `grok-4.7` | 5 of 5 | 474 s (344–566) | 6.4 (5–8) | 3.0 |
+| `grok-4.7-build-fast` | 3 of 5 | 268 s (90–358) | 6.3 (6–7) | 3.0 |
+
+Runs 1 and 2 of the change exited 1 after 143 s and 69 s: the Grok CLI returned
+`"structuredOutputError": "model did not produce structured output"` (`logs/c4-grok-S1-1.err`). The three runs that
+finished cover all three core bugs.
+
+Decision: dropped. On the runs that finished it is 43% faster with the same findings and core, but 2 of 5 runs
+produced no review at all, and one failed prompt fails a whole `source-review` run. The working tree is reverted.
+
+## Checkpoint 5 — Medium reasoning effort
+
+Status: Pass (change kept)
+
+Change: `grokArgs` adds `--reasoning-effort medium`. Measured on S1 in one batch (`cp5.sh`): the change (label `c5`)
+side by side with a fresh baseline from `0b05fa4` (label `c5base`), 5 Grok runs each.
+
+| Arm (Grok, S1) | Time | Findings | Core |
+|---|---|---|---|
+| Baseline (default effort) | 623 s (511–727) | 6.4 (4–9) | 2.8 |
+| `--reasoning-effort medium` | 502 s (406–576) | 7.8 (5–10) | 3.0 |
+
+Core, read finding by finding: baseline run 3 has no Cancel finding; every other baseline run and every medium
+run covers all three core bugs.
+
+Decision: kept. Time is 19% lower, findings are 1.4 higher, and core is not lower. `grokWant` in `model_test.go`
+names the new flag; `go test` for `internal/sourcereview` and `cmd/metareview` passes at 100.0%, and `make cover`
+exit 0 (`make-cover-c5.txt`). Commit: see below; this is the new baseline for later checkpoints.
+
+## Checkpoint 6 — Sampling settings
+
+Status: Unverified
+
+## Checkpoint 7 — Duplicate a slow call
+
+Status: Unverified
+
+## Checkpoint 8 — Summary
+
+Status: Unverified

From 6eba389a3e923fe0b53c7152e1ff49b4b19fc1f0 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Fri, 25 Sep 2026 06:08:24 -0700
Subject: [PATCH 07/22] feat(source-review): run Opus at medium effort to match
 Grok

0600426 moved Grok to --reasoning-effort medium but left Opus on the claude
CLI's default effort, so the two models no longer ran with the same setup.
claudeArgs now passes --effort medium. Not yet measured.

Also records the Grok speed goal's checkpoints 6-8 in its progress file:
sampling settings (dropped, 7.5% faster), duplicating slow calls (dropped,
never fired), the summary table, and one full hh run at 0600426 (exit 0,
4,188 s, 45 prompts, 671 findings).
---
 internal/sourcereview/model.go      |  4 +-
 internal/sourcereview/model_test.go |  2 +-
 metareview-grok-speed-progress.md   | 74 +++++++++++++++++++++++++++--
 3 files changed, 74 insertions(+), 6 deletions(-)

diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index b5a887e7..520fef14 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -87,12 +87,14 @@ const findingsSchema = `{"type":"object","properties":{"findings":{"type":"array
 const reviewSystem = "You are a code reviewer. You have no tools. Everything you need is in the user message. Answer in a single message."
 
 // claudeArgs runs Claude as one turn with no tools, no MCP servers, and no
-// saved session. The prompt is on stdin.
+// saved session, at medium effort to match Grok's --reasoning-effort medium.
+// The prompt is on stdin.
 func claudeArgs() []string {
 	return []string{
 		"-p", "--model", "opus", "--output-format", "json",
 		"--tools", "", "--system-prompt", reviewSystem, "--json-schema", findingsSchema,
 		"--strict-mcp-config", "--no-session-persistence",
+		"--effort", "medium",
 	}
 }
 
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
index 25c1a7cd..6ad929f3 100644
--- a/internal/sourcereview/model_test.go
+++ b/internal/sourcereview/model_test.go
@@ -124,7 +124,7 @@ func TestCallShapes(t *testing.T) {
 		c := fr.calls[0]
 		switch model {
 		case "opus":
-			want := []string{"-p", "--model", "opus", "--output-format", "json", "--tools", "", "--system-prompt", sharedSystem, "--json-schema", findingsSchema, "--strict-mcp-config", "--no-session-persistence"}
+			want := []string{"-p", "--model", "opus", "--output-format", "json", "--tools", "", "--system-prompt", sharedSystem, "--json-schema", findingsSchema, "--strict-mcp-config", "--no-session-persistence", "--effort", "medium"}
 			if c.name != "claude" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
 				t.Fatalf("claude call %+v", c)
 			}
diff --git a/metareview-grok-speed-progress.md b/metareview-grok-speed-progress.md
index 7af67721..25349ebd 100644
--- a/metareview-grok-speed-progress.md
+++ b/metareview-grok-speed-progress.md
@@ -112,16 +112,82 @@ run covers all three core bugs.
 
 Decision: kept. Time is 19% lower, findings are 1.4 higher, and core is not lower. `grokWant` in `model_test.go`
 names the new flag; `go test` for `internal/sourcereview` and `cmd/metareview` passes at 100.0%, and `make cover`
-exit 0 (`make-cover-c5.txt`). Commit: see below; this is the new baseline for later checkpoints.
+exit 0 (`make-cover-c5.txt`). Commit `0600426` (pushed); it is the baseline for checkpoints 6 and 7.
 
 ## Checkpoint 6 — Sampling settings
 
-Status: Unverified
+Status: Pass (change dropped)
+
+Where I looked: `grok --help` has no sampling flag. `~/.grok/config.toml` sets none, and `~/.grok/models_cache.json`
+has `"temperature": null, "top_p": null` for every model, so xAI's server decides. The docs
+(`~/.grok/docs/user-guide/26-config-reference.md`, `05-configuration.md`) list `models.temperature` and `models.top_p`,
+and no repetition penalty. The `GROK_CONFIG` inline JSON overlay may set the `models` table per process without
+touching the user's config; `grok inspect` with it set reports `env_overlay: $GROK_CONFIG (inline)`. Grok does not
+print the effective sampling values, so whether the server applied them is not verified.
+
+Change: run Grok as `env GROK_CONFIG={"models":{"temperature":0.7,"top_p":0.95}} grok …` (the docs' own example
+values). Measured on S1 in one batch (`cp6.sh`): the change (label `c6`) side by side with a fresh baseline built
+from `0600426` (label `c6base`, medium effort), 5 Grok runs each.
+
+| Arm (Grok, S1) | Time | Findings | Core |
+|---|---|---|---|
+| Baseline (`0600426`) | 494 s (470–509) | 5.4 (4–7) | 2.8 |
+| temperature 0.7, top_p 0.95 | 457 s (339–546) | 6.6 (5–8) | 3.0 |
+
+Core: baseline run 3 has no finding on the unguarded `result.data.errors`; every other run covers all three.
+
+Decision: dropped. Time is 7.5% lower, short of the 10% bar (findings and core did not get worse). The working
+tree is reverted.
 
 ## Checkpoint 7 — Duplicate a slow call
 
-Status: Unverified
+Status: Pass (change dropped)
+
+Change: in `review`, a call that runs past twice the median of the calls already finished in the run (once 3 have
+finished) gets one duplicate; the first to finish without error wins and the other is cancelled
+(`callHedged`, `durations`). Unit tests covered it at 100% (a slow first attempt is cancelled when the duplicate
+wins; an early failure gets no duplicate; a failed first attempt is rescued by the duplicate; two failures return
+the first error), passing 5 times under `-race`. Measured on S2 with `--jobs 8` in one batch (`cp7.sh`): the
+change (label `c7`) side by side with a fresh baseline built from `0600426` (label `c7base`), 5 Grok runs each,
+judged by wall-clock time.
+
+| Arm (Grok, S2, `--jobs 8`) | Wall time | Findings |
+|---|---|---|
+| Baseline (`0600426`) | 1,133 s (983–1,248) | 103.6 (85–130) |
+| Duplicate slow calls | 1,163 s (1,084–1,307) | 95.4 (88–101) |
+
+No run started a duplicate (`grep "started a duplicate" logs/c7-*` finds nothing): all 5 S2 prompts run at once
+under `--jobs 8`, so no call is still running after 3 have finished and it has passed twice their median.
+
+Decision: dropped. No time gain (2.6% slower, within noise). `run.go` and `run_test.go` are restored to `0600426`;
+`git diff` touches only this progress file.
 
 ## Checkpoint 8 — Summary
 
-Status: Unverified
+Status: Pass
+
+Each change was measured side by side with a fresh baseline in the same batch (5 runs each); "before" is that
+batch's baseline.
+
+| Change | Sample | Grok time before → after | Findings before → after | Core before → after | Decision |
+|---|---|---|---|---|---|
+| No forced answer format | S1 | 717 → 530 s | 7.8 → 5.8 | 2.8 → 2.8 | dropped (findings −2.0) |
+| 480 KB prompts | S2, `--jobs 1` | 5,745 → 2,087 s | 105.8 → 58.3 | — | dropped (findings −47.5) |
+| `grok-4.7-build-fast` | S1 | 474 → 268 s (3 of 5 runs) | 6.4 → 6.3 | 3.0 → 3.0 | dropped (2 of 5 runs failed) |
+| `--reasoning-effort medium` | S1 | 623 → 502 s | 6.4 → 7.8 | 2.8 → 3.0 | **kept** (`0600426`) |
+| temperature 0.7 / top_p 0.95 | S1 | 494 → 457 s | 5.4 → 6.6 | 2.8 → 3.0 | dropped (7.5% < 10%) |
+| Duplicate a slow call | S2, `--jobs 8` wall | 1,133 → 1,163 s | 103.6 → 95.4 | — | dropped (never fired) |
+
+Final run with the final code (`0600426`), from `/Users/ben/code/metareview` (`final.sh`):
+
+```
+metareview source-review --model grok --jobs 8 --output /tmp/grok-speed/final /Users/ben/code/hh
+```
+
+Exit 0 after 4,188 s (69.8 minutes) of wall-clock time. 45 prompts, each finished (per-prompt time 172–1,174 s,
+median 740 s). 671 findings. It wrote `/tmp/grok-speed/final/findings.json` (361,003 bytes) and
+`/tmp/grok-speed/final/review.html` (1,264,512 bytes). stderr has two skipped findings (a path that is not kept, and
+line numbers past the end of `data/reports/contractor.sql`); those are dropped by the parser, not failures.
+
+For comparison: the run before this goal (`--jobs 8`, default effort) was measured at about 58 minutes from its
+first 8 prompts, but was stopped there and never completed, so it is not a like-for-like total.

From 6775da03efce00b370afa8fdddaee43ae6e3fc5d Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sun, 27 Sep 2026 07:53:48 -0700
Subject: [PATCH 08/22] fix(source-review): isolate model calls and reject
 incomplete reviews

---
 docs/ARCHITECTURE.md                | 15 +++++--
 internal/sourcereview/model.go      | 65 +++++++++++++++++++++++------
 internal/sourcereview/model_test.go | 52 ++++++++++++++++++++++-
 internal/sourcereview/parse.go      |  4 +-
 internal/sourcereview/parse_test.go | 18 ++++++++
 5 files changed, 135 insertions(+), 19 deletions(-)

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 63e85557..6604b25a 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -46,10 +46,19 @@ generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the
 prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
 Every model gets the same setup — one system prompt, one findings JSON schema, no tools, one answer — so they
 are compared on the same job: `claude -p --tools "" --system-prompt --json-schema --strict-mcp-config`,
-`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override --reasoning-effort
-medium` (medium was faster than the default with no lost findings; `grok -p` hands
-a large prompt to its agent as an excerpt it re-reads with tools), and `codex exec -s read-only --output-schema`
+`grok --prompt-file --verbatim --json-schema --tools read_file --disallowed-tools read_file,search_tool,use_tool
+--max-turns 1 --system-prompt-override --reasoning-effort medium`
+(`grok --tools ""` retains the default tools; a nonempty allowlist followed by denial actually removes them;
+`grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools), and
+`codex exec -s read-only --skip-git-repo-check --output-schema`
 (Codex has no switch to remove its tools or replace its system prompt, so it is the one that differs).
+Calls start in an empty temporary working directory, cleaned after success or failure, so the host project's
+rules are not injected. Per-process settings disable Claude customizations and Grok's Claude/Cursor compatibility
+instructions. Native provider context can still differ. Grok's requested model is also set as its initial
+default: switching models after initialization otherwise replaces the supplied system prompt. Claude's effort
+environment override is set explicitly because it takes precedence over the CLI flag. Neither provider's
+global configuration is edited. Explicit token-limit stops and Grok structured-output failures fail the call,
+even if response text happens to parse as findings JSON.
 It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
 
 `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index 520fef14..c8e6d432 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -28,8 +28,32 @@ type OSRunner struct{}
 // is killed (the internal/fsm/cmdexec pattern).
 const waitDelay = 2 * time.Second
 
+const (
+	grokModelID  = "grok-4.7"
+	reviewEffort = "medium"
+)
+
 func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error) {
+	// Review only the supplied source. Starting in the host checkout injects
+	// unrelated project rules and skills into the model's conversation.
+	dir, err := os.MkdirTemp("", "metareview-workspace-*")
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = os.RemoveAll(dir) }()
 	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(),
+		"CLAUDE_CODE_SAFE_MODE=1",
+		// Claude gives this environment variable precedence over --effort.
+		"CLAUDE_CODE_EFFORT_LEVEL="+reviewEffort,
+		// Selecting a different Grok model after initialization re-renders its
+		// coding-agent system prompt, discarding --system-prompt-override.
+		// Make the requested model the session default before initialization.
+		fmt.Sprintf(`GROK_CONFIG={"models":{"default":%q}}`, grokModelID),
+		"GROK_CLAUDE_AGENTS_ENABLED=false", "GROK_CLAUDE_RULES_ENABLED=false", "GROK_CLAUDE_SKILLS_ENABLED=false",
+		"GROK_CURSOR_AGENTS_ENABLED=false", "GROK_CURSOR_RULES_ENABLED=false", "GROK_CURSOR_SKILLS_ENABLED=false",
+	)
 	if stdin != nil {
 		cmd.Stdin = bytes.NewReader(stdin)
 	}
@@ -39,7 +63,7 @@ func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byt
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
-	err := cmd.Run()
+	err = cmd.Run()
 	if err != nil {
 		// Codex puts the turn failure on stdout and a snapshot warning on
 		// stderr. Keep both so a non-zero exit records the CLI's reason.
@@ -67,7 +91,7 @@ func ModelID(model string) (string, error) {
 	case "astra":
 		return "gpt-6-astra", nil
 	case "grok":
-		return "grok-4.7", nil
+		return grokModelID, nil
 	default:
 		return "", fmt.Errorf("unknown model %q (want astra, opus, or grok)", model)
 	}
@@ -94,7 +118,7 @@ func claudeArgs() []string {
 		"-p", "--model", "opus", "--output-format", "json",
 		"--tools", "", "--system-prompt", reviewSystem, "--json-schema", findingsSchema,
 		"--strict-mcp-config", "--no-session-persistence",
-		"--effort", "medium",
+		"--effort", reviewEffort,
 	}
 }
 
@@ -104,24 +128,27 @@ func claudeArgs() []string {
 func codexArgs(schemaFile string) []string {
 	return []string{
 		"exec", "--json", "-m", "gpt-6-astra",
-		"-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-",
+		"-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-",
 	}
 }
 
 // grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
 // Grok's agent as an excerpt plus a file to read back with tools, which made
 // one hh prompt take 11 model calls; --prompt-file with --verbatim sends it whole.
-// --reasoning-effort medium: on one hh file (5 runs against 5) it took 502 s
-// against 623 s at the default, with more findings and every core bug found.
-// low is faster still but loses findings.
+// Effort is shared with Claude. Speed and independently verified quality are
+// measured together; a lower raw finding count alone does not establish a loss.
+// Grok treats --tools "" as the default toolset. Use a non-empty allowlist,
+// then deny that tool and the always-on MCP dispatchers. Deny takes precedence,
+// leaving no tools without maintaining an exhaustive list of built-in tools.
 func grokArgs(promptFile string) []string {
 	return []string{
 		"--prompt-file", promptFile, "--verbatim",
-		"-m", "grok-4.7", "--output-format", "json",
+		"-m", grokModelID, "--output-format", "json",
 		"--json-schema", findingsSchema,
-		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
+		"--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
+		"--max-turns", "1", "--no-subagents", "--disable-web-search",
 		"--system-prompt-override", reviewSystem,
-		"--reasoning-effort", "medium",
+		"--reasoning-effort", reviewEffort,
 	}
 }
 
@@ -187,8 +214,9 @@ func Call(ctx context.Context, runner Runner, model string, prompt []byte) (stri
 
 func claudeModelText(stdout []byte) (string, error) {
 	var doc struct {
-		IsError bool    `json:"is_error"`
-		Result  *string `json:"result"`
+		IsError    bool    `json:"is_error"`
+		StopReason string  `json:"stop_reason"`
+		Result     *string `json:"result"`
 	}
 	if err := json.Unmarshal(stdout, &doc); err != nil {
 		return "", fmt.Errorf("missing model text: %w", err)
@@ -200,6 +228,9 @@ func claudeModelText(stdout []byte) (string, error) {
 		}
 		return "", fmt.Errorf("claude: is_error: %s", msg)
 	}
+	if doc.StopReason == "max_tokens" {
+		return "", errors.New("claude: incomplete review: max_tokens")
+	}
 	if doc.Result == nil || *doc.Result == "" {
 		return "", errors.New("missing model text")
 	}
@@ -237,11 +268,19 @@ func codexModelText(stdout []byte) (string, error) {
 
 func grokModelText(stdout []byte) (string, error) {
 	var doc struct {
-		Text *string `json:"text"`
+		Text                  *string `json:"text"`
+		StopReason            string  `json:"stopReason"`
+		StructuredOutputError string  `json:"structuredOutputError"`
 	}
 	if err := json.Unmarshal(stdout, &doc); err != nil {
 		return "", fmt.Errorf("missing model text: %w", err)
 	}
+	if doc.StopReason == "max_tokens" {
+		return "", errors.New("grok: incomplete review: max_tokens")
+	}
+	if doc.StructuredOutputError != "" {
+		return "", fmt.Errorf("grok: %s", doc.StructuredOutputError)
+	}
 	if doc.Text == nil || *doc.Text == "" {
 		return "", errors.New("missing model text")
 	}
diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
index 6ad929f3..d2abef54 100644
--- a/internal/sourcereview/model_test.go
+++ b/internal/sourcereview/model_test.go
@@ -129,7 +129,7 @@ func TestCallShapes(t *testing.T) {
 				t.Fatalf("claude call %+v", c)
 			}
 		case "astra":
-			want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-"}
+			want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-"}
 			if c.name != "codex" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
 				t.Fatalf("codex call %+v", c)
 			}
@@ -157,7 +157,8 @@ func grokWant(promptFile string) []string {
 		"--prompt-file", promptFile, "--verbatim",
 		"-m", "grok-4.7", "--output-format", "json",
 		"--json-schema", findingsSchema,
-		"--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
+		"--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
+		"--max-turns", "1", "--no-subagents", "--disable-web-search",
 		"--system-prompt-override", sharedSystem,
 		"--reasoning-effort", "medium",
 	}
@@ -370,6 +371,26 @@ func TestCallErrors(t *testing.T) {
 	}
 }
 
+func TestModelTextRejectsIncompleteAnswer(t *testing.T) {
+	for _, c := range []struct {
+		model string
+		raw   string
+	}{
+		{"opus", `{"stop_reason":"max_tokens","result":"{\"findings\":[]}"}`},
+		{"grok", `{"stopReason":"max_tokens","text":"{\"findings\":[]}"}`},
+		{"grok", `{"structuredOutputError":"model did not produce structured output","text":"{\"findings\":[]}"}`},
+	} {
+		t.Run(c.model+c.raw, func(t *testing.T) {
+			fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+				return []byte(c.raw), nil
+			}}
+			if text, err := Call(bg, fr, c.model, []byte("review source")); err == nil || text != "" {
+				t.Fatalf("incomplete response accepted: text=%q err=%v", text, err)
+			}
+		})
+	}
+}
+
 func TestOSRunner(t *testing.T) {
 	out, err := OSRunner{}.Run(bg, "echo", []string{"hi"}, nil)
 	if err != nil || !bytes.Contains(out, []byte("hi")) {
@@ -400,6 +421,33 @@ func TestOSRunner(t *testing.T) {
 	}
 }
 
+func TestOSRunnerIsolatesWorkspace(t *testing.T) {
+	t.Setenv("GROK_CLAUDE_SKILLS_ENABLED", "true")
+	t.Setenv("CLAUDE_CODE_SAFE_MODE", "0")
+	t.Setenv("CLAUDE_CODE_EFFORT_LEVEL", "high")
+	t.Setenv("GROK_CONFIG", `{"models":{"default":"a-different-model"}}`)
+	for _, exit := range []string{"0", "1"} {
+		out, err := OSRunner{}.Run(bg, "sh", []string{"-c", `pwd; printf '%s\n' "$GROK_CLAUDE_SKILLS_ENABLED" "$CLAUDE_CODE_SAFE_MODE" "$GROK_CONFIG" "$CLAUDE_CODE_EFFORT_LEVEL"; exit "$1"`, "sh", exit}, nil)
+		if (err == nil) != (exit == "0") {
+			t.Fatalf("exit %s: %v", exit, err)
+		}
+		lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+		if len(lines) != 5 || !strings.HasPrefix(filepath.Base(lines[0]), "metareview-workspace-") || lines[1] != "false" || lines[2] != "1" || lines[3] != `{"models":{"default":"grok-4.7"}}` || lines[4] != "medium" {
+			t.Fatalf("unexpected workspace or environment: %q", out)
+		}
+		if _, err := os.Stat(lines[0]); !os.IsNotExist(err) {
+			t.Fatalf("workspace remains after exit %s: %v", exit, err)
+		}
+	}
+}
+
+func TestOSRunnerWorkspaceFailure(t *testing.T) {
+	t.Setenv("TMPDIR", filepath.Join(t.TempDir(), "missing"))
+	if _, err := (OSRunner{}).Run(bg, "echo", []string{"not started"}, nil); err == nil {
+		t.Fatal("workspace creation failure must fail the call")
+	}
+}
+
 func TestOSRunnerKillsProcessGroup(t *testing.T) {
 	pidFile := filepath.Join(t.TempDir(), "child.pid")
 	ctx, cancel := context.WithTimeout(bg, 300*time.Millisecond)
diff --git a/internal/sourcereview/parse.go b/internal/sourcereview/parse.go
index bccb20a9..aa77fa92 100644
--- a/internal/sourcereview/parse.go
+++ b/internal/sourcereview/parse.go
@@ -73,7 +73,9 @@ func Parse(text string, files map[string][]byte) ([]lensoutput.TypedFinding, []s
 func resolveKept(cited string, files map[string][]byte) (string, error) {
 	shown := cited
 	cited = strings.ReplaceAll(strings.TrimSpace(cited), "\\", "/")
-	if cited == "" || strings.Contains(cited, "..") {
+	// Only a complete parent-directory component is traversal. Literal dots
+	// in a kept file or directory name must not discard a valid citation.
+	if cited == "" || strings.Contains("/"+cited+"/", "/../") {
 		return "", fmt.Errorf("file is not kept: %s", shown)
 	}
 	cited = strings.TrimPrefix(cited, "./")
diff --git a/internal/sourcereview/parse_test.go b/internal/sourcereview/parse_test.go
index 9ae4f04e..534d9df5 100644
--- a/internal/sourcereview/parse_test.go
+++ b/internal/sourcereview/parse_test.go
@@ -161,6 +161,24 @@ func TestResolveShortPath(t *testing.T) {
 	}
 }
 
+func TestResolveKeptLiteralDoubleDots(t *testing.T) {
+	files := map[string][]byte{
+		"web/.. -t=silently/coverage/index.html": []byte("source\n"),
+		"pkg/file..name.go":                      []byte("source\n"),
+	}
+	for p := range files {
+		got, err := resolveKept(p, files)
+		if err != nil || got != p {
+			t.Fatalf("valid kept path %q was rejected: %q %v", p, got, err)
+		}
+	}
+	for _, p := range []string{"..", "../pkg/file..name.go", "other/../pkg/file..name.go", "pkg/..", `other\..\pkg\file..name.go`} {
+		if _, err := resolveKept(p, files); err == nil {
+			t.Fatalf("parent traversal accepted: %q", p)
+		}
+	}
+}
+
 func TestLineCountAndSplit(t *testing.T) {
 	if lineCount(nil) != 0 || splitLines(nil) != nil {
 		t.Fatal("empty")

From 08ce3cf8ad266b7570f940db8c9328eb85783fb2 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sun, 27 Sep 2026 07:58:00 -0700
Subject: [PATCH 09/22] docs: archive Grok experiments and record unfinished
 checkpoint

---
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ++++
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ++++
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ++++
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ++++
 ...533000-artifact-readme-075056c7-context.md |  64 +++
 ...66000-task-done-readme-075056c7-context.md | 446 ++++++++++++++++++
 .../metareview/learning/grok-parity/README.md |  27 ++
 .../grok-parity/experiment-history.md         | 396 ++++++++++++++++
 docs/metareview/learning/grok-parity/goal.md  | 143 ++++++
 ...ct-metareview-grok-parity-goal-b59209eb.md |  65 +++
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 +++
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 +++
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 +++
 ...45502217533000-artifact-readme-075056c7.md |  75 +++
 ...0100835166000-task-done-readme-075056c7.md |  65 +++
 15 files changed, 1900 insertions(+)
 create mode 100644 docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 create mode 100644 docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 create mode 100644 docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 create mode 100644 docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 create mode 100644 docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
 create mode 100644 docs/metareview/learning/grok-parity/README.md
 create mode 100644 docs/metareview/learning/grok-parity/experiment-history.md
 create mode 100644 docs/metareview/learning/grok-parity/goal.md
 create mode 100644 docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
 create mode 100644 docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
 create mode 100644 docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
 create mode 100644 docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
 create mode 100644 docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
 create mode 100644 docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
new file mode 100644
index 00000000..de3f17a9
--- /dev/null
+++ b/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
@@ -0,0 +1,103 @@
+# metareview context: metareview-grok-parity-goal.md
+
+Run ID: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
+
+## Target
+
+- Path: `metareview-grok-parity-goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `6eba389`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Goal
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+as well as or better than Opus, in no more than three times Opus's elapsed time.
+Quality means finding at least the important real bugs Opus finds, with no more
+false positives. More reported findings alone is not an improvement.
+
+Keep one review interface and one shared review pipeline. Switching between
+Opus and Grok changes the provider/model adapter, not the review task. A GPT
+adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
+
+This is the active scope, superseding the earlier fixed lists of experiments.
+The agent owns measurement details and may keep testing new approaches and
+combinations until the acceptance criteria are met. Do not stop because the
+first list of ideas is exhausted. Never report success from partial evidence.
+
+## Scope and invariants
+
+- Work on `whole-repo-source-review`, starting at `6eba389`.
+- Review `<reviewed-repository>` at commit
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
+  Check its HEAD before and after each measurement and reject a run if it changes.
+- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
+  or changes to the user's global CLI configuration.
+- Preserve the existing command and findings/page contract. Source selection,
+  prompts, system instructions, output schema, review stages, validation, retry
+  policy, concurrency, and reporting are shared. Translate their settings to
+  provider-specific CLI flags in the adapters. Record unavoidable differences.
+- Both models get the same source, context, instructions, allowed tools, and
+  effort setting for a comparison. No model receives benchmark answers or
+  findings from the other model. Keep tools disabled for review calls.
+- Shared prompt, packing, scheduling, validation, and recovery improvements are
+  allowed. Supported Grok model variants may be explored, with the actual model
+  ID recorded. A recovery must produce a real review; never turn a failed call,
+  truncation, missing coverage, or malformed answer into an empty successful review.
+- Preserve cancellation and timeouts. Count all retries and review stages in
+  elapsed time. Do not introduce unbounded retries or silently omit source.
+- Leave diff review, its anchor gate, and its FSM semantics unchanged.
+- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
+- Local implementation, experiments, tests, and commits are authorized by this
+  goal. Do not push, open a PR, or publish anything as part of this work.
+
+## Evidence and acceptance
+
+Use the actual `source-review` command built from the measured source revision.
+Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
+Record commands, build revision or diff hash, CLI versions, source commit,
+prompt hashes, settings, wall time, per-call time, failures, and output paths.
+Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
+evaluation ledger and summaries without committing the private `hh` source.
+
+1. Establish a fresh Opus baseline at the starting revision's medium effort,
+   and a current Grok measurement. Earlier results are context, not final proof.
+   Use small real `--path` samples to screen experiments, and full-repo runs to
+   decide success. The known DirectDeposit issues are leads to verify, not
+   automatically true bugs or the complete quality test.
+2. Adjudicate every unique defect claim in the baseline and finalist outputs
+   against the pinned source and relevant callers, tests, or dependency contracts.
+   Record root-cause matches, evidence, actual impact/severity, and one of
+   confirmed, false-positive, or unresolved. Adjudication is independent of the
+   producing model and does not accept its explanation as proof. Deduplicate by
+   root cause, not line overlap. Unresolved claims prevent a quality PASS.
+3. Important means co
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
+
+Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
new file mode 100644
index 00000000..249fb432
--- /dev/null
+++ b/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
@@ -0,0 +1,103 @@
+# metareview context: metareview-grok-parity-goal.md
+
+Run ID: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
+
+## Target
+
+- Path: `metareview-grok-parity-goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `6eba389`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Goal
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+as well as or better than Opus, in no more than three times Opus's elapsed time.
+Quality means finding at least the important real bugs Opus finds, with no more
+false positives. More reported findings alone is not an improvement.
+
+Keep one review interface and one shared review pipeline. Switching between
+Opus and Grok changes the provider/model adapter, not the review task. A GPT
+adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
+
+This is the active scope, superseding the earlier fixed lists of experiments.
+The agent owns measurement details and may keep testing new approaches and
+combinations until the acceptance criteria are met. Do not stop because the
+first list of ideas is exhausted. Never report success from partial evidence.
+
+## Scope and invariants
+
+- Work on `whole-repo-source-review`, starting at `6eba389`.
+- Review `<reviewed-repository>` at commit
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
+  Check its HEAD before and after each measurement and reject a run if it changes.
+- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
+  or changes to the user's global CLI configuration.
+- Preserve the existing command and findings/page contract. Source selection,
+  prompts, system instructions, output schema, review stages, validation, retry
+  policy, concurrency, and reporting are shared. Translate their settings to
+  provider-specific CLI flags in the adapters. Record unavoidable differences.
+- Both models get the same source, context, instructions, allowed tools, and
+  effort setting for a comparison. No model receives benchmark answers or
+  findings from the other model. Keep tools disabled for review calls.
+- Shared prompt, packing, scheduling, validation, and recovery improvements are
+  allowed. Supported Grok model variants may be explored, with the actual model
+  ID recorded. A recovery must produce a real review; never turn a failed call,
+  truncation, missing coverage, or malformed answer into an empty successful review.
+- Preserve cancellation and timeouts. Count all retries and review stages in
+  elapsed time. Do not introduce unbounded retries or silently omit source.
+- Leave diff review, its anchor gate, and its FSM semantics unchanged.
+- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
+- Local implementation, experiments, tests, and commits are authorized by this
+  goal. Do not push, open a PR, or publish anything as part of this work.
+
+## Evidence and acceptance
+
+Use the actual `source-review` command built from the measured source revision.
+Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
+Verify that directory is owned by the current user with mode `0700`, and use
+`umask 077` for benchmark artifacts containing private prompts or source excerpts.
+Record commands, build revision or diff hash, CLI versions, source commit,
+prompt hashes, settings, wall time, per-call time, failures, and output paths.
+Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
+evaluation ledger and summaries without committing the private `hh` source.
+
+1. Establish a fresh Opus baseline at the starting revision's medium effort,
+   and a current Grok measurement. Earlier results are context, not final proof.
+   Use small real `--path` samples to screen experiments, and full-repo runs to
+   decide success. The known DirectDeposit issues are leads to verify, not
+   automatically true bugs or the complete quality test.
+2. Adjudicate every unique defect claim in the baseline and finalist outputs
+   against the pinned source and relevant callers, tests, or dependency contracts.
+   Record root-cause matches, evidence, actual impact/severity, and one of
+   confirmed, false-positive, or unresolved. Adjudication is independent of the
+   producing mod
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
+
+Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
new file mode 100644
index 00000000..49a64242
--- /dev/null
+++ b/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
@@ -0,0 +1,103 @@
+# metareview context: metareview-grok-parity-goal.md
+
+Run ID: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
+
+## Target
+
+- Path: `metareview-grok-parity-goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `6eba389`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Goal
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+as well as or better than Opus, in no more than three times Opus's elapsed time.
+Quality means finding at least the important real bugs Opus finds, with no more
+false positives. More reported findings alone is not an improvement.
+
+Keep one review interface and one shared review pipeline. Switching between
+Opus and Grok changes the provider/model adapter, not the review task. A GPT
+adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
+
+This is the active scope, superseding the earlier fixed lists of experiments.
+The agent owns measurement details and may keep testing new approaches and
+combinations until the acceptance criteria are met. Do not stop because the
+first list of ideas is exhausted. Never report success from partial evidence.
+
+## Scope and invariants
+
+- Work on `whole-repo-source-review`, starting at `6eba389`.
+- Review `<reviewed-repository>` at commit
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
+  Check its HEAD before and after each measurement and reject a run if it changes.
+- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
+  or changes to the user's global CLI configuration.
+- Preserve the existing command and findings/page contract. Source selection,
+  prompts, system instructions, output schema, review stages, validation, retry
+  policy, concurrency, and reporting are shared. Translate their settings to
+  provider-specific CLI flags in the adapters. Record unavoidable differences.
+- Both models get the same source, context, instructions, allowed tools, and
+  effort setting for a comparison. No model receives benchmark answers or
+  findings from the other model. Keep tools disabled for review calls.
+- Shared prompt, packing, scheduling, validation, and recovery improvements are
+  allowed. Supported Grok model variants may be explored, with the actual model
+  ID recorded. A recovery must produce a real review; never turn a failed call,
+  truncation, missing coverage, or malformed answer into an empty successful review.
+- Preserve cancellation and timeouts. Count all retries and review stages in
+  elapsed time. Do not introduce unbounded retries or silently omit source.
+- Leave diff review, its anchor gate, and its FSM semantics unchanged.
+- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
+- Local implementation, experiments, tests, and commits are authorized by this
+  goal. Do not push, open a PR, or publish anything as part of this work.
+
+## Evidence and acceptance
+
+Use the actual `source-review` command built from the measured source revision.
+Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
+Verify that directory is owned by the current user with mode `0700`, and use
+`umask 077` for benchmark artifacts containing private prompts or source excerpts.
+Record commands, build revision or diff hash, CLI versions, source commit,
+prompt hashes, settings, wall time, per-call time, failures, and output paths.
+Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
+evaluation ledger and summaries without committing the private `hh` source.
+
+1. Establish a fresh Opus baseline at the starting revision's medium effort,
+   and a current Grok measurement. Earlier results are context, not final proof.
+   Use small real `--path` samples to screen experiments, and full-repo runs to
+   decide success. The known DirectDeposit issues are leads to verify, not
+   automatically true bugs or the complete quality test.
+2. Adjudicate every unique defect claim in the baseline and finalist outputs
+   against the pinned source and relevant callers, tests, or dependency contracts.
+   Record root-cause matches, evidence, actual impact/severity, and one of
+   confirmed, false-positive, or unresolved. Adjudication is independent of the
+   producing mod
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
+
+Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
new file mode 100644
index 00000000..67f686df
--- /dev/null
+++ b/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
@@ -0,0 +1,103 @@
+# metareview context: metareview-grok-parity-goal.md
+
+Run ID: `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb`
+
+## Target
+
+- Path: `metareview-grok-parity-goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `6eba389`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Goal
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+as well as or better than Opus, in no more than three times Opus's elapsed time.
+Quality means finding at least the important real bugs Opus finds, with no more
+false positives. More reported findings alone is not an improvement.
+
+Keep one review interface and one shared review pipeline. Switching between
+Opus and Grok changes the provider/model adapter, not the review task. A GPT
+adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
+
+This is the active scope, superseding the earlier fixed lists of experiments.
+The agent owns measurement details and may keep testing new approaches and
+combinations until the acceptance criteria are met. Do not stop because the
+first list of ideas is exhausted. Never report success from partial evidence.
+
+## Scope and invariants
+
+- Work on `whole-repo-source-review`, starting at `6eba389`.
+- Review `<reviewed-repository>` at commit
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
+  Check its HEAD before and after each measurement and reject a run if it changes.
+- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
+  or changes to the user's global CLI configuration.
+- Preserve the existing command and findings/page contract. Source selection,
+  prompts, system instructions, output schema, review stages, validation, retry
+  policy, concurrency, and reporting are shared. Translate their settings to
+  provider-specific CLI flags in the adapters. Record unavoidable differences.
+- Both models get the same source, context, instructions, allowed tools, and
+  effort setting for a comparison. No model receives benchmark answers or
+  findings from the other model. Keep tools disabled for review calls.
+- Shared prompt, packing, scheduling, validation, and recovery improvements are
+  allowed. Supported Grok model variants may be explored, with the actual model
+  ID recorded. A recovery must produce a real review; never turn a failed call,
+  truncation, missing coverage, or malformed answer into an empty successful review.
+- Preserve cancellation and timeouts. Count all retries and review stages in
+  elapsed time. Do not introduce unbounded retries or silently omit source.
+- Leave diff review, its anchor gate, and its FSM semantics unchanged.
+- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
+- Local implementation, experiments, tests, and commits are authorized by this
+  goal. Do not push, open a PR, or publish anything as part of this work.
+
+## Evidence and acceptance
+
+Use the actual `source-review` command built from the measured source revision.
+Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
+Verify that directory is owned by the current user with mode `0700`, and use
+`umask 077` for benchmark artifacts containing private prompts or source excerpts.
+Record commands, build revision or diff hash, CLI versions, source commit,
+prompt hashes, settings, wall time, per-call time, failures, and output paths.
+Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
+evaluation ledger and summaries without committing the private `hh` source.
+
+1. Freeze one full-repo Opus run as the reference, before further experiments.
+   Use the earliest fresh baseline already recorded at the starting revision's
+   medium effort: `baseline-full-opus-1` (295.9862 seconds). Keep the other runs
+   as historical evidence, not additional mandatory discoveries. Verify this
+   run's real issues against the pinned source; raw finding counts are not scores.
+   Do not select a different reference because a candidate fails.
+2. Adjudicate every unique defect claim in the baseline and finalist outputs
+   against the pinned source and relevant callers, tests, or dependency contracts.
+   Record root-cause matches, evidence, actual impact/severity, and one of
+
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
+
+Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..8343e91a
--- /dev/null
+++ b/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
@@ -0,0 +1,64 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260927-145502217533000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `6775da0`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. No benchmark is running. The current
+work is cleanup and verification, following the user's request to stop the
+open-ended experiment loop.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): preserved goal definition, originally at the repository root.
+- [Experiment history](experiment-history.md): preserved detailed log, originally
+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
+- The four historical goal reviews and context snapshots remain in the existing
+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
+  the goal, not completion of the implementation or successful benchmark quality.
+
+Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
+24 fixed primary files. Its quality score is unfinished. The previous fully
+scored sample covered 13/14 required roots and retained false claims.
+A successful whole-repository comparison has not been demonstrated.
+
+Private benchmark inputs, raw outputs, prototypes and harnesses remain under
+`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
+Nothing from this cleanup has been pushed or published.
+
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md b/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
new file mode 100644
index 00000000..200735c9
--- /dev/null
+++ b/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
@@ -0,0 +1,446 @@
+# metareview task-done context
+
+Run ID: `mrv-20260927-150100835166000-task-done-readme-075056c7`
+
+## Task
+
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. No benchmark is running. The current
+work is cleanup and verification, following the user's request to stop the
+open-ended experiment loop.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): preserved goal definition, originally at the repository root.
+- [Experiment history](experiment-history.md): preserved detailed log, originally
+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
+- The four historical goal reviews and context snapshots remain in the existing
+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
+  the goal, not completion of the implementation or successful benchmark quality.
+
+Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
+24 fixed primary files. Its quality score is unfinished. The previous fully
+scored sample covered 13/14 required roots and retained false claims.
+A successful whole-repository comparison has not been demonstrated.
+
+Private benchmark inputs, raw outputs, prototypes and harnesses remain under
+`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
+Nothing from this cleanup has been pushed or published.
+
+
+## Git
+
+- Base: `6eba389a3e923fe0b53c7152e1ff49b4b19fc1f0`
+- Head: `27972ab9c78f3d4fde80326c42da79e4d94fd024`
+- Branch: `whole-repo-source-review`
+- Gate effect: `gate`
+
+## Context Profile
+
+- Raw diff bytes: `159440`
+- Filtered diff bytes: `15752`
+- Risk level: `none`
+- Generated files excluded: docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md, docs/metareview/learning/grok-parity/experiment-history.md, docs/metareview/learning/grok-parity/goal.md, docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
+
+## Context Shard Plan
+
+Not sharded.
+
+## Review Manifest
+
+- Manifest verdict: `PASS`
+- Source manifest hash: not sharded
+- Runtime assessment: static-only; runtime not assessed
+
+### Source Paths
+- docs/ARCHITECTURE.md
+- docs/metareview/learning/grok-parity/README.md
+- internal/sourcereview/model.go
+- internal/sourcereview/model_test.go
+- internal/sourcereview/parse.go
+- internal/sourcereview/parse_test.go
+
+### Path Dispositions
+- docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/learning/grok-parity/experiment-history.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/learning/grok-parity/goal.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
+- docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md: generated (metareview generated review artifact excluded from source manifest)
+
+### Manifest Blockers
+No manifest blockers.
+
+## Changed Files
+
+- docs/ARCHITECTURE.md
+- docs/metareview/learning/grok-parity/README.md
+- internal/sourcereview/model.go
+- internal/sourcereview/model_test.go
+- internal/sourcereview/parse.go
+- internal/sourcereview/parse_test.go
+
+## Diff
+
+```diff
+diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
+index 63e8555..6604b25 100644
+--- a/docs/ARCHITECTURE.md
++++ b/docs/ARCHITECTURE.md
+@@ -46,10 +46,19 @@ generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the
+ prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
+ Every model gets the same setup — one system prompt, one findings JSON schema, no tools, one answer — so they
+ are compared on the same job: `claude -p --tools "" --system-prompt --json-schema --strict-mcp-config`,
+-`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override --reasoning-effort
+-medium` (medium was faster than the default with no lost findings; `grok -p` hands
+-a large prompt to its agent as an excerpt it re-reads with tools), and `codex exec -s read-only --output-schema`
++`grok --prompt-file --verbatim --json-schema --tools read_file --disallowed-tools read_file,search_tool,use_tool
++--max-turns 1 --system-prompt-override --reasoning-effort medium`
++(`grok --tools ""` retains the default tools; a nonempty allowlist followed by denial actually removes them;
++`grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools), and
++`codex exec -s read-only --skip-git-repo-check --output-schema`
+ (Codex has no switch to remove its tools or replace its system prompt, so it is the one that differs).
++Calls start in an empty temporary working directory, cleaned after success or failure, so the host project's
++rules are not injected. Per-process settings disable Claude customizations and Grok's Claude/Cursor compatibility
++instructions. Native provider context can still differ. Grok's requested model is also set as its initial
++default: switching models after initialization otherwise replaces the supplied system prompt. Claude's effort
++environment override is set explicitly because it takes precedence over the CLI flag. Neither provider's
++global configuration is edited. Explicit token-limit stops and Grok structured-output failures fail the call,
++even if response text happens to parse as findings JSON.
+ It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
+
+ `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
+diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
+new file mode 100644
+index 0000000..9aba16f
+--- /dev/null
++++ b/docs/metareview/learning/grok-parity/README.md
+@@ -0,0 +1,27 @@
++# Grok parity checkpoint
++
++The quality/speed goal is **not achieved**. No benchmark is running. The current
++work is cleanup and verification, following the user's request to stop the
++open-ended experiment loop.
++
++Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
++shared effort/system-prompt handling, incomplete-response rejection, and valid
++filenames containing double dots. It also adds tests and updates the architecture
++reference. The source-review package tests pass at 100% statement coverage.
++These are correctness fixes; no experimental speed candidate has been promoted.
++
++- [Goal](goal.md): preserved goal definition, originally at the repository root.
++- [Experiment history](experiment-history.md): preserved detailed log, originally
++  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
++- The four historical goal reviews and context snapshots remain in the existing
++  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
++  the goal, not completion of the implementation or successful benchmark quality.
++
++Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
++24 fixed primary files. Its quality score is unfinished. The previous fully
++scored sample covered 13/14 required roots and retained false claims.
++A successful whole-repository comparison has not been demonstrated.
++
++Private benchmark inputs, raw outputs, prototypes and harnesses remain under
++`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
++Nothing from this cleanup has been pushed or published.
+diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
+index 520fef1..c8e6d43 100644
+--- a/internal/sourcereview/model.go
++++ b/internal/sourcereview/model.go
+@@ -28,8 +28,32 @@ type OSRunner struct{}
+ // is killed (the internal/fsm/cmdexec pattern).
+ const waitDelay = 2 * time.Second
+
++const (
++   grokModelID  = "grok-4.7"
++   reviewEffort = "medium"
++)
++
+ func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error) {
++   // Review only the supplied source. Starting in the host checkout injects
++   // unrelated project rules and skills into the model's conversation.
++   dir, err := os.MkdirTemp("", "metareview-workspace-*")
++   if err != nil {
++       return nil, err
++   }
++   defer func() { _ = os.RemoveAll(dir) }()
+    cmd := exec.CommandContext(ctx, name, args...)
++   cmd.Dir = dir
++   cmd.Env = append(os.Environ(),
++       "CLAUDE_CODE_SAFE_MODE=1",
++       // Claude gives this environment variable precedence over --effort.
++       "CLAUDE_CODE_EFFORT_LEVEL="+reviewEffort,
++       // Selecting a different Grok model after initialization re-renders its
++       // coding-agent system prompt, discarding --system-prompt-override.
++       // Make the requested model the session default before initialization.
++       fmt.Sprintf(`GROK_CONFIG={"models":{"default":%q}}`, grokModelID),
++       "GROK_CLAUDE_AGENTS_ENABLED=false", "GROK_CLAUDE_RULES_ENABLED=false", "GROK_CLAUDE_SKILLS_ENABLED=false",
++       "GROK_CURSOR_AGENTS_ENABLED=false", "GROK_CURSOR_RULES_ENABLED=false", "GROK_CURSOR_SKILLS_ENABLED=false",
++   )
+    if stdin != nil {
+        cmd.Stdin = bytes.NewReader(stdin)
+    }
+@@ -39,7 +63,7 @@ func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byt
+    var stdout, stderr bytes.Buffer
+    cmd.Stdout = &stdout
+    cmd.Stderr = &stderr
+-   err := cmd.Run()
++   err = cmd.Run()
+    if err != nil {
+        // Codex puts the turn failure on stdout and a snapshot warning on
+        // stderr. Keep both so a non-zero exit records the CLI's reason.
+@@ -67,7 +91,7 @@ func ModelID(model string) (string, error) {
+    case "astra":
+        return "gpt-6-astra", nil
+    case "grok":
+-       return "grok-4.7", nil
++       return grokModelID, nil
+    default:
+        return "", fmt.Errorf("unknown model %q (want astra, opus, or grok)", model)
+    }
+@@ -94,7 +118,7 @@ func claudeArgs() []string {
+        "-p", "--model", "opus", "--output-format", "json",
+        "--tools", "", "--system-prompt", reviewSystem, "--json-schema", findingsSchema,
+        "--strict-mcp-config", "--no-session-persistence",
+-       "--effort", "medium",
++       "--effort", reviewEffort,
+    }
+ }
+
+@@ -104,24 +128,27 @@ func claudeArgs() []string {
+ func codexArgs(schemaFile string) []string {
+    return []string{
+        "exec", "--json", "-m", "gpt-6-astra",
+-       "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-",
++       "-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-",
+    }
+ }
+
+ // grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
+ // Grok's agent as an excerpt plus a file to read back with tools, which made
+ // one hh prompt take 11 model calls; --prompt-file with --verbatim sends it whole.
+-// --reasoning-effort medium: on one hh file (5 runs against 5) it took 502 s
+-// against 623 s at the default, with more findings and every core bug found.
+-// low is faster still but loses findings.
++// Effort is shared with Claude. Speed and independently verified quality are
++// measured together; a lower raw finding count alone does not establish a loss.
++// Grok treats --tools "" as the default toolset. Use a non-empty allowlist,
++// then deny that tool and the always-on MCP dispatchers. Deny takes precedence,
++// leaving no tools without maintaining an exhaustive list of built-in tools.
+ func grokArgs(promptFile string) []string {
+    return []string{
+        "--prompt-file", promptFile, "--verbatim",
+-       "-m", "grok-4.7", "--output-format", "json",
++       "-m", grokModelID, "--output-format", "json",
+        "--json-schema", findingsSchema,
+-       "--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
++       "--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
++       "--max-turns", "1", "--no-subagents", "--disable-web-search",
+        "--system-prompt-override", reviewSystem,
+-       "--reasoning-effort", "medium",
++       "--reasoning-effort", reviewEffort,
+    }
+ }
+
+@@ -187,8 +214,9 @@ func Call(ctx context.Context, runner Runner, model string, prompt []byte) (stri
+
+ func claudeModelText(stdout []byte) (string, error) {
+    var doc struct {
+-       IsError bool    `json:"is_error"`
+-       Result  *string `json:"result"`
++       IsError    bool    `json:"is_error"`
++       StopReason string  `json:"stop_reason"`
++       Result     *string `json:"result"`
+    }
+    if err := json.Unmarshal(stdout, &doc); err != nil {
+        return "", fmt.Errorf("missing model text: %w", err)
+@@ -200,6 +228,9 @@ func claudeModelText(stdout []byte) (string, error) {
+        }
+        return "", fmt.Errorf("claude: is_error: %s", msg)
+    }
++   if doc.StopReason == "max_tokens" {
++       return "", errors.New("claude: incomplete review: max_tokens")
++   }
+    if doc.Result == nil || *doc.Result == "" {
+        return "", errors.New("missing model text")
+    }
+@@ -237,11 +268,19 @@ func codexModelText(stdout []byte) (string, error) {
+
+ func grokModelText(stdout []byte) (string, error) {
+    var doc struct {
+-       Text *string `json:"text"`
++       Text                  *string `json:"text"`
++       StopReason            string  `json:"stopReason"`
++       StructuredOutputError string  `json:"structuredOutputError"`
+    }
+    if err := json.Unmarshal(stdout, &doc); err != nil {
+        return "", fmt.Errorf("missing model text: %w", err)
+    }
++   if doc.StopReason == "max_tokens" {
++       return "", errors.New("grok: incomplete review: max_tokens")
++   }
++   if doc.StructuredOutputError != "" {
++       return "", fmt.Errorf("grok: %s", doc.StructuredOutputError)
++   }
+    if doc.Text == nil || *doc.Text == "" {
+        return "", errors.New("missing model text")
+    }
+diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
+index 6ad929f..d2abef5 100644
+--- a/internal/sourcereview/model_test.go
++++ b/internal/sourcereview/model_test.go
+@@ -129,7 +129,7 @@ func TestCallShapes(t *testing.T) {
+                t.Fatalf("claude call %+v", c)
+            }
+        case "astra":
+-           want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-"}
++           want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-"}
+            if c.name != "codex" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
+                t.Fatalf("codex call %+v", c)
+            }
+@@ -157,7 +157,8 @@ func grokWant(promptFile string) []string {
+        "--prompt-file", promptFile, "--verbatim",
+        "-m", "grok-4.7", "--output-format", "json",
+        "--json-schema", findingsSchema,
+-       "--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
++       "--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
++       "--max-turns", "1", "--no-subagents", "--disable-web-search",
+        "--system-prompt-override", sharedSystem,
+        "--reasoning-effort", "medium",
+    }
+@@ -370,6 +371,26 @@ func TestCallErrors(t *testing.T) {
+    }
+ }
+
++func TestModelTextRejectsIncompleteAnswer(t *testing.T) {
++   for _, c := range []struct {
++       model string
++       raw   string
++   }{
++       {"opus", `{"stop_reason":"max_tokens","result":"{\"findings\":[]}"}`},
++       {"grok", `{"stopReason":"max_tokens","text":"{\"findings\":[]}"}`},
++       {"grok", `{"structuredOutputError":"model did not produce structured output","text":"{\"findings\":[]}"}`},
++   } {
++       t.Run(c.model+c.raw, func(t *testing.T) {
++           fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
++               return []byte(c.raw), nil
++           }}
++           if text, err := Call(bg, fr, c.model, []byte("review source")); err == nil || text != "" {
++               t.Fatalf("incomplete response accepted: text=%q err=%v", text, err)
++           }
++       })
++   }
++}
++
+ func TestOSRunner(t *testing.T) {
+    out, err := OSRunner{}.Run(bg, "echo", []string{"hi"}, nil)
+    if err != nil || !bytes.Contains(out, []byte("hi")) {
+@@ -400,6 +421,33 @@ func TestOSRunner(t *testing.T) {
+    }
+ }
+
++func TestOSRunnerIsolatesWorkspace(t *testing.T) {
++   t.Setenv("GROK_CLAUDE_SKILLS_ENABLED", "true")
++   t.Setenv("CLAUDE_CODE_SAFE_MODE", "0")
++   t.Setenv("CLAUDE_CODE_EFFORT_LEVEL", "high")
++   t.Setenv("GROK_CONFIG", `{"models":{"default":"a-different-model"}}`)
++   for _, exit := range []string{"0", "1"} {
++       out, err := OSRunner{}.Run(bg, "sh", []string{"-c", `pwd; printf '%s\n' "$GROK_CLAUDE_SKILLS_ENABLED" "$CLAUDE_CODE_SAFE_MODE" "$GROK_CONFIG" "$CLAUDE_CODE_EFFORT_LEVEL"; exit "$1"`, "sh", exit}, nil)
++       if (err == nil) != (exit == "0") {
++           t.Fatalf("exit %s: %v", exit, err)
++       }
++       lines := strings.Split(strings.TrimSpace(string(out)), "\n")
++       if len(lines) != 5 || !strings.HasPrefix(filepath.Base(lines[0]), "metareview-workspace-") || lines[1] != "false" || lines[2] != "1" || lines[3] != `{"models":{"default":"grok-4.7"}}` || lines[4] != "medium" {
++           t.Fatalf("unexpected workspace or environment: %q", out)
++       }
++       if _, err := os.Stat(lines[0]); !os.IsNotExist(err) {
++           t.Fatalf("workspace remains after exit %s: %v", exit, err)
++       }
++   }
++}
++
++func TestOSRunnerWorkspaceFailure(t *testing.T) {
++   t.Setenv("TMPDIR", filepath.Join(t.TempDir(), "missing"))
++   if _, err := (OSRunner{}).Run(bg, "echo", []string{"not started"}, nil); err == nil {
++       t.Fatal("workspace creation failure must fail the call")
++   }
++}
++
+ func TestOSRunnerKillsProcessGroup(t *testing.T) {
+    pidFile := filepath.Join(t.TempDir(), "child.pid")
+    ctx, cancel := context.WithTimeout(bg, 300*time.Millisecond)
+diff --git a/internal/sourcereview/parse.go b/internal/sourcereview/parse.go
+index bccb20a..aa77fa9 100644
+--- a/internal/sourcereview/parse.go
++++ b/internal/sourcereview/parse.go
+@@ -73,7 +73,9 @@ func Parse(text string, files map[string][]byte) ([]lensoutput.TypedFinding, []s
+ func resolveKept(cited string, files map[string][]byte) (string, error) {
+    shown := cited
+    cited = strings.ReplaceAll(strings.TrimSpace(cited), "\\", "/")
+-   if cited == "" || strings.Contains(cited, "..") {
++   // Only a complete parent-directory component is traversal. Literal dots
++   // in a kept file or directory name must not discard a valid citation.
++   if cited == "" || strings.Contains("/"+cited+"/", "/../") {
+        return "", fmt.Errorf("file is not kept: %s", shown)
+    }
+    cited = strings.TrimPrefix(cited, "./")
+diff --git a/internal/sourcereview/parse_test.go b/internal/sourcereview/parse_test.go
+index 9ae4f04..534d9df 100644
+--- a/internal/sourcereview/parse_test.go
++++ b/internal/sourcereview/parse_test.go
+@@ -161,6 +161,24 @@ func TestResolveShortPath(t *testing.T) {
+    }
+ }
+
++func TestResolveKeptLiteralDoubleDots(t *testing.T) {
++   files := map[string][]byte{
++       "web/.. -t=silently/coverage/index.html": []byte("source\n"),
++       "pkg/file..name.go":                      []byte("source\n"),
++   }
++   for p := range files {
++       got, err := resolveKept(p, files)
++       if err != nil || got != p {
++           t.Fatalf("valid kept path %q was rejected: %q %v", p, got, err)
++       }
++   }
++   for _, p := range []string{"..", "../pkg/file..name.go", "other/../pkg/file..name.go", "pkg/..", `other\..\pkg\file..name.go`} {
++       if _, err := resolveKept(p, files); err == nil {
++           t.Fatalf("parent traversal accepted: %q", p)
++       }
++   }
++}
++
+ func TestLineCountAndSplit(t *testing.T) {
+    if lineCount(nil) != 0 || splitLines(nil) != nil {
+        t.Fatal("empty")
+
+
+
+```
+
+## Knowledge And Registries
+
+Service inventory: none
+
+No service inventory found.
+
+Knowledge facts:
+
+No Beads knowledge facts found.
+
+## Evidence
+
+{"schemaVersion":1,"kind":"validation","command":["bash","-c","make cover \u003e /tmp/metareview-grok-parity/cleanup-make-cover-approved.log 2\u003e\u00261"],"cwd":".","exitCode":0,"startedAt":"2026-09-27T14:57:17.011405Z","finishedAt":"2026-09-27T15:00:49.985696Z","stdoutSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderrSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","summary":"bash -c make cover \u003e /tmp/metareview-grok-parity/cleanup-make-cover-approved.log 2\u003e\u00261 exited 0"}
+
+Embedded diff whitespace is normalized for documentation; git retains the exact source diff.
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
new file mode 100644
index 00000000..9aba16f2
--- /dev/null
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -0,0 +1,27 @@
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. No benchmark is running. The current
+work is cleanup and verification, following the user's request to stop the
+open-ended experiment loop.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): preserved goal definition, originally at the repository root.
+- [Experiment history](experiment-history.md): preserved detailed log, originally
+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
+- The four historical goal reviews and context snapshots remain in the existing
+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
+  the goal, not completion of the implementation or successful benchmark quality.
+
+Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
+24 fixed primary files. Its quality score is unfinished. The previous fully
+scored sample covered 13/14 required roots and retained false claims.
+A successful whole-repository comparison has not been demonstrated.
+
+Private benchmark inputs, raw outputs, prototypes and harnesses remain under
+`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
+Nothing from this cleanup has been pushed or published.
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
new file mode 100644
index 00000000..9ab01ec3
--- /dev/null
+++ b/docs/metareview/learning/grok-parity/experiment-history.md
@@ -0,0 +1,396 @@
+# Grok parity progress
+
+## Starting point
+
+- Goal: `metareview-grok-parity-goal.md`.
+- Branch: `whole-repo-source-review`; starting revision `6eba389`.
+- Target: `hh` at `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`.
+- Status: user-approved goal reset written; revised artifact review pending; fresh baseline recorded; no candidate has passed acceptance.
+- Historical final Grok run: 4,188 seconds, 45 prompts, 671 findings. The saved
+  outputs and logs still exist. Historical raw finding counts do not prove parity.
+
+## Goal review
+
+Artifact review `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`: PASS, zero blockers. Ten independent lenses reviewed the goal; Completeness and Security re-reviewed their resolved findings.
+
+## Investigation: tools were still exposed
+
+The two historical fast-model failures were `max turns reached`, not malformed
+review answers. Their Grok session records expose 25 tool definitions and actual
+`grep` tool calls despite `--tools ""`. Both had high reasoning effort. Current
+installed CLIs: Grok 1.0.41, Claude Code 2.1.281. This is evidence for fixing
+the shared no-tools contract before retesting the fast variant. No speed or
+quality improvement has yet been demonstrated.
+
+## Fresh Opus baseline
+
+At `6eba389`, medium effort and jobs 8, full `hh` runs completed in 295.99s (293 findings), 290.37s (283 findings), 266.13s (288 findings). All exit 0; source SHA unchanged. Median 290.37s; the 3x budget is 871.11s (14.52 minutes). Actual model reported: `claude-opus-5-5`. Raw responses, prompt hashes and full logs: `/tmp/metareview-grok-parity/baseline-full-opus-(1, 2, 3)/`. Quality adjudication is still in progress; raw counts are not scores.
+
+## Experiments in progress
+
+- Explicit nonempty allowlist plus denial removes Grok tools: live session `01a0d8e6-81f8-7172-b2f7-82458c2387d4` records an empty tool list, one turn, successful output. The diagnostic on `app/models/application_record.rb` took 131.76s.
+- Fast model, medium, no tools, original cwd: DirectDeposit sample took 262.99s and returned six findings (unadjudicated). Session `01a0d8e9-620a-7f42-87ba-44e0798d5412` records medium effort, but its actual system message is the 7,513-character coding-agent prompt, despite the requested 115-character reviewer prompt saved separately.
+- Isolated working directories and per-process customization suppression are implemented for the shared runner. They reduce ambient context, but the fast variant still changes the system message. An explicit reviewer agent profile is the next diagnostic.
+- `go test -cover ./internal/sourcereview` passes at 100.0% after the runner changes. Full coverage and task review remain owed.
+
+## Corrected setup and low-effort screening
+
+- Setting the requested Grok model as the per-process `models.default` prevents model selection from replacing the system prompt. Live fast-model session `01a0d8f4-ea2c-7f73-83bf-5d855ecc4c1d` records the exact shared 115-character system prompt and zero tools. An explicit agent file alone did not fix the reset and was dropped.
+- Fast model at low effort, corrected setup: S1 55.02s vs Opus 19.96s (2.76x), but Grok omitted the verified Cancel state defect. Rejected as a quality pass.
+- Shared systematic, evidence-grounded instructions at low effort: S1 Grok 64.75s vs Opus 21.97s (2.95x); Grok recovered Cancel. This is a screening result only. A full-repo pilot runs sequentially, Opus then Grok, under `/tmp/metareview-grok-parity/pilot-grounded-low-{opus,grok}-1/`.
+- The live benchmark exposed a parser defect: a real kept directory named `.. -t=silently` is rejected as traversal. A regression test first failed, and the parser now rejects only complete `..` path components. These historical harness rejections must not be scored as model false positives.
+
+## Full pilot: grounded instructions, low effort, fast Grok
+
+- Opus completed all 45 prompts in 150.04s, with 126 reported findings. This sets a matched 450.13s Grok limit; the initial baseline limit also remains binding.
+- Grok completed all 45 prompts in 902.07s (15.03 minutes), with 375 reported findings. The ratio is 6.01x, so this candidate fails timing. Its DirectDeposit prompt also omitted the confirmed Cancel defect, despite finding it in the small sample. It cannot pass quality either. Both runs exited 0 with the source SHA unchanged; their 45 prompt hashes match exactly.
+- Live session metadata confirms both a 13s call and a 297s call actually used `grok-4.7-build-fast`, low effort, and zero tools. Long calls still generate tens of thousands of reasoning tokens; the latency difference is not explained by accidentally retaining tools or high effort.
+- The pilot binary predates the literal-double-dot parser fix. Valid citations rejected for that reason are harness defects, not model false positives.
+- Independent adjudication has confirmed date-filter and invoice-cent truncation bugs and rejected claims contradicted by actual inherited scopes, soft-delete behavior, helper return values, and the database schema. The initial Opus reference is not yet frozen; adjudication remains incomplete.
+
+## Next experiment: smaller related groups
+
+The first-fit packer puts unrelated files together and separates relevant helpers. The next experimental build sorts by path and prefers 48 KB groups, retaining whole files up to the existing 120 KB hard limit. Selection, instructions, model variants, and effort remain the same as the failed pilot. This is a shared packing change, not a provider-specific prompt. Existing partition, UTF-8, line-number, and complete-file coverage tests pass with the grouping expectation adjusted. The implementation remains in a private Go overlay until measurements justify keeping it.
+
+Screening paths: `app/controllers/admin`, `app/models/reporting`, `app/models/concerns`, and `web/src/routes/DirectDeposit.svelte`. Paired sequential runs use jobs 8 and label `screen-grouped-low-s2plus`.
+
+Opus completed 14 prompts in 56.62s; Grok finished in 407.19s (7.19x). Both exited 0 with unchanged source SHA. Grouping alone fails the speed screen. Its first completed Grok calls took 134–193s, showing that smaller prompts do not reliably make the reasoning shorter. Grok recovered Cancel in this sample; that does not establish full quality parity.
+
+Prepared, not yet measured: a common concise-analysis instruction with a requested 1,500-token reasoning budget (a prompt request, not an enforced cap), and the supported Grok 4.6 variant at the same low effort. Both preserve the supplied review task and interface; neither is an accepted implementation.
+
+The concise-analysis screen ran sequentially under `screen-brief-critical`, after the grouped run finished. It supplied both models the same 12 files covering the verified seed defects and relevant API/validation/login helpers. No findings or expected answers were included in their prompts. Opus took 22.44s; Grok took 83.30s (3.71x), exceeding both the speed limit and the requested reasoning budget (5,777 and 8,231 reasoning tokens). Grok still missed verified defects and made a false claim that literal browser-side `ENV.fetch` exposed a server secret, so this is not a passing candidate.
+
+Executable adjudication checks now reproduce the date-filter boundary, scheduler missing-code acceptance, decimal subtotal truncation, and an actual rejected response-body read that leaves DirectDeposit saving indefinitely. The latter differs from the models' frequent false claim that ordinary fetch failures or invalid JSON omit `data`: the real API helper supplies `{}` or an error object for those cases.
+
+Next screen: `screen-cap4096-critical` applies the same 4,096-token response limit to both adapters, retaining the concise prompt and low effort. Grok uses the documented per-process `models.max_completion_tokens` overlay; Claude uses [`CLAUDE_CODE_MAX_OUTPUT_TOKENS`](https://code.claude.com/docs/en/env-vars). A cap-induced truncation is a failed review, not an empty success.
+
+Result: Opus 23.08s, Grok 82.85s (3.59x), both exit 0. Grok reported 8,266 and 4,394 total output tokens, including reasoning, despite the 4,096 setting. It is not an enforceable total-generation cap in this observed setup; no causal explanation is assumed. The candidate fails the speed screen.
+
+That documentation also shows `CLAUDE_CODE_EFFORT_LEVEL` overrides the CLI flag. The shared runner now explicitly sets the selected effort in the child environment. The regression test first failed with an inherited `high` value, then passed after the change. This workspace had no inherited effort or output-budget overrides, so prior measurements are unaffected. The source-review package remains at 100% coverage.
+
+The adapter now also rejects an explicit `max_tokens` stop from either CLI and Grok's `structuredOutputError`, even if its text happens to contain valid findings JSON. Regression tests demonstrated those incomplete responses were previously accepted. Package tests pass at 100% after the fix.
+
+Next: `screen-grok46-critical`, the same real-code sample with the supported Grok 4.6 variant, shared low effort and grounded instructions (without the ineffective response cap or concise-analysis request). Both adapters use a three-minute per-call timeout for this screen.
+
+Result: Opus 26.96s, Grok 61.24s (2.27x), both successful. Grok still missed the verified scheduler missing-code defect, Cancel, and the future-day boundary, so this does not pass quality. `screen-grok46-medium-critical` now tests the same variant/sample with medium effort for both models, preserving the same timeout.
+
+Medium result: Opus completed in 66.36s; Grok hit the three-minute per-call timeout and the command failed cleanly in 180.36s without publishing a partial review. This is a failed screening run. The timeout is shorter than 3x this new Opus time (199.08s), so it does not by itself prove the variant cannot meet the ratio with a longer timeout. The failed result is retained.
+
+## Focused targets with supporting source
+
+`screen-focused-context-critical` tests a documented combination: preferred 20 KB primary groups, up to 40 KB of deterministic supporting definitions/callers, and a shared system prompt that explicitly acknowledges omitted code. It uses Grok 4.6 and shared low effort. Retrieval uses only source identifiers and declarations, never benchmark findings or another model's answers. Every selected file remains a primary target; supporting files do not replace coverage. Primary grouping/UTF-8/line-number tests and provider/caller retrieval checks pass in the private overlay. Production packing remains unchanged while this is measured.
+
+Result: Opus 34.58s, Grok 120.61s (3.49x), both successful across seven prompts. Six Grok calls took 26–34s; DirectDeposit took 120s. Grok recovered the future-day boundary but still missed Cancel, the rejected-body-read defect, and scheduler missing-code acceptance. Its actual session confirms the new system text, low effort, and zero tools. This is not a quality pass.
+
+Next, `screen-focused-lenses-critical` keeps that source/context setup but performs three common discovery passes: security; state/correctness; and errors/recovery. This tests whether narrower tasks recover the missed defect classes. There is no model-to-model sharing and no expected findings in the prompts. All passes count toward elapsed time; this experiment has no automatic adjudication stage yet.
+
+Result: Opus 53.30s, Grok 116.84s (2.19x), both successful across 21 prompts. Grok recovered Cancel but still missed scheduler missing-code acceptance and the rejected response-body read. Opus also missed some seed defects in this run. The speed screen passes; quality does not. Next screen holds the three-pass pipeline and low effort constant and swaps Grok 4.6 for standard Grok 4.7.
+
+The standard Grok 4.7 three-pass screen failed its three-minute call timeout at 180.28s; Opus completed in 77.66s. No partial review was published. This cutoff is less than 3x the paired Opus time, so it is a failed bounded screen, not proof that the ratio is impossible with a longer timeout.
+
+Goal criterion 4 has been corrected from each Grok run reproducing the union of six Opus runs to equal three-run discovery frequencies per root cause. Grok must equal or exceed both initial and finalist Opus; finalist Opus must preserve its initial frequency. Every confirmed important reference bug remains mandatory. Six affected independent artifact-review lenses returned PASS; four unaffected results carry forward. Review: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`. No experiment is retroactively accepted.
+
+Next screen, `screen-trace-lenses-critical`, retains Grok 4.6, low effort, context retrieval, and three passes, but asks each shared pass to evaluate concrete guard values, state transitions, and deferred error propagation. These are general review procedures; no expected findings or other-model outputs are supplied. It tests the classes missed in prior screens.
+
+Result: Opus 62.41s, Grok 123.00s (1.97x), both successful. Grok covered all eight independently confirmed seed roots, including scheduler nil-equality acceptance and uncaught response-body rejection. Raw findings were 56 and 50; false-positive adjudication is not complete and this is not a full quality PASS.
+
+Full-source shape check: 1,346 selected files, 291 primary groups, 873 discovery calls, 51.8 MB of total prompt text across three passes, 58.8 KB median group including context. Packing took 11.57s. `pilot-trace-lenses-full` now measures the full repo sequentially with common jobs 48 and a five-minute per-call timeout. The machine has 128 GiB RAM; concurrency is explicitly recorded and shared. No verification stage or automatic semantic deduplication is present yet. This is a pilot, not a final validation batch.
+
+## User-approved reset from the side conversation
+
+The user explicitly approved revising the goal and resuming with cheap subset screening before bounded full-repo validation. The shared goal now freezes the earliest fresh full-repo Opus run (`baseline-full-opus-1`, 295.9862s), replaces the multi-run union/frequency requirements, and requires one-factor experiments. Grok must cover the frozen reference's verified important bugs, with no more false positives, and finish within 3x both the reference and a matched Opus run. Keep optimizing below that ceiling.
+
+Next steps for the main run: review the revised artifact; finish adjudicating this single reference and freeze the representative screening paths; implement and verify a whole-run timeout before another full-repo benchmark. The Grok full-run cap is 887.9586s or 3x the matched Opus time, whichever is lower. Timeout must cancel all model subprocesses, preserve logs, and fail the review without publishing partial coverage. Only candidates that pass the cheap quality/speed screen advance to a full-repo scorecard. Existing per-call timeouts do not implement this overall deadline.
+
+The side conversation edited only the goal and this handoff. It could not resume or change the persistent goal controller (`Goal tools require a persistent thread`). No benchmark was launched, cancelled, or claimed successful here. Prior artifact PASS verdicts do not cover this amendment; its review remains pending.
+
+The interrupted 873-call pilot stopped during Opus at 211.76s, exit 1, with no completed review; Grok never started. Observed CLI elapsed time far exceeded reported provider time at jobs 48. This failed pilot is retained and is not timing evidence for parity.
+
+The user-approved revised goal passed artifact review `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb` with zero blockers. Seven affected lenses re-reviewed; three unchanged lens results carry forward. Work is continuing manually following the user's resume instruction; the persistent controller still reports paused and exposes no agent-side resume operation.
+
+The benchmark harness now requires an overall deadline and launches each review in a private process session. Timeout kills all session process groups, including the separate groups created for model calls; premature output moves to failed-output. Three process tests passed (success/error exit, nested-group timeout preserving unrelated processes, and early-parent failure cleanup). End-to-end fake runs returned timeout exit124 at 0.89s for a0.8s cap and0.69s for the matched cap0.6s, retaining diagnostics and no completed output. Cleanup time is included; timeout runs always fail.
+
+The frozen screening manifest is `/tmp/metareview-grok-parity/frozen-screening.json`: 24 exact paths, retaining all prior critical targets and adding Swift, Ruby parsing and source helpers needed to reject known false positives. Screening cap:240s per Opus run; Grok is bounded by min(240s,3x matched Opus). No new model experiment has started under this reset. Frozen baseline identity is the earliest run; its source adjudication is still incomplete.
+
+The frozen subset's 27 original Opus claims have now been checked against source: 16 confirmed (12 important roots, four P3 items), 11 false positives. Evidence and root IDs are in `/tmp/metareview-grok-parity/screening-reference.json`. Checking the rest of the full reference continues; no full-repo quality PASS is claimed.
+
+Next hypothesis: the same three tracing checklists can run in one model call per source group, retaining coverage while removing repeated startup/context. `screen-combined-trace-fixed` changes only this call grouping from the prior trace-lenses candidate. Model/effort, primary grouping, retrieval and jobs8 stay fixed. It uses the frozen24 paths and verified overall cap240s (Grok also <=3x matched Opus). It cannot advance unless required subset roots are covered and false positives meet the comparison.
+
+Combined-call result: Opus56.97s, Grok92.65s (1.63x), both completed11prompts without timeout. Grok covers8/12 required subset roots; misses scheduler missing-code acceptance, iOS Cancel discarding edits, the weekend dashboard gap, and the ban parser extended-regex spaces. Candidate rejected on recall before further false-positive scoring.
+
+Next screen `screen-combined-medium-fixed` changes only shared effort from low to medium. Earlier medium screening lacked the focused context and concrete tracing instructions, so this is a new configuration. Frozen24paths, jobs8, cap240s, Grokalso<=3x matched Opus.
+
+Medium effort: Opus82.26s; Grok exceeded240s and failed. Cleanup raised PermissionError before saving the result; an immediate follow-up verified the private session82280 had no live children. Exact total elapsed was lost, so the reconstructed failure records elapsed>=240s, not an invented time. No completed output was accepted. The harness now deduplicates process-group signals, tolerates an exited-group race only after verifying no live members, and saves cleanup failures as failures. Five timeout tests pass after reproducing both missing cases.
+
+Next `screen-focused-fixed` changes the combined low-effort candidate into three focused calls using the same checklist content and exact packed source bodies. This controls the earlier promising three-pass result on the full frozen24-file sample; no full run follows until recall and false positives pass. Other settings and overall limits are unchanged.
+
+Focused fixed-sample result: Opus84.34s/79raw findings; Grok190.17s/81raw findings (2.25x),33calls each. Grok recovers iOS Cancel but still misses scheduler missing-code acceptance, weekend filtering and extended-regex spaces:9/12required roots. Recall fails; no full run and no claimed false-positive pass.
+
+Next `screen-focused-wide-fixed` changes only preferred primary grouping20KB->80KB, retaining40KB supporting-context ceiling within120KB total, three tracing passes, low effort, Grok4.6 and jobs8. This tests fewer repeated calls and more coherent local source; the earlier larger-group trial lacked this model and focused procedure. Frozen sample/deadlines stay fixed.
+
+115of293 frozen full-reference claims have now been independently source-adjudicated. Reference verification remains incomplete; that does not change the fixed sample or mandatory bugs.
+
+Wide-group result: Opus43.18s/39raw findings, Grok83.10s/43raw findings (1.92x),9calls each. Grok finds7/12required roots; misses scheduler MFA, iOS Cancel, weekend gap and both ban-parser roots. Speed improves but quality regresses, so no full run.
+
+Next `screen-focused-wide-fast-fixed` changes only Grok model4.6->4.7-build-fast. The common three-pass procedure, larger groups, low effort, frozen sample and limits are identical. This revisits the fast variant with the newer review procedure, not the earlier failed whole-repo configuration.
+
+Fast-model result: matched Opus38.62s; Grok4.7-build-fast timed out at115.996s with deadline115.868s (3x matched). Cleanup succeeded and no partial result was published. No quality pass.
+
+Next `screen-verified-fixed` returns to the combined low-effort control and changes one factor: adds a same-model verification pass for each source group. It receives its own provisional draft and the same source, checks unsupported claims, and searches for omissions; only its final replacement findings are published. This addresses measured false assertions, duplicate claims and missing roots, without cross-model answer sharing. Raw drafts are retained separately as provisional evidence. Every stage counts toward elapsed time; failed/malformed verification fails the run. Other settings and frozen24paths remain unchanged.
+
+Verification-pass result: Opus85.84s, Grok169.92s (1.98x),22calls each. Grok still misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. Recall fails; no full run. The additional pass does not justify its cost.
+
+Reference correction: B1-65 (Kaiser fractional adjustment) is false-positive. Earlier arithmetic reproduction did not establish reachable input: the production builder converts to Integer, the preview uses70, and draft edits permit integers only. Evidence and superseded adjudication are retained. The fixed subset now has11 important roots, four P3 claims and12 false positives. All prior candidates still fail the same recall gaps; each candidate that reported the Kaiser claim loses one true match and gains a false claim. The verification candidate finds7/11. Paths and reference run are unchanged.
+
+Next screen `screen-focused-wide-medium-fixed` changes only shared effort low->medium from the wide three-pass Grok4.6 control. Fewer concurrent groups may allow deeper reasoning within the bounded screen where medium with11 groups timed out. Same frozen24paths, jobs8,240s overall cap and Grok<=3x matched Opus.
+
+Wide-group medium result: Opus87.24s, Grok timed out at240.10s, cleanup successful. Three completed Grok calls took197-208s; not all9 completed. No output accepted and no full run.
+
+Next `screen-focused-grok45-fixed` changes only Grok4.6->supportedGrok4.5 from the20KB,three-pass,low-effort control. That control had the best fixed-sample recall so far (8/11 after the evidence-based correction), but missed three required roots. Same frozen paths, jobs8 and bounded240s/3x screen; no model gets expected answers.
+
+Grok4.5 result: Opus101.99s; Grok timed out at240.12s with successful cleanup. First completed calls were91-145s; not all33calls finished. This bounded screen fails and provides no completed quality result.
+
+Next `screen-focused-audit-fixed` changes the shared response procedure from the low-effortGrok4.6 three-pass control: each call must provide concise concrete check results per primary file before final findings. It adds no calls or models. Audit notes remain private; published findings retain the existing contract. Schema and instructions are identical between providers, all primary files must have nonempty check notes or the call fails, and grouping uses the prior header length to preserve primary membership. Five experimental validation cases passed after missing/empty/malformed audit cases failed against the initial stub. Frozen24paths, jobs8 and240s/3x limits remain unchanged.
+
+The audit Opus run completed in115.95s. A cosmetic pair-harness edit introduced an indentation error before Grok could start; no Grok subprocess launched. Two mock orchestration regressions reproduced the missing matched-time handoff and failed-run stop defect, then passed after correction. The already completed Opus measurement remains valid; Grok is being launched sequentially with its exact matched time and the original240s cap. No model inputs or candidate code changed between the pair.
+
+Audit result: Opus115.95s/48raw findings, Grok231.50s/72raw findings (2.00x),33calls each. Grok now covers9/11required roots, recovering MFA and weekend filtering but missing iOS Cancel and extended-regex spaces. False positives remain; no full run.
+
+Next screen `screen-focused-function-audit-fixed` changes only audit granularity: every source-detected declaration plus each file's top-level executable code gets an explicit audit entry, generated from source without expected findings. Same model, low effort, grouping, three passes, context, jobs and frozen paths. Validator rejects missing items. Experimental packing is not yet suitable for full-repo promotion.
+
+Function-audit result: Opus failed at65.53s because one required function audit was absent; validation rejected the result, cleanup succeeded and Grok never started. Next `screen-focused-function-map-fixed` changes only the audit representation to an object whose source-generated keys are individually required by the common schema. The procedure, source, model and caps remain the same. This tests reliable checklist completion without retries.
+
+All293 frozen reference findings have now received an initial source adjudication. Earlier counts included two separately tracked false components; the actual item count before this batch was277/293. Root deduplication and mixed-claim FP accounting still need consolidation before a final scorecard. No benchmark pass is inferred from completion of this ledger.
+
+Required-map audit result: Opus150.25s/50raw findings; Grok timed out at240.11s after28of33prompts, with successful cleanup. Required schema keys prevented the earlier omission failure in completed calls, but this screen is a time failure and partial findings are not accepted. Next `screen-combined-function-map-fixed` changes only call grouping: the same three checklists run together in one call per primary group, retaining mandatory per-declaration audits. Frozen24paths, model4.6,loweffort,context,grouping,jobs8 and240s/3x limits remain unchanged.
+
+Raw-response reconciliation found four additional baseline claims rejected by the original parser because valid directory names contained literal double dots. All four describe the same verified P3 generated-coverage clutter, not important functional bugs. Baseline:297raw claims,293published findings; initial root ledger has77important and80P3roots. The77important-root target is unchanged by these parser-skipped claims. The existing parser correction accepts these literal names while still rejecting parent-directory traversal.
+
+Combined mandatory-audit result: Opus87.04s/29findings; Grok112.28s/34findings (1.29x),11calls each. Grok covers7/11required roots and misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. The extra function-level output does not improve recall over ordinary combined calls. Candidate rejected; no full run.
+
+Next `screen-focused-semantics-fixed` changes only the correctness checklist of the best9/11 per-file-audit control. It explicitly asks for concrete parsing/pattern examples under actual language semantics and UI-event state comparisons. These are general procedures, with no benchmark answers, source-specific names or model-produced findings in the prompt. Same three passes,20KBprimary/40KBcontext,model4.6,loweffort,jobs8 and frozen screening limits.
+
+Adjudication consistency correction: B1-52 is a real configuration-dependent SQL day-boundary bug. ActiveRecord with this app's :local setting serializes Friday18:00Pacific to Saturday01:00 on a UTC host; :local alone did not disprove the claim. The important reference now contains78roots. Separately retained three disproved factual components from mixed claims (weekday parser example, unchanged fractional input validity, and alleged deletion of merged bytes). These corrections are source-driven and do not change screening paths or its11required roots.
+
+Semantics-checklist run: Opus213.66s/45findings; Grok stopped at206.69s when the experimental audit validator rejected malformed JSON text. Inspection shows a restarted, complete trailing JSON object exactly equal to the CLI structuredOutput, with the required file audit and an actual empty security-pass findings array. The existing production extractFindings parser already handles this case; the new audit validator incorrectly bypassed it. Next `screen-focused-semantics-normalized-fixed` changes only audit validation to use the same extraction before checking file coverage. Complete-restart, unfinished-restart and missing-coverage regressions cover this repair. Model inputs/settings/deadlines remain unchanged; the failed run is not relabeled a success.
+
+Normalized semantics result: Opus123.05s/46findings; Grok234.00s/75findings (1.90x),33completed calls. Grok covers8/11required roots: Cancel is recovered, but MFA, weekend filtering and extended-regex spaces are missed. No quality pass or full run.
+
+Next `screen-focused-wide-medium-jobs16-fixed` changes only concurrency8->16 from the earlier wide-group,medium-effort,Grok4.6 trial. The frozen subset has9calls, so all can start in one wave. That earlier configuration timed out before completing its queued ninth call; higher concurrency tests whether medium reasoning fits the bound without changing either model's task. Reuses the exact existing binary, same24paths and240s/3x cap.
+
+Wide-medium jobs16 result: Opus97.52s/61findings; Grok timed out at240.11s with clean cancellation, only4of9calls completed (157–231s). Removing the queued ninth call did not make medium effort fit this bound.
+
+New packing hypothesis: source-review's120KB byte cap is much smaller than the documented model context windows: [Grok4.6,500Ktokens](https://docs.x.ai/developers/models/grok-4.6) and [Opus5.5,1Mtokens](https://platform.claude.com/docs/en/models/opus-5-5/overview). These API capabilities do not guarantee the CLI accepts every large prompt; errors remain failures. `screen-focused-large-fixed` changes only source packing capacity from the normalized-semantics low-effort control:1MBtotal,960KBpreferred primary instead of20KB, same40KBsupport limit. The fixed24files fit one shared source batch and retain all three passes. Model4.6,loweffort,jobs8,schema,checklists and240s/3x cap stay fixed. This is an isolated source-review experiment; diff-gate120KBsharding is unchanged. A packing check verifies complete original numbered bytes beyond120KB and the new hard byte bound.
+
+Large-batch low-effort result: Opus52.84s/14findings; Grok108.96s/19findings (2.06x),3calls. Both CLIs accepted the complete sample (Grok about60.6Kinput tokens/call), but Grok found only5/11required roots. Opus also missed several. Large context at low effort loses recall; no full run.
+
+Next `screen-focused-large-medium-fixed` changes only shared model reasoning effort to medium from that large-batch control. The3-call shape tests whether deeper reasoning can use the broader source context effectively. The declared measurement safety bound is300s per run with5m call timeout; Grok remains capped at3x matched Opus. This extra minute cannot turn a >3x result into a pass, and it does not change the completed control measurements. Source, prompts, stages, schema, jobs8 and frozen24paths are unchanged.
+
+Large-batch medium result: Opus149.35s/25findings; Grok timed out at300.10s with clean cancellation and no completed review. Deeper reasoning still exceeds the cheap-test bound.
+
+Next `screen-focused-large-fast-fixed` changes only Grok model4.6->4.7-build-fast from the completed large-batch low-effort control. Larger batches now need just3calls, so this tests the stronger fast variant without the earlier queued calls. Shared loweffort,source,checklists,per-file audits,schema,jobs8 and3x comparison stay fixed. Bound240s,calltimeout4m as in the completed loweffort control.
+
+Large-batch fast result: Opus47.22s; Grok timed out at141.77s (3x matched deadline141.66s), cleanup successful. No partial result accepted.
+
+Next `screen-focused-file-results-fixed` returns to the large-batch Grok4.6 low-effort control and changes only response organization: each primary file has its concrete checks immediately followed by its own findings. The same existing eight-field findings are flattened deterministically for publication. This tests an observed omission: the prior Grok audit described the inactive-alias crash but left it out of its global findings array. No expected findings or other-model answers enter the prompt. Source, three checks, effort, jobs8 and240s/3x limits stay fixed. Missing file coverage, malformed entries, or incomplete JSON still fail.
+
+Per-file findings result: Opus56.55s/15findings; Grok failed at75.35s because its audit changed a primary path (`direct_deposit_controller.rb` to `direct_deposit/controller.rb`). Coverage validation correctly rejected the run; cleanup succeeded. Next `screen-focused-file-map-fixed` changes only the response representation to a map with exact primary paths as individually required schema keys. It retains per-file checks followed immediately by findings, without extra calls. Same source, model4.6,low effort, three passes and bounded comparison.
+
+Exact-file-map result: Opus83.65s/19findings; Grok117.16s/33findings (1.40x),3calls. Required file keys worked, but Grok covers only6/11important roots; misses both dashboard bugs, both ban-parser bugs and iOS Cancel. False claims remain; no quality pass or full run.
+
+Next `screen-focused-wide-medium-extended-fixed` reuses the exact prior wide-medium binary at jobs16. This is a measurement-bound change, not a claimed optimization: the prior run stopped at the240s screening safety cap although 3x matched Opus allowed292.57s, with calls completing at157–231s. The new declared cap is360s/6m, always further limited to3x the freshly matched Opus time. This tests whether the cheap-test safety cap censored a configuration that can satisfy the actual goal. No source, model4.6, medium effort, three checks, grouping, schema, or concurrency changes; no additional stages. All failures retained.
+
+Reference mixed-claim audit: split two independent important causes already present in the frozen output (legacy BG waiver-copy omission and course-load stale error) from their neighboring claims. Required whole-repo roots80; the fixed sample remains11. Also retained the dashboard-test timezone overgeneralization as a separate false component (UTC+2 disproves it), and corrected the adjudicator's mistaken claim that ComplianceSign submit checks canSubmit. Reference unique false roots109. These are source-driven accounting corrections, not discoveries added from later model runs. Final audit remains in progress.
+
+Extended medium result: Opus85.34s/52findings; Grok timed out at256.14s against256.03s matched limit, with2of9calls complete. Cleanup succeeded. The actual3x requirement, not the screening safety cap, now rejects this configuration.
+
+Next `screen-focused-all-context-fixed` returns to the normalized-semantics Grok4.6 low-effort control (33calls) and changes supporting-context retrieval. Frozen24primary paths/grouping stay fixed; helpers can now come from all selected first-party source at the same pinned commit, and explicit Ruby partial names match underscored template filenames. Source-derived dependencies only, no handpicked expected answers. This addresses observed false claims about omitted caller validation and shared UI handlers. Same three passes, per-file audit,40KBsupport bound and jobs8. Screening cap360s/6m and Grok<=3x matched, following the declared extended bound; no full run without quality.
+
+Supporting-context preflight caught another retrieval problem: raw identifier overlap crowded out an explicitly rendered helper even after making it available. Explicit quoted source references now outrank incidental matches, including Rails partial path normalization; no benchmark-specific path is in the retrieval implementation. Synthetic dependency/primary-scope checks and pinned-source manifest verification pass with24primary files and11source groups.
+
+Dashboard adjudication reproduced the actual view script plus shared table-search script in jsdom with the actual jQuery3.7.1. Initial `mode=future` hides the boundary day; clicking Future after ready shows it because the shared keyup handler replaces the filter. Clear shows weekend rows, and a Saturday text search works. The midnight root remains confirmed for reload/bookmarked future mode; its trigger is narrower than earlier isolated-expression evidence. The weekend preset gap remains present, with the Clear/search workaround explicitly recorded. [jQuery3 ready callbacks are asynchronous](https://jquery.com/upgrade-guide/3.0/#breaking-change-document-ready-handlers-are-now-asynchronous).
+
+Retained the original Future-button overstatement as a separate false component after the full DOM reproduction, rather than quietly narrowing the claim without FP accounting. Whole-repo reference remains80important roots; unique false roots110. Future-midnight matching must preserve the real initial/reload trigger, and analogous overstatements in finalist claims must be counted consistently.
+
+All-source supporting-context result: Opus137.25s/47findings; Grok227.15s/83findings (1.65x),33calls. Grok covers10/11required roots, the best recall so far; only extended-regex spaces remains missing. Cancel is identified through retained change flags. Multiple false/mixed claims remain, so no quality PASS or full run.
+
+Next `screen-focused-mixed-effort-fixed` changes one shared policy from this10/11control: correctness calls use medium effort; security and reliability keep low. Both models receive the identical per-stage effort policy. The remaining recall failure concerns exact language semantics, which deeper reasoning has recovered in other comparisons; increasing only that existing pass limits the extra time. No added stages or expected answers. Same source, supporting-context retrieval,33calls,per-file audit and jobs8. Declared360s/6m cap, further limited to3x matched Opus.
+
+Prepared, not yet benchmarked: stronger priority for directly referenced type definitions over generic method-name overlap. The10/11control's auth group omitted AuditTrail despite a direct AuditTrail call, while including unrelated methods with matching names; Grok consequently repeated a false claim that the audit stores full SSNs. A synthetic tight-budget regression reproduced the omission, then passed with type-reference weighting. The pinned-source manifest now includes AuditTrail; explicit rendered partials and all24primary targets remain covered. This preparation does not change the running mixed-effort benchmark or count as a measured improvement.
+
+Mixed-effort result: Opus169.02s/60findings; Grok timed out at the360s screening cap with clean cancellation. This cap is lower than3x matched Opus (507.07s), so it proves a failed bounded screen, not an intrinsic >3x ratio. One completed medium call took329s; several queued correctness calls remained unfinished. A reversed citation953..328 was rejected in the partial output and retained in diagnostics. No complete Grok output or quality score is accepted.
+
+Next `screen-focused-type-context-fixed` tests the prepared direct-type context priority from the completed10/11 all-context low-effort control. Only retrieval weighting changes; same33calls,primary groups,support byte limit,audit,model4.6,low effort,jobs8 and360s/3x cap. This specifically addresses the observed omission of called class definitions behind false claims; no handpicked source file or benchmark answer is inserted.
+
+Direct-type context result: Opus178.71s/50findings; Grok269.30s/73findings (1.51x),33completed calls. Grok covers8/11required roots, missing scheduler MFA, weekend filtering and extended-regex spaces. The full-SSN audit claim is absent, but other false claims remain and recall regressed. No full run.
+
+Next `screen-focused-declaration-audit-fixed` changes audit granularity from the best all-context low-effort control: every source-detected declaration, constant and file top level receives a required concise concrete-check entry. Short generated IDs avoid repeating long paths in output. Both models get identical source-generated inventory and schema; no expected findings enter prompts. Same33calls,24primary paths,context retrieval,model4.6,loweffort,jobs8 and360s/3x cap. Synthetic inventory/normalization checks passed; this experimental packing needs hardening before any full-repo promotion.
+
+Source-adjudication correction: the frozen reference already reported repeated invoice subtotals in Kaiser, Generic and Sutter templates (B1-66/72/86). Earlier dismissal traced production batch sorting but missed the separately routed preview actions, which order only by start_at. Rendering each actual ERB template with synthetic A,B,A chronological rows reproduces two full A subtotals; A,A,B renders one. All three have the same P2 financial-display impact (including B1-86 originally labeled P3). Required reference now83important roots; unique false roots107. The unchanged24-file sample now requires14roots. The best all-context result covers13/14; direct-type context covers11/14. Both still miss extended-regex spaces; no past failed candidate becomes a pass. Superseded adjudication and scorecards are retained.
+
+Production adapter/parser verification repeated in the current workspace: `go test ./internal/sourcereview -coverprofile=...` passed with100%statement coverage; `git diff --check` passed. These checks do not establish benchmark quality or task completion.
+
+Declaration-audit result: Opus142.68s/59findings; Grok247.78s/82findings (1.74x),33calls. Grok covers10/14important roots; misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. Required audit entries do not guarantee accurate evaluations: both models explicitly mis-evaluate the same regex despite noting its modifier. More checklist output regressed recall. No full run.
+
+Next `screen-focused-literal-normalization-fixed` returns to the best13/14 all-context control and changes only one correctness instruction: write the interpreted literal/pattern after escapes and modifiers, then evaluate examples against that form instead of its visual spelling. This addresses the observed incorrect audit evaluation, without source-specific examples or expected findings. No extra pass or schema expansion. Same24paths,33calls,model4.6,loweffort,jobs8 and360s/3x cap.
+
+Prepared (not benchmarked) selective-effort fallback: retain the best all-context prompts and use medium only for correctness groups whose primary source has an extended-mode pattern literal; all other calls stay low. This is a source heuristic shared by both adapters, with no target paths or expected findings. Tests first rejected the old all-correctness-medium policy, then passed for primary-only classification and CLI/environment agreement. A model-free full-source packing preflight selected all1346files into291groups/873calls, with only3correctness calls classified medium and no missing primary headers. No performance or quality gain is inferred from this preflight.
+
+Literal-normalization result: Opus141.93s/45findings; Grok229.34s/71findings (1.62x),33calls. Opus recovered the regex defect at low effort, but Grok still mis-evaluated the interpreted form. Grok covers11/14required roots, missing scheduler MFA, weekend filtering and extended-regex spaces. No quality pass or full run.
+
+Next `screen-focused-pattern-effort-fixed` runs the prepared selective-effort policy from the best all-context control, without the unsuccessful literal-normalization instruction or declaration audit. Only correctness groups with an extended-mode pattern literal in primary source use medium; other calls use low. Identical policy for both adapters. Same24paths,33calls,context,jobs8. Declared bounded screen480s/8m, still capped at3x freshly matched Opus; this larger safety bound avoids prematurely censoring the single medium call like earlier360s mixed-effort measurement. It cannot turn a >3x measurement into a pass.
+
+Selective-pattern-effort result: Opus161.31s/47findings; Grok451.39s/72findings (2.80x),33calls. The single medium call took318s and still missed extended-regex spaces. Grok covers11/14required roots, also missing weekend filtering and iOS Cancel. Extra reasoning at this granularity did not recover the target. No quality pass or full run.
+
+Next `screen-focused-all-context-fast-fixed` changes only Grok4.6 to4.7-build-fast from the best all-context low-effort control. Earlier fast-variant trials lacked the improved context/audit setup, or used large batches with poor recall. This tests the stronger variant with the best current shared setup and enough bounded time for all33calls. Same24paths,prompts,schema,loweffort,context,jobs8. Cap480s/8m and3x matched Opus. Actual fast-variant IDs and failures remain recorded; no change to production default.
+
+All-context fast-variant result: Opus129.44s/52findings; Grok timed out at388.41s against388.31s (3x matched), with clean cancellation. No complete Grok output or accepted quality score. Diagnostic calls retained.
+
+Fast-variant diagnostics: the completed correctness call correctly reports extended-regex spaces and the iOS call reports Cancel state. Those are observations from a failed run, not a quality score; the completed dashboard calls still miss the weekend preset gap. Next `screen-focused-all-context-fast-jobs16-fixed` changes only concurrency8->16, retaining the exact binary and shared inputs. The previous run had started all33calls and completed25at323s, leaving queued work before its388s limit. This tests whether additional parallelism makes the stronger variant practical. Same480s/8m safety cap, always3x freshly matched Opus.
+
+Prepared, not benchmarked: linked supporting-context retrieval replaces generic method-name overlap with explicit source references, named/qualified types, reverse filename references to callers, and up to three dependency steps. Templates contribute executable ERB/script references, not human headings: the old picker treated the heading Invoice as a reference to the unrelated Invoice model, feeding the private-method false claim. Synthetic tests reproduced missing receiver context and this heading mistake before the repair, and now pass along with byte-budget/primary-source checks. Dotfiles no longer all alias the literal dot. The pinned sample now includes AuditTrail for auth, preview callers for all invoice templates, and the actual public-method parent for Sutter. Same40KBsupport cap and unchanged24primary files/11groups. This is a private experimental overlay; no measured quality gain is claimed.
+
+Fast-variant jobs16 result: Opus124.25s/48findings; Grok303.04s/80findings (2.44x),33completed calls. First complete screen covering14/14required roots. Several false/mixed claims remain, including omitted audit redaction, a wrongly resolved private method, and a disproved alias example. Recall and timing pass alone do not establish quality; source FP adjudication and a complete full-repo pair are still required. No full run yet.
+
+Next `screen-focused-linked-context-fast-fixed` changes only supporting-context retrieval from the completed14/14 fast/jobs16 control. It uses the tested source-reference/type/caller graph, template-aware reference extraction, qualified Ruby type resolution and a bounded inheritance preference instead of incidental method-name overlap. Same24primary files,11groups/33calls,40KBsupport cap,prompts,audit,schema,model4.7-build-fast,loweffort and jobs16. Both adapters receive identical selected context. Declared480s/8m cap, further limited to3x matched Opus. The hypothesis is fewer false claims about omitted guards or wrongly resolved receiver methods while retaining recall.
+
+Mixed-claim accounting correction: an additional actual-script Saturday reproduction shows Same Day includes Saturday. B1-34 correctly identifies the preset gap (both weekend days on Friday; Sunday on Saturday), but its consequence overstates Saturday self-exclusion. Keep the real P2 root and count the false component separately, consistently with candidate claims. Reference remains83important roots and14sample roots; unique false roots108. This does not turn an earlier recall failure into a pass.
+
+Linked-context result: Opus107.64s/52findings; Grok249.69s/92findings (2.32x),33completed calls. Grok retains14/14required roots, and the earlier bank-redaction/private-Sutter-method/raw-date-injection false claims disappear. Other false claims remain, including misresolved inherited API authentication and a hypothetical truthy :expired caller despite the actual caller using == true. Larger raw count is not a quality improvement. No quality PASS or full run; per-claim FP adjudication remains necessary.
+
+Next `screen-focused-linked-verified-fast-fixed` adds one same-model verification stage to the completed linked-context14/14 control. False claims persisted after improving source context, so each model now checks its own draft against the identical original source, traces reachable callers and narrows mixed claims before publishing. No reference answers or other-model output enter prompts. Empty drafts need no second call; drafts with parser-skipped claims are still verified. Final audit/parse failures fail the run. Same24paths,primary packing,context,schema,model4.7-build-fast,loweffort and jobs16. All stages count in elapsed time; bounded screen600s/10m, further limited to3x freshly matched Opus. The larger safety bound accommodates the measured extra stage but cannot turn >3x into a pass. Focused tests cover both adapters, removing/retaining findings, empty drafts, invalid draft citations, final coverage failure and bounded source-plus-draft prompts; passed. No production promotion or full run yet.
+
+Mixed-claim audit correction: the actual MfaAuthentication concern sets both client_id and mfa_code cookies with the same ten-minute lifetime. A fixture loading that concern confirms that deleting only the code cookie permits nil==nil with a resolved identity, while waiting for both to expire leaves no login_object and is rejected. The important scheduler-MFA root remains; the original frozen claim's alternative expiry-only bypass is separately false. Reference remains83important roots/14sample roots; false roots109. Apply this distinction to finalist claims as well. This correction does not turn any failed candidate into a pass.
+
+Per-draft verification result: Opus226.35s/41final findings (33discovery+25verification calls); Grok378.64s/68final findings (33+28calls),1.67x. Shared discovery prompt hashes match exactly. Grok covers11/14required roots, missing browser ENV.fetch, weekend filtering and extended-regex spaces; those were already absent from its discovery drafts, so this trial does not establish that verification removed them. False claims remain, including a nonexistent truthy :expired caller and external e-badge URL, despite verification. Mixed factual errors are retained in the partial ledger; all remaining claims are unresolved. Reject on recall, no full run. The extra step is not promoted.
+
+Prepared next context repair from the faster completed14/14 linked-context control: resolve named types relative to Rails namespaces, honor explicit root ::, retain acronym directories, and retrieve actual consumers of named classes/modules. The current auth pack omitted LoginController and Api::V1::ApplicationController, directly causing false statements about login result checks and inherited authentication. Synthetic tests cover both distinctions and ensure context caching cannot change later prompts. The unchanged40KBsupport budget now includes both real callers/parents in the pinned auth group. This is source-derived retrieval, with no expected answers or path-specific exception. No extra model stage.
+
+Next `screen-focused-scoped-context-fast-fixed` tests that namespace/consumer context repair as the sole changed factor from `screen-focused-linked-context-fast-fixed`. It returns to33discovery calls without the unproven verification stage. Same24primary files,source groups,40KBsupport limit,instructions,audit,schema,Grok4.7-build-fast,sharedloweffort and jobs16. Declared480s/8m safety bound and Grok<=3x freshly matched Opus. Focused retrieval/audit tests and pinned auth-context checks pass; no measured quality improvement yet.
+
+Namespace/consumer context result: Opus75.93s/46findings; Grok timed out at227.90s against227.80s (3x matched Opus), with25of33calls complete and clean cancellation. No complete Grok output or accepted recall/FP score. Completed auth diagnostics no longer invent the truthy-expired caller or miss the inherited API guard. Slow calls are still provider reasoning: completed calls reach207–225seconds despite low effort, with thousands of reasoning tokens. Increasing jobs alone would not shorten those already-running calls, and would also tighten the matched Opus deadline. No full run.
+
+Next `screen-focused-small-batches-fast-fixed` changes preferred primary batch size20KB->10KB from the namespace-aware control. The longest completed Grok calls spend207–225seconds/21K–23Kreasoning tokens on groups containing several primary files, versus Opus under48seconds. Smaller primary groups test whether reducing the number of operations per call limits this reasoning cost and preserves recall. Whole files are retained when larger than the preference; the hard prompt budget120KB and support limit40KB remain. Same24paths,context selection,three passes,audit,schema,Grok4.7-build-fast,sharedloweffort,jobs16; no new review stage. Declared480s/8m safety bound, always capped at3x fresh matched Opus. Tests verify each frozen primary path appears exactly once in the source groups, along with scoped caller/parent retrieval and prompt bounds.
+
+Smaller-batch result: Opus206.96s/63findings; Grok429.22s/106findings (2.07x),48calls each. Grok covers12/14required roots, missing the weekend gap and iOS Cancel's unsaved-field/flag restoration (the different pending-check banner claim does not substitute). Many false claims remain. Dashboard/layout separation also loses the global keyup helper from the dashboard context, causing false Clear-button reports. Reject: more calls and longer absolute Grok time without sufficient quality. Opus startup/waiting varied substantially: some calls spent about100seconds outside the reported API duration; the ratio alone is not an optimization result. Aggregate host inspection showed substantial existing memory use from other processes, so high-concurrency full runs need capacity checks rather than assuming all128GB is free.
+
+Next `screen-focused-scoped-context-main-fixed` returns to the20KB namespace-aware control and changes only the Grok variant from4.7-build-fast to standard4.7. The earlier standard4.7 test used the old smaller sample without per-file audits/current caller context and stopped at180seconds, below its233second matched limit, so it did not establish impossibility. This tests the stronger standard variant with corrected source links and the current bounded protocol. Same24paths,33calls,three passes,audit,schema,sharedloweffort,jobs16 and480s/8m safety bound, further limited to3x freshly matched Opus. Model-ID and focused retrieval/audit tests pass. No API keys, tools, extra stages or production-default change.
+
+StandardGrok4.7 result: Opus146.92s/48findings; Grok438.81s/91findings (2.987x),33completed calls. It narrowly meets the paired time ceiling but covers13/14required roots, still missing the weekend preset gap. Multiple false/mixed claims remain, including Kaiser active-scope omission, unsupported fractional adjustments and treating literal ENV.fetch as ERB interpolation. Reject on recall; no quality PASS or full run. Standard4.7 offers no demonstrated improvement over the faster14/14 control.
+
+Next `screen-focused-split-correctness-fast-fixed` changes review-pass granularity from the20KB namespace-aware fast control. The existing correctness checklist is split into two independent passes: value/language semantics and state transitions; its substantive checks are unchanged. Security and reliability stay as before. Across completed runs the combined pass inconsistently recovers arithmetic/pattern/time issues and Cancel state, while reducing primary batch size lost global context. A separate focus tests that measured failure without shrinking source context or adding reference answers. This makes44calls over the same11groups instead of33. Both models use the identical four-pass procedure, per-file audit, source/context, schema, sharedloweffort and jobs16. ModelGrok4.7-build-fast. Declared480s/8m safety bound and Grok<=3x freshly matched Opus. Focused context/audit checks pass; no production promotion.
+
+Split-correctness result: Opus106.37s/68findings; Grok timed out at319.19s against319.10s (3x matched), with41of44calls complete and clean cancellation. No completed quality score or full run. A first-wave reliability call still took307seconds, so more focus alone did not remove the long reasoning tail.
+
+The supporting-context picker had two concrete ranking problems: a doubled inheritance preference exactly cancelled distance decay, allowing an ancestor to displace the actual receiver; and a file mentioning its own filename diluted the weight of its real callers. Synthetic regressions fail under the old picker and pass after stronger distance decay and excluding already-primary files from caller normalization. The actual dashboard context now includes Assignment::Interpretation, whose query was omitted while its ancestor was included. No target path or expected finding is special-cased in the implementation.
+
+Next `screen-focused-near-context-fast-fixed` tests that context-priority repair as the sole changed component from the four-pass control. Same24primary files,11groups/44calls,40KBsupport limit,120KBhard bound,existing check content,audit,schema,Grok4.7-build-fast,sharedloweffort and jobs16. Bound480s/8m and Grok<=3x fresh matched Opus. The hypothesis is fewer unsupported assumptions and less wasted reasoning when the actual receiver and callers outrank distant inherited code. Focused retrieval/audit tests pass. No production promotion.
+
+Near-context result: Opus194.10s/71findings; Grok393.01s/114findings (2.025x),44calls each. Grok covers13/14required roots, missing the gap across all three weekend presets; reporting the separate ignored-date query bug does not substitute. False claims remain, including attr_reader failing to read its instance variable, Rails before_action halting on false, and unreachable fractional Kaiser adjustments. No quality PASS or full run.
+
+Next `screen-focused-group-verified-fast-fixed` changes one stage from the near-context four-pass control: a same-model final verification per source group sees all four provisional passes together, checks claims and contradictions, and checks omissions. The earlier per-draft verifier could not compare independent passes and explicitly prohibited adding missing issues. This targets measured false claims and the missing condition-set gap, using only generic source-review procedures; no reference answers or other-model findings are supplied. Both models use the same procedure. Same24paths,11groups,44discovery+11final calls,source/context,model4.7-build-fast,loweffort,jobs16. Source-plus-drafts hard bound240KB; invalid or missing audit fails the run. Raw parser-skipped draft claims remain available to verification. Declared600s/10m safety bound, always capped at3x fresh matched Opus; all55calls and both stages count. Focused tests passed for both adapters, preservation of all raw drafts/source, supported retention, removal, omission recovery, invalid citations, empty drafts, malformed final audits and bounded inputs. No production promotion or full run.
+
+Group-verification result: Opus260.30s/36findings; Grok506.13s/58findings (1.94x),55calls each. Discovery prompt hashes match the previous near-context control. Grok covers13/14required roots: the weekend gap was already present in discovery and survives, but verification removes the real future-day-midnight defect. False language/API claims survive, including locale-sensitive default Swift uppercasing and successful iOS save despite errors in an HTTP200 body. Reject on recall; no quality PASS or full run. Opus final claims have33confirmed,1false and2unresolved UI-lifecycle claims; all unresolved claims still block a final quality verdict. An actual-source JavaScript fixture confirms the rejected response-body read escapes the API helpers and leaves calling UI state stuck.
+
+Next `screen-focused-wide-verified-fast-fixed` changes preferred primary batch size20KB->80KB from group-verification control. The current55-call sample is too costly to scale comfortably, and repeated passes still miss guards spread across source groups. Larger batches now retain per-file audits, corrected source-reference context and group verification, which the earlier wide fast-model trial lacked. This tests fewer calls plus more co-located source, with no new check or stage. All24frozen primary files appear exactly once in3source groups:12discovery+3verification calls instead of55. Same120KBdiscovery hard bound,40KBsupport cap,240KBsource-plus-drafts bound,Grok4.7-build-fast,sharedloweffort,jobs16 and600s/10m safety bound; Grok is always capped at3x fresh matched Opus. Context/audit/verification tests and exact sample coverage/bounds checks pass. No production promotion or full run.
+
+Wide-batch verification run: Opus failed at82.20s when the coverage validator found omitted primary-file audits; cleanup succeeded and Grok never started. The affected call returned only the first file audit and omitted five required files. No partial review is accepted. Next repair changes only audit representation from a free array to an object with each actual primary path required in the shared JSON schema. This is the same coverage procedure and source; the schema now enforces the expected membership rather than merely checking it after a model can forget entries.
+
+Next `screen-focused-wide-map-verified-fast-fixed` tests the required-path audit object repair. Same24primary paths,3source groups,12discovery+3verification calls,80KBpreferred/120KBhard primary prompts,40KBsupport,240KBverification bound,model4.7-build-fast,sharedloweffort,jobs16 and600s/10m screen cap, further limited to3x fresh matched Opus. Both adapters receive the same source-derived required keys; findings/page contract remains unchanged. Missing, extra, wrong or empty audits still fail closed; restarted complete JSON uses the existing parser. Focused audit/coverage/verification tests pass. No retry of the failed result, no partial publication, and no production promotion.
+
+Required-audit wide result: Opus111.90s/23findings; Grok timed out at335.79s against335.69s (3x matched), after all12discovery calls but only1of3verification calls completed. Cleanup succeeded. Exact audit keys fixed the coverage failure; the large group's236second discovery call plus verification still misses the elapsed bound. No accepted Grok quality score or full run.
+
+Source adjudication of the earlier linked-context14/14 result now establishes at least18unique false Grok roots, versus9proven false Opus roots. The Opus inventory covers all52published findings, with two SwiftUI lifecycle roots and one global Honeybadger-reporting component still unresolved; Grok's remaining claims are not treated as true. Several errors directly trace to omitted actual callers/guards, while others misstate language/runtime behavior. No quality PASS is claimed from its successful recall/time score. Ledgers and source evidence are retained.
+
+Prepared40KBmidpoint did not reach a model benchmark: its context preflight failed because named domain types crowded out the explicitly rendered shared table_search partial, despite layout and dashboard being primary files. Stop before measuring a known context regression. Explicit file/partial references currently have the same weight as inferred named-type links; the planned repair gives exact source references a bounded2x preference, still decaying with graph distance. To keep measured factors separate, test that priority change first against the existing80KBcontrol, then evaluate a smaller primary preference if needed.
+
+Exact-reference regression fails under the old picker (inferred type displaces the explicitly rendered helper) and passes with the2x exact-reference preference. The formerly failing40KBpinned-source preflight now passes, with every primary file once and the real shared table_search helper present. Existing context/audit/verification checks also pass.
+
+Next `screen-focused-wide-import-map-verified-fast-fixed` measures only that exact-reference priority repair against the80KBrequired-map control. Same24paths,3groups/15calls,allfourdiscoverychecks,same-modelverification,40KBsupport limit,120KBdiscovery/240KBverification bounds,Grok4.7-build-fast,sharedloweffort,jobs16,600s/10m cap further limited to3x fresh matched Opus. The40KBpacking change remains prepared but unmeasured, so its effects are not conflated with this retrieval repair. No production promotion or full run.
+
+The linked-context14/14 candidate now has a decisive false-positive rejection: the matched Opus inventory has9proven false roots and only3unresolved unique components, so its worst-case count is12. Grok already has18independently proven false roots. Resolving the remaining claims cannot make that candidate meet the no-more-false-positives criterion. This failure bound does not label unreviewed Grok claims true or pretend finalist adjudication is complete.
+
+Exact-reference80KB result: Opus123.1315s/23findings; Grok313.9569s/26findings (2.55x), all15calls complete. Grok recovers8/14required roots: CSRF, scheduler MFA, upload-after-save, both truncated subtotals, future midnight, browser ENV and inactive alias. It misses weekend presets, extended-regex spaces, iOS Cancel and all three repeated-preview subtotals. The future finding mixes a valid midnight predicate with an incorrect all-interactions consequence; multiple other false claims remain. Reject on recall; no full run.
+
+Next `screen-focused-medium-batch-map-verified-fast-fixed` changes only preferred primary batch size80KB->40KB from that completed control. Same exact-reference priority,40KBsupport,120KBdiscovery/240KBverification bounds,four discovery passes and one combined verification per group,required per-file audit map,Grok4.7-build-fast,sharedloweffort,jobs16. The fixed24paths form6groups/30calls; preflight checks all primaries once and the actual shared table-search helper. Rebuilt binary after the priority repair. Declared600s/10m safety bound, Grok additionally capped at3x freshly matched Opus. Smaller groups test the observed loss of findings in the large-batch control.
+
+The other earlier14/14 candidate (`screen-focused-all-context-fast-jobs16-fixed`,2.44x) also now fails the false-positive criterion: at least17proven unique false Grok roots versus8proven plus6unresolved Opus roots (worst-case14). All48Opus raw claims match its published count, with no unparsed calls or skipped findings. The remaining Grok claims stay unresolved; this is a decisive failure bound, not a completed positive adjudication. Both earlier14/14speed successes are now rejected on quality.
+
+40KBresult: Opus177.0164s/30findings; Grok319.0852s/48findings (1.80x),30calls each with identical discovery prompts. Grok recovers12/14required roots, missing weekend presets and extended-regex spaces. The weekend defect was present in a discovery draft and dropped in final verification; regex was not found in discovery. Invoice preview order and iOS Cancel recovered. False claims remain, including hypothetical clients treating HTTP200 as unconditional success and DateFormatter thread-unsafety. Reject on recall; no full run.
+
+Next `screen-focused-medium-verify-effort-fast-fixed` changes only final-verification effort low->medium, identically for both providers. Discovery stays low. Same40KBprimary batches,40KBsupport,four passes,required audit map and6combined verifications (30calls),Grok4.7-build-fast,jobs16,24frozenpaths. This tests the measured loss of a real draft and retained false semantics; final verification already checks omissions, without any benchmark answers supplied. Focused context/audit/verification tests plus a stage-to-CLI/environment effort agreement check pass. Declared600s/10m safety bound, Grok additionally capped at3x fresh matched Opus. No production default changes.
+
+Further source checking corrects one claim in the older all-context inventories: the Sutter empty preview fails in its controller before entering the template; a claimed empty-template failure is not reachable through that path or through the guarded production batch. The frozen controller-level empty-preview root remains real and unchanged. Conservative all-context false-positive bounds are now Grok>=18, Opus9proven+6unresolved<=15, still a rejection. A standalone macOS Foundation probe also confirms default DateFormatter.isLenient=false and rejects2024-02-31; explicit lenient=true accepts it. This corroborates the official Foundation implementation and refutes the default-leniency component in the recent Grok report; no iOS simulator was used.
+
+Medium-verification result: Opus115.1491s/23findings; Grok timed out at345.5452s against345.4474s (3x matched Opus), with clean cancellation. All24discovery calls completed, but only1of6verification calls finished (98seconds); the longest discovery took224seconds. No accepted complete Grok quality score. Captured arguments confirm low discovery and medium verification for both models.
+
+Next `screen-focused-medium-verify-effort-46-fixed` changes only the Grok variant to4.6. Earlier4.6low discovery was faster than4.7-build-fast, but was not tested with this exact caller context, four-pass split, required audit map or combined medium-effort verification. Same24paths,6groups/30calls,40KBprimary/40KBsupport budgets,sharedlow-discovery/medium-verification effort,jobs16,600s/10m safety and <=3x fresh matched Opus. The previous timeout stays a failure; this is not a repeat of the same candidate.
+
+Grok4.6medium-verification result: Opus110.0868s/26findings; Grok timed out at330.3753s against330.2603s (3x matched Opus), clean cancellation. All24discovery calls completed (longest99seconds), and5of6verification calls finished at147–220seconds, leaving the auth group incomplete. No complete quality score. The provider variant improved discovery time but did not meet the end-to-end ceiling.
+
+Prepared pipelined scheduling passes its race-enabled context/audit/verification and scheduling tests. A blocking regression demonstrates the old stage barrier cannot verify a finished group while another discovery is waiting; the new scheduler succeeds, never exceeds the shared job limit, retains draft/output order, and cancels unfinished work after failures or timeouts. This changes scheduling only; source prompts, schema, stage effort, group draft membership, model calls and final parser stay unchanged.
+
+Next `screen-focused-pipelined-verify-fast-fixed` measures that scheduler against the failed `screen-focused-medium-verify-effort-fast-fixed` control, returning toGrok4.7-build-fast. Ready verification work uses free shared slots before more discovery; there is no extra concurrency or added stage. Same24paths,6groups/30calls,40KBprimary/40KBsupport,low discovery and medium verification,jobs16,600s/10m safety and <=3x fresh matched Opus. The separate4.6trial remains recorded. This tests the observed idle slots before the all-discovery barrier released; no quality improvement is assumed from scheduling alone.
+
+The initial pipelined benchmark launch was not executed because the automatic approval service returned a401authentication error. On the next goal continuation, the normal approval path recovered and the same declared benchmark started. No sandbox bypass, credential change or alternate model access was used.
+
+Pipelined result: Opus114.0332s/25findings; Grok timed out at342.1903s against342.0995s (3x matched), with clean cancellation. All24discovery calls completed;2of6medium verifications completed,4were cancelled. Discovery prompt hashes match the barrier control. Verification began32.21seconds before the last Opus discovery ended, and108.86seconds before the last Grok discovery ended: overlap is real, but individual medium-effort calls still exceed the available end-to-end time. No complete Grok quality score and no production promotion.
+
+Next `screen-focused-decision-verified-fast-fixed` returns to the completed low-effort40KBcontrol (12/14roots,319.09seconds) and changes only the final-verification response contract. Every own-model draft finding gets a required decision ID; the model must retain, reject or deduplicate it with a source-based rationale. Retained/deduplicated claims must reference an actual final finding index; missing decisions, missing rationale and invalid indices fail the run. Discovery prompts, source/context, four passes, per-file audit, six combined verification calls, modelGrok4.7-build-fast, low effort throughout, jobs16 and30total calls stay unchanged. This addresses observed silent loss of the true weekend draft without adding a stage or injecting reference answers. The old validator accepts a final answer that accounts for none of its candidates; a regression now rejects it. Focused decision/schema/context/verification tests pass. Declared600s/10m safety and <=3x fresh matched Opus. The pipelined scheduler is kept separate from this quality test.
+
+Investigated Grok CLI shutdown overhead after finding its documented optional trace-upload drain. Existing captured stdout files are written directly by the live CLI, so their final modification time can be compared with capture start+elapsed. Across the completed low-effort40KBcontrol, pipelined run's completed calls, and current decision run's completed discovery, the median exit tail is about2.6seconds; observed largest tails are7.5,15.1and5.6seconds. The cancelled long calls had emitted no JSON. Thus a150second exit-drain budget is not the main observed delay. No telemetry or global settings were changed; diagnostic measurements are retained.
+
+
+Explicit-decision result: Opus147.8942s/27findings; Grok406.9520s/46findings (2.75x), all30calls complete. Grok covers10/14required roots, missing future midnight, weekend presets, extended-regex spaces and Sutter repeated preview subtotals. Required decision coverage prevents silent disappearance but does not make a rejection correct: Grok wrongly assumes the shared keyup handler always supersedes the initial date filter, and rejects the Sutter order defect because the actual preview controller is absent from its context. Multiple false claims remain. Reject on recall; no full model run or promotion.
+
+A model-free whole-repository preflight exercised the current decision prototype on all1346selected files, forming149source groups and745calls. Every primary source byte was verified, including reconstruction of the sliced SQL structure file; no model calls were made. The initial reconstruction check incorrectly used concurrent runner-start order and was corrected to use deterministic prompt-emission order. The repaired test passes. This establishes source coverage, not quality or acceptable full-run speed.
+
+
+Next `screen-focused-view-action-context-fast-fixed` returns to the completed40KB low-effort control (12/14roots,319.09seconds) and changes only supporting-source links for Rails views. An actual controller/concern definition of the view action now outranks incidental mentions of its filename. No target paths, source literals or expected findings are special-cased. A synthetic tight-budget regression fails before the change and passes after it; pinned-source preflight confirms the previously omitted Sutter preview controller is now present, all24primary files remain covered and existing context/audit/verification tests pass. Same6groups/30calls,four discovery passes,one group verification,required audit map,Grok4.7-build-fast,sharedloweffort,jobs16,40KBprimary/40KBsupport,120KBdiscovery/240KBverification bounds. Declared600s/10m safety and Grok<=3x fresh matched Opus. This trial does not include the additional per-candidate decision contract or pipelined scheduler.
+
+
+While the view-action trial runs, source inspection identifies another concrete context limit: its invoice-model group omits SutterHealthRateGuard (which performs the cleanup) and its Kaiser-template group omits the integer-converting BatchBuilder. Matched Opus consequently repeats both false claims. Prepared a separate supporting-context capacity experiment40KB->80KB, retaining the120KBtotal discovery bound,40KBprimary preference and same retrieval rules. A synthetic two-direct-dependency fixture fails at40KB and passes at80KB; pinned-source preflight confirms the Sutter cleanup guard is included and all existing context/audit/verification tests pass. Not yet benchmarked or promoted; the current view-action trial remains unchanged.
+
+
+Provider capability check: the logged-in Grok model cache still offers4.7,4.7-build-fast,4.6and4.5. Current [official reasoning documentation](https://docs.x.ai/developers/model-capabilities/text/reasoning) confirms reasoning cannot be disabled for these model families; low is the minimum. No unsupported effort value, authentication method or global configuration was changed. Current measured long calls generate tens of thousands of reasoning tokens even at low effort.
+
+
+View-action context result: Opus140.3275s/28findings; Grok timed out at421.0811s against420.9826s (3x matched Opus), with clean cancellation. Completed calls: {'discovery': 24, 'verification': 2}. The longest discovery took354.29seconds and generated30,788reasoning tokens on the13-file auth/invoice-model group. No completed Grok quality score or full run. The matched Opus inventory contains2proven false roots plus2unresolved components (upper bound4); all28raw final claims match the published count.
+
+Next `screen-focused-support-budget-fast-fixed` measures the prepared supporting-context capacity change against the view-action control:40KB->80KB, still bounded by120KBtotal discovery and240KBfinal input. Primary preference40KB,6groups/30calls,four discovery passes,one verification,required audit map,retrieval rules,Grok4.7-build-fast,sharedloweffort,jobs16 and24frozenpaths stay unchanged. The actual missing-rate cleanup guard is now present; no expected bug answers are added. The Kaiser builder remains absent from its template group because it is not reached by the current graph, so this is not claimed as a complete context repair. Focused tests pass. Declared600s/10m safety, Grok capped at3x fresh matched Opus.
+
+
+Prepared packing hardening separately from the live benchmark: source classification and bin admission now account for the required primary-target header. An empty file with an impossibly small header budget returns an error rather than silently disappearing. Both boundary regressions fail before the repair and pass afterward, with context/audit/verification and UTF-8 slicing checks. Model-free complete Run preflights on both versions verify all1346source files,149groups and745calls. Every generated prompt hash is identical on the pinned whole repository, proving the boundary repair does not alter this benchmark input. No model calls or production promotion were involved.
+
+
+Independent nil-association adjudication now confirms the older matched Opus Kaiser/Sutter deleted-department claims: root-admin deletion permits the soft deletion, assignment preview queries retain those assignments, and the actual templates crash at Kaiser line5/Sutter line214 when the scoped association is nil. The Nana address case is analogous via its unguarded root-admin address deletion and was reproduced at template line65. A fixture also reproduces a missing Kaiser routing-code crash, but that fixture alone does not settle its upstream reachability, so that older claim stays unresolved. Resolving the two department claims lowers the older all-context Opus false-positive upper bound from15to13 (9proven+4unresolved), strengthening its existing rejection against Grok>=18; it does not change the frozen required roots.
+
+
+Reference audit found an adjudication error in B1-245 (ignored invoice-stamp validation failure): the prior deleted-department trigger assumed required associations are always revalidated. hh uses Rails8.1 defaults, which disable that check for unchanged nonnil foreign keys. Executing the actual ActiveRecord8.1.3.1 validator condition confirms unchanged=false, changed=true, nil=true. B1-245 is now unresolved while an alternative reachable validation-failure trigger is investigated; its required root is retained provisionally, not dropped to let a candidate pass. The frozen set remains83required roots (82confirmed+1provisional), with no change to the14screen roots. Full quality PASS remains blocked by this unresolved reference claim. Evidence and the superseded reason are preserved.
+
+
+80KBsupport result: Opus180.2242s/25findings; Grok420.7579s/40findings (2.3346x), all30calls complete. Grok recovers12/14required roots, now including extended-regex spaces and all three repeated preview subtotals. It misses both future-midnight and weekend filtering; midnight was in discovery but dropped in verification, while the weekend root was not discovered. Known false claims include Rails before_action halting on false, hypothetical status-only clients, invoice CSRF-meta leakage and successful blank-bank submissions. Reject on recall; no full run or production promotion. Matched Opus has1proven false root plus4unresolved components after correcting an erroneous assumption that web pending-check Cancel behaves like Swift (the web version navigates away). All25raw Opus final claims match the published count.
+
+
+Next `screen-focused-runtime-notes-fast-fixed` changes only the shared system prompt from the completed80KBsupport control (12/14,420.76seconds). It adds2,599bytes of general Ruby, Rails8.1, JavaScript/jQuery3 and Swift/Foundation reference semantics, checked against primary language/framework documentation and local runtime probes. These contain no hh paths, business names, expected findings or model-produced answers. Same note goes to both providers at discovery and verification. This addresses observed false framework facts and incorrect initialization-order rejection. Source prompts, grouping,context,required audit schema,6groups/30calls,four discovery passes,one verification,Grok4.7-build-fast,sharedloweffort,jobs16 stay unchanged. Focused context/audit/verification tests pass; only model.go differs from the control. Declared600s/10m safety and Grok<=3x fresh matched Opus. The independent packing-boundary repair remains separate. References include [Ruby regex syntax](https://docs.ruby-lang.org/en/3.4/Regexp.html), [Rails callback termination](https://raw.githubusercontent.com/rails/rails/v8.1.3.1/actionpack/lib/abstract_controller/callbacks.rb), [jQuery3 ready scheduling](https://jquery.com/upgrade-guide/3.0/), [ECMAScript Date](https://tc39.es/ecma262/multipage/numbers-and-dates.html), and [Foundation DateFormatter](https://developer.apple.com/documentation/foundation/dateformatter).
+
+
+Runtime-reference result: Opus152.2060s/31findings; Grok447.0467s/42findings (2.9371x), all30calls complete with clean exit and pinned source unchanged. Grok covers13/14required roots: future midnight now survives verification, but weekend preset coverage is absent from all discovery passes and final output. False/mixed claims remain. Reject on recall; no full run or production promotion.
+
+Prepared next predicate-coverage trial changes only the values/language discovery instruction: enumerate small finite input domains and boundary representatives, compare related predicates together, and trace gaps/overlaps through actual callers to observable consequences. Both models currently note that the date offsets match the server query but do not check whether their combined visible subsets cover that query. The new instruction is generic and contains no repository paths, business facts, weekdays or expected findings. Runtime notes and all other settings remain the same.
+
+
+Predicate preflight initially detected a context change because the longer instruction also reduced the packer budget. Kept the existing reservation (which already exceeds every new per-pass prefix) and added the new text only after calculating it. The direct pack comparison passes. The first full model-free Run comparison incorrectly read Grok stdin instead of its prompt file and failed; that fixture is being corrected before any model benchmark. Existing context/audit/verification tests pass.
+
+Next `screen-focused-predicate-coverage-fast-fixed` measures that sole discovery-instruction change. Same24paths,6groups/30calls,four passes,one same-model verification,required audit map,40KBprimary/80KBsupport,shared runtime notes,Grok4.7-build-fast,low effort throughout,jobs16. Declared600s/10m safety bound, Grok capped at3x fresh matched Opus. No production promotion.
+
+Corrected model-free Run comparison passes:24discovery calls match the captured control byte-for-byte except six intended values-pass additions;6final calls and prompt bounds pass. Build exit0 (benign module stat-cache warning). The new benchmark is now ready to start.
+
+
+Resolved the global Honeybadger component in three older Opus ledgers: the local API catch is bypassed, but the absolute never-reported claim is false. The actual web entry configures Honeybadger with default unhandled-rejection capture; its installed6.16.3browser plugin reports the rejection. A no-network fixture uses the actual API source and installed browser bundle, dispatches the actual body-read error to the handler, and observes a notice with transport suppressed. It explicitly does not emulate native browser event scheduling. The underlying API/UI failure remains real. Moving one unique component from unresolved to false leaves each previous worst-case bound unchanged. [Honeybadger configuration](https://docs.honeybadger.io/lib/javascript/reference/configuration/) corroborates the default.
+
+
+Reference B1-245 is reconfirmed with a different reachable trigger, preserving all83required roots. Scheduler creation uses Assignment::Create, where visit_type is optional, and its accepted columns include billing status. A valid UCSF assignment with no visit_type can therefore persist and be selected as approved/unbilled. UcsfBatch reloads that row as Assignment::Ucsf, whose stricter visit_type validators fail during stamping. An executable fixture runs the pinned scalar validation declarations, actual ActiveRecord8.1.3.1 update/save validation, and actual HH stamping/record_run methods: update fails, ClientInvoice has already been recorded, and record_run returns normally; a valid-visit-type control stamps. Persistence/transactions are in-memory, with reachability traced separately through actual controller/query source. The earlier deleted-association trigger stays recorded as disproved. No required reference root was removed or softened.
+
+
+Predicate-coverage benchmark completed: Opus175.8631s/28findings; Grok410.2788s/41findings (2.3329x), all calls complete, clean exit and pinned source unchanged. Quality adjudication has not yet been completed; no PASS or full run claimed. User requested a candid status checkpoint after the long experiment loop. No benchmark is currently running.
diff --git a/docs/metareview/learning/grok-parity/goal.md b/docs/metareview/learning/grok-parity/goal.md
new file mode 100644
index 00000000..25925e2f
--- /dev/null
+++ b/docs/metareview/learning/grok-parity/goal.md
@@ -0,0 +1,143 @@
+# Grok quality and speed parity
+
+## Goal
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+as well as or better than Opus, in no more than three times Opus's elapsed time.
+Quality means finding at least the important real bugs Opus finds, with no more
+false positives. More reported findings alone is not an improvement.
+
+Keep one review interface and one shared review pipeline. Switching between
+Opus and Grok changes the provider/model adapter, not the review task. A GPT
+adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
+
+This is the active scope, superseding the earlier fixed lists of experiments.
+The agent owns measurement details and may keep testing new approaches and
+combinations until the acceptance criteria are met. Do not stop because the
+first list of ideas is exhausted. Never report success from partial evidence.
+
+## Scope and invariants
+
+- Work on `whole-repo-source-review`, starting at `6eba389`.
+- Review `/Users/ben/code/hh` at commit
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
+  Check its HEAD before and after each measurement and reject a run if it changes.
+- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
+  or changes to the user's global CLI configuration.
+- Preserve the existing command and findings/page contract. Source selection,
+  prompts, system instructions, output schema, review stages, validation, retry
+  policy, concurrency, and reporting are shared. Translate their settings to
+  provider-specific CLI flags in the adapters. Record unavoidable differences.
+- Both models get the same source, context, instructions, allowed tools, and
+  effort setting for a comparison. No model receives benchmark answers or
+  findings from the other model. Keep tools disabled for review calls.
+- Shared prompt, packing, scheduling, validation, and recovery improvements are
+  allowed. Supported Grok model variants may be explored, with the actual model
+  ID recorded. A recovery must produce a real review; never turn a failed call,
+  truncation, missing coverage, or malformed answer into an empty successful review.
+- Preserve cancellation and timeouts. Count all retries and review stages in
+  elapsed time. Do not introduce unbounded retries or silently omit source.
+- Leave diff review, its anchor gate, and its FSM semantics unchanged.
+- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
+- Local implementation, experiments, tests, and commits are authorized by this
+  goal. Do not push, open a PR, or publish anything as part of this work.
+
+## Evidence and acceptance
+
+Use the actual `source-review` command built from the measured source revision.
+Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
+Verify that directory is owned by the current user with mode `0700`, and use
+`umask 077` for benchmark artifacts containing private prompts or source excerpts.
+Record commands, build revision or diff hash, CLI versions, source commit,
+prompt hashes, settings, wall time, per-call time, failures, and output paths.
+Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
+evaluation ledger and summaries without committing the private `hh` source.
+
+1. Freeze one full-repo Opus run as the reference, before further experiments.
+   Use the earliest fresh baseline already recorded at the starting revision's
+   medium effort: `baseline-full-opus-1` (295.9862 seconds). Keep the other runs
+   as historical evidence, not additional mandatory discoveries. Verify this
+   run's real issues against the pinned source; raw finding counts are not scores.
+   Do not select a different reference because a candidate fails.
+2. Adjudicate every unique defect claim in the baseline and finalist outputs
+   against the pinned source and relevant callers, tests, or dependency contracts.
+   Record root-cause matches, evidence, actual impact/severity, and one of
+   confirmed, false-positive, or unresolved. Adjudication is independent of the
+   producing model and does not accept its explanation as proof. Deduplicate by
+   root cause, not line overlap. Unresolved claims prevent a quality PASS.
+3. Important means confirmed P0, P1, or P2 defects, classified by actual impact
+   rather than the producing model's label. The required reference contains
+   these defects from the single frozen Opus run. Do not expand it into a union
+   of discoveries across repeated Opus runs. Do not remove a real reference bug
+   to make a candidate pass; evidence-based corrections are recorded with reasons.
+4. A successful full-repo Grok review must find every important reference bug,
+   and may find additional real issues. Extra findings do not compensate for
+   missing a required bug. Count each root cause once. Report P3 defects and
+   advisories separately, and report additional verified discoveries from either
+   model without silently changing the frozen target.
+   Count unique false defect claims, including invalid citations skipped by the
+   parser, for each run. Grok's false-positive count must be no greater than
+   either the frozen reference's or the matched Opus run's. Incorrect factual
+   advisory claims also count as false
+   positives, so relabeling cannot hide them. Record duplicates separately.
+5. Validate a promising candidate with a complete, sequential Opus/Grok pair
+   using the same source, shared pipeline, settings, and concurrency. Neither
+   run may overlap another benchmark. Count startup, every review stage, retries,
+   and output generation in elapsed time. Grok must finish in at most 3x the
+   matched Opus time and 3x the frozen reference time. A full run is required
+   to demonstrate success; subset results and extrapolations cannot establish it.
+   Do not require a six-run batch or discovery-frequency accounting before the
+   first decisive comparison. Retain every failure and label changed candidates.
+6. Preserve Opus's usefulness: do not meet the ratio by slowing Opus or reducing
+   its review quality. Compare the final shared pipeline with the original
+   Opus reference as well. Three times its elapsed time is a ceiling, not the
+   optimization target: keep reducing time while preserving quality.
+   Re-establish a baseline only for demonstrated environment changes,
+   with the old and new measurements both retained.
+7. Tests appropriate to the changed code pass, changed packages retain 100%
+   statement coverage, `make cover` passes, and `git diff --check` passes.
+   Run the required artifact and task-done reviews, resolve blockers, and keep
+   durable review artifacts. Record what was actually tested.
+
+## Execution
+
+Review this revised goal and finish verifying the single frozen reference.
+Keep a fixed, representative subset for cheap screening, including verified
+reference bugs, difficult code, and the supporting context needed to distinguish
+real defects from false positives. Freeze its paths before the next experiment;
+do not shrink it to hide a failure or put expected findings in model prompts.
+
+State one hypothesis and change one factor per experiment. Reject candidates
+that miss required subset bugs, add false positives beyond the comparison, or
+remain clearly too slow. Only promising candidates advance to full-repo runs.
+Do not add more review stages or broaden the experiment plan without evidence
+that the added work addresses a measured failure.
+
+Before another full-repo benchmark, implement and verify an overall wall-clock
+deadline in the benchmark harness, separate from the existing per-call timeout.
+Cap a full Grok run at 3x the frozen Opus reference time (887.9586 seconds), or
+3x its matched Opus time if that is lower. On expiry, cancel all review subprocesses,
+retain diagnostic logs, and record the run as a timeout failure. Never publish
+partial coverage as a completed review or leave child model calls running.
+Use an explicit bounded screening deadline as well, recorded before each test.
+
+The next milestone is one full-repo scorecard: both elapsed times, verified real
+issues found, reference issues missed, and false positives. Keep improvements
+that preserve quality and reduce elapsed time. Do not repeat a known loss
+without a new reason it could improve the result.
+
+Update progress after each meaningful result. Continue autonomously through
+ordinary implementation choices. If external access prevents progress, record
+the exact failure. If the target remains unachieved, say so; an improvement,
+passing unit tests, or exhausted experiments is not completion.
+
+## User-approved measurement reset
+
+The original goal required one Grok run to reproduce the union of multiple
+Opus runs; an intermediate revision substituted three-run discovery frequencies.
+The user subsequently approved a simpler target: one frozen full-repo Opus
+reference, its verified important issues or more with no more false positives,
+and the fastest Grok run possible within the 3x ceiling. The user also approved
+cheap subset screening and a hard overall limit on full-repo Grok runs.
+These criteria supersede both earlier formulations. Preserve their review and
+experiment history; no earlier failed experiment is retroactively a success.
diff --git a/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
new file mode 100644
index 00000000..3af79310
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
@@ -0,0 +1,65 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Target: `metareview-grok-parity-goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+NEEDS_REVISION
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Branch, pinned checkout, CLI flags and verification seams checked. |
+| Completeness | NEEDS_REVISION | 1 | 0 | Final Opus discoveries must be mandatory reference additions. |
+| Scope and alignment | PASS | 0 | 0 | Work traces to user requirements. |
+| Architecture | PASS | 0 | 0 | Shared pipeline and adapter separation fit existing architecture. |
+| Intent preservation | PASS | 0 | 0 | Quality and speed criteria preserve user intent. |
+| Security | PASS | 0 | 0 | Owner-only benchmark storage advisory retained by staff filter. |
+| Testing-quality | NOT_APPLICABLE | 0 | 0 | Evaluation plan; no executable test changes. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No data migration or persisted format transition. |
+| Runtime-reliability | PASS | 0 | 0 | Bounded failures and complete source coverage required. |
+| Mechanical-precision | PASS | 0 | 0 | Contracts buildable; implementation choices delegated. |
+
+## Orchestrator Notes (not findings)
+
+Ten required lenses ran as independent subagents. One completeness blocker and one security advisory were returned. The sole advisory met the three gates and the separate staff filter retained it. No other advisories were raised. Fix and re-review the reference-membership wording before implementation.
+
+## Findings
+
+## Blocking Findings
+
+- goal-completeness-1 (P2, confidence 75): goal line 67 makes adding finalist Opus discoveries optional. Grok can pass while missing a confirmed important bug found by final Opus runs. Require all such findings in the reference. Source: Completeness subagent.
+
+## Advisory Findings
+
+- goal-security-1 (P2, confidence 75): use a current-user-owned benchmark directory with mode 0700 and umask 077 before storing private source prompts and excerpts. Uncommitted local files otherwise remain readable to other local users under the default 0755/0644 modes. Source: Security subagent. Staff filter: KEEP.
diff --git a/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
new file mode 100644
index 00000000..9e7f4ece
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Target: `metareview-grok-parity-goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Branch, pinned checkout, CLI flags and verification seams checked. |
+| Completeness | PASS | 0 | 0 | Mandatory inclusion of all confirmed important baseline and final Opus defects verified on re-review. |
+| Scope and alignment | PASS | 0 | 0 | Work traces to user requirements. |
+| Architecture | PASS | 0 | 0 | Shared pipeline and adapter separation fit existing architecture. |
+| Intent preservation | PASS | 0 | 0 | Quality and speed criteria preserve user intent. |
+| Security | PASS | 0 | 0 | Owner-only storage and umask077 verified on re-review; advisory resolved. |
+| Testing-quality | NOT_APPLICABLE | 0 | 0 | Evaluation plan; no executable test changes. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No data migration or persisted format transition. |
+| Runtime-reliability | PASS | 0 | 0 | Bounded failures and complete source coverage required. |
+| Mechanical-precision | PASS | 0 | 0 | Contracts buildable; implementation choices delegated. |
+
+## Orchestrator Notes (not findings)
+
+Completeness and Security independently re-reviewed both changes and returned PASS with zero blockers or remaining advisories. The other eight lens results are carried from the parent review of the otherwise unchanged goal. Parent blocker goal-completeness-1 and advisory goal-security-1 are resolved.
+
+Goal SHA256: `933c827a23aec1567c86299fbe01c68fec4aa686cb34dccdcfd110b3f69a17a1`.
+
+## Findings
+
+No open findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.
diff --git a/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
new file mode 100644
index 00000000..9835b79e
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Target: `metareview-grok-parity-goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
+
+Execution mode: `pending-parallel-subagents`
+
+Previous run: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Re-reviewed: counts executable, all thresholds 0–3; benchmark prerequisites verified. |
+| Completeness | PASS | 0 | 0 | Re-reviewed: every reference root retained, no extra-bug compensation, both Opus comparisons preserved. |
+| Scope and alignment | PASS | 0 | 0 | Re-reviewed: measurement fairness change remains within delegated parity goal. |
+| Architecture | PASS | 0 | 0 | Carried from parent; common pipeline and adapter contracts unchanged. |
+| Intent preservation | PASS | 0 | 0 | Re-reviewed: equal opportunities preserve empirical parity; no future-run guarantee claimed. |
+| Security | PASS | 0 | 0 | Carried from parent; access and private artifact controls unchanged. |
+| Testing-quality | PASS | 0 | 0 | Re-reviewed: per-root equal-size batches, source adjudication and inclusive timing are valid empirical criteria. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | Carried from parent; no persisted-format transition. |
+| Runtime-reliability | PASS | 0 | 0 | Carried from parent; complete coverage, bounded failures, no partial success unchanged. |
+| Mechanical-precision | PASS | 0 | 0 | Re-reviewed: per-root counts and inequalities unambiguous. |
+
+## Orchestrator Notes (not findings)
+
+Six affected lenses independently reviewed the entire amended artifact and returned PASS, zero blockers or advisories. Four unaffected results carry from the parent review. No advisory filter was needed because no lens raised an advisory. Criterion 4 changes one-run-vs-six-run union recall to equal three-run per-root discovery frequencies; every real reference bug remains mandatory and finalist Opus must preserve its initial frequency. No candidate has passed this revised protocol or the prior stricter protocol. Prior review logs preserve the original criterion history; the goal's Measurement correction records the rationale.
+
+Goal SHA256: `f6391dafbc24ab5739a39ccfccd8373bf3f32b3879178c6551b692435f1366e8`.
+
+## Findings
+
+No open findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.
diff --git a/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
new file mode 100644
index 00000000..33406151
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Target: `metareview-grok-parity-goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
+
+Execution mode: `pending-parallel-subagents`
+
+Previous run: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Frozen run, timing arithmetic, paths and prerequisites verified; overall deadline is required implementation work. |
+| Completeness | PASS | 0 | 0 | Single reference, adjudication, shared setup, fixed screens, deadlines and final evidence covered. |
+| Scope and alignment | PASS | 0 | 0 | Matches the user-approved single-reference reset. |
+| Architecture | PASS | 0 | 0 | Carried from parent; shared pipeline/adapter boundaries unchanged. |
+| Intent preservation | PASS | 0 | 0 | Latest user choices preserved; earlier multi-run criteria explicitly superseded. |
+| Security | PASS | 0 | 0 | Carried from parent; private artifact controls and access restrictions unchanged. |
+| Testing-quality | NOT_APPLICABLE | 0 | 0 | Measurement requirements reviewed; no test implementation in this artifact. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | Carried from parent; no persisted-format transition. |
+| Runtime-reliability | PASS | 0 | 0 | Complete coverage, bounded whole-run failure and child cancellation required. |
+| Mechanical-precision | PASS | 0 | 0 | Frozen reference and min(887.9586s, 3x matched Opus) deadline are implementable. |
+
+## Orchestrator Notes (not findings)
+
+Seven affected independent lenses reviewed the amended goal. Architecture, Security and Data-migration carry from the parent because those contracts are unchanged. No lens raised an advisory, so advisory filtering was unnecessary. This PASS covers the user-approved goal, not benchmark quality or unimplemented timeout handling.
+
+Goal SHA256: `4277d96632dcec8c959bcdaeeec56a8af247a506257e8bb36001e253dc2c7141`.
+
+## Findings
+
+No open findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.
diff --git a/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..3a8ca897
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
@@ -0,0 +1,75 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260927-145502217533000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md`
+
+Execution mode: `subagent-adjudicated`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Links, commit and timing statements match retained evidence. |
+| Completeness | PASS | 0 | 0 | Fixes, records, incomplete quality score and evidence location are identified. |
+| Scope and alignment | PASS | 0 | 0 | Cleanup only; no speed candidate promoted or success claimed. |
+| Architecture | PASS | 0 | 0 | Uses the established durable learning directory. |
+| Intent preservation | PASS | 0 | 0 | Quality/speed goal explicitly remains unachieved. |
+| Security | PASS | 0 | 0 | No credentials or private benchmark contents in the checkpoint. |
+| Testing-quality | PASS | 0 | 0 | Package coverage is distinguished from review quality. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No application data or schema changes. |
+| Runtime-reliability | PASS | 0 | 0 | No benchmark running; verification and acceptance limitations explicit. |
+| Mechanical-precision | NOT_APPLICABLE | 0 | 0 | Status checkpoint; no new implementation contract. |
+
+## Orchestrator Notes (not findings)
+
+Two independent read-only reviewers covered the ten artifact lenses in complementary groups.
+`cleanup_review_correctness` reviewed completeness, scope, intent, testing and mechanical precision;
+`cleanup_review_security` reviewed feasibility, architecture, security, migration and runtime reliability.
+The host checked their conclusions against the checkpoint and retained records. Zero blockers or advisories.
+This PASS covers the checkpoint document, not the unachieved Grok parity goal.
+
+The same reviewers reviewed `6eba389..6775da0` for correctness, testing, security and runtime reliability.
+Both reported PASS with zero findings. The host agrees after checking the exact diff and the passing
+source-review package tests (100% statement coverage). Full repository validation is recorded separately.
+
+## Findings
+
+No findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.
diff --git a/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md b/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md
new file mode 100644
index 00000000..6b4a27be
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md
@@ -0,0 +1,65 @@
+# metareview: task-done review
+
+Run ID: `mrv-20260927-150100835166000-task-done-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md`
+
+Execution mode: `deterministic-local`
+
+Gate effect: `gate`
+
+Previous run: `none`
+
+Covered paths: `["docs/ARCHITECTURE.md","docs/metareview/learning/grok-parity/README.md","internal/sourcereview/model.go","internal/sourcereview/model_test.go","internal/sourcereview/parse.go","internal/sourcereview/parse_test.go"]`
+
+## Verdict
+
+PASS_ADVISORY
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Notes |
+| --- | --- | ---: | --- |
+| code-quality-reviewer | PASS | 0 | No blocking findings. |
+| security-reviewer | PASS | 0 | No blocking findings. |
+| test-reviewer | PASS | 0 | No blocking findings. |
+| architecture-reviewer | PASS | 0 | No blocking findings. |
+
+## Blocking Findings
+
+No findings in this class.
+
+
+## Advisory Findings
+
+### mrvf-20260927-150100835166000-task-done-readme-075056c7-001: Adversarial review was in-session-emulated
+
+- Reviewer: adversarial-review-reviewer
+- Severity: low
+- Classification: advisory
+- Finding: The adjudicated review for this head was recorded as in-session-emulated (no independent subagents), which is weaker, non-independent evidence.
+- Expected: An independent subagent-adjudicated review where delegation is available.
+- Found: executionMode = in-session-emulated.
+- Recommendation: When subagents are available, prefer `metareview fsm --workflow review-loop` for an independent review.
+
+
+## Follow-up Findings
+
+No findings in this class.
+
+
+## Warnings
+
+No findings in this class.
+
+
+## Orchestrator Notes (not findings)
+
+Independent read-only reviews by cleanup_review_correctness and cleanup_review_security
+are recorded in mrv-20260927-145502217533000-artifact-readme-075056c7.md. Both found
+zero blockers or advisories. The host adjudicated those reviews in session and used the
+explicitly weaker marker because this checkpoint did not run an FSM review workflow.
+The automatic advisory is retained. This gate covers the cleanup and correctness fixes,
+not the unachieved Grok quality/speed goal.

From dc6b86b71216ef1b79f34d141a9b105c130424db Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sun, 27 Sep 2026 08:13:45 -0700
Subject: [PATCH 10/22] docs: bound Grok parity work without weakening accuracy

---
 ...36220000-artifact-goal-8af7bb93-context.md | 102 +++++++++
 .../metareview/learning/grok-parity/README.md |  10 +-
 docs/metareview/learning/grok-parity/goal.md  | 214 ++++++------------
 ...-150946036220000-artifact-goal-8af7bb93.md |  69 ++++++
 4 files changed, 252 insertions(+), 143 deletions(-)
 create mode 100644 docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md

diff --git a/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md b/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
new file mode 100644
index 00000000..81fc3a98
--- /dev/null
+++ b/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
@@ -0,0 +1,102 @@
+# metareview context: docs/metareview/learning/grok-parity/goal.md
+
+Run ID: `mrv-20260927-150946036220000-artifact-goal-8af7bb93`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `08ce3cf`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Required outcome
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
+time. A speedup with an accuracy loss is a failure. The goal remains unfinished
+until both conditions pass on a complete repository review.
+
+Keep one interface and one shared review pipeline. Switching models changes only
+the provider/model adapter. GPT evaluation is outside this goal.
+
+## Acceptance stays fixed
+
+- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
+  and its independently verified important bugs. Keep the pinned `hh` revision
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
+- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
+  cannot compensate for a miss. Do not change the reference to help a candidate
+  pass; record any evidence-based correction and its reason. Report P3 separately.
+- Grok must have no more unique false defect claims than either the frozen
+  reference or the fresh matched Opus run. Count false components of mixed claims,
+  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
+- A complete sequential Opus/Grok pair must use identical source, context, prompts,
+  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
+  never give either model benchmark answers or the other model's findings.
+- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
+  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
+  improve the ratio by slowing it or making its review less thorough.
+- Failed calls, truncation, missing coverage and timeouts are failures, never
+  successful empty reviews. Cancel descendants at the deadline. A sample result
+  cannot establish whole-repository success.
+
+## Bounded execution replaces the open-ended loop
+
+1. Start each batch by stating one hypothesis, its changed factor, the acceptance
+   check and a deadline. Reuse the existing evidence and fixed 24-file sample.
+2. A batch allows **one paired benchmark and at most 30 elapsed minutes**, including
+   implementation, analysis, testing and scoring. Automatic continuations do not
+   reset this budget. Do not start a run that cannot fit the remaining budget.
+3. Score the result before starting another experiment. Reject a candidate as soon
+   as a decisive quality or timing failure is proved; do not exhaustively adjudicate
+   an already rejected candidate. A candidate considered for PASS needs full
+   adjudication. Only a fully passing sample may advance to a full-repository pair
+   in a subsequent batch.
+4. At a decisive result or the batch deadline, cancel remaining benchmark processes
+   and report: elapsed times, required bugs found/missed, false claims (or explicit
+   unresolved bounds), verdict, and code kept or rejected. If scoring is incomplete,
+   say so. **Return to the user for direction before another batch.** Do not call
+   the overall goal complete merely because a batch ended.
+5. Commit verified changes at each checkpoint after the required tests and review
+   gates. Keep a clean worktree. Preserve rejected experiments outside the product
+   code; do not promote a candidate with worse accuracy. Push only on explicit
+   user instruction; do not open a PR or publish as part of this goal.
+
+## Immediate next batch
+
+Score the already completed `screen-focused-predicate-coverage-fast-fixed` run.
+**Make no new model calls in this batch.** It took Opus 175.8631 seconds and Grok
+410.2788 seconds; its quality is unfinished. Within 30 minutes, return a supported
+PASS/FAIL/INCOMPLETE sample verdict and a specific next recommendation.
+
+## Keep the work contained
+
+Use logged-in CLIs; do not add API keys, direct authenticated HTTP access or global
+configuration changes. Leave `hh`, diff-review/FSM semantics and GPT tuning alo
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index 9aba16f2..632d350e 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,8 +1,9 @@
 # Grok parity checkpoint
 
-The quality/speed goal is **not achieved**. No benchmark is running. The current
-work is cleanup and verification, following the user's request to stop the
-open-ended experiment loop.
+The quality/speed goal is **not achieved**. No benchmark is running. Cleanup is
+committed and full validation passed. The revised goal limits each future work
+batch to one paired benchmark and 30 minutes, followed by a user checkpoint.
+The next batch only scores the completed run; it makes no new model calls.
 
 Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
 shared effort/system-prompt handling, incomplete-response rejection, and valid
@@ -10,7 +11,8 @@ filenames containing double dots. It also adds tests and updates the architectur
 reference. The source-review package tests pass at 100% statement coverage.
 These are correctness fixes; no experimental speed candidate has been promoted.
 
-- [Goal](goal.md): preserved goal definition, originally at the repository root.
+- [Goal](goal.md): current acceptance criteria and bounded execution rules. The
+  previous definition remains in git history (`08ce3cf`).
 - [Experiment history](experiment-history.md): preserved detailed log, originally
   `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
 - The four historical goal reviews and context snapshots remain in the existing
diff --git a/docs/metareview/learning/grok-parity/goal.md b/docs/metareview/learning/grok-parity/goal.md
index 25925e2f..7998f03e 100644
--- a/docs/metareview/learning/grok-parity/goal.md
+++ b/docs/metareview/learning/grok-parity/goal.md
@@ -1,143 +1,79 @@
 # Grok quality and speed parity
 
-## Goal
+## Required outcome
 
 Make `metareview source-review --model grok` review the whole `hh` repository
-as well as or better than Opus, in no more than three times Opus's elapsed time.
-Quality means finding at least the important real bugs Opus finds, with no more
-false positives. More reported findings alone is not an improvement.
-
-Keep one review interface and one shared review pipeline. Switching between
-Opus and Grok changes the provider/model adapter, not the review task. A GPT
-adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
-
-This is the active scope, superseding the earlier fixed lists of experiments.
-The agent owns measurement details and may keep testing new approaches and
-combinations until the acceptance criteria are met. Do not stop because the
-first list of ideas is exhausted. Never report success from partial evidence.
-
-## Scope and invariants
-
-- Work on `whole-repo-source-review`, starting at `6eba389`.
-- Review `/Users/ben/code/hh` at commit
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
-  Check its HEAD before and after each measurement and reject a run if it changes.
-- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
-  or changes to the user's global CLI configuration.
-- Preserve the existing command and findings/page contract. Source selection,
-  prompts, system instructions, output schema, review stages, validation, retry
-  policy, concurrency, and reporting are shared. Translate their settings to
-  provider-specific CLI flags in the adapters. Record unavoidable differences.
-- Both models get the same source, context, instructions, allowed tools, and
-  effort setting for a comparison. No model receives benchmark answers or
-  findings from the other model. Keep tools disabled for review calls.
-- Shared prompt, packing, scheduling, validation, and recovery improvements are
-  allowed. Supported Grok model variants may be explored, with the actual model
-  ID recorded. A recovery must produce a real review; never turn a failed call,
-  truncation, missing coverage, or malformed answer into an empty successful review.
-- Preserve cancellation and timeouts. Count all retries and review stages in
-  elapsed time. Do not introduce unbounded retries or silently omit source.
-- Leave diff review, its anchor gate, and its FSM semantics unchanged.
-- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
-- Local implementation, experiments, tests, and commits are authorized by this
-  goal. Do not push, open a PR, or publish anything as part of this work.
-
-## Evidence and acceptance
-
-Use the actual `source-review` command built from the measured source revision.
-Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
-Verify that directory is owned by the current user with mode `0700`, and use
-`umask 077` for benchmark artifacts containing private prompts or source excerpts.
-Record commands, build revision or diff hash, CLI versions, source commit,
-prompt hashes, settings, wall time, per-call time, failures, and output paths.
-Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
-evaluation ledger and summaries without committing the private `hh` source.
-
-1. Freeze one full-repo Opus run as the reference, before further experiments.
-   Use the earliest fresh baseline already recorded at the starting revision's
-   medium effort: `baseline-full-opus-1` (295.9862 seconds). Keep the other runs
-   as historical evidence, not additional mandatory discoveries. Verify this
-   run's real issues against the pinned source; raw finding counts are not scores.
-   Do not select a different reference because a candidate fails.
-2. Adjudicate every unique defect claim in the baseline and finalist outputs
-   against the pinned source and relevant callers, tests, or dependency contracts.
-   Record root-cause matches, evidence, actual impact/severity, and one of
-   confirmed, false-positive, or unresolved. Adjudication is independent of the
-   producing model and does not accept its explanation as proof. Deduplicate by
-   root cause, not line overlap. Unresolved claims prevent a quality PASS.
-3. Important means confirmed P0, P1, or P2 defects, classified by actual impact
-   rather than the producing model's label. The required reference contains
-   these defects from the single frozen Opus run. Do not expand it into a union
-   of discoveries across repeated Opus runs. Do not remove a real reference bug
-   to make a candidate pass; evidence-based corrections are recorded with reasons.
-4. A successful full-repo Grok review must find every important reference bug,
-   and may find additional real issues. Extra findings do not compensate for
-   missing a required bug. Count each root cause once. Report P3 defects and
-   advisories separately, and report additional verified discoveries from either
-   model without silently changing the frozen target.
-   Count unique false defect claims, including invalid citations skipped by the
-   parser, for each run. Grok's false-positive count must be no greater than
-   either the frozen reference's or the matched Opus run's. Incorrect factual
-   advisory claims also count as false
-   positives, so relabeling cannot hide them. Record duplicates separately.
-5. Validate a promising candidate with a complete, sequential Opus/Grok pair
-   using the same source, shared pipeline, settings, and concurrency. Neither
-   run may overlap another benchmark. Count startup, every review stage, retries,
-   and output generation in elapsed time. Grok must finish in at most 3x the
-   matched Opus time and 3x the frozen reference time. A full run is required
-   to demonstrate success; subset results and extrapolations cannot establish it.
-   Do not require a six-run batch or discovery-frequency accounting before the
-   first decisive comparison. Retain every failure and label changed candidates.
-6. Preserve Opus's usefulness: do not meet the ratio by slowing Opus or reducing
-   its review quality. Compare the final shared pipeline with the original
-   Opus reference as well. Three times its elapsed time is a ceiling, not the
-   optimization target: keep reducing time while preserving quality.
-   Re-establish a baseline only for demonstrated environment changes,
-   with the old and new measurements both retained.
-7. Tests appropriate to the changed code pass, changed packages retain 100%
-   statement coverage, `make cover` passes, and `git diff --check` passes.
-   Run the required artifact and task-done reviews, resolve blockers, and keep
-   durable review artifacts. Record what was actually tested.
-
-## Execution
-
-Review this revised goal and finish verifying the single frozen reference.
-Keep a fixed, representative subset for cheap screening, including verified
-reference bugs, difficult code, and the supporting context needed to distinguish
-real defects from false positives. Freeze its paths before the next experiment;
-do not shrink it to hide a failure or put expected findings in model prompts.
-
-State one hypothesis and change one factor per experiment. Reject candidates
-that miss required subset bugs, add false positives beyond the comparison, or
-remain clearly too slow. Only promising candidates advance to full-repo runs.
-Do not add more review stages or broaden the experiment plan without evidence
-that the added work addresses a measured failure.
-
-Before another full-repo benchmark, implement and verify an overall wall-clock
-deadline in the benchmark harness, separate from the existing per-call timeout.
-Cap a full Grok run at 3x the frozen Opus reference time (887.9586 seconds), or
-3x its matched Opus time if that is lower. On expiry, cancel all review subprocesses,
-retain diagnostic logs, and record the run as a timeout failure. Never publish
-partial coverage as a completed review or leave child model calls running.
-Use an explicit bounded screening deadline as well, recorded before each test.
-
-The next milestone is one full-repo scorecard: both elapsed times, verified real
-issues found, reference issues missed, and false positives. Keep improvements
-that preserve quality and reduce elapsed time. Do not repeat a known loss
-without a new reason it could improve the result.
-
-Update progress after each meaningful result. Continue autonomously through
-ordinary implementation choices. If external access prevents progress, record
-the exact failure. If the target remains unachieved, say so; an improvement,
-passing unit tests, or exhausted experiments is not completion.
-
-## User-approved measurement reset
-
-The original goal required one Grok run to reproduce the union of multiple
-Opus runs; an intermediate revision substituted three-run discovery frequencies.
-The user subsequently approved a simpler target: one frozen full-repo Opus
-reference, its verified important issues or more with no more false positives,
-and the fastest Grok run possible within the 3x ceiling. The user also approved
-cheap subset screening and a hard overall limit on full-repo Grok runs.
-These criteria supersede both earlier formulations. Preserve their review and
-experiment history; no earlier failed experiment is retroactively a success.
+with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
+time. A speedup with an accuracy loss is a failure. The goal remains unfinished
+until both conditions pass on a complete repository review.
+
+Keep one interface and one shared review pipeline. Switching models changes only
+the provider/model adapter. GPT evaluation is outside this goal.
+
+## Acceptance stays fixed
+
+- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
+  and its independently verified important bugs. Keep the pinned `hh` revision
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
+- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
+  cannot compensate for a miss. Do not change the reference to help a candidate
+  pass; record any evidence-based correction and its reason. Report P3 separately.
+- Grok must have no more unique false defect claims than either the frozen
+  reference or the fresh matched Opus run. Count false components of mixed claims,
+  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
+- A complete sequential Opus/Grok pair must use identical source, context, prompts,
+  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
+  never give either model benchmark answers or the other model's findings.
+- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
+  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
+  improve the ratio by slowing it or making its review less thorough.
+- Failed calls, truncation, missing coverage and timeouts are failures, never
+  successful empty reviews. Cancel descendants at the deadline. A sample result
+  cannot establish whole-repository success.
+
+## Bounded execution replaces the open-ended loop
+
+1. Start each batch by stating one hypothesis, its changed factor, the acceptance
+   check and a deadline. Reuse the existing evidence and fixed 24-file sample.
+2. A batch allows **one paired benchmark and at most 30 elapsed minutes**, including
+   implementation, analysis, testing and scoring. Automatic continuations do not
+   reset this budget. Do not start a run that cannot fit the remaining budget.
+3. Score the result before starting another experiment. Reject a candidate as soon
+   as a decisive quality or timing failure is proved; do not exhaustively adjudicate
+   an already rejected candidate. A candidate considered for PASS needs full
+   adjudication. Only a fully passing sample may advance to a full-repository pair
+   in a subsequent batch.
+4. At a decisive result or the batch deadline, cancel remaining benchmark processes
+   and report: elapsed times, required bugs found/missed, false claims (or explicit
+   unresolved bounds), verdict, and code kept or rejected. If scoring is incomplete,
+   say so. **Return to the user for direction before another batch.** Do not call
+   the overall goal complete merely because a batch ended.
+5. Commit verified changes at each checkpoint after the required tests and review
+   gates. Keep a clean worktree. Preserve rejected experiments outside the product
+   code; do not promote a candidate with worse accuracy. Push only on explicit
+   user instruction; do not open a PR or publish as part of this goal.
+
+## Immediate next batch
+
+Score the already completed `screen-focused-predicate-coverage-fast-fixed` run.
+**Make no new model calls in this batch.** It took Opus 175.8631 seconds and Grok
+410.2788 seconds; its quality is unfinished. Within 30 minutes, return a supported
+PASS/FAIL/INCOMPLETE sample verdict and a specific next recommendation.
+
+## Keep the work contained
+
+Use logged-in CLIs; do not add API keys, direct authenticated HTTP access or global
+configuration changes. Leave `hh`, diff-review/FSM semantics and GPT tuning alone.
+Keep the existing GPT adapter compiling and tested.
+
+Keep private source, prompts, outputs and prototypes in the existing mode-0700
+`/tmp/metareview-grok-parity/` directory with umask 077. Retain commands, source and
+build hashes, settings, prompt hashes, timings, failures and scoring evidence.
+Use the existing README for a short current status and the existing experiment
+history for durable summaries; do not create another planning-document series.
+Required repository review records are retained in their established directories.
+
+Before accepting implementation changes, run appropriate tests, retain 100%
+coverage in changed packages, pass `make cover` and `git diff --check`, and satisfy
+the required artifact/task-done gates with zero blockers. Documentation-only edits
+need artifact review; do not rerun the full code suite without a relevant change.
diff --git a/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md b/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md
new file mode 100644
index 00000000..410962f9
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260927-150946036220000-artifact-goal-8af7bb93`
+
+Target: `docs/metareview/learning/grok-parity/goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md`
+
+Execution mode: `subagent-adjudicated`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings.
+
+## Completion Requirements
+
+All ten required lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blocking findings; no findings needed revision or an override.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Existing evidence supports the immediate scoring task; incomplete scoring has an explicit outcome. |
+| Completeness | PASS | 0 | 0 | Preserves important-bug recall, false-claim limits, complete-repository timing and failure handling. |
+| Scope and alignment | PASS | 0 | 0 | One pair and 30 elapsed minutes per batch; immediate task makes no new model calls. |
+| Architecture | PASS | 0 | 0 | Preserves the shared interface and pipeline, frozen reference and matched comparison. |
+| Intent preservation | PASS | 0 | 0 | Retains accuracy and 3x requirements, excludes GPT evaluation and leaves the goal unfinished. |
+| Security | PASS | 0 | 0 | Preserves CLI-only access, disabled tools, benchmark isolation and private artifact handling. |
+| Testing-quality | NOT_APPLICABLE | 0 | 0 | Documentation-only change; implementation validation requirements remain explicit. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
+| Runtime-reliability | PASS | 0 | 0 | Continuations share the deadline; cancellation includes descendants and failures cannot become empty successes. |
+| Mechanical-precision | PASS | 0 | 0 | Names the reference, next run, deadline formula, stopping conditions and zero-call restriction. |
+
+## Orchestrator Notes (not findings)
+
+`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. Both reviewed the documentation changes since `08ce3cf` without changing files or running benchmarks.
+
+The aggregate verdict follows those reviewer results. This review accepts the revised goal document and its README summary; it does not establish achievement of Grok quality or speed parity. `git diff --check` passed. No code tests were rerun for this documentation-only change.
+
+## Findings
+
+No findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.

From fbfcf4c2f482b3f0794200c47778886948a6b459 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sun, 27 Sep 2026 08:23:58 -0700
Subject: [PATCH 11/22] docs: make Grok parity decisions autonomous and finite

---
 ...21007000-artifact-goal-8af7bb93-context.md | 98 +++++++++++++++++++
 .../metareview/learning/grok-parity/README.md | 13 ++-
 docs/metareview/learning/grok-parity/goal.md  | 77 ++++++++++-----
 ...-152217521007000-artifact-goal-8af7bb93.md | 69 +++++++++++++
 4 files changed, 227 insertions(+), 30 deletions(-)
 create mode 100644 docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md

diff --git a/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md b/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
new file mode 100644
index 00000000..32ffb59e
--- /dev/null
+++ b/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
@@ -0,0 +1,98 @@
+# metareview context: docs/metareview/learning/grok-parity/goal.md
+
+Run ID: `mrv-20260927-152217521007000-artifact-goal-8af7bb93`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/goal.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `dc6b86b`
+
+## Artifact Excerpt
+
+```markdown
+# Grok quality and speed parity
+
+## Required outcome
+
+Make `metareview source-review --model grok` review the whole `hh` repository
+with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
+time. A speedup with an accuracy loss is a failure. The goal remains unfinished
+until both conditions pass on a complete repository review.
+
+Keep one interface and one shared review pipeline. Switching models changes only
+the provider/model adapter. GPT evaluation is outside this goal.
+
+## Acceptance stays fixed
+
+- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
+  and its independently verified important bugs. Keep the pinned `hh` revision
+  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
+- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
+  cannot compensate for a miss. Do not change the reference to help a candidate
+  pass; record any evidence-based correction and its reason. Report P3 separately.
+- Grok must have no more unique false defect claims than either the frozen
+  reference or the fresh matched Opus run. Count false components of mixed claims,
+  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
+- A complete sequential Opus/Grok pair must use identical source, context, prompts,
+  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
+  never give either model benchmark answers or the other model's findings.
+- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
+  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
+  improve the ratio by slowing it or making its review less thorough.
+- Failed calls, truncation, missing coverage and timeouts are failures, never
+  successful empty reviews. Cancel descendants at the deadline. A sample result
+  cannot establish whole-repository success.
+
+## Autonomous execution with a finite budget
+
+The agent chooses experiments and proceeds without asking the user to direct the
+work. Checkpoints are progress reports, not permission requests. These rules
+replace the previous requirement to return to the user after each batch.
+
+1. Score the existing completed run first, using the existing evidence. Until it
+   has a supported PASS or FAIL, make no new model calls. Reuse prior adjudications
+   when source and claim are unchanged; reopen them only for new contrary evidence.
+2. Before each experiment, record one observed failure, one proposed causal fix,
+   one changed factor and the measurable result that would justify keeping it.
+   Check the existing experiment history first. Do not repeat a rejected setup or
+   rerun a failed measurement hoping for a better random result. A repair needs a
+   new causal explanation and consumes another candidate slot.
+3. Allow at most **three new candidate configurations on the fixed 24-file sample**,
+   one sequential matched pair each, and **one full-repository matched pair** for
+   the first fully passing sample. Score each pair before choosing the next action.
+   Never exhaustively adjudicate an already decisive failure. Fully adjudicate a
+   candidate before PASS; unresolved quality is not progress or success.
+4. Keep the best measured candidate. Improvement requires a strict gain in required
+   root coverage, unique false-claim count or elapsed time, without worsening either
+   other measure, against the same fully scored sample control. An unresolved
+   comparison does not count. Stop after **two consecutive candidates without a
+   demonstrated improvement**. A failed full-repository pair ends this campaign;
+   a passing sample cannot substitute for it.
+5. The campaign has **two elapsed hours total**, including analysis, implementation,
+   model calls, scoring, tests, reviews and commits. Reserve the final 20 minutes
+   for cancellation, validation, saving work and reporting; do not start experiments
+   in that reserve. Begin the
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index 632d350e..ca50ffa3 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,9 +1,12 @@
 # Grok parity checkpoint
 
 The quality/speed goal is **not achieved**. No benchmark is running. Cleanup is
-committed and full validation passed. The revised goal limits each future work
-batch to one paired benchmark and 30 minutes, followed by a user checkpoint.
-The next batch only scores the completed run; it makes no new model calls.
+committed and full validation passed. The revised goal makes experiment decisions
+autonomous: score before advancing, reuse prior evidence, and stop after two
+consecutive non-improvements. Its campaign allows three new sample candidates,
+one full-repository pair and two hours total, including verification and commits.
+The campaign has not started. Its first action scores the existing completed run;
+no new model calls are allowed until that result has a supported verdict.
 
 Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
 shared effort/system-prompt handling, incomplete-response rejection, and valid
@@ -11,8 +14,8 @@ filenames containing double dots. It also adds tests and updates the architectur
 reference. The source-review package tests pass at 100% statement coverage.
 These are correctness fixes; no experimental speed candidate has been promoted.
 
-- [Goal](goal.md): current acceptance criteria and bounded execution rules. The
-  previous definition remains in git history (`08ce3cf`).
+- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
+  previous user-checkpoint definition remains in git history (`dc6b86b`).
 - [Experiment history](experiment-history.md): preserved detailed log, originally
   `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
 - The four historical goal reviews and context snapshots remain in the existing
diff --git a/docs/metareview/learning/grok-parity/goal.md b/docs/metareview/learning/grok-parity/goal.md
index 7998f03e..cd560c7a 100644
--- a/docs/metareview/learning/grok-parity/goal.md
+++ b/docs/metareview/learning/grok-parity/goal.md
@@ -31,34 +31,61 @@ the provider/model adapter. GPT evaluation is outside this goal.
   successful empty reviews. Cancel descendants at the deadline. A sample result
   cannot establish whole-repository success.
 
-## Bounded execution replaces the open-ended loop
+## Autonomous execution with a finite budget
 
-1. Start each batch by stating one hypothesis, its changed factor, the acceptance
-   check and a deadline. Reuse the existing evidence and fixed 24-file sample.
-2. A batch allows **one paired benchmark and at most 30 elapsed minutes**, including
-   implementation, analysis, testing and scoring. Automatic continuations do not
-   reset this budget. Do not start a run that cannot fit the remaining budget.
-3. Score the result before starting another experiment. Reject a candidate as soon
-   as a decisive quality or timing failure is proved; do not exhaustively adjudicate
-   an already rejected candidate. A candidate considered for PASS needs full
-   adjudication. Only a fully passing sample may advance to a full-repository pair
-   in a subsequent batch.
-4. At a decisive result or the batch deadline, cancel remaining benchmark processes
-   and report: elapsed times, required bugs found/missed, false claims (or explicit
-   unresolved bounds), verdict, and code kept or rejected. If scoring is incomplete,
-   say so. **Return to the user for direction before another batch.** Do not call
-   the overall goal complete merely because a batch ended.
-5. Commit verified changes at each checkpoint after the required tests and review
-   gates. Keep a clean worktree. Preserve rejected experiments outside the product
-   code; do not promote a candidate with worse accuracy. Push only on explicit
-   user instruction; do not open a PR or publish as part of this goal.
+The agent chooses experiments and proceeds without asking the user to direct the
+work. Checkpoints are progress reports, not permission requests. These rules
+replace the previous requirement to return to the user after each batch.
 
-## Immediate next batch
+1. Score the existing completed run first, using the existing evidence. Until it
+   has a supported PASS or FAIL, make no new model calls. Reuse prior adjudications
+   when source and claim are unchanged; reopen them only for new contrary evidence.
+2. Before each experiment, record one observed failure, one proposed causal fix,
+   one changed factor and the measurable result that would justify keeping it.
+   Check the existing experiment history first. Do not repeat a rejected setup or
+   rerun a failed measurement hoping for a better random result. A repair needs a
+   new causal explanation and consumes another candidate slot.
+3. Allow at most **three new candidate configurations on the fixed 24-file sample**,
+   one sequential matched pair each, and **one full-repository matched pair** for
+   the first fully passing sample. Score each pair before choosing the next action.
+   Never exhaustively adjudicate an already decisive failure. Fully adjudicate a
+   candidate before PASS; unresolved quality is not progress or success.
+4. Keep the best measured candidate. Improvement requires a strict gain in required
+   root coverage, unique false-claim count or elapsed time, without worsening either
+   other measure, against the same fully scored sample control. An unresolved
+   comparison does not count. Stop after **two consecutive candidates without a
+   demonstrated improvement**. A failed full-repository pair ends this campaign;
+   a passing sample cannot substitute for it.
+5. The campaign has **two elapsed hours total**, including analysis, implementation,
+   model calls, scoring, tests, reviews and commits. Reserve the final 20 minutes
+   for cancellation, validation, saving work and reporting; do not start experiments
+   in that reserve. Begin the clock before scoring the existing run. Persist the
+   absolute deadline, candidate count, non-improvement count, current action and
+   verdict in the existing private `latest-handoff.json`. Continuations, restarts,
+   renamed experiments and summaries never reset the limits. Check them before
+   each continuation and launch; missing state means no launch until recovered.
+   Give each benchmark process group an enforced timeout no greater than the
+   remaining experiment budget or its existing acceptance timeout. Do not start
+   work that cannot fit. At the deadline cancel remaining benchmark descendants.
+6. Report each decisive result briefly and continue autonomously within those
+   limits. Save verified changes in small commits after their required checks;
+   update the existing README instead of creating more planning documents. Keep
+   rejected prototypes outside product code. At success or a stopping limit,
+   report timings, required bugs found/missed, false claims or unresolved bounds,
+   and changes kept/rejected. Unfinished work remains explicitly unfinished; budget
+   exhaustion is not proof that parity is impossible. Do not restart the campaign
+   automatically or weaken acceptance to obtain a pass.
 
-Score the already completed `screen-focused-predicate-coverage-fast-fixed` run.
-**Make no new model calls in this batch.** It took Opus 175.8631 seconds and Grok
-410.2788 seconds; its quality is unfinished. Within 30 minutes, return a supported
-PASS/FAIL/INCOMPLETE sample verdict and a specific next recommendation.
+Push only on explicit user instruction; do not open a PR or publish as part of
+this goal. The user does not need to choose implementation details or experiments.
+
+## Immediate next action
+
+Score `screen-focused-predicate-coverage-fast-fixed` before launching anything.
+It took Opus 175.8631 seconds and Grok 410.2788 seconds; its quality is unfinished.
+Reject it as soon as a decisive failure is established. Otherwise finish its
+quality score, then choose the next action under the rules above without a user
+checkpoint. The campaign clock starts with this scoring work, not with goal editing.
 
 ## Keep the work contained
 
diff --git a/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md b/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md
new file mode 100644
index 00000000..499f07ba
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260927-152217521007000-artifact-goal-8af7bb93`
+
+Target: `docs/metareview/learning/grok-parity/goal.md`
+
+Context pack: `docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md`
+
+Execution mode: `subagent-adjudicated`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings.
+
+## Completion Requirements
+
+All ten lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blocking findings and no advisories.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Existing evidence and handoff support scoring first; unfinished work is an explicit outcome. |
+| Completeness | PASS | 0 | 0 | Preserves acceptance; defines candidate, elapsed-time and non-improvement limits. |
+| Scope and alignment | PASS | 0 | 0 | Scores prior output first, bounds new work and prohibits automatic campaign restarts. |
+| Architecture | PASS | 0 | 0 | Preserves shared interface/pipeline and requires causal experiments against fixed controls. |
+| Intent preservation | PASS | 0 | 0 | Agent decides without user checkpoints; exhausted budget cannot count as success. |
+| Security | PASS | 0 | 0 | Retains private artifacts, CLI-only access and existing publication restrictions. |
+| Testing-quality | NOT_APPLICABLE | 0 | 0 | Documentation-only revision; implementation validation requirements remain unchanged. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
+| Runtime-reliability | PASS | 0 | 0 | Persists deadlines and counters; missing state blocks launch; timeouts cancel benchmark groups. |
+| Mechanical-precision | PASS | 0 | 0 | Defines clock start, accounting, advancement and stopping rules across continuations. |
+
+## Orchestrator Notes (not findings)
+
+`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. Both reviewed the documentation changes since `dc6b86b` without edits or benchmark calls.
+
+The aggregate verdict follows both reviewer results. This accepts the goal revision and README summary, not Grok parity or an implemented experiment-budget guard. No campaign was started. `git diff --check` passed; code tests were not rerun for documentation-only changes.
+
+## Findings
+
+No findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.

From a4701dab7a60ae438e9d4f039c2d012e830e5b21 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Tue, 29 Sep 2026 07:26:34 -0700
Subject: [PATCH 12/22] docs: record bounded Grok campaign failures and stop

---
 ...138000-artifact-readme-075056c7-context.md | 83 +++++++++++++++++++
 .../metareview/learning/grok-parity/README.md | 36 +++++---
 .../grok-parity/experiment-history.md         | 48 +++++++++++
 ...42351964138000-artifact-readme-075056c7.md | 69 +++++++++++++++
 4 files changed, 225 insertions(+), 11 deletions(-)
 create mode 100644 docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..0cc90075
--- /dev/null
+++ b/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
@@ -0,0 +1,83 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260929-142351964138000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `fbfcf4c`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. The September 29 campaign stopped after
+two consecutive non-improvements, as required by the revised goal. No benchmark is
+running and no experimental speed change was promoted. The private harness now
+checks persisted deadlines and attempt limits before each provider launch; its
+stopped campaign state refuses further launches.
+
+| Sample | Opus | Grok | Required bugs found | Verdict |
+| --- | ---: | ---: | --- | --- |
+| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
+| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
+| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
+
+Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
+and inactive-alias lookup bugs. Their false-claim totals remain unscored because
+the recall failures already reject them. No full-repository run was attempted.
+These results do not establish that parity is impossible; they end this bounded
+campaign without relaxing accuracy or automatically starting another campaign.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
+  previous user-checkpoint definition remains in git history (`dc6b86b`).
+- [Experiment history](experiment-history.md): preserved detailed log, originally
+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
+- The four historical goal reviews and context snapshots remain in the existing
+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
+  the goal, not completion of the implementation or successful benchmark quality.
+
+All three rows use the same fixed 24 primary files. The two new candidates retain
+the control's discovery prompts byte for byte; the first changes only what draft
+data verification receives, and the second changes only the Grok model variant.
+Both successful candidate-2 runs completed 30 calls, retained the pinned source
+revision and cleaned up successfully. Experimental preflight tests passed; the
+first candidate's new audit-isolation regression failed before the change and
+passed afterward. Seven harness guard cases passed. The earlier full code-suite
+validation applies to the committed correctness fixes, not to these prototypes.
+
+Private benchmark inputs, raw outputs, prototypes and harnesses remain under
+`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
+Nothing from this cleanup has been pushed or published.
+
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index ca50ffa3..7d81fb4d 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,12 +1,22 @@
 # Grok parity checkpoint
 
-The quality/speed goal is **not achieved**. No benchmark is running. Cleanup is
-committed and full validation passed. The revised goal makes experiment decisions
-autonomous: score before advancing, reuse prior evidence, and stop after two
-consecutive non-improvements. Its campaign allows three new sample candidates,
-one full-repository pair and two hours total, including verification and commits.
-The campaign has not started. Its first action scores the existing completed run;
-no new model calls are allowed until that result has a supported verdict.
+The quality/speed goal is **not achieved**. The September 29 campaign stopped after
+two consecutive non-improvements, as required by the revised goal. No benchmark is
+running and no experimental speed change was promoted. The private harness now
+checks persisted deadlines and attempt limits before each provider launch; its
+stopped campaign state refuses further launches.
+
+| Sample | Opus | Grok | Required bugs found | Verdict |
+| --- | ---: | ---: | --- | --- |
+| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
+| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
+| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
+
+Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
+and inactive-alias lookup bugs. Their false-claim totals remain unscored because
+the recall failures already reject them. No full-repository run was attempted.
+These results do not establish that parity is impossible; they end this bounded
+campaign without relaxing accuracy or automatically starting another campaign.
 
 Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
 shared effort/system-prompt handling, incomplete-response rejection, and valid
@@ -22,10 +32,14 @@ These are correctness fixes; no experimental speed candidate has been promoted.
   `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
   the goal, not completion of the implementation or successful benchmark quality.
 
-Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
-24 fixed primary files. Its quality score is unfinished. The previous fully
-scored sample covered 13/14 required roots and retained false claims.
-A successful whole-repository comparison has not been demonstrated.
+All three rows use the same fixed 24 primary files. The two new candidates retain
+the control's discovery prompts byte for byte; the first changes only what draft
+data verification receives, and the second changes only the Grok model variant.
+Both successful candidate-2 runs completed 30 calls, retained the pinned source
+revision and cleaned up successfully. Experimental preflight tests passed; the
+first candidate's new audit-isolation regression failed before the change and
+passed afterward. Seven harness guard cases passed. The earlier full code-suite
+validation applies to the committed correctness fixes, not to these prototypes.
 
 Private benchmark inputs, raw outputs, prototypes and harnesses remain under
 `/tmp/metareview-grok-parity/`; they have not been copied into this repository.
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
index 9ab01ec3..979dd693 100644
--- a/docs/metareview/learning/grok-parity/experiment-history.md
+++ b/docs/metareview/learning/grok-parity/experiment-history.md
@@ -394,3 +394,51 @@ Reference B1-245 is reconfirmed with a different reachable trigger, preserving a
 
 
 Predicate-coverage benchmark completed: Opus175.8631s/28findings; Grok410.2788s/41findings (2.3329x), all calls complete, clean exit and pinned source unchanged. Quality adjudication has not yet been completed; no PASS or full run claimed. User requested a candid status checkpoint after the long experiment loop. No benchmark is currently running.
+
+
+## September 29 bounded autonomous campaign
+
+The campaign began at 13:59:36 UTC with an absolute experiment deadline of
+15:39:36 UTC and total deadline of 15:59:36 UTC. The existing private handoff
+records these limits and counters across continuations. The existing run harness
+now refuses an unregistered candidate, missing state, an expired deadline, an
+exhausted attempt limit or a stopped campaign before invoking a provider. Its
+process-group timeout is capped by the remaining experiment budget. Seven guard
+cases passed without model calls.
+
+Scored the previously completed `screen-focused-predicate-coverage-fast-fixed`:
+Opus 175.8631s, Grok 410.2788s (2.3329x), **11/14 required roots**. The final
+findings omit the weekend preset gap, extended-regex whitespace and inactive-alias
+nil dereference. The department/town nil lookup is a different path and does not
+cover the alias defect. Reused the existing source-backed reference adjudications;
+no reference acceptance was changed. Reject on recall without completing an
+unnecessary false-positive inventory. Its scorecard remains private.
+
+Candidate 1, `screen-focused-findings-only-fast-fixed`, changes only the final
+verification payload: retain every raw draft finding and source line, but discard
+the draft audit narratives. This tests false assurances in those narratives being
+repeated by verification. A regression reproduced that forwarding before the
+change; isolation, context, audit and verification preflights pass after it. All
+24 discovery prompts match the prior control byte for byte. Opus finished in
+121.6276s with 25 findings. Grok hit its 364.8829s deadline and stopped in 364.9931s;
+all 24 discovery calls completed, six verification calls started and none completed.
+Cleanup succeeded. No final Grok review exists, so no quality score is accepted.
+This is the first non-improvement; nothing is promoted.
+
+Candidate 2, `screen-focused-findings-only-46-fixed`, changes only the Grok model
+from 4.7-build-fast to 4.6. Earlier evidence showed faster 4.6 discovery, but its
+medium-verification experiment timed out and lacked the current runtime notes.
+Both providers retain the same source, context, prompts, audit schema, tools,
+low effort, concurrency and review stages. Preflights pass. Opus finished in
+118.6537s with 26 findings; Grok finished in 257.1117s with 48 findings (2.1669x).
+All 30 calls completed for each model; source remained pinned and cleanup succeeded.
+The final Grok findings cover **11/14 required roots**, missing the same three as
+the existing predicate result. Reject on recall; false and mixed claims remain
+unresolved and no false-positive total is asserted.
+
+At 14:22:41 UTC the two consecutive non-improvements ended the campaign. The
+persisted state is `STOPPED_NO_IMPROVEMENT`; the harness refuses another launch.
+No third candidate or full-repository model run was launched, and no experimental
+speed change entered product code. Raw results, prototypes, scorecards and the
+harness stay in the existing private artifact directory. The whole-repository
+quality/speed goal remains unfinished.
diff --git a/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..e55bce82
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md
@@ -0,0 +1,69 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260929-142351964138000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md`
+
+Execution mode: `subagent-adjudicated`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings.
+
+## Completion Requirements
+
+All ten required lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blockers.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Saved results support the timings, call counts and recall scores. |
+| Completeness | PASS | 0 | 0 | Records required-root misses, unresolved false claims and incomplete timed-out review. |
+| Scope and alignment | PASS | 0 | 0 | Two candidates, no full-repository attempt, no prototype promotion and persisted stop state. |
+| Architecture | PASS | 0 | 0 | Separates private experiments from product correctness fixes; preserves whole-repository acceptance. |
+| Intent preservation | PASS | 0 | 0 | Stops without reducing accuracy requirements, claiming parity or declaring impossibility. |
+| Security | PASS | 0 | 0 | Private artifacts remain owner-only; no credentials or private source are disclosed. |
+| Testing-quality | PASS | 0 | 0 | Separates prototype checks, prior product validation and benchmark outcomes. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
+| Runtime-reliability | PASS | 0 | 0 | Persisted state/counters/deadlines gate launches; stopped campaign refuses further work. |
+| Mechanical-precision | PASS | 0 | 0 | Result metadata and prompt hashes support the stated scope, settings and outcomes. |
+
+## Orchestrator Notes (not findings)
+
+`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. They reviewed the README changes and appended September 29 experiment-history section since `fbfcf4c`, using private scorecards, provider results, prompt hashes and the run harness as evidence. Neither changed files or ran model benchmarks.
+
+The aggregate verdict follows both reviewer results. This accepts the campaign report, not achievement of Grok parity. All rejected or incomplete claims retain their stated uncertainty. The actual stopped-campaign launch refusal was verified without creating a model run. `git diff --check` passed; product source remains unchanged since `6775da0`, so its full suite was not rerun for this documentation-only checkpoint.
+
+## Findings
+
+None.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.

From 12c1d09f6c4ea348585a19992dc4c84c249ab480 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Tue, 29 Sep 2026 10:58:59 -0700
Subject: [PATCH 13/22] docs: record isolated verification and smaller-context
 diagnostics

---
 ...801000-artifact-readme-075056c7-context.md | 97 +++++++++++++++++++
 .../metareview/learning/grok-parity/README.md | 25 ++++-
 .../grok-parity/experiment-history.md         | 34 +++++++
 ...75656945801000-artifact-readme-075056c7.md | 65 +++++++++++++
 4 files changed, 217 insertions(+), 4 deletions(-)
 create mode 100644 docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..2bfee179
--- /dev/null
+++ b/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
@@ -0,0 +1,97 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260929-175656945801000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `a4701da`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. The September 29 campaign stopped after
+two consecutive non-improvements. The user then authorized two targeted diagnostics:
+verify findings individually and try smaller discovery contexts. Those tests are
+also finished; neither qualifies for promotion. No benchmark is running and product
+code is unchanged. The private harness refuses further launches in its stopped state.
+
+- Individual verification kept the inactive-alias crash that Grok's combined checker
+  had dropped. However, it retained questionable claims and left one candidate
+  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
+  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
+- Smaller discovery prompts retained the existing instructions and selected source
+  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
+  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
+  claimed no text-filter handler exists; the reduced context omitted its implementation.
+  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
+
+These are diagnostic stage timings, not complete-review speed measurements. The
+regex miss remains untested by a completed smaller-context Grok response. Restoring
+one true finding does not establish accuracy parity; no complete sample or full
+repository run was launched in this follow-up.
+
+The earlier fixed-sample campaign remains recorded below:
+
+| Sample | Opus | Grok | Required bugs found | Verdict |
+| --- | ---: | ---: | --- | --- |
+| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
+| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
+| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
+
+Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
+and inactive-alias lookup bugs. Their false-claim totals remain unscored because
+the recall failures already reject them. No full-repository run was attempted.
+These results do not establish that parity is impossible; they end this bounded
+campaign without relaxing accuracy or automatically starting another campaign.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
+  previous user-checkpoint definition remains in git history (`dc6b86b`).
+- [Experiment history](experiment-history.md): preserved detailed log, originally
+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
+- The four historical goal reviews and context snapshots remain in the existing
+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
+  the goal, not completion of the implementation or successful benchmark quality.
+
+All three rows use the same fixed 24 primary files. The two new candidates retain
+the control's discovery prompts byte for byte; the first changes only what draft
+data verification receives, and the second changes only the Grok model variant.
+Both successful candidate-2 runs completed 30 calls, retained the pinned source
+revision and cleaned up successfully. Experimental preflight tests passed; the
+first candidate's new audit-isolation regression failed before the change and
+passed afterward. Seven harness guard cases passed. The earlier full code-suite
+validation applies to the committed correctness fixes, not to these prototypes.
+
+Private benchmark input
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index 7d81fb4d..f76a991a 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,10 +1,27 @@
 # Grok parity checkpoint
 
 The quality/speed goal is **not achieved**. The September 29 campaign stopped after
-two consecutive non-improvements, as required by the revised goal. No benchmark is
-running and no experimental speed change was promoted. The private harness now
-checks persisted deadlines and attempt limits before each provider launch; its
-stopped campaign state refuses further launches.
+two consecutive non-improvements. The user then authorized two targeted diagnostics:
+verify findings individually and try smaller discovery contexts. Those tests are
+also finished; neither qualifies for promotion. No benchmark is running and product
+code is unchanged. The private harness refuses further launches in its stopped state.
+
+- Individual verification kept the inactive-alias crash that Grok's combined checker
+  had dropped. However, it retained questionable claims and left one candidate
+  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
+  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
+- Smaller discovery prompts retained the existing instructions and selected source
+  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
+  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
+  claimed no text-filter handler exists; the reduced context omitted its implementation.
+  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
+
+These are diagnostic stage timings, not complete-review speed measurements. The
+regex miss remains untested by a completed smaller-context Grok response. Restoring
+one true finding does not establish accuracy parity; no complete sample or full
+repository run was launched in this follow-up.
+
+The earlier fixed-sample campaign remains recorded below:
 
 | Sample | Opus | Grok | Required bugs found | Verdict |
 | --- | ---: | ---: | --- | --- |
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
index 979dd693..3664b91c 100644
--- a/docs/metareview/learning/grok-parity/experiment-history.md
+++ b/docs/metareview/learning/grok-parity/experiment-history.md
@@ -442,3 +442,37 @@ No third candidate or full-repository model run was launched, and no experimenta
 speed change entered product code. Raw results, prototypes, scorecards and the
 harness stay in the existing private artifact directory. The whole-repository
 quality/speed goal remains unfinished.
+
+## September 29 user-authorized accuracy diagnostics
+
+After the prior campaign stopped, the user explicitly authorized testing isolated
+verification and smaller discovery contexts. A separate bounded diagnostic record
+preserves the old campaign; no acceptance criterion changed. Product code stayed
+unchanged and all private inputs and prototypes stayed outside the repository.
+
+`isolated-claim-diagnostic` replayed each provider's own saved reliability findings
+from the problematic source group: five Opus and seven Grok candidates, each judged
+separately against the original source context. Both used the same system prompt,
+decision schema, low effort, disabled tools and eight-worker limit. Code assembles
+accepted findings; an unresolved decision prevents a successful report. All twelve
+calls completed. Opus took 47.7650s; Grok took 45.1729s. Grok retained the verified
+inactive-alias crash that its combined verifier had discarded, but also retained
+questionable claims and returned one unresolved decision about nil billed amounts.
+Its report therefore failed. No precision or complete-pipeline improvement is claimed.
+
+`small-discovery-diagnostic` used the existing values-focused instructions and source
+dependency selection, one target at a time, with a 48,000-byte prompt budget.
+Preflight rejected a 32,000-byte version that omitted the dashboard query dependency;
+no model call used it. Both models received identical final prompts (47,849 and
+47,905 bytes), system prompts, schemas and settings. Opus completed both calls in
+17.4234s. Grok completed the dashboard call but missed the weekend gap and claimed
+that no text-filter keyup handler exists. That claim is contradicted by the layout's
+included `_table_search` partial, which the reduced context omitted. The ban-parser
+call timed out: deadline 52.2702s, elapsed including cleanup 52.3753s. Its regex
+detection is unscored because no completed response exists. Descendant cleanup
+succeeded and the pinned `hh` HEAD was unchanged.
+
+Both diagnostics are rejected for promotion. Their timings cover isolated stages,
+not source-review end to end. No new 24-file or full-repository pair was launched.
+The handoff records two non-improvements and refuses further launches; the limited
+retention signal is saved without claiming parity or weakening accuracy requirements.
diff --git a/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..80c62916
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md
@@ -0,0 +1,65 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260929-175656945801000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Saved results establish the completed calls, unresolved decision and timeout. |
+| Completeness | PASS | 0 | 0 | Records the retained alias defect, unresolved claim, missed weekend gap, false handler claim and incomplete regex result. |
+| Scope and alignment | PASS | 0 | 0 | Two authorized diagnostics only; no product promotion or complete-review measurement. |
+| Architecture | PASS | 0 | 0 | Preserves the shared model setup and separates diagnostic evidence from product acceptance. |
+| Intent preservation | PASS | 0 | 0 | Accuracy and whole-repository acceptance remain unchanged and unfinished. |
+| Security | PASS | 0 | 0 | Private artifacts remain owner-only; logged-in CLIs and per-process settings only. |
+| Testing-quality | PASS | 0 | 0 | A retained true finding is not claimed as proof of precision or overall accuracy improvement. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
+| Runtime-reliability | PASS | 0 | 0 | Bounded session runner cleaned descendants; unresolved output failed; stopped state refuses launches. |
+| Mechanical-precision | PASS | 0 | 0 | Verified timings, 5/7 and 2/1 completed calls, matching discovery hashes and distinct deadline/cleanup elapsed values. |
+
+## Orchestrator Notes (not findings)
+
+Scope: the new accuracy-diagnostic checkpoint in README.md and the corresponding
+September 29 addition to experiment-history.md. Earlier historical claims were not
+re-reviewed. Independent reviewers `cleanup_review_correctness` and
+`cleanup_review_security` covered all ten lenses and returned zero blockers. Their
+checks used the private saved decisions, result metadata, prompt hashes and harness
+state. This PASS approves the documentation's accuracy; it does not approve either
+prototype or declare the parity goal complete.
+
+## Findings
+
+No blocking or advisory findings. Both independent reviewers returned zero blockers.

From ebe30250cba21227c07b36bd28197de3670cb9fd Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Tue, 29 Sep 2026 13:41:09 -0700
Subject: [PATCH 14/22] docs: record runtime-fact recovery and correct prior
 recall score

---
 ...115000-artifact-readme-075056c7-context.md | 98 +++++++++++++++++++
 .../metareview/learning/grok-parity/README.md | 20 +++-
 .../grok-parity/experiment-history.md         | 54 ++++++++++
 ...03845642115000-artifact-readme-075056c7.md | 65 ++++++++++++
 4 files changed, 236 insertions(+), 1 deletion(-)
 create mode 100644 docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..8bde58e5
--- /dev/null
+++ b/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
@@ -0,0 +1,98 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260929-203845642115000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `12c1d09`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. The latest user-authorized tests found
+a promising mechanism: supplying source-derived Ruby match results recovered a
+regex bug Grok had missed. This single discovery call took Grok 69.69s versus Opus
+28.92s (2.41x), including about 0.13s of preprocessing per provider. However, Grok
+introduced a false arithmetic example and omitted another true finding. Nothing
+was promoted; these timings do not establish complete-review performance.
+
+The other new test required explicit reachability, behavior and counterevidence
+for each draft claim. It discarded both required dashboard bugs and retained a
+false controller-inheritance claim, so it was rejected. Both tests are finished,
+the worktree contains no product changes, and the stopped harness refuses further
+launches. The runtime-fact prototype and raw evidence remain private.
+
+An old scorecard was also corrected: `screen-focused-linked-context-fast-fixed`
+covered **13/14**, not 14/14. Its false key-exposure claim had been incorrectly
+credited for the real browser `ENV` error. The separate all-context candidate still
+has an explicit finding for that error; its false-positive failure remains unchanged.
+
+Earlier on September 29, the campaign stopped after
+two consecutive non-improvements. The user then authorized two targeted diagnostics:
+verify findings individually and try smaller discovery contexts. Those tests are
+also finished; neither qualifies for promotion. No benchmark is running and product
+code is unchanged. The private harness refuses further launches in its stopped state.
+
+- Individual verification kept the inactive-alias crash that Grok's combined checker
+  had dropped. However, it retained questionable claims and left one candidate
+  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
+  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
+- Smaller discovery prompts retained the existing instructions and selected source
+  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
+  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
+  claimed no text-filter handler exists; the reduced context omitted its implementation.
+  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
+
+These are diagnostic stage timings, not complete-review speed measurements. The
+regex miss remains untested by a completed smaller-context Grok response. Restoring
+one true finding does not establish accuracy parity; no complete sample or full
+repository run was launched in this follow-up.
+
+The earlier fixed-sample campaign remains recorded below:
+
+| Sample | Opus | Grok | Required bugs found | Verdict |
+| --- | ---: | ---: | --- | --- |
+| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
+| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
+| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
+
+Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
+and inactive-alias lookup bugs. Their false-claim totals remain unscored because
+the recall failures already reject them. No full-repository run was attempted.
+These results do not establish that parity is impossible; they end this bounded
+campaign without relaxing accuracy or automatically starting another campaign.
+
+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
+shared effort/system-prompt handling, incomplete-response rejection, and valid
+filenames containing double dots. It also adds tests and updates the architecture
+reference. The source-review package tests pass at 100% statement coverage.
+These are correctness fixes; no experimental speed candidate has been promoted.
+
+- [Goal](goal.md): current acceptance criteria and autonomous ex
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index f76a991a..4517885d 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,6 +1,24 @@
 # Grok parity checkpoint
 
-The quality/speed goal is **not achieved**. The September 29 campaign stopped after
+The quality/speed goal is **not achieved**. The latest user-authorized tests found
+a promising mechanism: supplying source-derived Ruby match results recovered a
+regex bug Grok had missed. This single discovery call took Grok 69.69s versus Opus
+28.92s (2.41x), including about 0.13s of preprocessing per provider. However, Grok
+introduced a false arithmetic example and omitted another true finding. Nothing
+was promoted; these timings do not establish complete-review performance.
+
+The other new test required explicit reachability, behavior and counterevidence
+for each draft claim. It discarded both required dashboard bugs and retained a
+false controller-inheritance claim, so it was rejected. Both tests are finished,
+the worktree contains no product changes, and the stopped harness refuses further
+launches. The runtime-fact prototype and raw evidence remain private.
+
+An old scorecard was also corrected: `screen-focused-linked-context-fast-fixed`
+covered **13/14**, not 14/14. Its false key-exposure claim had been incorrectly
+credited for the real browser `ENV` error. The separate all-context candidate still
+has an explicit finding for that error; its false-positive failure remains unchanged.
+
+Earlier on September 29, the campaign stopped after
 two consecutive non-improvements. The user then authorized two targeted diagnostics:
 verify findings individually and try smaller discovery contexts. Those tests are
 also finished; neither qualifies for promotion. No benchmark is running and product
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
index 3664b91c..f73716ea 100644
--- a/docs/metareview/learning/grok-parity/experiment-history.md
+++ b/docs/metareview/learning/grok-parity/experiment-history.md
@@ -476,3 +476,57 @@ Both diagnostics are rejected for promotion. Their timings cover isolated stages
 not source-review end to end. No new 24-file or full-repository pair was launched.
 The handoff records two non-improvements and refuses further launches; the limited
 retention signal is saved without claiming parity or weakening accuracy requirements.
+
+## September 29 evidence-obligation and runtime-fact diagnostics
+
+The user authorized another attempt. It began at 20:22:39 UTC with an experiment
+deadline of 21:02:39 UTC and a closure deadline of 21:22:39 UTC. Previous campaigns
+remain preserved. These are bounded replay/discovery diagnostics, not fresh complete
+review pairs; each provider stage had a 300-second safety cap. Whole-review quality
+and timing acceptance remain unchanged.
+
+`proof-obligations-diagnostic` replayed each model's own linked-context drafts for
+the authentication, dashboard/layout and ban-parser groups. Each claim required
+reachability, behavior and counterevidence before its verdict; accepted findings
+were collected directly rather than rewritten. Source contexts were identical
+between providers. Both completed three calls, Opus in 54.9398s and Grok in
+126.5931s. Grok retained the regex and alias bugs, but rejected the real midnight
+and weekend dashboard roots and retained the incorrect global-controller inheritance
+claim. Reject on recall; the remaining eight groups were not run.
+
+Reviewing that control exposed a scorecard error: finding G56 alleges Honeybadger
+key exposure, not the actual browser `ENV` ReferenceError. It was already recorded
+as false in the claim ledger but incorrectly counted toward recall. Correct the
+linked-context result to 13/14, retaining the previous scorecard and correction
+evidence. The other historical all-context candidate explicitly reports the `ENV`
+failure in finding53 and still covers14/14 with mixed false components; it remains
+rejected on its false-positive bound. No source or required reference root changed.
+
+`literal-facts-diagnostic` then changed only the existing Grok4.6 values-discovery
+input: append static-regex match observations generated by Ruby4.0.0 and Prism,
+matching the repository's Ruby version. The generator parses source without executing
+application code; it tests literal word runs already in each pattern and their
+space-removed forms. Both models receive identical actual match results, with no
+expected outcomes or bug labels. This follows the parser's documented
+[static regex node and flags](https://ruby.github.io/prism/rb/Prism/RegularExpressionNode.html)
+and Ruby's [Regexp construction and matching](https://docs.ruby-lang.org/en/4.0/Regexp.html).
+Eight synthetic literal-equivalence cases, interpolation exclusion and parse-error
+rejection passed. The source contains34static patterns and5dynamic patterns, which
+are explicitly skipped. The original117,315-byte prompt is unchanged; the augmented
+prompt is119,921bytes, within the120,000-byte bound.
+
+Opus completed in28.9169s and Grok in69.6861s (2.4099x), including0.1300s and0.1323s
+of preprocessing respectively. Both completed normally with clean process cleanup
+and the pinned source unchanged. Grok now reports the extended-regex whitespace
+bug, increasing required-root coverage in this group from4/7 to5/7. The weekend
+and inactive-alias roots remain absent. It omits the previously reported CPMC alias
+precedence defect and adds a false component to the real subtotal bug: it says
+10.9+0.2 becomes10 after truncating the accumulator, whereas executing the actual
+BigDecimal operation gives10.2. All six published findings in the old Grok stage
+and both new stages were inspected: the new Grok output has this one false component;
+the old Grok stage and new Opus stage have none. Audit notes are not accepted findings.
+
+This is a useful local recovery signal, not an accuracy pass. Two diagnostics failed
+the no-regression requirement, so the batch stopped without expanding to the24-file
+sample or whole repository. All prototypes remain private; no product change or
+benchmark acceptance was promoted.
diff --git a/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..1f54cc86
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md
@@ -0,0 +1,65 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260929-203845642115000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Saved records confirm timings, preprocessing, call counts, prompt sizes and matching runtime. |
+| Completeness | PASS | 0 | 0 | Records recovered/missing roots, omitted CPMC finding and false arithmetic component. |
+| Scope and alignment | PASS | 0 | 0 | Diagnostic stages only; no product promotion or full-review performance claim. |
+| Architecture | PASS | 0 | 0 | Separates local evidence from complete acceptance and preserves shared provider inputs. |
+| Intent preservation | PASS | 0 | 0 | Accuracy requirements stay fixed; the stopped campaign remains unfinished. |
+| Security | PASS | 0 | 0 | Prism parses source without eval; static regex matches are bounded and dynamic interpolation is skipped. |
+| Testing-quality | PASS | 0 | 0 | Compared all six published claims in each stage; credits the real subtotal defect and counts its false example separately. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No application-data or schema migration. |
+| Runtime-reliability | PASS | 0 | 0 | Bounded stages cleaned descendants, guards refuse stopped launches, prior campaigns preserved. |
+| Mechanical-precision | PASS | 0 | 0 | Checked hashes, stage4/7-to5/7 coverage, metadata and source-backed13/14 historical score correction. |
+
+## Orchestrator Notes (not findings)
+
+Scope: the new evidence-obligation/runtime-fact checkpoint in README.md and the
+corresponding September 29 addition to experiment-history.md. Independent reviewers
+`cleanup_review_correctness` and `cleanup_review_security` reviewed all ten lenses
+against saved private decisions, findings, metadata, source hashes and generator
+code. Both returned zero blockers. Older history was checked only where needed to
+verify the explicit scorecard correction. This PASS approves the documentation;
+it does not approve the experimental pipeline or declare the parity goal achieved.
+
+## Findings
+
+No blocking or advisory findings. Both independent reviewers returned zero blockers.

From e936e76e701d708ad8e4f99d4ee6afcf68aa7cc2 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Tue, 29 Sep 2026 14:33:38 -0700
Subject: [PATCH 15/22] docs: record five-option Grok parity trials

---
 ...462000-artifact-readme-075056c7-context.md |  76 ++++++++++++
 .../metareview/learning/grok-parity/README.md | 117 ++++++------------
 .../grok-parity/experiment-history.md         |  87 +++++++++++++
 ...13048175462000-artifact-readme-075056c7.md |  74 +++++++++++
 4 files changed, 275 insertions(+), 79 deletions(-)
 create mode 100644 docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..e2ab91f3
--- /dev/null
+++ b/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
@@ -0,0 +1,76 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260929-213048175462000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `ebe3025`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. The latest batch tried all five
+requested options: source-linked grouping, one bounded source lookup, existing
+tool evidence, selective medium reasoning, and evaluation on untuned primary files.
+No implementation qualified for promotion. Product code is unchanged.
+
+The evaluation used six previously untuned primary files from the same pinned
+`hh` revision, selected before designing these experiments. This is not an unseen
+repository. Each implementation used the same pipeline and initial inputs for both
+providers. The six verified reference bugs remained outside their prompts.
+
+| Experiment | Opus | Grok | Result |
+| --- | ---: | ---: | --- |
+| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
+| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
+| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
+| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
+| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
+
+These are experimental sample-pipeline timings, not whole-repository results.
+The completed Grok reports also retain a false claim about PDF widget values.
+The lookup and selective-effort reports identify the real radio-selection defect
+but mix it with that false premise. Recall credit does not erase false components.
+Grok made no medium calls; its low-effort checker retained every candidate. Opus
+made two medium calls. Its failure means the last row is not a successful matched
+speed comparison. No full-repository run was justified.
+
+All five options are finished for this batch, and the private harness refuses
+further launches. Rejected prototypes and raw evidence remain private. This
+checkpoint changes documentation only; no experimental feature was committed.
+Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
+
+- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
+- [Experiment history](experiment-history.md): detailed results and earlier trials.
+
+Private inputs, outputs, prototypes and scorecards remain under
+`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
+superseded the earlier campaign's three-candidate/two-failure limit for this batch.
+
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index 4517885d..cda1ff76 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -1,81 +1,40 @@
 # Grok parity checkpoint
 
-The quality/speed goal is **not achieved**. The latest user-authorized tests found
-a promising mechanism: supplying source-derived Ruby match results recovered a
-regex bug Grok had missed. This single discovery call took Grok 69.69s versus Opus
-28.92s (2.41x), including about 0.13s of preprocessing per provider. However, Grok
-introduced a false arithmetic example and omitted another true finding. Nothing
-was promoted; these timings do not establish complete-review performance.
-
-The other new test required explicit reachability, behavior and counterevidence
-for each draft claim. It discarded both required dashboard bugs and retained a
-false controller-inheritance claim, so it was rejected. Both tests are finished,
-the worktree contains no product changes, and the stopped harness refuses further
-launches. The runtime-fact prototype and raw evidence remain private.
-
-An old scorecard was also corrected: `screen-focused-linked-context-fast-fixed`
-covered **13/14**, not 14/14. Its false key-exposure claim had been incorrectly
-credited for the real browser `ENV` error. The separate all-context candidate still
-has an explicit finding for that error; its false-positive failure remains unchanged.
-
-Earlier on September 29, the campaign stopped after
-two consecutive non-improvements. The user then authorized two targeted diagnostics:
-verify findings individually and try smaller discovery contexts. Those tests are
-also finished; neither qualifies for promotion. No benchmark is running and product
-code is unchanged. The private harness refuses further launches in its stopped state.
-
-- Individual verification kept the inactive-alias crash that Grok's combined checker
-  had dropped. However, it retained questionable claims and left one candidate
-  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
-  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
-- Smaller discovery prompts retained the existing instructions and selected source
-  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
-  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
-  claimed no text-filter handler exists; the reduced context omitted its implementation.
-  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
-
-These are diagnostic stage timings, not complete-review speed measurements. The
-regex miss remains untested by a completed smaller-context Grok response. Restoring
-one true finding does not establish accuracy parity; no complete sample or full
-repository run was launched in this follow-up.
-
-The earlier fixed-sample campaign remains recorded below:
-
-| Sample | Opus | Grok | Required bugs found | Verdict |
-| --- | ---: | ---: | --- | --- |
-| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
-| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
-| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
-
-Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
-and inactive-alias lookup bugs. Their false-claim totals remain unscored because
-the recall failures already reject them. No full-repository run was attempted.
-These results do not establish that parity is impossible; they end this bounded
-campaign without relaxing accuracy or automatically starting another campaign.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
-  previous user-checkpoint definition remains in git history (`dc6b86b`).
-- [Experiment history](experiment-history.md): preserved detailed log, originally
-  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-- The four historical goal reviews and context snapshots remain in the existing
-  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-  the goal, not completion of the implementation or successful benchmark quality.
-
-All three rows use the same fixed 24 primary files. The two new candidates retain
-the control's discovery prompts byte for byte; the first changes only what draft
-data verification receives, and the second changes only the Grok model variant.
-Both successful candidate-2 runs completed 30 calls, retained the pinned source
-revision and cleaned up successfully. Experimental preflight tests passed; the
-first candidate's new audit-isolation regression failed before the change and
-passed afterward. Seven harness guard cases passed. The earlier full code-suite
-validation applies to the committed correctness fixes, not to these prototypes.
-
-Private benchmark inputs, raw outputs, prototypes and harnesses remain under
-`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
-Nothing from this cleanup has been pushed or published.
+The quality/speed goal is **not achieved**. The latest batch tried all five
+requested options: source-linked grouping, one bounded source lookup, existing
+tool evidence, selective medium reasoning, and evaluation on untuned primary files.
+No implementation qualified for promotion. Product code is unchanged.
+
+The evaluation used six previously untuned primary files from the same pinned
+`hh` revision, selected before designing these experiments. This is not an unseen
+repository. Each implementation used the same pipeline and initial inputs for both
+providers. The six verified reference bugs remained outside their prompts.
+
+| Experiment | Opus | Grok | Result |
+| --- | ---: | ---: | --- |
+| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
+| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
+| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
+| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
+| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
+
+Timings cover review stages, per-run checks and cleanup; initial prompt packs
+were precomputed. They do not establish full-command or whole-repository performance.
+The completed Grok reports also retain a false claim about PDF widget values.
+The lookup and selective-effort reports identify the real radio-selection defect
+but mix it with that false premise. Recall credit does not erase false components.
+Grok made no medium calls; its low-effort checker retained every candidate. Opus
+made two medium calls. Its failure means the last row is not a successful matched
+speed comparison. No full-repository run was justified.
+
+All five options are finished for this batch, and the private harness refuses
+further launches. Rejected prototypes and raw evidence remain private. This
+checkpoint changes documentation only; no experimental feature was committed.
+Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
+
+- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
+- [Experiment history](experiment-history.md): detailed results and earlier trials.
+
+Private inputs, outputs, prototypes and scorecards remain under
+`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
+superseded the earlier campaign's three-candidate/two-failure limit for this batch.
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
index f73716ea..cfbbf1e4 100644
--- a/docs/metareview/learning/grok-parity/experiment-history.md
+++ b/docs/metareview/learning/grok-parity/experiment-history.md
@@ -530,3 +530,90 @@ This is a useful local recovery signal, not an accuracy pass. Two diagnostics fa
 the no-regression requirement, so the batch stopped without expanding to the24-file
 sample or whole repository. All prototypes remain private; no product change or
 benchmark acceptance was promoted.
+
+## September 29: five requested options on untuned primary files
+
+The user explicitly authorized trying all five proposed options and keeping only
+improvements. This batch started at 21:05:28 UTC, with an experiment deadline of
+22:45:28 and closure deadline of 23:05:28. That authorization superseded the old
+three-candidate/two-failure stopping limits for this batch. The source revision,
+reference, quality requirements and whole-review speed requirements stayed fixed.
+All requested trials finished before the deadline; no implementation qualified.
+
+The fifth option, untuned-code evaluation, applied to every trial. Before new prompt
+design, a deterministic hash selection chose two primary files each from controller,
+model and frontend strata, excluding previous narrowed-review primary targets.
+Each selected file has a verified important reference root. These six files are
+untuned primary targets within the same repository, not a new unseen repository;
+some may previously have appeared as supporting context. The hypotheses, selection
+and initial scripts were frozen before reading their reference labels or outputs.
+Labels never entered provider prompts.
+
+The private harness used the logged-in Opus and Grok 4.6 CLIs, identical initial
+source/prompts/system/schema, low effort and a shared 16-worker limit. Models had
+no tools. Source-dependent follow-ups used each model's own findings and requests,
+with the same policy and accessible committed source. Review stages, per-run tool checks,
+startup and process cleanup were timed. Initial prompt packs were precomputed;
+these timings do not establish full-command performance. Grok was capped at three times fresh Opus
+elapsed time. The pinned source was checked before and after each provider; every
+check passed and descendant cleanup succeeded. Actual discovery prompts and shared
+settings were compared after execution. No full-repository run was launched.
+
+| Configuration | Opus seconds | Grok seconds | Grok recall screen | Decision |
+| --- | ---: | ---: | --- | --- |
+| Fresh control | 26.1739 | 60.6847 | 3 confirmed, at most 4 of 6 | Reject: missing date-default and radio-selection roots |
+| Source-linked grouping | 33.7866 | 68.6963 | 3 confirmed, at most 4 of 6 | Reject: missing timezone and radio-selection roots |
+| One bounded lookup | 49.3406 | 97.7715 | 4 confirmed, at most 5 of 6 | Reject: missing timezone root |
+| Standard tool evidence | 28.0442 | 84.2532 including cancellation | Incomplete; unscored | Reject: deadline 84.1326 exceeded |
+| Selective medium reasoning | 56.8381, failed | 97.9614, diagnostic | 4 of 6 | Reject: Opus unresolved; Grok misses concurrent-draft and date-default roots |
+
+For the first three Grok reports, possible additional recall credit for overlapping
+draft includes was left unresolved: they describe duplicate billing without tracing
+concurrency past the activation guard. Their other missing roots already establish
+failure even with that credit. Precision was not exhaustively adjudicated after
+these decisive failures. Each completed Grok report contains at least one verified
+false component about PDF widget values: the pinned and installed pdfjs-dist 6.3.289
+normalizes stored strings and uses boolean checkbox/radio widget state. The lookup
+and selective-effort outputs also identify the genuine loss of radio-option identity;
+they receive recall credit for it while retaining the false-component penalty.
+
+Source-linked grouping separated the six unrelated primary targets, using existing
+source/type/caller links and excluding high-fanout shared ancestors. This is an
+approximation to execution-flow grouping, not a compiler-resolved call graph. The
+existing supporting-context picker remained in use. Every primary was present once,
+all primary source was preserved, and all six initial prompts fit within 120,000 bytes.
+The control used two groups. Grok recovered the date-default root but lost the
+system-timezone root; the false widget-value claim persisted. Reject the prototype.
+
+Bounded lookup allowed at most three relative paths or symbols per group, four
+matches per request and 40 KB of additional committed source, followed by one completion
+call. Both providers returned empty request lists for both groups. Thus the code
+path was offered but retrieval itself was not exercised; this run does not establish
+whether useful requested context would help. Grok still missed the timezone root
+and retained a false library premise. Reject this configuration without another run.
+
+Standard evidence came from six syntax parses, the repository's RuboCop lint rules
+on four Ruby files, and ten existing companion JavaScript tests. All passed. The
+isolated snapshot used committed source and privately cloned installed dependencies,
+so compiler/test caches did not write into `hh`. Preflight repairs routed RuboCop
+JSON to its output file and fixed Vitest's external setup-path problem; no custom
+bug probes or tests were introduced. Both providers received byte-identical evidence,
+including existing test names and outcomes. Grok timed out before a complete report;
+partial responses were not scored as a successful review. Reject the prototype.
+
+Selective effort added a low-effort candidate checker, escalating at most two
+rejected or uncertain claims per group to medium reasoning. Opus made two medium
+calls: one narrowed a date-formatting claim, while the catalog-association crash
+remained uncertain, correctly preventing a successful report. Grok's arm was then
+run once diagnostically, bounded to 170.5142 seconds (three times that failed Opus
+elapsed time), to finish the requested option. Grok retained every candidate at low
+effort and therefore made zero medium calls. It missed two required roots and kept
+a false PDF-library premise. This is not evidence of medium-effort performance on
+Grok, nor a passing matched comparison. Reject the escalation policy as tested.
+
+All five requested options are now attempted, the launch guard is stopped, and
+no new product code, full-sample run or full-repository run is being promoted.
+This records failures of these prototypes, not proof that the ideas cannot work.
+Private manifests, scripts, prompts, outputs, timings and claim mappings remain
+under the existing private benchmark directory; only this results checkpoint and
+its required review artifacts are committed.
diff --git a/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..a4c3e67d
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md
@@ -0,0 +1,74 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260929-213048175462000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| feasibility | PASS | 0 | 0 | Timings, source pin and command outcomes match private records. |
+| completeness | PASS | 0 | 0 | All five options and their unexercised paths and failures are disclosed. |
+| scope-alignment | PASS | 0 | 0 | Documentation only; no prototype or parity acceptance promoted. |
+| architecture | PASS | 0 | 0 | Shared policies and diagnostic limitations are accurately described. |
+| intent-preservation | PASS | 0 | 0 | Quality/speed requirements remain fixed; failures do not prove impossibility. |
+| security | PASS | 0 | 0 | Private source stays private; CLI-only runs and isolated tool caches verified. |
+| testing-quality | NOT_APPLICABLE | 0 | 0 | No production/test edits; reported existing checks match evidence. |
+| data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application persistence changes. |
+| runtime-reliability | PASS | 0 | 0 | Timeouts, incomplete reports, cleanup and stopped launch guard verified. |
+| mechanical-precision | NOT_APPLICABLE | 0 | 0 | Results record, not an implementation spec; timings and bounds checked. |
+
+## Orchestrator Notes (not findings)
+
+Reviewed the README change and the newly appended September 29 five-option section
+of the experiment history. Historical records and product implementation were outside
+this review. Two independently delegated reviewers covered all ten required lenses:
+`forward_results_correctness` covered completeness, scope-alignment,
+intent-preservation, testing-quality and mechanical-precision;
+`forward_results_safety` covered feasibility, architecture, security, data-migration
+and runtime-reliability. Both returned zero blockers and zero warnings.
+
+The review checked saved result/score records, actual findings, lookup/escalation
+records, tool evidence, private-directory permissions and the stopped launch guard.
+The timing language explicitly excludes precomputed prompt preparation. The context
+pack's checkout path was sanitized. `git diff --check` passed. A launch-guard check
+refused another provider run and left the call count unchanged.
+
+PASS applies to the accuracy of this documentation checkpoint. The Grok parity goal
+remains unfinished; no implementation is accepted and no full-repository pass is claimed.
+
+## Findings
+
+No blocking findings, advisory findings or warnings.

From 57c824b10e11304baca7df945486267fe357db30 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Wed, 30 Sep 2026 06:35:30 -0700
Subject: [PATCH 16/22] docs: save branch summary for the PR body

---
 ...394000-artifact-readme-075056c7-context.md | 87 +++++++++++++++++++
 .../metareview/learning/grok-parity/README.md | 10 +++
 ...33322105394000-artifact-readme-075056c7.md | 65 ++++++++++++++
 3 files changed, 162 insertions(+)
 create mode 100644 docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md

diff --git a/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
new file mode 100644
index 00000000..0b922dd7
--- /dev/null
+++ b/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
@@ -0,0 +1,87 @@
+# metareview context: docs/metareview/learning/grok-parity/README.md
+
+Run ID: `mrv-20260930-133322105394000-artifact-readme-075056c7`
+
+## Target
+
+- Path: `docs/metareview/learning/grok-parity/README.md`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `e936e76`
+
+## Artifact Excerpt
+
+```markdown
+# Grok parity checkpoint
+
+The quality/speed goal is **not achieved**. The latest batch tried all five
+requested options: source-linked grouping, one bounded source lookup, existing
+tool evidence, selective medium reasoning, and evaluation on untuned primary files.
+No implementation qualified for promotion. Product code is unchanged.
+
+The evaluation used six previously untuned primary files from the same pinned
+`hh` revision, selected before designing these experiments. This is not an unseen
+repository. Each implementation used the same pipeline and initial inputs for both
+providers. The six verified reference bugs remained outside their prompts.
+
+| Experiment | Opus | Grok | Result |
+| --- | ---: | ---: | --- |
+| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
+| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
+| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
+| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
+| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
+
+Timings cover review stages, per-run checks and cleanup; initial prompt packs
+were precomputed. They do not establish full-command or whole-repository performance.
+The completed Grok reports also retain a false claim about PDF widget values.
+The lookup and selective-effort reports identify the real radio-selection defect
+but mix it with that false premise. Recall credit does not erase false components.
+Grok made no medium calls; its low-effort checker retained every candidate. Opus
+made two medium calls. Its failure means the last row is not a successful matched
+speed comparison. No full-repository run was justified.
+
+All five options are finished for this batch, and the private harness refuses
+further launches. Rejected prototypes and raw evidence remain private. This
+checkpoint changes documentation only; no experimental feature was committed.
+Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
+
+- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
+- [Experiment history](experiment-history.md): detailed results and earlier trials.
+
+Private inputs, outputs, prototypes and scorecards remain under
+`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
+superseded the earlier campaign's three-candidate/two-failure limit for this batch.
+
+## Branch summary for the PR body
+
+1. **Whole-repo review:** added `source-review` with interchangeable Opus, Grok and Astra adapters.
+2. **Saved reports:** generates `findings.json` and a standalone, offline `review.html`.
+3. **HTML redesign:** severity charts, directory filters, search, findings grouped by file, expandable source excerpts, and dark/mobile layouts.
+4. **Source preparation:** filters first-party code, supports `--path`, splits large reviews into prompts, and preserves original line numbers.
+5. **Execution controls:** parallel calls, configurable timeouts, progress reporting and cancellation.
+6. **Grok fixes:** eliminated its prompt-re-reading loop; aligned Opus/Grok prompts, schema, disabled tools and medium effort; isolated calls from local configuration.
+7. **Reliability and testing:** validates findings and citations, rejects truncated model responses, prevents failed calls publishing partial reports, and adds automated tests plus a CI coverage entrypoint.
+
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
index cda1ff76..b6becd33 100644
--- a/docs/metareview/learning/grok-parity/README.md
+++ b/docs/metareview/learning/grok-parity/README.md
@@ -38,3 +38,13 @@ Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushe
 Private inputs, outputs, prototypes and scorecards remain under
 `/tmp/metareview-grok-parity/`. The latest authorization to try all five options
 superseded the earlier campaign's three-candidate/two-failure limit for this batch.
+
+## Branch summary for the PR body
+
+1. **Whole-repo review:** added `source-review` with interchangeable Opus, Grok and Astra adapters.
+2. **Saved reports:** generates `findings.json` and a standalone, offline `review.html`.
+3. **HTML redesign:** severity charts, directory filters, search, findings grouped by file, expandable source excerpts, and dark/mobile layouts.
+4. **Source preparation:** filters first-party code, supports `--path`, splits large reviews into prompts, and preserves original line numbers.
+5. **Execution controls:** parallel calls, configurable timeouts, progress reporting and cancellation.
+6. **Grok fixes:** eliminated its prompt-re-reading loop; aligned Opus/Grok prompts, schema, disabled tools and medium effort; isolated calls from local configuration.
+7. **Reliability and testing:** validates findings and citations, rejects truncated model responses, prevents failed calls publishing partial reports, and adds automated tests plus a CI coverage entrypoint.
diff --git a/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md
new file mode 100644
index 00000000..5bf19f90
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md
@@ -0,0 +1,65 @@
+# metareview: artifact review
+
+Run ID: `mrv-20260930-133322105394000-artifact-readme-075056c7`
+
+Target: `docs/metareview/learning/grok-parity/README.md`
+
+Context pack: `docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md`
+
+Execution mode: `parallel-subagents`
+
+Previous run: `none`
+
+Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
+
+## Verdict
+
+PASS — zero blocking findings.
+
+## Completion Requirements
+
+This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
+
+## Reviewer Prompts
+
+Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security (see `rubrics/security-review-rubric.md`)
+- Testing-quality (see `rubrics/testing-quality-rubric.md`)
+- Data-migration (see `rubrics/data-migration-rubric.md`)
+- Runtime-reliability
+- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
+
+## Reviewer Results
+
+| Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | ---: | ---: | --- |
+| Feasibility | PASS | 0 | 0 | Command, adapters, reports and CI entrypoint exist. |
+| Completeness | PASS | 0 | 0 | All seven approved summary points are saved, including HTML features. |
+| Scope and alignment | PASS | 0 | 0 | Describes retained implementation without discarded experiments. |
+| Architecture | PASS | 0 | 0 | Selection, packing, adapters and outputs match implementation. |
+| Intent preservation | PASS | 0 | 0 | Preserves the user-approved summary verbatim. |
+| Security | PASS | 0 | 0 | Isolation and disabled-tool claims match code; no private source or credentials added. |
+| Testing-quality | PASS | 0 | 0 | Tests and CI coverage entrypoint exist; no new test execution is claimed. |
+| Data-migration | NOT_APPLICABLE | 0 | 0 | No migration or persistence change. |
+| Runtime-reliability | PASS | 0 | 0 | Timeouts, cancellation, truncation rejection and all-calls-success publication match code. |
+| Mechanical-precision | NOT_APPLICABLE | 0 | 0 | Retrospective summary; no new implementation contract. |
+
+## Orchestrator Notes (not findings)
+
+Scope: only the newly appended Branch summary for the PR body. The earlier checkpoint remains historical.
+Two independent read-only reviewers covered all ten lenses: pr_summary_accuracy_review covered
+feasibility, completeness, scope/alignment, intent preservation and mechanical precision;
+pr_summary_contract_review covered architecture, security, testing-quality, data-migration and
+runtime-reliability. Both returned zero blockers or advisories. No advisory filter was needed.
+The host aggregated their verdicts. No product code changed, no new test execution is claimed,
+and this review does not establish Grok accuracy or speed parity. `git diff --check` passed.
+
+## Findings
+
+No blocking findings, advisory findings or warnings.

From 7bedc848f390e2fa9470153e7faea200bc9c0777 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Wed, 30 Sep 2026 08:09:49 -0700
Subject: [PATCH 17/22] docs: record full Opus and Grok comparison review

---
 ...00-artifact-comparison-ae9780dc-context.md | 146 ++++++++++++++++++
 ...9972166000-artifact-comparison-ae9780dc.md |  84 ++++++++++
 2 files changed, 230 insertions(+)
 create mode 100644 docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
 create mode 100644 docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md

diff --git a/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md b/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
new file mode 100644
index 00000000..a74a3427
--- /dev/null
+++ b/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
@@ -0,0 +1,146 @@
+# metareview context: .metareview/reports/full-comparison-20260930T133301Z/comparison.json
+
+Run ID: `mrv-20260930-134049972166000-artifact-comparison-ae9780dc`
+
+## Target
+
+- Path: `.metareview/reports/full-comparison-20260930T133301Z/comparison.json`
+- Repository mode: `metaswarm-extension`
+- Git branch: `whole-repo-source-review`
+- Git head: `57c824b`
+
+## Artifact Reviewed
+
+Final artifact SHA256: 1274c65bbb498e3bf8bacd7c7231a4833aed52608922a6100ef03e9224d7d9d3
+
+The complete comparison metrics follow. Source excerpts, prompts, full findings, and HTML reports stay in the ignored local report directory.
+
+```json
+{
+  "status": "complete",
+  "source": {
+    "repository": "hh",
+    "commit": "7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b",
+    "selected_files": 1346,
+    "source_bytes": 4616754,
+    "prompts": 45,
+    "identical_prompt_hashes": true,
+    "coverage": "Every selected source byte and original line number checked against pinned git blobs."
+  },
+  "product_commit": "e936e76e701d708ad8e4f99d4ee6afcf68aa7cc2",
+  "settings": {
+    "jobs": 8,
+    "call_timeout": "30m",
+    "effort": "medium",
+    "tools": false,
+    "shared_system_prompt": true,
+    "shared_schema": true,
+    "path_filter": null
+  },
+  "opus": {
+    "status": "standard command completed",
+    "elapsed_seconds": 297.916461834684,
+    "findings": 222,
+    "report": "opus/review.html",
+    "findings_json": "opus/findings.json",
+    "reference_roots_found": 58,
+    "reference_root_count": 83,
+    "precision": {
+      "sample_size": 30,
+      "counts": {
+        "supported": 18,
+        "mixed": 3,
+        "unresolved": 2,
+        "false": 7
+      }
+    }
+  },
+  "grok": {
+    "status": "standard command failed; complete report recovered",
+    "standard_failure": "Invalid JSON: trailing characters at line 1 column 14542 in prompt 30/45. 22/45 prompts had completed; no partial report was published.",
+    "original_elapsed_seconds": 1801.6777763329446,
+    "stopped_recovery_seconds": 84.63092816714197,
+    "successful_recovery_seconds": 2523.0929506663233,
+    "total_active_command_seconds": 4409.40165516641,
+    "recovery_gaps_seconds": 339.2947338335898,
+    "total_wall_seconds": 4748.696389,
+    "wall_ratio_to_opus": 15.93969114615454,
+    "active_ratio_to_opus": 14.80079894884499,
+    "recovery": "Reused 22 exact successful assistant texts; ran the remaining 23 calls through the unchanged production pipeline and OSRunner. A stopped cache-matching attempt is included in the elapsed totals. Cached outer JSON envelopes were reconstructed; assistant texts were unchanged. No failed response was repaired.",
+    "findings": 625,
+    "report": "grok-recovered/review.html",
+    "findings_json": "grok-recovered/findings.json",
+    "reference_roots_found": 60,
+    "reference_root_count": 83,
+    "precision": {
+      "sample_size": 30,
+      "counts": {
+        "unresolved": 2,
+        "supported": 11,
+        "false": 14,
+        "mixed": 3
+      }
+    }
+  },
+  "reference_overlap": {
+    "both": 47,
+    "grok_only": 13,
+    "opus_only": 11,
+    "neither": 12
+  },
+  "accuracy_method": {
+    "reference_panel": "83 previously source-confirmed important root causes at the same source revision, originating in an older Opus review. All published findings were examined for root/trigger/consequence matches.",
+    "precision_sample": "30 published findings per model, including bugs and advisories, selected using a fixed SHA256 seed set before inspection. Two reviewers adjudicated the samples against source and callers.",
+    "verdicts": {
+      "supported": "Factual claim and trigger supported; does not certify severity.",
+      "false": "False or unsupported current-impact claim.",
+      "mixed": "Supported core plus a concrete false assertion.",
+      "unresolved": "Not established; no supported credit."
+    },
+    "protocol": "accuracy-protocol.json",
+    "reference": "reference.json",
+    "evidence": [
+      "opus/recall-review.json",
+      "grok-recovered/recall-review.json",
+      "opus/precision-reviewed.json",
+      "grok-recovered/precision-reviewed.json"
+    ]
+  },
+  "performance_details": "performance.json",
+  "speed_requirement": {
+    "maximum_ratio": 3,
+    "maximum_seconds": 893.749385504052,
+    "met": false
+  },
+  "conclusion": "Grok recovered two more known reference roots, but produced more false or unsupported claims in the checked samples and required 15.94 times the elapsed time to obtain a full report. The speed requirement is not met; overall accuracy parity is not demonstrated.",
+  "limitations": [
+    "One successful Opus run and one recovered Grok report provide no repeatability estimate.",
+    "The standard Grok command failed. Its recovered report combines multiple attempts; this is not a successful single standard run.",
+    "Grok wall time includes all attempts and manual recovery gaps. Active command time includes the stopped cache-matching attempt. Neither is a clean single-run model-latency estimate.",
+    "The reference panel originated in Opus findings and is not an unbiased or exhaustive bug inventory.",
+    "The precision samples contain 30 findings per model, including bugs and advisories; results do not establish whole-repository accuracy. Mixed and unresolved findings are shown separately.",
+    "Supported source behavior does not establish calibrated severity or observed production impact."
+  ]
+}
+```
+
+## Service Inventory
+
+No service inventory found.
+
+## Knowledge Facts
+
+No Beads knowledge facts found.
+
+## Suggested Reviewers
+
+- Feasibility
+- Completeness
+- Scope and alignment
+- Architecture
+- Intent preservation
+- Security
+- Testing-quality
+- Data-migration
+- Runtime-reliability
+- Mechanical-precision
diff --git a/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md b/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md
new file mode 100644
index 00000000..89786001
--- /dev/null
+++ b/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md
@@ -0,0 +1,84 @@
+# metareview: artifact review
+
+Run ID: mrv-20260930-134049972166000-artifact-comparison-ae9780dc
+
+Target: .metareview/reports/full-comparison-20260930T133301Z/comparison.json
+
+Context pack: docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
+
+Execution mode: parallel-subagents-adjudicated
+
+Previous run: none
+
+Required lenses: feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision
+
+## Verdict
+
+PASS — zero blocking findings and zero unresolved advisory findings.
+
+## Reviewer Results
+
+| Lens | Reviewer | Verdict | Blocking | Warnings | Notes |
+| --- | --- | --- | ---: | ---: | --- |
+| Feasibility | pr_summary_accuracy_review | PASS | 0 | 0 | Reports saved; sample claims traceable to source, callers and schema. |
+| Completeness | comparison_recall_review | PASS | 0 | 0 | Both reports cover 45 prompts; all published findings examined against 83 reference roots. |
+| Scope and alignment | comparison_recall_review | PASS | 0 | 0 | Requested comparison only; no model tuning or product changes. |
+| Architecture | comparison_recall_review | PASS | 0 | 0 | Recall, sampled precision, and command reliability remain distinct. |
+| Intent preservation | pr_summary_accuracy_review | PASS | 0 | 0 | Same source and model inputs; unchanged model outputs and scoring categories. |
+| Security | pr_summary_contract_review | PASS | 0 | 0 | Actual guards checked; private source/report payloads remain ignored. |
+| Testing-quality | pr_summary_contract_review | PASS | 0 | 0 | Fixed samples and bounded conclusions; no unsupported test or accuracy claims. |
+| Data-migration | pr_summary_contract_review | PASS | 0 | 0 | Sample claims checked against migrations/schema; historical production impact not presumed. |
+| Runtime-reliability | pr_summary_accuracy_review | PASS | 0 | 0 | Failed standard Grok command and multi-attempt recovery are explicit. |
+| Mechanical-precision | comparison_recall_review | PASS | 0 | 0 | Final counts, denominators, overlap and elapsed-time arithmetic match evidence. |
+
+## Orchestrator Notes (not findings)
+
+The same pinned repository revision supplied 1,346 selected files, 4,616,754 source bytes,
+and 45 byte-identical prompts to both models. Settings were 8 concurrent calls,
+30-minute call timeout, medium effort, no tools, and shared system prompt/schema.
+
+Opus completed its standard command in 297.916 seconds with 222 findings.
+Grok's standard command failed after 1801.678 seconds on invalid JSON after 22 completed
+responses, without publishing partial output. Recovery retained those exact successful
+assistant texts and used the unchanged production pipeline for 23 remaining prompts.
+A stopped cache-matching attempt is included in the totals. The resulting complete report
+has 625 findings; elapsed time from the original start was 4748.696 seconds (15.94x Opus),
+including 4409.402 seconds of active commands and 339.295 seconds of recovery gaps.
+These are recovery-inclusive measurements, not a successful single-run Grok latency.
+
+Reference-root matching found 58/83 for Opus and 60/83 for Grok:
+47 shared, 13 Grok-only, 11 Opus-only, 12 missed by both.
+The 30-finding samples yielded supported/false-or-unsupported/mixed/unresolved counts
+of 18/7/3/2 for Opus and 11/14/3/2 for Grok.
+The Opus-origin reference-panel bias, sample size, advisory inclusion, severity limits,
+and lack of repeatability estimates are explicit in the final artifacts.
+
+Two reviewers split each fixed precision sample into 15 findings apiece. A third reviewed
+the complete reference mappings and final comparison. Evidence is saved locally under
+the target's report directory in each model's precision-reviewed.json and recall-review.json;
+grok-recovered/final-assessment.json records final artifact hashes.
+Source coverage and performance records are also saved there.
+Only summary metrics are included in the committed context; source excerpts, prompt
+captures, detailed findings, and HTML reports remain private and ignored.
+
+Advisory consolidation grouped the measurement-disclosure concerns from architecture
+and mechanical-precision. Their stated consequence was misleading accuracy/performance
+claims; the rebuttal was that the final artifacts already disclose each limitation.
+The single read-only staff-bar filter (pr_summary_accuracy_review) dropped the satisfied
+cluster, requested no changes, and flagged no candidate blockers. The recall reviewer
+then returned final PASS verdicts with zero unresolved advisories.
+
+No product code changed for this comparison. The benchmark itself, source-coverage
+checks, and source adjudication are the evidence; no fresh full test-suite pass is claimed.
+
+## Findings
+
+No unresolved findings.
+
+## Blocking Findings
+
+None.
+
+## Advisory Findings
+
+None.

From 2818b9c24e7c3cdcbaa81ad12c5d3737723c16e4 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Thu, 1 Oct 2026 11:19:27 -0700
Subject: [PATCH 18/22] chore: remove experiment and review paperwork from
 source-review PR

---
 .gitignore                                    |   3 -
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ---
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ---
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ---
 ...eview-grok-parity-goal-b59209eb-context.md | 103 ---
 ...533000-artifact-readme-075056c7-context.md |  64 --
 ...66000-task-done-readme-075056c7-context.md | 446 -------------
 ...36220000-artifact-goal-8af7bb93-context.md | 102 ---
 ...21007000-artifact-goal-8af7bb93-context.md |  98 ---
 ...138000-artifact-readme-075056c7-context.md |  83 ---
 ...801000-artifact-readme-075056c7-context.md |  97 ---
 ...115000-artifact-readme-075056c7-context.md |  98 ---
 ...462000-artifact-readme-075056c7-context.md |  76 ---
 ...394000-artifact-readme-075056c7-context.md |  87 ---
 ...00-artifact-comparison-ae9780dc-context.md | 146 -----
 .../metareview/learning/grok-parity/README.md |  50 --
 .../grok-parity/experiment-history.md         | 619 ------------------
 docs/metareview/learning/grok-parity/goal.md  | 106 ---
 ...ct-metareview-grok-parity-goal-b59209eb.md |  65 --
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 --
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 --
 ...ct-metareview-grok-parity-goal-b59209eb.md |  69 --
 ...45502217533000-artifact-readme-075056c7.md |  75 ---
 ...0100835166000-task-done-readme-075056c7.md |  65 --
 ...-150946036220000-artifact-goal-8af7bb93.md |  69 --
 ...-152217521007000-artifact-goal-8af7bb93.md |  69 --
 ...42351964138000-artifact-readme-075056c7.md |  69 --
 ...75656945801000-artifact-readme-075056c7.md |  65 --
 ...03845642115000-artifact-readme-075056c7.md |  65 --
 ...13048175462000-artifact-readme-075056c7.md |  74 ---
 ...33322105394000-artifact-readme-075056c7.md |  65 --
 ...9972166000-artifact-comparison-ae9780dc.md |  84 ---
 metareview-grok-source-review-goal.md         | 164 -----
 metareview-grok-source-review-progress.md     | 103 ---
 metareview-grok-speed-goal.md                 | 105 ---
 metareview-grok-speed-progress.md             | 193 ------
 metareview-whole-repo-source-review-goal.md   | 265 --------
 ...eview-whole-repo-source-review-progress.md |  91 ---
 38 files changed, 4380 deletions(-)
 delete mode 100644 docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 delete mode 100644 docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 delete mode 100644 docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 delete mode 100644 docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
 delete mode 100644 docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
 delete mode 100644 docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
 delete mode 100644 docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
 delete mode 100644 docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
 delete mode 100644 docs/metareview/learning/grok-parity/README.md
 delete mode 100644 docs/metareview/learning/grok-parity/experiment-history.md
 delete mode 100644 docs/metareview/learning/grok-parity/goal.md
 delete mode 100644 docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
 delete mode 100644 docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
 delete mode 100644 docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
 delete mode 100644 docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
 delete mode 100644 docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md
 delete mode 100644 docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md
 delete mode 100644 docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md
 delete mode 100644 docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md
 delete mode 100644 metareview-grok-source-review-goal.md
 delete mode 100644 metareview-grok-source-review-progress.md
 delete mode 100644 metareview-grok-speed-goal.md
 delete mode 100644 metareview-grok-speed-progress.md
 delete mode 100644 metareview-whole-repo-source-review-goal.md
 delete mode 100644 metareview-whole-repo-source-review-progress.md

diff --git a/.gitignore b/.gitignore
index f8cd8728..48e536c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,9 +12,6 @@ node_modules/
 # Local agent worktrees (never commit)
 .claude/worktrees/
 
-# Local Claude Code cost tracking (never commit)
-.claude/cost/
-
 # findings-index atomic-replace temp files (unique names; only survive a hard crash
 # in the write→rename window — see writeIndexAtomic)
 docs/metareview/.FINDINGS.md.tmp-*
diff --git a/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
deleted file mode 100644
index de3f17a9..00000000
--- a/docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# metareview context: metareview-grok-parity-goal.md
-
-Run ID: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
-
-## Target
-
-- Path: `metareview-grok-parity-goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `6eba389`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Goal
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-as well as or better than Opus, in no more than three times Opus's elapsed time.
-Quality means finding at least the important real bugs Opus finds, with no more
-false positives. More reported findings alone is not an improvement.
-
-Keep one review interface and one shared review pipeline. Switching between
-Opus and Grok changes the provider/model adapter, not the review task. A GPT
-adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
-
-This is the active scope, superseding the earlier fixed lists of experiments.
-The agent owns measurement details and may keep testing new approaches and
-combinations until the acceptance criteria are met. Do not stop because the
-first list of ideas is exhausted. Never report success from partial evidence.
-
-## Scope and invariants
-
-- Work on `whole-repo-source-review`, starting at `6eba389`.
-- Review `<reviewed-repository>` at commit
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
-  Check its HEAD before and after each measurement and reject a run if it changes.
-- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
-  or changes to the user's global CLI configuration.
-- Preserve the existing command and findings/page contract. Source selection,
-  prompts, system instructions, output schema, review stages, validation, retry
-  policy, concurrency, and reporting are shared. Translate their settings to
-  provider-specific CLI flags in the adapters. Record unavoidable differences.
-- Both models get the same source, context, instructions, allowed tools, and
-  effort setting for a comparison. No model receives benchmark answers or
-  findings from the other model. Keep tools disabled for review calls.
-- Shared prompt, packing, scheduling, validation, and recovery improvements are
-  allowed. Supported Grok model variants may be explored, with the actual model
-  ID recorded. A recovery must produce a real review; never turn a failed call,
-  truncation, missing coverage, or malformed answer into an empty successful review.
-- Preserve cancellation and timeouts. Count all retries and review stages in
-  elapsed time. Do not introduce unbounded retries or silently omit source.
-- Leave diff review, its anchor gate, and its FSM semantics unchanged.
-- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
-- Local implementation, experiments, tests, and commits are authorized by this
-  goal. Do not push, open a PR, or publish anything as part of this work.
-
-## Evidence and acceptance
-
-Use the actual `source-review` command built from the measured source revision.
-Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
-Record commands, build revision or diff hash, CLI versions, source commit,
-prompt hashes, settings, wall time, per-call time, failures, and output paths.
-Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
-evaluation ledger and summaries without committing the private `hh` source.
-
-1. Establish a fresh Opus baseline at the starting revision's medium effort,
-   and a current Grok measurement. Earlier results are context, not final proof.
-   Use small real `--path` samples to screen experiments, and full-repo runs to
-   decide success. The known DirectDeposit issues are leads to verify, not
-   automatically true bugs or the complete quality test.
-2. Adjudicate every unique defect claim in the baseline and finalist outputs
-   against the pinned source and relevant callers, tests, or dependency contracts.
-   Record root-cause matches, evidence, actual impact/severity, and one of
-   confirmed, false-positive, or unresolved. Adjudication is independent of the
-   producing model and does not accept its explanation as proof. Deduplicate by
-   root cause, not line overlap. Unresolved claims prevent a quality PASS.
-3. Important means co
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
-
-Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
deleted file mode 100644
index 249fb432..00000000
--- a/docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# metareview context: metareview-grok-parity-goal.md
-
-Run ID: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
-
-## Target
-
-- Path: `metareview-grok-parity-goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `6eba389`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Goal
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-as well as or better than Opus, in no more than three times Opus's elapsed time.
-Quality means finding at least the important real bugs Opus finds, with no more
-false positives. More reported findings alone is not an improvement.
-
-Keep one review interface and one shared review pipeline. Switching between
-Opus and Grok changes the provider/model adapter, not the review task. A GPT
-adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
-
-This is the active scope, superseding the earlier fixed lists of experiments.
-The agent owns measurement details and may keep testing new approaches and
-combinations until the acceptance criteria are met. Do not stop because the
-first list of ideas is exhausted. Never report success from partial evidence.
-
-## Scope and invariants
-
-- Work on `whole-repo-source-review`, starting at `6eba389`.
-- Review `<reviewed-repository>` at commit
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
-  Check its HEAD before and after each measurement and reject a run if it changes.
-- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
-  or changes to the user's global CLI configuration.
-- Preserve the existing command and findings/page contract. Source selection,
-  prompts, system instructions, output schema, review stages, validation, retry
-  policy, concurrency, and reporting are shared. Translate their settings to
-  provider-specific CLI flags in the adapters. Record unavoidable differences.
-- Both models get the same source, context, instructions, allowed tools, and
-  effort setting for a comparison. No model receives benchmark answers or
-  findings from the other model. Keep tools disabled for review calls.
-- Shared prompt, packing, scheduling, validation, and recovery improvements are
-  allowed. Supported Grok model variants may be explored, with the actual model
-  ID recorded. A recovery must produce a real review; never turn a failed call,
-  truncation, missing coverage, or malformed answer into an empty successful review.
-- Preserve cancellation and timeouts. Count all retries and review stages in
-  elapsed time. Do not introduce unbounded retries or silently omit source.
-- Leave diff review, its anchor gate, and its FSM semantics unchanged.
-- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
-- Local implementation, experiments, tests, and commits are authorized by this
-  goal. Do not push, open a PR, or publish anything as part of this work.
-
-## Evidence and acceptance
-
-Use the actual `source-review` command built from the measured source revision.
-Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
-Verify that directory is owned by the current user with mode `0700`, and use
-`umask 077` for benchmark artifacts containing private prompts or source excerpts.
-Record commands, build revision or diff hash, CLI versions, source commit,
-prompt hashes, settings, wall time, per-call time, failures, and output paths.
-Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
-evaluation ledger and summaries without committing the private `hh` source.
-
-1. Establish a fresh Opus baseline at the starting revision's medium effort,
-   and a current Grok measurement. Earlier results are context, not final proof.
-   Use small real `--path` samples to screen experiments, and full-repo runs to
-   decide success. The known DirectDeposit issues are leads to verify, not
-   automatically true bugs or the complete quality test.
-2. Adjudicate every unique defect claim in the baseline and finalist outputs
-   against the pinned source and relevant callers, tests, or dependency contracts.
-   Record root-cause matches, evidence, actual impact/severity, and one of
-   confirmed, false-positive, or unresolved. Adjudication is independent of the
-   producing mod
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
-
-Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
deleted file mode 100644
index 49a64242..00000000
--- a/docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# metareview context: metareview-grok-parity-goal.md
-
-Run ID: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
-
-## Target
-
-- Path: `metareview-grok-parity-goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `6eba389`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Goal
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-as well as or better than Opus, in no more than three times Opus's elapsed time.
-Quality means finding at least the important real bugs Opus finds, with no more
-false positives. More reported findings alone is not an improvement.
-
-Keep one review interface and one shared review pipeline. Switching between
-Opus and Grok changes the provider/model adapter, not the review task. A GPT
-adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
-
-This is the active scope, superseding the earlier fixed lists of experiments.
-The agent owns measurement details and may keep testing new approaches and
-combinations until the acceptance criteria are met. Do not stop because the
-first list of ideas is exhausted. Never report success from partial evidence.
-
-## Scope and invariants
-
-- Work on `whole-repo-source-review`, starting at `6eba389`.
-- Review `<reviewed-repository>` at commit
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
-  Check its HEAD before and after each measurement and reject a run if it changes.
-- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
-  or changes to the user's global CLI configuration.
-- Preserve the existing command and findings/page contract. Source selection,
-  prompts, system instructions, output schema, review stages, validation, retry
-  policy, concurrency, and reporting are shared. Translate their settings to
-  provider-specific CLI flags in the adapters. Record unavoidable differences.
-- Both models get the same source, context, instructions, allowed tools, and
-  effort setting for a comparison. No model receives benchmark answers or
-  findings from the other model. Keep tools disabled for review calls.
-- Shared prompt, packing, scheduling, validation, and recovery improvements are
-  allowed. Supported Grok model variants may be explored, with the actual model
-  ID recorded. A recovery must produce a real review; never turn a failed call,
-  truncation, missing coverage, or malformed answer into an empty successful review.
-- Preserve cancellation and timeouts. Count all retries and review stages in
-  elapsed time. Do not introduce unbounded retries or silently omit source.
-- Leave diff review, its anchor gate, and its FSM semantics unchanged.
-- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
-- Local implementation, experiments, tests, and commits are authorized by this
-  goal. Do not push, open a PR, or publish anything as part of this work.
-
-## Evidence and acceptance
-
-Use the actual `source-review` command built from the measured source revision.
-Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
-Verify that directory is owned by the current user with mode `0700`, and use
-`umask 077` for benchmark artifacts containing private prompts or source excerpts.
-Record commands, build revision or diff hash, CLI versions, source commit,
-prompt hashes, settings, wall time, per-call time, failures, and output paths.
-Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
-evaluation ledger and summaries without committing the private `hh` source.
-
-1. Establish a fresh Opus baseline at the starting revision's medium effort,
-   and a current Grok measurement. Earlier results are context, not final proof.
-   Use small real `--path` samples to screen experiments, and full-repo runs to
-   decide success. The known DirectDeposit issues are leads to verify, not
-   automatically true bugs or the complete quality test.
-2. Adjudicate every unique defect claim in the baseline and finalist outputs
-   against the pinned source and relevant callers, tests, or dependency contracts.
-   Record root-cause matches, evidence, actual impact/severity, and one of
-   confirmed, false-positive, or unresolved. Adjudication is independent of the
-   producing mod
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
-
-Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md b/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
deleted file mode 100644
index 67f686df..00000000
--- a/docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# metareview context: metareview-grok-parity-goal.md
-
-Run ID: `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb`
-
-## Target
-
-- Path: `metareview-grok-parity-goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `6eba389`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Goal
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-as well as or better than Opus, in no more than three times Opus's elapsed time.
-Quality means finding at least the important real bugs Opus finds, with no more
-false positives. More reported findings alone is not an improvement.
-
-Keep one review interface and one shared review pipeline. Switching between
-Opus and Grok changes the provider/model adapter, not the review task. A GPT
-adapter must fit that interface later; evaluating or tuning GPT is outside this goal.
-
-This is the active scope, superseding the earlier fixed lists of experiments.
-The agent owns measurement details and may keep testing new approaches and
-combinations until the acceptance criteria are met. Do not stop because the
-first list of ideas is exhausted. Never report success from partial evidence.
-
-## Scope and invariants
-
-- Work on `whole-repo-source-review`, starting at `6eba389`.
-- Review `<reviewed-repository>` at commit
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`; do not modify that repository.
-  Check its HEAD before and after each measurement and reject a run if it changes.
-- Use the logged-in CLIs. Do not add API keys, direct authenticated HTTP calls,
-  or changes to the user's global CLI configuration.
-- Preserve the existing command and findings/page contract. Source selection,
-  prompts, system instructions, output schema, review stages, validation, retry
-  policy, concurrency, and reporting are shared. Translate their settings to
-  provider-specific CLI flags in the adapters. Record unavoidable differences.
-- Both models get the same source, context, instructions, allowed tools, and
-  effort setting for a comparison. No model receives benchmark answers or
-  findings from the other model. Keep tools disabled for review calls.
-- Shared prompt, packing, scheduling, validation, and recovery improvements are
-  allowed. Supported Grok model variants may be explored, with the actual model
-  ID recorded. A recovery must produce a real review; never turn a failed call,
-  truncation, missing coverage, or malformed answer into an empty successful review.
-- Preserve cancellation and timeouts. Count all retries and review stages in
-  elapsed time. Do not introduce unbounded retries or silently omit source.
-- Leave diff review, its anchor gate, and its FSM semantics unchanged.
-- Keep the existing GPT adapter compiling and tested; do not run GPT benchmarks.
-- Local implementation, experiments, tests, and commits are authorized by this
-  goal. Do not push, open a PR, or publish anything as part of this work.
-
-## Evidence and acceptance
-
-Use the actual `source-review` command built from the measured source revision.
-Keep run outputs outside the reviewed tree under `/tmp/metareview-grok-parity/`.
-Verify that directory is owned by the current user with mode `0700`, and use
-`umask 077` for benchmark artifacts containing private prompts or source excerpts.
-Record commands, build revision or diff hash, CLI versions, source commit,
-prompt hashes, settings, wall time, per-call time, failures, and output paths.
-Keep a durable summary in `metareview-grok-parity-progress.md`; commit the final
-evaluation ledger and summaries without committing the private `hh` source.
-
-1. Freeze one full-repo Opus run as the reference, before further experiments.
-   Use the earliest fresh baseline already recorded at the starting revision's
-   medium effort: `baseline-full-opus-1` (295.9862 seconds). Keep the other runs
-   as historical evidence, not additional mandatory discoveries. Verify this
-   run's real issues against the pinned source; raw finding counts are not scores.
-   Do not select a different reference because a candidate fails.
-2. Adjudicate every unique defect claim in the baseline and finalist outputs
-   against the pinned source and relevant callers, tests, or dependency contracts.
-   Record root-cause matches, evidence, actual impact/severity, and one of
-
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
-
-Local checkout paths were redacted when archiving this context snapshot.
diff --git a/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
deleted file mode 100644
index 8343e91a..00000000
--- a/docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260927-145502217533000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `6775da0`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. No benchmark is running. The current
-work is cleanup and verification, following the user's request to stop the
-open-ended experiment loop.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): preserved goal definition, originally at the repository root.
-- [Experiment history](experiment-history.md): preserved detailed log, originally
-  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-- The four historical goal reviews and context snapshots remain in the existing
-  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-  the goal, not completion of the implementation or successful benchmark quality.
-
-Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
-24 fixed primary files. Its quality score is unfinished. The previous fully
-scored sample covered 13/14 required roots and retained false claims.
-A successful whole-repository comparison has not been demonstrated.
-
-Private benchmark inputs, raw outputs, prototypes and harnesses remain under
-`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
-Nothing from this cleanup has been pushed or published.
-
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md b/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
deleted file mode 100644
index 200735c9..00000000
--- a/docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md
+++ /dev/null
@@ -1,446 +0,0 @@
-# metareview task-done context
-
-Run ID: `mrv-20260927-150100835166000-task-done-readme-075056c7`
-
-## Task
-
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. No benchmark is running. The current
-work is cleanup and verification, following the user's request to stop the
-open-ended experiment loop.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): preserved goal definition, originally at the repository root.
-- [Experiment history](experiment-history.md): preserved detailed log, originally
-  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-- The four historical goal reviews and context snapshots remain in the existing
-  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-  the goal, not completion of the implementation or successful benchmark quality.
-
-Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
-24 fixed primary files. Its quality score is unfinished. The previous fully
-scored sample covered 13/14 required roots and retained false claims.
-A successful whole-repository comparison has not been demonstrated.
-
-Private benchmark inputs, raw outputs, prototypes and harnesses remain under
-`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
-Nothing from this cleanup has been pushed or published.
-
-
-## Git
-
-- Base: `6eba389a3e923fe0b53c7152e1ff49b4b19fc1f0`
-- Head: `27972ab9c78f3d4fde80326c42da79e4d94fd024`
-- Branch: `whole-repo-source-review`
-- Gate effect: `gate`
-
-## Context Profile
-
-- Raw diff bytes: `159440`
-- Filtered diff bytes: `15752`
-- Risk level: `none`
-- Generated files excluded: docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md, docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md, docs/metareview/learning/grok-parity/experiment-history.md, docs/metareview/learning/grok-parity/goal.md, docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md, docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
-
-## Context Shard Plan
-
-Not sharded.
-
-## Review Manifest
-
-- Manifest verdict: `PASS`
-- Source manifest hash: not sharded
-- Runtime assessment: static-only; runtime not assessed
-
-### Source Paths
-- docs/ARCHITECTURE.md
-- docs/metareview/learning/grok-parity/README.md
-- internal/sourcereview/model.go
-- internal/sourcereview/model_test.go
-- internal/sourcereview/parse.go
-- internal/sourcereview/parse_test.go
-
-### Path Dispositions
-- docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/learning/grok-parity/experiment-history.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/learning/grok-parity/goal.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md: generated (metareview generated review artifact excluded from source manifest)
-- docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md: generated (metareview generated review artifact excluded from source manifest)
-
-### Manifest Blockers
-No manifest blockers.
-
-## Changed Files
-
-- docs/ARCHITECTURE.md
-- docs/metareview/learning/grok-parity/README.md
-- internal/sourcereview/model.go
-- internal/sourcereview/model_test.go
-- internal/sourcereview/parse.go
-- internal/sourcereview/parse_test.go
-
-## Diff
-
-```diff
-diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
-index 63e8555..6604b25 100644
---- a/docs/ARCHITECTURE.md
-+++ b/docs/ARCHITECTURE.md
-@@ -46,10 +46,19 @@ generated files, and non-UTF-8, narrowed to `--path` when given (a sample of the
- prompts at once (default 8), each call killed with its process group past `--call-timeout` (default 30m).
- Every model gets the same setup — one system prompt, one findings JSON schema, no tools, one answer — so they
- are compared on the same job: `claude -p --tools "" --system-prompt --json-schema --strict-mcp-config`,
--`grok --prompt-file --verbatim --json-schema --tools "" --max-turns 1 --system-prompt-override --reasoning-effort
--medium` (medium was faster than the default with no lost findings; `grok -p` hands
--a large prompt to its agent as an excerpt it re-reads with tools), and `codex exec -s read-only --output-schema`
-+`grok --prompt-file --verbatim --json-schema --tools read_file --disallowed-tools read_file,search_tool,use_tool
-+--max-turns 1 --system-prompt-override --reasoning-effort medium`
-+(`grok --tools ""` retains the default tools; a nonempty allowlist followed by denial actually removes them;
-+`grok -p` hands a large prompt to its agent as an excerpt it re-reads with tools), and
-+`codex exec -s read-only --skip-git-repo-check --output-schema`
- (Codex has no switch to remove its tools or replace its system prompt, so it is the one that differs).
-+Calls start in an empty temporary working directory, cleaned after success or failure, so the host project's
-+rules are not injected. Per-process settings disable Claude customizations and Grok's Claude/Cursor compatibility
-+instructions. Native provider context can still differ. Grok's requested model is also set as its initial
-+default: switching models after initialization otherwise replaces the supplied system prompt. Claude's effort
-+environment override is set explicitly because it takes precedence over the CLI flag. Neither provider's
-+global configuration is edited. Explicit token-limit stops and Grok structured-output failures fail the call,
-+even if response text happens to parse as findings JSON.
- It does not use the diff-review anchor gate, `ValidatePayload`, `internal/shardpack`, or `review-lenses`.
-
- `epic-ready` runs *after* every child task is task-done-reviewed. It reviews the epic's **integration diff**
-diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
-new file mode 100644
-index 0000000..9aba16f
---- /dev/null
-+++ b/docs/metareview/learning/grok-parity/README.md
-@@ -0,0 +1,27 @@
-+# Grok parity checkpoint
-+
-+The quality/speed goal is **not achieved**. No benchmark is running. The current
-+work is cleanup and verification, following the user's request to stop the
-+open-ended experiment loop.
-+
-+Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-+shared effort/system-prompt handling, incomplete-response rejection, and valid
-+filenames containing double dots. It also adds tests and updates the architecture
-+reference. The source-review package tests pass at 100% statement coverage.
-+These are correctness fixes; no experimental speed candidate has been promoted.
-+
-+- [Goal](goal.md): preserved goal definition, originally at the repository root.
-+- [Experiment history](experiment-history.md): preserved detailed log, originally
-+  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-+- The four historical goal reviews and context snapshots remain in the existing
-+  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-+  the goal, not completion of the implementation or successful benchmark quality.
-+
-+Latest completed sample: Opus 175.86 seconds; Grok 410.28 seconds (2.33x), across
-+24 fixed primary files. Its quality score is unfinished. The previous fully
-+scored sample covered 13/14 required roots and retained false claims.
-+A successful whole-repository comparison has not been demonstrated.
-+
-+Private benchmark inputs, raw outputs, prototypes and harnesses remain under
-+`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
-+Nothing from this cleanup has been pushed or published.
-diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
-index 520fef1..c8e6d43 100644
---- a/internal/sourcereview/model.go
-+++ b/internal/sourcereview/model.go
-@@ -28,8 +28,32 @@ type OSRunner struct{}
- // is killed (the internal/fsm/cmdexec pattern).
- const waitDelay = 2 * time.Second
-
-+const (
-+   grokModelID  = "grok-4.7"
-+   reviewEffort = "medium"
-+)
-+
- func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byte) ([]byte, error) {
-+   // Review only the supplied source. Starting in the host checkout injects
-+   // unrelated project rules and skills into the model's conversation.
-+   dir, err := os.MkdirTemp("", "metareview-workspace-*")
-+   if err != nil {
-+       return nil, err
-+   }
-+   defer func() { _ = os.RemoveAll(dir) }()
-    cmd := exec.CommandContext(ctx, name, args...)
-+   cmd.Dir = dir
-+   cmd.Env = append(os.Environ(),
-+       "CLAUDE_CODE_SAFE_MODE=1",
-+       // Claude gives this environment variable precedence over --effort.
-+       "CLAUDE_CODE_EFFORT_LEVEL="+reviewEffort,
-+       // Selecting a different Grok model after initialization re-renders its
-+       // coding-agent system prompt, discarding --system-prompt-override.
-+       // Make the requested model the session default before initialization.
-+       fmt.Sprintf(`GROK_CONFIG={"models":{"default":%q}}`, grokModelID),
-+       "GROK_CLAUDE_AGENTS_ENABLED=false", "GROK_CLAUDE_RULES_ENABLED=false", "GROK_CLAUDE_SKILLS_ENABLED=false",
-+       "GROK_CURSOR_AGENTS_ENABLED=false", "GROK_CURSOR_RULES_ENABLED=false", "GROK_CURSOR_SKILLS_ENABLED=false",
-+   )
-    if stdin != nil {
-        cmd.Stdin = bytes.NewReader(stdin)
-    }
-@@ -39,7 +63,7 @@ func (OSRunner) Run(ctx context.Context, name string, args []string, stdin []byt
-    var stdout, stderr bytes.Buffer
-    cmd.Stdout = &stdout
-    cmd.Stderr = &stderr
--   err := cmd.Run()
-+   err = cmd.Run()
-    if err != nil {
-        // Codex puts the turn failure on stdout and a snapshot warning on
-        // stderr. Keep both so a non-zero exit records the CLI's reason.
-@@ -67,7 +91,7 @@ func ModelID(model string) (string, error) {
-    case "astra":
-        return "gpt-6-astra", nil
-    case "grok":
--       return "grok-4.7", nil
-+       return grokModelID, nil
-    default:
-        return "", fmt.Errorf("unknown model %q (want astra, opus, or grok)", model)
-    }
-@@ -94,7 +118,7 @@ func claudeArgs() []string {
-        "-p", "--model", "opus", "--output-format", "json",
-        "--tools", "", "--system-prompt", reviewSystem, "--json-schema", findingsSchema,
-        "--strict-mcp-config", "--no-session-persistence",
--       "--effort", "medium",
-+       "--effort", reviewEffort,
-    }
- }
-
-@@ -104,24 +128,27 @@ func claudeArgs() []string {
- func codexArgs(schemaFile string) []string {
-    return []string{
-        "exec", "--json", "-m", "gpt-6-astra",
--       "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-",
-+       "-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-",
-    }
- }
-
- // grokArgs runs Grok as one turn with no tools. -p hands a large prompt to
- // Grok's agent as an excerpt plus a file to read back with tools, which made
- // one hh prompt take 11 model calls; --prompt-file with --verbatim sends it whole.
--// --reasoning-effort medium: on one hh file (5 runs against 5) it took 502 s
--// against 623 s at the default, with more findings and every core bug found.
--// low is faster still but loses findings.
-+// Effort is shared with Claude. Speed and independently verified quality are
-+// measured together; a lower raw finding count alone does not establish a loss.
-+// Grok treats --tools "" as the default toolset. Use a non-empty allowlist,
-+// then deny that tool and the always-on MCP dispatchers. Deny takes precedence,
-+// leaving no tools without maintaining an exhaustive list of built-in tools.
- func grokArgs(promptFile string) []string {
-    return []string{
-        "--prompt-file", promptFile, "--verbatim",
--       "-m", "grok-4.7", "--output-format", "json",
-+       "-m", grokModelID, "--output-format", "json",
-        "--json-schema", findingsSchema,
--       "--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
-+       "--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
-+       "--max-turns", "1", "--no-subagents", "--disable-web-search",
-        "--system-prompt-override", reviewSystem,
--       "--reasoning-effort", "medium",
-+       "--reasoning-effort", reviewEffort,
-    }
- }
-
-@@ -187,8 +214,9 @@ func Call(ctx context.Context, runner Runner, model string, prompt []byte) (stri
-
- func claudeModelText(stdout []byte) (string, error) {
-    var doc struct {
--       IsError bool    `json:"is_error"`
--       Result  *string `json:"result"`
-+       IsError    bool    `json:"is_error"`
-+       StopReason string  `json:"stop_reason"`
-+       Result     *string `json:"result"`
-    }
-    if err := json.Unmarshal(stdout, &doc); err != nil {
-        return "", fmt.Errorf("missing model text: %w", err)
-@@ -200,6 +228,9 @@ func claudeModelText(stdout []byte) (string, error) {
-        }
-        return "", fmt.Errorf("claude: is_error: %s", msg)
-    }
-+   if doc.StopReason == "max_tokens" {
-+       return "", errors.New("claude: incomplete review: max_tokens")
-+   }
-    if doc.Result == nil || *doc.Result == "" {
-        return "", errors.New("missing model text")
-    }
-@@ -237,11 +268,19 @@ func codexModelText(stdout []byte) (string, error) {
-
- func grokModelText(stdout []byte) (string, error) {
-    var doc struct {
--       Text *string `json:"text"`
-+       Text                  *string `json:"text"`
-+       StopReason            string  `json:"stopReason"`
-+       StructuredOutputError string  `json:"structuredOutputError"`
-    }
-    if err := json.Unmarshal(stdout, &doc); err != nil {
-        return "", fmt.Errorf("missing model text: %w", err)
-    }
-+   if doc.StopReason == "max_tokens" {
-+       return "", errors.New("grok: incomplete review: max_tokens")
-+   }
-+   if doc.StructuredOutputError != "" {
-+       return "", fmt.Errorf("grok: %s", doc.StructuredOutputError)
-+   }
-    if doc.Text == nil || *doc.Text == "" {
-        return "", errors.New("missing model text")
-    }
-diff --git a/internal/sourcereview/model_test.go b/internal/sourcereview/model_test.go
-index 6ad929f..d2abef5 100644
---- a/internal/sourcereview/model_test.go
-+++ b/internal/sourcereview/model_test.go
-@@ -129,7 +129,7 @@ func TestCallShapes(t *testing.T) {
-                t.Fatalf("claude call %+v", c)
-            }
-        case "astra":
--           want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--output-schema", schemaFile, "-"}
-+           want := []string{"exec", "--json", "-m", "gpt-6-astra", "-s", "read-only", "--ephemeral", "--skip-git-repo-check", "--output-schema", schemaFile, "-"}
-            if c.name != "codex" || !reflectArgs(c.args, want) || !bytes.Equal(c.stdin, prompt) {
-                t.Fatalf("codex call %+v", c)
-            }
-@@ -157,7 +157,8 @@ func grokWant(promptFile string) []string {
-        "--prompt-file", promptFile, "--verbatim",
-        "-m", "grok-4.7", "--output-format", "json",
-        "--json-schema", findingsSchema,
--       "--tools", "", "--max-turns", "1", "--no-subagents", "--disable-web-search",
-+       "--tools", "read_file", "--disallowed-tools", "read_file,search_tool,use_tool",
-+       "--max-turns", "1", "--no-subagents", "--disable-web-search",
-        "--system-prompt-override", sharedSystem,
-        "--reasoning-effort", "medium",
-    }
-@@ -370,6 +371,26 @@ func TestCallErrors(t *testing.T) {
-    }
- }
-
-+func TestModelTextRejectsIncompleteAnswer(t *testing.T) {
-+   for _, c := range []struct {
-+       model string
-+       raw   string
-+   }{
-+       {"opus", `{"stop_reason":"max_tokens","result":"{\"findings\":[]}"}`},
-+       {"grok", `{"stopReason":"max_tokens","text":"{\"findings\":[]}"}`},
-+       {"grok", `{"structuredOutputError":"model did not produce structured output","text":"{\"findings\":[]}"}`},
-+   } {
-+       t.Run(c.model+c.raw, func(t *testing.T) {
-+           fr := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
-+               return []byte(c.raw), nil
-+           }}
-+           if text, err := Call(bg, fr, c.model, []byte("review source")); err == nil || text != "" {
-+               t.Fatalf("incomplete response accepted: text=%q err=%v", text, err)
-+           }
-+       })
-+   }
-+}
-+
- func TestOSRunner(t *testing.T) {
-    out, err := OSRunner{}.Run(bg, "echo", []string{"hi"}, nil)
-    if err != nil || !bytes.Contains(out, []byte("hi")) {
-@@ -400,6 +421,33 @@ func TestOSRunner(t *testing.T) {
-    }
- }
-
-+func TestOSRunnerIsolatesWorkspace(t *testing.T) {
-+   t.Setenv("GROK_CLAUDE_SKILLS_ENABLED", "true")
-+   t.Setenv("CLAUDE_CODE_SAFE_MODE", "0")
-+   t.Setenv("CLAUDE_CODE_EFFORT_LEVEL", "high")
-+   t.Setenv("GROK_CONFIG", `{"models":{"default":"a-different-model"}}`)
-+   for _, exit := range []string{"0", "1"} {
-+       out, err := OSRunner{}.Run(bg, "sh", []string{"-c", `pwd; printf '%s\n' "$GROK_CLAUDE_SKILLS_ENABLED" "$CLAUDE_CODE_SAFE_MODE" "$GROK_CONFIG" "$CLAUDE_CODE_EFFORT_LEVEL"; exit "$1"`, "sh", exit}, nil)
-+       if (err == nil) != (exit == "0") {
-+           t.Fatalf("exit %s: %v", exit, err)
-+       }
-+       lines := strings.Split(strings.TrimSpace(string(out)), "\n")
-+       if len(lines) != 5 || !strings.HasPrefix(filepath.Base(lines[0]), "metareview-workspace-") || lines[1] != "false" || lines[2] != "1" || lines[3] != `{"models":{"default":"grok-4.7"}}` || lines[4] != "medium" {
-+           t.Fatalf("unexpected workspace or environment: %q", out)
-+       }
-+       if _, err := os.Stat(lines[0]); !os.IsNotExist(err) {
-+           t.Fatalf("workspace remains after exit %s: %v", exit, err)
-+       }
-+   }
-+}
-+
-+func TestOSRunnerWorkspaceFailure(t *testing.T) {
-+   t.Setenv("TMPDIR", filepath.Join(t.TempDir(), "missing"))
-+   if _, err := (OSRunner{}).Run(bg, "echo", []string{"not started"}, nil); err == nil {
-+       t.Fatal("workspace creation failure must fail the call")
-+   }
-+}
-+
- func TestOSRunnerKillsProcessGroup(t *testing.T) {
-    pidFile := filepath.Join(t.TempDir(), "child.pid")
-    ctx, cancel := context.WithTimeout(bg, 300*time.Millisecond)
-diff --git a/internal/sourcereview/parse.go b/internal/sourcereview/parse.go
-index bccb20a..aa77fa9 100644
---- a/internal/sourcereview/parse.go
-+++ b/internal/sourcereview/parse.go
-@@ -73,7 +73,9 @@ func Parse(text string, files map[string][]byte) ([]lensoutput.TypedFinding, []s
- func resolveKept(cited string, files map[string][]byte) (string, error) {
-    shown := cited
-    cited = strings.ReplaceAll(strings.TrimSpace(cited), "\\", "/")
--   if cited == "" || strings.Contains(cited, "..") {
-+   // Only a complete parent-directory component is traversal. Literal dots
-+   // in a kept file or directory name must not discard a valid citation.
-+   if cited == "" || strings.Contains("/"+cited+"/", "/../") {
-        return "", fmt.Errorf("file is not kept: %s", shown)
-    }
-    cited = strings.TrimPrefix(cited, "./")
-diff --git a/internal/sourcereview/parse_test.go b/internal/sourcereview/parse_test.go
-index 9ae4f04..534d9df 100644
---- a/internal/sourcereview/parse_test.go
-+++ b/internal/sourcereview/parse_test.go
-@@ -161,6 +161,24 @@ func TestResolveShortPath(t *testing.T) {
-    }
- }
-
-+func TestResolveKeptLiteralDoubleDots(t *testing.T) {
-+   files := map[string][]byte{
-+       "web/.. -t=silently/coverage/index.html": []byte("source\n"),
-+       "pkg/file..name.go":                      []byte("source\n"),
-+   }
-+   for p := range files {
-+       got, err := resolveKept(p, files)
-+       if err != nil || got != p {
-+           t.Fatalf("valid kept path %q was rejected: %q %v", p, got, err)
-+       }
-+   }
-+   for _, p := range []string{"..", "../pkg/file..name.go", "other/../pkg/file..name.go", "pkg/..", `other\..\pkg\file..name.go`} {
-+       if _, err := resolveKept(p, files); err == nil {
-+           t.Fatalf("parent traversal accepted: %q", p)
-+       }
-+   }
-+}
-+
- func TestLineCountAndSplit(t *testing.T) {
-    if lineCount(nil) != 0 || splitLines(nil) != nil {
-        t.Fatal("empty")
-
-
-
-```
-
-## Knowledge And Registries
-
-Service inventory: none
-
-No service inventory found.
-
-Knowledge facts:
-
-No Beads knowledge facts found.
-
-## Evidence
-
-{"schemaVersion":1,"kind":"validation","command":["bash","-c","make cover \u003e /tmp/metareview-grok-parity/cleanup-make-cover-approved.log 2\u003e\u00261"],"cwd":".","exitCode":0,"startedAt":"2026-09-27T14:57:17.011405Z","finishedAt":"2026-09-27T15:00:49.985696Z","stdoutSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","stderrSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","summary":"bash -c make cover \u003e /tmp/metareview-grok-parity/cleanup-make-cover-approved.log 2\u003e\u00261 exited 0"}
-
-Embedded diff whitespace is normalized for documentation; git retains the exact source diff.
diff --git a/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md b/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
deleted file mode 100644
index 81fc3a98..00000000
--- a/docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md
+++ /dev/null
@@ -1,102 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/goal.md
-
-Run ID: `mrv-20260927-150946036220000-artifact-goal-8af7bb93`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `08ce3cf`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Required outcome
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
-time. A speedup with an accuracy loss is a failure. The goal remains unfinished
-until both conditions pass on a complete repository review.
-
-Keep one interface and one shared review pipeline. Switching models changes only
-the provider/model adapter. GPT evaluation is outside this goal.
-
-## Acceptance stays fixed
-
-- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
-  and its independently verified important bugs. Keep the pinned `hh` revision
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
-- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
-  cannot compensate for a miss. Do not change the reference to help a candidate
-  pass; record any evidence-based correction and its reason. Report P3 separately.
-- Grok must have no more unique false defect claims than either the frozen
-  reference or the fresh matched Opus run. Count false components of mixed claims,
-  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
-- A complete sequential Opus/Grok pair must use identical source, context, prompts,
-  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
-  never give either model benchmark answers or the other model's findings.
-- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
-  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
-  improve the ratio by slowing it or making its review less thorough.
-- Failed calls, truncation, missing coverage and timeouts are failures, never
-  successful empty reviews. Cancel descendants at the deadline. A sample result
-  cannot establish whole-repository success.
-
-## Bounded execution replaces the open-ended loop
-
-1. Start each batch by stating one hypothesis, its changed factor, the acceptance
-   check and a deadline. Reuse the existing evidence and fixed 24-file sample.
-2. A batch allows **one paired benchmark and at most 30 elapsed minutes**, including
-   implementation, analysis, testing and scoring. Automatic continuations do not
-   reset this budget. Do not start a run that cannot fit the remaining budget.
-3. Score the result before starting another experiment. Reject a candidate as soon
-   as a decisive quality or timing failure is proved; do not exhaustively adjudicate
-   an already rejected candidate. A candidate considered for PASS needs full
-   adjudication. Only a fully passing sample may advance to a full-repository pair
-   in a subsequent batch.
-4. At a decisive result or the batch deadline, cancel remaining benchmark processes
-   and report: elapsed times, required bugs found/missed, false claims (or explicit
-   unresolved bounds), verdict, and code kept or rejected. If scoring is incomplete,
-   say so. **Return to the user for direction before another batch.** Do not call
-   the overall goal complete merely because a batch ended.
-5. Commit verified changes at each checkpoint after the required tests and review
-   gates. Keep a clean worktree. Preserve rejected experiments outside the product
-   code; do not promote a candidate with worse accuracy. Push only on explicit
-   user instruction; do not open a PR or publish as part of this goal.
-
-## Immediate next batch
-
-Score the already completed `screen-focused-predicate-coverage-fast-fixed` run.
-**Make no new model calls in this batch.** It took Opus 175.8631 seconds and Grok
-410.2788 seconds; its quality is unfinished. Within 30 minutes, return a supported
-PASS/FAIL/INCOMPLETE sample verdict and a specific next recommendation.
-
-## Keep the work contained
-
-Use logged-in CLIs; do not add API keys, direct authenticated HTTP access or global
-configuration changes. Leave `hh`, diff-review/FSM semantics and GPT tuning alo
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md b/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
deleted file mode 100644
index 32ffb59e..00000000
--- a/docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md
+++ /dev/null
@@ -1,98 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/goal.md
-
-Run ID: `mrv-20260927-152217521007000-artifact-goal-8af7bb93`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/goal.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `dc6b86b`
-
-## Artifact Excerpt
-
-```markdown
-# Grok quality and speed parity
-
-## Required outcome
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
-time. A speedup with an accuracy loss is a failure. The goal remains unfinished
-until both conditions pass on a complete repository review.
-
-Keep one interface and one shared review pipeline. Switching models changes only
-the provider/model adapter. GPT evaluation is outside this goal.
-
-## Acceptance stays fixed
-
-- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
-  and its independently verified important bugs. Keep the pinned `hh` revision
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
-- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
-  cannot compensate for a miss. Do not change the reference to help a candidate
-  pass; record any evidence-based correction and its reason. Report P3 separately.
-- Grok must have no more unique false defect claims than either the frozen
-  reference or the fresh matched Opus run. Count false components of mixed claims,
-  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
-- A complete sequential Opus/Grok pair must use identical source, context, prompts,
-  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
-  never give either model benchmark answers or the other model's findings.
-- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
-  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
-  improve the ratio by slowing it or making its review less thorough.
-- Failed calls, truncation, missing coverage and timeouts are failures, never
-  successful empty reviews. Cancel descendants at the deadline. A sample result
-  cannot establish whole-repository success.
-
-## Autonomous execution with a finite budget
-
-The agent chooses experiments and proceeds without asking the user to direct the
-work. Checkpoints are progress reports, not permission requests. These rules
-replace the previous requirement to return to the user after each batch.
-
-1. Score the existing completed run first, using the existing evidence. Until it
-   has a supported PASS or FAIL, make no new model calls. Reuse prior adjudications
-   when source and claim are unchanged; reopen them only for new contrary evidence.
-2. Before each experiment, record one observed failure, one proposed causal fix,
-   one changed factor and the measurable result that would justify keeping it.
-   Check the existing experiment history first. Do not repeat a rejected setup or
-   rerun a failed measurement hoping for a better random result. A repair needs a
-   new causal explanation and consumes another candidate slot.
-3. Allow at most **three new candidate configurations on the fixed 24-file sample**,
-   one sequential matched pair each, and **one full-repository matched pair** for
-   the first fully passing sample. Score each pair before choosing the next action.
-   Never exhaustively adjudicate an already decisive failure. Fully adjudicate a
-   candidate before PASS; unresolved quality is not progress or success.
-4. Keep the best measured candidate. Improvement requires a strict gain in required
-   root coverage, unique false-claim count or elapsed time, without worsening either
-   other measure, against the same fully scored sample control. An unresolved
-   comparison does not count. Stop after **two consecutive candidates without a
-   demonstrated improvement**. A failed full-repository pair ends this campaign;
-   a passing sample cannot substitute for it.
-5. The campaign has **two elapsed hours total**, including analysis, implementation,
-   model calls, scoring, tests, reviews and commits. Reserve the final 20 minutes
-   for cancellation, validation, saving work and reporting; do not start experiments
-   in that reserve. Begin the
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
deleted file mode 100644
index 0cc90075..00000000
--- a/docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,83 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260929-142351964138000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `fbfcf4c`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The September 29 campaign stopped after
-two consecutive non-improvements, as required by the revised goal. No benchmark is
-running and no experimental speed change was promoted. The private harness now
-checks persisted deadlines and attempt limits before each provider launch; its
-stopped campaign state refuses further launches.
-
-| Sample | Opus | Grok | Required bugs found | Verdict |
-| --- | ---: | ---: | --- | --- |
-| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
-| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
-| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
-
-Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
-and inactive-alias lookup bugs. Their false-claim totals remain unscored because
-the recall failures already reject them. No full-repository run was attempted.
-These results do not establish that parity is impossible; they end this bounded
-campaign without relaxing accuracy or automatically starting another campaign.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
-  previous user-checkpoint definition remains in git history (`dc6b86b`).
-- [Experiment history](experiment-history.md): preserved detailed log, originally
-  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-- The four historical goal reviews and context snapshots remain in the existing
-  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-  the goal, not completion of the implementation or successful benchmark quality.
-
-All three rows use the same fixed 24 primary files. The two new candidates retain
-the control's discovery prompts byte for byte; the first changes only what draft
-data verification receives, and the second changes only the Grok model variant.
-Both successful candidate-2 runs completed 30 calls, retained the pinned source
-revision and cleaned up successfully. Experimental preflight tests passed; the
-first candidate's new audit-isolation regression failed before the change and
-passed afterward. Seven harness guard cases passed. The earlier full code-suite
-validation applies to the committed correctness fixes, not to these prototypes.
-
-Private benchmark inputs, raw outputs, prototypes and harnesses remain under
-`/tmp/metareview-grok-parity/`; they have not been copied into this repository.
-Nothing from this cleanup has been pushed or published.
-
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
deleted file mode 100644
index 2bfee179..00000000
--- a/docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260929-175656945801000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `a4701da`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The September 29 campaign stopped after
-two consecutive non-improvements. The user then authorized two targeted diagnostics:
-verify findings individually and try smaller discovery contexts. Those tests are
-also finished; neither qualifies for promotion. No benchmark is running and product
-code is unchanged. The private harness refuses further launches in its stopped state.
-
-- Individual verification kept the inactive-alias crash that Grok's combined checker
-  had dropped. However, it retained questionable claims and left one candidate
-  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
-  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
-- Smaller discovery prompts retained the existing instructions and selected source
-  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
-  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
-  claimed no text-filter handler exists; the reduced context omitted its implementation.
-  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
-
-These are diagnostic stage timings, not complete-review speed measurements. The
-regex miss remains untested by a completed smaller-context Grok response. Restoring
-one true finding does not establish accuracy parity; no complete sample or full
-repository run was launched in this follow-up.
-
-The earlier fixed-sample campaign remains recorded below:
-
-| Sample | Opus | Grok | Required bugs found | Verdict |
-| --- | ---: | ---: | --- | --- |
-| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
-| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
-| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
-
-Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
-and inactive-alias lookup bugs. Their false-claim totals remain unscored because
-the recall failures already reject them. No full-repository run was attempted.
-These results do not establish that parity is impossible; they end this bounded
-campaign without relaxing accuracy or automatically starting another campaign.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): current acceptance criteria and autonomous execution rules. The
-  previous user-checkpoint definition remains in git history (`dc6b86b`).
-- [Experiment history](experiment-history.md): preserved detailed log, originally
-  `metareview-grok-parity-progress.md`. Historical paths and observations are retained.
-- The four historical goal reviews and context snapshots remain in the existing
-  `docs/metareview/reviews/` and `docs/metareview/context/` directories. They review
-  the goal, not completion of the implementation or successful benchmark quality.
-
-All three rows use the same fixed 24 primary files. The two new candidates retain
-the control's discovery prompts byte for byte; the first changes only what draft
-data verification receives, and the second changes only the Grok model variant.
-Both successful candidate-2 runs completed 30 calls, retained the pinned source
-revision and cleaned up successfully. Experimental preflight tests passed; the
-first candidate's new audit-isolation regression failed before the change and
-passed afterward. Seven harness guard cases passed. The earlier full code-suite
-validation applies to the committed correctness fixes, not to these prototypes.
-
-Private benchmark input
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
deleted file mode 100644
index 8bde58e5..00000000
--- a/docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,98 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260929-203845642115000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `12c1d09`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The latest user-authorized tests found
-a promising mechanism: supplying source-derived Ruby match results recovered a
-regex bug Grok had missed. This single discovery call took Grok 69.69s versus Opus
-28.92s (2.41x), including about 0.13s of preprocessing per provider. However, Grok
-introduced a false arithmetic example and omitted another true finding. Nothing
-was promoted; these timings do not establish complete-review performance.
-
-The other new test required explicit reachability, behavior and counterevidence
-for each draft claim. It discarded both required dashboard bugs and retained a
-false controller-inheritance claim, so it was rejected. Both tests are finished,
-the worktree contains no product changes, and the stopped harness refuses further
-launches. The runtime-fact prototype and raw evidence remain private.
-
-An old scorecard was also corrected: `screen-focused-linked-context-fast-fixed`
-covered **13/14**, not 14/14. Its false key-exposure claim had been incorrectly
-credited for the real browser `ENV` error. The separate all-context candidate still
-has an explicit finding for that error; its false-positive failure remains unchanged.
-
-Earlier on September 29, the campaign stopped after
-two consecutive non-improvements. The user then authorized two targeted diagnostics:
-verify findings individually and try smaller discovery contexts. Those tests are
-also finished; neither qualifies for promotion. No benchmark is running and product
-code is unchanged. The private harness refuses further launches in its stopped state.
-
-- Individual verification kept the inactive-alias crash that Grok's combined checker
-  had dropped. However, it retained questionable claims and left one candidate
-  unresolved, so the diagnostic failed. Checking each provider's own saved reliability
-  findings took Opus 47.76s (five candidates) and Grok 45.17s (seven candidates).
-- Smaller discovery prompts retained the existing instructions and selected source
-  dependencies, with one target per prompt. Opus completed both calls in 17.42s.
-  Grok finished only the dashboard call, still missed the weekend gap, and incorrectly
-  claimed no text-filter handler exists; the reduced context omitted its implementation.
-  The other call was cancelled at the 52.27s deadline; cleanup finished at 52.38s.
-
-These are diagnostic stage timings, not complete-review speed measurements. The
-regex miss remains untested by a completed smaller-context Grok response. Restoring
-one true finding does not establish accuracy parity; no complete sample or full
-repository run was launched in this follow-up.
-
-The earlier fixed-sample campaign remains recorded below:
-
-| Sample | Opus | Grok | Required bugs found | Verdict |
-| --- | ---: | ---: | --- | --- |
-| Existing predicate-coverage result, now scored | 175.86s | 410.28s (2.33x) | 11/14 | FAIL: recall |
-| Candidate 1: omit draft audit notes from verification | 121.63s | Timeout at 364.99s | Incomplete review | FAIL: time |
-| Candidate 2: same pipeline, Grok 4.6 | 118.65s | 257.11s (2.17x) | 11/14 | FAIL: recall |
-
-Both completed Grok samples miss the weekend-filter gap, extended-regex whitespace
-and inactive-alias lookup bugs. Their false-claim totals remain unscored because
-the recall failures already reject them. No full-repository run was attempted.
-These results do not establish that parity is impossible; they end this bounded
-campaign without relaxing accuracy or automatically starting another campaign.
-
-Local code commit `6775da0` fixes model-call isolation, Grok tool disabling,
-shared effort/system-prompt handling, incomplete-response rejection, and valid
-filenames containing double dots. It also adds tests and updates the architecture
-reference. The source-review package tests pass at 100% statement coverage.
-These are correctness fixes; no experimental speed candidate has been promoted.
-
-- [Goal](goal.md): current acceptance criteria and autonomous ex
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
deleted file mode 100644
index e2ab91f3..00000000
--- a/docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260929-213048175462000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `ebe3025`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The latest batch tried all five
-requested options: source-linked grouping, one bounded source lookup, existing
-tool evidence, selective medium reasoning, and evaluation on untuned primary files.
-No implementation qualified for promotion. Product code is unchanged.
-
-The evaluation used six previously untuned primary files from the same pinned
-`hh` revision, selected before designing these experiments. This is not an unseen
-repository. Each implementation used the same pipeline and initial inputs for both
-providers. The six verified reference bugs remained outside their prompts.
-
-| Experiment | Opus | Grok | Result |
-| --- | ---: | ---: | --- |
-| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
-| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
-| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
-| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
-| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
-
-These are experimental sample-pipeline timings, not whole-repository results.
-The completed Grok reports also retain a false claim about PDF widget values.
-The lookup and selective-effort reports identify the real radio-selection defect
-but mix it with that false premise. Recall credit does not erase false components.
-Grok made no medium calls; its low-effort checker retained every candidate. Opus
-made two medium calls. Its failure means the last row is not a successful matched
-speed comparison. No full-repository run was justified.
-
-All five options are finished for this batch, and the private harness refuses
-further launches. Rejected prototypes and raw evidence remain private. This
-checkpoint changes documentation only; no experimental feature was committed.
-Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
-
-- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
-- [Experiment history](experiment-history.md): detailed results and earlier trials.
-
-Private inputs, outputs, prototypes and scorecards remain under
-`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
-superseded the earlier campaign's three-candidate/two-failure limit for this batch.
-
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md b/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
deleted file mode 100644
index 0b922dd7..00000000
--- a/docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md
+++ /dev/null
@@ -1,87 +0,0 @@
-# metareview context: docs/metareview/learning/grok-parity/README.md
-
-Run ID: `mrv-20260930-133322105394000-artifact-readme-075056c7`
-
-## Target
-
-- Path: `docs/metareview/learning/grok-parity/README.md`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `e936e76`
-
-## Artifact Excerpt
-
-```markdown
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The latest batch tried all five
-requested options: source-linked grouping, one bounded source lookup, existing
-tool evidence, selective medium reasoning, and evaluation on untuned primary files.
-No implementation qualified for promotion. Product code is unchanged.
-
-The evaluation used six previously untuned primary files from the same pinned
-`hh` revision, selected before designing these experiments. This is not an unseen
-repository. Each implementation used the same pipeline and initial inputs for both
-providers. The six verified reference bugs remained outside their prompts.
-
-| Experiment | Opus | Grok | Result |
-| --- | ---: | ---: | --- |
-| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
-| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
-| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
-| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
-| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
-
-Timings cover review stages, per-run checks and cleanup; initial prompt packs
-were precomputed. They do not establish full-command or whole-repository performance.
-The completed Grok reports also retain a false claim about PDF widget values.
-The lookup and selective-effort reports identify the real radio-selection defect
-but mix it with that false premise. Recall credit does not erase false components.
-Grok made no medium calls; its low-effort checker retained every candidate. Opus
-made two medium calls. Its failure means the last row is not a successful matched
-speed comparison. No full-repository run was justified.
-
-All five options are finished for this batch, and the private harness refuses
-further launches. Rejected prototypes and raw evidence remain private. This
-checkpoint changes documentation only; no experimental feature was committed.
-Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
-
-- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
-- [Experiment history](experiment-history.md): detailed results and earlier trials.
-
-Private inputs, outputs, prototypes and scorecards remain under
-`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
-superseded the earlier campaign's three-candidate/two-failure limit for this batch.
-
-## Branch summary for the PR body
-
-1. **Whole-repo review:** added `source-review` with interchangeable Opus, Grok and Astra adapters.
-2. **Saved reports:** generates `findings.json` and a standalone, offline `review.html`.
-3. **HTML redesign:** severity charts, directory filters, search, findings grouped by file, expandable source excerpts, and dark/mobile layouts.
-4. **Source preparation:** filters first-party code, supports `--path`, splits large reviews into prompts, and preserves original line numbers.
-5. **Execution controls:** parallel calls, configurable timeouts, progress reporting and cancellation.
-6. **Grok fixes:** eliminated its prompt-re-reading loop; aligned Opus/Grok prompts, schema, disabled tools and medium effort; isolated calls from local configuration.
-7. **Reliability and testing:** validates findings and citations, rejects truncated model responses, prevents failed calls publishing partial reports, and adds automated tests plus a CI coverage entrypoint.
-
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md b/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
deleted file mode 100644
index a74a3427..00000000
--- a/docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
+++ /dev/null
@@ -1,146 +0,0 @@
-# metareview context: .metareview/reports/full-comparison-20260930T133301Z/comparison.json
-
-Run ID: `mrv-20260930-134049972166000-artifact-comparison-ae9780dc`
-
-## Target
-
-- Path: `.metareview/reports/full-comparison-20260930T133301Z/comparison.json`
-- Repository mode: `metaswarm-extension`
-- Git branch: `whole-repo-source-review`
-- Git head: `57c824b`
-
-## Artifact Reviewed
-
-Final artifact SHA256: 1274c65bbb498e3bf8bacd7c7231a4833aed52608922a6100ef03e9224d7d9d3
-
-The complete comparison metrics follow. Source excerpts, prompts, full findings, and HTML reports stay in the ignored local report directory.
-
-```json
-{
-  "status": "complete",
-  "source": {
-    "repository": "hh",
-    "commit": "7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b",
-    "selected_files": 1346,
-    "source_bytes": 4616754,
-    "prompts": 45,
-    "identical_prompt_hashes": true,
-    "coverage": "Every selected source byte and original line number checked against pinned git blobs."
-  },
-  "product_commit": "e936e76e701d708ad8e4f99d4ee6afcf68aa7cc2",
-  "settings": {
-    "jobs": 8,
-    "call_timeout": "30m",
-    "effort": "medium",
-    "tools": false,
-    "shared_system_prompt": true,
-    "shared_schema": true,
-    "path_filter": null
-  },
-  "opus": {
-    "status": "standard command completed",
-    "elapsed_seconds": 297.916461834684,
-    "findings": 222,
-    "report": "opus/review.html",
-    "findings_json": "opus/findings.json",
-    "reference_roots_found": 58,
-    "reference_root_count": 83,
-    "precision": {
-      "sample_size": 30,
-      "counts": {
-        "supported": 18,
-        "mixed": 3,
-        "unresolved": 2,
-        "false": 7
-      }
-    }
-  },
-  "grok": {
-    "status": "standard command failed; complete report recovered",
-    "standard_failure": "Invalid JSON: trailing characters at line 1 column 14542 in prompt 30/45. 22/45 prompts had completed; no partial report was published.",
-    "original_elapsed_seconds": 1801.6777763329446,
-    "stopped_recovery_seconds": 84.63092816714197,
-    "successful_recovery_seconds": 2523.0929506663233,
-    "total_active_command_seconds": 4409.40165516641,
-    "recovery_gaps_seconds": 339.2947338335898,
-    "total_wall_seconds": 4748.696389,
-    "wall_ratio_to_opus": 15.93969114615454,
-    "active_ratio_to_opus": 14.80079894884499,
-    "recovery": "Reused 22 exact successful assistant texts; ran the remaining 23 calls through the unchanged production pipeline and OSRunner. A stopped cache-matching attempt is included in the elapsed totals. Cached outer JSON envelopes were reconstructed; assistant texts were unchanged. No failed response was repaired.",
-    "findings": 625,
-    "report": "grok-recovered/review.html",
-    "findings_json": "grok-recovered/findings.json",
-    "reference_roots_found": 60,
-    "reference_root_count": 83,
-    "precision": {
-      "sample_size": 30,
-      "counts": {
-        "unresolved": 2,
-        "supported": 11,
-        "false": 14,
-        "mixed": 3
-      }
-    }
-  },
-  "reference_overlap": {
-    "both": 47,
-    "grok_only": 13,
-    "opus_only": 11,
-    "neither": 12
-  },
-  "accuracy_method": {
-    "reference_panel": "83 previously source-confirmed important root causes at the same source revision, originating in an older Opus review. All published findings were examined for root/trigger/consequence matches.",
-    "precision_sample": "30 published findings per model, including bugs and advisories, selected using a fixed SHA256 seed set before inspection. Two reviewers adjudicated the samples against source and callers.",
-    "verdicts": {
-      "supported": "Factual claim and trigger supported; does not certify severity.",
-      "false": "False or unsupported current-impact claim.",
-      "mixed": "Supported core plus a concrete false assertion.",
-      "unresolved": "Not established; no supported credit."
-    },
-    "protocol": "accuracy-protocol.json",
-    "reference": "reference.json",
-    "evidence": [
-      "opus/recall-review.json",
-      "grok-recovered/recall-review.json",
-      "opus/precision-reviewed.json",
-      "grok-recovered/precision-reviewed.json"
-    ]
-  },
-  "performance_details": "performance.json",
-  "speed_requirement": {
-    "maximum_ratio": 3,
-    "maximum_seconds": 893.749385504052,
-    "met": false
-  },
-  "conclusion": "Grok recovered two more known reference roots, but produced more false or unsupported claims in the checked samples and required 15.94 times the elapsed time to obtain a full report. The speed requirement is not met; overall accuracy parity is not demonstrated.",
-  "limitations": [
-    "One successful Opus run and one recovered Grok report provide no repeatability estimate.",
-    "The standard Grok command failed. Its recovered report combines multiple attempts; this is not a successful single standard run.",
-    "Grok wall time includes all attempts and manual recovery gaps. Active command time includes the stopped cache-matching attempt. Neither is a clean single-run model-latency estimate.",
-    "The reference panel originated in Opus findings and is not an unbiased or exhaustive bug inventory.",
-    "The precision samples contain 30 findings per model, including bugs and advisories; results do not establish whole-repository accuracy. Mixed and unresolved findings are shown separately.",
-    "Supported source behavior does not establish calibrated severity or observed production impact."
-  ]
-}
-```
-
-## Service Inventory
-
-No service inventory found.
-
-## Knowledge Facts
-
-No Beads knowledge facts found.
-
-## Suggested Reviewers
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security
-- Testing-quality
-- Data-migration
-- Runtime-reliability
-- Mechanical-precision
diff --git a/docs/metareview/learning/grok-parity/README.md b/docs/metareview/learning/grok-parity/README.md
deleted file mode 100644
index b6becd33..00000000
--- a/docs/metareview/learning/grok-parity/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Grok parity checkpoint
-
-The quality/speed goal is **not achieved**. The latest batch tried all five
-requested options: source-linked grouping, one bounded source lookup, existing
-tool evidence, selective medium reasoning, and evaluation on untuned primary files.
-No implementation qualified for promotion. Product code is unchanged.
-
-The evaluation used six previously untuned primary files from the same pinned
-`hh` revision, selected before designing these experiments. This is not an unseen
-repository. Each implementation used the same pipeline and initial inputs for both
-providers. The six verified reference bugs remained outside their prompts.
-
-| Experiment | Opus | Grok | Result |
-| --- | ---: | ---: | --- |
-| Fresh control | 26.17s | 60.68s | Missed required date-default and radio-selection bugs |
-| Source-linked grouping | 33.79s | 68.70s | Found date-default bug; lost timezone bug; radio-selection bug still missing |
-| One bounded lookup | 49.34s | 97.77s | Neither model requested source; Grok still missed timezone bug |
-| Existing syntax/lint/test evidence | 28.04s | Timeout at 84.13s | Incomplete Grok review; cleanup finished at 84.25s |
-| Medium reasoning for disputed findings | Failed at 56.84s | Diagnostic: 97.96s | Opus left a finding unresolved; Grok disputed nothing and found only 4/6 required bugs |
-
-Timings cover review stages, per-run checks and cleanup; initial prompt packs
-were precomputed. They do not establish full-command or whole-repository performance.
-The completed Grok reports also retain a false claim about PDF widget values.
-The lookup and selective-effort reports identify the real radio-selection defect
-but mix it with that false premise. Recall credit does not erase false components.
-Grok made no medium calls; its low-effort checker retained every candidate. Opus
-made two medium calls. Its failure means the last row is not a successful matched
-speed comparison. No full-repository run was justified.
-
-All five options are finished for this batch, and the private harness refuses
-further launches. Rejected prototypes and raw evidence remain private. This
-checkpoint changes documentation only; no experimental feature was committed.
-Earlier correctness fixes remain in `6775da0`. Nothing from this batch was pushed.
-
-- [Goal](goal.md): unchanged quality and whole-repository speed requirements.
-- [Experiment history](experiment-history.md): detailed results and earlier trials.
-
-Private inputs, outputs, prototypes and scorecards remain under
-`/tmp/metareview-grok-parity/`. The latest authorization to try all five options
-superseded the earlier campaign's three-candidate/two-failure limit for this batch.
-
-## Branch summary for the PR body
-
-1. **Whole-repo review:** added `source-review` with interchangeable Opus, Grok and Astra adapters.
-2. **Saved reports:** generates `findings.json` and a standalone, offline `review.html`.
-3. **HTML redesign:** severity charts, directory filters, search, findings grouped by file, expandable source excerpts, and dark/mobile layouts.
-4. **Source preparation:** filters first-party code, supports `--path`, splits large reviews into prompts, and preserves original line numbers.
-5. **Execution controls:** parallel calls, configurable timeouts, progress reporting and cancellation.
-6. **Grok fixes:** eliminated its prompt-re-reading loop; aligned Opus/Grok prompts, schema, disabled tools and medium effort; isolated calls from local configuration.
-7. **Reliability and testing:** validates findings and citations, rejects truncated model responses, prevents failed calls publishing partial reports, and adds automated tests plus a CI coverage entrypoint.
diff --git a/docs/metareview/learning/grok-parity/experiment-history.md b/docs/metareview/learning/grok-parity/experiment-history.md
deleted file mode 100644
index cfbbf1e4..00000000
--- a/docs/metareview/learning/grok-parity/experiment-history.md
+++ /dev/null
@@ -1,619 +0,0 @@
-# Grok parity progress
-
-## Starting point
-
-- Goal: `metareview-grok-parity-goal.md`.
-- Branch: `whole-repo-source-review`; starting revision `6eba389`.
-- Target: `hh` at `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`.
-- Status: user-approved goal reset written; revised artifact review pending; fresh baseline recorded; no candidate has passed acceptance.
-- Historical final Grok run: 4,188 seconds, 45 prompts, 671 findings. The saved
-  outputs and logs still exist. Historical raw finding counts do not prove parity.
-
-## Goal review
-
-Artifact review `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`: PASS, zero blockers. Ten independent lenses reviewed the goal; Completeness and Security re-reviewed their resolved findings.
-
-## Investigation: tools were still exposed
-
-The two historical fast-model failures were `max turns reached`, not malformed
-review answers. Their Grok session records expose 25 tool definitions and actual
-`grep` tool calls despite `--tools ""`. Both had high reasoning effort. Current
-installed CLIs: Grok 1.0.41, Claude Code 2.1.281. This is evidence for fixing
-the shared no-tools contract before retesting the fast variant. No speed or
-quality improvement has yet been demonstrated.
-
-## Fresh Opus baseline
-
-At `6eba389`, medium effort and jobs 8, full `hh` runs completed in 295.99s (293 findings), 290.37s (283 findings), 266.13s (288 findings). All exit 0; source SHA unchanged. Median 290.37s; the 3x budget is 871.11s (14.52 minutes). Actual model reported: `claude-opus-5-5`. Raw responses, prompt hashes and full logs: `/tmp/metareview-grok-parity/baseline-full-opus-(1, 2, 3)/`. Quality adjudication is still in progress; raw counts are not scores.
-
-## Experiments in progress
-
-- Explicit nonempty allowlist plus denial removes Grok tools: live session `01a0d8e6-81f8-7172-b2f7-82458c2387d4` records an empty tool list, one turn, successful output. The diagnostic on `app/models/application_record.rb` took 131.76s.
-- Fast model, medium, no tools, original cwd: DirectDeposit sample took 262.99s and returned six findings (unadjudicated). Session `01a0d8e9-620a-7f42-87ba-44e0798d5412` records medium effort, but its actual system message is the 7,513-character coding-agent prompt, despite the requested 115-character reviewer prompt saved separately.
-- Isolated working directories and per-process customization suppression are implemented for the shared runner. They reduce ambient context, but the fast variant still changes the system message. An explicit reviewer agent profile is the next diagnostic.
-- `go test -cover ./internal/sourcereview` passes at 100.0% after the runner changes. Full coverage and task review remain owed.
-
-## Corrected setup and low-effort screening
-
-- Setting the requested Grok model as the per-process `models.default` prevents model selection from replacing the system prompt. Live fast-model session `01a0d8f4-ea2c-7f73-83bf-5d855ecc4c1d` records the exact shared 115-character system prompt and zero tools. An explicit agent file alone did not fix the reset and was dropped.
-- Fast model at low effort, corrected setup: S1 55.02s vs Opus 19.96s (2.76x), but Grok omitted the verified Cancel state defect. Rejected as a quality pass.
-- Shared systematic, evidence-grounded instructions at low effort: S1 Grok 64.75s vs Opus 21.97s (2.95x); Grok recovered Cancel. This is a screening result only. A full-repo pilot runs sequentially, Opus then Grok, under `/tmp/metareview-grok-parity/pilot-grounded-low-{opus,grok}-1/`.
-- The live benchmark exposed a parser defect: a real kept directory named `.. -t=silently` is rejected as traversal. A regression test first failed, and the parser now rejects only complete `..` path components. These historical harness rejections must not be scored as model false positives.
-
-## Full pilot: grounded instructions, low effort, fast Grok
-
-- Opus completed all 45 prompts in 150.04s, with 126 reported findings. This sets a matched 450.13s Grok limit; the initial baseline limit also remains binding.
-- Grok completed all 45 prompts in 902.07s (15.03 minutes), with 375 reported findings. The ratio is 6.01x, so this candidate fails timing. Its DirectDeposit prompt also omitted the confirmed Cancel defect, despite finding it in the small sample. It cannot pass quality either. Both runs exited 0 with the source SHA unchanged; their 45 prompt hashes match exactly.
-- Live session metadata confirms both a 13s call and a 297s call actually used `grok-4.7-build-fast`, low effort, and zero tools. Long calls still generate tens of thousands of reasoning tokens; the latency difference is not explained by accidentally retaining tools or high effort.
-- The pilot binary predates the literal-double-dot parser fix. Valid citations rejected for that reason are harness defects, not model false positives.
-- Independent adjudication has confirmed date-filter and invoice-cent truncation bugs and rejected claims contradicted by actual inherited scopes, soft-delete behavior, helper return values, and the database schema. The initial Opus reference is not yet frozen; adjudication remains incomplete.
-
-## Next experiment: smaller related groups
-
-The first-fit packer puts unrelated files together and separates relevant helpers. The next experimental build sorts by path and prefers 48 KB groups, retaining whole files up to the existing 120 KB hard limit. Selection, instructions, model variants, and effort remain the same as the failed pilot. This is a shared packing change, not a provider-specific prompt. Existing partition, UTF-8, line-number, and complete-file coverage tests pass with the grouping expectation adjusted. The implementation remains in a private Go overlay until measurements justify keeping it.
-
-Screening paths: `app/controllers/admin`, `app/models/reporting`, `app/models/concerns`, and `web/src/routes/DirectDeposit.svelte`. Paired sequential runs use jobs 8 and label `screen-grouped-low-s2plus`.
-
-Opus completed 14 prompts in 56.62s; Grok finished in 407.19s (7.19x). Both exited 0 with unchanged source SHA. Grouping alone fails the speed screen. Its first completed Grok calls took 134–193s, showing that smaller prompts do not reliably make the reasoning shorter. Grok recovered Cancel in this sample; that does not establish full quality parity.
-
-Prepared, not yet measured: a common concise-analysis instruction with a requested 1,500-token reasoning budget (a prompt request, not an enforced cap), and the supported Grok 4.6 variant at the same low effort. Both preserve the supplied review task and interface; neither is an accepted implementation.
-
-The concise-analysis screen ran sequentially under `screen-brief-critical`, after the grouped run finished. It supplied both models the same 12 files covering the verified seed defects and relevant API/validation/login helpers. No findings or expected answers were included in their prompts. Opus took 22.44s; Grok took 83.30s (3.71x), exceeding both the speed limit and the requested reasoning budget (5,777 and 8,231 reasoning tokens). Grok still missed verified defects and made a false claim that literal browser-side `ENV.fetch` exposed a server secret, so this is not a passing candidate.
-
-Executable adjudication checks now reproduce the date-filter boundary, scheduler missing-code acceptance, decimal subtotal truncation, and an actual rejected response-body read that leaves DirectDeposit saving indefinitely. The latter differs from the models' frequent false claim that ordinary fetch failures or invalid JSON omit `data`: the real API helper supplies `{}` or an error object for those cases.
-
-Next screen: `screen-cap4096-critical` applies the same 4,096-token response limit to both adapters, retaining the concise prompt and low effort. Grok uses the documented per-process `models.max_completion_tokens` overlay; Claude uses [`CLAUDE_CODE_MAX_OUTPUT_TOKENS`](https://code.claude.com/docs/en/env-vars). A cap-induced truncation is a failed review, not an empty success.
-
-Result: Opus 23.08s, Grok 82.85s (3.59x), both exit 0. Grok reported 8,266 and 4,394 total output tokens, including reasoning, despite the 4,096 setting. It is not an enforceable total-generation cap in this observed setup; no causal explanation is assumed. The candidate fails the speed screen.
-
-That documentation also shows `CLAUDE_CODE_EFFORT_LEVEL` overrides the CLI flag. The shared runner now explicitly sets the selected effort in the child environment. The regression test first failed with an inherited `high` value, then passed after the change. This workspace had no inherited effort or output-budget overrides, so prior measurements are unaffected. The source-review package remains at 100% coverage.
-
-The adapter now also rejects an explicit `max_tokens` stop from either CLI and Grok's `structuredOutputError`, even if its text happens to contain valid findings JSON. Regression tests demonstrated those incomplete responses were previously accepted. Package tests pass at 100% after the fix.
-
-Next: `screen-grok46-critical`, the same real-code sample with the supported Grok 4.6 variant, shared low effort and grounded instructions (without the ineffective response cap or concise-analysis request). Both adapters use a three-minute per-call timeout for this screen.
-
-Result: Opus 26.96s, Grok 61.24s (2.27x), both successful. Grok still missed the verified scheduler missing-code defect, Cancel, and the future-day boundary, so this does not pass quality. `screen-grok46-medium-critical` now tests the same variant/sample with medium effort for both models, preserving the same timeout.
-
-Medium result: Opus completed in 66.36s; Grok hit the three-minute per-call timeout and the command failed cleanly in 180.36s without publishing a partial review. This is a failed screening run. The timeout is shorter than 3x this new Opus time (199.08s), so it does not by itself prove the variant cannot meet the ratio with a longer timeout. The failed result is retained.
-
-## Focused targets with supporting source
-
-`screen-focused-context-critical` tests a documented combination: preferred 20 KB primary groups, up to 40 KB of deterministic supporting definitions/callers, and a shared system prompt that explicitly acknowledges omitted code. It uses Grok 4.6 and shared low effort. Retrieval uses only source identifiers and declarations, never benchmark findings or another model's answers. Every selected file remains a primary target; supporting files do not replace coverage. Primary grouping/UTF-8/line-number tests and provider/caller retrieval checks pass in the private overlay. Production packing remains unchanged while this is measured.
-
-Result: Opus 34.58s, Grok 120.61s (3.49x), both successful across seven prompts. Six Grok calls took 26–34s; DirectDeposit took 120s. Grok recovered the future-day boundary but still missed Cancel, the rejected-body-read defect, and scheduler missing-code acceptance. Its actual session confirms the new system text, low effort, and zero tools. This is not a quality pass.
-
-Next, `screen-focused-lenses-critical` keeps that source/context setup but performs three common discovery passes: security; state/correctness; and errors/recovery. This tests whether narrower tasks recover the missed defect classes. There is no model-to-model sharing and no expected findings in the prompts. All passes count toward elapsed time; this experiment has no automatic adjudication stage yet.
-
-Result: Opus 53.30s, Grok 116.84s (2.19x), both successful across 21 prompts. Grok recovered Cancel but still missed scheduler missing-code acceptance and the rejected response-body read. Opus also missed some seed defects in this run. The speed screen passes; quality does not. Next screen holds the three-pass pipeline and low effort constant and swaps Grok 4.6 for standard Grok 4.7.
-
-The standard Grok 4.7 three-pass screen failed its three-minute call timeout at 180.28s; Opus completed in 77.66s. No partial review was published. This cutoff is less than 3x the paired Opus time, so it is a failed bounded screen, not proof that the ratio is impossible with a longer timeout.
-
-Goal criterion 4 has been corrected from each Grok run reproducing the union of six Opus runs to equal three-run discovery frequencies per root cause. Grok must equal or exceed both initial and finalist Opus; finalist Opus must preserve its initial frequency. Every confirmed important reference bug remains mandatory. Six affected independent artifact-review lenses returned PASS; four unaffected results carry forward. Review: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`. No experiment is retroactively accepted.
-
-Next screen, `screen-trace-lenses-critical`, retains Grok 4.6, low effort, context retrieval, and three passes, but asks each shared pass to evaluate concrete guard values, state transitions, and deferred error propagation. These are general review procedures; no expected findings or other-model outputs are supplied. It tests the classes missed in prior screens.
-
-Result: Opus 62.41s, Grok 123.00s (1.97x), both successful. Grok covered all eight independently confirmed seed roots, including scheduler nil-equality acceptance and uncaught response-body rejection. Raw findings were 56 and 50; false-positive adjudication is not complete and this is not a full quality PASS.
-
-Full-source shape check: 1,346 selected files, 291 primary groups, 873 discovery calls, 51.8 MB of total prompt text across three passes, 58.8 KB median group including context. Packing took 11.57s. `pilot-trace-lenses-full` now measures the full repo sequentially with common jobs 48 and a five-minute per-call timeout. The machine has 128 GiB RAM; concurrency is explicitly recorded and shared. No verification stage or automatic semantic deduplication is present yet. This is a pilot, not a final validation batch.
-
-## User-approved reset from the side conversation
-
-The user explicitly approved revising the goal and resuming with cheap subset screening before bounded full-repo validation. The shared goal now freezes the earliest fresh full-repo Opus run (`baseline-full-opus-1`, 295.9862s), replaces the multi-run union/frequency requirements, and requires one-factor experiments. Grok must cover the frozen reference's verified important bugs, with no more false positives, and finish within 3x both the reference and a matched Opus run. Keep optimizing below that ceiling.
-
-Next steps for the main run: review the revised artifact; finish adjudicating this single reference and freeze the representative screening paths; implement and verify a whole-run timeout before another full-repo benchmark. The Grok full-run cap is 887.9586s or 3x the matched Opus time, whichever is lower. Timeout must cancel all model subprocesses, preserve logs, and fail the review without publishing partial coverage. Only candidates that pass the cheap quality/speed screen advance to a full-repo scorecard. Existing per-call timeouts do not implement this overall deadline.
-
-The side conversation edited only the goal and this handoff. It could not resume or change the persistent goal controller (`Goal tools require a persistent thread`). No benchmark was launched, cancelled, or claimed successful here. Prior artifact PASS verdicts do not cover this amendment; its review remains pending.
-
-The interrupted 873-call pilot stopped during Opus at 211.76s, exit 1, with no completed review; Grok never started. Observed CLI elapsed time far exceeded reported provider time at jobs 48. This failed pilot is retained and is not timing evidence for parity.
-
-The user-approved revised goal passed artifact review `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb` with zero blockers. Seven affected lenses re-reviewed; three unchanged lens results carry forward. Work is continuing manually following the user's resume instruction; the persistent controller still reports paused and exposes no agent-side resume operation.
-
-The benchmark harness now requires an overall deadline and launches each review in a private process session. Timeout kills all session process groups, including the separate groups created for model calls; premature output moves to failed-output. Three process tests passed (success/error exit, nested-group timeout preserving unrelated processes, and early-parent failure cleanup). End-to-end fake runs returned timeout exit124 at 0.89s for a0.8s cap and0.69s for the matched cap0.6s, retaining diagnostics and no completed output. Cleanup time is included; timeout runs always fail.
-
-The frozen screening manifest is `/tmp/metareview-grok-parity/frozen-screening.json`: 24 exact paths, retaining all prior critical targets and adding Swift, Ruby parsing and source helpers needed to reject known false positives. Screening cap:240s per Opus run; Grok is bounded by min(240s,3x matched Opus). No new model experiment has started under this reset. Frozen baseline identity is the earliest run; its source adjudication is still incomplete.
-
-The frozen subset's 27 original Opus claims have now been checked against source: 16 confirmed (12 important roots, four P3 items), 11 false positives. Evidence and root IDs are in `/tmp/metareview-grok-parity/screening-reference.json`. Checking the rest of the full reference continues; no full-repo quality PASS is claimed.
-
-Next hypothesis: the same three tracing checklists can run in one model call per source group, retaining coverage while removing repeated startup/context. `screen-combined-trace-fixed` changes only this call grouping from the prior trace-lenses candidate. Model/effort, primary grouping, retrieval and jobs8 stay fixed. It uses the frozen24 paths and verified overall cap240s (Grok also <=3x matched Opus). It cannot advance unless required subset roots are covered and false positives meet the comparison.
-
-Combined-call result: Opus56.97s, Grok92.65s (1.63x), both completed11prompts without timeout. Grok covers8/12 required subset roots; misses scheduler missing-code acceptance, iOS Cancel discarding edits, the weekend dashboard gap, and the ban parser extended-regex spaces. Candidate rejected on recall before further false-positive scoring.
-
-Next screen `screen-combined-medium-fixed` changes only shared effort from low to medium. Earlier medium screening lacked the focused context and concrete tracing instructions, so this is a new configuration. Frozen24paths, jobs8, cap240s, Grokalso<=3x matched Opus.
-
-Medium effort: Opus82.26s; Grok exceeded240s and failed. Cleanup raised PermissionError before saving the result; an immediate follow-up verified the private session82280 had no live children. Exact total elapsed was lost, so the reconstructed failure records elapsed>=240s, not an invented time. No completed output was accepted. The harness now deduplicates process-group signals, tolerates an exited-group race only after verifying no live members, and saves cleanup failures as failures. Five timeout tests pass after reproducing both missing cases.
-
-Next `screen-focused-fixed` changes the combined low-effort candidate into three focused calls using the same checklist content and exact packed source bodies. This controls the earlier promising three-pass result on the full frozen24-file sample; no full run follows until recall and false positives pass. Other settings and overall limits are unchanged.
-
-Focused fixed-sample result: Opus84.34s/79raw findings; Grok190.17s/81raw findings (2.25x),33calls each. Grok recovers iOS Cancel but still misses scheduler missing-code acceptance, weekend filtering and extended-regex spaces:9/12required roots. Recall fails; no full run and no claimed false-positive pass.
-
-Next `screen-focused-wide-fixed` changes only preferred primary grouping20KB->80KB, retaining40KB supporting-context ceiling within120KB total, three tracing passes, low effort, Grok4.6 and jobs8. This tests fewer repeated calls and more coherent local source; the earlier larger-group trial lacked this model and focused procedure. Frozen sample/deadlines stay fixed.
-
-115of293 frozen full-reference claims have now been independently source-adjudicated. Reference verification remains incomplete; that does not change the fixed sample or mandatory bugs.
-
-Wide-group result: Opus43.18s/39raw findings, Grok83.10s/43raw findings (1.92x),9calls each. Grok finds7/12required roots; misses scheduler MFA, iOS Cancel, weekend gap and both ban-parser roots. Speed improves but quality regresses, so no full run.
-
-Next `screen-focused-wide-fast-fixed` changes only Grok model4.6->4.7-build-fast. The common three-pass procedure, larger groups, low effort, frozen sample and limits are identical. This revisits the fast variant with the newer review procedure, not the earlier failed whole-repo configuration.
-
-Fast-model result: matched Opus38.62s; Grok4.7-build-fast timed out at115.996s with deadline115.868s (3x matched). Cleanup succeeded and no partial result was published. No quality pass.
-
-Next `screen-verified-fixed` returns to the combined low-effort control and changes one factor: adds a same-model verification pass for each source group. It receives its own provisional draft and the same source, checks unsupported claims, and searches for omissions; only its final replacement findings are published. This addresses measured false assertions, duplicate claims and missing roots, without cross-model answer sharing. Raw drafts are retained separately as provisional evidence. Every stage counts toward elapsed time; failed/malformed verification fails the run. Other settings and frozen24paths remain unchanged.
-
-Verification-pass result: Opus85.84s, Grok169.92s (1.98x),22calls each. Grok still misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. Recall fails; no full run. The additional pass does not justify its cost.
-
-Reference correction: B1-65 (Kaiser fractional adjustment) is false-positive. Earlier arithmetic reproduction did not establish reachable input: the production builder converts to Integer, the preview uses70, and draft edits permit integers only. Evidence and superseded adjudication are retained. The fixed subset now has11 important roots, four P3 claims and12 false positives. All prior candidates still fail the same recall gaps; each candidate that reported the Kaiser claim loses one true match and gains a false claim. The verification candidate finds7/11. Paths and reference run are unchanged.
-
-Next screen `screen-focused-wide-medium-fixed` changes only shared effort low->medium from the wide three-pass Grok4.6 control. Fewer concurrent groups may allow deeper reasoning within the bounded screen where medium with11 groups timed out. Same frozen24paths, jobs8,240s overall cap and Grok<=3x matched Opus.
-
-Wide-group medium result: Opus87.24s, Grok timed out at240.10s, cleanup successful. Three completed Grok calls took197-208s; not all9 completed. No output accepted and no full run.
-
-Next `screen-focused-grok45-fixed` changes only Grok4.6->supportedGrok4.5 from the20KB,three-pass,low-effort control. That control had the best fixed-sample recall so far (8/11 after the evidence-based correction), but missed three required roots. Same frozen paths, jobs8 and bounded240s/3x screen; no model gets expected answers.
-
-Grok4.5 result: Opus101.99s; Grok timed out at240.12s with successful cleanup. First completed calls were91-145s; not all33calls finished. This bounded screen fails and provides no completed quality result.
-
-Next `screen-focused-audit-fixed` changes the shared response procedure from the low-effortGrok4.6 three-pass control: each call must provide concise concrete check results per primary file before final findings. It adds no calls or models. Audit notes remain private; published findings retain the existing contract. Schema and instructions are identical between providers, all primary files must have nonempty check notes or the call fails, and grouping uses the prior header length to preserve primary membership. Five experimental validation cases passed after missing/empty/malformed audit cases failed against the initial stub. Frozen24paths, jobs8 and240s/3x limits remain unchanged.
-
-The audit Opus run completed in115.95s. A cosmetic pair-harness edit introduced an indentation error before Grok could start; no Grok subprocess launched. Two mock orchestration regressions reproduced the missing matched-time handoff and failed-run stop defect, then passed after correction. The already completed Opus measurement remains valid; Grok is being launched sequentially with its exact matched time and the original240s cap. No model inputs or candidate code changed between the pair.
-
-Audit result: Opus115.95s/48raw findings, Grok231.50s/72raw findings (2.00x),33calls each. Grok now covers9/11required roots, recovering MFA and weekend filtering but missing iOS Cancel and extended-regex spaces. False positives remain; no full run.
-
-Next screen `screen-focused-function-audit-fixed` changes only audit granularity: every source-detected declaration plus each file's top-level executable code gets an explicit audit entry, generated from source without expected findings. Same model, low effort, grouping, three passes, context, jobs and frozen paths. Validator rejects missing items. Experimental packing is not yet suitable for full-repo promotion.
-
-Function-audit result: Opus failed at65.53s because one required function audit was absent; validation rejected the result, cleanup succeeded and Grok never started. Next `screen-focused-function-map-fixed` changes only the audit representation to an object whose source-generated keys are individually required by the common schema. The procedure, source, model and caps remain the same. This tests reliable checklist completion without retries.
-
-All293 frozen reference findings have now received an initial source adjudication. Earlier counts included two separately tracked false components; the actual item count before this batch was277/293. Root deduplication and mixed-claim FP accounting still need consolidation before a final scorecard. No benchmark pass is inferred from completion of this ledger.
-
-Required-map audit result: Opus150.25s/50raw findings; Grok timed out at240.11s after28of33prompts, with successful cleanup. Required schema keys prevented the earlier omission failure in completed calls, but this screen is a time failure and partial findings are not accepted. Next `screen-combined-function-map-fixed` changes only call grouping: the same three checklists run together in one call per primary group, retaining mandatory per-declaration audits. Frozen24paths, model4.6,loweffort,context,grouping,jobs8 and240s/3x limits remain unchanged.
-
-Raw-response reconciliation found four additional baseline claims rejected by the original parser because valid directory names contained literal double dots. All four describe the same verified P3 generated-coverage clutter, not important functional bugs. Baseline:297raw claims,293published findings; initial root ledger has77important and80P3roots. The77important-root target is unchanged by these parser-skipped claims. The existing parser correction accepts these literal names while still rejecting parent-directory traversal.
-
-Combined mandatory-audit result: Opus87.04s/29findings; Grok112.28s/34findings (1.29x),11calls each. Grok covers7/11required roots and misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. The extra function-level output does not improve recall over ordinary combined calls. Candidate rejected; no full run.
-
-Next `screen-focused-semantics-fixed` changes only the correctness checklist of the best9/11 per-file-audit control. It explicitly asks for concrete parsing/pattern examples under actual language semantics and UI-event state comparisons. These are general procedures, with no benchmark answers, source-specific names or model-produced findings in the prompt. Same three passes,20KBprimary/40KBcontext,model4.6,loweffort,jobs8 and frozen screening limits.
-
-Adjudication consistency correction: B1-52 is a real configuration-dependent SQL day-boundary bug. ActiveRecord with this app's :local setting serializes Friday18:00Pacific to Saturday01:00 on a UTC host; :local alone did not disprove the claim. The important reference now contains78roots. Separately retained three disproved factual components from mixed claims (weekday parser example, unchanged fractional input validity, and alleged deletion of merged bytes). These corrections are source-driven and do not change screening paths or its11required roots.
-
-Semantics-checklist run: Opus213.66s/45findings; Grok stopped at206.69s when the experimental audit validator rejected malformed JSON text. Inspection shows a restarted, complete trailing JSON object exactly equal to the CLI structuredOutput, with the required file audit and an actual empty security-pass findings array. The existing production extractFindings parser already handles this case; the new audit validator incorrectly bypassed it. Next `screen-focused-semantics-normalized-fixed` changes only audit validation to use the same extraction before checking file coverage. Complete-restart, unfinished-restart and missing-coverage regressions cover this repair. Model inputs/settings/deadlines remain unchanged; the failed run is not relabeled a success.
-
-Normalized semantics result: Opus123.05s/46findings; Grok234.00s/75findings (1.90x),33completed calls. Grok covers8/11required roots: Cancel is recovered, but MFA, weekend filtering and extended-regex spaces are missed. No quality pass or full run.
-
-Next `screen-focused-wide-medium-jobs16-fixed` changes only concurrency8->16 from the earlier wide-group,medium-effort,Grok4.6 trial. The frozen subset has9calls, so all can start in one wave. That earlier configuration timed out before completing its queued ninth call; higher concurrency tests whether medium reasoning fits the bound without changing either model's task. Reuses the exact existing binary, same24paths and240s/3x cap.
-
-Wide-medium jobs16 result: Opus97.52s/61findings; Grok timed out at240.11s with clean cancellation, only4of9calls completed (157–231s). Removing the queued ninth call did not make medium effort fit this bound.
-
-New packing hypothesis: source-review's120KB byte cap is much smaller than the documented model context windows: [Grok4.6,500Ktokens](https://docs.x.ai/developers/models/grok-4.6) and [Opus5.5,1Mtokens](https://platform.claude.com/docs/en/models/opus-5-5/overview). These API capabilities do not guarantee the CLI accepts every large prompt; errors remain failures. `screen-focused-large-fixed` changes only source packing capacity from the normalized-semantics low-effort control:1MBtotal,960KBpreferred primary instead of20KB, same40KBsupport limit. The fixed24files fit one shared source batch and retain all three passes. Model4.6,loweffort,jobs8,schema,checklists and240s/3x cap stay fixed. This is an isolated source-review experiment; diff-gate120KBsharding is unchanged. A packing check verifies complete original numbered bytes beyond120KB and the new hard byte bound.
-
-Large-batch low-effort result: Opus52.84s/14findings; Grok108.96s/19findings (2.06x),3calls. Both CLIs accepted the complete sample (Grok about60.6Kinput tokens/call), but Grok found only5/11required roots. Opus also missed several. Large context at low effort loses recall; no full run.
-
-Next `screen-focused-large-medium-fixed` changes only shared model reasoning effort to medium from that large-batch control. The3-call shape tests whether deeper reasoning can use the broader source context effectively. The declared measurement safety bound is300s per run with5m call timeout; Grok remains capped at3x matched Opus. This extra minute cannot turn a >3x result into a pass, and it does not change the completed control measurements. Source, prompts, stages, schema, jobs8 and frozen24paths are unchanged.
-
-Large-batch medium result: Opus149.35s/25findings; Grok timed out at300.10s with clean cancellation and no completed review. Deeper reasoning still exceeds the cheap-test bound.
-
-Next `screen-focused-large-fast-fixed` changes only Grok model4.6->4.7-build-fast from the completed large-batch low-effort control. Larger batches now need just3calls, so this tests the stronger fast variant without the earlier queued calls. Shared loweffort,source,checklists,per-file audits,schema,jobs8 and3x comparison stay fixed. Bound240s,calltimeout4m as in the completed loweffort control.
-
-Large-batch fast result: Opus47.22s; Grok timed out at141.77s (3x matched deadline141.66s), cleanup successful. No partial result accepted.
-
-Next `screen-focused-file-results-fixed` returns to the large-batch Grok4.6 low-effort control and changes only response organization: each primary file has its concrete checks immediately followed by its own findings. The same existing eight-field findings are flattened deterministically for publication. This tests an observed omission: the prior Grok audit described the inactive-alias crash but left it out of its global findings array. No expected findings or other-model answers enter the prompt. Source, three checks, effort, jobs8 and240s/3x limits stay fixed. Missing file coverage, malformed entries, or incomplete JSON still fail.
-
-Per-file findings result: Opus56.55s/15findings; Grok failed at75.35s because its audit changed a primary path (`direct_deposit_controller.rb` to `direct_deposit/controller.rb`). Coverage validation correctly rejected the run; cleanup succeeded. Next `screen-focused-file-map-fixed` changes only the response representation to a map with exact primary paths as individually required schema keys. It retains per-file checks followed immediately by findings, without extra calls. Same source, model4.6,low effort, three passes and bounded comparison.
-
-Exact-file-map result: Opus83.65s/19findings; Grok117.16s/33findings (1.40x),3calls. Required file keys worked, but Grok covers only6/11important roots; misses both dashboard bugs, both ban-parser bugs and iOS Cancel. False claims remain; no quality pass or full run.
-
-Next `screen-focused-wide-medium-extended-fixed` reuses the exact prior wide-medium binary at jobs16. This is a measurement-bound change, not a claimed optimization: the prior run stopped at the240s screening safety cap although 3x matched Opus allowed292.57s, with calls completing at157–231s. The new declared cap is360s/6m, always further limited to3x the freshly matched Opus time. This tests whether the cheap-test safety cap censored a configuration that can satisfy the actual goal. No source, model4.6, medium effort, three checks, grouping, schema, or concurrency changes; no additional stages. All failures retained.
-
-Reference mixed-claim audit: split two independent important causes already present in the frozen output (legacy BG waiver-copy omission and course-load stale error) from their neighboring claims. Required whole-repo roots80; the fixed sample remains11. Also retained the dashboard-test timezone overgeneralization as a separate false component (UTC+2 disproves it), and corrected the adjudicator's mistaken claim that ComplianceSign submit checks canSubmit. Reference unique false roots109. These are source-driven accounting corrections, not discoveries added from later model runs. Final audit remains in progress.
-
-Extended medium result: Opus85.34s/52findings; Grok timed out at256.14s against256.03s matched limit, with2of9calls complete. Cleanup succeeded. The actual3x requirement, not the screening safety cap, now rejects this configuration.
-
-Next `screen-focused-all-context-fixed` returns to the normalized-semantics Grok4.6 low-effort control (33calls) and changes supporting-context retrieval. Frozen24primary paths/grouping stay fixed; helpers can now come from all selected first-party source at the same pinned commit, and explicit Ruby partial names match underscored template filenames. Source-derived dependencies only, no handpicked expected answers. This addresses observed false claims about omitted caller validation and shared UI handlers. Same three passes, per-file audit,40KBsupport bound and jobs8. Screening cap360s/6m and Grok<=3x matched, following the declared extended bound; no full run without quality.
-
-Supporting-context preflight caught another retrieval problem: raw identifier overlap crowded out an explicitly rendered helper even after making it available. Explicit quoted source references now outrank incidental matches, including Rails partial path normalization; no benchmark-specific path is in the retrieval implementation. Synthetic dependency/primary-scope checks and pinned-source manifest verification pass with24primary files and11source groups.
-
-Dashboard adjudication reproduced the actual view script plus shared table-search script in jsdom with the actual jQuery3.7.1. Initial `mode=future` hides the boundary day; clicking Future after ready shows it because the shared keyup handler replaces the filter. Clear shows weekend rows, and a Saturday text search works. The midnight root remains confirmed for reload/bookmarked future mode; its trigger is narrower than earlier isolated-expression evidence. The weekend preset gap remains present, with the Clear/search workaround explicitly recorded. [jQuery3 ready callbacks are asynchronous](https://jquery.com/upgrade-guide/3.0/#breaking-change-document-ready-handlers-are-now-asynchronous).
-
-Retained the original Future-button overstatement as a separate false component after the full DOM reproduction, rather than quietly narrowing the claim without FP accounting. Whole-repo reference remains80important roots; unique false roots110. Future-midnight matching must preserve the real initial/reload trigger, and analogous overstatements in finalist claims must be counted consistently.
-
-All-source supporting-context result: Opus137.25s/47findings; Grok227.15s/83findings (1.65x),33calls. Grok covers10/11required roots, the best recall so far; only extended-regex spaces remains missing. Cancel is identified through retained change flags. Multiple false/mixed claims remain, so no quality PASS or full run.
-
-Next `screen-focused-mixed-effort-fixed` changes one shared policy from this10/11control: correctness calls use medium effort; security and reliability keep low. Both models receive the identical per-stage effort policy. The remaining recall failure concerns exact language semantics, which deeper reasoning has recovered in other comparisons; increasing only that existing pass limits the extra time. No added stages or expected answers. Same source, supporting-context retrieval,33calls,per-file audit and jobs8. Declared360s/6m cap, further limited to3x matched Opus.
-
-Prepared, not yet benchmarked: stronger priority for directly referenced type definitions over generic method-name overlap. The10/11control's auth group omitted AuditTrail despite a direct AuditTrail call, while including unrelated methods with matching names; Grok consequently repeated a false claim that the audit stores full SSNs. A synthetic tight-budget regression reproduced the omission, then passed with type-reference weighting. The pinned-source manifest now includes AuditTrail; explicit rendered partials and all24primary targets remain covered. This preparation does not change the running mixed-effort benchmark or count as a measured improvement.
-
-Mixed-effort result: Opus169.02s/60findings; Grok timed out at the360s screening cap with clean cancellation. This cap is lower than3x matched Opus (507.07s), so it proves a failed bounded screen, not an intrinsic >3x ratio. One completed medium call took329s; several queued correctness calls remained unfinished. A reversed citation953..328 was rejected in the partial output and retained in diagnostics. No complete Grok output or quality score is accepted.
-
-Next `screen-focused-type-context-fixed` tests the prepared direct-type context priority from the completed10/11 all-context low-effort control. Only retrieval weighting changes; same33calls,primary groups,support byte limit,audit,model4.6,low effort,jobs8 and360s/3x cap. This specifically addresses the observed omission of called class definitions behind false claims; no handpicked source file or benchmark answer is inserted.
-
-Direct-type context result: Opus178.71s/50findings; Grok269.30s/73findings (1.51x),33completed calls. Grok covers8/11required roots, missing scheduler MFA, weekend filtering and extended-regex spaces. The full-SSN audit claim is absent, but other false claims remain and recall regressed. No full run.
-
-Next `screen-focused-declaration-audit-fixed` changes audit granularity from the best all-context low-effort control: every source-detected declaration, constant and file top level receives a required concise concrete-check entry. Short generated IDs avoid repeating long paths in output. Both models get identical source-generated inventory and schema; no expected findings enter prompts. Same33calls,24primary paths,context retrieval,model4.6,loweffort,jobs8 and360s/3x cap. Synthetic inventory/normalization checks passed; this experimental packing needs hardening before any full-repo promotion.
-
-Source-adjudication correction: the frozen reference already reported repeated invoice subtotals in Kaiser, Generic and Sutter templates (B1-66/72/86). Earlier dismissal traced production batch sorting but missed the separately routed preview actions, which order only by start_at. Rendering each actual ERB template with synthetic A,B,A chronological rows reproduces two full A subtotals; A,A,B renders one. All three have the same P2 financial-display impact (including B1-86 originally labeled P3). Required reference now83important roots; unique false roots107. The unchanged24-file sample now requires14roots. The best all-context result covers13/14; direct-type context covers11/14. Both still miss extended-regex spaces; no past failed candidate becomes a pass. Superseded adjudication and scorecards are retained.
-
-Production adapter/parser verification repeated in the current workspace: `go test ./internal/sourcereview -coverprofile=...` passed with100%statement coverage; `git diff --check` passed. These checks do not establish benchmark quality or task completion.
-
-Declaration-audit result: Opus142.68s/59findings; Grok247.78s/82findings (1.74x),33calls. Grok covers10/14important roots; misses scheduler MFA, iOS Cancel, weekend filtering and extended-regex spaces. Required audit entries do not guarantee accurate evaluations: both models explicitly mis-evaluate the same regex despite noting its modifier. More checklist output regressed recall. No full run.
-
-Next `screen-focused-literal-normalization-fixed` returns to the best13/14 all-context control and changes only one correctness instruction: write the interpreted literal/pattern after escapes and modifiers, then evaluate examples against that form instead of its visual spelling. This addresses the observed incorrect audit evaluation, without source-specific examples or expected findings. No extra pass or schema expansion. Same24paths,33calls,model4.6,loweffort,jobs8 and360s/3x cap.
-
-Prepared (not benchmarked) selective-effort fallback: retain the best all-context prompts and use medium only for correctness groups whose primary source has an extended-mode pattern literal; all other calls stay low. This is a source heuristic shared by both adapters, with no target paths or expected findings. Tests first rejected the old all-correctness-medium policy, then passed for primary-only classification and CLI/environment agreement. A model-free full-source packing preflight selected all1346files into291groups/873calls, with only3correctness calls classified medium and no missing primary headers. No performance or quality gain is inferred from this preflight.
-
-Literal-normalization result: Opus141.93s/45findings; Grok229.34s/71findings (1.62x),33calls. Opus recovered the regex defect at low effort, but Grok still mis-evaluated the interpreted form. Grok covers11/14required roots, missing scheduler MFA, weekend filtering and extended-regex spaces. No quality pass or full run.
-
-Next `screen-focused-pattern-effort-fixed` runs the prepared selective-effort policy from the best all-context control, without the unsuccessful literal-normalization instruction or declaration audit. Only correctness groups with an extended-mode pattern literal in primary source use medium; other calls use low. Identical policy for both adapters. Same24paths,33calls,context,jobs8. Declared bounded screen480s/8m, still capped at3x freshly matched Opus; this larger safety bound avoids prematurely censoring the single medium call like earlier360s mixed-effort measurement. It cannot turn a >3x measurement into a pass.
-
-Selective-pattern-effort result: Opus161.31s/47findings; Grok451.39s/72findings (2.80x),33calls. The single medium call took318s and still missed extended-regex spaces. Grok covers11/14required roots, also missing weekend filtering and iOS Cancel. Extra reasoning at this granularity did not recover the target. No quality pass or full run.
-
-Next `screen-focused-all-context-fast-fixed` changes only Grok4.6 to4.7-build-fast from the best all-context low-effort control. Earlier fast-variant trials lacked the improved context/audit setup, or used large batches with poor recall. This tests the stronger variant with the best current shared setup and enough bounded time for all33calls. Same24paths,prompts,schema,loweffort,context,jobs8. Cap480s/8m and3x matched Opus. Actual fast-variant IDs and failures remain recorded; no change to production default.
-
-All-context fast-variant result: Opus129.44s/52findings; Grok timed out at388.41s against388.31s (3x matched), with clean cancellation. No complete Grok output or accepted quality score. Diagnostic calls retained.
-
-Fast-variant diagnostics: the completed correctness call correctly reports extended-regex spaces and the iOS call reports Cancel state. Those are observations from a failed run, not a quality score; the completed dashboard calls still miss the weekend preset gap. Next `screen-focused-all-context-fast-jobs16-fixed` changes only concurrency8->16, retaining the exact binary and shared inputs. The previous run had started all33calls and completed25at323s, leaving queued work before its388s limit. This tests whether additional parallelism makes the stronger variant practical. Same480s/8m safety cap, always3x freshly matched Opus.
-
-Prepared, not benchmarked: linked supporting-context retrieval replaces generic method-name overlap with explicit source references, named/qualified types, reverse filename references to callers, and up to three dependency steps. Templates contribute executable ERB/script references, not human headings: the old picker treated the heading Invoice as a reference to the unrelated Invoice model, feeding the private-method false claim. Synthetic tests reproduced missing receiver context and this heading mistake before the repair, and now pass along with byte-budget/primary-source checks. Dotfiles no longer all alias the literal dot. The pinned sample now includes AuditTrail for auth, preview callers for all invoice templates, and the actual public-method parent for Sutter. Same40KBsupport cap and unchanged24primary files/11groups. This is a private experimental overlay; no measured quality gain is claimed.
-
-Fast-variant jobs16 result: Opus124.25s/48findings; Grok303.04s/80findings (2.44x),33completed calls. First complete screen covering14/14required roots. Several false/mixed claims remain, including omitted audit redaction, a wrongly resolved private method, and a disproved alias example. Recall and timing pass alone do not establish quality; source FP adjudication and a complete full-repo pair are still required. No full run yet.
-
-Next `screen-focused-linked-context-fast-fixed` changes only supporting-context retrieval from the completed14/14 fast/jobs16 control. It uses the tested source-reference/type/caller graph, template-aware reference extraction, qualified Ruby type resolution and a bounded inheritance preference instead of incidental method-name overlap. Same24primary files,11groups/33calls,40KBsupport cap,prompts,audit,schema,model4.7-build-fast,loweffort and jobs16. Both adapters receive identical selected context. Declared480s/8m cap, further limited to3x matched Opus. The hypothesis is fewer false claims about omitted guards or wrongly resolved receiver methods while retaining recall.
-
-Mixed-claim accounting correction: an additional actual-script Saturday reproduction shows Same Day includes Saturday. B1-34 correctly identifies the preset gap (both weekend days on Friday; Sunday on Saturday), but its consequence overstates Saturday self-exclusion. Keep the real P2 root and count the false component separately, consistently with candidate claims. Reference remains83important roots and14sample roots; unique false roots108. This does not turn an earlier recall failure into a pass.
-
-Linked-context result: Opus107.64s/52findings; Grok249.69s/92findings (2.32x),33completed calls. Grok retains14/14required roots, and the earlier bank-redaction/private-Sutter-method/raw-date-injection false claims disappear. Other false claims remain, including misresolved inherited API authentication and a hypothetical truthy :expired caller despite the actual caller using == true. Larger raw count is not a quality improvement. No quality PASS or full run; per-claim FP adjudication remains necessary.
-
-Next `screen-focused-linked-verified-fast-fixed` adds one same-model verification stage to the completed linked-context14/14 control. False claims persisted after improving source context, so each model now checks its own draft against the identical original source, traces reachable callers and narrows mixed claims before publishing. No reference answers or other-model output enter prompts. Empty drafts need no second call; drafts with parser-skipped claims are still verified. Final audit/parse failures fail the run. Same24paths,primary packing,context,schema,model4.7-build-fast,loweffort and jobs16. All stages count in elapsed time; bounded screen600s/10m, further limited to3x freshly matched Opus. The larger safety bound accommodates the measured extra stage but cannot turn >3x into a pass. Focused tests cover both adapters, removing/retaining findings, empty drafts, invalid draft citations, final coverage failure and bounded source-plus-draft prompts; passed. No production promotion or full run yet.
-
-Mixed-claim audit correction: the actual MfaAuthentication concern sets both client_id and mfa_code cookies with the same ten-minute lifetime. A fixture loading that concern confirms that deleting only the code cookie permits nil==nil with a resolved identity, while waiting for both to expire leaves no login_object and is rejected. The important scheduler-MFA root remains; the original frozen claim's alternative expiry-only bypass is separately false. Reference remains83important roots/14sample roots; false roots109. Apply this distinction to finalist claims as well. This correction does not turn any failed candidate into a pass.
-
-Per-draft verification result: Opus226.35s/41final findings (33discovery+25verification calls); Grok378.64s/68final findings (33+28calls),1.67x. Shared discovery prompt hashes match exactly. Grok covers11/14required roots, missing browser ENV.fetch, weekend filtering and extended-regex spaces; those were already absent from its discovery drafts, so this trial does not establish that verification removed them. False claims remain, including a nonexistent truthy :expired caller and external e-badge URL, despite verification. Mixed factual errors are retained in the partial ledger; all remaining claims are unresolved. Reject on recall, no full run. The extra step is not promoted.
-
-Prepared next context repair from the faster completed14/14 linked-context control: resolve named types relative to Rails namespaces, honor explicit root ::, retain acronym directories, and retrieve actual consumers of named classes/modules. The current auth pack omitted LoginController and Api::V1::ApplicationController, directly causing false statements about login result checks and inherited authentication. Synthetic tests cover both distinctions and ensure context caching cannot change later prompts. The unchanged40KBsupport budget now includes both real callers/parents in the pinned auth group. This is source-derived retrieval, with no expected answers or path-specific exception. No extra model stage.
-
-Next `screen-focused-scoped-context-fast-fixed` tests that namespace/consumer context repair as the sole changed factor from `screen-focused-linked-context-fast-fixed`. It returns to33discovery calls without the unproven verification stage. Same24primary files,source groups,40KBsupport limit,instructions,audit,schema,Grok4.7-build-fast,sharedloweffort and jobs16. Declared480s/8m safety bound and Grok<=3x freshly matched Opus. Focused retrieval/audit tests and pinned auth-context checks pass; no measured quality improvement yet.
-
-Namespace/consumer context result: Opus75.93s/46findings; Grok timed out at227.90s against227.80s (3x matched Opus), with25of33calls complete and clean cancellation. No complete Grok output or accepted recall/FP score. Completed auth diagnostics no longer invent the truthy-expired caller or miss the inherited API guard. Slow calls are still provider reasoning: completed calls reach207–225seconds despite low effort, with thousands of reasoning tokens. Increasing jobs alone would not shorten those already-running calls, and would also tighten the matched Opus deadline. No full run.
-
-Next `screen-focused-small-batches-fast-fixed` changes preferred primary batch size20KB->10KB from the namespace-aware control. The longest completed Grok calls spend207–225seconds/21K–23Kreasoning tokens on groups containing several primary files, versus Opus under48seconds. Smaller primary groups test whether reducing the number of operations per call limits this reasoning cost and preserves recall. Whole files are retained when larger than the preference; the hard prompt budget120KB and support limit40KB remain. Same24paths,context selection,three passes,audit,schema,Grok4.7-build-fast,sharedloweffort,jobs16; no new review stage. Declared480s/8m safety bound, always capped at3x fresh matched Opus. Tests verify each frozen primary path appears exactly once in the source groups, along with scoped caller/parent retrieval and prompt bounds.
-
-Smaller-batch result: Opus206.96s/63findings; Grok429.22s/106findings (2.07x),48calls each. Grok covers12/14required roots, missing the weekend gap and iOS Cancel's unsaved-field/flag restoration (the different pending-check banner claim does not substitute). Many false claims remain. Dashboard/layout separation also loses the global keyup helper from the dashboard context, causing false Clear-button reports. Reject: more calls and longer absolute Grok time without sufficient quality. Opus startup/waiting varied substantially: some calls spent about100seconds outside the reported API duration; the ratio alone is not an optimization result. Aggregate host inspection showed substantial existing memory use from other processes, so high-concurrency full runs need capacity checks rather than assuming all128GB is free.
-
-Next `screen-focused-scoped-context-main-fixed` returns to the20KB namespace-aware control and changes only the Grok variant from4.7-build-fast to standard4.7. The earlier standard4.7 test used the old smaller sample without per-file audits/current caller context and stopped at180seconds, below its233second matched limit, so it did not establish impossibility. This tests the stronger standard variant with corrected source links and the current bounded protocol. Same24paths,33calls,three passes,audit,schema,sharedloweffort,jobs16 and480s/8m safety bound, further limited to3x freshly matched Opus. Model-ID and focused retrieval/audit tests pass. No API keys, tools, extra stages or production-default change.
-
-StandardGrok4.7 result: Opus146.92s/48findings; Grok438.81s/91findings (2.987x),33completed calls. It narrowly meets the paired time ceiling but covers13/14required roots, still missing the weekend preset gap. Multiple false/mixed claims remain, including Kaiser active-scope omission, unsupported fractional adjustments and treating literal ENV.fetch as ERB interpolation. Reject on recall; no quality PASS or full run. Standard4.7 offers no demonstrated improvement over the faster14/14 control.
-
-Next `screen-focused-split-correctness-fast-fixed` changes review-pass granularity from the20KB namespace-aware fast control. The existing correctness checklist is split into two independent passes: value/language semantics and state transitions; its substantive checks are unchanged. Security and reliability stay as before. Across completed runs the combined pass inconsistently recovers arithmetic/pattern/time issues and Cancel state, while reducing primary batch size lost global context. A separate focus tests that measured failure without shrinking source context or adding reference answers. This makes44calls over the same11groups instead of33. Both models use the identical four-pass procedure, per-file audit, source/context, schema, sharedloweffort and jobs16. ModelGrok4.7-build-fast. Declared480s/8m safety bound and Grok<=3x freshly matched Opus. Focused context/audit checks pass; no production promotion.
-
-Split-correctness result: Opus106.37s/68findings; Grok timed out at319.19s against319.10s (3x matched), with41of44calls complete and clean cancellation. No completed quality score or full run. A first-wave reliability call still took307seconds, so more focus alone did not remove the long reasoning tail.
-
-The supporting-context picker had two concrete ranking problems: a doubled inheritance preference exactly cancelled distance decay, allowing an ancestor to displace the actual receiver; and a file mentioning its own filename diluted the weight of its real callers. Synthetic regressions fail under the old picker and pass after stronger distance decay and excluding already-primary files from caller normalization. The actual dashboard context now includes Assignment::Interpretation, whose query was omitted while its ancestor was included. No target path or expected finding is special-cased in the implementation.
-
-Next `screen-focused-near-context-fast-fixed` tests that context-priority repair as the sole changed component from the four-pass control. Same24primary files,11groups/44calls,40KBsupport limit,120KBhard bound,existing check content,audit,schema,Grok4.7-build-fast,sharedloweffort and jobs16. Bound480s/8m and Grok<=3x fresh matched Opus. The hypothesis is fewer unsupported assumptions and less wasted reasoning when the actual receiver and callers outrank distant inherited code. Focused retrieval/audit tests pass. No production promotion.
-
-Near-context result: Opus194.10s/71findings; Grok393.01s/114findings (2.025x),44calls each. Grok covers13/14required roots, missing the gap across all three weekend presets; reporting the separate ignored-date query bug does not substitute. False claims remain, including attr_reader failing to read its instance variable, Rails before_action halting on false, and unreachable fractional Kaiser adjustments. No quality PASS or full run.
-
-Next `screen-focused-group-verified-fast-fixed` changes one stage from the near-context four-pass control: a same-model final verification per source group sees all four provisional passes together, checks claims and contradictions, and checks omissions. The earlier per-draft verifier could not compare independent passes and explicitly prohibited adding missing issues. This targets measured false claims and the missing condition-set gap, using only generic source-review procedures; no reference answers or other-model findings are supplied. Both models use the same procedure. Same24paths,11groups,44discovery+11final calls,source/context,model4.7-build-fast,loweffort,jobs16. Source-plus-drafts hard bound240KB; invalid or missing audit fails the run. Raw parser-skipped draft claims remain available to verification. Declared600s/10m safety bound, always capped at3x fresh matched Opus; all55calls and both stages count. Focused tests passed for both adapters, preservation of all raw drafts/source, supported retention, removal, omission recovery, invalid citations, empty drafts, malformed final audits and bounded inputs. No production promotion or full run.
-
-Group-verification result: Opus260.30s/36findings; Grok506.13s/58findings (1.94x),55calls each. Discovery prompt hashes match the previous near-context control. Grok covers13/14required roots: the weekend gap was already present in discovery and survives, but verification removes the real future-day-midnight defect. False language/API claims survive, including locale-sensitive default Swift uppercasing and successful iOS save despite errors in an HTTP200 body. Reject on recall; no quality PASS or full run. Opus final claims have33confirmed,1false and2unresolved UI-lifecycle claims; all unresolved claims still block a final quality verdict. An actual-source JavaScript fixture confirms the rejected response-body read escapes the API helpers and leaves calling UI state stuck.
-
-Next `screen-focused-wide-verified-fast-fixed` changes preferred primary batch size20KB->80KB from group-verification control. The current55-call sample is too costly to scale comfortably, and repeated passes still miss guards spread across source groups. Larger batches now retain per-file audits, corrected source-reference context and group verification, which the earlier wide fast-model trial lacked. This tests fewer calls plus more co-located source, with no new check or stage. All24frozen primary files appear exactly once in3source groups:12discovery+3verification calls instead of55. Same120KBdiscovery hard bound,40KBsupport cap,240KBsource-plus-drafts bound,Grok4.7-build-fast,sharedloweffort,jobs16 and600s/10m safety bound; Grok is always capped at3x fresh matched Opus. Context/audit/verification tests and exact sample coverage/bounds checks pass. No production promotion or full run.
-
-Wide-batch verification run: Opus failed at82.20s when the coverage validator found omitted primary-file audits; cleanup succeeded and Grok never started. The affected call returned only the first file audit and omitted five required files. No partial review is accepted. Next repair changes only audit representation from a free array to an object with each actual primary path required in the shared JSON schema. This is the same coverage procedure and source; the schema now enforces the expected membership rather than merely checking it after a model can forget entries.
-
-Next `screen-focused-wide-map-verified-fast-fixed` tests the required-path audit object repair. Same24primary paths,3source groups,12discovery+3verification calls,80KBpreferred/120KBhard primary prompts,40KBsupport,240KBverification bound,model4.7-build-fast,sharedloweffort,jobs16 and600s/10m screen cap, further limited to3x fresh matched Opus. Both adapters receive the same source-derived required keys; findings/page contract remains unchanged. Missing, extra, wrong or empty audits still fail closed; restarted complete JSON uses the existing parser. Focused audit/coverage/verification tests pass. No retry of the failed result, no partial publication, and no production promotion.
-
-Required-audit wide result: Opus111.90s/23findings; Grok timed out at335.79s against335.69s (3x matched), after all12discovery calls but only1of3verification calls completed. Cleanup succeeded. Exact audit keys fixed the coverage failure; the large group's236second discovery call plus verification still misses the elapsed bound. No accepted Grok quality score or full run.
-
-Source adjudication of the earlier linked-context14/14 result now establishes at least18unique false Grok roots, versus9proven false Opus roots. The Opus inventory covers all52published findings, with two SwiftUI lifecycle roots and one global Honeybadger-reporting component still unresolved; Grok's remaining claims are not treated as true. Several errors directly trace to omitted actual callers/guards, while others misstate language/runtime behavior. No quality PASS is claimed from its successful recall/time score. Ledgers and source evidence are retained.
-
-Prepared40KBmidpoint did not reach a model benchmark: its context preflight failed because named domain types crowded out the explicitly rendered shared table_search partial, despite layout and dashboard being primary files. Stop before measuring a known context regression. Explicit file/partial references currently have the same weight as inferred named-type links; the planned repair gives exact source references a bounded2x preference, still decaying with graph distance. To keep measured factors separate, test that priority change first against the existing80KBcontrol, then evaluate a smaller primary preference if needed.
-
-Exact-reference regression fails under the old picker (inferred type displaces the explicitly rendered helper) and passes with the2x exact-reference preference. The formerly failing40KBpinned-source preflight now passes, with every primary file once and the real shared table_search helper present. Existing context/audit/verification checks also pass.
-
-Next `screen-focused-wide-import-map-verified-fast-fixed` measures only that exact-reference priority repair against the80KBrequired-map control. Same24paths,3groups/15calls,allfourdiscoverychecks,same-modelverification,40KBsupport limit,120KBdiscovery/240KBverification bounds,Grok4.7-build-fast,sharedloweffort,jobs16,600s/10m cap further limited to3x fresh matched Opus. The40KBpacking change remains prepared but unmeasured, so its effects are not conflated with this retrieval repair. No production promotion or full run.
-
-The linked-context14/14 candidate now has a decisive false-positive rejection: the matched Opus inventory has9proven false roots and only3unresolved unique components, so its worst-case count is12. Grok already has18independently proven false roots. Resolving the remaining claims cannot make that candidate meet the no-more-false-positives criterion. This failure bound does not label unreviewed Grok claims true or pretend finalist adjudication is complete.
-
-Exact-reference80KB result: Opus123.1315s/23findings; Grok313.9569s/26findings (2.55x), all15calls complete. Grok recovers8/14required roots: CSRF, scheduler MFA, upload-after-save, both truncated subtotals, future midnight, browser ENV and inactive alias. It misses weekend presets, extended-regex spaces, iOS Cancel and all three repeated-preview subtotals. The future finding mixes a valid midnight predicate with an incorrect all-interactions consequence; multiple other false claims remain. Reject on recall; no full run.
-
-Next `screen-focused-medium-batch-map-verified-fast-fixed` changes only preferred primary batch size80KB->40KB from that completed control. Same exact-reference priority,40KBsupport,120KBdiscovery/240KBverification bounds,four discovery passes and one combined verification per group,required per-file audit map,Grok4.7-build-fast,sharedloweffort,jobs16. The fixed24paths form6groups/30calls; preflight checks all primaries once and the actual shared table-search helper. Rebuilt binary after the priority repair. Declared600s/10m safety bound, Grok additionally capped at3x freshly matched Opus. Smaller groups test the observed loss of findings in the large-batch control.
-
-The other earlier14/14 candidate (`screen-focused-all-context-fast-jobs16-fixed`,2.44x) also now fails the false-positive criterion: at least17proven unique false Grok roots versus8proven plus6unresolved Opus roots (worst-case14). All48Opus raw claims match its published count, with no unparsed calls or skipped findings. The remaining Grok claims stay unresolved; this is a decisive failure bound, not a completed positive adjudication. Both earlier14/14speed successes are now rejected on quality.
-
-40KBresult: Opus177.0164s/30findings; Grok319.0852s/48findings (1.80x),30calls each with identical discovery prompts. Grok recovers12/14required roots, missing weekend presets and extended-regex spaces. The weekend defect was present in a discovery draft and dropped in final verification; regex was not found in discovery. Invoice preview order and iOS Cancel recovered. False claims remain, including hypothetical clients treating HTTP200 as unconditional success and DateFormatter thread-unsafety. Reject on recall; no full run.
-
-Next `screen-focused-medium-verify-effort-fast-fixed` changes only final-verification effort low->medium, identically for both providers. Discovery stays low. Same40KBprimary batches,40KBsupport,four passes,required audit map and6combined verifications (30calls),Grok4.7-build-fast,jobs16,24frozenpaths. This tests the measured loss of a real draft and retained false semantics; final verification already checks omissions, without any benchmark answers supplied. Focused context/audit/verification tests plus a stage-to-CLI/environment effort agreement check pass. Declared600s/10m safety bound, Grok additionally capped at3x fresh matched Opus. No production default changes.
-
-Further source checking corrects one claim in the older all-context inventories: the Sutter empty preview fails in its controller before entering the template; a claimed empty-template failure is not reachable through that path or through the guarded production batch. The frozen controller-level empty-preview root remains real and unchanged. Conservative all-context false-positive bounds are now Grok>=18, Opus9proven+6unresolved<=15, still a rejection. A standalone macOS Foundation probe also confirms default DateFormatter.isLenient=false and rejects2024-02-31; explicit lenient=true accepts it. This corroborates the official Foundation implementation and refutes the default-leniency component in the recent Grok report; no iOS simulator was used.
-
-Medium-verification result: Opus115.1491s/23findings; Grok timed out at345.5452s against345.4474s (3x matched Opus), with clean cancellation. All24discovery calls completed, but only1of6verification calls finished (98seconds); the longest discovery took224seconds. No accepted complete Grok quality score. Captured arguments confirm low discovery and medium verification for both models.
-
-Next `screen-focused-medium-verify-effort-46-fixed` changes only the Grok variant to4.6. Earlier4.6low discovery was faster than4.7-build-fast, but was not tested with this exact caller context, four-pass split, required audit map or combined medium-effort verification. Same24paths,6groups/30calls,40KBprimary/40KBsupport budgets,sharedlow-discovery/medium-verification effort,jobs16,600s/10m safety and <=3x fresh matched Opus. The previous timeout stays a failure; this is not a repeat of the same candidate.
-
-Grok4.6medium-verification result: Opus110.0868s/26findings; Grok timed out at330.3753s against330.2603s (3x matched Opus), clean cancellation. All24discovery calls completed (longest99seconds), and5of6verification calls finished at147–220seconds, leaving the auth group incomplete. No complete quality score. The provider variant improved discovery time but did not meet the end-to-end ceiling.
-
-Prepared pipelined scheduling passes its race-enabled context/audit/verification and scheduling tests. A blocking regression demonstrates the old stage barrier cannot verify a finished group while another discovery is waiting; the new scheduler succeeds, never exceeds the shared job limit, retains draft/output order, and cancels unfinished work after failures or timeouts. This changes scheduling only; source prompts, schema, stage effort, group draft membership, model calls and final parser stay unchanged.
-
-Next `screen-focused-pipelined-verify-fast-fixed` measures that scheduler against the failed `screen-focused-medium-verify-effort-fast-fixed` control, returning toGrok4.7-build-fast. Ready verification work uses free shared slots before more discovery; there is no extra concurrency or added stage. Same24paths,6groups/30calls,40KBprimary/40KBsupport,low discovery and medium verification,jobs16,600s/10m safety and <=3x fresh matched Opus. The separate4.6trial remains recorded. This tests the observed idle slots before the all-discovery barrier released; no quality improvement is assumed from scheduling alone.
-
-The initial pipelined benchmark launch was not executed because the automatic approval service returned a401authentication error. On the next goal continuation, the normal approval path recovered and the same declared benchmark started. No sandbox bypass, credential change or alternate model access was used.
-
-Pipelined result: Opus114.0332s/25findings; Grok timed out at342.1903s against342.0995s (3x matched), with clean cancellation. All24discovery calls completed;2of6medium verifications completed,4were cancelled. Discovery prompt hashes match the barrier control. Verification began32.21seconds before the last Opus discovery ended, and108.86seconds before the last Grok discovery ended: overlap is real, but individual medium-effort calls still exceed the available end-to-end time. No complete Grok quality score and no production promotion.
-
-Next `screen-focused-decision-verified-fast-fixed` returns to the completed low-effort40KBcontrol (12/14roots,319.09seconds) and changes only the final-verification response contract. Every own-model draft finding gets a required decision ID; the model must retain, reject or deduplicate it with a source-based rationale. Retained/deduplicated claims must reference an actual final finding index; missing decisions, missing rationale and invalid indices fail the run. Discovery prompts, source/context, four passes, per-file audit, six combined verification calls, modelGrok4.7-build-fast, low effort throughout, jobs16 and30total calls stay unchanged. This addresses observed silent loss of the true weekend draft without adding a stage or injecting reference answers. The old validator accepts a final answer that accounts for none of its candidates; a regression now rejects it. Focused decision/schema/context/verification tests pass. Declared600s/10m safety and <=3x fresh matched Opus. The pipelined scheduler is kept separate from this quality test.
-
-Investigated Grok CLI shutdown overhead after finding its documented optional trace-upload drain. Existing captured stdout files are written directly by the live CLI, so their final modification time can be compared with capture start+elapsed. Across the completed low-effort40KBcontrol, pipelined run's completed calls, and current decision run's completed discovery, the median exit tail is about2.6seconds; observed largest tails are7.5,15.1and5.6seconds. The cancelled long calls had emitted no JSON. Thus a150second exit-drain budget is not the main observed delay. No telemetry or global settings were changed; diagnostic measurements are retained.
-
-
-Explicit-decision result: Opus147.8942s/27findings; Grok406.9520s/46findings (2.75x), all30calls complete. Grok covers10/14required roots, missing future midnight, weekend presets, extended-regex spaces and Sutter repeated preview subtotals. Required decision coverage prevents silent disappearance but does not make a rejection correct: Grok wrongly assumes the shared keyup handler always supersedes the initial date filter, and rejects the Sutter order defect because the actual preview controller is absent from its context. Multiple false claims remain. Reject on recall; no full model run or promotion.
-
-A model-free whole-repository preflight exercised the current decision prototype on all1346selected files, forming149source groups and745calls. Every primary source byte was verified, including reconstruction of the sliced SQL structure file; no model calls were made. The initial reconstruction check incorrectly used concurrent runner-start order and was corrected to use deterministic prompt-emission order. The repaired test passes. This establishes source coverage, not quality or acceptable full-run speed.
-
-
-Next `screen-focused-view-action-context-fast-fixed` returns to the completed40KB low-effort control (12/14roots,319.09seconds) and changes only supporting-source links for Rails views. An actual controller/concern definition of the view action now outranks incidental mentions of its filename. No target paths, source literals or expected findings are special-cased. A synthetic tight-budget regression fails before the change and passes after it; pinned-source preflight confirms the previously omitted Sutter preview controller is now present, all24primary files remain covered and existing context/audit/verification tests pass. Same6groups/30calls,four discovery passes,one group verification,required audit map,Grok4.7-build-fast,sharedloweffort,jobs16,40KBprimary/40KBsupport,120KBdiscovery/240KBverification bounds. Declared600s/10m safety and Grok<=3x fresh matched Opus. This trial does not include the additional per-candidate decision contract or pipelined scheduler.
-
-
-While the view-action trial runs, source inspection identifies another concrete context limit: its invoice-model group omits SutterHealthRateGuard (which performs the cleanup) and its Kaiser-template group omits the integer-converting BatchBuilder. Matched Opus consequently repeats both false claims. Prepared a separate supporting-context capacity experiment40KB->80KB, retaining the120KBtotal discovery bound,40KBprimary preference and same retrieval rules. A synthetic two-direct-dependency fixture fails at40KB and passes at80KB; pinned-source preflight confirms the Sutter cleanup guard is included and all existing context/audit/verification tests pass. Not yet benchmarked or promoted; the current view-action trial remains unchanged.
-
-
-Provider capability check: the logged-in Grok model cache still offers4.7,4.7-build-fast,4.6and4.5. Current [official reasoning documentation](https://docs.x.ai/developers/model-capabilities/text/reasoning) confirms reasoning cannot be disabled for these model families; low is the minimum. No unsupported effort value, authentication method or global configuration was changed. Current measured long calls generate tens of thousands of reasoning tokens even at low effort.
-
-
-View-action context result: Opus140.3275s/28findings; Grok timed out at421.0811s against420.9826s (3x matched Opus), with clean cancellation. Completed calls: {'discovery': 24, 'verification': 2}. The longest discovery took354.29seconds and generated30,788reasoning tokens on the13-file auth/invoice-model group. No completed Grok quality score or full run. The matched Opus inventory contains2proven false roots plus2unresolved components (upper bound4); all28raw final claims match the published count.
-
-Next `screen-focused-support-budget-fast-fixed` measures the prepared supporting-context capacity change against the view-action control:40KB->80KB, still bounded by120KBtotal discovery and240KBfinal input. Primary preference40KB,6groups/30calls,four discovery passes,one verification,required audit map,retrieval rules,Grok4.7-build-fast,sharedloweffort,jobs16 and24frozenpaths stay unchanged. The actual missing-rate cleanup guard is now present; no expected bug answers are added. The Kaiser builder remains absent from its template group because it is not reached by the current graph, so this is not claimed as a complete context repair. Focused tests pass. Declared600s/10m safety, Grok capped at3x fresh matched Opus.
-
-
-Prepared packing hardening separately from the live benchmark: source classification and bin admission now account for the required primary-target header. An empty file with an impossibly small header budget returns an error rather than silently disappearing. Both boundary regressions fail before the repair and pass afterward, with context/audit/verification and UTF-8 slicing checks. Model-free complete Run preflights on both versions verify all1346source files,149groups and745calls. Every generated prompt hash is identical on the pinned whole repository, proving the boundary repair does not alter this benchmark input. No model calls or production promotion were involved.
-
-
-Independent nil-association adjudication now confirms the older matched Opus Kaiser/Sutter deleted-department claims: root-admin deletion permits the soft deletion, assignment preview queries retain those assignments, and the actual templates crash at Kaiser line5/Sutter line214 when the scoped association is nil. The Nana address case is analogous via its unguarded root-admin address deletion and was reproduced at template line65. A fixture also reproduces a missing Kaiser routing-code crash, but that fixture alone does not settle its upstream reachability, so that older claim stays unresolved. Resolving the two department claims lowers the older all-context Opus false-positive upper bound from15to13 (9proven+4unresolved), strengthening its existing rejection against Grok>=18; it does not change the frozen required roots.
-
-
-Reference audit found an adjudication error in B1-245 (ignored invoice-stamp validation failure): the prior deleted-department trigger assumed required associations are always revalidated. hh uses Rails8.1 defaults, which disable that check for unchanged nonnil foreign keys. Executing the actual ActiveRecord8.1.3.1 validator condition confirms unchanged=false, changed=true, nil=true. B1-245 is now unresolved while an alternative reachable validation-failure trigger is investigated; its required root is retained provisionally, not dropped to let a candidate pass. The frozen set remains83required roots (82confirmed+1provisional), with no change to the14screen roots. Full quality PASS remains blocked by this unresolved reference claim. Evidence and the superseded reason are preserved.
-
-
-80KBsupport result: Opus180.2242s/25findings; Grok420.7579s/40findings (2.3346x), all30calls complete. Grok recovers12/14required roots, now including extended-regex spaces and all three repeated preview subtotals. It misses both future-midnight and weekend filtering; midnight was in discovery but dropped in verification, while the weekend root was not discovered. Known false claims include Rails before_action halting on false, hypothetical status-only clients, invoice CSRF-meta leakage and successful blank-bank submissions. Reject on recall; no full run or production promotion. Matched Opus has1proven false root plus4unresolved components after correcting an erroneous assumption that web pending-check Cancel behaves like Swift (the web version navigates away). All25raw Opus final claims match the published count.
-
-
-Next `screen-focused-runtime-notes-fast-fixed` changes only the shared system prompt from the completed80KBsupport control (12/14,420.76seconds). It adds2,599bytes of general Ruby, Rails8.1, JavaScript/jQuery3 and Swift/Foundation reference semantics, checked against primary language/framework documentation and local runtime probes. These contain no hh paths, business names, expected findings or model-produced answers. Same note goes to both providers at discovery and verification. This addresses observed false framework facts and incorrect initialization-order rejection. Source prompts, grouping,context,required audit schema,6groups/30calls,four discovery passes,one verification,Grok4.7-build-fast,sharedloweffort,jobs16 stay unchanged. Focused context/audit/verification tests pass; only model.go differs from the control. Declared600s/10m safety and Grok<=3x fresh matched Opus. The independent packing-boundary repair remains separate. References include [Ruby regex syntax](https://docs.ruby-lang.org/en/3.4/Regexp.html), [Rails callback termination](https://raw.githubusercontent.com/rails/rails/v8.1.3.1/actionpack/lib/abstract_controller/callbacks.rb), [jQuery3 ready scheduling](https://jquery.com/upgrade-guide/3.0/), [ECMAScript Date](https://tc39.es/ecma262/multipage/numbers-and-dates.html), and [Foundation DateFormatter](https://developer.apple.com/documentation/foundation/dateformatter).
-
-
-Runtime-reference result: Opus152.2060s/31findings; Grok447.0467s/42findings (2.9371x), all30calls complete with clean exit and pinned source unchanged. Grok covers13/14required roots: future midnight now survives verification, but weekend preset coverage is absent from all discovery passes and final output. False/mixed claims remain. Reject on recall; no full run or production promotion.
-
-Prepared next predicate-coverage trial changes only the values/language discovery instruction: enumerate small finite input domains and boundary representatives, compare related predicates together, and trace gaps/overlaps through actual callers to observable consequences. Both models currently note that the date offsets match the server query but do not check whether their combined visible subsets cover that query. The new instruction is generic and contains no repository paths, business facts, weekdays or expected findings. Runtime notes and all other settings remain the same.
-
-
-Predicate preflight initially detected a context change because the longer instruction also reduced the packer budget. Kept the existing reservation (which already exceeds every new per-pass prefix) and added the new text only after calculating it. The direct pack comparison passes. The first full model-free Run comparison incorrectly read Grok stdin instead of its prompt file and failed; that fixture is being corrected before any model benchmark. Existing context/audit/verification tests pass.
-
-Next `screen-focused-predicate-coverage-fast-fixed` measures that sole discovery-instruction change. Same24paths,6groups/30calls,four passes,one same-model verification,required audit map,40KBprimary/80KBsupport,shared runtime notes,Grok4.7-build-fast,low effort throughout,jobs16. Declared600s/10m safety bound, Grok capped at3x fresh matched Opus. No production promotion.
-
-Corrected model-free Run comparison passes:24discovery calls match the captured control byte-for-byte except six intended values-pass additions;6final calls and prompt bounds pass. Build exit0 (benign module stat-cache warning). The new benchmark is now ready to start.
-
-
-Resolved the global Honeybadger component in three older Opus ledgers: the local API catch is bypassed, but the absolute never-reported claim is false. The actual web entry configures Honeybadger with default unhandled-rejection capture; its installed6.16.3browser plugin reports the rejection. A no-network fixture uses the actual API source and installed browser bundle, dispatches the actual body-read error to the handler, and observes a notice with transport suppressed. It explicitly does not emulate native browser event scheduling. The underlying API/UI failure remains real. Moving one unique component from unresolved to false leaves each previous worst-case bound unchanged. [Honeybadger configuration](https://docs.honeybadger.io/lib/javascript/reference/configuration/) corroborates the default.
-
-
-Reference B1-245 is reconfirmed with a different reachable trigger, preserving all83required roots. Scheduler creation uses Assignment::Create, where visit_type is optional, and its accepted columns include billing status. A valid UCSF assignment with no visit_type can therefore persist and be selected as approved/unbilled. UcsfBatch reloads that row as Assignment::Ucsf, whose stricter visit_type validators fail during stamping. An executable fixture runs the pinned scalar validation declarations, actual ActiveRecord8.1.3.1 update/save validation, and actual HH stamping/record_run methods: update fails, ClientInvoice has already been recorded, and record_run returns normally; a valid-visit-type control stamps. Persistence/transactions are in-memory, with reachability traced separately through actual controller/query source. The earlier deleted-association trigger stays recorded as disproved. No required reference root was removed or softened.
-
-
-Predicate-coverage benchmark completed: Opus175.8631s/28findings; Grok410.2788s/41findings (2.3329x), all calls complete, clean exit and pinned source unchanged. Quality adjudication has not yet been completed; no PASS or full run claimed. User requested a candid status checkpoint after the long experiment loop. No benchmark is currently running.
-
-
-## September 29 bounded autonomous campaign
-
-The campaign began at 13:59:36 UTC with an absolute experiment deadline of
-15:39:36 UTC and total deadline of 15:59:36 UTC. The existing private handoff
-records these limits and counters across continuations. The existing run harness
-now refuses an unregistered candidate, missing state, an expired deadline, an
-exhausted attempt limit or a stopped campaign before invoking a provider. Its
-process-group timeout is capped by the remaining experiment budget. Seven guard
-cases passed without model calls.
-
-Scored the previously completed `screen-focused-predicate-coverage-fast-fixed`:
-Opus 175.8631s, Grok 410.2788s (2.3329x), **11/14 required roots**. The final
-findings omit the weekend preset gap, extended-regex whitespace and inactive-alias
-nil dereference. The department/town nil lookup is a different path and does not
-cover the alias defect. Reused the existing source-backed reference adjudications;
-no reference acceptance was changed. Reject on recall without completing an
-unnecessary false-positive inventory. Its scorecard remains private.
-
-Candidate 1, `screen-focused-findings-only-fast-fixed`, changes only the final
-verification payload: retain every raw draft finding and source line, but discard
-the draft audit narratives. This tests false assurances in those narratives being
-repeated by verification. A regression reproduced that forwarding before the
-change; isolation, context, audit and verification preflights pass after it. All
-24 discovery prompts match the prior control byte for byte. Opus finished in
-121.6276s with 25 findings. Grok hit its 364.8829s deadline and stopped in 364.9931s;
-all 24 discovery calls completed, six verification calls started and none completed.
-Cleanup succeeded. No final Grok review exists, so no quality score is accepted.
-This is the first non-improvement; nothing is promoted.
-
-Candidate 2, `screen-focused-findings-only-46-fixed`, changes only the Grok model
-from 4.7-build-fast to 4.6. Earlier evidence showed faster 4.6 discovery, but its
-medium-verification experiment timed out and lacked the current runtime notes.
-Both providers retain the same source, context, prompts, audit schema, tools,
-low effort, concurrency and review stages. Preflights pass. Opus finished in
-118.6537s with 26 findings; Grok finished in 257.1117s with 48 findings (2.1669x).
-All 30 calls completed for each model; source remained pinned and cleanup succeeded.
-The final Grok findings cover **11/14 required roots**, missing the same three as
-the existing predicate result. Reject on recall; false and mixed claims remain
-unresolved and no false-positive total is asserted.
-
-At 14:22:41 UTC the two consecutive non-improvements ended the campaign. The
-persisted state is `STOPPED_NO_IMPROVEMENT`; the harness refuses another launch.
-No third candidate or full-repository model run was launched, and no experimental
-speed change entered product code. Raw results, prototypes, scorecards and the
-harness stay in the existing private artifact directory. The whole-repository
-quality/speed goal remains unfinished.
-
-## September 29 user-authorized accuracy diagnostics
-
-After the prior campaign stopped, the user explicitly authorized testing isolated
-verification and smaller discovery contexts. A separate bounded diagnostic record
-preserves the old campaign; no acceptance criterion changed. Product code stayed
-unchanged and all private inputs and prototypes stayed outside the repository.
-
-`isolated-claim-diagnostic` replayed each provider's own saved reliability findings
-from the problematic source group: five Opus and seven Grok candidates, each judged
-separately against the original source context. Both used the same system prompt,
-decision schema, low effort, disabled tools and eight-worker limit. Code assembles
-accepted findings; an unresolved decision prevents a successful report. All twelve
-calls completed. Opus took 47.7650s; Grok took 45.1729s. Grok retained the verified
-inactive-alias crash that its combined verifier had discarded, but also retained
-questionable claims and returned one unresolved decision about nil billed amounts.
-Its report therefore failed. No precision or complete-pipeline improvement is claimed.
-
-`small-discovery-diagnostic` used the existing values-focused instructions and source
-dependency selection, one target at a time, with a 48,000-byte prompt budget.
-Preflight rejected a 32,000-byte version that omitted the dashboard query dependency;
-no model call used it. Both models received identical final prompts (47,849 and
-47,905 bytes), system prompts, schemas and settings. Opus completed both calls in
-17.4234s. Grok completed the dashboard call but missed the weekend gap and claimed
-that no text-filter keyup handler exists. That claim is contradicted by the layout's
-included `_table_search` partial, which the reduced context omitted. The ban-parser
-call timed out: deadline 52.2702s, elapsed including cleanup 52.3753s. Its regex
-detection is unscored because no completed response exists. Descendant cleanup
-succeeded and the pinned `hh` HEAD was unchanged.
-
-Both diagnostics are rejected for promotion. Their timings cover isolated stages,
-not source-review end to end. No new 24-file or full-repository pair was launched.
-The handoff records two non-improvements and refuses further launches; the limited
-retention signal is saved without claiming parity or weakening accuracy requirements.
-
-## September 29 evidence-obligation and runtime-fact diagnostics
-
-The user authorized another attempt. It began at 20:22:39 UTC with an experiment
-deadline of 21:02:39 UTC and a closure deadline of 21:22:39 UTC. Previous campaigns
-remain preserved. These are bounded replay/discovery diagnostics, not fresh complete
-review pairs; each provider stage had a 300-second safety cap. Whole-review quality
-and timing acceptance remain unchanged.
-
-`proof-obligations-diagnostic` replayed each model's own linked-context drafts for
-the authentication, dashboard/layout and ban-parser groups. Each claim required
-reachability, behavior and counterevidence before its verdict; accepted findings
-were collected directly rather than rewritten. Source contexts were identical
-between providers. Both completed three calls, Opus in 54.9398s and Grok in
-126.5931s. Grok retained the regex and alias bugs, but rejected the real midnight
-and weekend dashboard roots and retained the incorrect global-controller inheritance
-claim. Reject on recall; the remaining eight groups were not run.
-
-Reviewing that control exposed a scorecard error: finding G56 alleges Honeybadger
-key exposure, not the actual browser `ENV` ReferenceError. It was already recorded
-as false in the claim ledger but incorrectly counted toward recall. Correct the
-linked-context result to 13/14, retaining the previous scorecard and correction
-evidence. The other historical all-context candidate explicitly reports the `ENV`
-failure in finding53 and still covers14/14 with mixed false components; it remains
-rejected on its false-positive bound. No source or required reference root changed.
-
-`literal-facts-diagnostic` then changed only the existing Grok4.6 values-discovery
-input: append static-regex match observations generated by Ruby4.0.0 and Prism,
-matching the repository's Ruby version. The generator parses source without executing
-application code; it tests literal word runs already in each pattern and their
-space-removed forms. Both models receive identical actual match results, with no
-expected outcomes or bug labels. This follows the parser's documented
-[static regex node and flags](https://ruby.github.io/prism/rb/Prism/RegularExpressionNode.html)
-and Ruby's [Regexp construction and matching](https://docs.ruby-lang.org/en/4.0/Regexp.html).
-Eight synthetic literal-equivalence cases, interpolation exclusion and parse-error
-rejection passed. The source contains34static patterns and5dynamic patterns, which
-are explicitly skipped. The original117,315-byte prompt is unchanged; the augmented
-prompt is119,921bytes, within the120,000-byte bound.
-
-Opus completed in28.9169s and Grok in69.6861s (2.4099x), including0.1300s and0.1323s
-of preprocessing respectively. Both completed normally with clean process cleanup
-and the pinned source unchanged. Grok now reports the extended-regex whitespace
-bug, increasing required-root coverage in this group from4/7 to5/7. The weekend
-and inactive-alias roots remain absent. It omits the previously reported CPMC alias
-precedence defect and adds a false component to the real subtotal bug: it says
-10.9+0.2 becomes10 after truncating the accumulator, whereas executing the actual
-BigDecimal operation gives10.2. All six published findings in the old Grok stage
-and both new stages were inspected: the new Grok output has this one false component;
-the old Grok stage and new Opus stage have none. Audit notes are not accepted findings.
-
-This is a useful local recovery signal, not an accuracy pass. Two diagnostics failed
-the no-regression requirement, so the batch stopped without expanding to the24-file
-sample or whole repository. All prototypes remain private; no product change or
-benchmark acceptance was promoted.
-
-## September 29: five requested options on untuned primary files
-
-The user explicitly authorized trying all five proposed options and keeping only
-improvements. This batch started at 21:05:28 UTC, with an experiment deadline of
-22:45:28 and closure deadline of 23:05:28. That authorization superseded the old
-three-candidate/two-failure stopping limits for this batch. The source revision,
-reference, quality requirements and whole-review speed requirements stayed fixed.
-All requested trials finished before the deadline; no implementation qualified.
-
-The fifth option, untuned-code evaluation, applied to every trial. Before new prompt
-design, a deterministic hash selection chose two primary files each from controller,
-model and frontend strata, excluding previous narrowed-review primary targets.
-Each selected file has a verified important reference root. These six files are
-untuned primary targets within the same repository, not a new unseen repository;
-some may previously have appeared as supporting context. The hypotheses, selection
-and initial scripts were frozen before reading their reference labels or outputs.
-Labels never entered provider prompts.
-
-The private harness used the logged-in Opus and Grok 4.6 CLIs, identical initial
-source/prompts/system/schema, low effort and a shared 16-worker limit. Models had
-no tools. Source-dependent follow-ups used each model's own findings and requests,
-with the same policy and accessible committed source. Review stages, per-run tool checks,
-startup and process cleanup were timed. Initial prompt packs were precomputed;
-these timings do not establish full-command performance. Grok was capped at three times fresh Opus
-elapsed time. The pinned source was checked before and after each provider; every
-check passed and descendant cleanup succeeded. Actual discovery prompts and shared
-settings were compared after execution. No full-repository run was launched.
-
-| Configuration | Opus seconds | Grok seconds | Grok recall screen | Decision |
-| --- | ---: | ---: | --- | --- |
-| Fresh control | 26.1739 | 60.6847 | 3 confirmed, at most 4 of 6 | Reject: missing date-default and radio-selection roots |
-| Source-linked grouping | 33.7866 | 68.6963 | 3 confirmed, at most 4 of 6 | Reject: missing timezone and radio-selection roots |
-| One bounded lookup | 49.3406 | 97.7715 | 4 confirmed, at most 5 of 6 | Reject: missing timezone root |
-| Standard tool evidence | 28.0442 | 84.2532 including cancellation | Incomplete; unscored | Reject: deadline 84.1326 exceeded |
-| Selective medium reasoning | 56.8381, failed | 97.9614, diagnostic | 4 of 6 | Reject: Opus unresolved; Grok misses concurrent-draft and date-default roots |
-
-For the first three Grok reports, possible additional recall credit for overlapping
-draft includes was left unresolved: they describe duplicate billing without tracing
-concurrency past the activation guard. Their other missing roots already establish
-failure even with that credit. Precision was not exhaustively adjudicated after
-these decisive failures. Each completed Grok report contains at least one verified
-false component about PDF widget values: the pinned and installed pdfjs-dist 6.3.289
-normalizes stored strings and uses boolean checkbox/radio widget state. The lookup
-and selective-effort outputs also identify the genuine loss of radio-option identity;
-they receive recall credit for it while retaining the false-component penalty.
-
-Source-linked grouping separated the six unrelated primary targets, using existing
-source/type/caller links and excluding high-fanout shared ancestors. This is an
-approximation to execution-flow grouping, not a compiler-resolved call graph. The
-existing supporting-context picker remained in use. Every primary was present once,
-all primary source was preserved, and all six initial prompts fit within 120,000 bytes.
-The control used two groups. Grok recovered the date-default root but lost the
-system-timezone root; the false widget-value claim persisted. Reject the prototype.
-
-Bounded lookup allowed at most three relative paths or symbols per group, four
-matches per request and 40 KB of additional committed source, followed by one completion
-call. Both providers returned empty request lists for both groups. Thus the code
-path was offered but retrieval itself was not exercised; this run does not establish
-whether useful requested context would help. Grok still missed the timezone root
-and retained a false library premise. Reject this configuration without another run.
-
-Standard evidence came from six syntax parses, the repository's RuboCop lint rules
-on four Ruby files, and ten existing companion JavaScript tests. All passed. The
-isolated snapshot used committed source and privately cloned installed dependencies,
-so compiler/test caches did not write into `hh`. Preflight repairs routed RuboCop
-JSON to its output file and fixed Vitest's external setup-path problem; no custom
-bug probes or tests were introduced. Both providers received byte-identical evidence,
-including existing test names and outcomes. Grok timed out before a complete report;
-partial responses were not scored as a successful review. Reject the prototype.
-
-Selective effort added a low-effort candidate checker, escalating at most two
-rejected or uncertain claims per group to medium reasoning. Opus made two medium
-calls: one narrowed a date-formatting claim, while the catalog-association crash
-remained uncertain, correctly preventing a successful report. Grok's arm was then
-run once diagnostically, bounded to 170.5142 seconds (three times that failed Opus
-elapsed time), to finish the requested option. Grok retained every candidate at low
-effort and therefore made zero medium calls. It missed two required roots and kept
-a false PDF-library premise. This is not evidence of medium-effort performance on
-Grok, nor a passing matched comparison. Reject the escalation policy as tested.
-
-All five requested options are now attempted, the launch guard is stopped, and
-no new product code, full-sample run or full-repository run is being promoted.
-This records failures of these prototypes, not proof that the ideas cannot work.
-Private manifests, scripts, prompts, outputs, timings and claim mappings remain
-under the existing private benchmark directory; only this results checkpoint and
-its required review artifacts are committed.
diff --git a/docs/metareview/learning/grok-parity/goal.md b/docs/metareview/learning/grok-parity/goal.md
deleted file mode 100644
index cd560c7a..00000000
--- a/docs/metareview/learning/grok-parity/goal.md
+++ /dev/null
@@ -1,106 +0,0 @@
-# Grok quality and speed parity
-
-## Required outcome
-
-Make `metareview source-review --model grok` review the whole `hh` repository
-with at least Opus's verified accuracy and in no more than 3x Opus's elapsed
-time. A speedup with an accuracy loss is a failure. The goal remains unfinished
-until both conditions pass on a complete repository review.
-
-Keep one interface and one shared review pipeline. Switching models changes only
-the provider/model adapter. GPT evaluation is outside this goal.
-
-## Acceptance stays fixed
-
-- Use the existing frozen Opus reference, `baseline-full-opus-1` (295.9862 seconds),
-  and its independently verified important bugs. Keep the pinned `hh` revision
-  `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` unchanged. Check HEAD before and after runs.
-- Grok must find every verified P0/P1/P2 reference root cause. Extra discoveries
-  cannot compensate for a miss. Do not change the reference to help a candidate
-  pass; record any evidence-based correction and its reason. Report P3 separately.
-- Grok must have no more unique false defect claims than either the frozen
-  reference or the fresh matched Opus run. Count false components of mixed claims,
-  false factual advisories, and parser-skipped claims. Unresolved claims prevent PASS.
-- A complete sequential Opus/Grok pair must use identical source, context, prompts,
-  schema, tools, effort, concurrency, stages and retry policy. Keep tools disabled;
-  never give either model benchmark answers or the other model's findings.
-- Count startup, every stage, retries and cleanup. Grok's full-run deadline is
-  min(887.9586 seconds, 3x matched Opus time). Preserve Opus's usefulness: do not
-  improve the ratio by slowing it or making its review less thorough.
-- Failed calls, truncation, missing coverage and timeouts are failures, never
-  successful empty reviews. Cancel descendants at the deadline. A sample result
-  cannot establish whole-repository success.
-
-## Autonomous execution with a finite budget
-
-The agent chooses experiments and proceeds without asking the user to direct the
-work. Checkpoints are progress reports, not permission requests. These rules
-replace the previous requirement to return to the user after each batch.
-
-1. Score the existing completed run first, using the existing evidence. Until it
-   has a supported PASS or FAIL, make no new model calls. Reuse prior adjudications
-   when source and claim are unchanged; reopen them only for new contrary evidence.
-2. Before each experiment, record one observed failure, one proposed causal fix,
-   one changed factor and the measurable result that would justify keeping it.
-   Check the existing experiment history first. Do not repeat a rejected setup or
-   rerun a failed measurement hoping for a better random result. A repair needs a
-   new causal explanation and consumes another candidate slot.
-3. Allow at most **three new candidate configurations on the fixed 24-file sample**,
-   one sequential matched pair each, and **one full-repository matched pair** for
-   the first fully passing sample. Score each pair before choosing the next action.
-   Never exhaustively adjudicate an already decisive failure. Fully adjudicate a
-   candidate before PASS; unresolved quality is not progress or success.
-4. Keep the best measured candidate. Improvement requires a strict gain in required
-   root coverage, unique false-claim count or elapsed time, without worsening either
-   other measure, against the same fully scored sample control. An unresolved
-   comparison does not count. Stop after **two consecutive candidates without a
-   demonstrated improvement**. A failed full-repository pair ends this campaign;
-   a passing sample cannot substitute for it.
-5. The campaign has **two elapsed hours total**, including analysis, implementation,
-   model calls, scoring, tests, reviews and commits. Reserve the final 20 minutes
-   for cancellation, validation, saving work and reporting; do not start experiments
-   in that reserve. Begin the clock before scoring the existing run. Persist the
-   absolute deadline, candidate count, non-improvement count, current action and
-   verdict in the existing private `latest-handoff.json`. Continuations, restarts,
-   renamed experiments and summaries never reset the limits. Check them before
-   each continuation and launch; missing state means no launch until recovered.
-   Give each benchmark process group an enforced timeout no greater than the
-   remaining experiment budget or its existing acceptance timeout. Do not start
-   work that cannot fit. At the deadline cancel remaining benchmark descendants.
-6. Report each decisive result briefly and continue autonomously within those
-   limits. Save verified changes in small commits after their required checks;
-   update the existing README instead of creating more planning documents. Keep
-   rejected prototypes outside product code. At success or a stopping limit,
-   report timings, required bugs found/missed, false claims or unresolved bounds,
-   and changes kept/rejected. Unfinished work remains explicitly unfinished; budget
-   exhaustion is not proof that parity is impossible. Do not restart the campaign
-   automatically or weaken acceptance to obtain a pass.
-
-Push only on explicit user instruction; do not open a PR or publish as part of
-this goal. The user does not need to choose implementation details or experiments.
-
-## Immediate next action
-
-Score `screen-focused-predicate-coverage-fast-fixed` before launching anything.
-It took Opus 175.8631 seconds and Grok 410.2788 seconds; its quality is unfinished.
-Reject it as soon as a decisive failure is established. Otherwise finish its
-quality score, then choose the next action under the rules above without a user
-checkpoint. The campaign clock starts with this scoring work, not with goal editing.
-
-## Keep the work contained
-
-Use logged-in CLIs; do not add API keys, direct authenticated HTTP access or global
-configuration changes. Leave `hh`, diff-review/FSM semantics and GPT tuning alone.
-Keep the existing GPT adapter compiling and tested.
-
-Keep private source, prompts, outputs and prototypes in the existing mode-0700
-`/tmp/metareview-grok-parity/` directory with umask 077. Retain commands, source and
-build hashes, settings, prompt hashes, timings, failures and scoring evidence.
-Use the existing README for a short current status and the existing experiment
-history for durable summaries; do not create another planning-document series.
-Required repository review records are retained in their established directories.
-
-Before accepting implementation changes, run appropriate tests, retain 100%
-coverage in changed packages, pass `make cover` and `git diff --check`, and satisfy
-the required artifact/task-done gates with zero blockers. Documentation-only edits
-need artifact review; do not rerun the full code suite without a relevant change.
diff --git a/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
deleted file mode 100644
index 3af79310..00000000
--- a/docs/metareview/reviews/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Target: `metareview-grok-parity-goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-NEEDS_REVISION
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Branch, pinned checkout, CLI flags and verification seams checked. |
-| Completeness | NEEDS_REVISION | 1 | 0 | Final Opus discoveries must be mandatory reference additions. |
-| Scope and alignment | PASS | 0 | 0 | Work traces to user requirements. |
-| Architecture | PASS | 0 | 0 | Shared pipeline and adapter separation fit existing architecture. |
-| Intent preservation | PASS | 0 | 0 | Quality and speed criteria preserve user intent. |
-| Security | PASS | 0 | 0 | Owner-only benchmark storage advisory retained by staff filter. |
-| Testing-quality | NOT_APPLICABLE | 0 | 0 | Evaluation plan; no executable test changes. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No data migration or persisted format transition. |
-| Runtime-reliability | PASS | 0 | 0 | Bounded failures and complete source coverage required. |
-| Mechanical-precision | PASS | 0 | 0 | Contracts buildable; implementation choices delegated. |
-
-## Orchestrator Notes (not findings)
-
-Ten required lenses ran as independent subagents. One completeness blocker and one security advisory were returned. The sole advisory met the three gates and the separate staff filter retained it. No other advisories were raised. Fix and re-review the reference-membership wording before implementation.
-
-## Findings
-
-## Blocking Findings
-
-- goal-completeness-1 (P2, confidence 75): goal line 67 makes adding finalist Opus discoveries optional. Grok can pass while missing a confirmed important bug found by final Opus runs. Require all such findings in the reference. Source: Completeness subagent.
-
-## Advisory Findings
-
-- goal-security-1 (P2, confidence 75): use a current-user-owned benchmark directory with mode 0700 and umask 077 before storing private source prompts and excerpts. Uncommitted local files otherwise remain readable to other local users under the default 0755/0644 modes. Source: Security subagent. Staff filter: KEEP.
diff --git a/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
deleted file mode 100644
index 9e7f4ece..00000000
--- a/docs/metareview/reviews/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Target: `metareview-grok-parity-goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `mrv-20260925-135901604009000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Branch, pinned checkout, CLI flags and verification seams checked. |
-| Completeness | PASS | 0 | 0 | Mandatory inclusion of all confirmed important baseline and final Opus defects verified on re-review. |
-| Scope and alignment | PASS | 0 | 0 | Work traces to user requirements. |
-| Architecture | PASS | 0 | 0 | Shared pipeline and adapter separation fit existing architecture. |
-| Intent preservation | PASS | 0 | 0 | Quality and speed criteria preserve user intent. |
-| Security | PASS | 0 | 0 | Owner-only storage and umask077 verified on re-review; advisory resolved. |
-| Testing-quality | NOT_APPLICABLE | 0 | 0 | Evaluation plan; no executable test changes. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No data migration or persisted format transition. |
-| Runtime-reliability | PASS | 0 | 0 | Bounded failures and complete source coverage required. |
-| Mechanical-precision | PASS | 0 | 0 | Contracts buildable; implementation choices delegated. |
-
-## Orchestrator Notes (not findings)
-
-Completeness and Security independently re-reviewed both changes and returned PASS with zero blockers or remaining advisories. The other eight lens results are carried from the parent review of the otherwise unchanged goal. Parent blocker goal-completeness-1 and advisory goal-security-1 are resolved.
-
-Goal SHA256: `933c827a23aec1567c86299fbe01c68fec4aa686cb34dccdcfd110b3f69a17a1`.
-
-## Findings
-
-No open findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
deleted file mode 100644
index 9835b79e..00000000
--- a/docs/metareview/reviews/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Target: `metareview-grok-parity-goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
-
-Execution mode: `pending-parallel-subagents`
-
-Previous run: `mrv-20260925-140350512115000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Re-reviewed: counts executable, all thresholds 0–3; benchmark prerequisites verified. |
-| Completeness | PASS | 0 | 0 | Re-reviewed: every reference root retained, no extra-bug compensation, both Opus comparisons preserved. |
-| Scope and alignment | PASS | 0 | 0 | Re-reviewed: measurement fairness change remains within delegated parity goal. |
-| Architecture | PASS | 0 | 0 | Carried from parent; common pipeline and adapter contracts unchanged. |
-| Intent preservation | PASS | 0 | 0 | Re-reviewed: equal opportunities preserve empirical parity; no future-run guarantee claimed. |
-| Security | PASS | 0 | 0 | Carried from parent; access and private artifact controls unchanged. |
-| Testing-quality | PASS | 0 | 0 | Re-reviewed: per-root equal-size batches, source adjudication and inclusive timing are valid empirical criteria. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | Carried from parent; no persisted-format transition. |
-| Runtime-reliability | PASS | 0 | 0 | Carried from parent; complete coverage, bounded failures, no partial success unchanged. |
-| Mechanical-precision | PASS | 0 | 0 | Re-reviewed: per-root counts and inequalities unambiguous. |
-
-## Orchestrator Notes (not findings)
-
-Six affected lenses independently reviewed the entire amended artifact and returned PASS, zero blockers or advisories. Four unaffected results carry from the parent review. No advisory filter was needed because no lens raised an advisory. Criterion 4 changes one-run-vs-six-run union recall to equal three-run per-root discovery frequencies; every real reference bug remains mandatory and finalist Opus must preserve its initial frequency. No candidate has passed this revised protocol or the prior stricter protocol. Prior review logs preserve the original criterion history; the goal's Measurement correction records the rationale.
-
-Goal SHA256: `f6391dafbc24ab5739a39ccfccd8373bf3f32b3879178c6551b692435f1366e8`.
-
-## Findings
-
-No open findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md b/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
deleted file mode 100644
index 33406151..00000000
--- a/docs/metareview/reviews/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Target: `metareview-grok-parity-goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260925-155346658258000-artifact-metareview-grok-parity-goal-b59209eb-context.md`
-
-Execution mode: `pending-parallel-subagents`
-
-Previous run: `mrv-20260925-154013886105000-artifact-metareview-grok-parity-goal-b59209eb`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Frozen run, timing arithmetic, paths and prerequisites verified; overall deadline is required implementation work. |
-| Completeness | PASS | 0 | 0 | Single reference, adjudication, shared setup, fixed screens, deadlines and final evidence covered. |
-| Scope and alignment | PASS | 0 | 0 | Matches the user-approved single-reference reset. |
-| Architecture | PASS | 0 | 0 | Carried from parent; shared pipeline/adapter boundaries unchanged. |
-| Intent preservation | PASS | 0 | 0 | Latest user choices preserved; earlier multi-run criteria explicitly superseded. |
-| Security | PASS | 0 | 0 | Carried from parent; private artifact controls and access restrictions unchanged. |
-| Testing-quality | NOT_APPLICABLE | 0 | 0 | Measurement requirements reviewed; no test implementation in this artifact. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | Carried from parent; no persisted-format transition. |
-| Runtime-reliability | PASS | 0 | 0 | Complete coverage, bounded whole-run failure and child cancellation required. |
-| Mechanical-precision | PASS | 0 | 0 | Frozen reference and min(887.9586s, 3x matched Opus) deadline are implementable. |
-
-## Orchestrator Notes (not findings)
-
-Seven affected independent lenses reviewed the amended goal. Architecture, Security and Data-migration carry from the parent because those contracts are unchanged. No lens raised an advisory, so advisory filtering was unnecessary. This PASS covers the user-approved goal, not benchmark quality or unimplemented timeout handling.
-
-Goal SHA256: `4277d96632dcec8c959bcdaeeec56a8af247a506257e8bb36001e253dc2c7141`.
-
-## Findings
-
-No open findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
deleted file mode 100644
index 3a8ca897..00000000
--- a/docs/metareview/reviews/mrv-20260927-145502217533000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,75 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260927-145502217533000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260927-145502217533000-artifact-readme-075056c7-context.md`
-
-Execution mode: `subagent-adjudicated`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Links, commit and timing statements match retained evidence. |
-| Completeness | PASS | 0 | 0 | Fixes, records, incomplete quality score and evidence location are identified. |
-| Scope and alignment | PASS | 0 | 0 | Cleanup only; no speed candidate promoted or success claimed. |
-| Architecture | PASS | 0 | 0 | Uses the established durable learning directory. |
-| Intent preservation | PASS | 0 | 0 | Quality/speed goal explicitly remains unachieved. |
-| Security | PASS | 0 | 0 | No credentials or private benchmark contents in the checkpoint. |
-| Testing-quality | PASS | 0 | 0 | Package coverage is distinguished from review quality. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No application data or schema changes. |
-| Runtime-reliability | PASS | 0 | 0 | No benchmark running; verification and acceptance limitations explicit. |
-| Mechanical-precision | NOT_APPLICABLE | 0 | 0 | Status checkpoint; no new implementation contract. |
-
-## Orchestrator Notes (not findings)
-
-Two independent read-only reviewers covered the ten artifact lenses in complementary groups.
-`cleanup_review_correctness` reviewed completeness, scope, intent, testing and mechanical precision;
-`cleanup_review_security` reviewed feasibility, architecture, security, migration and runtime reliability.
-The host checked their conclusions against the checkpoint and retained records. Zero blockers or advisories.
-This PASS covers the checkpoint document, not the unachieved Grok parity goal.
-
-The same reviewers reviewed `6eba389..6775da0` for correctness, testing, security and runtime reliability.
-Both reported PASS with zero findings. The host agrees after checking the exact diff and the passing
-source-review package tests (100% statement coverage). Full repository validation is recorded separately.
-
-## Findings
-
-No findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md b/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md
deleted file mode 100644
index 6b4a27be..00000000
--- a/docs/metareview/reviews/mrv-20260927-150100835166000-task-done-readme-075056c7.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# metareview: task-done review
-
-Run ID: `mrv-20260927-150100835166000-task-done-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260927-150100835166000-task-done-readme-075056c7-context.md`
-
-Execution mode: `deterministic-local`
-
-Gate effect: `gate`
-
-Previous run: `none`
-
-Covered paths: `["docs/ARCHITECTURE.md","docs/metareview/learning/grok-parity/README.md","internal/sourcereview/model.go","internal/sourcereview/model_test.go","internal/sourcereview/parse.go","internal/sourcereview/parse_test.go"]`
-
-## Verdict
-
-PASS_ADVISORY
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Notes |
-| --- | --- | ---: | --- |
-| code-quality-reviewer | PASS | 0 | No blocking findings. |
-| security-reviewer | PASS | 0 | No blocking findings. |
-| test-reviewer | PASS | 0 | No blocking findings. |
-| architecture-reviewer | PASS | 0 | No blocking findings. |
-
-## Blocking Findings
-
-No findings in this class.
-
-
-## Advisory Findings
-
-### mrvf-20260927-150100835166000-task-done-readme-075056c7-001: Adversarial review was in-session-emulated
-
-- Reviewer: adversarial-review-reviewer
-- Severity: low
-- Classification: advisory
-- Finding: The adjudicated review for this head was recorded as in-session-emulated (no independent subagents), which is weaker, non-independent evidence.
-- Expected: An independent subagent-adjudicated review where delegation is available.
-- Found: executionMode = in-session-emulated.
-- Recommendation: When subagents are available, prefer `metareview fsm --workflow review-loop` for an independent review.
-
-
-## Follow-up Findings
-
-No findings in this class.
-
-
-## Warnings
-
-No findings in this class.
-
-
-## Orchestrator Notes (not findings)
-
-Independent read-only reviews by cleanup_review_correctness and cleanup_review_security
-are recorded in mrv-20260927-145502217533000-artifact-readme-075056c7.md. Both found
-zero blockers or advisories. The host adjudicated those reviews in session and used the
-explicitly weaker marker because this checkpoint did not run an FSM review workflow.
-The automatic advisory is retained. This gate covers the cleanup and correctness fixes,
-not the unachieved Grok quality/speed goal.
diff --git a/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md b/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md
deleted file mode 100644
index 410962f9..00000000
--- a/docs/metareview/reviews/mrv-20260927-150946036220000-artifact-goal-8af7bb93.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260927-150946036220000-artifact-goal-8af7bb93`
-
-Target: `docs/metareview/learning/grok-parity/goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260927-150946036220000-artifact-goal-8af7bb93-context.md`
-
-Execution mode: `subagent-adjudicated`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings.
-
-## Completion Requirements
-
-All ten required lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blocking findings; no findings needed revision or an override.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Existing evidence supports the immediate scoring task; incomplete scoring has an explicit outcome. |
-| Completeness | PASS | 0 | 0 | Preserves important-bug recall, false-claim limits, complete-repository timing and failure handling. |
-| Scope and alignment | PASS | 0 | 0 | One pair and 30 elapsed minutes per batch; immediate task makes no new model calls. |
-| Architecture | PASS | 0 | 0 | Preserves the shared interface and pipeline, frozen reference and matched comparison. |
-| Intent preservation | PASS | 0 | 0 | Retains accuracy and 3x requirements, excludes GPT evaluation and leaves the goal unfinished. |
-| Security | PASS | 0 | 0 | Preserves CLI-only access, disabled tools, benchmark isolation and private artifact handling. |
-| Testing-quality | NOT_APPLICABLE | 0 | 0 | Documentation-only change; implementation validation requirements remain explicit. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
-| Runtime-reliability | PASS | 0 | 0 | Continuations share the deadline; cancellation includes descendants and failures cannot become empty successes. |
-| Mechanical-precision | PASS | 0 | 0 | Names the reference, next run, deadline formula, stopping conditions and zero-call restriction. |
-
-## Orchestrator Notes (not findings)
-
-`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. Both reviewed the documentation changes since `08ce3cf` without changing files or running benchmarks.
-
-The aggregate verdict follows those reviewer results. This review accepts the revised goal document and its README summary; it does not establish achievement of Grok quality or speed parity. `git diff --check` passed. No code tests were rerun for this documentation-only change.
-
-## Findings
-
-No findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md b/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md
deleted file mode 100644
index 499f07ba..00000000
--- a/docs/metareview/reviews/mrv-20260927-152217521007000-artifact-goal-8af7bb93.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260927-152217521007000-artifact-goal-8af7bb93`
-
-Target: `docs/metareview/learning/grok-parity/goal.md`
-
-Context pack: `docs/metareview/context/mrv-20260927-152217521007000-artifact-goal-8af7bb93-context.md`
-
-Execution mode: `subagent-adjudicated`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings.
-
-## Completion Requirements
-
-All ten lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blocking findings and no advisories.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Existing evidence and handoff support scoring first; unfinished work is an explicit outcome. |
-| Completeness | PASS | 0 | 0 | Preserves acceptance; defines candidate, elapsed-time and non-improvement limits. |
-| Scope and alignment | PASS | 0 | 0 | Scores prior output first, bounds new work and prohibits automatic campaign restarts. |
-| Architecture | PASS | 0 | 0 | Preserves shared interface/pipeline and requires causal experiments against fixed controls. |
-| Intent preservation | PASS | 0 | 0 | Agent decides without user checkpoints; exhausted budget cannot count as success. |
-| Security | PASS | 0 | 0 | Retains private artifacts, CLI-only access and existing publication restrictions. |
-| Testing-quality | NOT_APPLICABLE | 0 | 0 | Documentation-only revision; implementation validation requirements remain unchanged. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
-| Runtime-reliability | PASS | 0 | 0 | Persists deadlines and counters; missing state blocks launch; timeouts cancel benchmark groups. |
-| Mechanical-precision | PASS | 0 | 0 | Defines clock start, accounting, advancement and stopping rules across continuations. |
-
-## Orchestrator Notes (not findings)
-
-`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. Both reviewed the documentation changes since `dc6b86b` without edits or benchmark calls.
-
-The aggregate verdict follows both reviewer results. This accepts the goal revision and README summary, not Grok parity or an implemented experiment-budget guard. No campaign was started. `git diff --check` passed; code tests were not rerun for documentation-only changes.
-
-## Findings
-
-No findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md
deleted file mode 100644
index e55bce82..00000000
--- a/docs/metareview/reviews/mrv-20260929-142351964138000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260929-142351964138000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260929-142351964138000-artifact-readme-075056c7-context.md`
-
-Execution mode: `subagent-adjudicated`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings.
-
-## Completion Requirements
-
-All ten required lenses were reviewed by two independent subagents and adjudicated in session. Both returned zero blockers.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Saved results support the timings, call counts and recall scores. |
-| Completeness | PASS | 0 | 0 | Records required-root misses, unresolved false claims and incomplete timed-out review. |
-| Scope and alignment | PASS | 0 | 0 | Two candidates, no full-repository attempt, no prototype promotion and persisted stop state. |
-| Architecture | PASS | 0 | 0 | Separates private experiments from product correctness fixes; preserves whole-repository acceptance. |
-| Intent preservation | PASS | 0 | 0 | Stops without reducing accuracy requirements, claiming parity or declaring impossibility. |
-| Security | PASS | 0 | 0 | Private artifacts remain owner-only; no credentials or private source are disclosed. |
-| Testing-quality | PASS | 0 | 0 | Separates prototype checks, prior product validation and benchmark outcomes. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
-| Runtime-reliability | PASS | 0 | 0 | Persisted state/counters/deadlines gate launches; stopped campaign refuses further work. |
-| Mechanical-precision | PASS | 0 | 0 | Result metadata and prompt hashes support the stated scope, settings and outcomes. |
-
-## Orchestrator Notes (not findings)
-
-`/root/cleanup_review_correctness` reviewed completeness, scope/alignment, intent preservation, testing-quality and mechanical precision. `/root/cleanup_review_security` independently reviewed feasibility, architecture, security, data migration and runtime reliability. They reviewed the README changes and appended September 29 experiment-history section since `fbfcf4c`, using private scorecards, provider results, prompt hashes and the run harness as evidence. Neither changed files or ran model benchmarks.
-
-The aggregate verdict follows both reviewer results. This accepts the campaign report, not achievement of Grok parity. All rejected or incomplete claims retain their stated uncertainty. The actual stopped-campaign launch refusal was verified without creating a model run. `git diff --check` passed; product source remains unchanged since `6775da0`, so its full suite was not rerun for this documentation-only checkpoint.
-
-## Findings
-
-None.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md
deleted file mode 100644
index 80c62916..00000000
--- a/docs/metareview/reviews/mrv-20260929-175656945801000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260929-175656945801000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260929-175656945801000-artifact-readme-075056c7-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Saved results establish the completed calls, unresolved decision and timeout. |
-| Completeness | PASS | 0 | 0 | Records the retained alias defect, unresolved claim, missed weekend gap, false handler claim and incomplete regex result. |
-| Scope and alignment | PASS | 0 | 0 | Two authorized diagnostics only; no product promotion or complete-review measurement. |
-| Architecture | PASS | 0 | 0 | Preserves the shared model setup and separates diagnostic evidence from product acceptance. |
-| Intent preservation | PASS | 0 | 0 | Accuracy and whole-repository acceptance remain unchanged and unfinished. |
-| Security | PASS | 0 | 0 | Private artifacts remain owner-only; logged-in CLIs and per-process settings only. |
-| Testing-quality | PASS | 0 | 0 | A retained true finding is not claimed as proof of precision or overall accuracy improvement. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application-data migration. |
-| Runtime-reliability | PASS | 0 | 0 | Bounded session runner cleaned descendants; unresolved output failed; stopped state refuses launches. |
-| Mechanical-precision | PASS | 0 | 0 | Verified timings, 5/7 and 2/1 completed calls, matching discovery hashes and distinct deadline/cleanup elapsed values. |
-
-## Orchestrator Notes (not findings)
-
-Scope: the new accuracy-diagnostic checkpoint in README.md and the corresponding
-September 29 addition to experiment-history.md. Earlier historical claims were not
-re-reviewed. Independent reviewers `cleanup_review_correctness` and
-`cleanup_review_security` covered all ten lenses and returned zero blockers. Their
-checks used the private saved decisions, result metadata, prompt hashes and harness
-state. This PASS approves the documentation's accuracy; it does not approve either
-prototype or declare the parity goal complete.
-
-## Findings
-
-No blocking or advisory findings. Both independent reviewers returned zero blockers.
diff --git a/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md
deleted file mode 100644
index 1f54cc86..00000000
--- a/docs/metareview/reviews/mrv-20260929-203845642115000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260929-203845642115000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260929-203845642115000-artifact-readme-075056c7-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Saved records confirm timings, preprocessing, call counts, prompt sizes and matching runtime. |
-| Completeness | PASS | 0 | 0 | Records recovered/missing roots, omitted CPMC finding and false arithmetic component. |
-| Scope and alignment | PASS | 0 | 0 | Diagnostic stages only; no product promotion or full-review performance claim. |
-| Architecture | PASS | 0 | 0 | Separates local evidence from complete acceptance and preserves shared provider inputs. |
-| Intent preservation | PASS | 0 | 0 | Accuracy requirements stay fixed; the stopped campaign remains unfinished. |
-| Security | PASS | 0 | 0 | Prism parses source without eval; static regex matches are bounded and dynamic interpolation is skipped. |
-| Testing-quality | PASS | 0 | 0 | Compared all six published claims in each stage; credits the real subtotal defect and counts its false example separately. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No application-data or schema migration. |
-| Runtime-reliability | PASS | 0 | 0 | Bounded stages cleaned descendants, guards refuse stopped launches, prior campaigns preserved. |
-| Mechanical-precision | PASS | 0 | 0 | Checked hashes, stage4/7-to5/7 coverage, metadata and source-backed13/14 historical score correction. |
-
-## Orchestrator Notes (not findings)
-
-Scope: the new evidence-obligation/runtime-fact checkpoint in README.md and the
-corresponding September 29 addition to experiment-history.md. Independent reviewers
-`cleanup_review_correctness` and `cleanup_review_security` reviewed all ten lenses
-against saved private decisions, findings, metadata, source hashes and generator
-code. Both returned zero blockers. Older history was checked only where needed to
-verify the explicit scorecard correction. This PASS approves the documentation;
-it does not approve the experimental pipeline or declare the parity goal achieved.
-
-## Findings
-
-No blocking or advisory findings. Both independent reviewers returned zero blockers.
diff --git a/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md
deleted file mode 100644
index a4c3e67d..00000000
--- a/docs/metareview/reviews/mrv-20260929-213048175462000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,74 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260929-213048175462000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260929-213048175462000-artifact-readme-075056c7-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| feasibility | PASS | 0 | 0 | Timings, source pin and command outcomes match private records. |
-| completeness | PASS | 0 | 0 | All five options and their unexercised paths and failures are disclosed. |
-| scope-alignment | PASS | 0 | 0 | Documentation only; no prototype or parity acceptance promoted. |
-| architecture | PASS | 0 | 0 | Shared policies and diagnostic limitations are accurately described. |
-| intent-preservation | PASS | 0 | 0 | Quality/speed requirements remain fixed; failures do not prove impossibility. |
-| security | PASS | 0 | 0 | Private source stays private; CLI-only runs and isolated tool caches verified. |
-| testing-quality | NOT_APPLICABLE | 0 | 0 | No production/test edits; reported existing checks match evidence. |
-| data-migration | NOT_APPLICABLE | 0 | 0 | No schema or application persistence changes. |
-| runtime-reliability | PASS | 0 | 0 | Timeouts, incomplete reports, cleanup and stopped launch guard verified. |
-| mechanical-precision | NOT_APPLICABLE | 0 | 0 | Results record, not an implementation spec; timings and bounds checked. |
-
-## Orchestrator Notes (not findings)
-
-Reviewed the README change and the newly appended September 29 five-option section
-of the experiment history. Historical records and product implementation were outside
-this review. Two independently delegated reviewers covered all ten required lenses:
-`forward_results_correctness` covered completeness, scope-alignment,
-intent-preservation, testing-quality and mechanical-precision;
-`forward_results_safety` covered feasibility, architecture, security, data-migration
-and runtime-reliability. Both returned zero blockers and zero warnings.
-
-The review checked saved result/score records, actual findings, lookup/escalation
-records, tool evidence, private-directory permissions and the stopped launch guard.
-The timing language explicitly excludes precomputed prompt preparation. The context
-pack's checkout path was sanitized. `git diff --check` passed. A launch-guard check
-refused another provider run and left the call count unchanged.
-
-PASS applies to the accuracy of this documentation checkpoint. The Grok parity goal
-remains unfinished; no implementation is accepted and no full-repository pass is claimed.
-
-## Findings
-
-No blocking findings, advisory findings or warnings.
diff --git a/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md b/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md
deleted file mode 100644
index 5bf19f90..00000000
--- a/docs/metareview/reviews/mrv-20260930-133322105394000-artifact-readme-075056c7.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# metareview: artifact review
-
-Run ID: `mrv-20260930-133322105394000-artifact-readme-075056c7`
-
-Target: `docs/metareview/learning/grok-parity/README.md`
-
-Context pack: `docs/metareview/context/mrv-20260930-133322105394000-artifact-readme-075056c7-context.md`
-
-Execution mode: `parallel-subagents`
-
-Previous run: `none`
-
-Required lenses: `feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision`
-
-## Verdict
-
-PASS — zero blocking findings.
-
-## Completion Requirements
-
-This scaffold is not a completed review. Artifact review defaults to parallel subagents for the required lenses. The artifact-review workflow is explicit authorization to delegate those lenses. Only use `in-session-emulated` when subagents are unavailable or the human explicitly requested no delegation; if used, state that the review is not independently adversarial and treat it as weaker evidence. Completion requires every required reviewer row to be populated, each reviewer to have a verdict, blocking findings to be fixed and re-reviewed or explicitly human-accepted, and the aggregate verdict to be the actual artifact-review verdict returned by the reviewer set rather than a fixed example result.
-
-## Reviewer Prompts
-
-Use `rubrics/artifact-review-rubric.md` and the context pack above. Run these lenses as parallel subagents by default before aggregation:
-
-- Feasibility
-- Completeness
-- Scope and alignment
-- Architecture
-- Intent preservation
-- Security (see `rubrics/security-review-rubric.md`)
-- Testing-quality (see `rubrics/testing-quality-rubric.md`)
-- Data-migration (see `rubrics/data-migration-rubric.md`)
-- Runtime-reliability
-- Mechanical-precision (see `rubrics/mechanical-precision-rubric.md`)
-
-## Reviewer Results
-
-| Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | ---: | ---: | --- |
-| Feasibility | PASS | 0 | 0 | Command, adapters, reports and CI entrypoint exist. |
-| Completeness | PASS | 0 | 0 | All seven approved summary points are saved, including HTML features. |
-| Scope and alignment | PASS | 0 | 0 | Describes retained implementation without discarded experiments. |
-| Architecture | PASS | 0 | 0 | Selection, packing, adapters and outputs match implementation. |
-| Intent preservation | PASS | 0 | 0 | Preserves the user-approved summary verbatim. |
-| Security | PASS | 0 | 0 | Isolation and disabled-tool claims match code; no private source or credentials added. |
-| Testing-quality | PASS | 0 | 0 | Tests and CI coverage entrypoint exist; no new test execution is claimed. |
-| Data-migration | NOT_APPLICABLE | 0 | 0 | No migration or persistence change. |
-| Runtime-reliability | PASS | 0 | 0 | Timeouts, cancellation, truncation rejection and all-calls-success publication match code. |
-| Mechanical-precision | NOT_APPLICABLE | 0 | 0 | Retrospective summary; no new implementation contract. |
-
-## Orchestrator Notes (not findings)
-
-Scope: only the newly appended Branch summary for the PR body. The earlier checkpoint remains historical.
-Two independent read-only reviewers covered all ten lenses: pr_summary_accuracy_review covered
-feasibility, completeness, scope/alignment, intent preservation and mechanical precision;
-pr_summary_contract_review covered architecture, security, testing-quality, data-migration and
-runtime-reliability. Both returned zero blockers or advisories. No advisory filter was needed.
-The host aggregated their verdicts. No product code changed, no new test execution is claimed,
-and this review does not establish Grok accuracy or speed parity. `git diff --check` passed.
-
-## Findings
-
-No blocking findings, advisory findings or warnings.
diff --git a/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md b/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md
deleted file mode 100644
index 89786001..00000000
--- a/docs/metareview/reviews/mrv-20260930-134049972166000-artifact-comparison-ae9780dc.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# metareview: artifact review
-
-Run ID: mrv-20260930-134049972166000-artifact-comparison-ae9780dc
-
-Target: .metareview/reports/full-comparison-20260930T133301Z/comparison.json
-
-Context pack: docs/metareview/context/mrv-20260930-134049972166000-artifact-comparison-ae9780dc-context.md
-
-Execution mode: parallel-subagents-adjudicated
-
-Previous run: none
-
-Required lenses: feasibility, completeness, scope-alignment, architecture, intent-preservation, security, testing-quality, data-migration, runtime-reliability, mechanical-precision
-
-## Verdict
-
-PASS — zero blocking findings and zero unresolved advisory findings.
-
-## Reviewer Results
-
-| Lens | Reviewer | Verdict | Blocking | Warnings | Notes |
-| --- | --- | --- | ---: | ---: | --- |
-| Feasibility | pr_summary_accuracy_review | PASS | 0 | 0 | Reports saved; sample claims traceable to source, callers and schema. |
-| Completeness | comparison_recall_review | PASS | 0 | 0 | Both reports cover 45 prompts; all published findings examined against 83 reference roots. |
-| Scope and alignment | comparison_recall_review | PASS | 0 | 0 | Requested comparison only; no model tuning or product changes. |
-| Architecture | comparison_recall_review | PASS | 0 | 0 | Recall, sampled precision, and command reliability remain distinct. |
-| Intent preservation | pr_summary_accuracy_review | PASS | 0 | 0 | Same source and model inputs; unchanged model outputs and scoring categories. |
-| Security | pr_summary_contract_review | PASS | 0 | 0 | Actual guards checked; private source/report payloads remain ignored. |
-| Testing-quality | pr_summary_contract_review | PASS | 0 | 0 | Fixed samples and bounded conclusions; no unsupported test or accuracy claims. |
-| Data-migration | pr_summary_contract_review | PASS | 0 | 0 | Sample claims checked against migrations/schema; historical production impact not presumed. |
-| Runtime-reliability | pr_summary_accuracy_review | PASS | 0 | 0 | Failed standard Grok command and multi-attempt recovery are explicit. |
-| Mechanical-precision | comparison_recall_review | PASS | 0 | 0 | Final counts, denominators, overlap and elapsed-time arithmetic match evidence. |
-
-## Orchestrator Notes (not findings)
-
-The same pinned repository revision supplied 1,346 selected files, 4,616,754 source bytes,
-and 45 byte-identical prompts to both models. Settings were 8 concurrent calls,
-30-minute call timeout, medium effort, no tools, and shared system prompt/schema.
-
-Opus completed its standard command in 297.916 seconds with 222 findings.
-Grok's standard command failed after 1801.678 seconds on invalid JSON after 22 completed
-responses, without publishing partial output. Recovery retained those exact successful
-assistant texts and used the unchanged production pipeline for 23 remaining prompts.
-A stopped cache-matching attempt is included in the totals. The resulting complete report
-has 625 findings; elapsed time from the original start was 4748.696 seconds (15.94x Opus),
-including 4409.402 seconds of active commands and 339.295 seconds of recovery gaps.
-These are recovery-inclusive measurements, not a successful single-run Grok latency.
-
-Reference-root matching found 58/83 for Opus and 60/83 for Grok:
-47 shared, 13 Grok-only, 11 Opus-only, 12 missed by both.
-The 30-finding samples yielded supported/false-or-unsupported/mixed/unresolved counts
-of 18/7/3/2 for Opus and 11/14/3/2 for Grok.
-The Opus-origin reference-panel bias, sample size, advisory inclusion, severity limits,
-and lack of repeatability estimates are explicit in the final artifacts.
-
-Two reviewers split each fixed precision sample into 15 findings apiece. A third reviewed
-the complete reference mappings and final comparison. Evidence is saved locally under
-the target's report directory in each model's precision-reviewed.json and recall-review.json;
-grok-recovered/final-assessment.json records final artifact hashes.
-Source coverage and performance records are also saved there.
-Only summary metrics are included in the committed context; source excerpts, prompt
-captures, detailed findings, and HTML reports remain private and ignored.
-
-Advisory consolidation grouped the measurement-disclosure concerns from architecture
-and mechanical-precision. Their stated consequence was misleading accuracy/performance
-claims; the rebuttal was that the final artifacts already disclose each limitation.
-The single read-only staff-bar filter (pr_summary_accuracy_review) dropped the satisfied
-cluster, requested no changes, and flagged no candidate blockers. The recall reviewer
-then returned final PASS verdicts with zero unresolved advisories.
-
-No product code changed for this comparison. The benchmark itself, source-coverage
-checks, and source adjudication are the evidence; no fresh full test-suite pass is claimed.
-
-## Findings
-
-No unresolved findings.
-
-## Blocking Findings
-
-None.
-
-## Advisory Findings
-
-None.
diff --git a/metareview-grok-source-review-goal.md b/metareview-grok-source-review-goal.md
deleted file mode 100644
index 927ea8bc..00000000
--- a/metareview-grok-source-review-goal.md
+++ /dev/null
@@ -1,164 +0,0 @@
-# Grok source review
-
-<!-- CODING-GOAL-BEGIN -->
-
-/goal Make `metareview source-review --model grok` finish on a real
-repository and write its findings file and page.
-
-This file is the contract. Do not edit it during the walk. Scores, the
-session id, and evidence paths go in
-/Users/ben/code/metareview/metareview-grok-source-review-progress.md.
-Create that progress file at the start. A new session starts at the first
-checkpoint.
-
-## Authority
-
-Repository: /Users/ben/code/metareview, branch
-`whole-repo-source-review`. This goal narrows
-`metareview-whole-repo-source-review-goal.md`. Every rule in that file
-still holds except where this file changes the Grok call or adds to
-`Run`. Do not edit that file.
-
-This goal is the approval to implement this scope. Do not commit, push,
-or open a pull request.
-
-## What went wrong
-
-The command was:
-
-```
-go run ./cmd/metareview source-review --model grok --output /tmp/hh-grok /Users/ben/code/hh
-```
-
-It was killed after 10 hours. `/tmp/hh-grok` is empty. It did not hang.
-
-- `hh` at commit `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` keeps 1,346
-  files, 4,616,754 bytes. `Pack` turns that into 40 prompts.
-- `grok -p <prompt>` runs Grok's full agent, not a single completion.
-  Grok cuts the ~120 KB argument down to an excerpt and saves the full
-  text to `~/.grok/sessions/<cwd>/<id>/prompts/prompt_0.txt`. The model
-  then reads that file back with `read_file` and `grep`. Session
-  `01a0cb4a-3519-7f11-8ffd-628326f49543` made 31 tool calls and 11 model
-  calls and read 844,756 input tokens for one prompt.
-- In 10 hours Grok finished 35 of the 40 prompts, at 10 to 25 minutes
-  each. The kill came during prompt 36. The Grok session folders under
-  `~/.grok/sessions/%2FUsers%2Fben%2Fcode%2Fmetareview/` are the record,
-  from `01a0cb4a…` at 15:43 to `01a0cd6b…` at 01:39.
-- `Run` sends the prompts one at a time. It writes nothing until every
-  prompt succeeds. No call has a time limit.
-
-## Measured call shapes
-
-These were run by hand against prompt 1 of `hh`, the 119,998-byte
-`prompt_0.txt` above. Each was run once. The goal must re-measure.
-
-1. `grok -p "<prompt>" -m grok-4.7 --output-format json --tools ""
-   --max-turns 1 --no-subagents --disable-web-search`: exit 1 after
-   14 s with `max turns reached`. The model text was "The omitted source
-   is required before I can finish the review." The argument was still
-   cut to an excerpt.
-2. `grok --prompt-file <f> --verbatim` plus the flags in 1: exit 1 after
-   170 s with `max turns reached`. The model still tried to call a tool.
-3. The flags in 2 plus `--json-schema <findings schema>` and
-   `--system-prompt-override "You are a code reviewer. You have no tools.
-   Everything you need is in the user message. Answer in a single
-   message."`: exit 0 after 451 s. One turn, `stopReason` `end_turn`,
-   49,803 input tokens, 30,712 output tokens (29,374 of them reasoning).
-   `text` held `{"findings":[...]}` with 11 findings that cite real
-   lines in `data/dumps/schema.sql`.
-
-`-m grok-4.7` shows up as `grok-4.7-build` in `modelUsage`. That is the
-CLI's own mapping. Leave the model id as `grok-4.7`.
-
-## Outcome
-
-1. Grok call shape. `Call` runs Grok as one turn with no tools:
-
-   ```
-   grok --prompt-file <file> --verbatim -m grok-4.7 --output-format json
-        --json-schema <schema> --tools "" --max-turns 1 --no-subagents
-        --disable-web-search --system-prompt-override <text>
-   ```
-
-   `<file>` holds exactly the prompt bytes. It is created in
-   `os.TempDir()`, never inside the reviewed tree or the output
-   directory, and removed after the call whether the call worked or not.
-   `<schema>` is a JSON Schema for `{"findings":[...]}`. It requires all
-   eight fields, limits `tag` to `bug`/`advisory` and `severity` to
-   `P0`–`P3`, and makes `start_line`, `end_line`, and `confidence`
-   integers. The prompt text, the parser, and `Validate` are the same as
-   before. The model text is still `text`. Opus and Astra call shapes do
-   not change. Use only flags that `grok --help` (1.0.40) lists. If a
-   flag in this list turns out not to be needed, keep it anyway. It
-   stops Grok from acting as an agent. If one is rejected, stop and
-   record the CLI's error.
-
-2. Per-call time limit. Each CLI call has a time limit, set with
-   `--call-timeout <duration>` and defaulting to 30m. When the limit is
-   reached, the process and its children are killed, the run fails with
-   an error that names the prompt number, and neither output file is
-   written. This applies to all three models.
-
-3. Concurrency. `--jobs <n>` runs up to n prompts at once. It defaults
-   to 8 and must be at least 1. The findings array stays in prompt order
-   whatever order the calls finish in. When one prompt fails, no new
-   prompts start, calls already running are cancelled, and nothing is
-   written. The `prompt-begin`/`prompt-end` blocks on stdout are still
-   printed in prompt order, and each block is printed whole. This
-   applies to all three models.
-
-4. Progress. After each prompt finishes, stderr gets one line:
-   `prompt <i>/<N> done in <seconds>s (<k> findings)`. A long run is
-   never silent.
-
-## Checkpoints
-
-Record Pass or Fail in the progress file only. A later checkpoint starts
-only after every earlier one is Pass. The first checkpoint is Unverified.
-
-1. Reproduce. Re-run call shape 3 above on one `hh` prompt, built with
-   `Pack` from `Select` at the `hh` commit and not taken from the Grok
-   session folder. Record the exit code, time, turns, and finding count.
-   Then run call shape 1 or 2 once and record that it fails. No product
-   change in this checkpoint.
-2. Grok call. The fake exec shows the exact argv in Outcome 1. The
-   `--prompt-file` file holds the prompt bytes during the call, is
-   outside the tree and the output directory, and is gone after a
-   successful call, a non-zero exit, and a process that cannot start.
-   `--json-schema` parses as JSON and requires the eight fields. Every
-   existing parser and failure test for Grok still passes, updated only
-   for the new argv.
-3. Time limit and concurrency. Fake-exec tests show: a call that runs
-   past `--call-timeout` fails the run, names the prompt, and leaves the
-   output directory empty; with `--jobs 3` and replies that finish in
-   reverse order, the findings array is in prompt order; at most `n`
-   calls run at the same time (checked with a counter in the fake);
-   after a failure no new call starts and the output directory is
-   empty; `--jobs 0` and a bad `--call-timeout` exit 2 with usage. The
-   progress line appears once per prompt.
-4. Fixture proof. The live Grok command from the first goal, run against
-   that goal's `fixture-kept`, writes `findings.json` and `review.html`
-   with model `grok-4.7`, the fixture commit, and counts that match the
-   findings. Record the time.
-5. Real proof. From `/Users/ben/code/metareview`:
-
-   ```
-   go run ./cmd/metareview source-review --model grok --output /tmp/hh-grok /Users/ben/code/hh
-   ```
-
-   Empty `/tmp/hh-grok` first. It exits 0 within 1 hour of wall-clock
-   time, runs all 40 prompts, and writes `/tmp/hh-grok/findings.json` and
-   `/tmp/hh-grok/review.html`. The page shows model `grok-4.7`, commit
-   `7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b`, both filters, and P0–P3
-   counts that match the findings. Record the wall-clock time, the
-   `--jobs` value, the time of each prompt from the progress lines, and
-   the finding count. If Grok rate-limits at the default `--jobs`,
-   record the CLI's error and the `--jobs` value that worked. A
-   `--call-timeout` that fires is recorded along with its prompt number.
-   It counts as a Fail, not as a reason to raise the limit silently.
-6. Gate. `go test` for every package this goal touched exits 0.
-   `internal/sourcereview` stays at 100% statement coverage (`make
-   cover`). The progress file names the commands, the commits, the
-   output paths, and the Grok session ids of the live runs.
-
-<!-- CODING-GOAL-END -->
diff --git a/metareview-grok-source-review-progress.md b/metareview-grok-source-review-progress.md
deleted file mode 100644
index 575bf334..00000000
--- a/metareview-grok-source-review-progress.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# Grok source review progress
-
-Session: Claude Code ccb3697d-57f7-43c7-afbe-b80f430f5235
-
-Evidence: /private/tmp/claude-501/-Users-ben-code-metareview/ccb3697d-57f7-43c7-afbe-b80f430f5235/scratchpad/evidence
-
-Goal file `metareview-grok-source-review-goal.md` is not edited. No commit, push, or pull request.
-
-## Checkpoint 1 — Reproduce
-
-Status: Pass
-
-The 40 `hh` prompts were built with `Select` + `Pack` at `hh` commit
-`7d257e0f8efcfcfdd5d31ef71346a3fa48cf192b` through a scratch test file overlaid with `go test -overlay`
-(nothing written to the repo) into `hh-prompt-01.txt` … `hh-prompt-40.txt`. `hh-prompt-01.txt` is
-byte-identical to the Grok session's `prompt_0.txt` (`cmp` exit 0). Measured on `hh-prompt-02.txt` (`cp1.sh`):
-
-- Call shape 3: exit 0, 795 s, 1 turn, `stopReason` `end_turn`, 5 findings, 47,994 input tokens,
-  55,233 output tokens (54,532 reasoning). Grok session `01a0cede-8b2d-7ef2-9f24-a4ada8e47544`.
-  Files: `cp1-shape3.json`, `cp1-shape3.meta`.
-- Call shape 1: exit 1, 13 s, `stopReason` `cancelled`, stderr `Error: max turns reached`, text "The
-  omitted middle of the review request is the part I still need." Grok session
-  `01a0cede-8b95-7033-8813-5a2f8b5206df`. Files: `cp1-shape1.json`, `cp1-shape1.err`.
-
-No product change in this checkpoint.
-
-## Checkpoint 2 — Grok call
-
-Status: Pass
-
-`Call` (`internal/sourcereview/model.go`) writes the prompt with `writePromptFile` (`os.CreateTemp("",
-"metareview-grok-prompt-*.txt")`), runs `grok` with `grokArgs(path)`, and removes the file in a `defer`.
-`grokSchema` and `grokSystem` are the schema and system prompt. `TestCallShapes` checks the exact argv
-against `grokWant`, with nil stdin, and checks that the file holds the prompt. `TestGrokPromptFile` checks
-during the call that the file holds the prompt bytes, sits in `os.TempDir()`, and is outside a tree dir and an
-output dir. It checks the file is gone after success, a non-zero exit, and a runner that cannot start, and after
-a real `OSRunner` with an empty `PATH`. `TestWritePromptFileErrors` covers the create and write failures.
-`TestGrokSchema` parses the schema and checks the eight required fields, the integer types, and the enums. The
-existing Grok parser/failure tests in `TestCallErrors` are unchanged apart from the added `ctx` argument.
-`TestRunSpecFixtureThreeModels` now reads the Grok prompt from `--prompt-file`.
-
-## Checkpoint 3 — Time limit and concurrency
-
-Status: Pass
-
-`Runner.Run` takes a `context.Context`. `OSRunner` uses `exec.CommandContext` with the `internal/fsm/cmdexec`
-process-group pattern (`Setpgid`, `Cancel` = `kill(-pgid, SIGKILL)`, `WaitDelay`). `Run` → `review` runs up
-to `Jobs` prompts (default 8) under a semaphore, each call has `context.WithTimeout(CallTimeout)` (default
-30m), and the results come back in prompt order. CLI: `--jobs`, `--call-timeout`. Tests:
-
-- `TestOSRunnerKillsProcessGroup`: a 300 ms deadline kills `sh` and its backgrounded `sleep 30` child
-  (the child pid is gone).
-- `TestRunCallTimeout`: an error with `prompt 1/1` and `timed out after 50ms`, and an empty output directory.
-- `TestRunJobsKeepPromptOrder`: `--jobs 3`, five prompts that finish in reverse. Findings are in prompt
-  order, max concurrent calls is exactly 3, prompt blocks print whole and in order, and each
-  `prompt i/5 done in Ns (1 findings)` line appears once.
-- `TestRunFailureStopsNewCalls`: with 1 job, a failure means 1 call and no more. With 2 jobs, prompt 1 fails
-  while prompt 2 blocks: prompt 2 is cancelled, exactly 2 calls are made, prompt 1's error is returned, and
-  the output directory is empty.
-- `TestCLI`: `--jobs 0`, `--jobs two`, `--call-timeout 0`, `-5m`, `soon`, and a missing value each exit 2 with
-  usage. The defaults are 8 and 30m.
-- `TestRunBadJobsAndTimeout`: a negative `Jobs`/`CallTimeout` in `Options` fails before any call.
-
-`go test -count=5 -race ./internal/sourcereview` exit 0.
-
-## Checkpoint 4 — Fixture proof
-
-Status: Pass
-
-`live.sh live-grok-fixture-2 <fixture-kept>` ran the built binary with `source-review --model grok --output
-<evidence>/live-grok-fixture-2 <first goal's fixture-kept>`. Fixture commit
-`1720b406e24e6f15e069f8aeb63a723582ce3968`. Exit 0 in 32 s. stderr `prompt 1/1 done in 31s (1 findings)`.
-Kept `pkg/app.go`, `pkg/note.go`, and the seven dropped paths printed before `prompt-begin`. `findings.json`
-has 1 finding (P1). The page shows `grok-4.7`, the commit, `id="severity"`, `id="directory"`, P0 0 / P1 1 /
-P2 0 / P3 0, and 1 finding block (`check.sh`). An earlier run (`live-grok-fixture`, 9 s, 0 findings, four zero
-counts) was made before checkpoint 1 finished. It is kept only as a second sample.
-
-## Checkpoint 5 — Real proof
-
-Status: Fail
-
-This is the exact goal command, run from `/Users/ben/code/metareview` by `real.sh`, which emptied `/tmp/hh-grok`
-first (0 entries, `real.before`), with the default `--jobs` 8 and `--call-timeout` 30m. It started 08:38:54.
-Result: exit 1 after 3,631 s. stderr: `prompt 19/40: call timed out after 30m0s: grok: signal: killed`.
-`/tmp/hh-grok` is empty afterwards. No `grok --prompt-file` process was left behind (`pgrep`).
-
-22 of 40 prompts finished before the timeout. Their times in seconds (sorted): 107 624 855 896 951 955 974
-991 1083 1087 1095 1099 1123 1142 1170 1218 1242 1259 1279 1291 1434 1701. The median is about 1,100 s. The
-same prompt shape took 451 s and 795 s alone (checkpoint 1). With 8 at once, each call is slower, and one
-took longer than 30 minutes. At that rate 40 prompts take about 40 × 1,100 / 8 ≈ 92 minutes even without a
-timeout. Neither the 1-hour bound nor the 30-minute call limit is met. The limit was not raised. Log:
-`real.log`, `real.err`, `real.exit`.
-
-Cause: Grok's per-prompt latency is reasoning. Checkpoint 1 was 54,532 reasoning tokens out of 55,233
-output tokens. It is not the call shape (1 turn, no tools). Meeting the bound needs a change this contract
-does not allow, such as `--reasoning-effort` (listed by `grok --help`, not measured) or a different `--jobs`
-/ prompt budget. Those are Ben's decisions.
-
-## Checkpoint 6 — Gate
-
-Status: Unverified. It does not start while checkpoint 5 is Fail. For the record: `make cover` exit 0 with
-`coverage gate passed` and `internal/sourcereview` at 100.0% (`make-cover.txt`). `go test` for
-`internal/sourcereview`, `internal/classify`, and `cmd/metareview` exit 0 at 100.0% each.
diff --git a/metareview-grok-speed-goal.md b/metareview-grok-speed-goal.md
deleted file mode 100644
index 084aef2e..00000000
--- a/metareview-grok-speed-goal.md
+++ /dev/null
@@ -1,105 +0,0 @@
-# Grok speed
-
-<!-- CODING-GOAL-BEGIN -->
-
-/goal Make `metareview source-review --model grok` faster without losing
-review quality, by testing six changes one at a time on the real code and
-keeping only the ones that win.
-
-This file is the contract. Do not edit it during the walk. Results go in
-/Users/ben/code/metareview/metareview-grok-speed-progress.md. Create it at
-the start.
-
-## Authority
-
-Repository /Users/ben/code/metareview, branch `whole-repo-source-review`,
-starting at commit `0b05fa4`. This goal approves the code changes below and
-one `flow-pro commit` per kept change. It does not approve anything else.
-
-## Rules
-
-- Every measurement runs the real command on the real `hh` checkout:
-  `metareview source-review --model <m> --path <path>... --output <dir> /Users/ben/code/hh`,
-  built from the working tree. No fixture repos, no scratch harnesses, no
-  direct `grok` or `claude` calls outside `source-review`.
-- Output directories go under `/tmp/grok-speed/`.
-- Astra is out of scope. Do not run it. Keep `codexArgs` compiling and tested.
-- No API keys. Everything goes through the logged-in CLIs.
-- `--reasoning-effort low` is never kept. It loses findings (4.4 against 6.8).
-- Every model keeps the same setup (system prompt, instruction, answer
-  format, tools off). A change to shared setup is measured on Opus too.
-- A change is kept only if `go test` passes with `internal/sourcereview` at
-  100% coverage and `make cover` passes.
-
-## The sample and the score
-
-Sample S1: `--path web/src/routes/DirectDeposit.svelte` (one prompt).
-
-Sample S2: a `--path` set of real `hh` source that packs into at least 4
-prompts at the 120,000-byte limit. Choose it in checkpoint 1 and record it.
-Use it unchanged for the rest of the walk.
-
-The core bugs are three bugs Opus finds on S1 in every run:
-1. `result.data.errors` read without checking `result.data` (lines ~294–306).
-2. bank name, routing and account number only required when `checkPending`
-   is true (lines ~87–134).
-3. Cancel on a saved deposit leaves edited fields changed (lines ~202–208).
-
-A finding covers a core bug when its cited lines overlap that range and its
-issue text is about that bug. Check each finding by reading it, not by line
-numbers alone.
-
-An arm is 5 runs. Its score:
-- time: mean seconds per run (S1), or mean sum of per-prompt seconds from the
-  `prompt i/N done in Ns` lines (S2);
-- findings: mean finding count;
-- core: mean number of the 3 core bugs covered (S1 only).
-
-A change wins when, against the current baseline arm:
-- time is at least 10% lower, and
-- findings is no more than 0.5 lower, and
-- core is not lower.
-
-Otherwise it loses. A loss is reverted from the working tree. A win is
-committed with `flow-pro commit` and becomes the new baseline.
-
-## Changes, in this order
-
-1. Drop the forced answer format: remove `--json-schema` from `claudeArgs`
-   and `grokArgs`. Measure Grok and Opus on S1.
-2. Bigger prompts: raise `MaxPromptBytes` so S2 packs into about a quarter
-   as many prompts. Measure Grok on S2 with `--jobs 1`, and Opus on S2.
-   Also record findings per prompt. First check that Grok accepts a prompt
-   that large; if it rejects it, record the CLI's error and pick the largest
-   size it accepts.
-3. `grok-4.7-build-fast`: change the Grok model id. Measure Grok on S1. The
-   page's model id changes with it.
-4. `--reasoning-effort medium` for Grok. Measure Grok on S1.
-5. Sampling settings: look for a repetition-penalty, temperature, or similar
-   setting the Grok CLI accepts (`grok --help`, `grok inspect`,
-   `~/.grok/config.toml`, `~/.grok/docs`). If none exists, record where you
-   looked and skip this change. If one exists, pass it per call from
-   `grokArgs` (do not edit the user's config) and measure Grok on S1.
-6. Duplicate a slow call: when a Grok call runs past 2× the median of the
-   calls already finished in that run (at least 3 finished), start one
-   duplicate of that prompt and use whichever finishes first; kill the other.
-   Measure Grok on S2 with `--jobs 8` by wall-clock time, not the sum.
-
-## Checkpoints
-
-Record Pass or Fail in the progress file only. A later checkpoint starts only
-after every earlier one is Pass. The first checkpoint is Unverified.
-
-1. Baseline. Choose S2. Run 5 Grok and 5 Opus runs on S1, and 5 Grok (`--jobs 1`)
-   and 5 Opus runs on S2, at commit `0b05fa4`. Record every run and the
-   baseline scores.
-2. through 7. One checkpoint per change, in the order above. Each records
-   every run, the scores against the baseline, the decision (kept or
-   dropped), and for a kept change the commit sha. A dropped change leaves
-   `git status` clean.
-8. Summary. One table: each change, Grok time before and after, findings,
-   core, decision. Then one real `source-review --model grok --jobs 8` on the
-   full `hh` checkout with the final code, recording wall-clock time, total
-   findings, and whether it wrote `findings.json` and `review.html`.
-
-<!-- CODING-GOAL-END -->
diff --git a/metareview-grok-speed-progress.md b/metareview-grok-speed-progress.md
deleted file mode 100644
index 25349ebd..00000000
--- a/metareview-grok-speed-progress.md
+++ /dev/null
@@ -1,193 +0,0 @@
-# Grok speed progress
-
-Session: Claude Code ccb3697d-57f7-43c7-afbe-b80f430f5235
-
-Evidence: /private/tmp/claude-501/-Users-ben-code-metareview/ccb3697d-57f7-43c7-afbe-b80f430f5235/scratchpad/speed
-(`arm.sh` runs the real source-review; `results.tsv` has one row per run; `logs/` holds each run's stdout and stderr;
-outputs are under `/tmp/grok-speed/`).
-
-Goal file `metareview-grok-speed-goal.md` is not edited.
-
-## Checkpoint 1 — Baseline
-
-Status: Pass
-
-Commit `0b05fa4`. S2: `--path app/controllers/admin --path app/models/reporting --path app/models/concerns`
-(488,772 raw bytes across those directories before the source cut). It packs into 5 prompts in every run.
-
-All 20 runs were started together (`baseline.sh`), so up to 10 Grok and 10 Opus calls ran at once. Rows are in
-`results.tsv` with label `base`. An earlier attempt exited 2 on every run because `arm.sh` passed the run number
-as an extra argument; that was a script bug, fixed, and those rows were discarded.
-
-| Arm (5 runs) | Time | Findings | Core |
-|---|---|---|---|
-| Grok S1 | 539 s (381–615) | 6.2 (4–9) | 3.0 |
-| Opus S1 | 63 s (52–76) | 5.8 (5–6) | 3.0 |
-| Grok S2, `--jobs 1`, sum of 5 prompts | 5,644 s (5,183–5,934) | 113 (103–119) | — |
-| Opus S2, `--jobs 1`, sum of 5 prompts | 265 s (234–289) | 33.2 (27–41) | — |
-
-Core: every run of both models covers all three core bugs (read with `show.sh`): the required-field check
-(lines ~87–134), the unguarded `result.data.errors` (~294–306), and Cancel not restoring fields (~202–208).
-
-Method note for later checkpoints: run times depend on how many calls run at once (Opus S1 took ~30 s alone
-earlier and ~63 s here). So each change is measured side by side with a fresh baseline arm in the same batch,
-and the change is judged against that fresh baseline, which is stricter than comparing with this table.
-
-## Checkpoint 2 — No forced answer format
-
-Status: Pass (change dropped)
-
-Change: remove `--json-schema` from `claudeArgs` and `grokArgs`. Measured on S1 in one batch (`cp2.sh`): the
-change (label `c2`) side by side with a fresh baseline built from `0b05fa4` (label `c2base`), 5 runs each,
-for Grok and Opus.
-
-| Arm (5 runs, S1) | Time | Findings | Core |
-|---|---|---|---|
-| Grok, baseline | 717 s (546–914) | 7.8 (4–13) | 2.8 |
-| Grok, no answer format | 530 s (458–589) | 5.8 (5–8) | 2.8 |
-| Opus, baseline | 87 s (62–116) | 4.8 (4–5) | 3.0 |
-| Opus, no answer format | 85 s (64–101) | 5.8 (5–7) | 3.0 |
-
-Core, read finding by finding (`show.sh`): Grok baseline run 3 and Grok change run 1 have no finding on the
-unguarded `result.data.errors`; every other run covers all three.
-
-Decision: dropped. Grok time is 26% lower, but Grok findings are 2.0 lower, past the 0.5 limit. The working
-tree is reverted; `git status` shows only the untracked goal and progress files.
-
-## Checkpoint 3 — Bigger prompts
-
-Status: Pass (change dropped)
-
-Change: `MaxPromptBytes` 120,000 → 480,000, so S2 packs into 2 prompts instead of 5. Grok accepted the larger
-prompts (no size error). Measured on S2 with `--jobs 1` in one batch (`cp3.sh`): the change (label `c3`) side by
-side with a fresh baseline from `0b05fa4` (label `c3base`), 5 runs each, Grok and Opus.
-
-| Arm (S2, `--jobs 1`) | Time (sum of prompts) | Findings | Findings per prompt |
-|---|---|---|---|
-| Grok, 120 KB (4 of 5 runs) | 5,745 s (5,429–6,011) | 105.8 (99–111) | 21.2 |
-| Grok, 480 KB (4 of 5 runs) | 2,087 s (1,886–2,475) | 58.3 (52–64) | 29.1 |
-| Opus, 120 KB | 320 s (290–389) | 36.0 (34–38) | 7.2 |
-| Opus, 480 KB | 168 s (144–186) | 13.2 (12–15) | 6.6 |
-
-One Grok run in each arm failed on the 30-minute call timeout and wrote nothing: `c3base` run 2 at prompt 4/5,
-`c3` run 2 at prompt 1/2. The Grok means cover the 4 runs that finished.
-
-Decision: dropped. Grok time is 64% lower, but Grok findings are 47.5 lower (Opus 22.8 lower), far past the
-0.5 limit. Grok's time per call barely changes at four times the size (about 1,000 s against about 1,100 s),
-but both models report far fewer findings for the same code. The working tree is reverted.
-
-## Checkpoint 4 — grok-4.7-build-fast
-
-Status: Pass (change dropped)
-
-Change: Grok model id `grok-4.7` → `grok-4.7-build-fast` (`ModelID` and `grokArgs`). Measured on S1 in one batch
-(`cp4.sh`): the change (label `c4`) side by side with a fresh baseline from `0b05fa4` (label `c4base`), 5 Grok runs each.
-
-| Arm (Grok, S1) | Runs that wrote output | Time | Findings | Core |
-|---|---|---|---|---|
-| Baseline `grok-4.7` | 5 of 5 | 474 s (344–566) | 6.4 (5–8) | 3.0 |
-| `grok-4.7-build-fast` | 3 of 5 | 268 s (90–358) | 6.3 (6–7) | 3.0 |
-
-Runs 1 and 2 of the change exited 1 after 143 s and 69 s: the Grok CLI returned
-`"structuredOutputError": "model did not produce structured output"` (`logs/c4-grok-S1-1.err`). The three runs that
-finished cover all three core bugs.
-
-Decision: dropped. On the runs that finished it is 43% faster with the same findings and core, but 2 of 5 runs
-produced no review at all, and one failed prompt fails a whole `source-review` run. The working tree is reverted.
-
-## Checkpoint 5 — Medium reasoning effort
-
-Status: Pass (change kept)
-
-Change: `grokArgs` adds `--reasoning-effort medium`. Measured on S1 in one batch (`cp5.sh`): the change (label `c5`)
-side by side with a fresh baseline from `0b05fa4` (label `c5base`), 5 Grok runs each.
-
-| Arm (Grok, S1) | Time | Findings | Core |
-|---|---|---|---|
-| Baseline (default effort) | 623 s (511–727) | 6.4 (4–9) | 2.8 |
-| `--reasoning-effort medium` | 502 s (406–576) | 7.8 (5–10) | 3.0 |
-
-Core, read finding by finding: baseline run 3 has no Cancel finding; every other baseline run and every medium
-run covers all three core bugs.
-
-Decision: kept. Time is 19% lower, findings are 1.4 higher, and core is not lower. `grokWant` in `model_test.go`
-names the new flag; `go test` for `internal/sourcereview` and `cmd/metareview` passes at 100.0%, and `make cover`
-exit 0 (`make-cover-c5.txt`). Commit `0600426` (pushed); it is the baseline for checkpoints 6 and 7.
-
-## Checkpoint 6 — Sampling settings
-
-Status: Pass (change dropped)
-
-Where I looked: `grok --help` has no sampling flag. `~/.grok/config.toml` sets none, and `~/.grok/models_cache.json`
-has `"temperature": null, "top_p": null` for every model, so xAI's server decides. The docs
-(`~/.grok/docs/user-guide/26-config-reference.md`, `05-configuration.md`) list `models.temperature` and `models.top_p`,
-and no repetition penalty. The `GROK_CONFIG` inline JSON overlay may set the `models` table per process without
-touching the user's config; `grok inspect` with it set reports `env_overlay: $GROK_CONFIG (inline)`. Grok does not
-print the effective sampling values, so whether the server applied them is not verified.
-
-Change: run Grok as `env GROK_CONFIG={"models":{"temperature":0.7,"top_p":0.95}} grok …` (the docs' own example
-values). Measured on S1 in one batch (`cp6.sh`): the change (label `c6`) side by side with a fresh baseline built
-from `0600426` (label `c6base`, medium effort), 5 Grok runs each.
-
-| Arm (Grok, S1) | Time | Findings | Core |
-|---|---|---|---|
-| Baseline (`0600426`) | 494 s (470–509) | 5.4 (4–7) | 2.8 |
-| temperature 0.7, top_p 0.95 | 457 s (339–546) | 6.6 (5–8) | 3.0 |
-
-Core: baseline run 3 has no finding on the unguarded `result.data.errors`; every other run covers all three.
-
-Decision: dropped. Time is 7.5% lower, short of the 10% bar (findings and core did not get worse). The working
-tree is reverted.
-
-## Checkpoint 7 — Duplicate a slow call
-
-Status: Pass (change dropped)
-
-Change: in `review`, a call that runs past twice the median of the calls already finished in the run (once 3 have
-finished) gets one duplicate; the first to finish without error wins and the other is cancelled
-(`callHedged`, `durations`). Unit tests covered it at 100% (a slow first attempt is cancelled when the duplicate
-wins; an early failure gets no duplicate; a failed first attempt is rescued by the duplicate; two failures return
-the first error), passing 5 times under `-race`. Measured on S2 with `--jobs 8` in one batch (`cp7.sh`): the
-change (label `c7`) side by side with a fresh baseline built from `0600426` (label `c7base`), 5 Grok runs each,
-judged by wall-clock time.
-
-| Arm (Grok, S2, `--jobs 8`) | Wall time | Findings |
-|---|---|---|
-| Baseline (`0600426`) | 1,133 s (983–1,248) | 103.6 (85–130) |
-| Duplicate slow calls | 1,163 s (1,084–1,307) | 95.4 (88–101) |
-
-No run started a duplicate (`grep "started a duplicate" logs/c7-*` finds nothing): all 5 S2 prompts run at once
-under `--jobs 8`, so no call is still running after 3 have finished and it has passed twice their median.
-
-Decision: dropped. No time gain (2.6% slower, within noise). `run.go` and `run_test.go` are restored to `0600426`;
-`git diff` touches only this progress file.
-
-## Checkpoint 8 — Summary
-
-Status: Pass
-
-Each change was measured side by side with a fresh baseline in the same batch (5 runs each); "before" is that
-batch's baseline.
-
-| Change | Sample | Grok time before → after | Findings before → after | Core before → after | Decision |
-|---|---|---|---|---|---|
-| No forced answer format | S1 | 717 → 530 s | 7.8 → 5.8 | 2.8 → 2.8 | dropped (findings −2.0) |
-| 480 KB prompts | S2, `--jobs 1` | 5,745 → 2,087 s | 105.8 → 58.3 | — | dropped (findings −47.5) |
-| `grok-4.7-build-fast` | S1 | 474 → 268 s (3 of 5 runs) | 6.4 → 6.3 | 3.0 → 3.0 | dropped (2 of 5 runs failed) |
-| `--reasoning-effort medium` | S1 | 623 → 502 s | 6.4 → 7.8 | 2.8 → 3.0 | **kept** (`0600426`) |
-| temperature 0.7 / top_p 0.95 | S1 | 494 → 457 s | 5.4 → 6.6 | 2.8 → 3.0 | dropped (7.5% < 10%) |
-| Duplicate a slow call | S2, `--jobs 8` wall | 1,133 → 1,163 s | 103.6 → 95.4 | — | dropped (never fired) |
-
-Final run with the final code (`0600426`), from `/Users/ben/code/metareview` (`final.sh`):
-
-```
-metareview source-review --model grok --jobs 8 --output /tmp/grok-speed/final /Users/ben/code/hh
-```
-
-Exit 0 after 4,188 s (69.8 minutes) of wall-clock time. 45 prompts, each finished (per-prompt time 172–1,174 s,
-median 740 s). 671 findings. It wrote `/tmp/grok-speed/final/findings.json` (361,003 bytes) and
-`/tmp/grok-speed/final/review.html` (1,264,512 bytes). stderr has two skipped findings (a path that is not kept, and
-line numbers past the end of `data/reports/contractor.sql`); those are dropped by the parser, not failures.
-
-For comparison: the run before this goal (`--jobs 8`, default effort) was measured at about 58 minutes from its
-first 8 prompts, but was stopped there and never completed, so it is not a like-for-like total.
diff --git a/metareview-whole-repo-source-review-goal.md b/metareview-whole-repo-source-review-goal.md
deleted file mode 100644
index 4e6404b7..00000000
--- a/metareview-whole-repo-source-review-goal.md
+++ /dev/null
@@ -1,265 +0,0 @@
-# Whole-repo source review
-
-<!-- CODING-GOAL-BEGIN -->
-
-/goal Add a whole-repo source review to /Users/ben/code/metareview.
-
-This file is the contract. Do not edit it during the walk. Scores, the
-session id, and evidence paths go in
-/Users/ben/code/metareview/metareview-whole-repo-source-review-progress.md.
-Create that progress file at the start. A new session starts at the first
-checkpoint. Do not resume an older progress file unless Ben points at it.
-
-## Authority
-
-Repository: /Users/ben/code/metareview. Origin is
-https://github.com/benkruger/metareview. Upstream is
-https://github.com/dsifry/metareview.
-
-This goal is the approval to implement this scope. Do not commit, push, or
-open a pull request.
-
-Read docs/ARCHITECTURE.md before writing code. Leave the diff review and
-its anchor gate alone. This run is a separate command.
-
-## Outcome
-
-A run reviews the first-party source of a repository. It keeps the files the
-project builds or runs as the product. It drops tests, vendored and
-third-party dependencies, lockfiles, generated code, documentation, and
-configuration. It prints the kept list and the dropped list before any model
-call.
-
-`internal/classify` frames a path as code, config, or docs and still sends
-all three to review (`internal/classify/classify.go`). Leave that behavior
-in place. This cut drops a path when `Classify` returns Config or Docs.
-That drops lockfiles, configuration, and documentation, including the
-lockfile names in `configBase`.
-
-It drops a path when `claimcheck.IsTestPath` is true
-(`internal/claimcheck/claimcheck.go`). `internal/foo_test.go` is Code to
-`Classify` and a test to `IsTestPath`.
-
-It drops a path whose segments include `vendor`, `node_modules`, or
-`third_party`.
-
-It drops a file with a line matching
-`^// Code generated .* DO NOT EDIT\.$` when every line before that
-match is blank or a comment. A blank line is a comment line. A line whose first non-whitespace
-characters are `//` is a comment line, and the rest of that line is the
-comment. A `/*` starts a block and `*/` ends it. A line with no code
-outside that block is a comment line. A line with code before `/*` or
-code after `*/` is not a comment line. The block still runs from `/*`
-to `*/` on the following lines.
-A line that only says `DO NOT EDIT` does not match and the file is
-kept. It drops a file that is not valid UTF-8. `Classify` calls an
-unrecognised path Code.
-
-`gitcontext.generatedExcludedFiles` stays the path exclude for
-metareview's own artifacts. The whole-repo cut is a new selection in
-front of this run.
-
-The user picks Astra, Opus, or Grok. One function runs all three. It
-reads the kept files, sends one or more prompts, and parses
-`lensoutput.TypedFinding`. The prompt text and the parser stay the
-same for every choice. The choice changes only the CLI and the model
-id. Each CLI is the subscription already logged in. The run never sees
-a token. Do not add an HTTP provider or an API key.
-
-Each prompt contains the instruction, then each kept path on its own
-line immediately before that file's text. A dropped file never appears.
-The instruction tells the model to return only `{"findings":[...]}`,
-with `tag` of `bug` or `advisory`, `severity` of `P0`, `P1`, `P2`, or
-`P3`, and every field present: `tag`, `file`, `start_line`, `end_line`,
-`issue`, `consequence`, `confidence`, `severity`. `confidence` is an
-integer from 0 to 100. The whole prompt, which is the instruction, the
-path lines, and the file text, is at most 120,000 bytes. `AGENTS.md` uses 120,000 bytes as the size that
-cannot be held in one review context. Whole kept files are packed into
-the smallest number of prompts that stay under that size. A kept file
-that cannot fit in one prompt is cut into
-consecutive byte slices that partition the file in order. Each slice
-is non-empty and starts and ends on a UTF-8 character boundary. Each
-slice prompt names the original path and the line
-that contains the slice's first byte, tells the model that citations
-use original line numbers, and the whole slice prompt is at most
-120,000 bytes. A finding cites the original path and the original line
-numbers. The findings file is one `{"findings":[...]}` whose array is
-every accepted finding from every prompt, in order. It is not the raw
-answers glued together. The page is still one page. The counts are the
-number of findings for each of `P0`, `P1`, `P2`, and `P3`.
-
-- Opus is `claude` with model id `opus`.
-- Astra is `codex` with model id `gpt-6-astra`. The live Astra command
-  passes it to `-m`. If the CLI rejects it, stop and record the CLI's
-  error.
-- Grok is `grok` with model id `grok-4.7`. That is the default
-  `grok models` prints.
-
-`claude` takes `-p`, `--model`, and `--output-format json`, and reads
-the prompt on stdin. Its stdout is one JSON document. The model text
-is the `result` string (`claudeResult` in
-`internal/fsm/judge/claude.go`). `codex` takes `exec`, `--json`, and
-`-m`, reads the prompt on stdin, and the argv includes `-`. Its stdout
-is a JSON event stream. The model text is `item.text` of the last
-`item.completed` event whose `item.type` is `agent_message`
-(`parseCodexEvents` in `internal/fsm/judge/codex.go`). `grok` takes
-`-p`, `-m`, and `--output-format json`, and `-p` takes the prompt as
-its argument. Its stdout is one JSON document. The model text is the
-`text` string in its JSON output. Use those flags.
-Do not invent flags. The parser reads that model text as `{"findings":[...]}`. Surrounding
-whitespace is ignored. A surrounding fence is a first line of three
-backticks, optionally followed by one word of letters, and a last line
-of three backticks. When the body of that fence is the object, the
-parser uses the body. Any other extra text fails the run. Each
-element is unmarshaled as `wireEntry`
-(`internal/lensoutput/lensoutput.go`). An element that does not
-unmarshal fails the run. A missing field is a nil pointer and fails
-the run. A present element must then pass
-`TypedFinding.Validate`. The path must be a kept file, and the line
-numbers must exist in that file. This run does not call
-`ValidatePayload`. An empty answer is `{"findings":[]}`.
-`{"findings":null}`, a CLI error, missing model text, a missing field,
-or text that is not that object fails the run. A CLI error is a
-process that cannot start, a non-zero exit status, or `is_error` true
-on the Claude document. It is not stored as an empty list. One failed prompt fails the run.
-That run writes neither the findings file nor the page. When no file
-is kept, the run still prints the kept list and the dropped list,
-calls no model, and writes `{"findings":[]}` and the page. The page
-shows that run's commit, the chosen model id, both filters, and four
-zero counts.
-
-`internal/shardpack` and `review-lenses` stay on diff reviews. A finding
-in this run is a `lensoutput.TypedFinding`: tag, file, start_line,
-end_line, issue, consequence, confidence, severity. The cited range
-must fall inside a kept file. The page quotes those lines from the
-file. That quote is the excerpt. It is not a schema field. The page
-shows which model ran. The finding record does not carry a model field.
-
-The output directory is an argument. The proof points it outside the
-fixture. The run refuses an output directory inside the tree under review.
-
-- A findings file.
-- One self-contained HTML file. It opens in a browser with no server and no
-  sibling assets. It shows the repo, commit, model, and counts. Findings
-  filter by severity and by the directory component of `file`. A file
-  in the repo root has parent `.`. Opening a
-  finding shows the
-  issue and consequence beside the quoted lines. The page does not modify
-  the repo, post anywhere, or start another review.
-
-A fake exec proves the call shape for all three. For each one it
-records the binary, the model id, where the prompt was passed, and that
-every prompt contains the instruction and names each kept path before
-that file's text, and contains no dropped file. The whole prompt is at
-most 120,000 bytes. One test packs kept files that do not fit in one
-prompt and shows more than one prompt, each file whole, each prompt at
-most 120,000 bytes. Another test feeds one kept file that does not fit
-in one prompt and shows consecutive non-empty byte slices that
-partition the file on UTF-8 character boundaries, with findings citing
-the original path and original line numbers. A parser test accepts `{"findings":[]}`, accepts an entry with all
-eight fields present that passes `Validate`, and rejects
-`{"findings":null}`, a missing `confidence`, a CLI error, missing model
-text, and an entry that fails `Validate`. A non-zero exit, Claude `is_error` true, and a process that cannot
-start each write neither file. The output directory is empty before
-the failure and still empty after it.
-A renderer test loads two findings with different severities and
-directories, the directory being the directory component of `file`,
-and shows the
-severity filter and the directory filter each
-hide the finding that does not match. The same page shows the `P0`,
-`P1`, `P2`, and `P3` counts, and those counts match the findings. No
-API key is read.
-
-The goal is not done on a fake exec. Three live commands run Astra,
-Opus, and Grok against the fixture. Each command writes to its own
-output directory. Each prompt asks for
-`{"findings":[...]}`. The only source text in each prompt is
-`pkg/app.go` and `pkg/note.go`, and each path is printed before that
-file's text. Each command prints the kept list and the dropped list
-before the model call. Each command writes a findings file and an HTML
-page from that model's answer. Each page shows that model id, the
-fixture commit, both filters, and the `P0`, `P1`, `P2`, and `P3`
-counts, and those counts match the findings. An empty `findings` list
-shows no findings and four zero counts. A mock run does not satisfy
-this.
-
-## Checkpoints
-
-Record Pass or Fail in the progress file only. A later checkpoint starts
-only after every earlier one is Pass. The first checkpoint is Unverified.
-
-1. Seams. Name the files and symbols for the new file selection, the one
-   function that calls `claude`, `codex`, or `grok`, `wireEntry`, and
-   `TypedFinding.Validate`. Cite file:line in the progress file. No
-   product change in this checkpoint.
-2. Source cut. A fixture is a git repository with one commit containing
-   `pkg/app.go`, `pkg/note.go`, `pkg/app_test.go`, `vendor/lib.go`,
-   `go.sum`, `pkg/gen.go`, `pkg/blob.dat`, `README.md`, and
-   `config.yaml`. `pkg/blob.dat` is not valid UTF-8. `pkg/gen.go`
-   has a first line matching `^// Code generated .* DO NOT EDIT\.$`.
-   `pkg/note.go`'s first line is `DO NOT EDIT`.
-   The run prints `pkg/app.go` and `pkg/note.go` as kept, and prints
-   `pkg/app_test.go`, `vendor/lib.go`, `go.sum`, `pkg/gen.go`,
-   `pkg/blob.dat`, `README.md`, and `config.yaml` as dropped. A second
-   fixture is a git repository with one commit of only those dropped
-   files. It prints an empty kept list and that dropped list, calls no
-   model, and writes `{"findings":[]}` and a page. The page shows that
-   commit, the chosen model id, both filters, and four zero counts.
-   Existing
-   classify tests still pass unchanged.
-3. Model choice. Astra, Opus, and Grok go through the one function.
-   The fake exec shows `claude` with `opus`, `codex` with `--json` and
-   `-m gpt-6-astra`, and `grok` with `grok-4.7`. The model text is read
-   from `result`, the last `item.text`, and `text` respectively, then
-   read as `{"findings":[...]}`. Each element is a `wireEntry` with all
-   eight fields present and then passes `TypedFinding.Validate`. The
-   path is a kept file and the line numbers exist in that file.
-   `{"findings":[]}` is empty. `{"findings":null}`, a missing field, a
-   CLI error, missing model text, or an entry that fails `Validate`
-   fails the run. A non-zero exit, Claude `is_error` true, and a
-   process that cannot start each write neither file. The output
-   directory is empty before the failure and still empty after it.
-   Every prompt contains the instruction and asks for that object,
-   names each kept path before that file's text, and is at most
-   120,000 bytes. Kept files that do not fit in one prompt become more
-   than one prompt, each file whole, each prompt at most 120,000
-   bytes. One kept file that does not fit
-   in one prompt becomes consecutive non-empty byte slices that
-   partition the file on UTF-8 character boundaries, and a finding
-   cites the original path and
-   original line numbers. No dropped file appears
-   in any prompt. No API key is read.
-4. Findings. The findings file is one `{"findings":[...]}` written
-   outside the fixture. Its array is every accepted finding from every
-   prompt, in order. A record is a complete `wireEntry` that passes
-   `Validate`, its path is a kept file, and its line numbers exist in
-   that file. The page shows the model id. An empty answer is
-   `{"findings":[]}` from the model. A failed call writes neither the
-   findings file nor the page.
-5. Page. The HTML file renders from that findings file, is self-contained,
-   and filters by severity and by the directory component of `file`.
-   A file in the repo root has parent `.`. It
-   shows the fixture commit, the model id, and the `P0`, `P1`, `P2`,
-   and `P3` counts. Opening a finding shows the issue and consequence
-   beside the quoted lines. It is outside the fixture. There is no
-   existing findings-page seam. The page is new.
-6. Proof. The fake-exec tests cover Astra, Opus, and Grok. Input that
-   does not fit in 120,000 bytes is split into whole-file prompts and
-   into non-empty byte slices that partition one large file on UTF-8
-   character boundaries, and every prompt is at most 120,000 bytes. Three live commands against the fixture, one for each model,
-   each writing to its own output directory,
-   each ask for `{"findings":[...]}`. The only source text in each
-   prompt is `pkg/app.go` and `pkg/note.go`, with each path printed
-   before that file's text. Each writes a findings file and an HTML
-   page. Each command prints the kept list and the dropped list from
-   checkpoint 2 before the model call. Each page shows that model id,
-   the fixture commit, both filters, and the `P0`, `P1`, `P2`, and `P3`
-   counts, and those counts match the findings. An empty `findings`
-   list shows no findings and four zero counts.
-   `go test` for
-   every package this goal touched exits 0. A package this goal adds is
-   at 100% statement coverage, which is what `make cover` enforces. The
-   progress file names the three commands, the commit, and the output
-   paths.
-
-<!-- CODING-GOAL-END -->
diff --git a/metareview-whole-repo-source-review-progress.md b/metareview-whole-repo-source-review-progress.md
deleted file mode 100644
index d6672f39..00000000
--- a/metareview-whole-repo-source-review-progress.md
+++ /dev/null
@@ -1,91 +0,0 @@
-# Whole-repo source review progress
-
-Session: 01a0ca43-3878-7771-aeec-ddc5f7ae9106
-
-Evidence: /var/folders/88/6w9jsm3s1v757_nzs4ybffj40000gn/T/grok-goal-2c246734b978/implementer
-
-Goal file `metareview-whole-repo-source-review-goal.md` is not edited. No commit, push, or pull request.
-
-## Checkpoint 1 — Seams
-
-Status: Pass
-
-Started Unverified. Named the seams below after reading `docs/ARCHITECTURE.md` and the cited files. No product change in this checkpoint.
-
-Selection (new code will compose these; `Classify` stays unchanged and still returns Code for an unrecognised path):
-
-- `classify.Classify` — `internal/classify/classify.go:72`
-- `configBase` (lockfile basenames, reached only through `Classify`) — `internal/classify/classify.go:65`
-- `claimcheck.IsTestPath` — `internal/claimcheck/claimcheck.go:69`
-
-The new selection function will be `sourcereview.Select` in `internal/sourcereview/select.go`. It is not in the tree at this checkpoint.
-
-The one function that will call `claude`, `codex`, or `grok` will be `sourcereview.Call` in `internal/sourcereview/model.go`. It is not in the tree at this checkpoint. It will read model text the way these do:
-
-- Claude `result` and `is_error` — `claudeResult` at `internal/fsm/judge/claude.go:156`, read in `parseClaudeResult` at `internal/fsm/judge/claude.go:201`
-- Codex last `item.completed` / `agent_message` `item.text` — `parseCodexEvents` at `internal/fsm/judge/codex.go:160` (the assignment is `internal/fsm/judge/codex.go:171`)
-- Grok `text` — no existing helper; `Call` will read that JSON string
-
-Findings:
-
-- `wireEntry` — `internal/lensoutput/lensoutput.go:320`
-- `TypedFinding.Validate` — `internal/lensoutput/lensoutput.go:128`
-
-`ValidatePayload` is not used. Diff review, `gitcontext.generatedExcludedFiles`, `internal/shardpack`, and `review-lenses` stay as they are.
-
-## Checkpoint 2 — Source cut
-
-Status: Pass
-
-`sourcereview.Select` is `internal/sourcereview/select.go:27`. `keepPath` drops Config and Docs from `Classify`, `IsTestPath`, a `vendor` / `node_modules` / `third_party` segment, invalid UTF-8, and a generated line `^// Code generated .* DO NOT EDIT\.$` whose preceding lines are blank or comments. A line that only says `DO NOT EDIT` stays kept. `Classify` is unchanged.
-
-`go test ./internal/classify` exited 0. Evidence: `cover.txt` in the evidence directory.
-
-Fixture `fixture-kept` commit `1720b406e24e6f15e069f8aeb63a723582ce3968`. Kept `pkg/app.go`, `pkg/note.go`. Dropped the other seven. Fixture `fixture-empty` commit `17a0f35d9dd710c9e860d2d7a69b1644afc1db6d` keeps nothing, calls no model, and writes `{"findings":[]}` plus a zero-count page (`empty-kept-1/`, `empty-kept-2/`). The two captures match.
-
-## Checkpoint 3 — Model choice
-
-Status: Pass
-
-`sourcereview.Call` is the one function, `internal/sourcereview/model.go:66`. It runs `claude -p --model opus --output-format json` (prompt on stdin, text in `result`), `codex exec --json -m gpt-6-astra -` (prompt on stdin, text in the last `agent_message` `item.text`), and `grok -p <prompt> -m grok-4.7 --output-format json` (text in `text`). Fake-exec tests record argv, stdin versus `-p`, the instruction, kept paths immediately before file text, no dropped file, and prompts at most 120000 bytes. Whole-file packing and UTF-8 slice partitions are tested. The parser accepts `{"findings":[]}` and a complete entry that passes `TypedFinding.Validate` (`internal/lensoutput/lensoutput.go:128`), and rejects null findings, a missing field, a CLI error, missing model text, a bad entry, a path that is not kept, and line numbers that are not in the file. Local `wireEntry` is `internal/sourcereview/parse.go:19`, same pointer fields as `internal/lensoutput/lensoutput.go:320`.
-
-## Checkpoint 4 — Findings
-
-Status: Pass
-
-Success writes `<dir>/findings.json` as one `{"findings":[...]}` of accepted findings in prompt order, and only after every prompt succeeds. The record has no model field. An output directory inside the reviewed tree is refused (`refuse-inside.txt`); that directory stayed empty. A non-zero exit, Claude `is_error`, a process that cannot start, and a bad payload each leave the output directory empty.
-
-## Checkpoint 5 — Page
-
-Status: Pass
-
-`sourcereview.Render` is `internal/sourcereview/page.go:102`. One self-contained `review.html`. Severity and directory filters are the shipped page script. A repo-root file's parent is `.`. Opening a finding shows issue and consequence beside the quoted lines. Headless Chrome (`browser.json`, `page.png`): zero page exceptions; the severity filter and the directory filter each hide the non-matching finding; the quote is `package main`.
-
-## Checkpoint 6 — Proof
-
-Status: Fail
-
-Opus and Grok passed the structural bar. Astra did not. Codex accepted `-m gpt-6-astra`, then exited 1. Stdout on the retry:
-
-```
-{"type":"error","message":"You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Sep 23rd, 2026 1:41 PM."}
-{"type":"turn.failed","error":{"message":"You've hit your usage limit. Visit https://chatgpt.com/codex/settings/usage to purchase more credits or try again at Sep 23rd, 2026 1:41 PM."}}
-```
-
-`live-astra/` is empty. That is a failed proof. No fake CLI was substituted.
-
-Commands, from `/Users/ben/code/metareview`:
-
-```
-go run ./cmd/metareview source-review --model opus --output <evidence>/live-opus <evidence>/fixture-kept
-go run ./cmd/metareview source-review --model astra --output <evidence>/live-astra <evidence>/fixture-kept
-go run ./cmd/metareview source-review --model grok --output <evidence>/live-grok <evidence>/fixture-kept
-```
-
-Fixture commit `1720b406e24e6f15e069f8aeb63a723582ce3968`. Opus wrote `live-opus/findings.json` (`{"findings":[]}`) and `live-opus/review.html` (model `opus`, that commit, both filters, P0 0, P1 0, P2 0, P3 0). Grok wrote `live-grok/findings.json` and `live-grok/review.html` (model `grok-4.7`, same commit and zero counts). Logs: `live-opus.log`, `live-grok.log`, `live-astra.log`. Each log prints the kept pair and the seven dropped paths before the prompt. The prompt's only source text is `pkg/app.go` and `pkg/note.go`, each path immediately before its text, and the prompt asks for `{"findings":[...]}`.
-
-`go test` for `internal/sourcereview`, `internal/classify`, and `cmd/metareview` exited 0 (`go-test.txt`). Coverage is 100.0% of statements for all three (`cover.txt`). `internal/sourcereview` was not added to `tests/coverage-exclude.txt`.
-
-`git log -1` is `02b0527`. No commit, push, or pull request. The goal file was not edited.
-
-User action for the failed proof: wait until the Codex usage limit resets (2026-09-23 13:41) and re-run the astra command above. The shell also logs `codex_core::shell_snapshot` line 20716 `syntax error near unexpected token '('`; the turn still started, and the exit reason on stdout is the usage limit.

From 6e3047000f50279dd6b1eb2089b987dd2771e510 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sat, 3 Oct 2026 07:39:13 -0700
Subject: [PATCH 19/22] fix: address source-review correctness and resource
 handling

---
 internal/sourcereview/git.go             |  32 ++-
 internal/sourcereview/model.go           |  13 +-
 internal/sourcereview/output.go          |  98 +++++++
 internal/sourcereview/output_test.go     | 164 +++++++++++
 internal/sourcereview/pack.go            |  51 +++-
 internal/sourcereview/regression_test.go | 345 +++++++++++++++++++++++
 internal/sourcereview/run.go             |  99 +++++--
 internal/sourcereview/run_test.go        |   8 +-
 internal/sourcereview/select.go          |  41 ++-
 internal/sourcereview/select_test.go     |  11 +-
 10 files changed, 782 insertions(+), 80 deletions(-)
 create mode 100644 internal/sourcereview/output.go
 create mode 100644 internal/sourcereview/output_test.go
 create mode 100644 internal/sourcereview/regression_test.go

diff --git a/internal/sourcereview/git.go b/internal/sourcereview/git.go
index 5212d12f..c05c3d81 100644
--- a/internal/sourcereview/git.go
+++ b/internal/sourcereview/git.go
@@ -39,9 +39,15 @@ func resolveTop(root string, git GitFunc) (string, error) {
 	return strings.TrimSpace(string(out)), nil
 }
 
-// parseTree reads `git ls-tree -r -z` records and returns blob paths.
-func parseTree(out []byte) ([]string, error) {
-	var paths []string
+type treeBlob struct {
+	path string
+	id   string
+}
+
+// parseTree reads `git ls-tree -r -z` records, preserving arbitrary filenames
+// and the object IDs used to read this exact snapshot.
+func parseTree(out []byte) ([]treeBlob, error) {
+	var blobs []treeBlob
 	rest := out
 	for len(rest) > 0 {
 		rec, next, _ := bytes.Cut(rest, []byte{0})
@@ -54,7 +60,7 @@ func parseTree(out []byte) ([]string, error) {
 			return nil, fmt.Errorf("bad ls-tree record")
 		}
 		fields := strings.Fields(string(rec[:tab]))
-		if len(fields) < 2 {
+		if len(fields) < 3 {
 			return nil, fmt.Errorf("bad ls-tree meta")
 		}
 		if fields[1] != "blob" {
@@ -64,21 +70,21 @@ func parseTree(out []byte) ([]string, error) {
 		if p == "" {
 			continue
 		}
-		paths = append(paths, p)
+		blobs = append(blobs, treeBlob{path: p, id: fields[2]})
 	}
-	return paths, nil
+	return blobs, nil
 }
 
-func readBlobs(root string, paths []string, git GitFunc) (map[string][]byte, error) {
-	if len(paths) == 0 {
+func readBlobs(root string, blobs []treeBlob, git GitFunc) (map[string][]byte, error) {
+	if len(blobs) == 0 {
 		return map[string][]byte{}, nil
 	}
 	var stdin bytes.Buffer
-	for _, p := range paths {
-		if strings.Contains(p, "\n") {
-			return nil, fmt.Errorf("path contains a newline")
-		}
-		fmt.Fprintf(&stdin, "HEAD:%s\n", p)
+	paths := make([]string, 0, len(blobs))
+	for _, b := range blobs {
+		// Object IDs avoid line-delimited filenames and any later HEAD lookup.
+		fmt.Fprintln(&stdin, b.id)
+		paths = append(paths, b.path)
 	}
 	out, err := git(root, []string{"cat-file", "--batch"}, stdin.Bytes())
 	if err != nil {
diff --git a/internal/sourcereview/model.go b/internal/sourcereview/model.go
index c8e6d432..94c8083d 100644
--- a/internal/sourcereview/model.go
+++ b/internal/sourcereview/model.go
@@ -214,9 +214,10 @@ func Call(ctx context.Context, runner Runner, model string, prompt []byte) (stri
 
 func claudeModelText(stdout []byte) (string, error) {
 	var doc struct {
-		IsError    bool    `json:"is_error"`
-		StopReason string  `json:"stop_reason"`
-		Result     *string `json:"result"`
+		IsError          bool            `json:"is_error"`
+		StopReason       string          `json:"stop_reason"`
+		Result           *string         `json:"result"`
+		StructuredOutput json.RawMessage `json:"structured_output"`
 	}
 	if err := json.Unmarshal(stdout, &doc); err != nil {
 		return "", fmt.Errorf("missing model text: %w", err)
@@ -231,6 +232,12 @@ func claudeModelText(stdout []byte) (string, error) {
 	if doc.StopReason == "max_tokens" {
 		return "", errors.New("claude: incomplete review: max_tokens")
 	}
+	if len(doc.StructuredOutput) > 0 && !bytes.Equal(doc.StructuredOutput, []byte("null")) {
+		if doc.StructuredOutput[0] != '{' {
+			return "", errors.New("claude: structured_output must be an object")
+		}
+		return string(doc.StructuredOutput), nil
+	}
 	if doc.Result == nil || *doc.Result == "" {
 		return "", errors.New("missing model text")
 	}
diff --git a/internal/sourcereview/output.go b/internal/sourcereview/output.go
new file mode 100644
index 00000000..9dddee9f
--- /dev/null
+++ b/internal/sourcereview/output.go
@@ -0,0 +1,98 @@
+package sourcereview
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// reportLstat is a seam for filesystem metadata failures.
+var reportLstat = os.Lstat
+
+// publishReports stages both files on the destination filesystem before changing
+// either saved report. Publication errors restore the previous pair. Renaming
+// two files is not an atomic transaction for concurrent readers or process crashes.
+func publishReports(opts Options, findings, page []byte) error {
+	write, rename, remove := opts.WriteFile, opts.Rename, opts.Remove
+	if write == nil {
+		write = os.WriteFile
+	}
+	if rename == nil {
+		rename = os.Rename
+	}
+	if remove == nil {
+		remove = os.Remove
+	}
+	stage, err := os.MkdirTemp(opts.OutputDir, ".metareview-publish-*")
+	if err != nil {
+		return err
+	}
+	cleanup := true
+	defer func() {
+		if cleanup {
+			_ = os.RemoveAll(stage)
+		}
+	}()
+	type report struct {
+		name      string
+		body      []byte
+		exists    bool
+		backedUp  bool
+		published bool
+	}
+	reports := []report{{name: "findings.json", body: findings}, {name: "review.html", body: page}}
+	for i := range reports {
+		r := &reports[i]
+		if err := write(filepath.Join(stage, r.name), r.body, 0o644); err != nil {
+			return err
+		}
+		info, err := reportLstat(filepath.Join(opts.OutputDir, r.name))
+		if err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		r.exists = err == nil
+		if r.exists && info.IsDir() {
+			return fmt.Errorf("report destination is a directory: %s", r.name)
+		}
+	}
+	rollback := func(cause error) error {
+		var restoreErrors []error
+		for i := len(reports) - 1; i >= 0; i-- {
+			r := &reports[i]
+			dest := filepath.Join(opts.OutputDir, r.name)
+			if r.backedUp {
+				if err := rename(filepath.Join(stage, r.name+".previous"), dest); err != nil {
+					restoreErrors = append(restoreErrors, err)
+				}
+			} else if r.published {
+				if err := remove(dest); err != nil {
+					restoreErrors = append(restoreErrors, err)
+				}
+			}
+		}
+		if len(restoreErrors) > 0 {
+			// Never delete the only surviving copy if restoration itself fails.
+			cleanup = false
+			return errors.Join(cause, fmt.Errorf("restore reports (backups retained in %s): %w", stage, errors.Join(restoreErrors...)))
+		}
+		return cause
+	}
+	for i := range reports {
+		r := &reports[i]
+		if r.exists {
+			if err := rename(filepath.Join(opts.OutputDir, r.name), filepath.Join(stage, r.name+".previous")); err != nil {
+				return rollback(err)
+			}
+			r.backedUp = true
+		}
+	}
+	for i := range reports {
+		r := &reports[i]
+		if err := rename(filepath.Join(stage, r.name), filepath.Join(opts.OutputDir, r.name)); err != nil {
+			return rollback(err)
+		}
+		r.published = true
+	}
+	return nil
+}
diff --git a/internal/sourcereview/output_test.go b/internal/sourcereview/output_test.go
new file mode 100644
index 00000000..92cc0142
--- /dev/null
+++ b/internal/sourcereview/output_test.go
@@ -0,0 +1,164 @@
+package sourcereview
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+var oldReports = map[string]string{"findings.json": "old findings", "review.html": "old page"}
+
+func seedReports(t *testing.T, dir string, names []string) {
+	t.Helper()
+	for _, name := range names {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(oldReports[name]), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func checkOldReports(t *testing.T, dir string, names []string) {
+	t.Helper()
+	for _, name := range names {
+		body, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil || string(body) != oldReports[name] {
+			t.Fatalf("lost previous %s: %q %v", name, body, err)
+		}
+	}
+	entries, err := os.ReadDir(dir)
+	if err != nil || len(entries) != len(names) {
+		t.Fatalf("extra or missing files after failure: %v %v", entries, err)
+	}
+}
+
+func TestReportPublicationFailuresPreservePreviousResults(t *testing.T) {
+	for _, names := range [][]string{{"findings.json", "review.html"}, {"findings.json"}, {"review.html"}, nil} {
+		for failWrite := 1; failWrite <= 2; failWrite++ {
+			t.Run(fmt.Sprintf("partial-write-%d-existing-%d-%v", failWrite, len(names), names), func(t *testing.T) {
+				dir := t.TempDir()
+				seedReports(t, dir, names)
+				n := 0
+				failure := errors.New("no space left on device")
+				err := publishReports(Options{OutputDir: dir, WriteFile: func(p string, body []byte, mode os.FileMode) error {
+					n++
+					if n == failWrite {
+						_ = os.WriteFile(p, []byte("partial write"), mode)
+						return failure
+					}
+					return os.WriteFile(p, body, mode)
+				}}, []byte("new findings"), []byte("new page"))
+				if !errors.Is(err, failure) {
+					t.Fatal(err)
+				}
+				checkOldReports(t, dir, names)
+			})
+		}
+		for failRename := 1; failRename <= len(names)+2; failRename++ {
+			t.Run(fmt.Sprintf("rename-%d-existing-%d-%v", failRename, len(names), names), func(t *testing.T) {
+				dir := t.TempDir()
+				seedReports(t, dir, names)
+				n := 0
+				failure := errors.New("rename failed")
+				err := publishReports(Options{OutputDir: dir, Rename: func(from, to string) error {
+					n++
+					if n == failRename {
+						return failure
+					}
+					return os.Rename(from, to)
+				}, Remove: os.Remove}, []byte("new findings"), []byte("new page"))
+				if !errors.Is(err, failure) {
+					t.Fatal(err)
+				}
+				checkOldReports(t, dir, names)
+			})
+		}
+	}
+}
+
+func TestReportPublicationReplacesPreviousPair(t *testing.T) {
+	dir := t.TempDir()
+	seedReports(t, dir, []string{"findings.json", "review.html"})
+	if err := publishReports(Options{OutputDir: dir}, []byte("new findings"), []byte("new page")); err != nil {
+		t.Fatal(err)
+	}
+	for name, want := range map[string]string{"findings.json": "new findings", "review.html": "new page"} {
+		body, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil || string(body) != want {
+			t.Fatalf("publication failed: %q %v", body, err)
+		}
+	}
+	if entries, _ := os.ReadDir(dir); len(entries) != 2 {
+		t.Fatalf("left staging files: %v", entries)
+	}
+}
+
+func TestReportPublicationKeepsBackupsWhenRestoreFails(t *testing.T) {
+	dir := t.TempDir()
+	seedReports(t, dir, []string{"findings.json", "review.html"})
+	err := publishReports(Options{OutputDir: dir, Rename: func(from, to string) error {
+		if strings.HasSuffix(from, ".previous") {
+			return errors.New("restore failed")
+		}
+		if filepath.Dir(from) != dir && filepath.Base(from) == "review.html" {
+			return errors.New("publish failed")
+		}
+		return os.Rename(from, to)
+	}}, []byte("new findings"), []byte("new page"))
+	if err == nil || !strings.Contains(err.Error(), "backups retained") {
+		t.Fatal(err)
+	}
+	stages, _ := filepath.Glob(filepath.Join(dir, ".metareview-publish-*"))
+	if len(stages) != 1 {
+		t.Fatalf("lost backups: %v", stages)
+	}
+	for name, want := range oldReports {
+		body, err := os.ReadFile(filepath.Join(stages[0], name+".previous"))
+		if err != nil || string(body) != want {
+			t.Fatalf("backup %s lost: %q %v", name, body, err)
+		}
+	}
+}
+
+func TestReportPublicationReportsCleanupFailure(t *testing.T) {
+	dir := t.TempDir()
+	err := publishReports(Options{OutputDir: dir, Rename: func(from, to string) error {
+		if filepath.Base(from) == "review.html" {
+			return errors.New("publish failed")
+		}
+		return os.Rename(from, to)
+	}, Remove: func(string) error { return errors.New("remove failed") }}, []byte("new findings"), []byte("new page"))
+	if err == nil || !strings.Contains(err.Error(), "remove failed") {
+		t.Fatal(err)
+	}
+}
+
+func TestReportPublicationFilesystemErrors(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "file")
+	if err := os.WriteFile(file, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := publishReports(Options{OutputDir: file}, nil, nil); err == nil {
+		t.Fatal("staging under a file accepted")
+	}
+	seedReports(t, dir, []string{"findings.json"})
+	if err := os.Mkdir(filepath.Join(dir, "review.html"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := publishReports(Options{OutputDir: dir}, nil, nil); err == nil || !strings.Contains(err.Error(), "directory") {
+		t.Fatal(err)
+	}
+	body, err := os.ReadFile(filepath.Join(dir, "findings.json"))
+	if err != nil || string(body) != oldReports["findings.json"] {
+		t.Fatal("changed findings despite invalid page destination")
+	}
+	prev := reportLstat
+	reportLstat = func(string) (os.FileInfo, error) { return nil, errors.New("metadata failed") }
+	t.Cleanup(func() { reportLstat = prev })
+	if err := publishReports(Options{OutputDir: dir}, nil, nil); err == nil || !strings.Contains(err.Error(), "metadata failed") {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/sourcereview/pack.go b/internal/sourcereview/pack.go
index e72b0179..f630b503 100644
--- a/internal/sourcereview/pack.go
+++ b/internal/sourcereview/pack.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"sort"
+	"strconv"
 	"strings"
 	"unicode/utf8"
 )
@@ -85,10 +86,12 @@ func Pack(files []File, budget int) ([][]byte, error) {
 	if budget <= 0 {
 		return nil, fmt.Errorf("prompt budget must be positive")
 	}
-	var whole, big []File
+	var whole []sizedFile
+	var big []File
 	for _, f := range files {
-		if len(promptWith(instruction, []File{f})) <= budget {
-			whole = append(whole, f)
+		size := len(f.Path) + 1 + numberedSize(f.Body)
+		if len(instruction)+1+size <= budget {
+			whole = append(whole, sizedFile{File: f, size: size})
 		} else {
 			big = append(big, f)
 		}
@@ -105,32 +108,58 @@ func Pack(files []File, budget int) ([][]byte, error) {
 	return prompts, nil
 }
 
-func packWhole(files []File, budget int) [][]byte {
-	sorted := append([]File(nil), files...)
+type sizedFile struct {
+	File
+	size int
+}
+
+// numberedSize measures the rendered body without building a prompt.
+func numberedSize(body []byte) int {
+	size := len(body)
+	for line := 1; len(body) > 0; line++ {
+		size += len(strconv.Itoa(line)) + 2
+		_, body, _ = bytes.Cut(body, []byte("\n"))
+	}
+	return size
+}
+
+func packWhole(files []sizedFile, budget int) [][]byte {
+	sorted := append([]sizedFile(nil), files...)
 	sort.Slice(sorted, func(i, j int) bool {
 		if len(sorted[i].Body) == len(sorted[j].Body) {
 			return sorted[i].Path < sorted[j].Path
 		}
 		return len(sorted[i].Body) > len(sorted[j].Body)
 	})
-	var bins [][]File
+	type bin struct {
+		files     []File
+		size      int
+		separator bool
+	}
+	var bins []bin
 	for _, f := range sorted {
 		placed := false
 		for i := range bins {
-			candidate := append(append([]File{}, bins[i]...), f)
-			if len(promptWith(instruction, candidate)) <= budget {
-				bins[i] = candidate
+			size := bins[i].size + f.size
+			if bins[i].separator {
+				size++
+			}
+			if size <= budget {
+				bins[i].files = append(bins[i].files, f.File)
+				bins[i].size = size
+				bins[i].separator = len(f.Body) == 0 || f.Body[len(f.Body)-1] != '\n'
 				placed = true
 				break
 			}
 		}
 		if !placed {
-			bins = append(bins, []File{f})
+			bins = append(bins, bin{files: []File{f.File}, size: len(instruction) + 1 + f.size,
+				separator: len(f.Body) == 0 || f.Body[len(f.Body)-1] != '\n'})
 		}
 	}
 	out := make([][]byte, 0, len(bins))
 	for _, bin := range bins {
-		out = append(out, promptWith(instruction, bin))
+		out = append(out, promptWith(instruction, bin.files))
 	}
 	return out
 }
diff --git a/internal/sourcereview/regression_test.go b/internal/sourcereview/regression_test.go
new file mode 100644
index 00000000..4c59a449
--- /dev/null
+++ b/internal/sourcereview/regression_test.go
@@ -0,0 +1,345 @@
+package sourcereview
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestClaudeStructuredOutput(t *testing.T) {
+	for _, envelope := range []string{
+		`{"structured_output":{"findings":[]}}`,
+		`{"result":"","structured_output":{"findings":[]}}`,
+		`{"result":"Review complete","structured_output":{"findings":[]}}`,
+		`{"result":"{\"findings\":[]}","structured_output":null}`,
+	} {
+		got, err := claudeModelText([]byte(envelope))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, _, err := Parse(got, keptFiles()); err != nil {
+			t.Fatalf("valid output rejected: %s: %v", envelope, err)
+		}
+	}
+	for _, envelope := range []string{
+		`{"structured_output":"not an object","result":"{\"findings\":[]}"}`,
+		`{"structured_output":{"findings":[]},"is_error":true}`,
+		`{"structured_output":{"findings":[]},"stop_reason":"max_tokens"}`,
+	} {
+		if _, err := claudeModelText([]byte(envelope)); err == nil {
+			t.Fatalf("accepted failed/malformed response: %s", envelope)
+		}
+	}
+}
+
+func TestEmptyPathIsRejected(t *testing.T) {
+	for _, files := range [][]File{nil, {{Path: "a.go"}}} {
+		if _, err := onlyPaths(files, []string{""}); err == nil {
+			t.Fatal("empty filter accepted")
+		}
+	}
+	if _, _, _, err := selectPaths("", nil, []string{""}); err == nil {
+		t.Fatal("empty filter reached git")
+	}
+	if _, err := parseArgs([]string{"--model", "grok", "--output", "/tmp/out", "--path", ""}); err == nil {
+		t.Fatal("CLI accepted empty filter")
+	}
+}
+
+func TestSelectPinnedCommit(t *testing.T) {
+	old := []byte("package a\n// old revision\n")
+	root, first := newRepoBytes(t, map[string][]byte{"a.go": old})
+	changed := false
+	git := func(dir string, args []string, stdin []byte) ([]byte, error) {
+		if args[0] == "ls-tree" && !changed {
+			changed = true
+			if err := os.WriteFile(filepath.Join(root, "a.go"), []byte("package a\n// new revision\n"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			gitRun(t, root, "add", "a.go")
+			gitRun(t, root, "commit", "-m", "concurrent update")
+		}
+		return realGit(dir, args, stdin)
+	}
+	kept, _, commit, err := Select(root, git)
+	if err != nil || commit != first || len(kept) != 1 || !bytes.Equal(kept[0].Body, old) {
+		t.Fatalf("snapshot changed: %v %s %v", err, commit, kept)
+	}
+}
+
+func TestSelectFiltersBeforeBlobReads(t *testing.T) {
+	root, commit := newRepoBytes(t, map[string][]byte{
+		"a.go":          []byte("package a\n"),
+		"other.go":      []byte("package other\n"),
+		"vendor/lib.go": bytes.Repeat([]byte("x"), 1<<20),
+		"docs/a\nb.md":  []byte("documentation\n"),
+	})
+	id, err := realGit(root, []string{"rev-parse", commit + ":a.go"}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var request []byte
+	git := func(dir string, args []string, stdin []byte) ([]byte, error) {
+		if args[0] == "cat-file" {
+			request = append(request, stdin...)
+		}
+		return realGit(dir, args, stdin)
+	}
+	kept, _, _, err := selectPaths(root, git, []string{"a.go"})
+	if err != nil || len(kept) != 1 || !bytes.Equal(request, id) {
+		t.Fatalf("loaded blobs outside the selected scope: %q want %q; %v", request, id, err)
+	}
+}
+
+func TestSelectNewlineFilenames(t *testing.T) {
+	body := []byte("package a\n")
+	root, _ := newRepoBytes(t, map[string][]byte{"pkg/a\nb.go": body, "docs/a\nb.md": []byte("docs\n")})
+	kept, dropped, _, err := Select(root, nil)
+	if err != nil || len(kept) != 1 || kept[0].Path != "pkg/a\nb.go" || !bytes.Equal(kept[0].Body, body) || len(dropped) != 1 {
+		t.Fatalf("newline paths: kept=%v dropped=%v err=%v", kept, dropped, err)
+	}
+}
+
+func TestRunContextCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := Run(Options{Context: ctx}); !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+	// Cancellation and an available worker slot can both be selected. Neither
+	// outcome may launch a call or turn an already canceled review into success.
+	for i := 0; i < 64; i++ {
+		if _, err := review(Options{Context: ctx}, [][]byte{[]byte("unused")}, nil); !errors.Is(err, context.Canceled) {
+			t.Fatal(err)
+		}
+	}
+	if err := writeOutputs(Options{Context: ctx}, "", "", "opus", nil, nil); !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+	root, _ := newRepoBytes(t, specFiles())
+	ctx, cancel = context.WithCancel(context.Background())
+	defer cancel()
+	git := func(dir string, args []string, stdin []byte) ([]byte, error) {
+		out, err := realGit(dir, args, stdin)
+		if args[0] == "cat-file" {
+			cancel()
+		}
+		return out, err
+	}
+	if err := Run(Options{Context: ctx, Repo: root, Model: "grok", OutputDir: t.TempDir(), Git: git}); !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+}
+
+func TestRunCancellationStopsQueuedCalls(t *testing.T) {
+	root, _ := fivePrompts(t)
+	out := t.TempDir()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	runner := &fakeRunner{wait: func(context.Context, []byte) error {
+		cancel()
+		return nil // Even a runner that ignores cancellation must not publish.
+	}, reply: func(int, string, []string, []byte) ([]byte, error) {
+		return cliStdout("opus", `{"findings":[]}`), nil
+	}}
+	err := Run(Options{Context: ctx, Repo: root, Model: "opus", OutputDir: out, Jobs: 1, Runner: runner})
+	if !errors.Is(err, context.Canceled) || len(runner.callList()) != 1 {
+		t.Fatalf("err=%v calls=%d", err, len(runner.callList()))
+	}
+	if entries, _ := os.ReadDir(out); len(entries) != 0 {
+		t.Fatal("published canceled review")
+	}
+}
+
+type cancelWriter struct{ cancel context.CancelFunc }
+
+func (w cancelWriter) Write(p []byte) (int, error) {
+	w.cancel()
+	return len(p), nil
+}
+
+func TestReviewCanceledAfterResponse(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	runner := &fakeRunner{reply: func(int, string, []string, []byte) ([]byte, error) {
+		return cliStdout("opus", `{"findings":[]}`), nil
+	}}
+	_, err := review(Options{Context: ctx, Model: "opus", Runner: runner, Stdout: io.Discard, Stderr: cancelWriter{cancel}}, [][]byte{[]byte("prompt")}, nil)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+}
+
+func TestSourceReviewSignalHelper(t *testing.T) {
+	if os.Getenv("METAREVIEW_SIGNAL_CHILD") != "1" {
+		return
+	}
+	os.Exit(CLI([]string{"--model", "grok", "--output", os.Getenv("METAREVIEW_SIGNAL_OUT"), "--call-timeout", "30s"}, os.Getenv("METAREVIEW_SIGNAL_ROOT"), io.Discard, os.Stderr))
+}
+
+func TestCLISignalsCleanUpModel(t *testing.T) {
+	for _, signal := range []os.Signal{os.Interrupt, syscall.SIGTERM} {
+		t.Run(signal.String(), func(t *testing.T) {
+			root, _ := newRepoBytes(t, map[string][]byte{"a.go": []byte("package a\n")})
+			dir := t.TempDir()
+			pidFile, promptFile := filepath.Join(dir, "pid"), filepath.Join(dir, "prompt")
+			script := "#!/bin/sh\nprintf '%s\\n' \"$$\" > \"$METAREVIEW_SIGNAL_PID\"\nprintf '%s\\n' \"$2\" > \"$METAREVIEW_SIGNAL_PROMPT\"\nsleep 60\n"
+			if err := os.WriteFile(filepath.Join(dir, "grok"), []byte(script), 0o700); err != nil {
+				t.Fatal(err)
+			}
+			cmd := exec.Command(os.Args[0], "-test.run=^TestSourceReviewSignalHelper$")
+			var stderr bytes.Buffer
+			cmd.Stderr = &stderr
+			cmd.Env = append(os.Environ(), "METAREVIEW_SIGNAL_CHILD=1", "METAREVIEW_SIGNAL_ROOT="+root,
+				"METAREVIEW_SIGNAL_OUT="+filepath.Join(dir, "out"), "METAREVIEW_SIGNAL_PID="+pidFile,
+				"METAREVIEW_SIGNAL_PROMPT="+promptFile, "PATH="+dir+string(os.PathListSeparator)+os.Getenv("PATH"), "TMPDIR="+dir)
+			if err := cmd.Start(); err != nil {
+				t.Fatal(err)
+			}
+			defer func() { _ = cmd.Process.Kill() }()
+			var pid int
+			var prompt string
+			deadline := time.Now().Add(5 * time.Second)
+			for time.Now().Before(deadline) {
+				p, _ := os.ReadFile(pidFile)
+				pid, _ = strconv.Atoi(strings.TrimSpace(string(p)))
+				p, _ = os.ReadFile(promptFile)
+				prompt = strings.TrimSpace(string(p))
+				if pid > 0 && prompt != "" {
+					break
+				}
+				time.Sleep(10 * time.Millisecond)
+			}
+			if pid == 0 || prompt == "" {
+				_ = cmd.Process.Kill()
+				_ = cmd.Wait()
+				t.Fatalf("fake model did not start: %s", stderr.Bytes())
+			}
+			defer func() { _ = syscall.Kill(-pid, syscall.SIGKILL) }()
+			if err := cmd.Process.Signal(signal); err != nil {
+				t.Fatal(err)
+			}
+			done := make(chan error, 1)
+			go func() { done <- cmd.Wait() }()
+			select {
+			case err := <-done:
+				var exitErr *exec.ExitError
+				if !errors.As(err, &exitErr) || exitErr.ExitCode() != 1 {
+					t.Fatalf("CLI exit: %v", err)
+				}
+			case <-time.After(5 * time.Second):
+				t.Fatal("CLI failed to stop")
+			}
+			state, _ := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
+			if s := strings.TrimSpace(string(state)); s != "" && !strings.HasPrefix(s, "Z") {
+				t.Fatalf("model still running: %s", state)
+			}
+			if _, err := os.Stat(prompt); !os.IsNotExist(err) {
+				t.Fatalf("prompt not removed: %v", err)
+			}
+			workspaces, _ := filepath.Glob(filepath.Join(dir, "metareview-workspace-*"))
+			if len(workspaces) != 0 {
+				t.Fatalf("workspaces left behind: %v", workspaces)
+			}
+		})
+	}
+}
+
+func TestPackPreservesPromptBytes(t *testing.T) {
+	var files []File
+	for i := 0; i < 24; i++ {
+		body := bytes.Repeat([]byte("x\n"), i*3)
+		if i%2 == 1 {
+			body = append(body, 'x')
+		}
+		if numberedSize(body) != len(numberLines(body, 1)) {
+			t.Fatal("wrong rendered size")
+		}
+		files = append(files, File{Path: fmt.Sprintf("%02d.go", i), Body: body})
+	}
+	const budget = 2000
+	// Reference the previous packing algorithm to require identical prompt bytes,
+	// including boundaries, ordering, separators, and source line numbers.
+	sort.Slice(files, func(i, j int) bool {
+		if len(files[i].Body) == len(files[j].Body) {
+			return files[i].Path < files[j].Path
+		}
+		return len(files[i].Body) > len(files[j].Body)
+	})
+	var bins [][]File
+	for _, f := range files {
+		placed := false
+		for i := range bins {
+			candidate := append(append([]File(nil), bins[i]...), f)
+			if len(promptWith(instruction, candidate)) <= budget {
+				bins[i], placed = candidate, true
+				break
+			}
+		}
+		if !placed {
+			bins = append(bins, []File{f})
+		}
+	}
+	got, err := Pack(files, budget)
+	if err != nil || len(got) != len(bins) {
+		t.Fatalf("prompt count changed: %v", err)
+	}
+	for i := range bins {
+		if !bytes.Equal(got[i], promptWith(instruction, bins[i])) {
+			t.Fatalf("prompt %d changed", i)
+		}
+	}
+}
+
+func packScalingFiles() []File {
+	var files []File
+	for i := 0; i < 30; i++ {
+		files = append(files, File{Path: fmt.Sprintf("big-%03d.go", i), Body: bytes.Repeat([]byte("x"), 100000)})
+	}
+	for i := 0; i < 300; i++ {
+		files = append(files, File{Path: fmt.Sprintf("small-%03d.go", i), Body: bytes.Repeat([]byte("y"), 4000)})
+	}
+	return files
+}
+
+func TestPackWholeRepoAllocation(t *testing.T) {
+	files := packScalingFiles()
+	runtime.GC()
+	var before, after runtime.MemStats
+	runtime.ReadMemStats(&before)
+	start := time.Now()
+	prompts, err := Pack(files, MaxPromptBytes)
+	runtime.ReadMemStats(&after)
+	allocated := after.TotalAlloc - before.TotalAlloc
+	t.Logf("files=330 source_bytes=4200000 prompts=%d allocated_bytes=%d elapsed=%s", len(prompts), allocated, time.Since(start))
+	if err != nil || len(prompts) != 37 {
+		t.Fatalf("pack: %d prompts, %v", len(prompts), err)
+	}
+	// Bound gross regressions generously, even with coverage instrumentation.
+	if allocated > 128<<20 {
+		t.Fatalf("packing allocated %d bytes for 4.2 MB of source", allocated)
+	}
+}
+
+func BenchmarkPackWholeRepo(b *testing.B) {
+	files := packScalingFiles()
+	b.ReportAllocs()
+	b.ResetTimer()
+	for b.Loop() {
+		if _, err := Pack(files, MaxPromptBytes); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/internal/sourcereview/run.go b/internal/sourcereview/run.go
index 18bd91b8..4eb28f0f 100644
--- a/internal/sourcereview/run.go
+++ b/internal/sourcereview/run.go
@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/signal"
 	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/dsifry/metareview/internal/lensoutput"
@@ -46,10 +48,12 @@ var (
 	statPath = os.Stat
 )
 
-// Options is one source-review run. A nil Runner, Git, MkdirAll, WriteFile, or
-// Remove uses the real process, git, or filesystem. Budget 0 means MaxPromptBytes.
+// Options is one source-review run. A nil Git, MkdirAll, WriteFile, Remove or
+// Rename uses the real git or filesystem. CLI supplies the OSRunner. A nil Context uses
+// context.Background. Budget 0 means MaxPromptBytes.
 // Jobs 0 means DefaultJobs and CallTimeout 0 means DefaultCallTimeout.
 type Options struct {
+	Context     context.Context
 	Repo        string
 	Model       string
 	OutputDir   string
@@ -66,11 +70,18 @@ type Options struct {
 	MkdirAll  func(string, os.FileMode) error
 	WriteFile func(string, []byte, os.FileMode) error
 	Remove    func(string) error
+	Rename    func(string, string) error
 }
 
 // Run reviews one repository. It writes the findings file and the page only
-// after every prompt succeeds. A failed prompt leaves the output directory empty.
+// after every prompt succeeds. A failed run preserves any previously saved reports.
 func Run(opts Options) error {
+	if opts.Context == nil {
+		opts.Context = context.Background()
+	}
+	if err := opts.Context.Err(); err != nil {
+		return err
+	}
 	if opts.Stdout == nil {
 		opts.Stdout = io.Discard
 	}
@@ -95,12 +106,11 @@ func Run(opts Options) error {
 	if err := refuseInside(top, opts.OutputDir); err != nil {
 		return err
 	}
-	kept, dropped, commit, err := Select(top, git)
+	kept, dropped, commit, err := selectPaths(top, git, opts.Paths)
 	if err != nil {
 		return err
 	}
-	kept, err = onlyPaths(kept, opts.Paths)
-	if err != nil {
+	if err := opts.Context.Err(); err != nil {
 		return err
 	}
 	writeLists(opts.Stdout, kept, dropped)
@@ -148,7 +158,7 @@ func review(opts Options, prompts [][]byte, files map[string][]byte) ([]lensoutp
 	if timeout < 0 {
 		return nil, fmt.Errorf("call timeout must be positive, got %s", timeout)
 	}
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(opts.Context)
 	defer cancel()
 	var (
 		mu       sync.Mutex
@@ -166,9 +176,15 @@ func review(opts Options, prompts [][]byte, files map[string][]byte) ([]lensoutp
 	n := len(prompts)
 	results := make([][]lensoutput.TypedFinding, n)
 	sem := make(chan struct{}, jobs)
+schedule:
 	for i, p := range prompts {
-		sem <- struct{}{}
+		select {
+		case sem <- struct{}{}:
+		case <-ctx.Done():
+			break schedule
+		}
 		if ctx.Err() != nil {
+			<-sem
 			break
 		}
 		mu.Lock()
@@ -182,6 +198,9 @@ func review(opts Options, prompts [][]byte, files map[string][]byte) ([]lensoutp
 			callCtx, callCancel := context.WithTimeout(ctx, timeout)
 			defer callCancel()
 			text, err := Call(callCtx, opts.Runner, opts.Model, p)
+			if err == nil {
+				err = callCtx.Err()
+			}
 			if err != nil {
 				if errors.Is(callCtx.Err(), context.DeadlineExceeded) {
 					err = fmt.Errorf("call timed out after %s: %w", timeout, err)
@@ -207,6 +226,9 @@ func review(opts Options, prompts [][]byte, files map[string][]byte) ([]lensoutp
 	if firstErr != nil {
 		return nil, firstErr
 	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
 	var all []lensoutput.TypedFinding
 	for _, r := range results {
 		all = append(all, r...)
@@ -227,6 +249,11 @@ func writePrompt(w io.Writer, p []byte) {
 // file. A path that matches no kept file is an error, so a typo or a file the
 // source cut dropped is reported instead of reviewing nothing.
 func onlyPaths(kept []File, paths []string) ([]File, error) {
+	var err error
+	paths, err = cleanPaths(paths)
+	if err != nil {
+		return nil, err
+	}
 	if len(paths) == 0 {
 		return kept, nil
 	}
@@ -235,8 +262,7 @@ func onlyPaths(kept []File, paths []string) ([]File, error) {
 	for _, f := range kept {
 		hit := false
 		for i, p := range paths {
-			p = path.Clean(p)
-			if f.Path == p || strings.HasPrefix(f.Path, p+"/") || p == "." {
+			if pathSelected(f.Path, []string{p}) {
 				matched[i] = true
 				hit = true
 			}
@@ -253,6 +279,29 @@ func onlyPaths(kept []File, paths []string) ([]File, error) {
 	return out, nil
 }
 
+func cleanPaths(paths []string) ([]string, error) {
+	cleaned := make([]string, 0, len(paths))
+	for _, p := range paths {
+		if p == "" {
+			return nil, errors.New("--path must not be empty")
+		}
+		cleaned = append(cleaned, path.Clean(p))
+	}
+	return cleaned, nil
+}
+
+func pathSelected(file string, paths []string) bool {
+	if len(paths) == 0 {
+		return true
+	}
+	for _, p := range paths {
+		if file == p || strings.HasPrefix(file, p+"/") || p == "." {
+			return true
+		}
+	}
+	return false
+}
+
 func writeLists(w io.Writer, kept []File, dropped []string) {
 	fmt.Fprintln(w, "kept:")
 	for _, f := range kept {
@@ -265,33 +314,21 @@ func writeLists(w io.Writer, kept []File, dropped []string) {
 }
 
 func writeOutputs(opts Options, repo, commit, modelID string, findings []lensoutput.TypedFinding, files map[string][]byte) error {
+	if opts.Context != nil {
+		if err := opts.Context.Err(); err != nil {
+			return err
+		}
+	}
 	body := findingsJSON(findings)
 	page := Render(Page{Repo: repo, Commit: commit, ModelID: modelID, Findings: findings, Files: files})
 	mkdir := opts.MkdirAll
 	if mkdir == nil {
 		mkdir = os.MkdirAll
 	}
-	write := opts.WriteFile
-	if write == nil {
-		write = os.WriteFile
-	}
-	remove := opts.Remove
-	if remove == nil {
-		remove = os.Remove
-	}
 	if err := mkdir(opts.OutputDir, 0o755); err != nil {
 		return err
 	}
-	findingsPath := filepath.Join(opts.OutputDir, "findings.json")
-	pagePath := filepath.Join(opts.OutputDir, "review.html")
-	if err := write(findingsPath, body, 0o644); err != nil {
-		return err
-	}
-	if err := write(pagePath, page, 0o644); err != nil {
-		_ = remove(findingsPath)
-		return err
-	}
-	return nil
+	return publishReports(opts, body, page)
 }
 
 func findingsJSON(fs []lensoutput.TypedFinding) []byte {
@@ -387,7 +424,10 @@ func CLI(args []string, cwd string, stdout, stderr io.Writer) int {
 	if a.repo == "" {
 		a.repo = cwd
 	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
 	err = Run(Options{
+		Context:     ctx,
 		Repo:        a.repo,
 		Model:       a.model,
 		OutputDir:   a.out,
@@ -449,6 +489,9 @@ func (a *cliArgs) set(flag, v string) error {
 	case "--output":
 		a.out = v
 	case "--path":
+		if v == "" {
+			return errors.New("--path must not be empty")
+		}
 		a.paths = append(a.paths, v)
 	case "--jobs":
 		n, err := strconv.Atoi(v)
diff --git a/internal/sourcereview/run_test.go b/internal/sourcereview/run_test.go
index a5bd3c35..278396e1 100644
--- a/internal/sourcereview/run_test.go
+++ b/internal/sourcereview/run_test.go
@@ -609,7 +609,6 @@ func TestRunWriteErrors(t *testing.T) {
 	if err == nil || !strings.Contains(err.Error(), "write") {
 		t.Fatal(err)
 	}
-	removed := false
 	n := 0
 	err = Run(Options{
 		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
@@ -620,12 +619,11 @@ func TestRunWriteErrors(t *testing.T) {
 			}
 			return os.WriteFile(path, data, mode)
 		},
-		Remove: func(string) error { removed = true; return nil },
 	})
-	if err == nil || !removed {
-		t.Fatalf("err=%v removed=%v", err, removed)
+	if err == nil || !strings.Contains(err.Error(), "page") {
+		t.Fatalf("err=%v", err)
 	}
-	// real Remove deletes the findings file when the page write fails
+	// Neither staged file is published when the page write fails.
 	n = 0
 	err = Run(Options{
 		Repo: root, Model: "opus", OutputDir: outDir, Stdout: &bytes.Buffer{},
diff --git a/internal/sourcereview/select.go b/internal/sourcereview/select.go
index 188df801..7e35bb29 100644
--- a/internal/sourcereview/select.go
+++ b/internal/sourcereview/select.go
@@ -25,6 +25,14 @@ var generatedLine = regexp.MustCompile(`^// Code generated .* DO NOT EDIT\.$`)
 // everything this command drops. Classify is unchanged: config and docs are
 // still Code/Config/Docs for the diff review; this command drops Config and Docs.
 func Select(root string, git GitFunc) (kept []File, dropped []string, commit string, err error) {
+	return selectPaths(root, git, nil)
+}
+
+func selectPaths(root string, git GitFunc, filters []string) (kept []File, dropped []string, commit string, err error) {
+	filters, err = cleanPaths(filters)
+	if err != nil {
+		return nil, nil, "", err
+	}
 	if git == nil {
 		git = realGit
 	}
@@ -37,19 +45,28 @@ func Select(root string, git GitFunc) (kept []File, dropped []string, commit str
 		return nil, nil, "", err
 	}
 	commit = strings.TrimSpace(string(head))
-	tree, err := git(top, []string{"ls-tree", "-r", "-z", "HEAD"}, nil)
+	tree, err := git(top, []string{"ls-tree", "-r", "-z", commit}, nil)
 	if err != nil {
 		return nil, nil, "", err
 	}
-	paths, err := parseTree(tree)
+	entries, err := parseTree(tree)
 	if err != nil {
 		return nil, nil, "", err
 	}
-	blobs, err := readBlobs(top, paths, git)
+	var selected []treeBlob
+	for _, entry := range entries {
+		if !eligiblePath(entry.path) {
+			dropped = append(dropped, entry.path)
+		} else if pathSelected(entry.path, filters) {
+			selected = append(selected, entry)
+		}
+	}
+	blobs, err := readBlobs(top, selected, git)
 	if err != nil {
 		return nil, nil, "", err
 	}
-	for _, p := range paths {
+	for _, entry := range selected {
+		p := entry.path
 		body := blobs[p]
 		if keepPath(p, body) {
 			kept = append(kept, File{Path: p, Body: body})
@@ -59,19 +76,17 @@ func Select(root string, git GitFunc) (kept []File, dropped []string, commit str
 	}
 	sort.Slice(kept, func(i, j int) bool { return kept[i].Path < kept[j].Path })
 	sort.Strings(dropped)
+	kept, err = onlyPaths(kept, filters)
+	if err != nil {
+		return nil, nil, "", err
+	}
 	return kept, dropped, commit, nil
 }
 
 // keepPath is the whole-repo cut. An unrecognised path is still Code to Classify
 // and is kept when the other cuts do not apply.
 func keepPath(p string, body []byte) bool {
-	if classify.Classify(p) != classify.Code {
-		return false
-	}
-	if claimcheck.IsTestPath(p) {
-		return false
-	}
-	if vendored(p) {
+	if !eligiblePath(p) {
 		return false
 	}
 	if !utf8.Valid(body) {
@@ -83,6 +98,10 @@ func keepPath(p string, body []byte) bool {
 	return true
 }
 
+func eligiblePath(p string) bool {
+	return classify.Classify(p) == classify.Code && !claimcheck.IsTestPath(p) && !vendored(p)
+}
+
 func vendored(p string) bool {
 	for _, s := range strings.Split(p, "/") {
 		switch s {
diff --git a/internal/sourcereview/select_test.go b/internal/sourcereview/select_test.go
index a1b4a556..7d0e9f3b 100644
--- a/internal/sourcereview/select_test.go
+++ b/internal/sourcereview/select_test.go
@@ -156,7 +156,7 @@ func TestParseTree(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(paths, []string{"file.go", "link"}) {
+	if !reflect.DeepEqual(paths, []treeBlob{{path: "file.go", id: "abc"}, {path: "link", id: "def"}}) {
 		t.Fatalf("%v", paths)
 	}
 	if _, err := parseTree([]byte("no-tab\x00")); err == nil {
@@ -199,17 +199,10 @@ func TestParseBatch(t *testing.T) {
 }
 
 func TestReadBlobsErrors(t *testing.T) {
-	git := func(string, []string, []byte) ([]byte, error) {
-		t.Fatal("git should not run")
-		return nil, nil
-	}
-	if _, err := readBlobs(".", []string{"a\nb"}, git); err == nil {
-		t.Fatal("newline path")
-	}
 	boom := func(string, []string, []byte) ([]byte, error) {
 		return nil, errors.New("git down")
 	}
-	if _, err := readBlobs(".", []string{"a.go"}, boom); err == nil {
+	if _, err := readBlobs(".", []treeBlob{{path: "a.go", id: "abc"}}, boom); err == nil {
 		t.Fatal("git error")
 	}
 	if files, err := readBlobs(".", nil, boom); err != nil || len(files) != 0 {

From 77535e0df57bc64ec43135d78040a40e6e2acaf3 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sat, 3 Oct 2026 07:57:05 -0700
Subject: [PATCH 20/22] fix: preserve cancellation and exact filename handling

---
 internal/sourcereview/output.go          | 17 +++++++
 internal/sourcereview/output_test.go     | 56 ++++++++++++++++++++++++
 internal/sourcereview/page.go            |  5 ++-
 internal/sourcereview/page_test.go       | 13 +++++-
 internal/sourcereview/parse.go           |  3 ++
 internal/sourcereview/regression_test.go | 15 +++++++
 6 files changed, 106 insertions(+), 3 deletions(-)

diff --git a/internal/sourcereview/output.go b/internal/sourcereview/output.go
index 9dddee9f..69c98de1 100644
--- a/internal/sourcereview/output.go
+++ b/internal/sourcereview/output.go
@@ -1,6 +1,7 @@
 package sourcereview
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -14,6 +15,10 @@ var reportLstat = os.Lstat
 // either saved report. Publication errors restore the previous pair. Renaming
 // two files is not an atomic transaction for concurrent readers or process crashes.
 func publishReports(opts Options, findings, page []byte) error {
+	ctx := opts.Context
+	if ctx == nil {
+		ctx = context.Background()
+	}
 	write, rename, remove := opts.WriteFile, opts.Rename, opts.Remove
 	if write == nil {
 		write = os.WriteFile
@@ -43,6 +48,9 @@ func publishReports(opts Options, findings, page []byte) error {
 	}
 	reports := []report{{name: "findings.json", body: findings}, {name: "review.html", body: page}}
 	for i := range reports {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
 		r := &reports[i]
 		if err := write(filepath.Join(stage, r.name), r.body, 0o644); err != nil {
 			return err
@@ -79,6 +87,9 @@ func publishReports(opts Options, findings, page []byte) error {
 		return cause
 	}
 	for i := range reports {
+		if err := ctx.Err(); err != nil {
+			return rollback(err)
+		}
 		r := &reports[i]
 		if r.exists {
 			if err := rename(filepath.Join(opts.OutputDir, r.name), filepath.Join(stage, r.name+".previous")); err != nil {
@@ -88,11 +99,17 @@ func publishReports(opts Options, findings, page []byte) error {
 		}
 	}
 	for i := range reports {
+		if err := ctx.Err(); err != nil {
+			return rollback(err)
+		}
 		r := &reports[i]
 		if err := rename(filepath.Join(stage, r.name), filepath.Join(opts.OutputDir, r.name)); err != nil {
 			return rollback(err)
 		}
 		r.published = true
 	}
+	if err := ctx.Err(); err != nil {
+		return rollback(err)
+	}
 	return nil
 }
diff --git a/internal/sourcereview/output_test.go b/internal/sourcereview/output_test.go
index 92cc0142..2ee6f0eb 100644
--- a/internal/sourcereview/output_test.go
+++ b/internal/sourcereview/output_test.go
@@ -1,6 +1,7 @@
 package sourcereview
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -9,6 +10,61 @@ import (
 	"testing"
 )
 
+func TestReportPublicationCancellationPreservesPreviousPair(t *testing.T) {
+	for cancelAfter := 0; cancelAfter <= 6; cancelAfter++ {
+		t.Run(fmt.Sprintf("after-operation-%d", cancelAfter), func(t *testing.T) {
+			dir := t.TempDir()
+			names := []string{"findings.json", "review.html"}
+			seedReports(t, dir, names)
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			n := 0
+			completed := func() {
+				n++
+				if n == cancelAfter {
+					cancel()
+				}
+			}
+			if cancelAfter == 0 {
+				cancel()
+			}
+			err := publishReports(Options{Context: ctx, OutputDir: dir,
+				WriteFile: func(p string, body []byte, mode os.FileMode) error {
+					if err := os.WriteFile(p, body, mode); err != nil {
+						return err
+					}
+					completed()
+					return nil
+				}, Rename: func(from, to string) error {
+					if err := os.Rename(from, to); err != nil {
+						return err
+					}
+					completed()
+					return nil
+				}}, []byte("new findings"), []byte("new page"))
+			if !errors.Is(err, context.Canceled) {
+				t.Fatal(err)
+			}
+			checkOldReports(t, dir, names)
+		})
+	}
+}
+
+func TestRunCancellationDuringReportSetup(t *testing.T) {
+	root, _ := newRepoBytes(t, droppedOnlyFiles())
+	dir := t.TempDir()
+	names := []string{"findings.json", "review.html"}
+	seedReports(t, dir, names)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	err := Run(Options{Context: ctx, Repo: root, Model: "opus", OutputDir: dir,
+		MkdirAll: func(p string, mode os.FileMode) error { cancel(); return os.MkdirAll(p, mode) }})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatal(err)
+	}
+	checkOldReports(t, dir, names)
+}
+
 var oldReports = map[string]string{"findings.json": "old findings", "review.html": "old page"}
 
 func seedReports(t *testing.T, dir string, names []string) {
diff --git a/internal/sourcereview/page.go b/internal/sourcereview/page.go
index 08c358c1..2e3fc2fd 100644
--- a/internal/sourcereview/page.go
+++ b/internal/sourcereview/page.go
@@ -234,7 +234,8 @@ const pageScript = `
       var okS = s === "" || el.getAttribute("data-severity") === s;
       var okD = d === "" || el.getAttribute("data-dir") === d;
       var okA = area === "" || el.getAttribute("data-area") === area;
-      var okQ = q === "" || el.textContent.toLowerCase().indexOf(q) >= 0;
+      var file = el.getAttribute("data-file") || "";
+      var okQ = q === "" || file.toLowerCase().indexOf(q) >= 0 || el.textContent.toLowerCase().indexOf(q) >= 0;
       var ok = okS && okD && okA && okQ;
       el.style.display = ok ? "" : "none";
       if (ok) n++;
@@ -683,7 +684,7 @@ func Render(p Page) []byte {
 				lines = fmt.Sprintf("L%d–%d", f.StartLine, f.EndLine)
 			}
 			tag := string(f.Tag)
-			fmt.Fprintf(&b, "<article class=\"finding\" data-severity=\"%s\" data-dir=\"%s\" data-area=\"%s\">\n", html.EscapeString(f.Severity), html.EscapeString(dir), html.EscapeString(area(f.File)))
+			fmt.Fprintf(&b, "<article class=\"finding\" data-file=\"%s\" data-severity=\"%s\" data-dir=\"%s\" data-area=\"%s\">\n", html.EscapeString(f.File), html.EscapeString(f.Severity), html.EscapeString(dir), html.EscapeString(area(f.File)))
 			// The row shows the issue's first sentence; opening it reveals the rest in place.
 			issue := strings.TrimSpace(f.Issue)
 			lead := summary(issue)
diff --git a/internal/sourcereview/page_test.go b/internal/sourcereview/page_test.go
index b2e03da5..bf82b92d 100644
--- a/internal/sourcereview/page_test.go
+++ b/internal/sourcereview/page_test.go
@@ -82,6 +82,9 @@ func TestRenderFiltersAndQuote(t *testing.T) {
 	if !reflectArgs(report.Search.Displays, []string{"none", "", "none", "none"}) || report.Search.Shown != "Showing 1 of 4" {
 		t.Fatalf("search %+v", report.Search)
 	}
+	if !reflectArgs(report.FileSearch.Displays, []string{"none", "", "none", "none"}) || report.FileSearch.Shown != "Showing 1 of 4" {
+		t.Fatalf("filename search %+v", report.FileSearch)
+	}
 }
 
 func TestPageHelpers(t *testing.T) {
@@ -150,7 +153,7 @@ func TestRenderRangesAndGutter(t *testing.T) {
 	for _, want := range []string{
 		"<h1>app</h1>", "L2–3", `<pre class="gutter" aria-hidden="true">2` + "\n3</pre>", `<pre class="quote">beta` + "\ngamma</pre>",
 		`<span class="lead">First sentence.</span><span class="rest"> Second sentence.</span>`,
-		`<span class="dir">pkg/</span>app.go`, "Model confidence 80 of 100", "The one finding is a P2.", `data-area="pkg"`,
+		`<span class="dir">pkg/</span>app.go`, "Model confidence 80 of 100", "The one finding is a P2.", `data-area="pkg"`, `data-file="pkg/app.go"`,
 	} {
 		if !strings.Contains(page, want) {
 			t.Fatalf("page missing %q", want)
@@ -228,6 +231,10 @@ type pageReport struct {
 		Displays []string `json:"displays"`
 		Shown    string   `json:"shown"`
 	} `json:"search"`
+	FileSearch struct {
+		Displays []string `json:"displays"`
+		Shown    string   `json:"shown"`
+	} `json:"fileSearch"`
 }
 
 func runPage(t *testing.T, page []byte) pageReport {
@@ -410,6 +417,10 @@ if (findings.length >= 2) {
   search.value = findings[1].querySelector(".issue").textContent.trim().toUpperCase();
   search.dispatchEvent("input");
   report.search = { displays: displays(), shown: shown() };
+  // Filename matching is separate from issue/snippet text and ignores case.
+  search.value = findings[1].getAttribute("data-file").split("/").pop().toUpperCase();
+  search.dispatchEvent("input");
+  report.fileSearch = { displays: displays(), shown: shown() };
 }
 process.stdout.write(JSON.stringify(report));
 `
diff --git a/internal/sourcereview/parse.go b/internal/sourcereview/parse.go
index aa77fa92..be9a3f86 100644
--- a/internal/sourcereview/parse.go
+++ b/internal/sourcereview/parse.go
@@ -71,6 +71,9 @@ func Parse(text string, files map[string][]byte) ([]lensoutput.TypedFinding, []s
 // citation, so "vite.config.js" means "web/vite.config.js" when that is the
 // only such file. Zero matches or two matches fail the run.
 func resolveKept(cited string, files map[string][]byte) (string, error) {
+	if _, ok := files[cited]; ok {
+		return cited, nil
+	}
 	shown := cited
 	cited = strings.ReplaceAll(strings.TrimSpace(cited), "\\", "/")
 	// Only a complete parent-directory component is traversal. Literal dots
diff --git a/internal/sourcereview/regression_test.go b/internal/sourcereview/regression_test.go
index 4c59a449..2ed0e1f0 100644
--- a/internal/sourcereview/regression_test.go
+++ b/internal/sourcereview/regression_test.go
@@ -112,6 +112,21 @@ func TestSelectNewlineFilenames(t *testing.T) {
 	}
 }
 
+func TestExactFindingFilenameWinsOverNormalization(t *testing.T) {
+	files := map[string][]byte{
+		"\napp.go": []byte("package newline\n"), "app.go": []byte("package app\n"),
+		"pkg/a\\b.go": []byte("package backslash\n"), "pkg/a/b.go": []byte("package slash\n"),
+		" app.go ": []byte("package spaced\n"),
+	}
+	for cited := range files {
+		text := fmt.Sprintf(`{"findings":[{"tag":"bug","file":%q,"start_line":1,"end_line":1,"issue":"i","consequence":"c","confidence":80,"severity":"P1"}]}`, cited)
+		got, skipped, err := Parse(text, files)
+		if err != nil || len(skipped) != 0 || len(got) != 1 || got[0].File != cited {
+			t.Fatalf("exact filename changed: cited=%q got=%v skipped=%v err=%v", cited, got, skipped, err)
+		}
+	}
+}
+
 func TestRunContextCancellation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()

From 84f6a87f2f4ccf740ec75c0be66177e8b8939e95 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sat, 3 Oct 2026 08:44:03 -0700
Subject: [PATCH 21/22] Add simple source-review wrapper and README guide

---
 README.md         | 24 ++++++++++++++++++++++++
 bin/source-review | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100755 bin/source-review

diff --git a/README.md b/README.md
index b5621455..c682fad6 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,30 @@ standalone or as a deeper review engine inside metaswarm, Superpowers, and Beads
 **→ New here? Read [USAGE.md](USAGE.md) for a task-oriented walkthrough, and [INSTALL.md](INSTALL.md) to
 get set up.**
 
+## Review a whole repository
+
+From a metareview source checkout, review a repository with Grok:
+
+```bash
+bin/source-review grok /path/to/repo
+```
+
+Replace `grok` with `opus` or `astra` to use another model. Omit the repository
+path to review your current directory. The script builds metareview automatically;
+you need Go and the selected model's CLI (`grok`, `claude`, or `codex`) installed
+and logged in.
+
+Each run saves `findings.json` and an offline `review.html` in its own directory
+under `/tmp`; the script prints that directory before starting. It reviews the
+committed first-party source at `HEAD`, skipping tests, docs, dependencies, and
+generated files.
+
+For path filters, concurrency, or timeout controls, use the full command:
+
+```bash
+bin/metareview source-review --model grok --output /tmp/grok-review --jobs 8 --call-timeout 30m /path/to/repo
+```
+
 ## Use Cases
 
 - **Workflow runs.** `metareview fsm` drives `sdlc-loop` (discover → adjudicate → fix → verify) and `review-loop` as an audited state machine: the agent does the host nodes' work in its own warm session, judge calls are auditable and swappable, and resume is a fork. Contract: `metareview fsm --agent-prompt`; guide: `docs/fsm/driving-a-workflow.md`.
diff --git a/bin/source-review b/bin/source-review
new file mode 100755
index 00000000..a4cb8f60
--- /dev/null
+++ b/bin/source-review
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  printf 'Usage: %s <grok|opus|astra> [repo]\n' "$0"
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+if [[ $# -lt 1 || $# -gt 2 ]]; then
+  usage >&2
+  exit 2
+fi
+
+model="$1"
+case "$model" in
+  grok|opus|astra) ;;
+  *) printf 'Unknown model: %s\n' "$model" >&2; usage >&2; exit 2 ;;
+esac
+
+# Resolve the caller's repo before moving into the metareview checkout to build.
+repo="$(cd -- "${2:-$PWD}" && pwd -P)"
+root="$(cd -- "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+cd -- "$root"
+go build -o bin/metareview ./cmd/metareview
+
+# Each run gets its own reports, outside the repository being reviewed.
+output="$(mktemp -d "/tmp/metareview-${model}-XXXXXX")"
+printf 'Reports: %s\n' "$output" >&2
+exec "$root/bin/metareview" source-review --model "$model" --output "$output" "$repo"

From e8c6560471d55cbf81010c238a00e25e955152f1 Mon Sep 17 00:00:00 2001
From: Ben Kruger <ben@benkruger.com>
Date: Sat, 3 Oct 2026 09:19:17 -0700
Subject: [PATCH 22/22] Require explicit model and repo flags in source-review
 wrapper

---
 README.md         | 10 +++++-----
 bin/source-review | 34 +++++++++++++++++++++++++---------
 2 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/README.md b/README.md
index c682fad6..0adce418 100644
--- a/README.md
+++ b/README.md
@@ -43,13 +43,13 @@ get set up.**
 From a metareview source checkout, review a repository with Grok:
 
 ```bash
-bin/source-review grok /path/to/repo
+bin/source-review --model grok --repo /path/to/repo
 ```
 
-Replace `grok` with `opus` or `astra` to use another model. Omit the repository
-path to review your current directory. The script builds metareview automatically;
-you need Go and the selected model's CLI (`grok`, `claude`, or `codex`) installed
-and logged in.
+Both `--model` and `--repo` are required. Replace `grok` with `opus` or `astra`
+to use another model; use `--repo .` to review your current directory. The script
+builds metareview automatically. You need Go and a logged-in model CLI (`grok`,
+`claude`, or `codex`).
 
 Each run saves `findings.json` and an offline `review.html` in its own directory
 under `/tmp`; the script prints that directory before starting. It reviews the
diff --git a/bin/source-review b/bin/source-review
index a4cb8f60..8de250aa 100755
--- a/bin/source-review
+++ b/bin/source-review
@@ -2,26 +2,42 @@
 set -euo pipefail
 
 usage() {
-  printf 'Usage: %s <grok|opus|astra> [repo]\n' "$0"
+  printf 'Usage: %s --model <grok|opus|astra> --repo <path>\n' "$0"
 }
 
-if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
-  usage
-  exit 0
-fi
-if [[ $# -lt 1 || $# -gt 2 ]]; then
+model=""
+repo=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --model|--repo)
+      if [[ $# -lt 2 || -z "$2" || "$2" == --* ]]; then
+        printf 'Missing value for %s\n' "$1" >&2
+        usage >&2
+        exit 2
+      fi
+      case "$1" in
+        --model) model="$2" ;;
+        --repo) repo="$2" ;;
+      esac
+      shift 2
+      ;;
+    --help|-h) usage; exit 0 ;;
+    *) printf 'Unknown argument: %s\n' "$1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+if [[ -z "$model" || -z "$repo" ]]; then
+  printf 'Both --model and --repo are required\n' >&2
   usage >&2
   exit 2
 fi
-
-model="$1"
 case "$model" in
   grok|opus|astra) ;;
   *) printf 'Unknown model: %s\n' "$model" >&2; usage >&2; exit 2 ;;
 esac
 
 # Resolve the caller's repo before moving into the metareview checkout to build.
-repo="$(cd -- "${2:-$PWD}" && pwd -P)"
+repo="$(cd -- "$repo" && pwd -P)"
 root="$(cd -- "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
 cd -- "$root"
 go build -o bin/metareview ./cmd/metareview