feat(review): swap re-review rounds to a fix-audit shape under the critical posture

docs/users/features/code-review.md

@@ -367,6 +367,8 @@ If you switch models (via `/model`) and re-review the same PR, `/review` detects
 
 The model match also gates incremental scoping, not just the skip: "clean up to the cached commit" is the previous model's verdict, so when new commits have landed since the cached review, a model mismatch never scopes to `lastCommitSha..HEAD` — the range is the full diff, noting "Previous round was reviewed by qwen3-coder. Running full review with gpt-4o." — unless an anchor certified by the model now running is recovered from the last posted review (below), which scopes the range instead. The previous round's findings still carry over to be re-ruled; only the anchor does not. The same gate binds the anchor recovered from the last posted review's machine-ledger marker when the cache is absent or its anchor is unusable (CI, another clone): it scopes the incremental range only if the model now running certified it — a marker certified by a different model, or carrying no model (a review posted with `review.attribution` off, or one from before the field), falls back to the full diff. A round that did not close cleanly posts its marker without an anchor (it cannot certify a range), but that loss is not sticky when the round's work list survived whole: recovery grafts the anchor forward from the most recent earlier marker your own account posted with one, so a single non-clean round no longer forces every later round to re-read the full diff — the next round scopes `anchor..HEAD`, which re-covers the range the non-clean round could not certify. A size-capped round's graft is refused (dropped findings would fall outside the grafted scope and retire silently), so later rounds keep re-reading the full diff until a complete marker lands.
 
+**Critical-posture re-reviews run a narrower round (fix-audit shape).** Once a PR's re-review resolves the round-adaptive posting floor to critical-only (from round 6, or earlier when the flat first-time-finding trend latches — see the convergence posture) *and* a usable incremental anchor exists, the round stops re-running round 1's shape. The capture command predicts the floor from the previous round's posted marker and records `incremental.posture: "critical"` in the plan, and the round then: fans out one territory agent per chunk of the delta (whatever its size — no 3A dimension set, and no issue-fidelity agent, which the full rounds already answered); republishes each still-clean *interaction* file seam-bounded — only the hunks displaying a line that imports or uses what changed, with a `seam: {kept, total}` census in the plan and a header-only section when nothing qualifies, so the file still gets an agent briefed to check the seam from the worktree; and narrows the reverse-audit waves instead of capping them — from wave 3, a chunk holding no delta file leaves the schedule after one substantive dry audit, while delta territories keep the full retirement rules, so the late waves (where fix-induced Criticals measurably surface) keep running over a shrinking front. Severities are unchanged — the posture governs what posts, never what is found — and every reduction is disclosed: in the plan, in the agents' briefs, in the round's `posture narrowing:` note, and as a one-sentence "Round shape" disclosure in the posted review body. The plan's posture record is itself an arm of the compose-time floor resolution, so a fix-audit round's posting bar cannot disagree with the shape it ran (sub-Critical findings defer even if the floor's usual inputs are unavailable at compose time). An explicit `--severity-floor suggestion` turns the shape off along with the posture (and outranks a stale plan record at posting time); an explicit `--severity-floor critical` enables it from the first anchored re-review.
+
 Cache is stored in `.qwen/review-cache/` and tracks both the commit SHA and model ID. Make sure this directory is in your `.gitignore` (a broader rule like `.qwen/*` also works). On GitHub, if the cached commit was rebased or force-pushed away, it falls back to a full review; Aone rules the cached anchor differently — see its paragraph below. Only high-effort reviews consult or write the cache — a `--effort low|medium` quick pass never counts as "already reviewed".
 
 ## Review Reports

packages/cli/src/commands/review/agent-prompt.test.ts

@@ -5025,6 +5025,52 @@ describe('per-chunk retirement — cold territories stop costing a round', () =>
     expect(rounds).toContain(2);
   });
 
+  it('a fix-audit round narrows the wave and the note names it (#10104)', () => {
+    // Chunk 13 is the delta territory; 14 and 15 hold interaction files.
+    const fixAuditPlan = {
+      ...PLAN,
+      incremental: {
+        since: 'a'.repeat(40),
+        effective: true,
+        posture: 'critical',
+        postureCause: 'round',
+        scope: {
+          anchor: 'a'.repeat(40),
+          deltaFiles: ['packages/cli/src/commands/review/x.test.ts'],
+          interaction: [
+            {
+              path: 'a.ts',
+              importsChanged: ['packages/cli/src/commands/review/x.test.ts'],
+            },
+            {
+              path: 'bundle.min.js',
+              importsChanged: ['packages/cli/src/commands/review/x.test.ts'],
+            },
+          ],
+        },
+      },
+    };
+    writeFileSync(plan, JSON.stringify(fixAuditPlan));
+    const old = new Date(2020, 0, 1);
+    utimesSync(plan, old, old);
+
+    answerRound(1, { 13: YIELD, 14: DRY, 15: YIELD });
+    answerRound(2, { 13: DRY, 14: DRY, 15: YIELD });
+    const out = runRound(3);
+
+    expect(process.exitCode).toBeUndefined();
+    // 13 is delta (ordinary rules, yield+dry: hot); 15 yielded last wave;
+    // 14 is a non-delta territory whose latest audit is dry — narrowed out
+    // after ONE dry receipt, where plain retirement would need two.
+    expect(out).toContain('2 auditors required this round');
+    expect(out).toContain('— chunk 13 ─');
+    expect(out).toContain('— chunk 15 ─');
+    expect(out).not.toContain('— chunk 14 ─');
+    expect(out).toContain('posture-narrowed chunk(s) skipped');
+    expect(out).toContain('posture narrowing (#10104)');
+    expect(out).toContain('chunk 14 — not a delta territory, dry in round 2');
+  });
+
   it('round 3 skips a chunk dry in rounds 1 and 2, and the note names it', () => {
     answerRound(1, { 13: DRY, 14: YIELD, 15: YIELD });
     answerRound(2, { 13: DRY, 14: YIELD, 15: YIELD });
@@ -6892,6 +6938,65 @@ describe('incremental-scope briefs', () => {
     expect(seam).toContain('src/changed.ts');
   });
 
+  it('a fix-audit round frames the brief and discloses the seam bound (#10104)', () => {
+    const fixAudit = {
+      ...INCREMENTAL_PLAN,
+      incremental: {
+        since: 'abc1234def5678900000',
+        effective: true,
+        posture: 'critical',
+        postureCause: 'round',
+        scope: {
+          ...INCREMENTAL_PLAN.incremental.scope,
+          interaction: [
+            {
+              path: 'src/caller.ts',
+              importsChanged: ['src/changed.ts'],
+              seam: { kept: 1, total: 4 },
+            },
+          ],
+        },
+      },
+    };
+    const delta = buildChunkAgentPrompt(fixAudit, 1);
+    expect(delta).toContain('Fix-audit round (critical posting posture)');
+    expect(delta).toContain('the floor governs posting, never');
+
+    const seam = buildChunkAgentPrompt(fixAudit, 2);
+    expect(seam).toContain('SEAM-BOUNDED: 1 of 4 hunk(s)');
+    expect(seam).toContain('still yours in full, from the worktree');
+
+    // Without the posture, no fix-audit frame and no seam clause — the seam
+    // census is a fix-audit fact, and a plan without one renders none.
+    const plain = buildChunkAgentPrompt(INCREMENTAL_PLAN, 2);
+    expect(plain).not.toContain('Fix-audit round');
+    expect(plain).not.toContain('SEAM-BOUNDED');
+  });
+
+  it('a malformed seam census renders no seam clause', () => {
+    const bad = {
+      ...INCREMENTAL_PLAN,
+      incremental: {
+        since: 'abc1234def5678900000',
+        effective: true,
+        posture: 'critical',
+        scope: {
+          ...INCREMENTAL_PLAN.incremental.scope,
+          interaction: [
+            {
+              path: 'src/caller.ts',
+              importsChanged: ['src/changed.ts'],
+              seam: { kept: 5, total: 2 },
+            },
+          ],
+        },
+      },
+    };
+    const seam = buildChunkAgentPrompt(bad, 2);
+    expect(seam).toContain('INTERACTION only');
+    expect(seam).not.toContain('SEAM-BOUNDED');
+  });
+
   it('whole-diff role briefs carry the frame once, up front', () => {
     const p = buildRoleBrief(INCREMENTAL_PLAN, '2');
     expect(p).toContain('Incremental round');

packages/cli/src/commands/review/agent-prompt.ts

@@ -105,6 +105,7 @@ import {
   type WorktreeResidue,
 } from './lib/worktree.js';
 import {
+  isFixAuditRound,
   isTerritoryFanOut,
   requiredAgents,
   reviewMode,
@@ -189,7 +190,12 @@ interface PlanReport {
 interface IncrementalScope {
   anchor: string;
   deltaFiles: string[];
-  interaction: Array<{ path: string; importsChanged: string[] }>;
+  interaction: Array<{
+    path: string;
+    importsChanged: string[];
+    /** The fix-audit seam bound's census, when the capture recorded one. */
+    seam?: { kept: number; total: number };
+  }>;
 }
 
 /**
@@ -220,7 +226,11 @@ function chunkScopeBullets(
       (e) =>
         `- ${inertPath(e.path)} — **interaction only**: cleared last round, back in ` +
         `scope because it imports ${e.importsChanged.map(inertPath).join(', ')}. ` +
-        `Review that seam, not the rest of its diff.`,
+        `Review that seam, not the rest of its diff.` +
+        (e.seam
+          ? ` (seam-bounded: ${e.seam.kept} of ${e.seam.total} hunk(s) republished; ` +
+            `the rest were cleared by an earlier round and are not re-shown)`
+          : ''),
     ),
   ];
 }
@@ -307,10 +317,27 @@ function incrementalScopeOf(report: PlanReport): IncrementalScope | null {
             strings((e as { importsChanged?: unknown }).importsChanged).length >
               0,
         )
-        .map((e) => ({
-          path: e.path,
-          importsChanged: strings(e.importsChanged),
-        }))
+        .map((e) => {
+          const rawSeam = (e as { seam?: unknown }).seam;
+          const seam =
+            typeof rawSeam === 'object' &&
+            rawSeam !== null &&
+            Number.isInteger((rawSeam as { kept?: unknown }).kept) &&
+            Number.isInteger((rawSeam as { total?: unknown }).total) &&
+            ((rawSeam as { kept: number }).kept as number) >= 0 &&
+            ((rawSeam as { total: number }).total as number) >=
+              ((rawSeam as { kept: number }).kept as number)
+              ? {
+                  kept: (rawSeam as { kept: number }).kept,
+                  total: (rawSeam as { total: number }).total,
+                }
+              : undefined;
+          return {
+            path: e.path,
+            importsChanged: strings(e.importsChanged),
+            ...(seam ? { seam } : {}),
+          };
+        })
     : [];
   // The SAME validity notion the roster applies
   // (`incrementalInteractionPaths`): a partially corrupt delta list
@@ -746,6 +773,22 @@ export function buildChunkAgentPrompt(
         `previous clean review round (anchor \`${inertPath(incremental.anchor.slice(0, 12))}\`), ` +
         `plus still-clean files one import hop from a change. Your files' scopes:`,
     ];
+    if (isFixAuditRound(report)) {
+      lines.splice(
+        1,
+        0,
+        `**Fix-audit round (critical posting posture).** The commits since the anchor ` +
+          `answer earlier rounds' findings, and this round's posting floor is Critical — ` +
+          `everything below it is recorded and deferred, never posted. Spend your walk ` +
+          `where such a round's signal measurably lives: for each change in your ` +
+          `territory, work out what the fix changed and what that change could break — ` +
+          `the guard added with no test of its own, the caller the moved callee leaves ` +
+          `behind, the invariant the fix's shortcut skips. Severities are unchanged: ` +
+          `report every finding at its true severity (the floor governs posting, never ` +
+          `finding), and never inflate one to clear the floor.`,
+        '',
+      );
+    }
     if (deltaHere.length > 0) {
       lines.push(
         ...deltaHere.map(
@@ -767,7 +810,13 @@ export function buildChunkAgentPrompt(
             `still hold — signatures, argument contracts, invariants, error behaviour — ` +
             `now that the imported side moved? Read the changed side from the worktree to ` +
             `answer that. Do not re-review the rest of this file's diff from scratch, and ` +
-            `do not report defects in it that the change it imports does not affect.`,
+            `do not report defects in it that the change it imports does not affect.` +
+            (e.seam
+              ? ` Its diff here is SEAM-BOUNDED: ${e.seam.kept} of ${e.seam.total} hunk(s) ` +
+                `republished — only the ones displaying a line that imports or uses what ` +
+                `changed; the rest were cleared by an earlier round and are not re-shown. ` +
+                `The seam question above is still yours in full, from the worktree.`
+              : ''),
         ),
       );
       lines.push(
@@ -2712,7 +2761,9 @@ function admitReverseAuditRound(
 function refuseConverged(planPath: string): void {
   clearBudgetStop(planPath);
   writeStderrLine(
-    'CONVERGED: every chunk holds two consecutive substantive dry audits; ' +
+    'CONVERGED: every chunk has left the wave — retired territories hold ' +
+      'two consecutive substantive dry audits, and on a fix-audit round a ' +
+      'posture-narrowed territory holds its single one; ' +
       'the reverse audit has converged — stop the loop and proceed to ' +
       'Step 6. This is a clean convergence, not a gap: no ' +
       'unreviewedDimensions entry is owed. If an earlier round-cap or ' +
@@ -2746,6 +2797,36 @@ function noteUncertifiedChunks(planPath: string, diagnostics: string[]): void {
   );
 }
 
+/**
+ * The fix-audit posture's wave-narrowing context (#10104): which chunks hold
+ * a delta file. Null everywhere the posture is off, so the schedule is
+ * byte-for-byte what it always was. A chunk holding only interaction files
+ * is NOT a delta territory — it is exactly the territory the narrowing
+ * exists to stop re-auditing once provably dry.
+ */
+function postureNarrowing(
+  report: PlanReport,
+): { deltaChunkIds: ReadonlySet<number> } | null {
+  if (!isFixAuditRound(report)) return null;
+  const scope = incrementalScopeOf(report);
+  if (scope === null) return null;
+  const delta = new Set(scope.deltaFiles);
+  const ids = new Set<number>();
+  const chunks = Array.isArray(report.chunks)
+    ? (report.chunks as Array<{ id?: unknown; files?: unknown }>)
+    : [];
+  for (const c of chunks) {
+    if (!Number.isSafeInteger(c?.id)) continue;
+    const files = Array.isArray(c.files)
+      ? (c.files as Array<{ path?: unknown }>)
+      : [];
+    if (files.some((f) => typeof f?.path === 'string' && delta.has(f.path))) {
+      ids.add(c.id as number);
+    }
+  }
+  return { deltaChunkIds: ids };
+}
+
 /**
  * The schedule read shared by the round builder and the per-chunk path
  * (#9272 — hand-rolled at both sites and edited in lockstep across three
@@ -2757,11 +2838,11 @@ function noteUncertifiedChunks(planPath: string, diagnostics: string[]): void {
  * the build's own scope.
  */
 function reverseAuditScheduleOrNote(
+  report: PlanReport,
   planPath: string,
   chunkIds: number[],
   round: number,
   env: NodeJS.ProcessEnv,
-  diffPathAbsolute: unknown,
   noteTail: string,
 ): { schedule: RoundSchedule | null; scheduleNote: string | null } {
   try {
@@ -2771,7 +2852,10 @@ function reverseAuditScheduleOrNote(
         chunkIds,
         round,
         env,
-        typeof diffPathAbsolute === 'string' ? diffPathAbsolute : undefined,
+        typeof report.diffPathAbsolute === 'string'
+          ? report.diffPathAbsolute
+          : undefined,
+        postureNarrowing(report),
       ),
       scheduleNote: null,
     };
@@ -2871,11 +2955,11 @@ function runAllChunks(
     round >= retirementReadsFrom
   ) {
     const read = reverseAuditScheduleOrNote(
+      report,
       planPath,
       chunks.map((c) => c.id),
       round,
       process.env,
-      report.diffPathAbsolute,
       'auditing every chunk.',
     );
     schedule = read.schedule;
@@ -2932,6 +3016,7 @@ function runAllChunks(
   );
   const coldSet = new Set(schedule?.coldChecks ?? []);
   const skipped = schedule?.skipped ?? [];
+  const narrowedOut = schedule?.narrowed ?? [];
 
   const digest = findingsDigest(findingsContent, rules);
   const roundPart = roundPartOf(round);
@@ -2968,11 +3053,16 @@ function runAllChunks(
   // counts; when nothing is retired the sentence is byte-identical to what
   // it always said.
   const scope =
-    skipped.length === 0
+    skipped.length === 0 && narrowedOut.length === 0
       ? 'one per chunk'
-      : `one per chunk still under audit (${skipped.length} retired ` +
-        `chunk(s) skipped; the retirement note after the end-of-round line ` +
-        `says which — relay it to the terminal)`;
+      : narrowedOut.length === 0
+        ? `one per chunk still under audit (${skipped.length} retired ` +
+          `chunk(s) skipped; the retirement note after the end-of-round line ` +
+          `says which — relay it to the terminal)`
+        : `one per chunk still under audit (${skipped.length} retired and ` +
+          `${narrowedOut.length} posture-narrowed chunk(s) skipped; the ` +
+          `notes after the end-of-round line say which — relay them to ` +
+          `the terminal)`;
   const planRoundCap = reverseAuditRoundCap(
     report,
     hasReviewDeadline(process.env),
@@ -2998,6 +3088,23 @@ function runAllChunks(
               )
               .join('\n'),
         ];
+  const narrowingNote =
+    narrowedOut.length === 0
+      ? []
+      : [
+          `posture narrowing (#10104): on this critical-posture round the ` +
+            `wave re-launches only the delta territories and whatever the ` +
+            `previous wave surfaced findings in — a chunk holding no delta ` +
+            `file leaves the schedule after one substantive dry audit and ` +
+            `takes no cold checks. Narrowed out this round:\n` +
+            narrowedOut
+              .map(
+                (n) =>
+                  `chunk ${n.chunkId} — not a delta territory, dry in round ` +
+                  `${n.dryRound}`,
+              )
+              .join('\n'),
+        ];
   writeStdoutLine(
     [
       `${dueChunks.length} auditors required this round — ${scope}. Launch ` +
@@ -3016,6 +3123,7 @@ function runAllChunks(
       ...blocks,
       `───── end of round — ${dueChunks.length} auditors ─────`,
       ...retirementNote,
+      ...narrowingNote,
     ].join('\n\n'),
   );
   // Admitted AND built: stamp now, so the next round's gate can measure
@@ -3449,11 +3557,11 @@ function runAgentPrompt(args: AgentPromptArgs): void {
     let scheduleNote: string | null = null;
     if (args.round !== undefined) {
       const read = reverseAuditScheduleOrNote(
+        report,
         args.plan,
         planChunkIds,
         args.round,
         process.env,
-        report.diffPathAbsolute,
         'auditing the chunk.',
       );
       const schedule = read.schedule;