diff --git a/packages/cli/src/commands/review/drive.test.ts b/packages/cli/src/commands/review/drive.test.ts
index 2697ba190f6..cc6cdd1556e 100644
--- a/packages/cli/src/commands/review/drive.test.ts
+++ b/packages/cli/src/commands/review/drive.test.ts
@@ -15,6 +15,7 @@ import {
   mkdtempSync,
   mkdirSync,
   readFileSync,
+  readdirSync,
   writeFileSync,
   existsSync,
   rmSync,
@@ -29,8 +30,11 @@ import {
   shellQuote,
   driveCommand,
   DRIVE_SENTINEL,
+  parseCaptureSpecs,
+  extractCaptures,
   type ExecResult,
 } from './drive.js';
+import { BRIEFS } from './lib/agent-briefs.js';
 import {
   writeStdoutLine,
   writeStderrLineSafe,
@@ -89,6 +93,61 @@ function harness(opts: {
   };
 }
 
+/**
+ * The fake tmux lifecycle shared by every test that fakes a drive:
+ * `new-session` writes the drive log, then — unless the run must not
+ * finish — the sentinel file. The protocol (log name, sentinel path,
+ * sentinel line format) lives in ONE place, so a change to it cannot
+ * leave a copy still modelling the old shape while passing.
+ */
+function driveExec(opts: {
+  server: string;
+  logText: string;
+  finish?: boolean;
+}) {
+  const dir = mkdtempSync(join(tmpdir(), 'drv-cap-'));
+  const logPath = join(dir, 'drive.log');
+  const workDir = join(tmpdir(), `qwen-review-drive-${opts.server}`);
+  const exec = (cmd: string, args: string[]): ExecResult => {
+    if (cmd === 'tmux' && args[0] === '-V') return ok();
+    if (cmd === 'tmux' && args[2] === 'new-session') {
+      writeFileSync(logPath, opts.logText);
+      if (opts.finish !== false) {
+        mkdirSync(workDir, { recursive: true });
+        writeFileSync(join(workDir, 'drive.rc'), `${DRIVE_SENTINEL} rc=0\n`);
+      }
+      return ok();
+    }
+    return ok();
+  };
+  return { dir, logPath, workDir, exec };
+}
+
+/** A full runDrive against a faked tmux lifecycle that writes `logText`. */
+function driveWithLog(
+  logText: string,
+  opts: { server: string; capture?: string[]; finish?: boolean },
+) {
+  const { dir, logPath, workDir, exec } = driveExec({
+    server: opts.server,
+    logText,
+    finish: opts.finish,
+  });
+  const report = runDrive({
+    script: 'drive it',
+    cwd: dir,
+    readyTimeout: 1,
+    timeout: opts.finish === false ? 0 : 30,
+    server: opts.server,
+    capture: opts.capture,
+    exec,
+    logPath,
+  });
+  rmSync(dir, { recursive: true, force: true });
+  rmSync(workDir, { recursive: true, force: true });
+  return report;
+}
+
 describe('the sentinel', () => {
   it('carries the exit code on the same line it announces completion', () => {
     // Two facts read from one capture. A capture holding the marker but not the
@@ -505,6 +564,494 @@ describe('the log cap', () => {
   });
 });
 
+describe('--capture', () => {
+  // The address a service BOUND is not the address it was asked for. `qwen
+  // serve` handed a taken port prints `port 8931 is in use, trying 8932...`
+  // and listens on the next one; a caller that keeps addressing 8931 reads a
+  // different, stale process for the rest of the run while the drive completes
+  // and looks clean. These pin the one thing that makes that detectable: the
+  // value in the report came out of this run's own output.
+
+  it('reports the address the service bound, not the one it was asked for', () => {
+    const r = driveWithLog(
+      [
+        'port 8931 is in use, trying 8932...',
+        'qwen serve listening on http://127.0.0.1:8932',
+        'ready',
+      ].join('\n'),
+      {
+        server: 'cap1',
+        capture: ['baseUrl=listening on (http://\\S+)'],
+      },
+    );
+    expect(r.outcome).toBe('completed');
+    expect(r.captured).toEqual({ baseUrl: 'http://127.0.0.1:8932' });
+    // The requested port appears in the log too; the capture must not be it.
+    expect(r.captured?.['baseUrl']).not.toContain('8931');
+  });
+
+  it('reads the UNTRIMMED log, so a value printed at startup survives a noisy run', () => {
+    // `trimCapture` keeps the TAIL, and the line a service prints when it binds
+    // is at the HEAD. Capturing from the report's `output` would lose exactly
+    // the value this flag exists for — on the loudest runs, which are the ones
+    // most likely to need it.
+    const head = 'listening on http://127.0.0.1:8432\n';
+    const r = driveWithLog(head + 'x'.repeat(400_000), {
+      server: 'cap2',
+      capture: ['baseUrl=listening on (http://\\S+)'],
+    });
+    expect(r.truncated).toBe(true);
+    expect(r.output).not.toContain('listening on');
+    expect(r.captured).toEqual({ baseUrl: 'http://127.0.0.1:8432' });
+  });
+
+  it('names an unmatched pattern in the note instead of reporting a blank', () => {
+    // null, never ''. A service that did not print what it was expected to
+    // print is a different fact from one that printed nothing, and the note
+    // has to say WHICH value a witness is about to quote by assumption.
+    const r = driveWithLog('started, but quietly\n', {
+      server: 'cap3',
+      capture: ['baseUrl=listening on (http://\\S+)', 'pid=pid=(\\d+)'],
+    });
+    expect(r.captured).toEqual({ baseUrl: null, pid: null });
+    expect(r.note).toContain('"baseUrl"');
+    expect(r.note).toContain('"pid"');
+    expect(r.note).toContain('addressed by assumption');
+  });
+
+  it('phrases a miss neutrally when the pattern matched but its group did not', () => {
+    // "no output matched" is falsified by a declared group that did not
+    // participate: the pattern's text IS present in the log, and a reader
+    // grepping for it would blame the extraction instead of the pattern.
+    const r = driveWithLog('b\n', {
+      server: 'cap7',
+      capture: ['v=(?:a(x))?b'],
+    });
+    expect(r.captured).toEqual({ v: null });
+    expect(r.note).toContain('produced no value for "v"');
+    expect(r.note).toContain(
+      'the pattern never matched, or its group did not participate',
+    );
+    expect(r.note).not.toContain('no output matched');
+  });
+
+  it('captures on a drive that did NOT finish', () => {
+    // A timed-out drive still bound its port, and that address is often what
+    // explains where the rest of it went.
+    const r = driveWithLog('listening on http://127.0.0.1:9001\n', {
+      server: 'cap4',
+      capture: ['baseUrl=listening on (http://\\S+)'],
+      finish: false,
+    });
+    expect(r.observed).toBe(false);
+    expect(r.captured).toEqual({ baseUrl: 'http://127.0.0.1:9001' });
+  });
+
+  it('omits the field entirely when nothing was asked for', () => {
+    // An empty object would claim a result set; a drive that asked for nothing
+    // has none.
+    const r = driveWithLog('anything\n', { server: 'cap5' });
+    expect(r.captured).toBeUndefined();
+    expect(r.note).not.toContain('--capture');
+  });
+
+  it('refuses a malformed pattern before starting anything', () => {
+    // Discovering it after a 300-second drive costs the drive. `tmux -V` is
+    // the first thing runDrive would otherwise touch, so its absence from the
+    // log is the proof that nothing was started.
+    const seen: string[][] = [];
+    const exec = (cmd: string, args: string[]): ExecResult => {
+      seen.push([cmd, ...args]);
+      return ok();
+    };
+    const r = runDrive({
+      script: 's',
+      cwd: '/tmp',
+      readyTimeout: 1,
+      timeout: 1,
+      server: 'cap6',
+      capture: ['baseUrl=[unclosed'],
+      exec,
+    });
+    expect(r.outcome).toBe('unavailable');
+    expect(r.note).toContain('not a valid regular expression');
+    expect(r.note).toContain('Nothing was started.');
+    expect(seen).toEqual([]);
+  });
+
+  it('rejects the whole set rather than dropping the bad entry', () => {
+    // A silently dropped capture reports the others beside a missing key,
+    // which reads as "the service never printed it" — the one meaning null is
+    // reserved for.
+    const bad = parseCaptureSpecs(['ok=a', '9bad=b']);
+    expect('error' in bad).toBe(true);
+    expect(parseCaptureSpecs(['a=x', 'a=y'])).toHaveProperty('error');
+    expect(parseCaptureSpecs(['noequals'])).toHaveProperty('error');
+    expect(parseCaptureSpecs(['empty='])).toHaveProperty('error');
+    expect(
+      parseCaptureSpecs(Array.from({ length: 9 }, (_, i) => `n${i}=x`)),
+    ).toHaveProperty('error');
+  });
+
+  it('refuses a bare --capture — an empty ask must not pass as no ask', () => {
+    // A bare flag or an empty array expansion parses to [], and without a
+    // rejection the drive runs to its timeout and reports identically to
+    // never having asked — the one malformed shape that would escape the
+    // rejects-rather-than-skips rule.
+    expect(parseCaptureSpecs([])).toHaveProperty('error');
+    expect(parseCaptureSpecs(undefined)).toEqual({ specs: [] });
+  });
+
+  it('holds the length caps at their documented boundary', () => {
+    // "A pattern of 1 to 200 characters" existed only in prose: deleting the
+    // cap check survives the rest of this suite (mutation-verified).
+    expect('specs' in parseCaptureSpecs(['p=' + 'x'.repeat(200)])).toBe(true);
+    expect(parseCaptureSpecs(['p=' + 'x'.repeat(201)])).toHaveProperty('error');
+    expect('specs' in parseCaptureSpecs([`n${'a'.repeat(31)}=x`])).toBe(true);
+    expect(parseCaptureSpecs([`n${'a'.repeat(32)}=x`])).toHaveProperty('error');
+  });
+
+  it('splits on the first = only, so a pattern may hold its own', () => {
+    const parsed = parseCaptureSpecs(['port=listening=(\\d+)']);
+    expect('specs' in parsed).toBe(true);
+    if (!('specs' in parsed)) throw new Error('unreachable');
+    expect(parsed.specs[0].name).toBe('port');
+    expect(parsed.specs[0].re.source).toBe('listening=(\\d+)');
+  });
+
+  it('prefers group 1, falls back to the whole match', () => {
+    const grouped = parseCaptureSpecs(['a=on (\\d+)']);
+    const whole = parseCaptureSpecs(['a=on \\d+']);
+    if (!('specs' in grouped) || !('specs' in whole))
+      throw new Error('unreachable');
+    expect(extractCaptures('on 42', grouped.specs)).toEqual({ a: '42' });
+    expect(extractCaptures('on 42', whole.specs)).toEqual({ a: 'on 42' });
+    expect(extractCaptures('nothing', grouped.specs)).toEqual({ a: null });
+  });
+
+  it('reads the FIRST match when a log holds several', () => {
+    // The sentinel takes the LAST occurrence because its decoys come from the
+    // driven script's own text; the value this flag exists for is printed
+    // once, at startup. Two occurrences are not exotic — a wrapper echoing
+    // the startup line, or a script that restarts the service — and the
+    // last-match mutant passes the rest of this suite (mutation-verified).
+    const parsed = parseCaptureSpecs(['baseUrl=listening on (http://\\S+)']);
+    if (!('specs' in parsed)) throw new Error('unreachable');
+    expect(
+      extractCaptures(
+        'listening on http://127.0.0.1:1\nlistening on http://127.0.0.1:2\n',
+        parsed.specs,
+      ),
+    ).toEqual({ baseUrl: 'http://127.0.0.1:1' });
+  });
+
+  it("keeps an empty group-1 as '' — a printed empty value is a measurement", () => {
+    // The ?? is what distinguishes it from null: the || mutant turns an
+    // empty group-1 into the whole match and passes the rest of this suite
+    // (mutation-verified).
+    const parsed = parseCaptureSpecs(['v=value: (.*)']);
+    if (!('specs' in parsed)) throw new Error('unreachable');
+    expect(extractCaptures('value: ', parsed.specs)).toEqual({ v: '' });
+  });
+
+  it('caps each captured VALUE — the one channel no other cap covers', () => {
+    // Extraction reads the UNTRIMMED log before trimCapture, so one group
+    // could otherwise carry megabytes into the report — written to BOTH
+    // stdout and the --out file — and the brief tells agents to quote
+    // captured values in the witness.
+    const parsed = parseCaptureSpecs(['data=data=(.*)']);
+    if (!('specs' in parsed)) throw new Error('unreachable');
+    const out = extractCaptures(`data=${'d'.repeat(1_000_000)}`, parsed.specs);
+    const v = out['data'] as string;
+    expect(v.length).toBeLessThan(10_000);
+    expect(v.startsWith('d'.repeat(4096))).toBe(true);
+    expect(v).toContain('[truncated, 1000000 characters total]');
+  });
+});
+
+describe('--capture: the invariants the docblocks claim', () => {
+  const specsOf = (entries: string[]) => {
+    const parsed = parseCaptureSpecs(entries);
+    if (!('specs' in parsed))
+      throw new Error(`unexpected error: ${parsed.error}`);
+    return parsed.specs;
+  };
+
+  it('a declared group the match left unfilled is null, not the whole match', () => {
+    // `m[1] ?? m[0]` reads as "group 1, or else the match", and for an OPTIONAL
+    // group that is a silent substitution: the caller asked what `x` matched
+    // and would receive the whole match under the same name, with nothing in
+    // the report saying a different question had been answered.
+    expect(extractCaptures('b', specsOf(['v=(?:a(x))?b']))).toEqual({
+      v: null,
+    });
+    // ...while a pattern that declares NO group still yields the whole match.
+    expect(extractCaptures('b', specsOf(['v=(?:ax)?b']))).toEqual({ v: 'b' });
+  });
+
+  it('keeps an empty capture as "", which is a measurement, not an absence', () => {
+    // The two are different claims and the report must not merge them: `null`
+    // is "nothing was captured", `''` is "the group captured zero characters".
+    expect(extractCaptures('pid=abc', specsOf(['pid=pid=(\\d*)']))).toEqual({
+      pid: '',
+    });
+    expect(extractCaptures('pid=abc', specsOf(['pid=pid=(\\d+)']))).toEqual({
+      pid: null,
+    });
+  });
+
+  it('takes the FIRST match, so a restart later in the log cannot rewrite it', () => {
+    // Every other capture test has exactly one occurrence, where first and last
+    // are the same value — which pins nothing about the rule the docblock
+    // states. This one differs on purpose.
+    const log = [
+      'listening on http://127.0.0.1:8932',
+      'restarting',
+      'listening on http://127.0.0.1:9999',
+    ].join('\n');
+    expect(extractCaptures(log, specsOf(['u=listening on (\\S+)']))).toEqual({
+      u: 'http://127.0.0.1:8932',
+    });
+  });
+
+  it('rejects a pattern past the length cap, not just an empty one', () => {
+    // The cap's lower bound was pinned and its upper bound was not, so the
+    // number could drift to anything without a test noticing.
+    expect(parseCaptureSpecs([`v=${'a'.repeat(200)}`])).toHaveProperty('specs');
+    expect(parseCaptureSpecs([`v=${'a'.repeat(201)}`])).toHaveProperty('error');
+  });
+});
+
+describe('--capture and the head-trim are reconciled in the note', () => {
+  it('says captures survive the trim, for the matched and the missed alike', () => {
+    // Without this the report reads as a self-contradiction: "early output is
+    // missing" sits directly beside a value that came OUT of the missing head,
+    // and beside a null the reader would reasonably blame the trim for.
+    const r = driveWithLog(
+      `listening on http://127.0.0.1:8432\n${'x'.repeat(400_000)}`,
+      {
+        server: 'trim1',
+        capture: ['baseUrl=listening on (\\S+)', 'pid=pid=(\\d+)'],
+      },
+    );
+
+    expect(r.truncated).toBe(true);
+    expect(r.captured).toEqual({
+      baseUrl: 'http://127.0.0.1:8432',
+      pid: null,
+    });
+    // the trim clause, the reconciliation, and the named miss — in that order
+    expect(r.note).toContain('trimmed at the head');
+    expect(r.note).toContain('--capture reads the untrimmed log');
+    expect(r.note).toContain('"pid"');
+    expect(r.note.indexOf('trimmed at the head')).toBeLessThan(
+      r.note.indexOf('--capture reads the untrimmed log'),
+    );
+    expect(r.note.indexOf('--capture reads the untrimmed log')).toBeLessThan(
+      r.note.indexOf('"pid"'),
+    );
+  });
+
+  it('scopes the reconciliation to completed drives', () => {
+    // The clause points at "the head-trim above" — emitted only in the
+    // completed note — and claims "the whole run". An overflowed drive was
+    // stopped at the log cap, so extraction never saw past it and a null
+    // there is NOT a miss against the whole run; the clause must not fire.
+    const r = driveWithLog('x'.repeat(9 * 1024 * 1024), {
+      server: 'trim3',
+      capture: ['baseUrl=listening on (\\S+)'],
+      finish: false,
+    });
+    expect(r.outcome).toBe('overflowed');
+    expect(r.truncated).toBe(true);
+    expect(r.captured).toEqual({ baseUrl: null });
+    expect(r.note).not.toContain('--capture reads the untrimmed log');
+  });
+
+  it('stays silent on a timed-out drive too', () => {
+    // The run had not ended either, so the same two claims do not hold.
+    const r = driveWithLog(
+      `listening on http://127.0.0.1:9001\n${'x'.repeat(400_000)}`,
+      {
+        server: 'trim4',
+        capture: ['baseUrl=listening on (\\S+)'],
+        finish: false,
+      },
+    );
+    expect(r.outcome).toBe('timed-out');
+    expect(r.truncated).toBe(true);
+    expect(r.note).not.toContain('--capture reads the untrimmed log');
+  });
+
+  it('adds no reconciliation when nothing was trimmed', () => {
+    // The clause is scoped to the case it explains; a short log gets no
+    // sentence about a trim that did not happen.
+    const r = runDrive({
+      script: 's',
+      cwd: '/tmp',
+      readyTimeout: 1,
+      timeout: 0,
+      server: 'trim2',
+      capture: ['v=nope'],
+      exec: harness({}).exec,
+    });
+    expect(r.truncated).toBe(false);
+    expect(r.note).not.toContain('--capture reads the untrimmed log');
+  });
+});
+
+describe("the verify brief's bound-address recipe actually captures", () => {
+  // The recipe is what agents copy, and a recipe that cannot work is worse
+  // than none: measured on the first version of it, the service was redirected
+  // to a file of its own, so `captured.baseUrl` came back null on every
+  // faithful run while the miss note said the value "was never measured".
+  //
+  // So this runs the brief's OWN text rather than a retyped copy — the script
+  // body and the capture pattern are both extracted from it — under the same
+  // redirect contract runDrive imposes (`bash <script> > <log> 2>&1`). No tmux
+  // is involved: what broke was the shell, and the shell is what this drives.
+  const briefText = () =>
+    Object.values(BRIEFS.verify)
+      .filter((v): v is string => typeof v === 'string')
+      .join('\n\n');
+
+  const recipe = () => {
+    const text = briefText();
+    const start = text.indexOf("--capture 'baseUrl=");
+    expect(start).toBeGreaterThan(-1);
+    const fence = text.indexOf('```', start);
+    const body = text.slice(text.lastIndexOf('```bash', start), fence);
+    const pattern = /--capture '([^']+)'/.exec(body)?.[1];
+    const script = /--script '([\s\S]*?)'\s*$/m.exec(body)?.[1];
+    // If either is missing the brief no longer teaches the recipe at all,
+    // which is a change this test exists to make somebody notice.
+    expect(pattern).toBeTruthy();
+    expect(script).toBeTruthy();
+    return { pattern: pattern as string, script: script as string };
+  };
+
+  const have = (bin: string) =>
+    spawnSync('sh', ['-lc', `command -v ${bin}`]).status === 0;
+
+  it.skipIf(!have('curl') || !have('mktemp'))(
+    "puts the service's own address in the drive log, not the response body",
+    () => {
+      const { pattern, script } = recipe();
+      const dir = mkdtempSync(join(tmpdir(), 'drv-recipe-'));
+      // A service whose RESPONSE BODY also carries a listening-on line: if the
+      // capture came from the request rather than the service, this is the
+      // address it would report, and the assertion below would catch it.
+      const svc = join(dir, 'svc.mjs');
+      writeFileSync(
+        svc,
+        [
+          "import http from 'node:http';",
+          "const s=http.createServer((_q,r)=>{r.writeHead(200);r.end('listening on http://127.0.0.1:59999\\n')});",
+          "s.listen(0,'127.0.0.1',()=>console.log(`svc listening on http://127.0.0.1:${s.address().port}`));",
+          'setTimeout(()=>process.exit(0),20000);',
+        ].join('\n'),
+      );
+
+      const filled = script
+        .replace(
+          '<start the service; --port 0 wherever it allows one>',
+          `${JSON.stringify(process.execPath)} ${JSON.stringify(svc)}`,
+        )
+        .replace('<the endpoint the claim is about>', 'whatever');
+      const scriptPath = join(dir, 'recipe.sh');
+      writeFileSync(scriptPath, filled);
+      const logPath = join(dir, 'drive.log');
+
+      // Exactly what runDrive does with the script it is given.
+      const ran = spawnSync(
+        'bash',
+        ['-lc', `bash ${shellQuote(scriptPath)} > ${shellQuote(logPath)} 2>&1`],
+        { cwd: dir, timeout: 30_000, encoding: 'utf8' },
+      );
+      // Thrown rather than asserted so the shell's own stderr reaches the
+      // failure message — a recipe that dies takes its reason with it.
+      if (ran.status !== 0) {
+        throw new Error(`the recipe exited ${ran.status}: ${ran.stderr}`);
+      }
+
+      // `pattern` already carries its `name=` prefix, straight from the brief.
+      const parsed = parseCaptureSpecs([pattern]);
+      if (!('specs' in parsed)) throw new Error(parsed.error);
+      const captured = extractCaptures(
+        readFileSync(logPath, 'utf8'),
+        parsed.specs,
+      );
+
+      // The whole point: a value, and the SERVICE's value.
+      expect(captured['baseUrl']).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+      expect(captured['baseUrl']).not.toContain('59999');
+      // ...and the recipe left nothing behind in the working directory.
+      expect(
+        readdirSync(dir).filter((f) => f.endsWith('.log') && f !== 'drive.log'),
+      ).toEqual([]);
+
+      rmSync(dir, { recursive: true, force: true });
+    },
+  );
+});
+
+describe('--capture reaches runDrive through the real CLI seam', () => {
+  // The handler casts `argv as unknown as DriveArgs`, which type-checks
+  // whatever the option is called. Rename `DriveArgs.capture` — or the yargs
+  // option — and `--capture` silently stops working end to end while every
+  // runDrive test above stays green and tsc exits 0. This drives the real
+  // builder with a real flag string and asserts the value lands in the report
+  // the handler prints.
+  it('parses the flag and the captured value reaches the printed report', async () => {
+    const { default: yargs } = await import('yargs');
+    const { dir, logPath, workDir, exec } = driveExec({
+      server: 'seam1',
+      logText: 'listening on http://127.0.0.1:8932\n',
+    });
+
+    const argv = (
+      yargs([
+        'drive',
+        '--script',
+        'true',
+        '--cwd',
+        dir,
+        '--server',
+        'seam1',
+        '--capture',
+        'baseUrl=listening on (\\S+)',
+      ]).command({
+        ...driveCommand,
+        handler: () => {},
+      }) as unknown as { parseSync: () => Record<string, unknown> }
+    ).parseSync();
+
+    // The flag string reached the option name the handler reads.
+    expect(argv['capture']).toEqual(['baseUrl=listening on (\\S+)']);
+
+    vi.mocked(writeStdoutLine).mockClear();
+    const originalExit = process.exitCode;
+    try {
+      (driveCommand.handler as (a: unknown) => void)({
+        ...argv,
+        readyTimeout: 1,
+        timeout: 30,
+        exec,
+        logPath,
+      });
+    } finally {
+      process.exitCode = originalExit;
+      rmSync(dir, { recursive: true, force: true });
+      rmSync(workDir, { recursive: true, force: true });
+    }
+
+    const printed = vi.mocked(writeStdoutLine).mock.calls.at(-1)?.[0] as string;
+    expect(JSON.parse(printed).captured).toEqual({
+      baseUrl: 'http://127.0.0.1:8932',
+    });
+  });
+});
+
 describe('a partial observation is never presented as a whole one', () => {
   it('a timed-out drive sets observed=false and says the capture is partial', () => {
     const h = harness({});
diff --git a/packages/cli/src/commands/review/drive.ts b/packages/cli/src/commands/review/drive.ts
index ca755226d44..ab552731a3d 100644
--- a/packages/cli/src/commands/review/drive.ts
+++ b/packages/cli/src/commands/review/drive.ts
@@ -88,6 +88,43 @@ export interface DriveReport {
   truncated: boolean;
   /** A stale server from an earlier run that this one had to kill first. */
   killedStale: boolean;
+  /**
+   * Facts read back out of THIS run's own output, one per `--capture`.
+   *
+   * A RECORD of the run, never an input to it. Extraction happens after the
+   * drive loop has ended, so nothing here can reach a request the script has
+   * already made — and treating it as though it could is worse than not
+   * capturing at all: a script that addressed 8931 while the service logged
+   * 8932 completes with `observed: true` beside `captured.baseUrl` of 8932,
+   * and nothing in the report contradicts it, so a witness quoting that
+   * address attributes 8931's readings to the daemon on 8932. The script has
+   * to derive the address from the service's own output before its first
+   * request; what this field then adds is evidence that the address it used
+   * is the one the service printed. The verify brief carries the recipe.
+   *
+   * The address a service actually bound is the motivating one, and it is not
+   * the address it was asked for: `qwen serve` handed a taken port prints
+   * `port 8931 is in use, trying 8932...` and listens on the next one. A caller
+   * that goes on addressing its requested port then reads a DIFFERENT, stale
+   * process for the rest of the run — and every number it reports is about that
+   * process, while the drive completes and looks exactly like a clean one.
+   * Measured: a full verification cycle spent on a daemon that was not the one
+   * under test.
+   *
+   * `null` when nothing was captured — the pattern never matched, or it
+   * declares a group the match left unfilled. That is a different fact from a
+   * captured empty string, and only the second is a measurement.
+   *
+   * `''` is narrower than it looks, and the narrowing is the pattern's rather
+   * than the service's: it means the pattern matched and its group captured
+   * zero characters, which a `*`-quantified group does wherever it is anchored
+   * — `pid=(\d*)` returns `''` against `pid=abc`. A pattern meant to tell
+   * "printed nothing" from "printed something" needs `+`, not `*`.
+   *
+   * Absent entirely when nothing was captured, so a report from a drive that
+   * asked for nothing does not claim an empty result set.
+   */
+  captured?: Record<string, string | null>;
   note: string;
 }
 
@@ -112,6 +149,11 @@ export interface DriveArgs {
    * cannot be captured from, or killed, by this one.
    */
   server: string;
+  /**
+   * `name=<regex>` pairs read back out of the drive's own output. Repeatable.
+   * Capture group 1 when the pattern has one, the whole match otherwise.
+   */
+  capture?: string[];
   /** Test seam — production shells out for real. */
   exec?: (cmd: string, args: string[], input?: string) => ExecResult;
   /** Test seam — production derives it from `server`. */
@@ -149,6 +191,181 @@ export function shellQuote(v: string): string {
 /** Cap the captured pane the way build-test caps command output. */
 const CAPTURE_MAX = 200_000;
 
+/**
+ * Bounds on `--capture`. Small on purpose: this exists to lift a handful of
+ * run-derived facts out of a log — an address, a pid, a chosen path — not to
+ * become a reporting language. A caller who wants more than this wants `jq`
+ * over the log, which they already have.
+ */
+const MAX_CAPTURES = 8;
+/**
+ * Bounds the pattern's LENGTH, not its running time: a nested quantifier like
+ * `(a+)+$` — nine characters, well under this cap — backtracks exponentially
+ * on a near-matching run, and extraction happens after the poll loop exits,
+ * where `--timeout` no longer reaches. Measured growth is ~×3.5 per +2
+ * characters, so a ~40-char near-miss is hours at 100% CPU with no report
+ * ever written. Keep patterns linear; the verify brief says so where it tells
+ * agents to author their own.
+ */
+const MAX_CAPTURE_PATTERN = 200;
+/** Capture names travel into a JSON key and a report a human reads. */
+const CAPTURE_NAME_RE = /^[A-Za-z][A-Za-z0-9_-]{0,31}$/;
+/**
+ * A captured value is the one output channel here with no cap anywhere else:
+ * it comes out of the UNTRIMMED log before `trimCapture`, so one group could
+ * otherwise carry megabytes into the report — which the handler writes to
+ * BOTH stdout and the `--out` file — and the verify brief tells agents to
+ * quote captured values in the witness. Symmetric with `trimCapture`: cut at
+ * a bound, and say that it cut.
+ */
+const CAPTURE_VALUE_MAX = 4096;
+
+export interface CaptureSpec {
+  name: string;
+  re: RegExp;
+  /**
+   * Whether the pattern declares a capturing group, decided when it is parsed
+   * rather than from whether group 1 happened to participate in a match.
+   *
+   * Those are different questions and conflating them loses a value silently.
+   * `(?:a(x))?b` against `b` matches with group 1 absent; a runtime
+   * `m[1] ?? m[0]` then reports the WHOLE MATCH under a name whose pattern
+   * asked for the group — the caller receives `"b"` where it asked for what
+   * `x` matched, and nothing says a substitution happened. A pattern that
+   * declares a group and did not fill it captured nothing, which is `null`.
+   */
+  hasGroup: boolean;
+}
+
+/**
+ * Does this pattern declare a capturing group?
+ *
+ * Counted by matching `<source>|` against the empty string — the alternation
+ * always matches, and the result's length is 1 + the group count, which is the
+ * standard way to ask this without parsing regex syntax. Guarded because it
+ * builds a second pattern from the first: any source that survived
+ * `new RegExp` should survive this too, and a source that somehow does not
+ * falls back to "no group", which is the pre-existing whole-match behaviour
+ * rather than a throw from a helper that only counts.
+ */
+function declaresGroup(re: RegExp): boolean {
+  try {
+    return (new RegExp(`${re.source}|`).exec('')?.length ?? 1) > 1;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Parse `--capture name=<regex>` pairs, or say why they cannot be used.
+ *
+ * Rejects rather than skips, and rejects the whole set rather than the bad
+ * entry: a drive that quietly dropped one capture would report the others
+ * beside a missing key, which reads as "the service never printed it" — the
+ * one meaning `null` is reserved for. A malformed request is the caller's bug
+ * and must not be able to disguise itself as a measurement.
+ *
+ * Split on the FIRST `=` only, because a regex may hold as many as it likes
+ * (`--capture port=listening on \S+=(\d+)` is a legitimate pattern).
+ */
+export function parseCaptureSpecs(
+  raw: readonly string[] | undefined,
+): { specs: CaptureSpec[] } | { error: string } {
+  if (!raw) return { specs: [] };
+  if (raw.length === 0) {
+    return {
+      error:
+        '--capture was given but holds no `name=<regex>` pair — an empty ask would run the whole drive and report identically to never having asked, and a malformed request must not be able to disguise itself.',
+    };
+  }
+  if (raw.length > MAX_CAPTURES) {
+    return {
+      error: `--capture was given ${raw.length} patterns; the cap is ${MAX_CAPTURES}. This lifts a few run-derived facts out of the log, not a report format.`,
+    };
+  }
+  const specs: CaptureSpec[] = [];
+  const seen = new Set<string>();
+  for (const entry of raw) {
+    const eq = entry.indexOf('=');
+    if (eq <= 0) {
+      return {
+        error: `--capture ${JSON.stringify(entry)} is not \`name=<regex>\` — the name comes first, then one \`=\`, then the pattern (later \`=\` characters belong to the pattern).`,
+      };
+    }
+    const name = entry.slice(0, eq);
+    const pattern = entry.slice(eq + 1);
+    if (!CAPTURE_NAME_RE.test(name)) {
+      return {
+        error: `--capture name ${JSON.stringify(name)} is not usable as a report key: letters, digits, underscore and dash, starting with a letter, max 32.`,
+      };
+    }
+    if (seen.has(name)) {
+      return {
+        error: `--capture name ${JSON.stringify(name)} was given twice; one of the two would silently win.`,
+      };
+    }
+    if (pattern.length === 0 || pattern.length > MAX_CAPTURE_PATTERN) {
+      return {
+        error: `--capture ${JSON.stringify(name)} needs a pattern of 1 to ${MAX_CAPTURE_PATTERN} characters.`,
+      };
+    }
+    let re: RegExp;
+    try {
+      re = new RegExp(pattern);
+    } catch (err) {
+      return {
+        error: `--capture ${JSON.stringify(name)} is not a valid regular expression: ${(err as Error).message}`,
+      };
+    }
+    seen.add(name);
+    specs.push({ name, re, hasGroup: declaresGroup(re) });
+  }
+  return { specs };
+}
+
+/**
+ * Read each pattern out of the drive's output.
+ *
+ * Against the UNTRIMMED log, not the report's `output`: `trimCapture` keeps the
+ * tail, and the line a service prints when it binds is near the head — the one
+ * value this feature exists for is exactly the one a trimmed capture loses.
+ *
+ * Group 1 when the pattern declares one, the whole match otherwise, so both
+ * `listening on \S+` and `listening on (\S+)` do what they look like — and a
+ * declared group the match left unfilled is `null`, not a quiet substitution
+ * of the whole match under the same name.
+ *
+ * FIRST match, unlike `sentinelExitCode`'s last. The two are answering
+ * different questions: the sentinel's decoys come from the driven script's own
+ * text and the real one is written last by construction, whereas the value this
+ * exists for is printed once, at startup, before anything else could have
+ * echoed it. A caller who wants the most recent of several occurrences says so
+ * in the pattern rather than having the rule chosen for them.
+ *
+ * A value longer than the cap is cut at it, keeping the head and naming the
+ * full length — a service that prints one huge line under a pattern spanning
+ * it must not put megabytes into the report.
+ */
+export function extractCaptures(
+  output: string,
+  specs: readonly CaptureSpec[],
+): Record<string, string | null> {
+  const out: Record<string, string | null> = {};
+  for (const { name, re, hasGroup } of specs) {
+    const m = re.exec(output);
+    // A pattern that declares a group is asking for the group. When it matched
+    // but the group did not participate, nothing was captured — `null` — and
+    // NOT the whole match, which would answer a question the caller did not
+    // ask under the name it did.
+    const v = m ? (hasGroup ? (m[1] ?? null) : m[0]) : null;
+    out[name] =
+      v !== null && v.length > CAPTURE_VALUE_MAX
+        ? `${v.slice(0, CAPTURE_VALUE_MAX)}... [truncated, ${v.length} characters total]`
+        : v;
+  }
+  return out;
+}
+
 /**
  * Cap on the log FILE, not just on what gets reported from it.
  *
@@ -290,6 +507,24 @@ export function runDrive(args: DriveArgs): DriveReport {
       note: `--server ${JSON.stringify(server)} is not a name this command will own: it becomes both a path under the temp dir and a word in the shell line tmux runs, so it is restricted to letters, digits, dot, dash and underscore (max 64). Nothing was started.`,
     };
   }
+  // Before anything is started, like the server-name check above: a caller who
+  // asked for a capture wants it in the witness, and discovering the pattern
+  // was malformed after a 300-second drive costs the drive.
+  const parsed = parseCaptureSpecs(args.capture);
+  if ('error' in parsed) {
+    return {
+      outcome: 'unavailable',
+      observed: false,
+      exitCode: null,
+      readyAfterMs: null,
+      droveForMs: 0,
+      output: '',
+      truncated: false,
+      killedStale: false,
+      note: `${parsed.error} Nothing was started.`,
+    };
+  }
+  const captureSpecs = parsed.specs;
   const tmux = (...a: string[]) => exec('tmux', ['-L', server, ...a]);
 
   if (exec('tmux', ['-V']).status !== 0) {
@@ -386,6 +621,20 @@ export function runDrive(args: DriveArgs): DriveReport {
         ? sentinelExitCode(readFileSync(sentinelPath, 'utf8'))
         : null;
       if (exitCode !== null) {
+        // Re-read the log now that the sentinel is there, because the read
+        // above happened BEFORE it. The wrapper writes the sentinel from an
+        // EXIT trap, strictly after the script's last write to the log, so a
+        // final write landing between these two back-to-back reads is in the
+        // file and not in the snapshot — a window one `readFileSync` of a
+        // near-cap log wide, measured at ~1 in 70 such drives. It used to cost
+        // a truncated tail in `output`, which reads as a display artefact;
+        // with `captured` extracted from that same snapshot it costs a `null`
+        // for a value the run demonstrably produced, under a note asserting
+        // the pattern never matched. Every log write happens-before the
+        // sentinel write, so a read taken after it is complete. Kept to this
+        // branch: the other exits stopped the run rather than observing it
+        // finish, and have no such guarantee to lean on.
+        output = existsSync(logPath) ? readFileSync(logPath, 'utf8') : '';
         outcome = 'completed';
         break;
       }
@@ -409,8 +658,18 @@ export function runDrive(args: DriveArgs): DriveReport {
     if (!args.logPath) rmSync(dir, { recursive: true, force: true });
   }
 
+  // From the untrimmed log, and on every outcome rather than only `completed`:
+  // a drive that timed out still bound its port, and the address it bound is
+  // often the fact that explains why the rest of it went nowhere.
+  const captured =
+    captureSpecs.length > 0 ? extractCaptures(output, captureSpecs) : undefined;
   const { text, truncated } = trimCapture(output);
   const droveForMs = Date.now() - droveFrom;
+  const missed = captured
+    ? Object.entries(captured)
+        .filter(([, v]) => v === null)
+        .map(([k]) => k)
+    : [];
   const note =
     outcome === 'overflowed'
       ? `the drive wrote more than ${Math.round(LOG_MAX_BYTES / 1024 / 1024)} MiB and was stopped — no exit code is reported because it never gave one, and a run this command had to stop is not evidence about the diff either way. Quieten the script, or have it manage its own output file.`
@@ -418,6 +677,30 @@ export function runDrive(args: DriveArgs): DriveReport {
         ? `drove for ${Math.round(droveForMs / 1000)}s and reached its sentinel with exit ${exitCode}${readyAfterMs === null ? '' : ` (ready after ${Math.round(readyAfterMs / 1000)}s)`}${truncated ? '; the capture was trimmed at the head, so early output is missing' : ''}`
         : `the drive did not finish within ${args.timeout}s — the capture below is PARTIAL, and a partial capture is not evidence that the run produced nothing. Raise --timeout, or give the script a smaller job.`;
 
+  // Named, not merely counted. A `null` capture is the case where a witness is
+  // about to quote a value the run never produced, and the reader needs to know
+  // WHICH one before deciding whether the rest still stands.
+  const captureNote =
+    missed.length > 0
+      ? ` — --capture produced no value for ${missed.map((n) => JSON.stringify(n)).join(', ')} (the pattern never matched, or its group did not participate), so ${missed.length === 1 ? 'that value is' : 'those values are'} null rather than measured; anything addressed by ${missed.length === 1 ? 'it' : 'them'} was addressed by assumption`
+      : '';
+
+  // Reconciles the head-trim clause with the capture block beside it. `output`
+  // is trimmed at the head and `captured` is read BEFORE that trim, so without
+  // this the report says "early output is missing" immediately beside values
+  // that came out of the missing head — and, for a miss, beside a `null` the
+  // reader would reasonably blame the trim for. Both misreadings run the same
+  // way: they invite doubt about a measurement that is sound.
+  //
+  // Completed only: "the head-trim above" appears only in the completed note,
+  // and only a run that reached its sentinel had a whole run to miss against —
+  // a timed-out or overflowed drive was stopped early, so a value printed
+  // after the stop never reached the extraction.
+  const trimScopeNote =
+    captured && truncated && outcome === 'completed'
+      ? ' — --capture reads the untrimmed log, so the head-trim above does not reach it and a null capture is a miss against the whole run rather than against what survived the trim'
+      : '';
+
   return {
     outcome,
     observed: outcome === 'completed',
@@ -427,7 +710,8 @@ export function runDrive(args: DriveArgs): DriveReport {
     output: text,
     truncated,
     killedStale,
-    note,
+    ...(captured ? { captured } : {}),
+    note: `${note}${trimScopeNote}${captureNote}`,
   };
 }
 
@@ -468,6 +752,12 @@ export const driveCommand: CommandModule = {
         describe:
           'tmux server name — namespaced so runs cannot capture each other',
       })
+      .option('capture', {
+        type: 'array',
+        string: true,
+        describe:
+          "name=<regex> read back out of this run's own output, e.g. baseUrl=listening on (https?://\\S+). Repeatable. Group 1 when the pattern declares one, the whole match otherwise; null when nothing was captured — the pattern never matched, or its declared group did not participate. Keep patterns linear — no nested quantifiers like (a+)+: extraction runs after the drive ends, where no --timeout reaches, and a backtracking pattern hangs the run with no report. Use it for anything the service CHOSE rather than was told — above all the address it actually bound.",
+      })
       .option('out', {
         type: 'string',
         describe: 'Write the JSON report here',
diff --git a/packages/cli/src/commands/review/lib/agent-briefs.ts b/packages/cli/src/commands/review/lib/agent-briefs.ts
index 7092e06a45d..7c78088857c 100644
--- a/packages/cli/src/commands/review/lib/agent-briefs.ts
+++ b/packages/cli/src/commands/review/lib/agent-briefs.ts
@@ -703,6 +703,30 @@ until [ -s <plan dir>/mock.json ]; do sleep 0.1; done  # its port is in that rep
 
 For anything that is not one of those two wires — the project's own HTTP service, an MCP server, an OAuth endpoint — stand it up yourself and let \`drive\` own the lifecycle.
 
+**Address what the service BOUND, never what you asked it for.** A port is a request, not a fact: handed a taken one, \`qwen serve\` prints \`port 8931 is in use, trying 8932...\` and listens on the next. Keep addressing 8931 and every reading for the rest of the run comes from a **different, stale process** — the readiness probe passes against whatever is squatting there, the drive completes, and the whole thing looks exactly like a clean run. Measured: one full verification cycle spent on a daemon that was not the one under test.
+
+**The fix belongs in the SCRIPT; \`--capture\` only records it.** Captures are extracted after the drive has ended, so they cannot reach requests the script already made — and reading one as though they could is a WORSE failure than not capturing at all. A script that talks to 8931 while the service logs 8932 returns \`observed: true\` beside \`captured.baseUrl: …8932\` with nothing contradicting it, and a witness quoting that address attributes 8931's numbers to the daemon on 8932. So the script derives the address from the service's own output before its first request, and \`--capture\` corroborates that the address it used is the one the service printed.
+
+That needs the service's output in TWO places, and getting it into only one is the way this goes wrong: the script parses it, and the **drive log** must hold it too, because \`--capture\` reads nothing else. \`drive\` runs your script as \`bash <script> > <the drive log> 2>&1\`, so a service redirected to a file of its own is invisible to the capture — measured, that recipe returns \`captured.baseUrl: null\` on every faithful run while the service printed the address all along. Send it to a temp file the script can \`grep\`, then \`cat\` that file **before the first request**:
+
+\`\`\`bash
+"\${QWEN_CODE_CLI:-qwen}" review drive --cwd <the worktree> --timeout 300 \\
+  --capture 'baseUrl=listening on (https?://\\S+)' --out <plan dir>/drive.json \\
+  --script '
+    LOG=$(mktemp)
+    <start the service; --port 0 wherever it allows one> > "$LOG" 2>&1 &
+    until grep -q "listening on" "$LOG"; do sleep 0.2; done
+    BASE=$(sed -n "s|.*listening on \\(https\\{0,1\\}://[^ ]*\\).*|\\1|p" "$LOG" | head -1)
+    cat "$LOG"
+    curl -s "$BASE/<the endpoint the claim is about>"
+    rm -f "$LOG"
+  '
+\`\`\`
+
+Three details in that shape are load-bearing. \`mktemp\` rather than a file beside the code, because \`--cwd\` is the reviewed worktree and an untracked \`svc.log\` left there is inlined into the next capture of that tree as though the PR added it. \`cat\` **before** the request, because captures take the first match — so the service's own line wins over any response body that happens to contain one, and a status endpoint quoting its own banner cannot forge the address. And **no \`trap … EXIT\` of your own**: the wrapper this command puts around your script writes its completion sentinel from an EXIT trap, and yours replaces it — measured, a script with its own trap comes back \`timed-out\` with a null exit code having run perfectly.
+
+Bind ephemeral wherever the service allows it: an OS-assigned port cannot collide, so the fallback never fires and the only address in the log is the right one. **\`null\` means nothing was captured** — the pattern never matched, or its declared group did not participate — which is the report saying the value was never measured, not permission to fall back to the one on your command line. If the readiness \`grep\` never matches while the service is plainly up, suspect block-buffered stdout (C stdio and Python \`print()\` buffer once redirected to a file, Node does not): \`stdbuf -oL\` the service, or poll the port instead and take the address from a source that is not the log. Keep patterns linear — no nested quantifiers like \`(a+)+\`: extraction runs once the drive has ended, where no \`--timeout\` reaches, and one backtracking pattern hangs the whole run with no report written.
+
 **When the observable is an AGGREGATE, change the population rather than instrumenting the reader.** A total, a maximum across children, a count over a fleet — a claim about how one of those combines cannot be settled from a single reading, and the obvious repair (add a per-component dump and read that) costs the verdict its standing, because the numbers then come out of a build you edited. Shrink the contributing population instead: read the aggregate with every contributor live, remove exactly one — kill the process, unregister the workspace, drop the feed — and read it again. Both numbers come from unmodified code, and what they mean depends on the combining rule you are testing for: doubled with the population is a sum, flat is not a sum, and reducing the population to a single contributor makes the reading that contributor's own value outright. Only for a sum is the **difference** a contributor's value; under a maximum, removing a non-holder moves nothing and removing the holder exposes the next-largest. Identify what you removed by something the product did not choose for you — a process's own working directory, its port, its registered id — because removing the one you assumed answers a different question than the one asked.
 
 **When the claim is about GITHUB's behaviour, neither tree can settle it — only GitHub can.** A claim like "this encoding renders identically and can never ping", "GitHub strips this tag", "this markdown shape closes the fold" is about the comment pipeline's parser, sanitizer allowlist and notification path, none of which exist in this environment — a local markdown library is a model of GitHub, and judging a sanitizer claim against a model of the authority is exactly the parser-divergence failure under review. Measured live: an \`@\` → \`&#64;\` defusal read as sound in every local trace, and GitHub's real renderer registered the mention and fired the notification. So: