diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 45c86435d1..32df8df657 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -9,7 +9,7 @@
     {
       "name": "doperpowers",
       "description": "Emerges by humans, Converges by Agent",
-      "version": "7.46.6",
+      "version": "7.47.0",
       "source": "./",
       "author": {
         "name": "SSFSKIM",
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 1740b2ff6f..bb1c6f1fd3 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "doperpowers",
   "description": "Emerges by humans, Converges by Agents",
-  "version": "7.46.6",
+  "version": "7.47.0",
   "author": {
     "name": "SSFSKIM",
     "email": "supremekim17@gmail.com"
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index d39031fe06..62e12ee4c3 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "doperpowers",
-  "version": "7.46.6",
+  "version": "7.47.0",
   "description": "A two-track software-development methodology for coding agents: a human-gated controlled track (brainstorm, plan, TDD, review, ship) plus an autonomous board loop for unattended, well-scoped work.",
   "author": {
     "name": "SSFSKIM",
diff --git a/docs/doperpowers/execplans/2026-08-11-requesting-review-split.md b/docs/doperpowers/execplans/2026-08-11-requesting-review-split.md
new file mode 100644
index 0000000000..a973f4c1de
--- /dev/null
+++ b/docs/doperpowers/execplans/2026-08-11-requesting-review-split.md
@@ -0,0 +1,161 @@
+# Split codex-companion: a `requesting-review` skill, runtime fail-closed, and a script-free reviewing-prs review step
+
+This ExecPlan is a living document. The sections `Progress`, `Surprises & Discoveries`, `Decision Log`, and `Outcomes & Retrospective` must be kept up to date as work proceeds. It is maintained in accordance with the vendored PLANS.md contract of the doperpowers:execplan skill (the PLANS.md file itself is not checked into this repository; this document is self-contained and does not depend on it).
+
+## Purpose / Big Picture
+
+Today, an agent that wants an independent code review must know about two different layers: the `doperpowers:codex-companion` skill (which documents five verbs of a vendored OpenAI Codex runtime — reviews, delegation, orchestration, job plumbing — in one place) and, inside the autonomous PR-review loop, a bash script (`skills/reviewing-prs/scripts/review-engine.sh`) that wraps the runtime and decides by a hard-coded numstat heuristic whether a diff is big enough to deserve a multi-reviewer panel instead of a single review. That script accreted real machinery: a JSON-flattening renderer, exit-code conventions, environment isolation, and a fail-closed grep for sandbox failures.
+
+After this change, three things are true that were not before:
+
+1. There is a new skill, `doperpowers:requesting-review`, that owns the whole *independent quality review* job: when to review, how to choose between a single native review, a steered adversarial review, and the multi-lens panel (judgment guidance with a stated default and its reason — not a script heuristic), the exact invocations, and how to read the results. Any agent — an interactive session, a dispatched review daemon, another skill — reads one skill and can request a review.
+2. The vendored runtime itself fails closed on sandbox failure: a review whose probing shell never worked errors out instead of rendering a hollow "clean" verdict. That guarantee used to exist only for callers who went through `review-engine.sh`; now every consumer has it.
+3. The reviewing-prs review worker routes by its own judgment following requesting-review's doctrine, invoking the runtime directly. `review-engine.sh`, `render-panel-findings.mjs`, and their test suite are deleted.
+
+To see it working: run the test suites listed in Validation, and (the merge gate) dispatch one live review worker at a big-diff PR and observe it start the panel — not a single review, not two reviews — purely from reading its protocol.
+
+## Progress
+
+- [x] (2026-08-10 16:40Z) Grill complete (brainstorming session); design approved; track = autonomous.
+- [x] (2026-08-10 16:55Z) ExecPlan authored and committed (b656b9de).
+- [x] (2026-08-10 17:25Z) Milestone 1: runtime fail-closed — lib/sandbox.mjs; engine.mjs leaves guard via assertSandboxUsable (terminal); review AND adversarial verb branches assert on result.stderr; with-effort.mjs guards its private server's piped stderr (exit 3) since the socket path hides stderr from the verb's client; CODEX_SANDBOX stands the guard down everywhere. Tests: engine-hooks sandbox cases rewritten (fail-closed + nested-OK), fake codex gained `sandbox-broken` behavior + `-c` tolerance, 4 new runtime.test.mjs cases — all green; full companion + workflow suites green.
+- [x] (2026-08-10 17:40Z) Milestone 2: skills/requesting-review/SKILL.md created; codex-companion SKILL.md verb list repointed; references/reviews.md deleted; workflows.md panel section → pointer.
+- [x] (2026-08-10 17:56Z) Milestone 3: review-engine.sh, render-panel-findings.mjs, test-review-engine.sh deleted; SKILL.md START ENGINE rewritten (worker routes per requesting-review; env preamble template; findings-rN.txt/.json; interrupted retries once); ENGINE FALLBACK covers sandbox rejection + twice-interrupted panel; dispatcher binds COMPANION_DIR (3 sites); bootstrap binding renamed; operation-manual rewritten; dispatch + entrypoint suites updated and green.
+- [x] (2026-08-10 18:10Z) Milestone 4: consumer repoints (execplan, subagent-driven-development, writing-plans, architecting) committed 214a496f; review-bench's codex path moved to the with-effort invocation; user-CLAUDE.md repoint flagged for the final report, not edited.
+- [x] (2026-08-10 18:40Z) Milestone 5: companion, workflow, dispatch, entrypoint, shell-lint suites all rc=0; residual grep clean (one intentional "is retired" note in review-bench); run-skill-tests.sh shows 6 pre-existing ARKHO_DIR-gated integration skips the runner counts as failures (unrelated to this branch — runner has no exit-77 accounting) plus one LLM-phrasing flake in the SDD test that passed on rerun. Version stays 7.46.0.
+- [x] (2026-08-10 22:10Z) Milestone 6 (merge gate): PASSED — worker `review-pr-55` (dispatched 18:20Z, auto-merge off) chose the panel from protocol reading alone on the 26-file diff and composed the documented invocation exactly; it then ran the FULL loop: 5 panel rounds, 5 waves, 21 graded commits pushed (d58d85a5→79a69dad), trail comment posted 21:34Z. Review commits pulled; origin/main merged (4 version-manifest conflicts only, resolved to main); version re-bumped 7.47.0 per the reviewer's staleness finding; PR #55 description rewritten; pushed.
+
+## Surprises & Discoveries
+
+- Observation (planning stage): the incident's sandbox markers ride the app-server child's *buffered stderr* (surfaced per turn as `result.stderr`), while the streamed progress lines also carry a truncated copy of the model's final answer — making progress a false-positive channel (a diff quoting a marker string, e.g. this repo's own tests, would trip a naive scan).
+  Evidence: `skills/codex-companion/runtime/scripts/lib/workflow/engine.mjs` lines 251–265 (the buffering comment), and `executeReviewRun` in `codex-companion.mjs` returning `result.stderr` verbatim on the native-review branch.
+- Observation (planning stage, CORRECTED at M1): I first noted the adversarial branch drops the turn's stderr — wrong on re-read: its payload carries `codex.stderr` (codex-companion.mjs line ~440). Both verb branches only needed the assert added.
+  Evidence: `payload.codex.stderr` present in both branches; M1 diff adds only the two `assertSandboxUsable` calls.
+- Observation (M1): the verb's default path and the with-effort path talk to the app-server over a socket, where the child's stderr never reaches the verb's client — `result.stderr` is populated only on the direct (dead-endpoint kill-switch) path. The guard therefore lives in THREE places: the workflow engine's leaves (disableBroker → direct), the verb branches (direct path), and with-effort.mjs itself, which pipes and scans its private server's stderr and exits 3 on a marker after a clean verb exit.
+  Evidence: first new runtime test failed with exit 0 until the kill-switch env was added; with-effort test passes end-to-end against the `sandbox-broken` fake.
+
+- Observation (M6 dogfood): the stderr-only scanning decision was validated LIVE, in the negative — a wave-4 fixer extended the guard to the workflow engine's throw path (error text), the very next panel round's scalpel-1 lane died because codex's command-policy rejection embedded model-authored text quoting this repo's own `RTM_NEWADDR` test fixtures, and the worker reverted it with cross-round evidence (rounds 1–4: 0 diagnostics, 0 lost lanes; round 5: 3 and 1). The throw path's error is a union of machine stderr and arbitrary server text (`app-server.mjs:314` vs `:165`) and can never be treated as machine-emitted.
+  Evidence: PR #55 trail comment ("The correction I have to lead with"), revert 79a69dad.
+- Observation (M6 dogfood): three seams produced findings in round after round — the guard's per-transport observation channels, engine-home cleanup, and template shell-safety. The trail names this a decomposition defect: the guard must observe a channel three transports expose differently, and patching call sites one at a time is what produced five rounds. A follow-up design pass should unify the observation channel. Deferred findings (broker-path guard gap, stderr snapshot races, unquoted template paths, inert `--background`) are LOGGED inline in the trail.
+  Evidence: trail "The pattern worth more than any single finding" + Deferred section.
+- Observation (M6 dogfood): behavior evidence for the skill rewrite — the dispatched worker followed the new protocol end to end with zero protocol errors attributable to the prose: correct route choice, correct env preamble, correct JSON reading at JOIN, interrupted-retry honored (round 3's first attempt was SIGTERMed and retried), observation-mode close. The 5-round loop also pressure-tested requesting-review's own text: 6 of the 20 wave fixes were to MY skill prose (promised-but-unset env var, `--out` flag that no longer exists, over-broad target-selection claim, missing CODEX_SANDBOX caveat, setup-verb contradiction, overstated interrupted conditions) — all caught by the panel reading the docs against the code.
+  Evidence: trail Waves 1–4 tables; commits 82793c52, 9c7a11bb, 548828a6, a831ba90, 034cb0ab, 8b81b162.
+
+## Decision Log
+
+- Decision: split codex-companion two ways (requesting-review + slimmed codex-companion), not three.
+  Rationale: `review`, `adversarial-review`, and the panel are one job — independent quality scrutiny of a diff — sharing target-selection flags and output contracts; a separate adversarial-review skill would have exactly two consumers and would split the shared plumbing doc. `task`/amigo is a genuinely different job (delegation/partnership). Named by job, not runtime, so the backing engine stays swappable. Rejected: three-way split (user's original sketch; declined by user after tradeoffs); no split (leaves the discoverability problem).
+  Date/Author: 2026-08-10, brainstorming session with human.
+- Decision: big-diff routing moves from `review-engine.sh` to the review worker's judgment, guided by requesting-review.
+  Rationale: human directive (golden rule: trust agent judgment; the pre-#55 failure was doctrine living in a doc workers never read, not judgment failing). The worker sees risk surfaces and diff character that a numstat heuristic cannot. Rejected: keep engine-internal routing (PR #55 as built — human explicitly chose against); engine survives as thin executor (once the guard moved into the runtime, nothing load-bearing remained in the script).
+  Date/Author: 2026-08-10, human via AskUserQuestion.
+- Decision: the fail-closed sandbox guard moves into the vendored runtime (workflow engine leaves AND the review/adversarial verb paths), exempted when `CODEX_SANDBOX` is set.
+  Rationale: a clean verdict from a reviewer whose shell was broken is garbage for every consumer, not just daemons; runtime-level failure protects interactive sessions that today have no guard, and lets the script layer retire. The `CODEX_SANDBOX` exemption carries over from the engine script: under an outer codex sandbox, probe confinement is expected and the degraded diff-only render is documented behavior. Rejected: guard stays script-side (leaves interactive consumers unguarded and blocks the retirement); protocol-level grep instructions (the incident was precisely that nobody looked).
+  Date/Author: 2026-08-10, human via AskUserQuestion.
+- Decision: the runtime guard scans ONLY the app-server child's buffered stderr (`result.stderr` / `turn.stderr`), never `reviewText`/final-message/progress channels; ANY marker hit fails the run (no multi-hit threshold).
+  Rationale: model-authored channels can quote marker strings innocently (this repo's own tests contain them), so scanning them manufactures false positives; the buffered stderr is machine-emitted. The incident showed markers on every probe, so a single-hit trigger loses nothing there, and a threshold would be an invented knob with no observed failure to calibrate against. This resolves the "sustained threshold" delegated unknown from the design.
+  Date/Author: 2026-08-11, ExecPlan author.
+- Decision: a marker-triggered leaf failure in the workflow engine is `terminal: true` (no transport retry).
+  Rationale: a host that blocks the sandbox (userns denied) does not heal between retries; the retry would spend a full review turn to reach the same failure. The panel's own composition then yields `interrupted` (lost lane), which is the correct verdict shape.
+  Date/Author: 2026-08-11, ExecPlan author.
+- Decision: version stays 7.46.0; same branch, same PR (#55), description rewritten.
+  Rationale: 7.46.0 was bumped on this branch and never released; the rework replaces unmerged work. Rejected: merge #55 first then follow-up (human chose same-branch rework — no interim merge of machinery about to be deleted).
+  Date/Author: 2026-08-10, human via AskUserQuestion.
+- Decision: the worker's per-round review environment preamble (temp `CODEX_HOME` + auth symlink, temp `CLAUDE_PLUGIN_DATA`, `SSL_CERT_FILE` bundle fallback, `CODEX_CODE_MODE_HOST_PATH` fallback) lives as an indented template inside reviewing-prs SKILL.md's START ENGINE step.
+  Rationale: it is daemon-environment knowledge (outer seatbelt makes `~/.codex` read-only; nested codex cannot reach trustd), not review doctrine — so it belongs to the loop's protocol, not to requesting-review, and a helper script would resurrect the layer being retired. Rejected: dispatcher-exported env (a resumed worker whose dispatcher is gone could not recreate it).
+  Date/Author: 2026-08-11, ExecPlan author.
+- Decision: skill/protocol prose is authored to the root-CLAUDE.md "Authoring agent behavior" standard and the repo golden rule — generalized principles with reasons, fewest hard gates, every line earning its place; incident citations stay only where they license a hard constraint (the fail-closed guard).
+  Rationale: explicit human directive at track handoff.
+  Date/Author: 2026-08-11, human.
+
+## Outcomes & Retrospective
+
+Completed 2026-08-10 ~22:20Z (calendar 2026-08-11 local). All six milestones landed. The review job now lives in one skill (`requesting-review`, 120 lines) that every consumer — interactive session, daemon worker, other skills — reads directly; the engine script layer (182-line engine + 74-line renderer + 384-line test suite) is deleted; the fail-closed sandbox guarantee moved to the runtime and got *stronger* (stderr-only scanning removed the quoted-marker false-positive class the old events-log grep carried — proven live when the dogfood's own wave briefly reintroduced the class and the next round caught it).
+
+The merge-gate dogfood exceeded its brief: the dispatched worker not only routed to the panel by protocol alone but ran the full 5-round/5-wave loop against this branch, contributing 21 graded commits — including 6 corrections to the new skill prose itself and a caught-and-reverted regression. That run IS the behavior evidence CLAUDE.md's skill-change bar asks for.
+
+Gaps, stated plainly: the "every consumer" fail-closed claim holds for the direct, wrapper, and workflow paths, NOT the broker path (unreachable via the documented contract but real — logged as a deferred P1); two stderr-timing races remain accepted-by-design; and the guard-channel-per-transport pattern is a decomposition defect deserving its own design pass (the trail's strongest recommendation). Lessons: (1) moving a guard from wrapper to source is what frees the wrapper's deletion; (2) a protocol template's env preamble must be carried over *verbatim with its reasons* — every line I paraphrased or dropped (CODE_MODE_HOST_PATH, cleanup trap, isolated bench env) came back as a finding; (3) the panel reviewing prose-against-code catches skill-doc lies a suite cannot.
+
+## Context and Orientation
+
+This repository (`doperpowers`) is a Claude Code plugin: a collection of *skills* — markdown protocol documents under `skills/<name>/SKILL.md` that agents load by name — plus supporting scripts and a vendored copy of OpenAI's Codex app-server client. Everything below is relative to the repository root (the git worktree you are in).
+
+Key parts:
+
+- `skills/codex-companion/` — the skill wrapping the vendored Codex runtime. `SKILL.md` lists verbs; `references/reviews.md` documents the `review` and `adversarial-review` verbs; `references/workflows.md` documents the `workflow` orchestration verb and its bundled code-review panel; `references/amigo.md` (the `task` verb) and `references/jobs.md` (backgrounding) stay untouched. The runtime lives in `runtime/scripts/` — entry point `codex-companion.mjs`, app-server client `lib/codex.mjs` and `lib/app-server.mjs`, workflow engine `lib/workflow/engine.mjs`. `scripts/with-effort.mjs` wraps a verb invocation with a private app-server carrying a reasoning-effort override. `workflows/code-review.mjs` is the bundled review panel (one lens-free sweep + up to five diff-derived scalpel lenses + one binding verifier; result `{verdict, findings, coverage, lenses, explanation}` where `verdict` ∈ `correct`/`incorrect`/`interrupted`).
+- `skills/reviewing-prs/` — the autonomous PR-review loop. `SKILL.md` is the pinned protocol a dispatched review daemon follows; `scripts/review-dispatch.sh` spawns workers and macro-expands `{{...}}` bindings into the protocol; `scripts/review-engine.sh` (TO BE DELETED) wraps the runtime; `scripts/render-panel-findings.mjs` (TO BE DELETED) flattens panel JSON to text; `references/operation-manual.md` and `references/runner-setup.md` are operator docs.
+- `tests/` — shell/node suites: `tests/codex-companion/` (runtime; `run-codex-companion-tests.sh` and `run-workflow-tests.sh` are the runners; `mock/codex` is a scenario-driven fake codex supporting a `stderrLine` behavior that writes a line to fd 2), `tests/reviewing-prs/` (`test-review-dispatch.sh`, `test-review-engine.sh` (TO BE DELETED), `test-skill-entrypoint.sh` which asserts protocol phrases — including that `IN THE BACKGROUND` appears contiguously in START ENGINE), `scripts/lint-shell.sh` (shellcheck baseline).
+- Version manifests are bumped ONLY via `scripts/bump-version.sh`; this branch already carries 7.46.0 and keeps it.
+
+Terms: a *sandbox-failure marker* is any of the three substrings `RTM_NEWADDR`, `shell is unavailable`, `fs sandbox helper failed` appearing in the Codex app-server child's stderr — the observed signature (ida-worker-1, 2026-08-09) of a host whose filesystem sandbox never worked while codex still exited 0 and rendered findings (22 consecutive false-clean runs). *Fail closed* means: on that signature, produce an error, never a verdict. `CODEX_SANDBOX` set in the environment means we are already nested under an outer codex sandbox, where probe confinement is expected — the guard stands down there.
+
+The current state to build from: PR #55's branch, where `review-engine.sh` contains the numstat panel routing (lines 123–157), `engine.mjs` lines 251–265 forward sandbox markers from buffered leaf stderr as `sandbox-diagnostic` events (emission only — no failure), and reviewing-prs SKILL.md's START ENGINE step tells the worker "Diff-size scaling is the ENGINE's, not yours".
+
+## Plan of Work
+
+Milestone 1 — runtime fail-closed. Create `skills/codex-companion/runtime/scripts/lib/sandbox.mjs` exporting the marker regex and `assertSandboxUsable(label, stderr, {onDiagnostic})`: scans buffered stderr line-by-line; every hit line is reported through `onDiagnostic` first (so journaling survives the throw); on a hit, when `process.env.CODEX_SANDBOX` is set report only, otherwise throw an Error naming the guard (`sandbox unavailable during <label>: <line> — findings would be untrustworthy`) carrying `terminal: true`. In `lib/workflow/engine.mjs`, replace the local `SANDBOX_FAILURE_MARKERS`/`emitSandboxDiagnostics` pair with the shared module: each leaf (agent turn, repair turn, review) calls the assert BEFORE `assertTurnUsable`, with `onDiagnostic` emitting the existing `sandbox-diagnostic <label>: <line>` journal event. In `codex-companion.mjs` `executeReviewRun`: the native-review branch asserts on `result.stderr` after `runAppServerReview`; the adversarial branch must first carry the turn's stderr into its result (it currently drops it), then assert the same way. The `task` verb is out of scope (delegation, not verdict-bearing). Tests: `tests/codex-companion/test-engine-hooks.mjs` — the existing sandbox-diag case now expects leaf FAILURE (and a `CODEX_SANDBOX=1` variant expects success with the diagnostic journaled); `tests/codex-companion/test-verb-e2e.sh` — a `stderrLine` marker scenario on `review` and on `adversarial-review` expects nonzero exit and the guard's message on stderr.
+
+Milestone 2 — the requesting-review skill. Create `skills/requesting-review/SKILL.md` (frontmatter name `requesting-review`; description states triggers only: requesting an independent code review, a second opinion, an adversarial challenge of a design or plan diff, or a multi-reviewer panel on a big diff). Body: the env-contract header mirrored from codex-companion with a change-both note; routing doctrine as judgment guidance (single native review is the default; at roughly 20+ files or a couple thousand changed lines one reviewer's recall thins — the PR752 benchmark: best single run found 10 of 13 confirmed defects, seven runs' union found all 13 — so run the panel; weight concentrated on declared risk surfaces can justify the panel below that size; `adversarial-review` when the question is the design, not defects); the three invocation shapes with sibling-path runtime references (`<skill-base>/../codex-companion/runtime/scripts/codex-companion.mjs`, `with-effort.mjs` for single-review effort, the panel via `workflow --script <skill-base>/../codex-companion/workflows/code-review.mjs`); the output-reading contract (findings stdout-only, `2>` an events log; panel stdout is one JSON object whose `result.verdict` of `interrupted` is an engine failure — retry once, then treat as outage; don't commit to the branch under review while a panel round runs). Slim codex-companion: delete `references/reviews.md`; in `SKILL.md`, replace the `review`/`adversarial-review` verb lines with one pointer line to `doperpowers:requesting-review` (the verbs still exist in the runtime; this skill just no longer documents driving them); in `references/workflows.md`, replace the bundled-panel section body with a pointer to requesting-review.
+
+Milestone 3 — reviewing-prs. Delete `scripts/review-engine.sh`, `scripts/render-panel-findings.mjs`, `tests/reviewing-prs/test-review-engine.sh`. In `scripts/review-dispatch.sh`, replace the `REVIEW_ENGINE` binding with `COMPANION_DIR` (absolute path `$SCRIPT_DIR/../../codex-companion`) at every prompt-build site (grep for `REVIEW_ENGINE`) and keep `CODEX_REVIEW_MODEL`/`CODEX_REVIEW_EFFORT` bindings. Rewrite SKILL.md's START ENGINE: step 2 keeps "the round's ONE review run IN THE BACKGROUND" (phrase `IN THE BACKGROUND` contiguous — test contract) but the worker first chooses the route by requesting-review's doctrine (the numbers and the risk-surface judgment live there; reviewing-prs states the ownership and points), then runs the chosen invocation from an indented command template: a per-round env preamble (mktemp CODEX_HOME with `auth.json` symlink, temp `CLAUDE_PLUGIN_DATA`, `SSL_CERT_FILE` bundle fallback, `CODEX_CODE_MODE_HOST_PATH` fallback — carried over verbatim from the deleted engine with their reasons) followed by either the `with-effort.mjs … review --base origin/{{BASE_REF}}` form writing `findings-rN.txt`, or the panel form writing `findings-rN.json` (raw workflow stdout). JOIN reads text or JSON accordingly; a panel `verdict` of `interrupted` retries once within the round before the ENGINE FALLBACK path. Remove every `CODEX_REVIEW_PANEL` and `CODEX_REVIEW_LENS` mention (lenses were engine plumbing; the worker never authored them). REVIEW TRAIL: panel rounds record the verdict line and lens/coverage summary from `findings-rN.json`. Update `references/operation-manual.md` (engine section → the worker drives requesting-review; pieces-table rows for the deleted scripts) and `references/runner-setup.md` if it names the engine. Update `tests/reviewing-prs/test-review-dispatch.sh` (engine-path assertions → COMPANION_DIR assertions) and `test-skill-entrypoint.sh` (drop engine-script phrase asserts, keep IN THE BACKGROUND, add a `requesting-review` pointer assert).
+
+Milestone 4 — consumers. In `skills/execplan/SKILL.md` (exit gate) and `skills/subagent-driven-development/SKILL.md` (reviewer step): "codex native review via doperpowers:codex-companion's `review` verb" → "an independent review via doperpowers:requesting-review". In `skills/writing-plans/SKILL.md` (plan review) and `skills/architecting/SKILL.md`: the adversarial-review call-sites likewise point at requesting-review (keeping model/effort specifics). `skills/brainstorming/SKILL.md` keeps its `task`-verb pointer to codex-companion untouched. Do NOT edit the user's global `~/.claude/CLAUDE.md`; flag its "Independent Reviews" section repoint in the final report.
+
+Milestone 5 — validation (commands below) and a residual-grep sweep: `grep -rn "review-engine\|render-panel-findings\|CODEX_REVIEW_PANEL\|references/reviews.md" skills/ tests/` must return nothing; `docs/doperpowers/{plans,specs,execplans}` history is allowed to mention them.
+
+Milestone 6 — merge gate. Dispatch one live review worker (via `review-dispatch.sh`, auto-merge OFF, against a real big-diff PR — this branch's own PR #55 diff qualifies) and observe from its transcript that START ENGINE chose the panel by protocol alone. Rewrite the PR #55 description to describe the split (not the retired engine routing). Push.
+
+## Concrete Steps
+
+All commands run from the repository root.
+
+Runtime and workflow suites:
+
+    tests/codex-companion/run-codex-companion-tests.sh
+    tests/codex-companion/run-workflow-tests.sh
+    node --test tests/codex-companion/test-engine-hooks.mjs
+    tests/codex-companion/test-verb-e2e.sh
+
+reviewing-prs suites (after Milestone 3):
+
+    tests/reviewing-prs/test-review-dispatch.sh
+    tests/reviewing-prs/test-skill-entrypoint.sh
+
+Shell lint:
+
+    scripts/lint-shell.sh
+
+Expected: every suite prints its pass count and exits 0; test-engine-hooks gains two case variants (marker → leaf fails terminally; marker under CODEX_SANDBOX=1 → leaf succeeds, diagnostic journaled); test-verb-e2e gains the review/adversarial marker cases (nonzero exit, guard message names the marker line).
+
+Dogfood (Milestone 6): dispatch per `references/operation-manual.md` against a PR whose diff exceeds ~20 files; watch the worker's transcript for a `workflow --script .../code-review.mjs` invocation in START ENGINE and a findings-rN.json read at JOIN.
+
+## Validation and Acceptance
+
+Acceptance is behavior: (1) a `tests/codex-companion/mock/codex` scenario with `stderrLine: "bwrap: loopback: Failed RTM_NEWADDR"` on a `review` verb run exits nonzero and prints the guard's named error — before this change it exits 0 and renders findings. (2) The same scenario with `CODEX_SANDBOX=1` in the environment exits 0 (degraded-but-documented nested behavior). (3) A workflow panel run whose sweep leaf sees the marker ends with `verdict: "interrupted"`, never `correct`. (4) `skills/requesting-review/SKILL.md` exists and `skills/codex-companion/references/reviews.md` does not. (5) A dispatched review worker's prompt (test-review-dispatch fixture output) binds `COMPANION_DIR` and no longer names `review-engine.sh`. (6) All suites in Concrete Steps green. (7) Live dogfood: one dispatched worker on a big diff starts the panel by protocol alone.
+
+## Idempotence and Recovery
+
+Every step is a git-tracked edit on branch `worktree-review-engine-panel-routing`; re-running an edit is a no-op or a visible conflict, and `git status` plus this Progress section recover the position after any interruption. Deletions are plain `git rm` — recoverable from history. The dogfood dispatch runs with auto-merge off (observation only) so the reviewed PR cannot be merged by the worker. Commit at every milestone boundary.
+
+## Artifacts and Notes
+
+Deleted-line budget for orientation: review-engine.sh (182 lines), render-panel-findings.mjs (~74), test-review-engine.sh (~384). The panel result contract, for JOIN's reader: stdout JSON `{runId, result: {verdict, findings: [{id, priority, title, file, lines, comment, sources}], coverage: [{finder, status}], lenses, explanation}, agents, durationMs}`.
+
+## Interfaces and Dependencies
+
+In `skills/codex-companion/runtime/scripts/lib/sandbox.mjs`, define and export:
+
+    export const SANDBOX_FAILURE_MARKERS = /RTM_NEWADDR|shell is unavailable|fs sandbox helper failed/;
+    export function sandboxFailureLines(stderr)      // string -> string[] (matching lines)
+    export function assertSandboxUsable(label, stderr, { onDiagnostic } = {})
+    // reports every hit line through onDiagnostic, then throws Error{terminal:true}
+    // unless process.env.CODEX_SANDBOX is set.
+
+Consumers: `lib/workflow/engine.mjs` (agent leaf, repair turn, review leaf — onDiagnostic emits `sandbox-diagnostic <label>: <line>`), `codex-companion.mjs` `executeReviewRun` (both branches; onDiagnostic writes to the progress stream). No other module changes its exports. The reviewing-prs protocol depends on: `{{COMPANION_DIR}}` (absolute path binding from review-dispatch.sh), `{{CODEX_REVIEW_MODEL}}`, `{{CODEX_REVIEW_EFFORT}}` — all dispatcher-provided; and on doperpowers:requesting-review for doctrine, which depends on the sibling directory layout `skills/requesting-review` ↔ `skills/codex-companion` (both installed from the same plugin, so the layout is guaranteed).
+
+## Revision Notes
+
+- 2026-08-11: Initial authoring after the brainstorming grill. The "sustained threshold" delegated unknown is resolved here (stderr-only scan, single-hit trigger — see Decision Log) rather than left to implementation, since the channel analysis that settles it was done during planning.
+- 2026-08-11 (M1): Corrected my own planning-stage claim about the adversarial branch's stderr (it was present all along); recorded the three-transport guard placement discovery (direct / wrapper / workflow — the broker path stays unguarded and undocumented-unreachable).
+- 2026-08-11 (M5): Milestone 5's residual-grep acceptance is satisfied substantively, not literally — one deliberate "is retired" comment in tests/review-bench and frozen artifacts under its results/ remain (also noted by the dogfood reviewer).
+- 2026-08-11 (M6, close): Dogfood observations recorded in Surprises; version decision superseded live (main released 7.46.x while this branch sat → merged main, re-bumped 7.47.0); Outcomes written. The reviewer's deferred P1/P2 findings live in the PR trail comment — the guard-channel unification is the named follow-up design pass.
diff --git a/infra/worker-host/README.md b/infra/worker-host/README.md
index e54c693b00..cd65c998c9 100644
--- a/infra/worker-host/README.md
+++ b/infra/worker-host/README.md
@@ -129,9 +129,11 @@ dogfood cell end-to-end on the VM and check, in order:
 
 1. `codex exec` smoke turn — auth.json accepted, Landlock sandbox active
    (kernel ≥5.13; Ubuntu 24.04 is 6.8).
-2. Nested-codex TLS — `SSL_CERT_FILE` resolves (`_codex_launch` and
-   `review-engine.sh` probe `/etc/ssl/certs/ca-certificates.crt` since
-   2026-07-12); a review-engine call from inside a worker completes.
+2. Nested-codex TLS — `SSL_CERT_FILE` resolves (`_codex_launch` and the
+   review worker's START ENGINE preamble in
+   `skills/reviewing-prs/SKILL.md` probe `/etc/ssl/certs/ca-certificates.crt`
+   since 2026-07-12); that preamble's review invocation, run from inside a
+   worker, completes.
 3. Board write under env `GH_TOKEN` — a `board-transition.sh` against a test
    issue; push from a worktree uses the remote-wired credential.
 4. Full cell: dispatch an implement worker on a toy ticket → PR → review
diff --git a/package.json b/package.json
index 1400fd248f..e3009f9cfc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "doperpowers",
-  "version": "7.46.6",
+  "version": "7.47.0",
   "description": "Doperpowers skills and runtime bootstrap for coding agents",
   "type": "module",
   "main": ".opencode/plugins/doperpowers.js",
diff --git a/skills/architecting/SKILL.md b/skills/architecting/SKILL.md
index 99e0bb623a..08b3f44c44 100644
--- a/skills/architecting/SKILL.md
+++ b/skills/architecting/SKILL.md
@@ -96,8 +96,8 @@ parks carry the quality machinery.
     dispatch doperpowers:critique on the matured design and debate to
     convergence; run the spec-review pass; then give the implementation
     plan the same independent review doperpowers:writing-plans
-    prescribes — doperpowers:codex-companion's `adversarial-review` verb
-    (model `gpt-5.6-sol`, effort `xhigh` via its with-effort wrapper) in
+    prescribes — doperpowers:requesting-review's adversarial review
+    (model `gpt-5.6-sol`, effort `xhigh` via the with-effort wrapper) in
     a background Bash, focused on whether the plan is complete,
     spec-aligned, well-decomposed, and buildable by an engineer with
     zero context. Evaluate its findings rather than accepting them
diff --git a/skills/codex-companion/SKILL.md b/skills/codex-companion/SKILL.md
index ee2ec46991..536ad6976e 100644
--- a/skills/codex-companion/SKILL.md
+++ b/skills/codex-companion/SKILL.md
@@ -48,12 +48,10 @@ land on stderr, so keep the file and check it only on a nonzero exit.
 
 Verbs, and where each is specified:
 
-- `review` — Codex's native code review of the working tree or a branch
-  (`--base <ref>`); non-steerable by design; reasoning effort is choosable
-  via the `scripts/with-effort.mjs` wrapper; big diffs (~20+ files) route
-  to the `workflow` code-review panel instead → references/reviews.md
-- `adversarial-review` — challenge review of design and assumptions;
-  trailing text is a lens, parallel lenses for big diffs → references/reviews.md
+- `review` / `adversarial-review` — the independent-review job, owned by
+  the sibling skill doperpowers:requesting-review: routing between a
+  single review, an adversarial challenge, and the big-diff code-review
+  panel, plus every invocation and output contract, live there
 - `task` — any prompt to a resumable Codex thread; one-shot delegation
   or a standing multi-turn partner (critique debates, steered execution);
   read-only unless `--write` → references/amigo.md
diff --git a/skills/codex-companion/references/reviews.md b/skills/codex-companion/references/reviews.md
deleted file mode 100644
index 0549852414..0000000000
--- a/skills/codex-companion/references/reviews.md
+++ /dev/null
@@ -1,82 +0,0 @@
-# Reviews: `review` and `adversarial-review`
-
-Both verbs run Codex's reviewer against local git state and print rendered
-findings (or an explicit no-findings result) to stdout. Both record a job
-(see references/jobs.md). Neither ever edits files.
-
-    CLAUDE_PLUGIN_DATA="$HOME/.claude/doperpowers/codex-companion" \
-    CODEX_COMPANION_SESSION_ID="$CLAUDE_CODE_SESSION_ID" \
-    CODEX_COMPANION_APP_SERVER_ENDPOINT="unix:$HOME/.claude/doperpowers/codex-companion/no-broker.sock" \
-      node "<skill-base>/runtime/scripts/codex-companion.mjs" review \
-      [--wait|--background] [--base <ref>] [--scope auto|working-tree|branch] [--model <m>] [--json] [--cwd <dir>]
-
-`adversarial-review` takes the same flags plus trailing positional focus
-text.
-
-Target selection (shared by both):
-
-- `--base <ref>` — branch review: the diff from `merge-base HEAD <ref>` to
-  HEAD. This is the form for "review this branch against main".
-- `--scope branch` — same, against the auto-detected default branch.
-- `--scope working-tree` — uncommitted work (staged + unstaged + untracked).
-- default (`auto`) — working-tree changes when present, otherwise the
-  branch against the detected default branch.
-
-Route by diff size: on a big diff — as a rule of thumb, 20+ files or a
-couple thousand changed lines — run the `workflow` verb's code-review
-panel instead of a single `review`; one reviewer's recall thins at that
-scale. Invocation and output contract: references/workflows.md. Expect
-~8 workers and ~20 minutes; smaller, focused diffs stay with plain
-`review`.
-
-`review` is Codex's native reviewer, deliberately non-steerable: it errors
-on focus text and on staged-only/unstaged-only scopes. `--model` takes a
-literal model name only ; review forwards the value un-normalized, so an 
-alias reaches the app-server as an unknown model. Left unset, the user's 
-codex `config.toml` decides.
-
-Reasoning effort: the review protocol has no effort field — a review runs
-at whatever `model_reasoning_effort` the serving app-server process was
-configured with (the user's global config.toml default). To choose it
-per-run, wrap the invocation in `<skill-base>/scripts/with-effort.mjs`,
-which serves the verb a private app-server started with the override:
-
-    CLAUDE_PLUGIN_DATA="$HOME/.claude/doperpowers/codex-companion" \
-    CODEX_COMPANION_SESSION_ID="$CLAUDE_CODE_SESSION_ID" \
-      node "<skill-base>/scripts/with-effort.mjs" --effort medium -- \
-      review --base main --wait
-
-Everything after `--` is ordinary verb arguments (works for
-`adversarial-review` too; `task` has a native `--effort` flag and doesn't
-need it). Repeatable `-c key=value` before `--` passes any other codex
-config override the same way. Don't set
-`CODEX_COMPANION_APP_SERVER_ENDPOINT` yourself on a wrapped run — the
-wrapper provides its own live endpoint, and its per-connection app-servers
-die with the run, so the broker kill-switch isn't needed there either.
-
-`adversarial-review` is the steerable challenge review: it questions the
-chosen design, tradeoffs, and hidden assumptions rather than only hunting
-defects. The trailing focus text is a lens, e.g.
-
-    … adversarial-review --base main challenge whether this caching and retry design is right
-    … adversarial-review --background look for race conditions and question the chosen approach
-
-For a multi-lens sweep of a big diff, launch several `adversarial-review`
-runs in parallel background Bash calls, one lens each. Concurrent runs may
-share one state root: every ledger writer takes the state lock, so parallel
-runs no longer drop each other's job records.
-
-Working-tree and adversarial reviews embed the contents of untracked
-files — following symlinks — into the review prompt before any sandbox
-applies. Don't run them on a checkout you don't trust.
-
-`--json` prints the structured result object instead of rendered text.
-
-Foreground (`--wait`) suits small diffs; anything multi-file belongs in a
-background Bash call (see references/jobs.md for the mechanics). Either
-way, add `2> <scratch>.events.log`: findings are stdout-only, and the
-redirect keeps the streamed per-command progress — and its truncated
-copy of the verdict — out of what you read back. On a wrapped run the
-same redirect also catches the private app-server's noise. If codex
-may be missing or unauthenticated, run the `setup` verb first — it
-diagnoses install and auth state.
diff --git a/skills/codex-companion/references/workflows.md b/skills/codex-companion/references/workflows.md
index bed28fda95..6b293197e3 100644
--- a/skills/codex-companion/references/workflows.md
+++ b/skills/codex-companion/references/workflows.md
@@ -52,28 +52,9 @@ was the last guard standing.
 ## The bundled code-review panel
 
 `<skill-base>/workflows/code-review.mjs` is a ready-made review workflow —
-the destination references/reviews.md routes big diffs to. One lens-free
-native sweep, up to five scalpel lenses a deriver reads off the diff, and
-one binding verifier over the merged candidate pool:
-
-    … workflow --script "<skill-base>/workflows/code-review.mjs" \
-      --args '{"base":"main"}' --cwd <repo> 2> <scratch>.events.log
-
-`base` is the only required arg. Optional: `lenses` (an array replacing the
-derived set), `finderModel`/`finderEffort` (default `gpt-5.6-sol`/`xhigh`),
-`verifierModel`/`verifierEffort` (default `gpt-5.6-sol`/`high`).
-
-The verb's stdout `result` is `{verdict, findings, coverage, lenses,
-explanation}`. `verdict` is `correct`, `incorrect`, or `interrupted`;
-`findings` carries only verifier-confirmed items —
-`{id, priority, title, file, lines, comment, sources}`, priority-sorted —
-so `incorrect` means confirmed defects, not raw candidates. `interrupted`
-means no verdict about this diff can be asserted: a lane was lost (sweep or
-verifier down, so a clean claim would be hollow) or the target moved — the
-panel pins `merge-base` AND `HEAD` at start and re-resolves both at
-assembly, so a commit landing on the reviewed branch mid-run withholds the
-verdict, with any findings attached as partial evidence. Don't commit to
-the branch under review while a round is in flight.
+one lens-free native sweep, up to five diff-derived scalpel lenses, and one
+binding verifier. When to run it, its invocation, and its result contract
+are owned by the sibling skill doperpowers:requesting-review.
 
 ## The script
 
@@ -124,7 +105,7 @@ Hooks:
 - `review({base, scope, model, effort, lens, label, cwd})` →
   `{reviewText, threadId, status}`. Target selection matches the `review` verb
   (`base`, or `scope` of `auto`/`working-tree`/`branch` — see
-  references/reviews.md). This is Codex's native reviewer, so `lens` is not a
+  doperpowers:requesting-review). This is Codex's native reviewer, so `lens` is not a
   prompt: it rides `developer_instructions` on that worker's private
   app-server, alongside the review protocol rather than replacing it. Keep a
   lens to at most two plain sentences; longer mandates compete with the
diff --git a/skills/codex-companion/runtime/scripts/codex-companion.mjs b/skills/codex-companion/runtime/scripts/codex-companion.mjs
index 5e8aea405d..83892ceda4 100644
--- a/skills/codex-companion/runtime/scripts/codex-companion.mjs
+++ b/skills/codex-companion/runtime/scripts/codex-companion.mjs
@@ -23,6 +23,7 @@ import {
     runAppServerTurn
   } from "./lib/codex.mjs";
 import { resolveClaudeSessionPath } from "./lib/claude-session-transfer.mjs";
+import { assertSandboxUsable } from "./lib/sandbox.mjs";
 import { readStdinIfPiped } from "./lib/fs.mjs";
 import { collectReviewContext, ensureGitRepository, resolveReviewTarget } from "./lib/git.mjs";
 import { pidInstanceVerified, processStartTime } from "./lib/pid.mjs";
@@ -379,6 +380,11 @@ async function executeReviewRun(request) {
       model: request.model,
       onProgress: request.onProgress
     });
+    // Fail closed BEFORE rendering: a review whose fs sandbox never worked
+    // renders hollow findings (see lib/sandbox.mjs for the observed incident).
+    assertSandboxUsable(reviewName, result.stderr, {
+      onDiagnostic: (line) => process.stderr.write(`[codex] sandbox-diagnostic: ${line}\n`)
+    });
     const payload = {
       review: reviewName,
       target,
@@ -422,6 +428,10 @@ async function executeReviewRun(request) {
     outputSchema: readOutputSchema(REVIEW_SCHEMA),
     onProgress: request.onProgress
   });
+  // Same fail-closed guard as the native branch: no verdict from a broken sandbox.
+  assertSandboxUsable(reviewName, result.stderr, {
+    onDiagnostic: (line) => process.stderr.write(`[codex] sandbox-diagnostic: ${line}\n`)
+  });
   const parsed = parseStructuredOutput(result.finalMessage, {
     status: result.status,
     failureMessage: result.error?.message ?? result.stderr
diff --git a/skills/codex-companion/runtime/scripts/lib/sandbox.mjs b/skills/codex-companion/runtime/scripts/lib/sandbox.mjs
new file mode 100644
index 0000000000..552492efcb
--- /dev/null
+++ b/skills/codex-companion/runtime/scripts/lib/sandbox.mjs
@@ -0,0 +1,34 @@
+// Fail-closed guard for the codex fs sandbox. Observed live (ida-worker-1,
+// 2026-08-09): a host that blocks unprivileged userns makes every probe fail
+// (`bwrap: loopback: Failed RTM_NEWADDR`), yet codex exits 0 and renders
+// findings anyway — 22 consecutive review runs passed as "clean". The
+// app-server child's buffered stderr is the machine-emitted trace of that
+// state, so its markers turn the run into a hard error instead of a verdict.
+// Only that channel is scanned: model-authored channels (final message,
+// review text, streamed progress) can quote marker strings innocently.
+export const SANDBOX_FAILURE_MARKERS = /RTM_NEWADDR|shell is unavailable|fs sandbox helper failed/;
+
+export function sandboxFailureLines(stderr) {
+  if (!stderr) return [];
+  return String(stderr).split("\n").filter((line) => SANDBOX_FAILURE_MARKERS.test(line));
+}
+
+// Reports every hit through onDiagnostic first (so journaling survives the
+// throw), then throws terminally — a blocked sandbox does not heal between
+// retries, so a transport retry would spend a full turn to fail identically.
+// Under an OUTER codex sandbox (CODEX_SANDBOX set) probe confinement is
+// expected and the degraded diff-only render is documented behavior: report
+// only, never throw.
+export function assertSandboxUsable(label, stderr, { onDiagnostic } = {}) {
+  const hits = sandboxFailureLines(stderr);
+  if (hits.length === 0) return;
+  for (const line of hits) onDiagnostic?.(line);
+  if (process.env.CODEX_SANDBOX) return;
+  throw Object.assign(
+    new Error(
+      `fs sandbox unavailable during ${label ?? "codex run"}: ${hits[0].trim()} — ` +
+      "findings would be untrustworthy; treat as an engine failure"
+    ),
+    { terminal: true }
+  );
+}
diff --git a/skills/codex-companion/runtime/scripts/lib/workflow/engine.mjs b/skills/codex-companion/runtime/scripts/lib/workflow/engine.mjs
index 56f53a0840..a31efa85df 100644
--- a/skills/codex-companion/runtime/scripts/lib/workflow/engine.mjs
+++ b/skills/codex-companion/runtime/scripts/lib/workflow/engine.mjs
@@ -7,6 +7,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { runAppServerTurn, runAppServerReview, parseStructuredOutput, resolveReviewTarget } from "../codex.mjs";
+import { assertSandboxUsable, sandboxFailureLines } from "../sandbox.mjs";
 import { processStartTime } from "../pid.mjs";
 import { validateSchema } from "./validate.mjs";
 import {
@@ -181,6 +182,18 @@ export async function runWorkflow(spec) {
           out = await attempt();
         } catch (e1) {
           if (e1?.terminal) throw e1;            // schema-repair exhaustion etc: NEVER a third attempt
+          // A dead app-server's protocol error carries the child's buffered
+          // stderr — forward sandbox markers from it too, or a dying worker's
+          // diagnostics never reach the consumers' fail-closed guards.
+          // Diagnostic ONLY, never guardSandbox: unlike the *.stderr sites, an
+          // error message is not exclusively the machine channel — a rejected
+          // request quotes back the command the model asked to run, so a leaf
+          // reviewing this repo can put a marker here by reading its own test
+          // fixtures. Observed 2026-08-11: a command-policy rejection quoting
+          // `bwrap: … RTM_NEWADDR` out of tests/codex-companion/ killed a live
+          // review lane whose sandbox was fine. Fail closed only where the text
+          // cannot be model-authored.
+          emitSandboxDiagnostics(label, String(e1?.message ?? e1));
           appendEvent(journalPath, { type: "retry", key, error: String(e1?.message ?? e1) });
           emit(`retry ${kind}:${label ?? ""}`);
           out = await attempt();                 // one automatic transport retry, fresh turn
@@ -189,6 +202,7 @@ export async function runWorkflow(spec) {
         emit(`done ${kind}:${label ?? ""}`);
         return out;
       } catch (err) {
+        emitSandboxDiagnostics(label, String(err?.message ?? err));
         appendEvent(journalPath, { type: "finished", key, error: String(err?.message ?? err) });
         emit(`fail ${kind}:${label ?? ""}`);
         throw err;
@@ -243,6 +257,22 @@ export async function runWorkflow(spec) {
       return { ...stamped, uncacheable: runNonce };
     };
 
+    // The app-server buffers its child's stderr and surfaces it only on a
+    // nonzero exit, but the observed fs-sandbox failure (bwrap RTM_NEWADDR —
+    // ida-worker-1, 2026-08-09) exits 0 and renders findings anyway. Every
+    // leaf therefore fails closed on that buffered stderr (lib/sandbox.mjs) —
+    // checked BEFORE the leaf's own success check, so a "successful" turn
+    // whose sandbox never worked becomes a terminal leaf failure instead of a
+    // false-clean result. In the panel that failure surfaces as a lost lane,
+    // i.e. an `interrupted` verdict, never `correct`.
+    const emitSandboxDiagnostics = (label, text) => {
+      for (const line of sandboxFailureLines(text)) emit(`sandbox-diagnostic ${label ?? ""}: ${line}`);
+    };
+    const guardSandbox = (label, stderr) =>
+      assertSandboxUsable(label, stderr, {
+        onDiagnostic: (line) => emit(`sandbox-diagnostic ${label ?? ""}: ${line}`)
+      });
+
     const hooks = {
       args: spec.args,
       log: (m) => { appendEvent(journalPath, { type: "log", message: String(m) }); emit(`log ${m}`); },
@@ -256,6 +286,7 @@ export async function runWorkflow(spec) {
             sandbox: "read-only", persistThread: true,
             outputSchema: opts.schema ?? null, connect
           });
+          guardSandbox(opts.label, turn.stderr);
           assertTurnUsable(turn, "agent turn");
           if (!opts.schema) {
             if (!turn.finalMessage?.trim()) throw new Error("agent turn returned no output");
@@ -270,6 +301,7 @@ export async function runWorkflow(spec) {
             model: opts.model, effort: opts.effort, sandbox: "read-only",
             outputSchema: opts.schema, connect
           });
+          guardSandbox(opts.label, repair.stderr);
           assertTurnUsable(repair, "schema repair turn");
           parsed = parseStructuredOutput(repair.finalMessage);
           errors = parsed.parseError ? [parsed.parseError] : validateSchema(parsed.parsed, opts.schema);
@@ -316,6 +348,7 @@ export async function runWorkflow(spec) {
             model: opts.model, target,
             connect: { disableBroker: true, configOverrides: overrides, onSpawn }
           });
+          guardSandbox(opts.label, res.stderr);
           assertTurnUsable(res, "review");
           if (!res.reviewText?.trim()) throw new Error("review returned no output");
           // review/start takes the SYMBOLIC target — it has no commit parameter —
diff --git a/skills/codex-companion/scripts/with-effort.mjs b/skills/codex-companion/scripts/with-effort.mjs
index d3c3663302..e7eefc5a27 100644
--- a/skills/codex-companion/scripts/with-effort.mjs
+++ b/skills/codex-companion/scripts/with-effort.mjs
@@ -21,6 +21,7 @@ import path from "node:path";
 import fs from "node:fs";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { SANDBOX_FAILURE_MARKERS } from "../runtime/scripts/lib/sandbox.mjs";
 
 const RUNTIME_ENTRY = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -65,11 +66,30 @@ const socketPath = path.join(os.tmpdir(), `codex-effort-${process.pid}.sock`);
 fs.rmSync(socketPath, { force: true });
 
 let connections = 0;
+// The private app-server's stderr is the only trace of the observed fs-sandbox
+// failure (bwrap RTM_NEWADDR: codex exits 0 and renders findings anyway — see
+// runtime/scripts/lib/sandbox.mjs). The verb's own client never sees a socket
+// server's stderr, so THIS process owns the fail-closed check on that channel:
+// forward the stream unchanged, and remember any marker line.
+let sandboxMarkerLine = null;
 const server = net.createServer((conn) => {
   connections += 1;
   const child = spawn("codex", codexArgs, {
     cwd: process.cwd(),
-    stdio: ["pipe", "pipe", "inherit"]
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  let pending = "";
+  child.stderr.on("data", (chunk) => {
+    process.stderr.write(chunk);
+    pending += chunk.toString();
+    const lines = pending.split("\n");
+    pending = lines.pop();
+    // The trailing fragment is scanned too: a marker can be the last thing the
+    // child ever writes, and the exit decision cannot wait for a newline that
+    // is not coming.
+    for (const line of [...lines, pending]) {
+      if (sandboxMarkerLine === null && SANDBOX_FAILURE_MARKERS.test(line)) sandboxMarkerLine = line;
+    }
   });
   conn.pipe(child.stdin);
   child.stdout.pipe(conn);
@@ -98,6 +118,16 @@ server.listen(socketPath, () => {
     }
     server.close();
     fs.rmSync(socketPath, { force: true });
+    // Fail closed: a clean verb exit over a broken sandbox is the false-clean
+    // incident shape. Under an OUTER codex sandbox (CODEX_SANDBOX) confinement
+    // is expected and the degraded render is documented behavior.
+    if (code === 0 && !signal && sandboxMarkerLine !== null && !process.env.CODEX_SANDBOX) {
+      console.error(
+        `with-effort: fs sandbox unavailable during the run: ${sandboxMarkerLine.trim()} — ` +
+        "findings would be untrustworthy; treat as an engine failure"
+      );
+      process.exit(3);
+    }
     process.exit(signal ? 1 : code ?? 1);
   });
 });
diff --git a/skills/execplan/SKILL.md b/skills/execplan/SKILL.md
index c8c66ace0e..d1c22561e5 100644
--- a/skills/execplan/SKILL.md
+++ b/skills/execplan/SKILL.md
@@ -36,4 +36,4 @@ This profile fits durable background daemons (doperpowers:orchestrating-daemons)
 
 ## Exit gate
 
-Exactly one, at the end. Before merging: dispatch the final whole-branch review to an external reviewer (codex native review via doperpowers:codex-companion's `review` verb with `--base <base-branch>`; a fresh Claude reviewer subagent if codex is unavailable), then finish with doperpowers:finishing-a-development-branch. Its retrospective step writes into the ExecPlan's own `Outcomes & Retrospective` section — the ExecPlan is this track's spec-equivalent.
+Exactly one, at the end. Before merging: dispatch the final whole-branch review to an external reviewer (an independent review via doperpowers:requesting-review with `--base <base-branch>`; a fresh Claude reviewer subagent if codex is unavailable), then finish with doperpowers:finishing-a-development-branch. Its retrospective step writes into the ExecPlan's own `Outcomes & Retrospective` section — the ExecPlan is this track's spec-equivalent.
diff --git a/skills/orchestrating-daemons/scripts/_codex_lib.sh b/skills/orchestrating-daemons/scripts/_codex_lib.sh
index 8a278edd8d..ad2a46cb0d 100755
--- a/skills/orchestrating-daemons/scripts/_codex_lib.sh
+++ b/skills/orchestrating-daemons/scripts/_codex_lib.sh
@@ -234,7 +234,7 @@ _codex_launch() {
       if [ -f "$_cert" ]; then export SSL_CERT_FILE="$_cert"; break; fi
     done
   fi
-  # A NESTED codex (e.g. review-engine.sh run by a codex worker) resolves
+  # A NESTED codex (e.g. a review run driven by a codex worker) resolves
   # its code-mode command host to /usr/local/bin (absent here) instead of
   # ~/.local/bin — export the explicit path so nested engine calls can run
   # commands. Only when unset and the host binary exists.
diff --git a/skills/requesting-review/SKILL.md b/skills/requesting-review/SKILL.md
new file mode 100644
index 0000000000..5336970dcc
--- /dev/null
+++ b/skills/requesting-review/SKILL.md
@@ -0,0 +1,120 @@
+---
+name: requesting-review
+description: Use when work needs an independent quality review — a second-opinion code review of a branch or working tree, an adversarial challenge of a design or plan diff, or a multi-reviewer panel on a big diff.
+---
+
+# Requesting a Review
+
+Independent review of local git state, served by the Codex runtime that the
+sibling doperpowers:codex-companion skill vendors. `<skill-base>` is THIS
+skill's base directory (printed when the skill loads); the runtime sits
+beside it at `<skill-base>/../codex-companion` — both install from the same
+plugin, so that layout is guaranteed. Every invocation carries the shared
+env contract (mirrored from codex-companion's SKILL.md — a change to either
+copy updates both):
+
+    CLAUDE_PLUGIN_DATA="$HOME/.claude/doperpowers/codex-companion" \
+    CODEX_COMPANION_SESSION_ID="$CLAUDE_CODE_SESSION_ID" \
+    CODEX_COMPANION_APP_SERVER_ENDPOINT="unix:$HOME/.claude/doperpowers/codex-companion/no-broker.sock" \
+      node "<skill-base>/../codex-companion/runtime/scripts/codex-companion.mjs" <verb> [flags…]
+
+`CLAUDE_PLUGIN_DATA` pins job state somewhere durable; the session id scopes
+job reads to this session; the dead endpoint forces the per-call app-server
+path so nothing detaches and outlives the run. The `workflow` verb ignores
+the endpoint (its workers always spawn their own servers) — carrying it is
+harmless. On a wrapped run (`with-effort.mjs` below) leave the endpoint OFF:
+the wrapper provides its own live one. Leave it off `setup` too — that
+verb's auth probe has no direct fallback, so a dead endpoint makes it
+misreport a valid login as unauthenticated.
+
+## Choosing the shape
+
+Three shapes, chosen by what the review is for:
+
+- **Single native review** — the default for a focused diff. Codex's native
+  reviewer, deliberately non-steerable: it errors on focus text.
+- **The code-review panel** — for a big diff: as a rule of thumb, 20+ files
+  or a couple thousand changed lines. One reviewer's recall thins at that
+  scale — on the PR752 benchmark (22 files, +2,101 lines) the best single
+  run found 10 of 13 confirmed defects while seven runs' union found all
+  13 — so the panel runs one lens-free sweep, up to five scalpel lenses a
+  deriver reads off the diff, and one binding verifier over the merged
+  pool. Expect ~8 workers and ~20 minutes. A smaller diff whose weight
+  concentrates on ground you consider high-stakes (declared risk surfaces,
+  auth, money, data deletion) can be worth the panel too — the threshold
+  is a default, not a gate.
+- **Adversarial review** — when the question is the design rather than
+  defects: it challenges the chosen approach, tradeoffs, and hidden
+  assumptions. Trailing positional text is its focus lens, e.g.
+  `… adversarial-review --base main challenge whether this caching design is right`.
+
+Target selection (`review` and `adversarial-review`): `--base <ref>` reviews the diff from
+`merge-base HEAD <ref>` to HEAD — the form for "review this branch against
+main". `--scope working-tree` reviews uncommitted work; `--scope branch`
+uses the auto-detected default branch; the default (`auto`) is working-tree
+changes when present, otherwise the branch.
+
+## Single and adversarial invocations
+
+    … codex-companion.mjs review [--wait|--background] [--base <ref>] [--scope auto|working-tree|branch] [--model <m>] [--json] [--cwd <dir>]
+
+`adversarial-review` takes the same flags plus the trailing focus text.
+`--model` is a literal model name, forwarded un-normalized; unset, the
+user's codex config.toml decides. The review protocol has no effort field —
+to choose reasoning effort per run, wrap the invocation in
+`<skill-base>/../codex-companion/scripts/with-effort.mjs`, which serves the
+verb a private app-server carrying the override:
+
+    CLAUDE_PLUGIN_DATA="$HOME/.claude/doperpowers/codex-companion" \
+    CODEX_COMPANION_SESSION_ID="$CLAUDE_CODE_SESSION_ID" \
+      node "<skill-base>/../codex-companion/scripts/with-effort.mjs" --effort xhigh -- \
+      review --base main --wait
+
+Everything after `--` is ordinary verb arguments; repeatable `-c key=value`
+before `--` passes any other codex config override.
+
+Findings are stdout-only; stderr streams per-command progress that dwarfs
+the verdict, so always redirect it (`2> <scratch>.events.log`) and read
+stdout. Keep the file: errors land there, checked on a nonzero exit. The
+runtime fails closed when the reviewer's own fs sandbox was broken during
+the run (a hollow "clean" is worse than no verdict) — that surfaces as a
+nonzero exit naming the sandbox, and retrying it is pointless until the
+host is fixed. One exception: nested under an outer codex sandbox
+(`CODEX_SANDBOX` set) the guard stands down — the run exits zero and the
+broken sandbox shows up only as a diagnostic in the events log, so a
+nested run's clean verdict is only as good as that log. Foreground `--wait` suits small diffs; anything multi-file
+belongs in a background Bash call. Working-tree and adversarial reviews
+embed untracked-file contents (following symlinks) into the prompt — don't
+run them on a checkout you don't trust. If codex may be missing or
+unauthenticated, the `setup` verb diagnoses both.
+
+## The panel invocation
+
+    … codex-companion.mjs workflow \
+      --script "<skill-base>/../codex-companion/workflows/code-review.mjs" \
+      --args '{"base":"origin/main"}' [--cwd <repo>] 2> <scratch>.events.log
+
+`base` is the only required arg, and it is the panel's whole target: every
+finder reviews `merge-base(HEAD, base)`…HEAD, so uncommitted work is outside
+a panel round — there is no scope selection here. Optional args: `lenses` (an array replacing
+the derived set), `finderModel`/`finderEffort` (default `gpt-5.6-sol`/`xhigh`),
+`verifierModel`/`verifierEffort` (default `gpt-5.6-sol`/`high`). It is ONE
+foreground process — run it in a background Bash call and keep the handle.
+
+Stdout is exactly one JSON object `{runId, result, agents, durationMs}`;
+`result` is `{verdict, findings, coverage, lenses, explanation}`. `verdict`
+`correct`/`incorrect` is the panel's answer — `findings` carries only
+verifier-confirmed items (`{id, priority, title, file, lines, comment,
+sources}`, priority-sorted), so `incorrect` means confirmed defects.
+`interrupted` means no verdict can be asserted: the reviewed head moved
+mid-run (the panel pins merge-base AND HEAD at start and re-resolves at
+assembly), the lens-free sweep died, or a lost lane would otherwise have
+made the answer `correct` — a clean claim needs complete coverage. A lost
+LENS lane does NOT overturn `incorrect`: the confirmed defects stand, and the
+incomplete coverage shows up as a `; coverage partial: <lanes>` suffix on
+`explanation` and in `coverage`, whose per-lane rows carry a `status` of
+`ok`, `dead`, or `extraction-failed`. Treat `interrupted` as an engine
+failure: retry once, then treat the round as an outage. Don't commit to the branch
+under review while a panel round is in flight — that is what moves the
+head. `watch <run-id>` (same runtime) renders live progress from any
+terminal.
diff --git a/skills/reviewing-prs/SKILL.md b/skills/reviewing-prs/SKILL.md
index 214153b968..bcfdd33cfb 100644
--- a/skills/reviewing-prs/SKILL.md
+++ b/skills/reviewing-prs/SKILL.md
@@ -133,10 +133,10 @@ its own.
 
 ## START ENGINE
 
-REVIEW ENGINE — the native codex review engine (the
-doperpowers:codex-companion runtime, driven through {{REVIEW_ENGINE}}),
-run as a PURE correctness review: it receives no ticket or spec input of
-any kind.
+REVIEW ENGINE — the native codex review runtime (the
+doperpowers:codex-companion runtime at {{COMPANION_DIR}}, driven per
+doperpowers:requesting-review), run as a PURE correctness review: it
+receives no ticket or spec input of any kind.
 Ticket/spec compliance is YOUR audit, not the engine's. The engine call
 is a TOOL invocation, not a nested agent. Never add
 --dangerously-bypass-approvals-and-sandbox / --yolo to anything.
@@ -145,61 +145,91 @@ is a TOOL invocation, not a nested agent. Never add
    once. Treat the returned path as `<review-tmp>` for this invocation and
    remove that directory before ending the turn —
    EXCEPT a needs-human park: wave boards live there and the resumed
-   turn reads them.
-2. Judge the diff shape and choose this round's engine-run count — most
-   PRs need exactly ONE run; a substantial diff may warrant 2–3 parallel
-   runs, whole-branch scale up to 4. From the worktree root, start each
-   run IN THE BACKGROUND (round N, run k uses findings-rN-k.txt; the
-   empty lens assignments are deliberate — they shield the plain run
-   from any inherited host value):
-
-   CODEX_REVIEW_MODEL={{CODEX_REVIEW_MODEL}} \
-   CODEX_REVIEW_EFFORT={{CODEX_REVIEW_EFFORT}} \
-   CODEX_REVIEW_LENS= CODEX_REVIEW_LENS_FILE= \
-     {{REVIEW_ENGINE}} --base origin/{{BASE_REF}} \
-     --out <review-tmp>/findings-r1-1.txt
-
-   A single run takes no lens. When fanning out, keep one run lens-free
-   as the broad sweep and give each other run a LENS: a structural focus
-   mandate you derive from the diff itself (e.g. actor/authz assumptions
-   in the changed routes; ordering/atomicity of the new writes;
-   consumers of a changed field) — never ticket/spec content. The repo's
-   risk-surface manifest (in your dispatch prompt) marks validated hot
-   paths: a diff touching one is a strong lens candidate. Write each
-   mandate to `<review-tmp>/lens-<k>.txt` with your file-writing tool
-   and set `CODEX_REVIEW_LENS_FILE=<review-tmp>/lens-<k>.txt` on that
-   run's command — never inline the mandate text into a shell command
-   (it is generated prose; interpolation is an injection surface). A
-   lensed run narrows hard — a scalpel beside the sweep, not a second
-   sweep; it runs the engine's challenge-review rubric along the lens,
-   so its findings may question structure and assumptions, not only
-   defects — triage them with the same judgment. Use your harness's background execution for these commands and
-   keep the task handles. Leave them running and the findings unread —
-   the protocol's COMPLIANCE AUDIT runs while the engine reviews, and
-   its JOIN step is the only place engine output is read.
-3. At JOIN: wait for all of the round's background tasks. Bound the
-   wait — an engine task that has neither completed nor failed
-   45 minutes after start is hung: kill it. The lens-free sweep is the
-   round's required whole-range review: if IT failed, the round failed
-   (the fallback below owns retries and the outage path) — only lensed
-   runs' failures are tolerable. When the sweep succeeded, proceed on
-   the successful outputs and record any failed lensed runs in the
-   review trail.
-4. Read the findings file(s) — the round's findings are their union;
-   overlapping findings collapse into one triaged item (keep the
-   highest-priority duplicate as the anchor).
-   Correctness review of the whole range is the engine's job; your own
-   reading serves the audit and the triage, not a second review.
+   turn reads them. A park preserves the boards, never engine state, so
+   `rm -rf <review-tmp>/codex-home.*` runs on every exit including a
+   park — nothing after JOIN reads the engine home, and it holds a
+   symlink to the real `auth.json`.
+2. Choose the round's route — YOUR judgment, by
+   doperpowers:requesting-review's doctrine: a single native review by
+   default; the code-review panel on a big diff (~20+ files or a couple
+   thousand changed lines, where one reviewer's recall thins) or on a
+   smaller diff whose weight concentrates on declared risk surfaces
+   (your dispatch manifest). A panel round runs ~8 workers and can take
+   ~20 minutes. Then, from the worktree root, start the round's ONE
+   review run IN THE BACKGROUND (round N writes findings-rN.*). Both
+   forms share the preamble: codex must WRITE session state, the
+   worker's default home may be read-only under the outer sandbox, and
+   that state must stay out of the reviewed tree — so it goes to a
+   throwaway home INSIDE `<review-tmp>`, with login symlinked over
+   (step 1's removal is then the only cleanup this state needs, and it
+   reclaims every round's home even when a run dies early or you kill a
+   hung one); a nested codex also needs
+   TLS trust anchors as a FILE bundle and an explicit code-mode host
+   path (it resolves that command host to /usr/local/bin, not
+   ~/.local/bin, so it must be pointed at the real one).
+
+   eng_home="$(mktemp -d "<review-tmp>/codex-home.XXXXXX")" && \
+   { [ ! -f "${CODEX_HOME:-$HOME/.codex}/auth.json" ] || ln -s "${CODEX_HOME:-$HOME/.codex}/auth.json" "$eng_home/auth.json"; } && \
+   export CODEX_HOME="$eng_home" CLAUDE_PLUGIN_DATA="$eng_home/companion-state" && \
+   { [ -n "${SSL_CERT_FILE:-}" ] || { [ -f /etc/ssl/cert.pem ] && export SSL_CERT_FILE=/etc/ssl/cert.pem; } || { [ -f /etc/ssl/certs/ca-certificates.crt ] && export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt; } || true; } && \
+   { [ -n "${CODEX_CODE_MODE_HOST_PATH:-}" ] || { [ -x "$HOME/.local/bin/codex-code-mode-host" ] && export CODEX_CODE_MODE_HOST_PATH="$HOME/.local/bin/codex-code-mode-host"; } || true; } && \
+   <ONE of the two commands below>
+
+   Single review:
+
+   node {{COMPANION_DIR}}/scripts/with-effort.mjs \
+     --effort {{CODEX_REVIEW_EFFORT}} -- \
+     review --base origin/{{BASE_REF}} --wait --model {{CODEX_REVIEW_MODEL}} \
+     > <review-tmp>/findings-rN.txt 2> <review-tmp>/findings-rN.events.log
+
+   Panel:
+
+   node {{COMPANION_DIR}}/runtime/scripts/codex-companion.mjs workflow \
+     --script {{COMPANION_DIR}}/workflows/code-review.mjs \
+     --args '{"base":"origin/{{BASE_REF}}","finderModel":"{{CODEX_REVIEW_MODEL}}","finderEffort":"{{CODEX_REVIEW_EFFORT}}","verifierModel":"{{CODEX_REVIEW_MODEL}}"}' \
+     > <review-tmp>/findings-rN.json 2> <review-tmp>/findings-rN.events.log
+
+   `{{BASE_REF}}` reached these commands as a branch NAME rendered into a
+   shell word (the panel's is inside a single-quoted JSON blob), and git
+   accepts refs carrying a quote, `$`, or a backtick — such a ref is
+   shell syntax here, not a ref, and this loop runs unattended. Run
+   nothing until the rendered ref is plain (letters, digits, `.`, `_`,
+   `/`, `-`); anything else is the same hard stop as a base that will not
+   fetch — park needs-human naming the ref.
+
+   Keep the task handle. Leave it running and the findings unread — the
+   protocol's COMPLIANCE AUDIT runs while the engine reviews, and its
+   JOIN step is the only place engine output is read.
+3. At JOIN: wait for the round's background task. Bound the wait — an
+   engine task that has neither completed nor failed 45 minutes after
+   start is hung: kill it. If the run failed, the round failed (the
+   fallback below owns retries and the outage path).
+4. Read the findings. A single review's findings-rN.txt is rendered
+   text. A panel's findings-rN.json is one JSON object: read
+   `.result.verdict` and `.result.findings` (verifier-confirmed only,
+   priority-sorted) plus `.result.coverage` for the trail. A verdict of
+   `interrupted` is an engine failure, not a judgment about the diff —
+   retry the panel once with fresh output files; a second interruption
+   fails the round. An interrupted attempt still carries any confirmed
+   findings it reached, and they remain this round's evidence: carry
+   them into TRIAGE alongside the retry's. Correctness review of the
+   whole range is the engine's job; your own reading serves the audit
+   and the triage, not a second review.
 
 The verdict is YOURS, derived from the findings: approve when no
-critical/high finding remains unresolved; needs-attention otherwise. On
-RE-REVIEW rounds the same run-count judgment applies — after a small fix
-wave a single plain run is the norm — with fresh --out files, again in
-the background.
+critical/high finding remains unresolved; needs-attention otherwise.
+RE-REVIEW rounds repeat the route judgment and run a fresh command with
+fresh output files, again in the background.
 
 ENGINE FALLBACK — there is no second engine; the reviewer is codex-only.
-If the engine script fails (codex missing — rc 127, auth failure, or
-API errors), retry twice with a short backoff. Still failing:
+If the run fails — codex missing, auth failure, API errors — retry twice
+with a short backoff. Two kinds of failure skip that budget and take the outage
+path below on first occurrence: the runtime's sandbox-unavailable
+rejection, terminal by construction because a blocked sandbox does not
+heal between attempts and only the host can fix it; and a panel round
+whose step 4 retry failed at all, interrupted again or otherwise — it
+has already spent step 4's retry, at ~8 workers and ~20 minutes a round.
+Still failing:
 - post the review-trail comment recording the outage ("engine
   unavailable: <error>");
 - touch NO board state — the ticket stays in-review. An infra outage is
@@ -295,11 +325,10 @@ itself a finding.
 
 ## JOIN
 
-Wait for ALL of the round's background engine tasks per the engine
-block's bound; a failed lens-free sweep fails the round (the fallback
-block owns retries and the outage path — lensed-run failures alone do
-not). Read every successful run's compact findings file — the round's
-findings are their union — and your already-written audit together.
+Wait for the round's background engine task per the engine block's
+bound; a failed run fails the round (the fallback block owns retries
+and the outage path). Read the round's compact findings file and your
+already-written audit together.
 From here on, command-backed evidence checks may run whenever nothing
 else holds the worktree — never while an engine round or a fixer wave
 is live.
@@ -356,9 +385,9 @@ Maximum 4 waves per review.
 
 ## RE-REVIEW
 
-After a wave that fixed anything, rerun the engine — same run-count
-judgment (a single plain run is the norm after a small wave), fresh
---out files, in the background again; max 5 engine rounds total. The
+After a wave that fixed anything, rerun the engine — the round's one
+command again, redirected to fresh round-numbered findings files, in
+the background again; max 5 engine rounds total. The
 engine is stateless: it WILL re-flag findings you already routed. Match
 re-flags by file and substance against your tech-debt comments and wave
 dispositions (line numbers shift after fixes). A match against a LOGGED
@@ -428,8 +457,9 @@ end your turn with the park intact.
 
 A `review-epic-<n>` dispatch is the E2 scale review: the ticket is an
 EPIC in in-review whose `pr:` meta is a closure package, not a PR (your
-`CLOSURE_PACKAGE` binding names it). Same engine machinery — whole-range
-codex runs, lenses derived from the cross-child contracts: your worktree
+`CLOSURE_PACKAGE` binding names it). Same engine machinery — a
+whole-range codex run per range (an epic-scale diff warrants the panel
+by size, judged as any diff is): your worktree
 sits at the epic's integration branch and START ENGINE's
 `--base origin/{{BASE_REF}}` reviews it against the branch it merges
 into. When your dispatch prompt instead says this epic has NO aggregate
@@ -507,8 +537,9 @@ what the contract permits separately from what the evidence shows actually ran.
 ## REVIEW TRAIL
 
 The review-trail comment on the PR records: engine and rounds run — for
-a fan-out round, every run (its lens mandate verbatim, or lens-free) with
-the findings it contributed, written BEFORE `<review-tmp>` cleanup; the
+a panel round, the panel's verdict line and its lens/coverage summary
+(from findings-rN.json's `.result`), written BEFORE
+`<review-tmp>` cleanup; the
 compliance-audit verdict with every AUDIT NOTE; every finding with its
 bin and a one-line disposition; each wave with its per-item board
 outcomes; deferred findings inline when the tech-debt issue is "none";
@@ -516,7 +547,8 @@ secondary linked issues if any; and the tier judgment with the rubric
 clauses it satisfied. A scale run has no PR to post it on: its trail goes
 on the EPIC ISSUE, the same thread its closure package lives in.
 
-Cleanup: a needs-human park preserves `<review-tmp>` and the dispatcher control
+Cleanup: a needs-human park preserves `<review-tmp>` (minus the engine homes
+step 1 removes on every exit) and the dispatcher control
 directory (parent of `{{BIND_READY_FILE}}`) for resume. Any non-park terminal
 outcome removes both after the trail is posted; never leave the accepted ledger
 behind when no reviewer will resume it.
diff --git a/skills/reviewing-prs/references/operation-manual.md b/skills/reviewing-prs/references/operation-manual.md
index bbac19a454..48e1c27d86 100644
--- a/skills/reviewing-prs/references/operation-manual.md
+++ b/skills/reviewing-prs/references/operation-manual.md
@@ -6,9 +6,9 @@ The inverse-symmetric counterpart of the implementing daemon: where a worker
 turns a ticket into a PR, a **review worker** turns a PR into a confident
 merge. Every non-draft PR opened in an adopting repo gets a fresh-context
 background daemon (`orchestrating-daemons`) that runs TWO review tracks at
-once: the native Codex engine (the doperpowers:codex-companion runtime via
-review-engine.sh, in the background) reviews pure code correctness, while
-the worker itself audits
+once: the native Codex engine (the doperpowers:codex-companion runtime,
+invoked per doperpowers:requesting-review in the background) reviews pure
+code correctness, while the worker itself audits
 implementer protocol/spec compliance against the linked ticket. The worker
 never fixes anything: it triages the joined findings on its own judgment
 (the engine's native severity is the starting rank),
@@ -27,7 +27,7 @@ Full design + rationale: `docs/doperpowers/specs/2026-07-08-pr-review-loop-desig
 | piece | what |
 |---|---|
 | `scripts/review-dispatch.sh <pr#> \| --sweep` | mechanical trigger: dedupe → PR + ticket context → detached worktree at the PR head SHA → spawn a `review-pr-<n>` daemon (`daemon-spawn.sh --no-wait`; default route is plain Claude models, `engine:codex` opts into the clodex gateway settings) → exclusively bind it to the primary ticket under the registry lock → complete a dispatcher-ready / worker-ack startup barrier so `board-answer.sh` reaches the parked reviewer and no review action races binding |
-| `scripts/review-engine.sh` | the ONE native-review invocation, pure correctness: `--base` + `--out`, env recipe only — no ticket/spec input of any kind. Drives the doperpowers:codex-companion runtime (per-run effort via its with-effort wrapper). The worker may run it 1–4× in parallel per round (its judgment, by diff scale); extra runs carry `CODEX_REVIEW_LENS` — a diff-derived structural focus mandate that routes the run through the `adversarial-review` verb as its focus text |
+| the review runtime | one review run per round, pure correctness — no ticket/spec input of any kind. The worker drives the doperpowers:codex-companion runtime directly, following doperpowers:requesting-review: a single native review (per-run effort via the with-effort wrapper) by default, the companion's code-review panel (sweep + diff-derived scalpel lenses + binding verifier) on a big or risk-concentrated diff — the route is the worker's judgment. The runtime itself fails closed on a broken fs sandbox |
 | `SKILL.md` | the Review Worker Protocol — invoked by every review worker; the dispatch bootstrap supplies its `{{PLACEHOLDERS}}` as runtime bindings. The engine-start and engine-fallback text live in its START ENGINE section; the worker reads PR and ticket bodies live via gh (only the BASE-ref manifest snapshots ride the prompt) |
 | `references/wave-board.md` | runtime-opened fix-wave companion: board-file schema, the fixer's verify-then-fix contract, disposition grading |
 | `references/pr-review-dispatch.yml` | GH workflow template: PR events → self-hosted runner → dispatch script. No checkout, no token permissions |
@@ -77,9 +77,10 @@ human to merge" state.
 **Risk surfaces feed scrutiny, not a merge gate.** A repo may declare
 concrete hot paths in an optional `.doperpowers/risk-surfaces.md` — a
 plain list of globs and prose path/content rules the worker reads against
-the diff; a diff touching one is a strong lens candidate for the engine
-fan-out. The dispatch layer injects it from the PR's **base ref, never
-HEAD**, so a PR cannot delist a surface it touches in the same commit.
+the diff; a diff touching one earns the worker's sharpest audit and
+triage attention. The dispatch layer injects it from the PR's **base ref,
+never HEAD**, so a PR cannot delist a surface it touches in the same
+commit.
 
 **Repo facts feed the cross-check.** The optional
 `.doperpowers/repo-facts.md` manifest (format: doperpowers:implementing)
@@ -126,23 +127,23 @@ produce evidence, the review side verifies the claims were real.
 ## Review engine (pure correctness) + worker audit (compliance)
 
 Review responsibility is split between two concurrent tracks with one owner
-each. The ENGINE — the native codex review run by
-`scripts/review-engine.sh` through the doperpowers:codex-companion runtime
-(plain run = the non-steerable `review` verb; lensed run = the
-`adversarial-review` verb with the lens as focus) — receives no ticket,
-spec, or policy input of
-any kind: coupling spec policy into the native reviewer measurably weakened
-its correctness review, so the interface is `--base` + `--out` plus the
-optional `CODEX_REVIEW_LENS` env — a structural focus mandate the worker
-derives from the diff itself (never from the ticket/spec) when it fans out
-to 2–4 parallel runs on a large diff; a bench-validated lens recovered a
-confirmed authz defect two plain runs had missed
-(`tests/review-bench/results/2026-07-28-pr752-lenscell/`). The worker
-starts the round's runs in the background, and each returns a compact
-structured verdict file; the PR diff never enters the worker's own
-context. A hung engine (no result within 45 minutes) is killed and treated
-as a failure; a failed lens-free sweep fails the round (it is the required
-whole-range review), while failed lensed runs are merely recorded.
+each. The ENGINE — the native codex review, driven directly through the
+doperpowers:codex-companion runtime — receives no ticket, spec, or policy
+input of any kind: coupling spec policy into the native reviewer measurably
+weakened its correctness review, so the run is a pure `--base` diff review.
+The route is the worker's judgment per doperpowers:requesting-review: a
+big diff (~20+ files or ~2k changed lines — one reviewer's recall thins at
+that scale; on the PR752 benchmark the best single run found 10 of 13
+confirmed defects while a multi-run union found all 13) or a smaller diff
+concentrated on declared risk surfaces warrants the companion's
+code-review panel — one lens-free sweep, up to five diff-derived scalpel
+lenses, one binding verifier (an `interrupted` panel verdict is an engine
+failure, retried once, never a judgment about the diff). Other diffs run
+the single non-steerable `review` verb. The worker starts the round's run
+in the background and reads the findings back at JOIN; the PR diff never
+enters the worker's own context. The runtime fails closed when its fs
+sandbox was broken during the run. A hung engine (no result within 45
+minutes) is killed and treated as a failure; a failed run fails the round.
 
 The WORKER meanwhile audits implementer protocol/spec compliance itself,
 read-only, and records the audit BEFORE reading engine output: the issue
@@ -155,8 +156,11 @@ PROTOCOL BLOCKER (authority gap → needs-human; parks confidence, not
 progress), SPEC FINDING (fix-required; waves with native blockers), and
 AUDIT NOTE (trail-only). The two streams JOIN before triage.
 
-There is NO second engine: on engine failure the worker retries twice, then
-posts the trail comment, leaves the ticket in-review, and ends its turn
+There is NO second engine: on engine failure the worker retries twice —
+except for two terminal kinds, a sandbox-unavailable rejection and a panel
+round that has already spent its own retry, which take the outage path on
+first occurrence — then posts the trail comment, leaves the ticket
+in-review, and ends its turn
 with the `ENGINE-UNAVAILABLE` marker — the sweep re-dispatches on seeing it
 (capped; see the outage cap above). `needs-human` is never written for an
 infra outage. The review-trail comment names the engine that reviewed.
@@ -212,7 +216,8 @@ self-review bias: the entity that grades the fixes never wrote them.
    `tech-debt` label).
 5. (Optional) Add `.doperpowers/risk-surfaces.md` listing the repo's
    validated hot paths — auth files, migration dirs, privileged routes,
-   security-sensitive SQL; reviewers read it for lens derivation. Commit
+   security-sensitive SQL; reviewers read it to sharpen audit and triage
+   scrutiny. Commit
    it on the branch(es) reviewers target (it is read from the base).
 6. Start in observation mode: leave `AUTO_MERGE_ENABLED` unset/false in the
    workflow env. Flip it to `true` only after the trail comments show the
diff --git a/skills/reviewing-prs/references/review-worker-bootstrap.md b/skills/reviewing-prs/references/review-worker-bootstrap.md
index 8bebe7586a..c2c820d451 100644
--- a/skills/reviewing-prs/references/review-worker-bootstrap.md
+++ b/skills/reviewing-prs/references/review-worker-bootstrap.md
@@ -101,7 +101,7 @@ Runtime bindings (dispatcher-owned):
 - `AUTO_MERGE`: {{AUTO_MERGE}}
 - `BIND_READY_FILE`: {{BIND_READY_FILE}}
 - `IMPLEMENT_PROTOCOL_FILE`: {{IMPLEMENT_PROTOCOL_FILE}}
-- `REVIEW_ENGINE`: {{REVIEW_ENGINE}}
+- `COMPANION_DIR`: {{COMPANION_DIR}}
 - `CODEX_REVIEW_MODEL`: {{CODEX_REVIEW_MODEL}}
 - `CODEX_REVIEW_EFFORT`: {{CODEX_REVIEW_EFFORT}}
 
diff --git a/skills/reviewing-prs/references/runner-setup.md b/skills/reviewing-prs/references/runner-setup.md
index f277ebd7eb..a36233b3ab 100644
--- a/skills/reviewing-prs/references/runner-setup.md
+++ b/skills/reviewing-prs/references/runner-setup.md
@@ -76,6 +76,6 @@ Declare the repo's validated hot paths in
 `.doperpowers/risk-surfaces.md` on the branch(es) reviewers
 target. It's a plain list of globs and prose path/content rules the review
 worker reads against the diff — auth files, migration dirs, privileged
-routes, security-sensitive SQL — as lens-derivation input for the engine
-fan-out. It is read from the PR's **base ref** (never HEAD). Absent file →
-reviewers derive lenses from the diff alone.
+routes, security-sensitive SQL — to sharpen its audit and triage
+scrutiny; it never moves merge authority (surfaces are not a merge gate).
+It is read from the PR's **base ref** (never HEAD).
diff --git a/skills/reviewing-prs/scripts/review-dispatch.sh b/skills/reviewing-prs/scripts/review-dispatch.sh
index f034677b6a..8204f9a22c 100755
--- a/skills/reviewing-prs/scripts/review-dispatch.sh
+++ b/skills/reviewing-prs/scripts/review-dispatch.sh
@@ -193,7 +193,7 @@ case "${AUTO_MERGE_ENABLED:-false}" in
 esac
 CODEX_REVIEW_MODEL="${CODEX_REVIEW_MODEL:-gpt-5.6-sol}"
 CODEX_REVIEW_EFFORT="${CODEX_REVIEW_EFFORT:-xhigh}"
-REVIEW_ENGINE="$SCRIPT_DIR/review-engine.sh"
+COMPANION_DIR="$(cd "$SCRIPT_DIR/../../codex-companion" && pwd)"
 
 # Newest registry entry for worker name <1> (review-pr-<n> or review-epic-<n>)
 # → "uuid|status|current|engine|pid|host|boot" (empty if none).
@@ -618,7 +618,7 @@ PY
     P_BIND_READY_FILE="$bind_ready" P_SKILL_FILE="$SKILL_DIR/SKILL.md" \
     P_IMPLEMENT_PROTOCOL_FILE="${SKILL_DIR%/*}/implementing/SKILL.md" \
     P_ENGINE_NAME="$engine" P_CODEX_REVIEW_MODEL="$CODEX_REVIEW_MODEL" \
-    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_REVIEW_ENGINE="$REVIEW_ENGINE" \
+    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_COMPANION_DIR="$COMPANION_DIR" \
     RISK_FILE="$tmp/risk.md" FACTS_FILE="$tmp/facts.md" \
     _render_prompt)" \
     || { echo "#$pr: prompt render failed" >&2; rm -rf "$tmp" "$control_dir"; return 1; }
@@ -769,7 +769,7 @@ _dispatch_epic_locked() {
     P_BIND_READY_FILE="$bind_ready" P_SKILL_FILE="$SKILL_DIR/SKILL.md" \
     P_IMPLEMENT_PROTOCOL_FILE="${SKILL_DIR%/*}/implementing/SKILL.md" \
     P_ENGINE_NAME="$engine" P_CODEX_REVIEW_MODEL="$CODEX_REVIEW_MODEL" \
-    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_REVIEW_ENGINE="$REVIEW_ENGINE" \
+    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_COMPANION_DIR="$COMPANION_DIR" \
     RISK_FILE="$tmp/risk.md" FACTS_FILE="$tmp/facts.md" \
     _render_prompt)" \
     || { echo "$name: prompt render failed" >&2; rm -rf "$tmp" "$control_dir"; return 1; }
@@ -1476,7 +1476,7 @@ PY
     P_BIND_READY_FILE="$control_dir/bind-ready.json" P_SKILL_FILE="$SKILL_DIR/SKILL.md" \
     P_IMPLEMENT_PROTOCOL_FILE="${SKILL_DIR%/*}/implementing/SKILL.md" \
     P_ENGINE_NAME="$engine" P_CODEX_REVIEW_MODEL="$CODEX_REVIEW_MODEL" \
-    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_REVIEW_ENGINE="$REVIEW_ENGINE" \
+    P_CODEX_REVIEW_EFFORT="$CODEX_REVIEW_EFFORT" P_COMPANION_DIR="$COMPANION_DIR" \
     RISK_FILE="$tmp/risk.md" FACTS_FILE="$tmp/facts.md" \
     _render_prompt)" \
     || { echo "#$C_TICKET: prompt render failed — releasing run $C_RUN_ID" >&2
diff --git a/skills/reviewing-prs/scripts/review-engine.sh b/skills/reviewing-prs/scripts/review-engine.sh
deleted file mode 100755
index b392775f98..0000000000
--- a/skills/reviewing-prs/scripts/review-engine.sh
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env bash
-# review-engine.sh — the ONE review-engine invocation for the reviewing-prs
-# loop, driven by the doperpowers:codex-companion runtime (vendored codex
-# app-server client; sibling skill). PURE correctness review: a plain run is
-# codex's native `review` verb with no ticket/spec input of any kind; the
-# single optional modification is a diff-derived structural LENS
-# (CODEX_REVIEW_LENS_FILE / CODEX_REVIEW_LENS, see the lens block below),
-# which routes the run through the `adversarial-review` verb with the lens
-# as its focus mandate. Ticket/spec compliance is the REVIEW WORKER's own
-# audit, performed outside this engine (skills/reviewing-prs/SKILL.md). The
-# script stays synchronous; the caller chooses foreground or background. The
-# verdict lands in --out as rendered findings (progress stream:
-# <out>.events.log); the PR diff never enters the caller's context.
-#
-# Usage: review-engine.sh --base <ref> --out <file>
-#   --base  diff base (e.g. origin/main); the engine reviews <ref>...HEAD
-#   --out   findings file the engine writes
-# Env: CODEX_REVIEW_MODEL (default gpt-5.6-sol), CODEX_REVIEW_EFFORT
-# (default xhigh), CODEX_REVIEW_LENS_FILE / CODEX_REVIEW_LENS (optional
-# diff-derived structural focus mandate — see the lens block below; both
-# empty keeps the plain review).
-# Run from the worktree root — the engine reviews $PWD.
-# Exits 127 when codex/node are missing, 2 on usage error, else the
-# runtime's rc.
-set -euo pipefail
-
-usage() { echo "usage: review-engine.sh --base <ref> --out <file>" >&2; exit 2; }
-base="" out=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --base) base="${2:-}"; shift 2 ;;
-    --out)  out="${2:-}"; shift 2 ;;
-    *) usage ;;
-  esac
-done
-[ -n "$base" ] && [ -n "$out" ] || usage
-command -v codex >/dev/null 2>&1 || { echo "review-engine: codex CLI not found" >&2; exit 127; }
-command -v node  >/dev/null 2>&1 || { echo "review-engine: node not found" >&2; exit 127; }
-
-script_dir="$(cd "$(dirname "$0")" && pwd)"
-companion="$script_dir/../../codex-companion"
-[ -f "$companion/scripts/with-effort.mjs" ] || { echo "review-engine: codex-companion skill not found at $companion" >&2; exit 127; }
-
-model="${CODEX_REVIEW_MODEL:-gpt-5.6-sol}"
-effort="${CODEX_REVIEW_EFFORT:-xhigh}"
-source_codex_home="${CODEX_HOME:-$HOME/.codex}"
-
-# TLS trust anchors as a FILE bundle — a nested codex cannot reach the OS
-# keychain/trustd under the outer seatbelt (shakedown FU-6). macOS ships the
-# bundle as cert.pem, Debian/Ubuntu as ca-certificates.crt.
-if [ -z "${SSL_CERT_FILE:-}" ]; then
-  for _cert in /etc/ssl/cert.pem /etc/ssl/certs/ca-certificates.crt; do
-    if [ -f "$_cert" ]; then export SSL_CERT_FILE="$_cert"; break; fi
-  done
-fi
-# A nested codex resolves its code-mode command host to /usr/local/bin
-# (absent here) instead of ~/.local/bin — point it explicitly.
-if [ -z "${CODEX_CODE_MODE_HOST_PATH:-}" ] && [ -x "$HOME/.local/bin/codex-code-mode-host" ]; then
-  export CODEX_CODE_MODE_HOST_PATH="$HOME/.local/bin/codex-code-mode-host"
-fi
-# Temporary CODEX_HOME: the engine must WRITE session state, and the default
-# ~/.codex is read-only under the outer seatbelt. Keep that state outside the
-# reviewed tree so untracked snapshots cannot affect the review. auth.json is
-# symlinked so login state carries over. A temporary CLAUDE_PLUGIN_DATA
-# isolates each run's companion job ledger (state.json is unlocked
-# read-modify-write — parallel lens runs must not share a root). Both removed
-# on every exit path.
-eng_home="$(mktemp -d "${TMPDIR:-/tmp}/review-engine-home.XXXXXX")"
-trap 'rm -rf "$eng_home"' EXIT
-if [ -f "$source_codex_home/auth.json" ]; then
-  ln -s "$source_codex_home/auth.json" "$eng_home/auth.json"
-fi
-export CODEX_HOME="$eng_home"
-export CLAUDE_PLUGIN_DATA="$eng_home/companion-state"
-
-# Nested-codex caveat: review threads run their probing commands under
-# codex's own read-only sandbox, applied unconditionally by the app-server
-# (thread/start pins it; codex never skips seatbelt when CODEX_SANDBOX says
-# it is already inside one — verified against codex-rs). Under an OUTER
-# codex seatbelt those probes may fail; the review still renders findings
-# from the diff. Claude-harness workers (this loop's normal shape) are
-# unaffected. Warn so a degraded nested run is attributable.
-if [ -n "${CODEX_SANDBOX:-}" ]; then
-  echo "review-engine: warning — running nested under a codex sandbox; engine probe commands may be confined" >&2
-fi
-
-# Optional lens: a diff-derived structural focus mandate. A lensed run uses
-# the adversarial-review verb — the steerable challenge review — with the
-# lens as its focus text; the rubric hunts along that mandate instead of
-# re-running the broad native sweep. Never ticket/spec content.
-# CODEX_REVIEW_LENS_FILE (a path; read verbatim, so generated prose never
-# passes through shell interpolation — the review worker MUST use this form)
-# takes precedence over CODEX_REVIEW_LENS (inline, for trusted/manual
-# invocations). The lens travels as a single argv element after `--`, so the
-# companion parser never re-tokenizes it into flags. Both empty/unset =
-# the plain native review.
-lens=""
-if [ -n "${CODEX_REVIEW_LENS_FILE:-}" ]; then
-  [ -f "$CODEX_REVIEW_LENS_FILE" ] || { echo "review-engine: CODEX_REVIEW_LENS_FILE not found: $CODEX_REVIEW_LENS_FILE" >&2; exit 2; }
-  lens="$(cat "$CODEX_REVIEW_LENS_FILE")"
-elif [ -n "${CODEX_REVIEW_LENS:-}" ]; then
-  lens="$CODEX_REVIEW_LENS"
-fi
-
-verb_args=( review --base "$base" --wait --model "$model" )
-if [ -n "$lens" ]; then
-  verb_args=( adversarial-review --base "$base" --wait --model "$model" -- "$lens" )
-fi
-
-# with-effort.mjs serves the verb a private app-server carrying the effort
-# override (the review protocol has no effort field) and provides its own
-# live endpoint — no detached broker, nothing outlives this run. Findings
-# render on stdout (--out), progress on stderr (<out>.events.log).
-rc=0
-node "$companion/scripts/with-effort.mjs" --effort "$effort" -- \
-  "${verb_args[@]}" > "$out" 2> "$out.events.log" || rc=$?
-
-# Fail closed when the engine's own fs sandbox never worked. Observed live
-# (ida-worker-1, 2026-08-09): a host that blocks unprivileged userns makes
-# every probe fail (`bwrap: loopback: Failed RTM_NEWADDR`), yet codex exits 0
-# and renders findings anyway — 22 consecutive runs across 6 review workers
-# passed as "clean" or fabricated defects from the lens text. The events log
-# is the only reliable trace, so its sandbox-failure markers turn the run
-# into a hard error. Skipped under an OUTER codex sandbox (CODEX_SANDBOX):
-# there probe confinement is expected and the degraded diff-only render is
-# the documented behavior (warned above).
-if [ "$rc" -eq 0 ] && [ -z "${CODEX_SANDBOX:-}" ] && \
-   grep -qE 'RTM_NEWADDR|shell is unavailable|fs sandbox helper failed' "$out.events.log" 2>/dev/null; then
-  echo "review-engine: fs sandbox unavailable during run — findings in $out are untrustworthy (see $out.events.log); treat as ENGINE-UNAVAILABLE" >&2
-  exit 3
-fi
-exit "$rc"
diff --git a/skills/subagent-driven-development/SKILL.md b/skills/subagent-driven-development/SKILL.md
index 2ec4ba9043..dd4dcd6042 100644
--- a/skills/subagent-driven-development/SKILL.md
+++ b/skills/subagent-driven-development/SKILL.md
@@ -53,8 +53,8 @@ Handing execution to a parallel session → doperpowers:executing-plans.
    changed design understanding into the spec's living tail
    (doperpowers:execspec). Implementation noise stays in commit messages.
 7. **After all tasks:** dispatch the final whole-branch review (external
-   reviewer — codex native review via doperpowers:codex-companion's
-   `review` verb with `--base <base>`; a
+   reviewer — an independent review via doperpowers:requesting-review
+   with `--base <base>`; a
    fresh top-tier Claude reviewer if codex is unavailable) with its own
    package (`scripts/review-package PLAN_FILE MERGE_BASE HEAD`,
    MERGE_BASE = `git merge-base main HEAD`). Then
diff --git a/skills/writing-plans/SKILL.md b/skills/writing-plans/SKILL.md
index 7661e9a9b4..73d702cb7e 100644
--- a/skills/writing-plans/SKILL.md
+++ b/skills/writing-plans/SKILL.md
@@ -203,7 +203,7 @@ After saving the plan, offer execution choice:
 
 **Which approach?"**
 
-While waiting for the response, run the plan review on the Codex side — doperpowers:codex-companion's `adversarial-review` verb (model `gpt-5.6-sol`, effort `xhigh` via its with-effort wrapper), in a background Bash, with the focus text:
+While waiting for the response, run the plan review on the Codex side — doperpowers:requesting-review's adversarial review (model `gpt-5.6-sol`, effort `xhigh` via the with-effort wrapper), in a background Bash, with the focus text:
 
 > Review the implementation plan at [PLAN_FILE_PATH] against its spec at [SPEC_FILE_PATH]. Verify the implementation architecture is sound and the plan is complete, spec-aligned, well-decomposed, and buildable by an engineer with zero context.
 
diff --git a/tests/codex-companion/fake-codex-fixture.mjs b/tests/codex-companion/fake-codex-fixture.mjs
index f83c96a0de..7741dce1fe 100644
--- a/tests/codex-companion/fake-codex-fixture.mjs
+++ b/tests/codex-companion/fake-codex-fixture.mjs
@@ -248,6 +248,9 @@ function taskPayload(prompt, resume) {
 }
 
 const args = process.argv.slice(2);
+// with-effort.mjs spawns \`codex -c key=value … app-server\`; strip the
+// override pairs so the fake serves that spawn shape too.
+while (args[0] === "-c") args.splice(0, 2);
 if (args[0] === "--version") {
   console.log("codex-cli test");
   process.exit(0);
@@ -405,6 +408,16 @@ rl.on("line", (line) => {
       }
 
       case "review/start": {
+        if (BEHAVIOR === "sandbox-broken") {
+          // The real server's sandbox helper writes this to ITS stderr while the
+          // review still completes cleanly — the false-clean incident signature.
+          process.stderr.write("bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted\\n");
+        }
+        if (BEHAVIOR === "sandbox-broken-fragment") {
+          // The same signature as the last, UNTERMINATED thing on the channel:
+          // a scanner that only reads completed lines never sees it.
+          process.stderr.write("bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted");
+        }
         const thread = ensureThread(state, message.params.threadId);
         let reviewThread = thread;
         if (message.params.delivery === "detached") {
@@ -437,6 +450,9 @@ rl.on("line", (line) => {
       }
 
 	      case "turn/start": {
+	        if (BEHAVIOR === "sandbox-broken") {
+	          process.stderr.write("bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted\\n");
+	        }
 	        const thread = ensureThread(state, message.params.threadId);
 	        const prompt = (message.params.input || [])
           .filter((item) => item.type === "text")
diff --git a/tests/codex-companion/mock/codex b/tests/codex-companion/mock/codex
index 2fba32a90a..32cc594417 100755
--- a/tests/codex-companion/mock/codex
+++ b/tests/codex-companion/mock/codex
@@ -2,7 +2,7 @@
 // Mock codex app-server. Speaks the REAL JSON-RPC-over-stdio shapes
 // (derived from lib/codex.mjs captureTurn + app-server.mjs — see the
 // PROTOCOL notes below). Controlled by CODEX_MOCK_DIR:
-//   scenario.json  { turns: [ {finalMessage|finalRaw|die|dieMidTurn|banner|hangMs|reviewText|turnStatus}... ],
+//   scenario.json  { turns: [ {finalMessage|finalRaw|die|dieMidTurn|banner|stderrLine|hangMs|reviewText|turnStatus}... ],
 //                    byLens: { "<developer_instructions prefix>": {same behavior} } }
 //                  `turns` is consumed in global order via a counter file (mkdir
 //                  lock); turnStatus: "failed" ⇒ emit turn/completed with the
@@ -187,6 +187,13 @@ rl.on("line", (line) => {
     fs.appendFileSync(path.join(MOCK, "turns.jsonl"),
       JSON.stringify({ method: msg.method, params: msg.params, pid: process.pid }) + "\n");
     const b = lensBehavior() ?? nextTurnBehavior();
+    // stderrLine: a line on the server's STDERR — the real server's sandbox
+    // helper complains there (bwrap RTM_NEWADDR et al.); written before `die`
+    // so a dying server can leave the diagnostic behind, exactly like the
+    // real failure. The client buffers it into client.stderr either way.
+    if (b.stderrLine) {
+      fs.writeSync(2, `${b.stderrLine}\n`);
+    }
     if (b.die) process.exit(1);
 
     const isReview = msg.method === "review/start";
diff --git a/tests/codex-companion/runtime.test.mjs b/tests/codex-companion/runtime.test.mjs
index c97376a668..c199902f57 100644
--- a/tests/codex-companion/runtime.test.mjs
+++ b/tests/codex-companion/runtime.test.mjs
@@ -15,6 +15,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const PLUGIN_ROOT = path.join(ROOT, "..", "skills", "codex-companion", "runtime");
 const SCRIPT = path.join(PLUGIN_ROOT, "scripts", "codex-companion.mjs");
 const STOP_HOOK = path.join(PLUGIN_ROOT, "scripts", "stop-review-gate-hook.mjs");
+const WITH_EFFORT = path.join(ROOT, "..", "skills", "codex-companion", "scripts", "with-effort.mjs");
 const SESSION_HOOK = path.join(PLUGIN_ROOT, "scripts", "session-lifecycle-hook.mjs");
 
 async function waitFor(predicate, { timeoutMs = 5000, intervalMs = 50 } = {}) {
@@ -158,6 +159,107 @@ test("review renders a no-findings result from app-server review/start", () => {
   assert.match(result.stdout, /No material issues found/);
 });
 
+test("review fails closed when the sandbox-failure marker rides the server's stderr", () => {
+  const repo = makeTempDir();
+  const binDir = makeTempDir();
+  installFakeCodex(binDir, "sandbox-broken");
+  initGitRepo(repo);
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 1;\n");
+  run("git", ["add", "a.js"], { cwd: repo });
+  run("git", ["commit", "-m", "init"], { cwd: repo });
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 2;\n");
+
+  const result = run("node", [SCRIPT, "review"], {
+    cwd: repo,
+    env: { ...buildEnv(binDir), CODEX_COMPANION_APP_SERVER_ENDPOINT: "unix:/nonexistent/no-broker.sock" }
+  });
+
+  assert.notEqual(result.status, 0, "a clean render from a broken sandbox must not exit 0");
+  assert.match(result.stderr, /fs sandbox unavailable/);
+  assert.doesNotMatch(result.stdout, /No material issues found/);
+});
+
+test("adversarial review fails closed on the same marker", () => {
+  const repo = makeTempDir();
+  const binDir = makeTempDir();
+  installFakeCodex(binDir, "sandbox-broken");
+  initGitRepo(repo);
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 1;\n");
+  run("git", ["add", "a.js"], { cwd: repo });
+  run("git", ["commit", "-m", "init"], { cwd: repo });
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 2;\n");
+
+  const result = run("node", [SCRIPT, "adversarial-review"], {
+    cwd: repo,
+    env: { ...buildEnv(binDir), CODEX_COMPANION_APP_SERVER_ENDPOINT: "unix:/nonexistent/no-broker.sock" }
+  });
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /fs sandbox unavailable/);
+});
+
+test("review under an outer codex sandbox keeps the degraded render", () => {
+  const repo = makeTempDir();
+  const binDir = makeTempDir();
+  installFakeCodex(binDir, "sandbox-broken");
+  initGitRepo(repo);
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 1;\n");
+  run("git", ["add", "a.js"], { cwd: repo });
+  run("git", ["commit", "-m", "init"], { cwd: repo });
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 2;\n");
+
+  const result = run("node", [SCRIPT, "review"], {
+    cwd: repo,
+    env: { ...buildEnv(binDir), CODEX_COMPANION_APP_SERVER_ENDPOINT: "unix:/nonexistent/no-broker.sock", CODEX_SANDBOX: "seatbelt" }
+  });
+
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /No material issues found/);
+});
+
+test("with-effort fails closed when its private app-server reports a broken sandbox", () => {
+  // On this path the verb's client talks to a socket, so the child's stderr is
+  // visible only to with-effort itself — the wrapper owns the guard here.
+  const repo = makeTempDir();
+  const binDir = makeTempDir();
+  installFakeCodex(binDir, "sandbox-broken");
+  initGitRepo(repo);
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 1;\n");
+  run("git", ["add", "a.js"], { cwd: repo });
+  run("git", ["commit", "-m", "init"], { cwd: repo });
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 2;\n");
+
+  const result = run("node", [WITH_EFFORT, "--effort", "medium", "--", "review"], {
+    cwd: repo,
+    env: buildEnv(binDir)
+  });
+
+  assert.equal(result.status, 3, result.stderr);
+  assert.match(result.stderr, /with-effort: fs sandbox unavailable/);
+});
+
+test("with-effort fails closed on a marker that never got a trailing newline", () => {
+  // The marker can be the last, unterminated thing the app-server writes; a
+  // scanner that only judges completed lines would leave it buffered and let
+  // the clean verb exit stand.
+  const repo = makeTempDir();
+  const binDir = makeTempDir();
+  installFakeCodex(binDir, "sandbox-broken-fragment");
+  initGitRepo(repo);
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 1;\n");
+  run("git", ["add", "a.js"], { cwd: repo });
+  run("git", ["commit", "-m", "init"], { cwd: repo });
+  fs.writeFileSync(path.join(repo, "a.js"), "export const value = 2;\n");
+
+  const result = run("node", [WITH_EFFORT, "--effort", "medium", "--", "review"], {
+    cwd: repo,
+    env: buildEnv(binDir)
+  });
+
+  assert.equal(result.status, 3, result.stderr);
+  assert.match(result.stderr, /with-effort: fs sandbox unavailable/);
+});
+
 test("task runs when the active provider does not require OpenAI login", () => {
   const repo = makeTempDir();
   const binDir = makeTempDir();
diff --git a/tests/codex-companion/test-engine-hooks.mjs b/tests/codex-companion/test-engine-hooks.mjs
index 0421c8390a..4149ae9fe2 100644
--- a/tests/codex-companion/test-engine-hooks.mjs
+++ b/tests/codex-companion/test-engine-hooks.mjs
@@ -296,6 +296,91 @@ const spawnRecord = (mockDir, pid) => JSON.parse(fs.readFileSync(path.join(mockD
   assert.deepEqual(workers(c.runDir), [], "no pids left tracked");
 }
 
+// --- a sandbox-failure marker on the server's stderr FAILS the leaf ----------
+// The app-server buffers stderr and surfaces it only on a nonzero exit, but the
+// observed fs-sandbox failure (bwrap RTM_NEWADDR) exits 0 and renders findings
+// anyway. The engine fails closed on the buffered markers (lib/sandbox.mjs):
+// the leaf fails terminally — no transport retry, since a blocked sandbox does
+// not heal between attempts — and the diagnostic still reaches emit.
+{
+  const c = newCase("sandbox-fail-closed", [{
+    reviewText: "# Sweep\n\nlooks clean",
+    stderrLine: "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted"
+  }]);
+  const lines = [];
+  const out = await runWorkflow({
+    scriptPath: path.join(FIXTURES, "fx-review-fail.mjs"),
+    args: {},
+    cwd: c.repo,
+    runDir: c.runDir,
+    emit: (l) => lines.push(l)
+  });
+  assert.deepEqual(out.result, [null], "a clean-looking report from a broken sandbox is not a result");
+  assert.equal(counter(c.mockDir), 1, "terminal: the transport retry never buys a second attempt");
+  const fin = journal(c.runDir).filter((e) => e.type === "finished");
+  assert.match(fin[0].error, /fs sandbox unavailable/, "the sandbox guard is what rejected it");
+  assert.ok(
+    lines.some((l) => l.startsWith("sandbox-diagnostic sweep:") && l.includes("RTM_NEWADDR")),
+    "the marker from the worker's buffered stderr still reaches emit"
+  );
+}
+
+// --- under an OUTER codex sandbox the guard stands down ----------------------
+// CODEX_SANDBOX set means probe confinement is expected (nested run); the leaf
+// succeeds and the marker is journaled as a diagnostic only.
+{
+  const c = newCase("sandbox-nested-ok", [{
+    reviewText: "# Sweep\n\nlooks clean",
+    stderrLine: "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted"
+  }]);
+  const lines = [];
+  process.env.CODEX_SANDBOX = "seatbelt";
+  let out;
+  try {
+    out = await runWorkflow({
+      scriptPath: path.join(FIXTURES, "fx-review.mjs"),
+      args: {},
+      cwd: c.repo,
+      runDir: c.runDir,
+      emit: (l) => lines.push(l)
+    });
+  } finally {
+    delete process.env.CODEX_SANDBOX;
+  }
+  assert.equal(out.result.reviewText, "# Sweep\n\nlooks clean", "the nested leaf still succeeds");
+  assert.ok(
+    lines.some((l) => l.startsWith("sandbox-diagnostic sweep:") && l.includes("RTM_NEWADDR")),
+    "…with the marker forwarded to emit as a diagnostic"
+  );
+}
+
+// --- sandbox diagnostics survive a leaf that THROWS --------------------------
+// A dying app-server never returns a result to inspect, but its protocol error
+// carries the buffered stderr — the retry/fail paths must forward markers from
+// the error text, or a dead scalpel hides exactly the diagnostic that matters.
+// Diagnostic only: an error message can also be model-authored (a rejected
+// request quotes the command back), so unlike the *.stderr sites this one must
+// keep RETRYING — a live lane was once killed by a marker a model had quoted.
+{
+  const c = newCase("sandbox-diag-throw", [
+    { die: true, stderrLine: "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" },
+    { finalMessage: "recovered" }
+  ]);
+  const lines = [];
+  const out = await runWorkflow({
+    scriptPath: path.join(FIXTURES, "fx-solo.mjs"),
+    args: {},
+    cwd: c.repo,
+    runDir: c.runDir,
+    emit: (l) => lines.push(l)
+  });
+  assert.equal(out.result.one, "recovered", "the transport retry still recovers the leaf");
+  assert.ok(
+    lines.some((l) => l.startsWith("sandbox-diagnostic") && l.includes("RTM_NEWADDR")),
+    "the marker from the dying worker's protocol error is forwarded to emit"
+  );
+}
+
 // --- a review whose turn failed is not a review ------------------------------
 {
   const c = newCase("review-fail", [
diff --git a/tests/implementing/test-protocol-content.sh b/tests/implementing/test-protocol-content.sh
index 36ee653cbd..2f97d4d52b 100755
--- a/tests/implementing/test-protocol-content.sh
+++ b/tests/implementing/test-protocol-content.sh
@@ -289,8 +289,11 @@ done
 # writing-plans prescribes, so the two cannot drift apart again.
 assert_not_contains "$arch" "plan-reviewer" \
     "the council never dispatches the deleted plan-reviewer agent"
-assert_contains "$arch" "doperpowers:codex-companion's \`adversarial-review\` verb" \
+assert_contains "$arch" "doperpowers:requesting-review's adversarial review" \
     "the plan gets the independent review writing-plans prescribes, by its real mechanism"
+plans="$(cat "$REPO_ROOT/skills/writing-plans/SKILL.md")"
+assert_contains "$plans" "doperpowers:requesting-review's adversarial review" \
+    "...and writing-plans names that same mechanism (the two cannot drift apart)"
 assert_contains "$arch" "buildable by an engineer with" \
     "...focused on the same bar (same voice as writing-plans, not a bespoke variant)"
 assert_contains "$arch" "recomposition" "architect protocol carries the recomposition claim"
diff --git a/tests/review-bench/README.md b/tests/review-bench/README.md
index 64a5cd230d..670fb1c876 100644
--- a/tests/review-bench/README.md
+++ b/tests/review-bench/README.md
@@ -29,8 +29,13 @@ One case, one engine (from anywhere; scratch repos are ephemeral):
 
 Both engines review the identical committed `bench-change` branch
 against `main` in a materialized scratch repo. The codex engine runs
-through the loop's own `review-engine.sh` (env `CODEX_REVIEW_MODEL`,
-`CODEX_REVIEW_EFFORT` pass through; defaults match the live loop). The
+the loop's single-review path — the companion's with-effort wrapper
+serving the native review verb, under the loop's engine preamble
+(throwaway `CODEX_HOME` with login symlinked over, isolated
+`CLAUDE_PLUGIN_DATA`, TLS bundle and code-mode-host fallbacks), so a
+nested or read-only host benches the same environment production runs
+in (env `CODEX_REVIEW_MODEL`, `CODEX_REVIEW_EFFORT` pass through;
+defaults match the live loop). The
 argus engine ALWAYS runs through the headless invocation path (`claude
 -p` slash invocation, `--permission-mode auto` — the C1.G3 probe
 mechanism), because that is the context C4 deploys; benching argus
diff --git a/tests/review-bench/run-case.sh b/tests/review-bench/run-case.sh
index 3edff47b07..f09b3ecc41 100755
--- a/tests/review-bench/run-case.sh
+++ b/tests/review-bench/run-case.sh
@@ -19,7 +19,7 @@
 #   seeded:  base/ + patch.diff (+ truth.json, case.md, intent.md)
 #   real:    case.json {"repo": "<owner/name-or-local-path>", "head": "<sha>", "base": "<sha>"}
 #
-# Env: CODEX_REVIEW_MODEL / CODEX_REVIEW_EFFORT pass through to review-engine.sh.
+# Env: CODEX_REVIEW_MODEL / CODEX_REVIEW_EFFORT pick the codex model/effort.
 #      ARGUS_TIMEOUT (default 2700s) bounds the argus run; codex is bounded the same.
 #      ARGUS_LEVEL (default plain) pins the argus effort level.
 #      CR_LEVEL (default medium) pins the code-review effort level.
@@ -44,7 +44,11 @@ bench_root="$(cd "$(dirname "$0")" && pwd)"
 timeout_s="${ARGUS_TIMEOUT:-2700}"
 
 scratch="$(mktemp -d "${TMPDIR:-/tmp}/review-bench.XXXXXX")"
-cleanup() { [ "${BENCH_KEEP:-0}" = "1" ] && echo "scratch kept: $scratch" >&2 || rm -rf "$scratch"; }
+eng_home=""
+cleanup() {
+  if [ -n "$eng_home" ]; then rm -rf "$eng_home"; fi
+  [ "${BENCH_KEEP:-0}" = "1" ] && echo "scratch kept: $scratch" >&2 || rm -rf "$scratch"
+}
 trap cleanup EXIT
 
 # --- Materialize: a repo with base branch `main` and the change committed on `bench-change`.
@@ -84,8 +88,33 @@ cd "$scratch"
 started="$(date +%s)"
 case "$engine" in
   codex)
-    "$bench_root/../../skills/reviewing-prs/scripts/review-engine.sh" \
-      --base main --out "$out"
+    # The production single-review path (review-engine.sh is retired): the
+    # with-effort wrapper serving the native review verb, findings on stdout,
+    # under the same preamble the live loop's START ENGINE sets up — codex
+    # must WRITE session state, the default home may be read-only under an
+    # outer sandbox, and that state must stay out of the reviewed tree. So:
+    # a throwaway CODEX_HOME with login symlinked over, an isolated
+    # CLAUDE_PLUGIN_DATA (the job ledger is unlocked read-modify-write), TLS
+    # anchors as a FILE bundle, and the code-mode host a nested codex
+    # resolves to /usr/local/bin instead of ~/.local/bin.
+    eng_home="$(mktemp -d "${TMPDIR:-/tmp}/review-bench-codex.XXXXXX")"
+    source_codex_home="${CODEX_HOME:-$HOME/.codex}"
+    if [ -f "$source_codex_home/auth.json" ]; then
+      ln -s "$source_codex_home/auth.json" "$eng_home/auth.json"
+    fi
+    export CODEX_HOME="$eng_home" CLAUDE_PLUGIN_DATA="$eng_home/companion-state"
+    if [ -z "${SSL_CERT_FILE:-}" ]; then
+      for _cert in /etc/ssl/cert.pem /etc/ssl/certs/ca-certificates.crt; do
+        if [ -f "$_cert" ]; then export SSL_CERT_FILE="$_cert"; break; fi
+      done
+    fi
+    if [ -z "${CODEX_CODE_MODE_HOST_PATH:-}" ] && [ -x "$HOME/.local/bin/codex-code-mode-host" ]; then
+      export CODEX_CODE_MODE_HOST_PATH="$HOME/.local/bin/codex-code-mode-host"
+    fi
+    node "$bench_root/../../skills/codex-companion/scripts/with-effort.mjs" \
+      --effort "${CODEX_REVIEW_EFFORT:-xhigh}" -- \
+      review --base main --wait --model "${CODEX_REVIEW_MODEL:-gpt-5.6-sol}" \
+      > "$out" 2> "$out.events.log"
     ;;
   argus)
     # Headless path (C1.G3): base-branch target with precomputed merge base —
diff --git a/tests/reviewing-prs/test-review-dispatch.sh b/tests/reviewing-prs/test-review-dispatch.sh
index 37f62da0cf..341e21be2d 100755
--- a/tests/reviewing-prs/test-review-dispatch.sh
+++ b/tests/reviewing-prs/test-review-dispatch.sh
@@ -445,7 +445,7 @@ assert_contains "$PROMPT" "Use doperpowers:reviewing-prs" "prompt names the Revi
 assert_contains "$PROMPT" "dispatcher-pinned copy" "prompt routes the protocol through the dispatcher-pinned file"
 assert_contains "$PROMPT" "$REPO_ROOT/skills/reviewing-prs/SKILL.md" "prompt carries the canonical dispatcher-owned skill path"
 assert_contains "$PROMPT" "$REPO_ROOT/skills/implementing/SKILL.md" "prompt carries the canonical implement-contract path (the skill IS the protocol)"
-assert_contains "$PROMPT" "scripts/review-engine.sh" "prompt binds the engine script path"
+assert_contains "$PROMPT" '`COMPANION_DIR`: '"$REPO_ROOT/skills/codex-companion" "prompt binds the companion runtime dir"
 assert_contains "$PROMPT" '`CODEX_REVIEW_MODEL`:' "prompt binds the engine model"
 assert_contains "$PROMPT" '`CODEX_REVIEW_EFFORT`:' "prompt binds the engine effort"
 
@@ -1440,7 +1440,7 @@ assert_contains "$(cat "$SPAWN_LOG")" "spawn:--no-wait review-pr-41" "WORKER_ENG
 assert_not_contains "$(cat "$SPAWN_LOG")" "codex-spawn:" "codex-CLI worker species is retired from dispatch"
 assert_contains "$(cat "$SPAWN_LOG")" "spawn-env:settings=$HOME/.claude/clodex-settings.json;effort=xhigh" "gateway route rides DAEMON_CLAUDE_SETTINGS/EFFORT"
 prompt="$(cat "$PROMPT_DIR/review-pr-41.prompt")"
-assert_contains "$prompt" "review-engine.sh" "prompt binds the engine script path"
+assert_contains "$prompt" '`COMPANION_DIR`:' "prompt binds the companion runtime dir"
 assert_contains "$prompt" '`BASE_REF`: main' "prompt binds the base ref the engine call uses"
 assert_not_contains "$prompt" "--criteria" "criteria concept is gone from the rendered prompt"
 assert_not_contains "$prompt" "developer_instructions" "no developer instructions ride the rendered prompt"
@@ -1458,7 +1458,7 @@ else
     fail "claude route pins the QAgent model to opus"
 fi
 prompt42="$(cat "$PROMPT_DIR/review-pr-42.prompt")"
-assert_contains "$prompt42" "scripts/review-engine.sh" "claude route binds the same single engine (no per-route fork)"
+assert_contains "$prompt42" '`COMPANION_DIR`:' "claude route binds the same single runtime (no per-route fork)"
 
 : > "$SPAWN_LOG"
 gh_pr 43 OPEN 0 "engine:claude"
diff --git a/tests/reviewing-prs/test-review-engine.sh b/tests/reviewing-prs/test-review-engine.sh
deleted file mode 100755
index 9ddfce0d11..0000000000
--- a/tests/reviewing-prs/test-review-engine.sh
+++ /dev/null
@@ -1,132 +0,0 @@
-#!/usr/bin/env bash
-#
-# Hermetic tests for review-engine.sh — the single native-review invocation.
-# The engine is PURE correctness review: no criteria file, no developer
-# instructions — the worker owns ticket/spec compliance out-of-engine.
-# `codex` is stubbed: it logs argv + the env recipe, honors -o, and exits
-# with STUB_CODEX_RC. No network, no real codex.
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-ENGINE="$REPO_ROOT/skills/reviewing-prs/scripts/review-engine.sh"
-
-FAILURES=0
-TEST_ROOT="$(mktemp -d)"
-cleanup() { rm -rf "$TEST_ROOT"; }
-trap cleanup EXIT
-
-pass() { echo "  [PASS] $1"; }
-fail() { echo "  [FAIL] $1"; FAILURES=$((FAILURES + 1)); }
-assert_equals() {
-    if [[ "$1" == "$2" ]]; then pass "$3"; else
-        fail "$3"; echo "    expected: $2"; echo "    actual:   $1"; fi
-}
-assert_contains() {
-    if printf '%s' "$1" | grep -Fq -- "$2"; then pass "$3"; else
-        fail "$3"; echo "    expected to find: $2"; echo "    in: $1"; fi
-}
-assert_not_contains() {
-    if printf '%s' "$1" | grep -Fq -- "$2"; then
-        fail "$3"; echo "    expected NOT to find: $2"; echo "    in: $1"; else pass "$3"; fi
-}
-
-export HOME="$TEST_ROOT/home"
-export TMPDIR="$TEST_ROOT/tmp"
-export ENGINE_LOG="$TEST_ROOT/engine.log"
-mkdir -p "$HOME/.codex" "$HOME/.local/bin" "$TMPDIR"
-echo '{"token":"fake"}' > "$HOME/.codex/auth.json"
-: > "$HOME/.local/bin/codex-code-mode-host"; chmod +x "$HOME/.local/bin/codex-code-mode-host"
-
-STUB_BIN="$TEST_ROOT/bin"; mkdir -p "$STUB_BIN"
-cat > "$STUB_BIN/codex" <<'STUB'
-#!/usr/bin/env bash
-set -euo pipefail
-{
-  printf 'ARGS:'; printf ' %q' "$@"; printf '\n'
-  echo "ENV_CODEX_HOME=${CODEX_HOME:-}"
-  echo "ENV_SSL_CERT_FILE=${SSL_CERT_FILE:-}"
-  echo "ENV_HOST_PATH=${CODEX_CODE_MODE_HOST_PATH:-}"
-  echo "AUTH_LINK=$([ -L "${CODEX_HOME:-/nonexistent}/auth.json" ] && echo yes || echo no)"
-  echo "AUTH_TARGET=$(readlink "${CODEX_HOME:-/nonexistent}/auth.json" 2>/dev/null || true)"
-} >> "$ENGINE_LOG"
-prev=""; out=""
-for a in "$@"; do [ "$prev" = "-o" ] && out="$a"; prev="$a"; done
-[ -n "$out" ] && echo "- [P2] stub finding (ratio.py:2)" > "$out"
-exit "${STUB_CODEX_RC:-0}"
-STUB
-chmod +x "$STUB_BIN/codex"
-export PATH="$STUB_BIN:/usr/bin:/bin"
-
-WT="$TEST_ROOT/wt"; mkdir -p "$WT"; cd "$WT"
-
-reset() { : > "$ENGINE_LOG"; rm -f "$TEST_ROOT/out.txt" "$TEST_ROOT/out.txt.events.jsonl"; }
-
-echo "happy path (non-nested):"
-reset
-env -u CODEX_HOME -u CODEX_SANDBOX -u CODEX_REVIEW_MODEL -u CODEX_REVIEW_EFFORT \
-  -u SSL_CERT_FILE -u CODEX_CODE_MODE_HOST_PATH \
-  "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt"
-LOG="$(cat "$ENGINE_LOG")"
-assert_contains "$LOG" "exec review --base origin/main" "invokes the native review subcommand with the base"
-assert_contains "$LOG" "gpt-5.6-sol" "default model applied"
-assert_contains "$LOG" "xhigh" "default effort applied"
-assert_not_contains "$LOG" "developer_instructions" "pure engine sends no developer instructions"
-assert_not_contains "$LOG" "criteria" "pure engine has no criteria concept in its argv"
-assert_not_contains "$LOG" "SPEC COMPLIANCE" "no spec policy rides the engine"
-assert_not_contains "$LOG" "danger-full-access" "non-nested run never widens the sandbox"
-assert_contains "$LOG" "ENV_CODEX_HOME=$TMPDIR/review-engine-home." "temporary CODEX_HOME stays outside the reviewed tree"
-assert_contains "$LOG" "AUTH_LINK=yes" "auth.json symlinked into the engine home"
-assert_equals "$(find "$TMPDIR" -maxdepth 1 -name 'review-engine-home.*' | wc -l | tr -d ' ')" "0" "engine home removed after the run"
-assert_equals "$(cat "$TEST_ROOT/out.txt")" "- [P2] stub finding (ratio.py:2)" "findings land in --out"
-
-echo "custom CODEX_HOME auth:"
-reset
-CUSTOM_CODEX_HOME="$TEST_ROOT/custom-codex"
-mkdir -p "$CUSTOM_CODEX_HOME"
-echo '{"token":"custom"}' > "$CUSTOM_CODEX_HOME/auth.json"
-CODEX_HOME="$CUSTOM_CODEX_HOME" \
-env -u CODEX_SANDBOX -u SSL_CERT_FILE -u CODEX_CODE_MODE_HOST_PATH \
-  "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt"
-LOG="$(cat "$ENGINE_LOG")"
-assert_contains "$LOG" "AUTH_TARGET=$CUSTOM_CODEX_HOME/auth.json" "auth is inherited from a custom CODEX_HOME"
-
-echo "nested:"
-reset
-CODEX_SANDBOX=seatbelt \
-env -u CODEX_HOME -u SSL_CERT_FILE -u CODEX_CODE_MODE_HOST_PATH \
-  "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt"
-LOG="$(cat "$ENGINE_LOG")"
-assert_contains "$LOG" 'danger-full-access' "nested run skips self-profiling (outer profile confines)"
-assert_contains "$LOG" "ENV_HOST_PATH=$HOME/.local/bin/codex-code-mode-host" "code-mode host path exported"
-assert_contains "$LOG" "ENV_SSL_CERT_FILE=/etc/ssl/cert.pem" "TLS file bundle exported"
-
-echo "only-if-unset env:"
-reset
-env -u CODEX_HOME CODEX_SANDBOX=seatbelt SSL_CERT_FILE=/custom/pem CODEX_CODE_MODE_HOST_PATH=/custom/host \
-  "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt"
-LOG="$(cat "$ENGINE_LOG")"
-assert_contains "$LOG" "ENV_SSL_CERT_FILE=/custom/pem" "pre-set SSL_CERT_FILE preserved"
-assert_contains "$LOG" "ENV_HOST_PATH=/custom/host" "pre-set host path preserved"
-
-echo "rc passthrough:"
-reset
-rc=0; env -u CODEX_HOME STUB_CODEX_RC=3 "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt" || rc=$?
-assert_equals "$rc" "3" "codex rc passes through"
-assert_equals "$(find "$TMPDIR" -maxdepth 1 -name 'review-engine-home.*' | wc -l | tr -d ' ')" "0" "engine home removed even on failure"
-
-echo "usage errors:"
-rc=0; "$ENGINE" --base origin/main 2>/dev/null || rc=$?
-assert_equals "$rc" "2" "missing --out is a usage error"
-rc=0; "$ENGINE" --out "$TEST_ROOT/out.txt" 2>/dev/null || rc=$?
-assert_equals "$rc" "2" "missing --base is a usage error"
-rc=0; "$ENGINE" --base origin/main --criteria "$TEST_ROOT/x.md" --out "$TEST_ROOT/out.txt" 2>/dev/null || rc=$?
-assert_equals "$rc" "2" "retired --criteria flag is a usage error"
-
-echo "codex missing:"
-rc=0; PATH="/usr/bin:/bin" "$ENGINE" --base origin/main --out "$TEST_ROOT/out.txt" 2>/dev/null || rc=$?
-assert_equals "$rc" "127" "missing codex CLI exits 127"
-
-echo
-if [ "$FAILURES" -gt 0 ]; then echo "$FAILURES failure(s)"; exit 1; fi
-echo "all green"
diff --git a/tests/reviewing-prs/test-skill-entrypoint.sh b/tests/reviewing-prs/test-skill-entrypoint.sh
index 8f672c0c30..9191563e21 100755
--- a/tests/reviewing-prs/test-skill-entrypoint.sh
+++ b/tests/reviewing-prs/test-skill-entrypoint.sh
@@ -154,7 +154,7 @@ echo "runtime skill — placeholder set:"
 # MANIFEST_REF is the API binding's addition: dispatch there cannot know the
 # PR's base, so it names the ref the two manifest snapshots were taken from and
 # the worker re-reads them when the base it resolves turns out to differ.
-want_placeholders="{{AUTO_MERGE}} {{BASE_REF}} {{BIND_READY_FILE}} {{BOARD_SCRIPTS}} {{CODEX_REVIEW_EFFORT}} {{CODEX_REVIEW_MODEL}} {{ENV_TRACKER_ISSUE}} {{HEAD_REF}} {{HEAD_SHA}} {{IMPLEMENT_PROTOCOL_FILE}} {{ISSUE_LIST}} {{ISSUE_NUMBER}} {{MANIFEST_REF}} {{PR_NUMBER}} {{PR_URL}} {{REPO}} {{REVIEW_ENGINE}} {{TECH_DEBT_ISSUE}} {{WORKER_NAME}}"
+want_placeholders="{{AUTO_MERGE}} {{BASE_REF}} {{BIND_READY_FILE}} {{BOARD_SCRIPTS}} {{CODEX_REVIEW_EFFORT}} {{CODEX_REVIEW_MODEL}} {{COMPANION_DIR}} {{ENV_TRACKER_ISSUE}} {{HEAD_REF}} {{HEAD_SHA}} {{IMPLEMENT_PROTOCOL_FILE}} {{ISSUE_LIST}} {{ISSUE_NUMBER}} {{MANIFEST_REF}} {{PR_NUMBER}} {{PR_URL}} {{REPO}} {{TECH_DEBT_ISSUE}} {{WORKER_NAME}}"
 got_placeholders="$(grep -o '{{[A-Z_]*}}' "$SKILL" | sort -u | tr '\n' ' ' | sed 's/ $//')"
 if [[ "$got_placeholders" == "$want_placeholders" ]]; then
     pass "runtime placeholder set is exact"
@@ -180,9 +180,21 @@ else
     pass "engine-blocks dir is retired (engine text lives in SKILL.md)"
 fi
 assert_contains "$SKILL" "EXCEPT a needs-human park" "review-tmp survives a park so mid-wave boards persist"
+assert_contains "$SKILL" 'eng_home="$(mktemp -d "<review-tmp>/' "the engine home is created INSIDE <review-tmp>, so cleanup needs no JOIN-time handle on a background shell's variable"
+assert_contains "$SKILL" 'rm -rf <review-tmp>/codex-home.*' "the engine home (codex session state + the auth.json symlink) is removed by glob on every exit"
+assert_contains "$SKILL" "every exit including a" "...park included — the park carve-out preserves wave boards, never engine state"
 assert_not_contains "$SKILL" "Do NOT wait on it" "background-run rule is stated as shape, not double prohibition"
 assert_contains "$SKILL" "the only place engine output is read" "audit independence keeps its positive statement"
 assert_contains "$SKILL" "IN THE BACKGROUND" "engine starts in the background (audit runs concurrently)"
+assert_contains "$SKILL" "CODEX_CODE_MODE_HOST_PATH" "the engine preamble points a nested codex at the code-mode host it cannot resolve"
+assert_contains "$SKILL" "doperpowers:requesting-review" "the route judgment is delegated to the requesting-review skill"
+assert_contains "$SKILL" "retry the panel once" "an interrupted panel verdict retries within the round"
+assert_not_contains "$SKILL" "or a twice-interrupted panel" "the already-retried panel is not re-entered into the fallback's generic retry budget"
+assert_contains "$SKILL" "spent step 4's retry" "a panel whose step 4 retry failed takes the outage path directly (requesting-review's retry-once-then-outage contract)"
+assert_contains "$SKILL" "interrupted again or otherwise" "...however that retry died — a nonzero exit does not re-enter the generic budget"
+assert_contains "$SKILL" "rejection, terminal by construction" "the runtime's terminal sandbox rejection is never retried (the host, not the reviewer, fixes it)"
+assert_not_contains "$SKILL" "--out" "the retired engine's --out flag is absent — round output comes from redirection"
+assert_contains "$SKILL" "shell syntax here, not a ref" "the rendered base ref is checked for shell metacharacters before it is pasted into an engine command"
 assert_contains "$SKILL" "45 minutes" "engine wait is bounded (hung-engine timeout)"
 assert_contains "$SKILL" "ENGINE-UNAVAILABLE" "fallback carries the sweep retry marker"
 assert_contains "$SKILL" "stays in-review" "engine-down never parks needs-human"
@@ -288,7 +300,7 @@ assert_contains "$BOOTSTRAP" "<!-- mode:pr -->" "PR-only prose is fenced into a
 assert_contains "$BOOTSTRAP" "<!-- mode:scale -->" "scale-only prose is fenced into a mode block"
 # ...plus TICKET_BODY_FILE, the api-mode block's assignment file: a claim
 # response is the only route a run has to its own ticket text.
-want_rboot="{{AUTO_MERGE}} {{BASE_REF}} {{BIND_READY_FILE}} {{BOARD_SCRIPTS}} {{CLOSURE_PACKAGE}} {{CODEX_REVIEW_EFFORT}} {{CODEX_REVIEW_MODEL}} {{ENV_TRACKER_ISSUE}} {{HEAD_REF}} {{HEAD_SHA}} {{IMPLEMENT_PROTOCOL_FILE}} {{INTEGRATION_REF}} {{ISSUE_LIST}} {{ISSUE_NUMBER}} {{MANIFEST_REF}} {{PR_NUMBER}} {{PR_URL}} {{REPO_FACTS}} {{REPO}} {{REVIEW_ENGINE}} {{REVIEW_MODE}} {{RISK_MANIFEST}} {{SCALE_RANGE_NOTE}} {{SKILL_FILE}} {{TECH_DEBT_ISSUE}} {{TICKET_BODY_FILE}} {{WORKER_NAME}}"
+want_rboot="{{AUTO_MERGE}} {{BASE_REF}} {{BIND_READY_FILE}} {{BOARD_SCRIPTS}} {{CLOSURE_PACKAGE}} {{CODEX_REVIEW_EFFORT}} {{CODEX_REVIEW_MODEL}} {{COMPANION_DIR}} {{ENV_TRACKER_ISSUE}} {{HEAD_REF}} {{HEAD_SHA}} {{IMPLEMENT_PROTOCOL_FILE}} {{INTEGRATION_REF}} {{ISSUE_LIST}} {{ISSUE_NUMBER}} {{MANIFEST_REF}} {{PR_NUMBER}} {{PR_URL}} {{REPO_FACTS}} {{REPO}} {{REVIEW_MODE}} {{RISK_MANIFEST}} {{SCALE_RANGE_NOTE}} {{SKILL_FILE}} {{TECH_DEBT_ISSUE}} {{TICKET_BODY_FILE}} {{WORKER_NAME}}"
 got_rboot="$(grep -o '{{[A-Z_]*}}' "$BOOTSTRAP" | sort -u | tr '\n' ' ' | sed 's/ $//')"
 if [[ "$got_rboot" == "$want_rboot" ]]; then
     pass "bootstrap placeholder set is exact"