feat(review): retire dry chunks from reverse-audit rounds and pipeline verification

Rebuild of the retirement/pipelining feature as one commit on top of the
merged reverse-audit budget gate (#8468).

- retirement.ts: per-chunk scheduler over the CLI's own prompt records
  and the harness transcripts — a chunk whose two most recent audits are
  substantive dry receipts is cold-checked on the even rounds instead of
  audited on every one, and a cold check that yields returns it to
  every-round auditing. The certifying match is counted records per
  transcript (one launch matching several records certifies none), dry
  receipts are read structurally with the zh forms beside the English
  ones, and a filed finding requires the File+Severity pair so an echoed
  quotation cannot pin a chunk hot. Everything fails toward auditing.

- agent-prompt --all-chunks: requireAuditableChunks, then the schedule
  (round >= 3, fail-open to all-due on any error), then CONVERGED exit 5
  (nothing built, no stamp, no marker), then the budget gate (exit 4 +
  marker), then the build. The admission stamp keeps the #8468 ordering
  and lands only after the build succeeds: a cold-check-only round that
  builds still stamps, a converged round never does, and a build that
  throws leaves no stamp.

- agent-prompt --chunk: a round holding an admission stamp is repaired
  without gates or scheduling; an unadmitted round answers to the same
  sequence as --all-chunks (convergence, then budget), and its first
  chunk build is the round's admission — stamped after the build.

- prompt-record: optional sinceMs fence on readRecordedPrompts (history
  readers only; coverage's obligation reads stay unfenced), plus the
  flattenPrompt/deliveredVerbatim split so the scheduler flattens each
  launch once instead of once per (record, transcript) pair.

- deadline: doc-comments rewritten for the pipelined cadence — the
  admission-to-admission measure no longer contains a verification pass,
  so the tail reserve is the terminal round's only cover (replacing the
  'deliberate margin' overlap rationale), and the workflow's reserve cap
  is cross-referenced. runEpochMs fencing, the bilingual budget-stop
  marker and the stamp semantics are unchanged from #8468.

- SKILL Step 5: builder-owned 3B scheduling, the CONVERGED exit-5
  termination rule, verification launched alongside the next round's
  auditors, and the cumulative reported list with '— [unverified]'
  tagging (added at the admitting merge, cleared or removed after the
  verdict; anything still tagged is excluded from Step 6).

Superseded pieces of the parallel branch were dropped in favour of the
#8468 form now on main: the planMtimeMs-equality fence (runEpochMs
stays), the budget-scaled round-1 estimate, stamping inside the
admission helper, and the branch's variants of the budget-gate tests.

Author: verify

packages/cli/src/commands/review/agent-prompt.test.ts

@@ -53,24 +53,27 @@ export const RESERVE_ENV = 'QWEN_REVIEW_DEADLINE_RESERVE_SECONDS';
  * verification of that round's findings, compose-review, anchor resolution
  * and the submission itself.
  *
- * The measured round estimate ALSO contains one verification pass — a round
- * is admitted only after the previous round's findings were verified and
- * merged (SKILL.md Step 5), so an admission-to-admission span includes the
- * verification between them — which means the gate holds back roughly one
- * verification more than the terminal round strictly needs. That overlap is
- * deliberate margin, not double-entry bookkeeping that slipped: round costs
- * trend UP (each round re-reads the diff against a longer findings list, and
- * repair relaunches land mid-loop), so the previous round's measurement
- * under-predicts the next in exactly the runs that end near the boundary —
- * and the two error directions are not symmetric. Over-reserving ends the
- * loop at most one round early, disclosed as a budget stop; under-reserving
- * is #8368 — killed mid-verification, holding every confirmed finding.
+ * Under the pipelined loop (SKILL.md Step 5), a round's verification
+ * launches WITH the next round's auditors instead of sitting between
+ * admissions — so the admission-to-admission span the gate measures
+ * contains no verification pass, and the terminal round's verification has
+ * exactly one cover: this reserve. That makes the reserve's sizing the
+ * whole margin, not a top-up on an overlap the measurement already
+ * carried, and the two error directions are still not symmetric: round
+ * costs trend UP (each round re-reads the diff against a longer findings
+ * list, and repair relaunches land mid-loop), so the previous round's
+ * measurement under-predicts the next in exactly the runs that end near
+ * the boundary. Over-reserving ends the loop at most one round early,
+ * disclosed as a budget stop; under-reserving is #8368 — killed
+ * mid-verification, holding every confirmed finding.
  *
  * This is only the fallback: the budget itself is
  * chosen outside the CLI (a repository variable, a workflow input, a
  * `/review --timeout=N` comment), so the review workflow passes a reserve
  * scaled to the budget it resolved rather than trusting this constant to fit
- * an arbitrary one. A local run has no deadline and no reserve at all.
+ * an arbitrary one. The workflow caps that scaled reserve at this same
+ * number (`.github/workflows/qwen-code-pr-review.yml`) — keep the two in
+ * sync. A local run has no deadline and no reserve at all.
  */
 export const DEFAULT_RESERVE_SECONDS = 3600;
 
@@ -176,11 +179,12 @@ export function stampRound(
 
 /**
  * What the round about to be admitted is expected to cost, in seconds: the
- * observed cost of the previous round (admission-to-admission — its agents,
- * their verification, the orchestration between) when a stamp exists, else
- * the conservative constant. The span deliberately overlaps the tail
- * reserve by one verification pass — see `DEFAULT_RESERVE_SECONDS` for why
- * that margin is kept rather than netted out. A stamp of the SAME round is
+ * observed cost of the previous round (admission-to-admission — its audit
+ * fan-out and the orchestration around it; under the pipelined loop a
+ * round's verification overlaps the NEXT round instead of sitting between
+ * admissions, so it is not in this measure, and the terminal round's
+ * verification is exactly what the deadline's reserve covers) when a stamp
+ * exists, else the conservative constant. A stamp of the SAME round is
  * ignored — that is a rebuild, and measuring it would report a round as
  * cheap because its prompts were built twice quickly.
  */

packages/cli/src/commands/review/agent-prompt.ts

@@ -27,7 +27,13 @@
 // agent's actual launch prompt. The two artifacts have different authors, and
 // neither is the orchestrator.
 
-import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import {
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
 import { dirname, join, basename, resolve } from 'node:path';
 
 /**
@@ -128,8 +134,24 @@ export function recordPrompt(
   }
 }
 
-/** Every prompt this plan's builder emitted, keyed as it was recorded. */
-export function readRecordedPrompts(planPath: string): Map<string, string> {
+/**
+ * Every prompt this plan's builder emitted, keyed as it was recorded.
+ *
+ * `sinceMs` is the same fence every other reader of this directory applies —
+ * the plan's mtime. Nothing clears the record dir, and a run that dies
+ * mid-review leaves its records beside the retry's (the CI retry re-runs the
+ * review at the SAME plan path, under a freshly-captured plan): a record file
+ * older than the plan belongs to that dead attempt. A caller that reads
+ * records as OBLIGATIONS (coverage: "an agent was owed for this key") passes
+ * nothing — an obligation is not less owed for being stale, and dropping one
+ * would excuse the agent it demands. A caller that reads them as HISTORY
+ * (retirement) must pass the fence, or the dead attempt's records shadow the
+ * live ones.
+ */
+export function readRecordedPrompts(
+  planPath: string,
+  sinceMs?: number,
+): Map<string, string> {
   const out = new Map<string, string>();
   const dir = promptRecordDir(planPath);
   let names: string[];
@@ -150,7 +172,9 @@ export function readRecordedPrompts(planPath: string): Map<string, string> {
       } catch {
         continue; // Not a name this module wrote.
       }
-      out.set(key, readFileSync(join(dir, name), 'utf8'));
+      const file = join(dir, name);
+      if (sinceMs !== undefined && statSync(file).mtimeMs < sinceMs) continue;
+      out.set(key, readFileSync(file, 'utf8'));
     } catch {
       /* raced with a cleanup */
     }
@@ -186,6 +210,22 @@ export function readRecordedPrompts(planPath: string): Map<string, string> {
 export function wasDeliveredVerbatim(
   launchPrompt: string,
   built: string,
+): boolean {
+  return deliveredVerbatim(flattenPrompt(launchPrompt), built);
+}
+
+/**
+ * `wasDeliveredVerbatim` with the launch prompt already put through
+ * `flattenPrompt`. The pair exists for the one caller that pairs MANY records
+ * against MANY transcripts (the retirement scheduler): flattening is the
+ * expensive half of the check, and a caller that flattens each launch once
+ * pays it per transcript instead of per (record, transcript) pair — a few
+ * thousand full-prompt passes on the run the scheduler was built for, all
+ * before the round is admitted. Same contract, same failure modes.
+ */
+export function deliveredVerbatim(
+  flattenedLaunch: string,
+  built: string,
 ): boolean {
   // A zero-byte record is not a prompt, and the loop below would be vacuously true
   // for it — the check would pass every agent, and the roster would credit a role
@@ -194,25 +234,27 @@ export function wasDeliveredVerbatim(
   // *built*), so an empty file is exactly what a partial write leaves behind. It is
   // the one input that must fail closed.
   if (built.trim().length === 0) return false;
-  const delivered = flatten(launchPrompt);
   let at = 0;
   for (const line of lines(built)) {
-    const i = delivered.indexOf(line, at);
+    const i = flattenedLaunch.indexOf(line, at);
     if (i === -1) return false;
     at = i + line.length;
   }
   return true;
 }
 
-/** Whitespace collapsed to single spaces: a re-wrap is not an edit. */
-function flatten(s: string): string {
+/**
+ * Whitespace collapsed to single spaces: a re-wrap is not an edit. What
+ * `deliveredVerbatim` expects its launch side to have been put through.
+ */
+export function flattenPrompt(s: string): string {
   return s.replace(/\s+/g, ' ').trim();
 }
 
 /** The built prompt's lines, whitespace-normalized, blanks dropped. */
 function lines(built: string): string[] {
   return built
     .split('\n')
-    .map((l) => flatten(l))
+    .map((l) => flattenPrompt(l))
     .filter((l) => l.length > 0);
 }