Merge remote-tracking branch 'origin/capy/fixwave-baseline-repairs' into capy/audit-fix-wave

scripts/resolvers/qa.ts

@@ -71,7 +71,7 @@ Write a **charter** per behavior: contract, risk, entrypoint, isolation, exit co
 
 ${reportOnly ? '' : `For /review and /ship, no plan/server is required.
 Stop after 5 minutes or 12 probes, whichever comes first (SECONDS=300 across surfaces).
-Explicit plan checks remain required beyond this smoke budget.`}
+Explicit plan checks and revalidation remain required beyond this smoke budget.`}
 For /qa and /qa-only:
 - Browser Quick: SECONDS=30. Browser Full/Regression: SECONDS=900.
 - Functional Full, Quick and Regression have no default total timer.
@@ -126,7 +126,7 @@ ${reportOnly ? `   For guarded text, copy the complete span between the guard's
    Another input or a regression test is not that replay.
 ${reportOnly ? `5. If the user or another process changes source, commands or fixtures, review the affected
    contracts and return to step 2 for each affected revalidation. Do not make product changes yourself.
-   Keep the original limits/notes; update outcomes only from fresh evidence.` : `5. After source/commands/fixtures change, repeat affected review and return to step 2 for each affected revalidation. Keep limits/notes; status requires fresh evidence.`}
+   Keep the original limits/notes; update outcomes only from fresh evidence.` : `5. After source/commands/fixtures change, re-review and return to step 2 for each affected revalidation. Keep limits/notes; status requires fresh evidence.`}
 
 ## 3. Parent handoff
 
@@ -255,9 +255,9 @@ Never install, import cookies or bootstrap tests. Functional-only skips browser
 - Required: plan commands/assertions, listed separately. Other ideas are optional, untested.
 
 **3. Run smoke and plan checks.**
-Follow the shared Probe loop for smoke checks, replays and revalidation until the smoke limit.
-Then run required plan checks, even after smoke expires, using the same procedure but no smoke guard; never reset the clock.
-Use finite command timeouts, capped at the caller's remaining time if it has a deadline.
+Follow the shared Probe loop for smoke checks and replays until the smoke limit.
+Then run required plan checks and revalidation, even after smoke expires, using the same procedure but no smoke guard; never reset the clock.
+Use finite command timeouts, capped at the caller's remaining time if it has a deadline.${ship ? '' : ' /review sets none; only an invoker-supplied EARLIER_UTC counts.'}
 Await clock/guard results before acting. When the caller's deadline expires, mark unfinished checks not-run.
 
 **4. Check freshness before reporting.**
@@ -275,7 +275,8 @@ Return verified defects to Fix-First: \`path\`, \`line\`, \`category\`,
 \`fingerprint: path:line:category\`, replay, \`test_stub\`. Use checklist severity;
 unmatched functional failures are \`functional-contract\`, \`CRITICAL\`.
 Setup/permission blockers are not defects. Test creation needs user approval.
-${ship ? 'Step 9.4 asks: permission/repair or explicit named-risk acceptance; otherwise blocked.' : 'Ask for setup/permission, never secrets. Unresolved coverage makes Step 5.8 incomplete; a ship waiver cannot complete it.'}
+${ship ? 'Step 9.4 asks: permission/repair or explicit named-risk acceptance; otherwise blocked.' : `Ask only for a named permission or setup the user performs, never secrets. Report-only /review never runs setup, installs or cookie import, even after approval.
+After a grant, recheck readiness and run affected checks; otherwise they stay blocked. Unresolved coverage makes Step 5.8 incomplete; a ship waiver cannot complete it.`}
 
 ${ship ? `Read QA's \`templates/functional-report-template.md\`: PR section \`## Exploratory QA\`,
 fields as subsections. Link every checkpoint; no second report. Separate browser results;

scripts/resolvers/review.ts

@@ -1483,8 +1483,9 @@ done
 3. **Validation:** For search results, read the first 20 lines and verify the project, feature and current branch. A mismatch means "no plan file found." Conversation-supplied paths bypass this search-result check.
 
 **Error handling:**
-- No plan file found → skip with "No plan file detected — skipping."
-${ship ? '- Plan file found but unreadable (permissions, encoding) → return an audit error to the parent. Do not report no plan or successful zero counts; the parent applies its audit-failure recovery and skip/stop decision.' : '- Plan file found but unreadable (permissions, encoding) → skip with "Plan file found but unreadable — skipping."'}`;
+${ship ? `- No plan file found → skip with "No plan file detected — skipping."
+- Plan file found but unreadable (permissions, encoding) → return an audit error to the parent. Do not report no plan or successful zero counts; the parent applies its audit-failure recovery and skip/stop decision.` : `- No plan file found → say "No plan file detected." and use the Fallback Intent Sources below.
+- Plan file found but unreadable (permissions, encoding) → say "Plan file found but unreadable." and use the Fallback Intent Sources below; never report plan items as verified.`}`;
 }
 
 // ─── Plan Completion Audit ────────────────────────────────────────────
@@ -1723,13 +1724,15 @@ The plan completion results augment the existing Scope Drift Detection. If a pla
 
 - **NOT DONE items** become additional evidence for **MISSING REQUIREMENTS** in the scope drift report.
 - **Items in the diff that don't match any plan item** become evidence for **SCOPE CREEP** detection.
-- **HIGH-impact discrepancies** trigger AskUserQuestion:
+- **HIGH-impact plan-file discrepancies** trigger AskUserQuestion:
   - Show the investigation findings
   - Options: A) Stop this review for implementation, B) Continue this review with P1 TODOs, C) Record the items as intentionally dropped
   - A ends this invocation before code review or implementation. List the missing work; after implementation, start a fresh /review.
   - B queues the approved TODO changes for Step 5, not this read-only audit. B/C continue to the final Scope Check and Step 2. None of these choices authorizes shipping or waives required verification.
 
-This is **INFORMATIONAL** unless HIGH-impact discrepancies are found (then it gates via AskUserQuestion).
+This is **INFORMATIONAL** unless HIGH-impact plan-file discrepancies are found (then it gates via AskUserQuestion).
+Discrepancies derived only from fallback sources (commit messages, TODOS.md, PR description) never trigger
+this question, whatever their IMPACT: report them in the Scope Check as lower-confidence missing requirements.
 
 When continuing after the audit (no HIGH-impact gate, or option B/C), emit the
 single final Scope Check using Step 1.5's provisional notes and this plan context: