diff --git a/contracts/review-integration/v2/fixtures/capabilities.fixture.json b/contracts/review-integration/v2/fixtures/capabilities.fixture.json
new file mode 100644
index 000000000..bbe3fa39b
--- /dev/null
+++ b/contracts/review-integration/v2/fixtures/capabilities.fixture.json
@@ -0,0 +1,111 @@
+{
+  "schema": "gentle-ai.review-integration.capabilities/v2",
+  "contract": "gentle-ai.review-integration/v2",
+  "protocol": {"major": 2, "minor": 0},
+  "package": {"name": "gentle-ai", "version": "2.1.7-test", "release_channel": "prerelease"},
+  "build": {
+    "id": "sha256:444a9f0608eb22c4697fd2092f3afcfab040c0918343e7e04087730fd33fd5e1",
+    "go_version": "go1.25.10",
+    "module_version": "v2.1.7",
+    "vcs": "git",
+    "vcs_revision": "0123456789abcdef0123456789abcdef01234567",
+    "vcs_time": "2026-07-15T18:00:00Z",
+    "vcs_modified": "false"
+  },
+  "executable": {
+    "sha256": "sha256:dcc846103b16d365eaeeb9d7f289c23fc4f2897f23def1cb3fe7f05557b64705",
+    "evidence": "self-reported",
+    "verification": "compare-with-published-manifest"
+  },
+  "operations": [
+    "review.bind_sdd", "review.capabilities", "review.finalize", "review.repair",
+    "review.retry_final_verification", "review.start", "review.status", "review.validate"
+  ],
+  "gates": ["post-apply", "pre-commit", "pre-push", "pre-pr", "release"],
+  "projections": ["staged", "workspace"],
+  "schemas": [
+    "gentle-ai.review-admitted-result/v2",
+    "gentle-ai.review-artifact-subject/v2",
+    "gentle-ai.review-authority-repair-assessment/v1",
+    "gentle-ai.review-authority-status/v1",
+    "gentle-ai.review-gate-request/v1",
+    "gentle-ai.review-integration.capabilities/v2",
+    "gentle-ai.review-integration.failure/v2",
+    "gentle-ai.review-final-verification-incident/v1",
+    "gentle-ai.review-integration.operation/v2",
+    "gentle-ai.review-integration.projection/v1",
+    "gentle-ai.review-integration.repair/v2",
+    "gentle-ai.review-integration.start/v3",
+    "gentle-ai.review-integration.status/v3",
+    "gentle-ai.review-receipt/v1",
+    "gentle-ai.review-receipt/v2",
+    "gentle-ai.review-result-artifact/v2",
+    "gentle-ai.review-targeted-validation-request/v1",
+    "gentle-ai.review-verification-evidence/v2",
+    "https://gentle-ai.dev/schema/review/refuter/v1",
+    "https://gentle-ai.dev/schema/review/reviewer/v1",
+    "https://gentle-ai.dev/schema/review/validator/v1",
+    "gentle-ai.review-integration.consent/v2"
+  ],
+  "features": {
+    "mandatory": [
+      {"name": "compact_v2_authority", "supported": true, "requires": []},
+      {"name": "exact_receipt_replay", "supported": true, "requires": ["compact_v2_authority"]},
+      {"name": "five_delivery_gates", "supported": true, "requires": ["compact_v2_authority"]},
+      {"name": "immutable_snapshot", "supported": true, "requires": []},
+      {"name": "legacy_v1_target_scoped_read_only", "supported": true, "requires": ["target_scoped_status"]},
+      {"name": "repository_independent_capabilities", "supported": true, "requires": []},
+      {"name": "restart_safe_projection", "supported": true, "requires": ["target_scoped_status"]},
+      {"name": "sdd_receipt_binding", "supported": true, "requires": ["compact_v2_authority"]},
+      {"name": "target_scoped_status", "supported": true, "requires": ["repository_independent_capabilities"]},
+      {"name": "uniform_failure_envelope", "supported": true, "requires": ["repository_independent_capabilities"]}
+    ],
+    "optional": [
+      {"name": "base_ref_workspace_overlay", "supported": true, "requires": ["immutable_snapshot", "restart_safe_projection"]},
+      {"name": "bounded_process_waits", "supported": true, "requires": ["uniform_failure_envelope"]},
+      {"name": "classified_authority_repair", "supported": true, "requires": ["native_next_transition", "uniform_failure_envelope"]},
+      {"name": "exact_gate_receipt_discovery", "supported": true, "requires": ["five_delivery_gates"]},
+      {"name": "native_frozen_candidate_context", "supported": true, "requires": ["immutable_snapshot"]},
+      {"name": "native_low_risk_verification", "supported": true, "requires": ["compact_v2_authority"]},
+      {"name": "native_next_transition", "supported": true, "requires": ["target_scoped_status"]},
+      {"name": "one_shot_final_verification_retry", "supported": true, "requires": ["compact_v2_authority", "exact_receipt_replay", "native_next_transition"]},
+      {"name": "opaque_repository_context", "supported": true, "requires": ["compact_v2_authority", "native_next_transition"]},
+      {"name": "outcome_bound_verification_evidence", "supported": true, "requires": ["compact_v2_authority", "native_next_transition"]},
+      {"name": "provider_artifact_admission", "supported": true, "requires": ["compact_v2_authority", "native_frozen_candidate_context", "opaque_repository_context"]},
+      {"name": "provider_targeted_validation_request", "supported": true, "requires": ["compact_v2_authority", "native_next_transition"]},
+      {"name": "recovered_correction_evidence", "supported": true, "requires": ["compact_v2_authority", "provider_targeted_validation_request"]},
+      {"name": "risk_reasons", "supported": true, "requires": ["repository_independent_capabilities"]},
+      {"name": "scope_change_diagnostics", "supported": true, "requires": ["uniform_failure_envelope"]},
+      {"name": "validating_result_reopen", "supported": true, "requires": ["compact_v2_authority", "provider_artifact_admission"]},
+      {"name": "provider_bound_native_git_context", "supported": true, "requires": ["native_frozen_candidate_context", "opaque_repository_context", "provider_artifact_admission"]}
+    ]
+  },
+  "bootstrap": {
+    "command": "gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v2 --next-transition",
+    "target_selector_variants": [
+      {"target_type": "staged", "arguments": ["--projection", "staged"]},
+      {"target_type": "base_ref", "arguments": ["--base-ref", "\u003cref\u003e"]},
+      {"target_type": "workspace_overlay_base_ref", "arguments": ["--workspace-overlay", "--base-ref", "\u003cref\u003e"]},
+      {"target_type": "workspace_overlay_base_tree", "arguments": ["--workspace-overlay", "--base-tree", "\u003ctree\u003e"]}
+    ],
+    "required_feature": "native_next_transition",
+    "unsupported_outcome": "unsupported-capability",
+    "parent_only": true
+  },
+  "compatibility": {
+    "minimum_protocol_major": 2,
+    "maximum_protocol_major": 2,
+    "additive_minor_policy": "optional-fields-only",
+    "unknown_mandatory": "reject",
+    "unknown_optional": "ignore",
+    "modes": ["compact-v2", "legacy-v1"],
+    "legacy_window": {
+      "mode": "legacy-v1",
+      "state": "active",
+      "read_only": true,
+      "deprecation_started": true,
+      "removal": "not-scheduled",
+      "minimum_compatibility_releases": 1
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/fixtures/consent.fixture.json b/contracts/review-integration/v2/fixtures/consent.fixture.json
new file mode 100644
index 000000000..353014607
--- /dev/null
+++ b/contracts/review-integration/v2/fixtures/consent.fixture.json
@@ -0,0 +1,36 @@
+{
+  "schema": "gentle-ai.review-integration.consent/v2",
+  "contract": "gentle-ai.review-integration/v2",
+  "operation": "review.start",
+  "action": "consent_required",
+  "blocking": true,
+  "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5",
+  "projection": "workspace",
+  "risk_level": "high",
+  "changed_files": 1,
+  "changed_lines": 1,
+  "headline": "Gentle AI can review this change before you call it done.",
+  "reason": "this change gets a deeper review because it touches shell scripting in scripts/deploy.sh.",
+  "value": "Reviewing takes a bit longer, and it makes the result substantially safer.",
+  "risk_evidence": [
+    "shell scripting in scripts/deploy.sh"
+  ],
+  "choices": [
+    {
+      "answer": "granted",
+      "label": "Run the review now",
+      "effect": "Reviews this candidate now and records the one-time question as answered, so future candidates are reviewed without asking again.",
+      "invocation": "gentle-ai review start --contract gentle-ai.review-integration/v2 --cwd /repo --target sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5 --projection workspace --lineage review-consent-fixture --consent granted"
+    },
+    {
+      "answer": "declined",
+      "label": "Not now, just this once",
+      "effect": "Skips the review for this candidate only; nothing is persisted and the next candidate is asked again. This is not the kill switch.",
+      "invocation": "gentle-ai review start --contract gentle-ai.review-integration/v2 --cwd /repo --target sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5 --projection workspace --lineage review-consent-fixture --consent declined"
+    }
+  ],
+  "off_path": {
+    "note": "To turn reviews off for good, run 'gentle-ai review mode disable'.",
+    "command": "gentle-ai review mode disable"
+  }
+}
diff --git a/contracts/review-integration/v2/fixtures/start.fixture.json b/contracts/review-integration/v2/fixtures/start.fixture.json
new file mode 100644
index 000000000..cfddffefd
--- /dev/null
+++ b/contracts/review-integration/v2/fixtures/start.fixture.json
@@ -0,0 +1,93 @@
+{
+  "schema": "gentle-ai.review-integration.start/v3",
+  "contract": "gentle-ai.review-integration/v2",
+  "operation": "review.start",
+  "action": "created",
+  "lenses_required": true,
+  "lineage_id": "review-start-fixture",
+  "state": "reviewing",
+  "risk_level": "high",
+  "selected_lenses": [
+    "review-risk",
+    "review-resilience",
+    "review-readability",
+    "review-reliability"
+  ],
+  "projection": "workspace",
+  "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+  "candidate_tree": "556e838994d4e5669ffafda7b72226598bc38297",
+  "changed_files": 1,
+  "changed_lines": 1,
+  "correction_budget": 1,
+  "risk_reasons": [
+    {"code": "shell_source", "signal": "shell_process", "path": "scripts/deploy.sh"}
+  ],
+  "artifact_subjects": [
+    {
+      "schema": "gentle-ai.review-artifact-subject/v2",
+      "subject_hash": "sha256:2ec775b2a519da488fd76212470e9e42160179e394cfae2819f1f8ac3c7842e0",
+      "lineage_id": "review-start-fixture",
+      "authority_revision": "sha256:3411d049f39e891b50adfc76473199b473927d10245a227a3bc967eae0caf68c",
+      "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5",
+      "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+      "candidate_tree": "556e838994d4e5669ffafda7b72226598bc38297",
+      "changed_path_manifest_sha256": "sha256:049219ea30e21c409608ea8527e65bcc6774d764363031a6cf0cb05e35c734ef",
+      "lens": "review-risk",
+      "selected_order": 0
+    },
+    {
+      "schema": "gentle-ai.review-artifact-subject/v2",
+      "subject_hash": "sha256:1800117ac48276e0039e3791287aed7af08ee65112476f9f0cbe5d11ca1044fe",
+      "lineage_id": "review-start-fixture",
+      "authority_revision": "sha256:3411d049f39e891b50adfc76473199b473927d10245a227a3bc967eae0caf68c",
+      "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5",
+      "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+      "candidate_tree": "556e838994d4e5669ffafda7b72226598bc38297",
+      "changed_path_manifest_sha256": "sha256:049219ea30e21c409608ea8527e65bcc6774d764363031a6cf0cb05e35c734ef",
+      "lens": "review-resilience",
+      "selected_order": 1
+    },
+    {
+      "schema": "gentle-ai.review-artifact-subject/v2",
+      "subject_hash": "sha256:b426bc54f5f4f3ea446a84b7957e14492c803e8748f07425cd2e0652b485d7a5",
+      "lineage_id": "review-start-fixture",
+      "authority_revision": "sha256:3411d049f39e891b50adfc76473199b473927d10245a227a3bc967eae0caf68c",
+      "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5",
+      "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+      "candidate_tree": "556e838994d4e5669ffafda7b72226598bc38297",
+      "changed_path_manifest_sha256": "sha256:049219ea30e21c409608ea8527e65bcc6774d764363031a6cf0cb05e35c734ef",
+      "lens": "review-readability",
+      "selected_order": 2
+    },
+    {
+      "schema": "gentle-ai.review-artifact-subject/v2",
+      "subject_hash": "sha256:1b43f90a9391e996e28d478c0aef85b1fd26229c1ccb2ef8bc56b418ab0b4a7f",
+      "lineage_id": "review-start-fixture",
+      "authority_revision": "sha256:3411d049f39e891b50adfc76473199b473927d10245a227a3bc967eae0caf68c",
+      "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5",
+      "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+      "candidate_tree": "556e838994d4e5669ffafda7b72226598bc38297",
+      "changed_path_manifest_sha256": "sha256:049219ea30e21c409608ea8527e65bcc6774d764363031a6cf0cb05e35c734ef",
+      "lens": "review-reliability",
+      "selected_order": 3
+    }
+  ],
+  "changed_path_manifest": [
+    {
+      "path": "scripts/deploy.sh",
+      "status": "A",
+      "old_mode": "000000",
+      "new_mode": "100644",
+      "deleted": false,
+      "type_changed": false,
+      "mode_only": false,
+      "intended_untracked": true
+    }
+  ],
+  "repository_context": {
+    "capability": "review.opaque_repository_context",
+    "handle": "rctx1_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "revision": "sha256:3411d049f39e891b50adfc76473199b473927d10245a227a3bc967eae0caf68c",
+    "target_identity": "sha256:136dc6556e3bac8c2e7f7af7cc5ec361f449e383a997638128729059fefa06a5"
+  }
+}
diff --git a/contracts/review-integration/v2/fixtures/status.fixture.json b/contracts/review-integration/v2/fixtures/status.fixture.json
new file mode 100644
index 000000000..4c21fe83b
--- /dev/null
+++ b/contracts/review-integration/v2/fixtures/status.fixture.json
@@ -0,0 +1,113 @@
+{
+  "schema": "gentle-ai.review-integration.status/v3",
+  "contract": "gentle-ai.review-integration/v2",
+  "operation": "review.status",
+  "applicability": "current_target",
+  "authority": {
+    "version": "compact-v2",
+    "lineage_id": "review-status-fixture",
+    "state": "reviewing",
+    "generation": 1,
+    "revision": "sha256:81cdad8f3182d4919147d3c4fe8f614814068e5ef68417e3dcbd5e326dd3e390"
+  },
+  "receipt": {"status": "expected_missing"},
+  "action": "finalize",
+  "replayability": "not_replayable",
+  "frozen": {"tier": "medium", "original_changed_lines": 2, "correction_budget": 1},
+  "target_identity": "sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6",
+  "projection": {
+    "schema": "gentle-ai.review-integration.projection/v1",
+    "kind": "current-changes",
+    "projection": "workspace",
+    "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+    "initial_review_tree": "1c3325617279b38743f073302ba190fc421b5a09",
+    "current_candidate_tree": "1c3325617279b38743f073302ba190fc421b5a09",
+    "paths_digest": "sha256:b93fca961a97d240c2b7023e98772f49ebd2995eda7db07043270b57bed75d71",
+    "paths": ["tracked.txt"],
+    "intended_untracked": [],
+    "intended_untracked_proof": "sha256:b97229718d4c7fe50a8892eb474ae5aa6491697bccb400e3e31dbaca4894d2f3",
+    "initial_snapshot_identity": "sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6",
+    "current_snapshot_identity": "sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6"
+  },
+  "repair": {
+    "schema": "gentle-ai.review-authority-repair-assessment/v1",
+    "status": "unsupported",
+    "counts": {
+      "lineages": 0,
+      "compact_lineages": 0,
+      "legacy_lineages": 0,
+      "events": 0,
+      "bytes": 0,
+      "eligible_candidates": 0,
+      "unsupported_lineages": 0,
+      "conflicts": 0
+    },
+    "supported_operations": ["review/complete-fix", "review/validate-fix"],
+    "authorization_schema": "gentle-ai.review-repair-authorization/v1"
+  },
+  "candidates": [],
+  "next_transition": {
+    "kind": "collect",
+    "reason_code": "reviewer_results_required",
+    "collect": {
+      "inputs": [
+        {
+          "name": "reviewer_result",
+          "schema": "https://gentle-ai.dev/schema/review/reviewer/v1",
+          "capture_operation": "review.capture-result",
+          "arguments": [
+            {"name": "lineage", "value": "review-status-fixture", "token": "--lineage=review-status-fixture"},
+            {
+              "name": "expected-revision",
+              "value": "sha256:81cdad8f3182d4919147d3c4fe8f614814068e5ef68417e3dcbd5e326dd3e390",
+              "token": "--expected-revision=sha256:81cdad8f3182d4919147d3c4fe8f614814068e5ef68417e3dcbd5e326dd3e390"
+            },
+            {
+              "name": "target",
+              "value": "sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6",
+              "token": "--target=sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6"
+            },
+            {
+              "name": "repository-context",
+              "value": "rctx1_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+              "token": "--repository-context=rctx1_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+            },
+            {"name": "lens", "value": "review-reliability", "token": "--lens=review-reliability"},
+            {"name": "order", "value": "0", "token": "--order=0"},
+            {
+              "name": "subject-hash",
+              "value": "sha256:34c226ef1586f0c77b30311320d4d2529819097fbb073ee31634f4d87a19da6a",
+              "token": "--subject-hash=sha256:34c226ef1586f0c77b30311320d4d2529819097fbb073ee31634f4d87a19da6a"
+            }
+          ],
+          "artifact_subject": {
+            "schema": "gentle-ai.review-artifact-subject/v2",
+            "subject_hash": "sha256:34c226ef1586f0c77b30311320d4d2529819097fbb073ee31634f4d87a19da6a",
+            "lineage_id": "review-status-fixture",
+            "authority_revision": "sha256:81cdad8f3182d4919147d3c4fe8f614814068e5ef68417e3dcbd5e326dd3e390",
+            "target_identity": "sha256:e6faad1cb9ceb2db170e0ec9ea5394b44c3991dff6cbd02fb6787539715968f6",
+            "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+            "candidate_tree": "1c3325617279b38743f073302ba190fc421b5a09",
+            "changed_path_manifest_sha256": "sha256:64d028ff676fb4ef10f2d4a3488d568854b364b4cc4399578b5932d144d2347b",
+            "lens": "review-reliability",
+            "selected_order": 0
+          },
+          "base_tree": "3e21a205dd9b55021aeae87965092623807e455f",
+          "candidate_tree": "1c3325617279b38743f073302ba190fc421b5a09",
+          "changed_path_manifest": [
+            {
+              "path": "tracked.txt",
+              "status": "M",
+              "old_mode": "100644",
+              "new_mode": "100644",
+              "deleted": false,
+              "type_changed": false,
+              "mode_only": false,
+              "intended_untracked": false
+            }
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/admitted-result.schema.json b/contracts/review-integration/v2/schemas/admitted-result.schema.json
new file mode 100644
index 000000000..d5af2b263
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/admitted-result.schema.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/admitted-result.schema.json",
+  "title": "Gentle AI provider-admitted native Git reviewer result v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "subject", "admission", "result"],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-admitted-result/v2"},
+    "subject": {"$ref": "artifact-subject.schema.json"},
+    "admission": {"$ref": "../../v1/schemas/admitted-result.schema.json#/$defs/admission"},
+    "result": {"type": "object"}
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/artifact-subject.schema.json b/contracts/review-integration/v2/schemas/artifact-subject.schema.json
new file mode 100644
index 000000000..43a8ed099
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/artifact-subject.schema.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/artifact-subject.schema.json",
+  "title": "Gentle AI provider-owned native Git reviewer artifact subject v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "subject_hash",
+    "lineage_id",
+    "authority_revision",
+    "target_identity",
+    "base_tree",
+    "candidate_tree",
+    "changed_path_manifest_sha256",
+    "lens",
+    "selected_order"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-artifact-subject/v2"},
+    "subject_hash": {"$ref": "#/$defs/sha256"},
+    "lineage_id": {"type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"},
+    "authority_revision": {"$ref": "#/$defs/sha256"},
+    "target_identity": {"$ref": "#/$defs/sha256"},
+    "base_tree": {"$ref": "#/$defs/git_tree"},
+    "candidate_tree": {"$ref": "#/$defs/git_tree"},
+    "changed_path_manifest_sha256": {"$ref": "#/$defs/sha256"},
+    "lens": {"enum": ["review-risk", "review-resilience", "review-readability", "review-reliability"]},
+    "selected_order": {"type": "integer", "minimum": 0, "maximum": 3},
+    "correction_target_identity": {"$ref": "#/$defs/sha256"}
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "git_tree": {"type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"}
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/capabilities.schema.json b/contracts/review-integration/v2/schemas/capabilities.schema.json
new file mode 100644
index 000000000..7459f50bd
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/capabilities.schema.json
@@ -0,0 +1,111 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/capabilities.schema.json",
+  "title": "Gentle AI review integration capabilities protocol 2.0",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "contract", "protocol", "package", "build", "executable", "operations", "gates",
+    "projections", "schemas", "features", "compatibility"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.capabilities/v2"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "protocol": {
+      "type": "object", "additionalProperties": false, "required": ["major", "minor"],
+      "properties": {"major": {"const": 2}, "minor": {"const": 0}}
+    },
+    "package": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/package"},
+    "build": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/build"},
+    "executable": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/executable"},
+    "operations": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/operations"},
+    "gates": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/gates"},
+    "projections": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/projections"},
+    "schemas": {
+      "type": "array", "minItems": 22, "maxItems": 22, "uniqueItems": true,
+      "items": {
+        "enum": [
+          "gentle-ai.review-admitted-result/v2",
+          "gentle-ai.review-artifact-subject/v2",
+          "gentle-ai.review-authority-repair-assessment/v1",
+          "gentle-ai.review-authority-status/v1",
+          "gentle-ai.review-gate-request/v1",
+          "gentle-ai.review-integration.capabilities/v2",
+          "gentle-ai.review-integration.consent/v2",
+          "gentle-ai.review-integration.failure/v2",
+          "gentle-ai.review-final-verification-incident/v1",
+          "gentle-ai.review-integration.operation/v2",
+          "gentle-ai.review-integration.projection/v1",
+          "gentle-ai.review-integration.repair/v2",
+          "gentle-ai.review-integration.start/v3",
+          "gentle-ai.review-integration.status/v3",
+          "gentle-ai.review-receipt/v1",
+          "gentle-ai.review-receipt/v2",
+          "gentle-ai.review-result-artifact/v2",
+          "gentle-ai.review-targeted-validation-request/v1",
+          "gentle-ai.review-verification-evidence/v2",
+          "https://gentle-ai.dev/schema/review/refuter/v1",
+          "https://gentle-ai.dev/schema/review/reviewer/v1",
+          "https://gentle-ai.dev/schema/review/validator/v1"
+        ]
+      }
+    },
+    "features": {
+      "type": "object", "additionalProperties": false, "required": ["mandatory", "optional"],
+      "properties": {
+        "mandatory": {"type": "array", "minItems": 10, "maxItems": 10, "items": {"$ref": "#/$defs/feature"}},
+        "optional": {"type": "array", "minItems": 17, "maxItems": 17, "items": {"$ref": "#/$defs/feature"}}
+      }
+    },
+    "bootstrap": {"$ref": "#/$defs/bootstrap"},
+    "compatibility": {
+      "type": "object", "additionalProperties": false,
+      "required": [
+        "minimum_protocol_major", "maximum_protocol_major", "additive_minor_policy", "unknown_mandatory",
+        "unknown_optional", "modes", "legacy_window"
+      ],
+      "properties": {
+        "minimum_protocol_major": {"const": 2},
+        "maximum_protocol_major": {"const": 2},
+        "additive_minor_policy": {"const": "optional-fields-only"},
+        "unknown_mandatory": {"const": "reject"},
+        "unknown_optional": {"const": "ignore"},
+        "modes": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/compatibility/properties/modes"},
+        "legacy_window": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/properties/compatibility/properties/legacy_window"}
+      }
+    }
+  },
+  "$defs": {
+    "feature": {
+      "type": "object", "additionalProperties": false, "required": ["name", "supported", "requires"],
+      "properties": {
+        "name": {
+          "enum": [
+            "base_ref_workspace_overlay", "bounded_process_waits", "classified_authority_repair", "compact_v2_authority",
+            "exact_gate_receipt_discovery", "exact_receipt_replay", "five_delivery_gates", "immutable_snapshot",
+            "legacy_v1_target_scoped_read_only", "native_frozen_candidate_context", "native_low_risk_verification",
+            "native_next_transition", "one_shot_final_verification_retry", "opaque_repository_context",
+            "outcome_bound_verification_evidence",
+            "provider_artifact_admission", "provider_bound_native_git_context", "provider_targeted_validation_request",
+            "recovered_correction_evidence", "repository_independent_capabilities", "restart_safe_projection", "risk_reasons",
+            "scope_change_diagnostics", "sdd_receipt_binding", "target_scoped_status", "uniform_failure_envelope",
+            "validating_result_reopen"
+          ]
+        },
+        "supported": {"type": "boolean"},
+        "requires": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}
+      }
+    },
+    "bootstrap": {
+      "type": "object", "additionalProperties": false,
+      "required": ["command", "target_selector_variants", "required_feature", "unsupported_outcome", "parent_only"],
+      "properties": {
+        "command": {"const": "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition"},
+        "target_selector_variants": {"$ref": "../../v1/schemas/capabilities-v1.4.schema.json#/$defs/bootstrap/properties/target_selector_variants"},
+        "required_feature": {"const": "native_next_transition"},
+        "unsupported_outcome": {"const": "unsupported-capability"},
+        "parent_only": {"const": true}
+      }
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/consent.schema.json b/contracts/review-integration/v2/schemas/consent.schema.json
new file mode 100644
index 000000000..d2fb5b6da
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/consent.schema.json
@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/consent.schema.json",
+  "title": "Gentle AI negotiated review v2 consent question",
+  "description": "The typed per-candidate blocking consent question emitted by negotiated v2 START when the caller declared --consent relay.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "contract", "operation", "action", "blocking", "target_identity", "projection",
+    "risk_level", "changed_files", "changed_lines", "headline", "reason", "value", "risk_evidence",
+    "choices", "off_path"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.consent/v2"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"const": "review.start"},
+    "action": {"const": "consent_required"},
+    "blocking": {"const": true},
+    "target_identity": {"$ref": "#/$defs/sha256"},
+    "projection": {"enum": ["workspace", "staged"]},
+    "risk_level": {"enum": ["medium", "high"]},
+    "changed_files": {"type": "integer", "minimum": 0},
+    "changed_lines": {"type": "integer", "minimum": 0},
+    "headline": {"type": "string", "minLength": 1},
+    "reason": {"type": "string", "minLength": 1},
+    "value": {"type": "string", "minLength": 1},
+    "risk_evidence": {"type": "array", "items": {"type": "string", "minLength": 1}},
+    "choices": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "prefixItems": [
+        {"$ref": "#/$defs/choice_granted"},
+        {"$ref": "#/$defs/choice_declined"}
+      ],
+      "items": false
+    },
+    "off_path": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["note", "command"],
+      "properties": {
+        "note": {"type": "string", "minLength": 1},
+        "command": {"const": "gentle-ai review mode disable"}
+      }
+    }
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "choice": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["answer", "label", "effect", "invocation"],
+      "properties": {
+        "answer": {"enum": ["granted", "declined"]},
+        "label": {"type": "string", "minLength": 1},
+        "effect": {"type": "string", "minLength": 1},
+        "invocation": {"type": "string", "pattern": "^gentle-ai review start --contract gentle-ai\\.review-integration/v2 .* --consent (granted|declined)$"}
+      }
+    },
+    "choice_granted": {
+      "allOf": [{"$ref": "#/$defs/choice"}],
+      "properties": {"answer": {"const": "granted"}}
+    },
+    "choice_declined": {
+      "allOf": [{"$ref": "#/$defs/choice"}],
+      "properties": {"answer": {"const": "declined"}}
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/failure.schema.json b/contracts/review-integration/v2/schemas/failure.schema.json
new file mode 100644
index 000000000..3508d8b2e
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/failure.schema.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/failure.schema.json",
+  "title": "Gentle AI negotiated review v2 failure",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "contract", "operation", "phase", "code", "message", "mutation_outcome",
+    "authority_applicability", "retry_safe", "replayability", "required_inputs", "next_action"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.failure/v2"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"$ref": "../../v1/schemas/failure.schema.json#/properties/operation"},
+    "phase": {"$ref": "../../v1/schemas/failure.schema.json#/properties/phase"},
+    "code": {"$ref": "../../v1/schemas/failure.schema.json#/properties/code"},
+    "message": {"$ref": "../../v1/schemas/failure.schema.json#/properties/message"},
+    "mutation_outcome": {"$ref": "../../v1/schemas/failure.schema.json#/properties/mutation_outcome"},
+    "authority_applicability": {"$ref": "../../v1/schemas/failure.schema.json#/properties/authority_applicability"},
+    "retry_safe": {"type": "boolean"},
+    "replayability": {"$ref": "../../v1/schemas/failure.schema.json#/properties/replayability"},
+    "lineage_id": {"$ref": "../../v1/schemas/failure.schema.json#/properties/lineage_id"},
+    "request_digest": {"$ref": "../../v1/schemas/failure.schema.json#/properties/request_digest"},
+    "progress_identity": {"$ref": "../../v1/schemas/failure.schema.json#/properties/progress_identity"},
+    "required_inputs": {"$ref": "../../v1/schemas/failure.schema.json#/properties/required_inputs"},
+    "next_action": {"$ref": "../../v1/schemas/failure.schema.json#/properties/next_action"},
+    "cause_category": {"$ref": "../../v1/schemas/failure.schema.json#/properties/cause_category"},
+    "cause": {"$ref": "../../v1/schemas/failure.schema.json#/properties/cause"},
+    "context": {"$ref": "../../v1/schemas/failure.schema.json#/properties/context"}
+  },
+  "allOf": [
+    {"$ref": "../../v1/schemas/failure.schema.json#/allOf/0"},
+    {"$ref": "../../v1/schemas/failure.schema.json#/allOf/1"}
+  ]
+}
diff --git a/contracts/review-integration/v2/schemas/operation.schema.json b/contracts/review-integration/v2/schemas/operation.schema.json
new file mode 100644
index 000000000..f6f24bd89
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/operation.schema.json
@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/operation.schema.json",
+  "title": "Gentle AI negotiated review v2 operation result",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "contract", "operation", "result"],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.operation/v2"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"$ref": "../../v1/schemas/operation.schema.json#/properties/operation"},
+    "result": {
+      "oneOf": [
+        {"$ref": "#/$defs/finalize"},
+        {"$ref": "../../v1/schemas/operation.schema.json#/$defs/validate"},
+        {"$ref": "../../v1/schemas/operation.schema.json#/$defs/bind_sdd"},
+        {"$ref": "../../v1/schemas/operation.schema.json#/$defs/retry_final_verification"}
+      ]
+    }
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "finalize": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["operation", "lineage_id", "state", "action", "store_revision"],
+      "properties": {
+        "operation": {"const": "review/finalize"},
+        "lineage_id": {"type": "string", "minLength": 1},
+        "state": {"type": "string", "minLength": 1},
+        "action": {"type": "string", "minLength": 1},
+        "store_revision": {"$ref": "#/$defs/sha256"},
+        "eligibility": {"$ref": "status.schema.json#/properties/eligibility"},
+        "next_transition": {"$ref": "status.schema.json#/$defs/next_transition"},
+        "validation_request": {"$ref": "../../v1/schemas/targeted-validation-request.schema.json"},
+        "escalation": {"type": "string", "minLength": 1}
+      },
+      "allOf": [
+        {
+          "if": {"required": ["validation_request"]},
+          "then": {"properties": {"state": {"const": "correction_required"}}}
+        }
+      ]
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/repair.schema.json b/contracts/review-integration/v2/schemas/repair.schema.json
new file mode 100644
index 000000000..d2a8f788d
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/repair.schema.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/repair.schema.json",
+  "title": "Gentle AI negotiated review v2 repair result",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "contract", "operation", "mode", "assessment", "required_inputs"],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.repair/v2"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"$ref": "../../v1/schemas/repair.schema.json#/properties/operation"},
+    "mode": {"$ref": "../../v1/schemas/repair.schema.json#/properties/mode"},
+    "assessment": {"$ref": "../../v1/schemas/repair.schema.json#/properties/assessment"},
+    "provider_inputs": {"$ref": "../../v1/schemas/repair.schema.json#/properties/provider_inputs"},
+    "required_inputs": {"$ref": "../../v1/schemas/repair.schema.json#/properties/required_inputs"},
+    "execution": {"$ref": "../../v1/schemas/repair.schema.json#/properties/execution"}
+  },
+  "allOf": [
+    {"$ref": "../../v1/schemas/repair.schema.json#/allOf/0"},
+    {"$ref": "../../v1/schemas/repair.schema.json#/allOf/1"}
+  ]
+}
diff --git a/contracts/review-integration/v2/schemas/start.schema.json b/contracts/review-integration/v2/schemas/start.schema.json
new file mode 100644
index 000000000..3cb7a0ef9
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/start.schema.json
@@ -0,0 +1,106 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/start.schema.json",
+  "title": "Gentle AI negotiated native Git review START response v3",
+  "type": "object",
+  "additionalProperties": false,
+  "dependentRequired": {
+    "target_mode": ["target_identity", "base_tree", "candidate_tree"],
+    "target_identity": ["target_mode", "base_tree", "candidate_tree"],
+    "base_tree": ["candidate_tree"],
+    "candidate_tree": ["base_tree"],
+    "changed_path_manifest": ["base_tree", "candidate_tree"]
+  },
+  "allOf": [
+    {
+      "if": {"properties": {"selected_lenses": {"minItems": 1}}, "required": ["selected_lenses"]},
+      "then": {"required": ["base_tree", "candidate_tree", "changed_path_manifest"]}
+    },
+    {
+      "if": {
+        "properties": {"action": {"enum": ["created", "resumed"]}, "state": {"const": "reviewing"}},
+        "required": ["action", "state"]
+      },
+      "then": {"required": ["repository_context"]},
+      "else": {"not": {"required": ["repository_context"]}}
+    }
+  ],
+  "required": [
+    "schema", "contract", "operation", "action", "lenses_required", "lineage_id", "state", "risk_level",
+    "selected_lenses", "projection", "changed_files", "changed_lines", "correction_budget", "risk_reasons", "artifact_subjects"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.start/v3"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"const": "review.start"},
+    "action": {"enum": ["created", "resumed", "reuse-receipt", "blocked-scope-action"]},
+    "lenses_required": {"type": "boolean"},
+    "lineage_id": {"type": "string", "minLength": 1},
+    "state": {
+      "enum": [
+        "unreviewed", "reviewing", "judges_confirmed", "findings_frozen", "evidence_classified", "fix_required",
+        "fixing", "fix_validating", "correction_required", "validating", "ready_final_verification", "final_verifying",
+        "approved", "escalated", "invalidated"
+      ]
+    },
+    "risk_level": {"enum": ["low", "medium", "high"]},
+    "selected_lenses": {
+      "type": "array", "maxItems": 4, "uniqueItems": true,
+      "items": {"enum": ["review-risk", "review-resilience", "review-readability", "review-reliability"]}
+    },
+    "projection": {"enum": ["workspace", "staged"]},
+    "target_mode": {"const": "base-workspace-overlay"},
+    "target_identity": {"$ref": "#/$defs/sha256"},
+    "base_tree": {"$ref": "#/$defs/git_tree"},
+    "candidate_tree": {"$ref": "#/$defs/git_tree"},
+    "changed_files": {"type": "integer", "minimum": 0},
+    "changed_lines": {"type": "integer", "minimum": 0},
+    "correction_budget": {"type": "integer", "minimum": 0, "maximum": 200},
+    "risk_reasons": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/$defs/risk_reason"}},
+    "artifact_subjects": {"type": "array", "maxItems": 4, "items": {"$ref": "artifact-subject.schema.json"}},
+    "changed_path_manifest": {"type": "array", "uniqueItems": true, "items": {"$ref": "#/$defs/changed_path"}},
+    "repository_context": {
+      "type": "object", "additionalProperties": false,
+      "required": ["capability", "handle", "revision", "target_identity"],
+      "properties": {
+        "capability": {"const": "review.opaque_repository_context"},
+        "handle": {"type": "string", "pattern": "^rctx1_[0-9a-f]{64}$"},
+        "revision": {"$ref": "#/$defs/sha256"},
+        "target_identity": {"$ref": "#/$defs/sha256"}
+      }
+    }
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "git_tree": {"type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"},
+    "changed_path": {
+      "type": "object", "additionalProperties": false,
+      "required": ["path", "status", "old_mode", "new_mode", "deleted", "type_changed", "mode_only", "intended_untracked"],
+      "properties": {
+        "path": {"type": "string", "minLength": 1},
+        "status": {"enum": ["A", "D", "M", "T"]},
+        "old_mode": {"type": "string", "pattern": "^[0-7]{6}$"},
+        "new_mode": {"type": "string", "pattern": "^[0-7]{6}$"},
+        "deleted": {"type": "boolean"},
+        "type_changed": {"type": "boolean"},
+        "mode_only": {"type": "boolean"},
+        "intended_untracked": {"type": "boolean"}
+      }
+    },
+    "risk_reason": {
+      "type": "object", "additionalProperties": false, "required": ["code"],
+      "properties": {
+        "code": {
+          "enum": [
+            "configuration_change", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change",
+            "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"
+          ]
+        },
+        "signal": {"enum": ["auth", "update", "security", "payments", "permissions", "shell_process"]},
+        "path": {"type": "string", "minLength": 1},
+        "old_mode": {"type": "string", "pattern": "^[0-7]{6}$"},
+        "new_mode": {"type": "string", "pattern": "^[0-7]{6}$"}
+      }
+    }
+  }
+}
diff --git a/contracts/review-integration/v2/schemas/status.schema.json b/contracts/review-integration/v2/schemas/status.schema.json
new file mode 100644
index 000000000..78e7d16b5
--- /dev/null
+++ b/contracts/review-integration/v2/schemas/status.schema.json
@@ -0,0 +1,104 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gentle-ai.dev/contracts/review-integration/v2/schemas/status.schema.json",
+  "title": "Gentle AI Review Integration native Git target status v3",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "contract", "operation", "applicability", "receipt", "action", "replayability",
+    "target_identity", "projection", "repair", "candidates"
+  ],
+  "properties": {
+    "schema": {"const": "gentle-ai.review-integration.status/v3"},
+    "contract": {"const": "gentle-ai.review-integration/v2"},
+    "operation": {"const": "review.status"},
+    "applicability": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/applicability"},
+    "authority": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/authority"},
+    "receipt": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/receipt"},
+    "action": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/action"},
+    "action_disposition": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/action_disposition"},
+    "replayability": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/replayability"},
+    "frozen": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/frozen"},
+    "target_identity": {"$ref": "#/$defs/sha256"},
+    "authority_target_identity": {"$ref": "#/$defs/sha256"},
+    "projection": {"$ref": "../../v1/schemas/projection.schema.json"},
+    "repair": {"$ref": "../../v1/schemas/authority-repair-assessment.schema.json"},
+    "candidates": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/candidates"},
+    "reconciliation": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/reconciliation"},
+    "eligibility": {"$ref": "../../v1/schemas/status-v2.schema.json#/$defs/action_eligibility"},
+    "next_transition": {"$ref": "#/$defs/next_transition"},
+    "validation_request": {"$ref": "../../v1/schemas/targeted-validation-request.schema.json"},
+    "final_verification_retry": {"$ref": "../../v1/schemas/status-v2.schema.json#/properties/final_verification_retry"}
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "next_transition": {
+      "type": "object", "additionalProperties": false, "required": ["kind", "reason_code"],
+      "properties": {
+        "kind": {"enum": ["execute", "collect", "stop"]},
+        "reason_code": {"type": "string", "pattern": "^[a-z0-9_]+$"},
+        "execute": {"$ref": "../../v1/schemas/status-v2.schema.json#/$defs/transition_execution"},
+        "collect": {"$ref": "#/$defs/transition_collection"}
+      },
+      "allOf": [
+        {"if": {"properties": {"kind": {"const": "execute"}}, "required": ["kind"]}, "then": {"required": ["execute"], "not": {"required": ["collect"]}}},
+        {"if": {"properties": {"kind": {"const": "collect"}}, "required": ["kind"]}, "then": {"required": ["collect"], "not": {"required": ["execute"]}}},
+        {"if": {"properties": {"kind": {"const": "stop"}}, "required": ["kind"]}, "then": {"not": {"anyOf": [{"required": ["execute"]}, {"required": ["collect"]}]}}}
+      ]
+    },
+    "transition_collection": {
+      "type": "object", "additionalProperties": false, "required": ["inputs"],
+      "properties": {"inputs": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/transition_input"}}}
+    },
+    "transition_input": {
+      "type": "object", "additionalProperties": false,
+      "required": ["name", "schema", "capture_operation", "arguments"],
+      "properties": {
+        "name": {"type": "string", "pattern": "^[a-z0-9_]+$"},
+        "schema": {"type": "string", "minLength": 1},
+        "capture_operation": {"type": "string", "minLength": 1},
+        "arguments": {
+          "type": "array", "minItems": 1,
+          "items": {"$ref": "../../v1/schemas/status-v2.schema.json#/$defs/transition_argument"}
+        },
+        "artifact_subject": {"$ref": "artifact-subject.schema.json"},
+        "base_tree": {"$ref": "#/$defs/git_tree"},
+        "candidate_tree": {"$ref": "#/$defs/git_tree"},
+        "changed_path_manifest": {"type": "array", "uniqueItems": true, "items": {"$ref": "start.schema.json#/$defs/changed_path"}},
+        "validation_request": {"$ref": "../../v1/schemas/targeted-validation-request.schema.json"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"capture_operation": {"const": "external.run_targeted_validation"}}, "required": ["capture_operation"]},
+          "then": {"required": ["validation_request"], "properties": {"schema": {"const": "gentle-ai.review-targeted-validation-request/v1"}}},
+          "else": {"not": {"required": ["validation_request"]}}
+        },
+        {
+          "if": {"properties": {"capture_operation": {"const": "review.capture-result"}}, "required": ["capture_operation"]},
+          "then": {
+            "required": ["artifact_subject", "base_tree", "candidate_tree", "changed_path_manifest"],
+            "properties": {"schema": {"const": "https://gentle-ai.dev/schema/review/reviewer/v1"}}
+          },
+          "else": {
+            "allOf": [
+              {"not": {"required": ["artifact_subject"]}},
+              {"not": {"required": ["base_tree"]}},
+              {"not": {"required": ["candidate_tree"]}},
+              {"not": {"required": ["changed_path_manifest"]}}
+            ]
+          }
+        }
+      ]
+    },
+    "git_tree": {"type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"}
+  },
+  "allOf": [
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/0"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/1"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/2"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/3"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/4"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/5"},
+    {"$ref": "../../v1/schemas/status-v2.schema.json#/allOf/6"}
+  ]
+}
diff --git a/docs/review-integration.md b/docs/review-integration.md
index 1ec065e34..45c485cd7 100644
--- a/docs/review-integration.md
+++ b/docs/review-integration.md
@@ -2,7 +2,7 @@
 
 ← [Back to README](../README.md)
 
-`gentle-ai.review-integration/v1` is the versioned provider contract for consumers that coordinate Gentle AI's native bounded review lifecycle. It lets a consumer negotiate capabilities, reconstruct one target after restart, drive explicit review operations, and validate the resulting receipt without reading provider-private authority files.
+Gentle AI exposes two negotiated review contracts. `gentle-ai.review-integration/v1` preserves the published Base64 candidate-diff transport byte for byte. `gentle-ai.review-integration/v2` is the native-Git contract: it carries immutable base/candidate tree IDs and an ordered changed-path manifest, never an inline patch. Both let a consumer reconstruct one target after restart, drive explicit review operations, and validate the resulting receipt without reading provider-private authority files.
 
 ## Negotiate the provider first
 
@@ -15,11 +15,15 @@ gentle-ai review capabilities \
 
 The response identifies the protocol major, package and build identity, executable SHA-256, operations, five gates, projections, schemas, mandatory and optional features, and compatibility window. The executable digest is self-reported evidence; compare it with the published release manifest before trusting the binary.
 
+New integrations SHOULD negotiate `gentle-ai.review-integration/v2`. Existing v1 consumers remain valid and MUST continue validating the published v1 schemas and fixture bytes; they do not gain tree-only fields additively.
+
 Protocol v1.5 advertises `gentle-ai.review-integration.capabilities/v1.5` and adds `outcome_bound_verification_evidence` without changing the preserved v1.4 identity or its `one_shot_final_verification_retry` feature. `review capture-evidence` requires one closed `--outcome` (`passed`, `verification_failed`, or `procedural_tooling_failed`) and persists `gentle-ai.review-verification-evidence/v2` beside immutable candidate-addressed raw bytes. The record binds lineage, authority revision, target tree, canonical paths and ledger IDs, raw SHA-256 and size, outcome, and its own canonical digest. FINALIZE derives captured approval or escalation from that record; a caller-supplied `--failed` may agree with it but cannot override it.
 
+Protocol v1.4 advertises `gentle-ai.review-integration.capabilities/v1.4` and adds `one_shot_final_verification_retry`, operation `review.retry_final_verification`, and incident schema `gentle-ai.review-final-verification-incident/v1`. This is a dedicated provider-owned retry for one exact completed failed final-verification tooling incident; it does not relax generic recovery.
+
 Protocol v1.3 introduced `provider_artifact_admission`, `validating_result_reopen`, `recovered_correction_evidence`, and `classified_authority_repair`. START v2 supplies one provider-owned `ArtifactSubject` per selected lens. Result artifact v2 and status v2 expose the admitted subject hash and completed admission decision. Status v2 also requires a bounded `gentle-ai.review-authority-repair-assessment/v1`; `review.repair` publishes the matching strict preflight and execution contract. The durable admitted-result envelope preserves raw and canonical payload identities, the result identity, and repository-verified candidate-causal finding IDs. Exact accounting-only recovery may reuse that evidence only when the corrected predecessor bytes are the successor's exact initial target. Protocol v1.0 through v1.4 capability schemas and fixtures remain packaged unchanged. Consumers must reject an unknown schema/minor identity they do not support; v1.5 consumers validate the v1.5 schema before relying on the current features.
 
-The v1.2 artifact remains the compatibility record for `native_frozen_candidate_context`, `opaque_repository_context`, and `provider_targeted_validation_request`. Frozen context supplies the exact candidate diff and changed-path manifest. Opaque repository context lets an external actor return results without receiving or rediscovering a repository path. Provider-targeted validation supplies the exact corrected candidate and frozen finding IDs to validate. START v1, status v1, and result-artifact v1 schemas and fixtures remain packaged byte-identically; v1.3 advertises their v2 successors rather than changing those identities in place.
+The v1.2 feature set includes `native_frozen_candidate_context`, `opaque_repository_context`, and `provider_targeted_validation_request`. Its published reviewer transport contains the canonical candidate diff and ordered changed-path manifest. Opaque repository context lets an external actor return results without receiving or rediscovering a repository path. Provider-targeted validation supplies the exact corrected candidate and frozen finding IDs to validate. Contract v2 replaces only that reviewer transport with immutable tree IDs; it does not rewrite v1.
 
 The v1.1 artifact remains the compatibility record for `base_ref_workspace_overlay`, `bounded_process_waits`, `exact_gate_receipt_discovery`, `native_low_risk_verification`, `native_next_transition`, `risk_reasons`, and `scope_change_diagnostics`. The overlay feature requires immutable snapshots and restart-safe projection.
 
@@ -28,11 +32,11 @@ Consumers MUST reject an incompatible protocol major, an unsupported mandatory f
 Pass the same contract explicitly to negotiated repository operations:
 
 ```bash
-gentle-ai review start --contract gentle-ai.review-integration/v1 --cwd .
-gentle-ai review status --contract gentle-ai.review-integration/v1 --cwd .
-gentle-ai review finalize --contract gentle-ai.review-integration/v1 --cwd . --lineage <lineage> ...
-gentle-ai review validate --contract gentle-ai.review-integration/v1 --cwd . --gate pre-commit
-gentle-ai review bind-sdd --contract gentle-ai.review-integration/v1 --cwd . --change <change> --lineage <lineage> --expected-binding-revision=<revision>
+gentle-ai review start --contract gentle-ai.review-integration/v2 --cwd .
+gentle-ai review status --contract gentle-ai.review-integration/v2 --cwd .
+gentle-ai review finalize --contract gentle-ai.review-integration/v2 --cwd . --lineage <lineage> ...
+gentle-ai review validate --contract gentle-ai.review-integration/v2 --cwd . --gate pre-commit
+gentle-ai review bind-sdd --contract gentle-ai.review-integration/v2 --cwd . --change <change> --lineage <lineage> --expected-binding-revision=<revision>
 ```
 
 ### Zero-help lifecycle bootstrap
@@ -40,14 +44,14 @@ gentle-ai review bind-sdd --contract gentle-ai.review-integration/v1 --cwd . --c
 When capabilities advertise `native_next_transition`, the parent orchestrator starts lifecycle routing exactly once with:
 
 ```bash
-gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition
+gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition
 ```
 
-Append a target selector only when its type is already known: `--projection staged`, `--base-ref <ref>`, `--workspace-overlay --base-ref <ref>`, or `--workspace-overlay --base-tree <tree>`. If the feature is unavailable, query exactly once `gentle-ai review capabilities --contract gentle-ai.review-integration/v1` and stop with `unsupported-capability`; do not explore commands or consult help. After bootstrap, only the parent executes the exact native `next_transition`. Reviewers, validators, executors, and refuters receive role inputs and return artifacts; they never invoke review lifecycle commands.
+Append a target selector only when its type is already known: `--projection staged`, `--base-ref <ref>`, `--workspace-overlay --base-ref <ref>`, or `--workspace-overlay --base-tree <tree>`. If the feature is unavailable, query exactly once `gentle-ai review capabilities --contract gentle-ai.review-integration/v2` and stop with `unsupported-capability`; do not explore commands or consult help. After bootstrap, only the parent executes the exact native `next_transition`. Reviewers, validators, executors, and refuters receive role inputs and return artifacts; they never invoke review lifecycle commands.
 
 ### Per-candidate consent relay
 
-A session that can relay a blocking question to a human declares it on negotiated START with `--consent relay`. When the frozen candidate's tier would ask the per-candidate consent question (any non-low tier whose one-time question is still unanswered), START then responds with the typed `gentle-ai.review-integration.consent/v1` envelope instead of proceeding: why input is required (the same headline, reason, and risk-evidence phrases the interactive terminal question speaks), the complete choice set, and one runnable follow-up invocation per choice, scoped to the exact `--target` identity. Nothing is persisted while the question is outstanding, and no console notice is printed.
+A session that can relay a blocking question to a human declares it on negotiated START with `--consent relay`. When the frozen candidate's tier would ask the per-candidate consent question (any non-low tier whose one-time question is still unanswered), START responds with the consent envelope matching the negotiated contract: `consent/v1` for integration v1 or `consent/v2` for integration v2. It carries why input is required, the complete choice set, and one runnable follow-up invocation per choice scoped to the exact `--target` identity. Nothing is persisted while the question is outstanding, and no console notice is printed.
 
 The orchestrator relays the complete envelope losslessly and answers with exactly one named invocation. `--consent granted` runs the review and records the one-time question as answered; it is replay-safe and a rerun resumes the same authority. `--consent declined` reports the existing typed declined START outcome (`consent: declined_this_candidate`): scoped to that one candidate, nothing persisted, the next candidate asks again. A decline is deliberately not the kill switch; the permanent disable remains `gentle-ai review mode disable`, documented in the envelope's `off_path` and never offered as a choice. Without the declaration, START behavior is unchanged: low risk asks nothing, a resolved question asks nothing, and a headless undeclared session keeps the skip-and-notice fallback.
 
@@ -81,7 +85,7 @@ Consumers MUST NOT reconstruct receipts, derive canonical hashes, inspect the Gi
 
 `review.start` is the only ordinary entry point that creates a review budget. Finalize continues that frozen lifecycle. The dedicated final-verification retry creates a successor lineage but copies every frozen budget and accounting field without adding a reviewer, correction, SDD, or other budget. Status, validation, and gates are read-only.
 
-`gentle-ai review capture-result` is an additive headless command, not a negotiated `review-integration/v1` repository operation. It accepts no `--contract` and emits a manifest with capability `review.native_result_artifact` and schema `gentle-ai.review-result-artifact/v2`. The manifest binds the provider-issued `subject_hash` and `admission_decision: completed`; exactly one provider-owned `path` or opaque `reference` locates the durable `gentle-ai.review-admitted-result/v1` envelope. A negotiated capture transition carries `--repository-context <opaque-handle>` plus `--expected-revision <revision>`, so the consumer can invoke capture from an unrelated working directory without learning the repository path. Explicit `--cwd` remains the compatibility path-manifest mode and cannot be combined with a repository-context handle.
+`gentle-ai review capture-result` is an additive headless command, not a negotiated repository operation. It accepts no `--contract`; the provider-issued subject hash selects the transport version. Capture emits a manifest with capability `review.native_result_artifact` and schema `gentle-ai.review-result-artifact/v2`; the manifest binds `subject_hash` and `admission_decision: completed`, and exactly one provider-owned `path` or opaque `reference` locates the durable admitted-result envelope (`review-admitted-result/v1` for a v1 subject, `review-admitted-result/v2` for a v2 subject). A negotiated capture transition carries `--repository-context <opaque-handle>` plus `--expected-revision <revision>`, so consumers can invoke capture from an unrelated working directory without learning the repository path. Explicit `--cwd` remains the capture compatibility path-manifest mode and cannot be combined with a repository-context handle.
 
 ### Choose the target explicitly
 
@@ -91,26 +95,32 @@ Consumers MUST NOT reconstruct receipts, derive canonical hashes, inspect the Gi
 | `review start --base-ref <ref> --committed-only` | `<ref>` to `HEAD`; workspace changes are excluded. |
 | `review start --base-ref <ref> --workspace-overlay` | `<ref>` to the synthetic workspace tree, including branch commits and staged, unstaged, and intended-untracked bytes. |
 
-Overlay mode requires workspace projection and cannot be combined with `--committed-only`. START returns `target_mode`, `target_identity`, `base_tree`, and `candidate_tree` only for this mode. Restarted consumers select the frozen target with `review status --base-tree <START base_tree> --workspace-overlay`; `--base-ref` remains available for a fresh symbolic selection, but cannot be combined with `--base-tree`. Existing workspace-only and committed-only payloads remain unchanged. Snapshot construction uses a temporary index and does not mutate the real index or worktree.
+Overlay mode requires workspace projection and cannot be combined with `--committed-only`. START returns `target_mode` and `target_identity` only for this mode. Under contract v2, selected-lens START responses also return `base_tree` and `candidate_tree` as reviewer context for every target kind. Restarted consumers select an overlay target with `review status --base-tree <START base_tree> --workspace-overlay`; `--base-ref` remains available for a fresh symbolic selection, but cannot be combined with `--base-tree`. Snapshot construction uses a temporary index and does not mutate the real index or worktree.
 
 ### Use frozen reviewer context
 
-When negotiated START returns one or more selected lenses, it also returns both `candidate_diff` and `changed_path_manifest` plus one `artifact_subjects` entry per selected lens. The provider derives them from the selected authority's persisted initial base/candidate trees and canonical paths—not from the current index, worktree, or a correction snapshot. Each subject self-hashes the exact lineage, authority revision, target, candidate-diff digest, changed-path-manifest digest, lens, selected order, and optional correction target. Created, resumed, receipt-replay, blocked, and recovery-selected responses therefore retain the same bytes across process restarts and unrelated workspace mutation.
+Under integration v2, negotiated START with selected lenses returns `base_tree`, `candidate_tree`, `changed_path_manifest`, and one `artifact_subjects` entry per lens. The provider derives them from the selected authority's persisted initial snapshot, not the current index, worktree, or a correction snapshot. Each subject self-hashes the exact lineage, authority revision, target, both tree IDs, manifest digest, lens, selected order, and optional correction target.
 
-After a restart, negotiated `review status --next-transition` returns that same immutable context inside every missing `review.capture-result` collection input: the lens-specific `artifact_subject`, exact `candidate_diff`, and complete `changed_path_manifest` including modes. This is sufficient to launch each missing reviewer without another START, lineage, or review budget. Consumers pass these fields through unchanged and never rebuild them from the live workspace.
+After a restart, v2 `review status --next-transition` returns that same context inside every missing `review.capture-result` input. No v2 START, status, task, environment, or plugin payload contains the full patch or a Base64 copy. Contract v1 deliberately retains its published Base64 candidate-diff field.
 
-The patch uses fixed binary/full-index, prefix, context, algorithm, rename, external-diff, text-conversion, submodule, color, and locale behavior. Rendering and START diff statistics run through a temporary bare Git view backed only by the repository object database, with repository, info, global, system, worktree, and committed `.gitattributes` sources excluded. Attribute state therefore cannot reinterpret frozen bytes or risk counts between retries. The raw patch is capped at 4 MiB while Git output is captured, matching the native reviewer-artifact ceiling and bounding the base64 plus indented-JSON copies in the START response. Oversized patches stop before a new authority is created.
+Reviewers inspect the frozen candidate through read-only native Git commands against the exact `base_tree` and `candidate_tree` from their collection input. They treat the ordered `changed_path_manifest` as the complete frozen scope, begin with compact discovery, and then open only the paths their lens needs:
 
-`candidate_diff` is an exact-byte object rather than a JSON string:
+```bash
+env -i PATH="$PATH" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 \
+  git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= \
+  diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \
+  <base_tree> <candidate_tree> --
+
+env -i PATH="$PATH" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 \
+  git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= \
+  diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv \
+  --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none \
+  <base_tree> <candidate_tree> -- ':(literal)<path>'
+```
 
-| Field | Meaning |
-| --- | --- |
-| `encoding` | Always `base64`; `data` is canonical padded base64. |
-| `data` | The exact raw Git patch bytes, including bytes that are not valid UTF-8. |
-| `sha256` | `sha256:<lowercase hex>` over the decoded bytes. |
-| `byte_size` | Decoded byte count, from zero through 4,194,304. |
+Reviewers may also use the corresponding allowlisted `--numstat`, selective `--stat`, and exact `cat-file -p '<tree>:<path>'` forms. Several related literal pathspecs may share one selective command. Reviewers never pass `--binary` and never render the entire candidate patch automatically. They run only these clean-environment commands in the session working directory. The frozen trees resolve through the repository object store shared by every worktree of the same repository. The guarantee is immutable candidate content addressed by the frozen trees, not byte-identical rendered patch transport across Git versions. Reviewers never inspect the live worktree, index, `HEAD`, or an unbound revision; a runtime without the enforced Git command boundary reports incomplete inspection instead of substituting live files.
 
-The provider validates all four fields together before serialization. Consumers decode `data`, verify `byte_size` and `sha256`, and never reinterpret the patch as UTF-8 before that verification. Manifest entries stay in persisted path order and expose:
+Manifest entries stay in persisted path order and expose:
 
 | Field | Meaning |
 | --- | --- |
@@ -120,11 +130,11 @@ The provider validates all four fields together before serialization. Consumers
 | `deleted` / `type_changed` / `mode_only` | Explicit state that consumers do not need to infer from patch prose. |
 | `intended_untracked` | Whether the frozen snapshot bound the path as intended-untracked provenance. |
 
-Missing context is different from a valid empty candidate: the latter is encoded as `candidate_diff: {"encoding":"base64","data":"","sha256":"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","byte_size":0}` with `changed_path_manifest: []`. The schema and runtime require both context fields or neither; selected lenses require both. START rejects incomplete, non-canonical, digest-mismatched, oversized, or structurally mismatched context before serialization. Unnegotiated START retains its legacy behavior and emits neither field nor candidate contents.
+Under v2, selected lenses require both valid tree IDs and the manifest. An empty candidate has equal valid tree IDs with `changed_path_manifest: []`; missing context remains invalid. V1 continues to require its candidate diff and manifest. Unnegotiated START retains its legacy response shape and emits no candidate contents.
 
 Reviewer results must echo the exact `subject_hash` and report structured `inspection: {status: "completed", paths: [...]}` for the complete frozen manifest, including root-level paths. Finding IDs use the ASCII form `R[1-4]-[A-Za-z0-9][A-Za-z0-9._-]*`. Proof and evidence recognize `path:positive-line` only for canonical paths present in the immutable base/candidate tree union: bare root references contain a dot, while quoted references support extensionless, Unicode, and space-containing paths. Digests, timestamps, status labels, URLs, and arbitrary colon-delimited prose are not path references. The provider accepts transport prose around exactly one complete JSON object, but rejects zero, multiple, or unterminated objects. Missing inspection, access-denied or unavailable-inspection evidence, paths or locations outside the frozen candidate, repeated finding IDs, wrong lens prefixes, binding mismatch, and unsupported causal metadata are classified and rejected before publication. Severe findings must retain a supported `evidence_class` and `causal_disposition`; `introduced`, `behavior-activated`, and `worsened` claims are admitted only when repository-derived changed-line evidence supports the claimed location. Reviewer results may omit the top-level `lens`; when present, it must match the selected-lens position returned by START.
 
-The managed OpenCode result-artifact plugin preflights each bound reviewer invocation and injects the provider-returned subject, exact candidate diff, and manifest before the lens runs. It then captures the reviewer's single schema-conformant result. A legacy provider that does not support preflight remains compatible, but receives no invented frozen context.
+The managed OpenCode result-artifact plugin replaces caller-authored task prose with the provider-issued binding and preflight context. It validates the subject, trees, lens slot, and canonical ordered manifest before launching the reviewer; it never transports a patch or candidate bytes. OpenCode reviewers receive only the narrow read-only Git allowlist above. Managed runtimes that cannot enforce that per-command boundary receive no shell and must report incomplete inspection rather than substitute live files or receive an inline patch fallback.
 
 Durable controllers capture each result with exact lineage, target, lens, selected order, authority revision, and provider-issued repository context. Current captures emit pathless manifests with opaque references; the provider can discover every canonical result with `--captured-results`, or controllers can write each emitted manifest to its own file and pass those files to FINALIZE in selected-lens order with repeatable `--result-artifact-file <path>` flags. A `--result-artifact-file -` occurrence reads exactly one manifest from stdin; because FINALIZE has one shared stdin, `-` may appear only once across reviewer results, artifact manifests, validation, refuter outcomes, and evidence.
 
@@ -247,7 +257,7 @@ Persistent compact `LOCK` JSON is advisory diagnostics, not current-holder proof
 
 ### Preserve the uniform failure envelope
 
-Every failed operation explicitly negotiated through `gentle-ai.review-integration/v1` emits `gentle-ai.review-integration.failure/v1` and still exits nonzero. Capabilities uses this envelope by default; repository operations use it when `--contract` is present. Unnegotiated command errors retain their compatibility behavior.
+Every failed negotiated operation emits the failure envelope matching its contract: `failure/v1` for integration v1 and `failure/v2` for integration v2, and still exits nonzero. Capabilities defaults to v1; repository operations use the selected envelope when `--contract` is present. Unnegotiated command errors retain their compatibility behavior.
 
 | Field | Runtime meaning |
 | --- | --- |
diff --git a/internal/assets/assets_test.go b/internal/assets/assets_test.go
index adc9abcbe..5e8e5da81 100644
--- a/internal/assets/assets_test.go
+++ b/internal/assets/assets_test.go
@@ -480,12 +480,9 @@ func TestReviewResultArtifactsPluginContract(t *testing.T) {
 		`const current = fields === "lens,lineage,order,repository_context,revision,subject_hash,target"`,
 		`typeof subject.subject_hash !== "string"`,
 		`subject.subject_hash !== binding.subject_hash`,
-		`const FROZEN_CONTEXT = "GENTLE_AI_FROZEN_CANDIDATE_CONTEXT "`,
 		`artifact_subject`,
-		`candidate_diff`,
-		`changed_path_manifest`,
-		`prompt.includes(FROZEN_CONTEXT)`,
-		`review task must not supply GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`,
+		`GENTLE_AI_REVIEW_CONTEXT`,
+		`validManifest(manifest)`,
 		`output.args.prompt = await injectReviewerContext(`,
 		`"--lineage", binding.lineage`,
 		`"--target", binding.target`,
@@ -538,6 +535,11 @@ func TestReviewResultArtifactsPluginContract(t *testing.T) {
 	if strings.Contains(source, `.slice("review-".length)`) {
 		t.Fatal("review-result-artifacts.ts must preserve the exact full selected lens; found review- prefix stripping")
 	}
+	for _, forbidden := range []string{"GENTLE_AI_FROZEN_CANDIDATE_CONTEXT", "candidate_diff"} {
+		if strings.Contains(source, forbidden) {
+			t.Fatalf("review-result-artifacts.ts still transports obsolete candidate context %q", forbidden)
+		}
+	}
 	// Pin the split: the previously conflated empty/nested-envelope message
 	// must never regress back into one indistinguishable free-text throw.
 	if strings.Contains(source, `reviewer task result is empty or contains a nested envelope`) {
diff --git a/internal/assets/opencode/plugins/review-result-artifacts.ts b/internal/assets/opencode/plugins/review-result-artifacts.ts
index 84797f251..405e6aa33 100644
--- a/internal/assets/opencode/plugins/review-result-artifacts.ts
+++ b/internal/assets/opencode/plugins/review-result-artifacts.ts
@@ -3,7 +3,6 @@ import { spawn } from "node:child_process"
 
 const REVIEW_AGENTS = new Set(["review-risk", "review-resilience", "review-readability", "review-reliability"])
 const BINDING = /^GENTLE_AI_REVIEW_BINDING (\{[^\n]+\})(?:\n|$)/
-const FROZEN_CONTEXT = "GENTLE_AI_FROZEN_CANDIDATE_CONTEXT "
 const TASK_RESULT = /^<task id="[^"\r\n]+" state="completed">\n<task_result>\n([\s\S]*?)\n<\/task_result>\n<\/task>$/
 const TASK_TAG = /<\/?task(?:\s|>)|<\/?task_result>/
 
@@ -18,13 +17,40 @@ type ReviewBinding = {
 }
 
 interface ReviewArtifactSubject {
+  schema: string
   subject_hash: string
+  lineage_id: string
+  authority_revision: string
+  target_identity: string
+  base_tree: string
+  candidate_tree: string
+  changed_path_manifest_sha256: string
+  lens: string
+  selected_order: number
+}
+
+interface ChangedPathManifestEntry {
+  path: string
+  status: string
+  old_mode: string
+  new_mode: string
+  deleted: boolean
+  type_changed: boolean
+  mode_only: boolean
+  intended_untracked: boolean
 }
 
 interface ReviewCapturePreflight {
+  schema: string
+  capability: string
+  lineage_id: string
+  target_identity: string
+  lens: string
+  selected_order: number
   artifact_subject: ReviewArtifactSubject
-  candidate_diff: Record<string, unknown>
-  changed_path_manifest: Array<Record<string, unknown>>
+  base_tree: string
+  candidate_tree: string
+  changed_path_manifest: ChangedPathManifestEntry[]
 }
 
 function parseBinding(prompt: unknown, lens: string): ReviewBinding {
@@ -114,19 +140,21 @@ function repositoryBindingArgs(cwd: string, binding: ReviewBinding): string[] {
 }
 
 function captureResult(cwd: string, binding: ReviewBinding, result: string): Promise<string> {
+  const subjectArgs = binding.subject_hash ? ["--subject-hash", binding.subject_hash] : []
   return runNative(cwd, [
     "review", "capture-result", ...repositoryBindingArgs(cwd, binding),
     "--lineage", binding.lineage, "--target", binding.target,
-    "--lens", binding.lens, "--order", String(binding.order), "--input", "-",
+    "--lens", binding.lens, "--order", String(binding.order), ...subjectArgs, "--input", "-",
   ], result)
 }
 
 async function preflightCapture(cwd: string, binding: ReviewBinding): Promise<ReviewCapturePreflight> {
   try {
+    const subjectArgs = binding.subject_hash ? ["--subject-hash", binding.subject_hash] : []
     const response = await runNative(cwd, [
       "review", "capture-result", ...repositoryBindingArgs(cwd, binding),
       "--lineage", binding.lineage, "--target", binding.target,
-      "--lens", binding.lens, "--order", String(binding.order), "--preflight",
+      "--lens", binding.lens, "--order", String(binding.order), ...subjectArgs, "--preflight",
     ], "")
     let parsed: unknown
     try {
@@ -139,10 +167,21 @@ async function preflightCapture(cwd: string, binding: ReviewBinding): Promise<Re
     }
     const value = parsed as Record<string, unknown>
     const subject = value.artifact_subject as Record<string, unknown> | undefined
-    if (!subject || typeof subject.subject_hash !== "string" || !/^sha256:[a-f0-9]{64}$/.test(subject.subject_hash) ||
-        !value.candidate_diff || typeof value.candidate_diff !== "object" || Array.isArray(value.candidate_diff) ||
-        !Array.isArray(value.changed_path_manifest) || value.changed_path_manifest.some((entry) => !entry || typeof entry !== "object" || Array.isArray(entry))) {
-      throw new Error("review capture preflight returned incomplete frozen candidate context")
+    const manifest = value.changed_path_manifest
+    if (!subject || subject.schema !== "gentle-ai.review-artifact-subject/v2" ||
+        typeof subject.subject_hash !== "string" || !/^sha256:[a-f0-9]{64}$/.test(subject.subject_hash) ||
+        typeof subject.authority_revision !== "string" || !/^sha256:[a-f0-9]{64}$/.test(subject.authority_revision) ||
+        typeof subject.base_tree !== "string" || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(subject.base_tree) ||
+        typeof subject.candidate_tree !== "string" || !/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(subject.candidate_tree) ||
+        typeof subject.changed_path_manifest_sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(subject.changed_path_manifest_sha256) ||
+        subject.lineage_id !== binding.lineage || subject.target_identity !== binding.target ||
+        (binding.revision !== undefined && subject.authority_revision !== binding.revision) ||
+        subject.lens !== binding.lens || subject.selected_order !== binding.order ||
+        value.schema !== "gentle-ai.review-capture-preflight/v1" || value.capability !== "review.native_capture_preflight" ||
+        value.lineage_id !== binding.lineage || value.target_identity !== binding.target || value.lens !== binding.lens ||
+        value.selected_order !== binding.order || value.base_tree !== subject.base_tree || value.candidate_tree !== subject.candidate_tree ||
+        !validManifest(manifest)) {
+      throw new Error("review capture preflight returned an incomplete artifact subject")
     }
     if (binding.subject_hash && subject.subject_hash !== binding.subject_hash) {
       throw new Error("review capture preflight returned a different artifact subject")
@@ -165,20 +204,36 @@ async function preflightCapture(cwd: string, binding: ReviewBinding): Promise<Re
   }
 }
 
-async function injectReviewerContext(prompt: string, lens: string, cwd: string): Promise<string> {
-  if (prompt.includes(FROZEN_CONTEXT)) {
-    throw new Error("review task must not supply GENTLE_AI_FROZEN_CANDIDATE_CONTEXT")
+function validManifest(value: unknown): value is ChangedPathManifestEntry[] {
+  if (!Array.isArray(value)) return false
+  let previous = ""
+  for (const entry of value) {
+    if (!validManifestEntry(entry) ||
+        (previous !== "" && Buffer.compare(Buffer.from(previous, "utf8"), Buffer.from(entry.path, "utf8")) >= 0)) return false
+    previous = entry.path
   }
+  return true
+}
+
+function validManifestEntry(entry: unknown): entry is ChangedPathManifestEntry {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false
+  const value = entry as Record<string, unknown>
+  return Object.keys(value).sort().join(",") ===
+    "deleted,intended_untracked,mode_only,new_mode,old_mode,path,status,type_changed" &&
+    typeof value.path === "string" && value.path !== "" &&
+    typeof value.status === "string" && /^[ADMT]$/.test(value.status) &&
+    typeof value.old_mode === "string" && /^[0-7]{6}$/.test(value.old_mode) &&
+    typeof value.new_mode === "string" && /^[0-7]{6}$/.test(value.new_mode) &&
+    typeof value.deleted === "boolean" && typeof value.type_changed === "boolean" &&
+    typeof value.mode_only === "boolean" && typeof value.intended_untracked === "boolean"
+}
+
+async function injectReviewerContext(prompt: string, lens: string, cwd: string): Promise<string> {
   const binding = parseBinding(prompt, lens)
   const preflight = await preflightCapture(cwd, binding)
   const injectedBinding = { ...binding, subject_hash: preflight.artifact_subject.subject_hash }
-  const boundPrompt = prompt.replace(BINDING, `GENTLE_AI_REVIEW_BINDING ${JSON.stringify(injectedBinding)}\n`)
-  const frozen = JSON.stringify({
-    artifact_subject: preflight.artifact_subject,
-    candidate_diff: preflight.candidate_diff,
-    changed_path_manifest: preflight.changed_path_manifest,
-  })
-  return `${boundPrompt.trimEnd()}\n${FROZEN_CONTEXT}${frozen}`
+  return `GENTLE_AI_REVIEW_BINDING ${JSON.stringify(injectedBinding)}\n` +
+    `GENTLE_AI_REVIEW_CONTEXT ${JSON.stringify(preflight)}\n`
 }
 
 function preserveResult(cwd: string, binding: ReviewBinding, raw: string, cls?: string): Promise<string> {
@@ -222,9 +277,30 @@ function gitTrustRefusal(binding: ReviewBinding, cause: unknown): boolean {
   return Boolean(binding.repository_context) && new RegExp(`\\b${GIT_TRUST_REFUSAL_CODE}\\b`).test(errorMessage(cause))
 }
 
+// ADMISSION_REJECTION matches the typed decision the native CLI emits when it
+// refused the reviewer RESULT itself (`reviewer artifact admission <decision>:`
+// from internal/cli/review_artifact.go). Only the [a-z_]+ decision token is
+// forwarded — never the native diagnostic, which can embed payload text — so
+// the opaque path keeps its rule that no native prose reaches the transcript.
+// Without this, an invalid result collapsed into "retry the same opaque
+// binding", advice that deterministically fails: recapturing identical bytes
+// can never satisfy admission, only a relaunched reviewer can.
+const ADMISSION_REJECTION = /\breviewer artifact admission ([a-z_]+):/
+
+function admissionRejection(cause: unknown): string | undefined {
+  const match = ADMISSION_REJECTION.exec(errorMessage(cause))
+  return match ? match[1] : undefined
+}
+
 function sessionErrorMessage(binding: ReviewBinding, cause: unknown, code: string): string {
   if (!binding.repository_context) return errorMessage(cause)
   if (gitTrustRefusal(binding, cause)) return GIT_TRUST_REFUSAL_MESSAGE
+  const admission = admissionRejection(cause)
+  if (admission) {
+    return `${code}: native admission rejected the reviewer result as ${admission}; ` +
+      "retrying capture with the same result cannot succeed — relaunch this lens reviewer to produce a corrected result " +
+      "(severe findings must anchor to lines the frozen candidate actually changed)"
+  }
   return `${code}: provider-owned review operation failed; refresh the exact native next_transition or retry the same opaque binding`
 }
 
diff --git a/internal/assets/review_plugin_recovery_test.go b/internal/assets/review_plugin_recovery_test.go
index df1533232..fbf42e714 100644
--- a/internal/assets/review_plugin_recovery_test.go
+++ b/internal/assets/review_plugin_recovery_test.go
@@ -29,16 +29,16 @@ const opaque = {
 const legacy = { lens: "review-risk", lineage: "trust-check", order: 0, target: "sha256:" + "d".repeat(64) }
 const binding = scenario.endsWith("legacy") ? legacy : opaque
 let prompt = ` + "`" + `GENTLE_AI_REVIEW_BINDING ${JSON.stringify(binding)}\nreview the frozen candidate\n` + "`" + `
+if (scenario === "before-substitute") prompt += ` + "`" + `base_tree=${"9".repeat(40)} candidate_tree=${"8".repeat(40)} changed_path_manifest=[{"path":"caller.txt"}]\n` + "`" + `
 if (scenario === "before-missing") prompt = "review the frozen candidate\n"
 if (scenario === "before-equals") prompt = ` + "`" + `GENTLE_AI_REVIEW_BINDING=${JSON.stringify(binding)}\nreview the frozen candidate\n` + "`" + `
 if (scenario === "before-malformed") prompt = "GENTLE_AI_REVIEW_BINDING {not-json}\nreview the frozen candidate\n"
-if (scenario === "before-forged") prompt += "GENTLE_AI_FROZEN_CANDIDATE_CONTEXT {\"forged\":true}\n"
 
 try {
   if (scenario.startsWith("before")) {
     const output = { args: { subagent_type: "review-risk", prompt } }
     await hooks["tool.execute.before"]({ tool: "task" }, output)
-    console.log(scenario === "before-valid" ? output.args.prompt : "NO_ERROR")
+    console.log(scenario === "before-valid" || scenario === "before-substitute" ? output.args.prompt : "NO_ERROR")
   } else {
     const input = { tool: "task", args: { subagent_type: "review-risk", prompt } }
     const output = { output: '{"subject_hash":"sha256:x","findings":[],"evidence":["` + reviewPluginPayloadMarker + `"]}' }
@@ -137,30 +137,64 @@ func TestReviewPluginRejectsInvalidBindingBeforeReviewerLaunch(t *testing.T) {
 	}
 }
 
-func TestReviewPluginRejectsCallerSuppliedFrozenContextBeforeReviewerLaunch(t *testing.T) {
-	message := runReviewPluginScenarioWithNative(t, "before-forged", `{"unexpected":"native call"}`, "")
-	const want = "review task must not supply GENTLE_AI_FROZEN_CANDIDATE_CONTEXT"
-	if message != want {
-		t.Fatalf("caller-supplied frozen context result = %q, want %q", message, want)
-	}
-}
-
-func TestReviewPluginInjectsExactlyOneNativeFrozenContext(t *testing.T) {
-	preflight := `{"artifact_subject":{"subject_hash":"sha256:` + strings.Repeat("c", 64) + `"},` +
-		`"candidate_diff":{"patch":"native exact diff"},` +
-		`"changed_path_manifest":[{"path":"internal/example.go"}]}`
+func TestReviewPluginBindsProviderOwnedCandidateContext(t *testing.T) {
+	baseTree := strings.Repeat("1", 40)
+	candidateTree := strings.Repeat("2", 40)
+	preflight := reviewPluginPreflight(baseTree, candidateTree)
 	prompt := runReviewPluginScenarioWithNative(t, "before-valid", preflight, "")
 	if !strings.HasPrefix(prompt, "GENTLE_AI_REVIEW_BINDING {") {
 		t.Fatalf("injected prompt does not begin with the exact binding prefix: %q", prompt)
 	}
-	if count := strings.Count(prompt, "GENTLE_AI_FROZEN_CANDIDATE_CONTEXT "); count != 1 {
-		t.Fatalf("native frozen context count = %d, want exactly one: %q", count, prompt)
+	if !strings.Contains(prompt, `"subject_hash":"sha256:`+strings.Repeat("c", 64)+`"`) {
+		t.Fatalf("bound prompt is missing the preflight subject hash: %q", prompt)
 	}
-	for _, nativeValue := range []string{"native exact diff", "internal/example.go"} {
-		if !strings.Contains(prompt, nativeValue) {
-			t.Fatalf("injected prompt missing native preflight value %q: %q", nativeValue, prompt)
+	for _, want := range []string{"GENTLE_AI_REVIEW_CONTEXT ", baseTree, candidateTree, "internal/example.go"} {
+		if !strings.Contains(prompt, want) {
+			t.Fatalf("plugin omitted provider context %q: %q", want, prompt)
 		}
 	}
+	if strings.Contains(prompt, "candidate_diff") {
+		t.Fatalf("injected prompt contains obsolete candidate diff payload: %q", prompt)
+	}
+}
+
+func TestReviewPluginRejectsNonCanonicalProviderManifest(t *testing.T) {
+	entry := `{"path":"internal/example.go","status":"M","old_mode":"100644","new_mode":"100644","deleted":false,"type_changed":false,"mode_only":false,"intended_untracked":false}`
+	unsorted := `{"path":"z.go","status":"M","old_mode":"100644","new_mode":"100644","deleted":false,"type_changed":false,"mode_only":false,"intended_untracked":false},` + entry
+	preflight := strings.Replace(reviewPluginPreflight(strings.Repeat("1", 40), strings.Repeat("2", 40)), entry, unsorted, 1)
+	message := runReviewPluginScenarioWithNative(t, "before-valid", preflight, "")
+	if !strings.Contains(message, "review capture preflight failed") || !strings.Contains(message, "The reviewer was not launched") {
+		t.Fatalf("non-canonical provider manifest was accepted: %s", message)
+	}
+	if strings.Contains(message, "incomplete artifact subject") {
+		t.Fatalf("opaque preflight exposed native validation detail: %s", message)
+	}
+}
+
+func TestReviewPluginReplacesCallerAuthoredCandidateContext(t *testing.T) {
+	baseTree := strings.Repeat("1", 40)
+	candidateTree := strings.Repeat("2", 40)
+	prompt := runReviewPluginScenarioWithNative(t, "before-substitute", reviewPluginPreflight(baseTree, candidateTree), "")
+	for _, callerValue := range []string{strings.Repeat("9", 40), strings.Repeat("8", 40), "caller.txt", "review the frozen candidate"} {
+		if strings.Contains(prompt, callerValue) {
+			t.Fatalf("provider injection retained caller-authored context %q: %q", callerValue, prompt)
+		}
+	}
+	for _, providerValue := range []string{baseTree, candidateTree, "internal/example.go"} {
+		if !strings.Contains(prompt, providerValue) {
+			t.Fatalf("provider injection omitted preflight context %q: %q", providerValue, prompt)
+		}
+	}
+}
+
+func reviewPluginPreflight(baseTree, candidateTree string) string {
+	return `{"schema":"gentle-ai.review-capture-preflight/v1","capability":"review.native_capture_preflight",` +
+		`"lineage_id":"trust-check","target_identity":"sha256:` + strings.Repeat("d", 64) + `","lens":"review-risk","selected_order":0,` +
+		`"artifact_subject":{"schema":"gentle-ai.review-artifact-subject/v2","subject_hash":"sha256:` + strings.Repeat("c", 64) + `",` +
+		`"lineage_id":"trust-check","authority_revision":"sha256:` + strings.Repeat("b", 64) + `","target_identity":"sha256:` + strings.Repeat("d", 64) + `",` +
+		`"base_tree":"` + baseTree + `","candidate_tree":"` + candidateTree + `","changed_path_manifest_sha256":"sha256:` + strings.Repeat("e", 64) + `",` +
+		`"lens":"review-risk","selected_order":0},"base_tree":"` + baseTree + `","candidate_tree":"` + candidateTree + `",` +
+		`"changed_path_manifest":[{"path":"internal/example.go","status":"M","old_mode":"100644","new_mode":"100644","deleted":false,"type_changed":false,"mode_only":false,"intended_untracked":false}]}`
 }
 
 func TestReviewPluginRejectsLegacyBinaryWithoutPreflightBeforeReviewerLaunch(t *testing.T) {
@@ -233,6 +267,37 @@ func TestReviewPluginSurfacesNativeGitTrustRefusal(t *testing.T) {
 	}
 }
 
+// TestReviewPluginSurfacesAdmissionRejectionClass pins the diagnosability fix
+// from the first live 4R run: a reviewer result the native admission refused
+// (for example a severe finding anchored to an unchanged line) collapsed into
+// "retry the same opaque binding" — advice that deterministically fails,
+// because recapturing identical bytes can never satisfy admission. The opaque
+// message must carry the typed decision class and direct the caller to
+// relaunch the reviewer, while the native diagnostic prose (which can embed
+// payload text) stays out of the transcript.
+func TestReviewPluginSurfacesAdmissionRejectionClass(t *testing.T) {
+	native := "Error: reviewer artifact admission out_of_scope: candidate-causal findings are not proven by repository-derived changed-line evidence"
+	message := runReviewPluginScenario(t, "after-opaque", native)
+	if message == "NO_ERROR" {
+		t.Fatal("plugin did not fail despite an always-failing native binary")
+	}
+	if !strings.Contains(message, "rejected the reviewer result as out_of_scope") {
+		t.Fatalf("admission rejection lost its typed decision class: %s", message)
+	}
+	if !strings.Contains(message, "relaunch this lens reviewer") {
+		t.Fatalf("admission rejection carries no instruction that can actually succeed: %s", message)
+	}
+	if strings.Contains(message, "retry the same opaque binding") {
+		t.Fatalf("plugin still advises retrying a deterministically refused result: %s", message)
+	}
+	if strings.Contains(message, "changed-line evidence") {
+		t.Fatalf("plugin forwarded native admission diagnostic prose through an opaque binding: %s", message)
+	}
+	if !strings.Contains(message, reviewPluginPayloadMarker) {
+		t.Fatalf("admission rejection did not preserve the reviewer payload: %s", message)
+	}
+}
+
 // TestReviewPluginKeepsGenericOpaqueFailureOpaque proves the trust pass-through
 // is not a hole in the opaque path's path-safety rule: any other native failure
 // still collapses into the generic provider-owned message.
diff --git a/internal/assets/skills/_shared/review-ledger-contract.md b/internal/assets/skills/_shared/review-ledger-contract.md
index 5538f9955..8cc85a2fe 100644
--- a/internal/assets/skills/_shared/review-ledger-contract.md
+++ b/internal/assets/skills/_shared/review-ledger-contract.md
@@ -4,17 +4,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -23,7 +25,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/internal/cli/review_artifact.go b/internal/cli/review_artifact.go
index 25e3dd4aa..7d7f23e54 100644
--- a/internal/cli/review_artifact.go
+++ b/internal/cli/review_artifact.go
@@ -228,6 +228,7 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 	lens := flags.String("lens", "", "exact selected lens")
 	order := flags.Int("order", -1, "zero-based selected lens order")
 	revision := flags.String("expected-revision", "", "exact reviewing authority revision")
+	subjectHash := flags.String("subject-hash", "", "provider-issued artifact subject hash for native-Git context")
 	input := flags.String("input", "", "raw reviewer result JSON file or - for stdin; `gentle-ai review schema reviewer` emits the schema and a working example")
 	preflight := flags.Bool("preflight", false, "verify the capture binding against the current reviewing authority without reading or persisting any result")
 	if err := parseReviewFlags(flags, args); err != nil {
@@ -289,7 +290,7 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 	if state.State != reviewtransaction.StateReviewing || state.LineageID != *lineage || state.InitialSnapshot.Identity != *target ||
 		(strings.TrimSpace(*revision) != "" && record.Revision != *revision) || *order >= len(state.SelectedLenses) || state.SelectedLenses[*order] != *lens {
 		if contextHandle != "" {
-			return reviewPreflightError(fmt.Errorf("capture binding does not match the current reviewing authority under the provider-issued repository context; ask the parent orchestrator to refresh the exact native next transition by running %s", reviewNextTransitionRefreshCommand))
+			return reviewPreflightError(fmt.Errorf("capture binding does not match the current reviewing authority under the provider-issued repository context; ask the parent orchestrator to refresh the exact native next transition by running %s", reviewNextTransitionRefreshCommandV2))
 		}
 		return reviewPreflightError(fmt.Errorf("capture binding does not match the current reviewing authority under repository %q; verify the frozen lineage, target, lens, and order for that repository, or re-run with --cwd set to the repository where the review was started", root))
 	}
@@ -302,6 +303,17 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 		return reviewPreflightError(fmt.Errorf("derive reviewer artifact subject: %w", err))
 	}
 	if *preflight {
+		if *subjectHash != "" && *subjectHash != subject.SubjectHash {
+			legacyFrozen, legacyErr := (reviewtransaction.SnapshotBuilder{Repo: root}).WithLegacyCandidateDiff(ctx, state.InitialSnapshot, frozen)
+			if legacyErr != nil {
+				return reviewPreflightError(errors.New("review capture preflight subject hash does not match the provider-owned authority; refresh the binding with gentle-ai review status --cwd <repo> --contract <same-contract> --next-transition"))
+			}
+			legacySubject, legacyErr := reviewtransaction.NewLegacyArtifactSubject(state, record.Revision, legacyFrozen, *lens, *order, "")
+			if legacyErr != nil || *subjectHash != legacySubject.SubjectHash {
+				return reviewPreflightError(errors.New("review capture preflight subject hash does not match the provider-owned authority; refresh the binding with gentle-ai review status --cwd <repo> --contract <same-contract> --next-transition"))
+			}
+			frozen, subject = legacyFrozen, legacySubject
+		}
 		publicRoot := root
 		if contextHandle != "" {
 			publicRoot = ""
@@ -309,7 +321,7 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 		return encodeReviewJSON(stdout, reviewCapturePreflightResult{
 			Schema: reviewCapturePreflightSchema, Capability: reviewCapturePreflightCapability, RepositoryRoot: publicRoot,
 			LineageID: state.LineageID, TargetIdentity: state.InitialSnapshot.Identity, Lens: *lens, SelectedOrder: *order,
-			ArtifactSubject: subject, CandidateDiff: frozen.CandidateDiff,
+			ArtifactSubject: subject, BaseTree: frozen.BaseTree, CandidateTree: frozen.CandidateTree,
 			ChangedPathManifest: append([]reviewtransaction.ChangedPathManifestEntry{}, frozen.ChangedPathManifest...),
 		})
 	}
@@ -331,6 +343,15 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 	if result.Findings == nil || result.Evidence == nil {
 		return reviewPreflightError(errors.New("reviewer result requires explicit findings and evidence arrays"))
 	}
+	if result.SubjectHash != subject.SubjectHash {
+		legacyFrozen, legacyErr := (reviewtransaction.SnapshotBuilder{Repo: root}).WithLegacyCandidateDiff(ctx, state.InitialSnapshot, frozen)
+		if legacyErr == nil {
+			legacySubject, subjectErr := reviewtransaction.NewLegacyArtifactSubject(state, record.Revision, legacyFrozen, *lens, *order, "")
+			if subjectErr == nil && result.SubjectHash == legacySubject.SubjectHash {
+				frozen, subject = legacyFrozen, legacySubject
+			}
+		}
+	}
 	if _, err := prepareCompactReviewerResults(reviewtransaction.CompactState{SelectedLenses: []string{*lens}}, []facadeReviewerResult{result}, facadeRefuterResult{}); err != nil {
 		return reviewPreflightError(err)
 	}
@@ -365,8 +386,12 @@ func RunReviewCaptureResult(args []string, stdout io.Writer) error {
 	if err != nil {
 		return reviewPreflightError(err)
 	}
+	envelopeSchema := reviewAdmittedResultSchema
+	if subject.Schema == reviewtransaction.ArtifactSubjectSchemaV1 {
+		envelopeSchema = reviewtransaction.AdmittedReviewerResultSchemaV1
+	}
 	envelope, err := json.Marshal(admittedReviewerResult{
-		Schema: reviewAdmittedResultSchema, Subject: subject, Admission: admission, Result: result,
+		Schema: envelopeSchema, Subject: subject, Admission: admission, Result: result,
 	})
 	if err != nil {
 		return err
@@ -671,7 +696,7 @@ func readFacadeReviewerArtifacts(ctx context.Context, repo string, raw []string,
 		if err != nil {
 			return nil, fmt.Errorf("verify reviewer artifact %d: %w", index+1, err)
 		}
-		result, subject, err := decodeBoundAdmittedReviewerResult(payload, artifact.SHA256, state, revision, index, frozen)
+		result, subject, err := decodeBoundAdmittedReviewerResult(ctx, repo, payload, artifact.SHA256, state, revision, index, frozen)
 		if err != nil {
 			return nil, fmt.Errorf("parse reviewer artifact %d: %w", index+1, err)
 		}
@@ -713,7 +738,7 @@ func discoverCapturedReviewerArtifacts(ctx context.Context, repo, storeDir strin
 		if err != nil {
 			return nil, fmt.Errorf("verify captured reviewer result %d: %w", order, err)
 		}
-		_, subject, err := decodeBoundAdmittedReviewerResult(payload, artifact.SHA256, state, revision, order, frozen)
+		_, subject, err := decodeBoundAdmittedReviewerResult(ctx, repo, payload, artifact.SHA256, state, revision, order, frozen)
 		if err != nil {
 			return nil, fmt.Errorf("verify captured reviewer admission %d: %w", order, err)
 		}
@@ -753,7 +778,7 @@ func readCapturedReviewerResults(ctx context.Context, repo, storeDir string, sta
 		if err != nil {
 			return nil, err
 		}
-		result, subject, err := decodeBoundAdmittedReviewerResult(payload, artifact.SHA256, state, revision, index, frozen)
+		result, subject, err := decodeBoundAdmittedReviewerResult(ctx, repo, payload, artifact.SHA256, state, revision, index, frozen)
 		if err != nil {
 			return nil, err
 		}
@@ -773,7 +798,7 @@ func reviewerArtifactFrozenContext(ctx context.Context, repo string, state revie
 	return frozen, nil
 }
 
-func decodeBoundAdmittedReviewerResult(payload []byte, artifactDigest string, state reviewtransaction.CompactState, currentRevision string, order int, frozen reviewtransaction.FrozenCandidateContext) (facadeReviewerResult, reviewtransaction.ArtifactSubject, error) {
+func decodeBoundAdmittedReviewerResult(ctx context.Context, repo string, payload []byte, artifactDigest string, state reviewtransaction.CompactState, currentRevision string, order int, frozen reviewtransaction.FrozenCandidateContext) (facadeReviewerResult, reviewtransaction.ArtifactSubject, error) {
 	var envelope admittedReviewerResult
 	if err := decodeFacadeJSONBytes(payload, &envelope); err != nil {
 		return facadeReviewerResult{}, reviewtransaction.ArtifactSubject{}, err
@@ -787,13 +812,25 @@ func decodeBoundAdmittedReviewerResult(payload []byte, artifactDigest string, st
 		) {
 		return facadeReviewerResult{}, reviewtransaction.ArtifactSubject{}, errors.New("captured reviewer result does not bind the active authority revision")
 	}
-	expected, err := reviewtransaction.NewArtifactSubject(
-		state, envelope.Subject.AuthorityRevision, frozen, state.SelectedLenses[order], order, envelope.Subject.CorrectionTargetIdentity,
-	)
+	subjectFrozen := frozen
+	var expected reviewtransaction.ArtifactSubject
+	var err error
+	if envelope.Subject.Schema == reviewtransaction.ArtifactSubjectSchemaV1 {
+		subjectFrozen, err = (reviewtransaction.SnapshotBuilder{Repo: repo}).WithLegacyCandidateDiff(ctx, state.InitialSnapshot, frozen)
+		if err == nil {
+			expected, err = reviewtransaction.NewLegacyArtifactSubject(
+				state, envelope.Subject.AuthorityRevision, subjectFrozen, state.SelectedLenses[order], order, envelope.Subject.CorrectionTargetIdentity,
+			)
+		}
+	} else {
+		expected, err = reviewtransaction.NewArtifactSubject(
+			state, envelope.Subject.AuthorityRevision, frozen, state.SelectedLenses[order], order, envelope.Subject.CorrectionTargetIdentity,
+		)
+	}
 	if err != nil {
 		return facadeReviewerResult{}, reviewtransaction.ArtifactSubject{}, err
 	}
-	result, err := decodeAdmittedReviewerResult(payload, expected, frozen)
+	result, err := decodeAdmittedReviewerResult(payload, expected, subjectFrozen)
 	if err != nil {
 		return facadeReviewerResult{}, reviewtransaction.ArtifactSubject{}, err
 	}
@@ -813,7 +850,11 @@ func decodeAdmittedReviewerResult(payload []byte, expected reviewtransaction.Art
 	if err := decodeFacadeJSONBytes(payload, &envelope); err != nil {
 		return facadeReviewerResult{}, err
 	}
-	if envelope.Schema != reviewAdmittedResultSchema || !reflect.DeepEqual(envelope.Subject, expected) {
+	wantSchema := reviewAdmittedResultSchema
+	if expected.Schema == reviewtransaction.ArtifactSubjectSchemaV1 {
+		wantSchema = reviewtransaction.AdmittedReviewerResultSchemaV1
+	}
+	if envelope.Schema != wantSchema || !reflect.DeepEqual(envelope.Subject, expected) {
 		return facadeReviewerResult{}, errors.New("captured reviewer result does not contain the exact provider-owned subject")
 	}
 	if err := envelope.Admission.Validate(expected); err != nil {
diff --git a/internal/cli/review_capabilities.go b/internal/cli/review_capabilities.go
index e1759386a..94c03c127 100644
--- a/internal/cli/review_capabilities.go
+++ b/internal/cli/review_capabilities.go
@@ -17,6 +17,7 @@ import (
 )
 
 const ReviewIntegrationContractV1 = "gentle-ai.review-integration/v1"
+const ReviewIntegrationContractV2 = "gentle-ai.review-integration/v2"
 const ReviewIntegrationCapabilitiesSchemaV1 = "gentle-ai.review-integration.capabilities/v1"
 const ReviewIntegrationCapabilitiesSchemaIDV1 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/capabilities.schema.json"
 const ReviewIntegrationCapabilitiesSchemaV11 = "gentle-ai.review-integration.capabilities/v1.1"
@@ -29,6 +30,8 @@ const ReviewIntegrationCapabilitiesSchemaV14 = "gentle-ai.review-integration.cap
 const ReviewIntegrationCapabilitiesSchemaIDV14 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/capabilities-v1.4.schema.json"
 const ReviewIntegrationCapabilitiesSchema = "gentle-ai.review-integration.capabilities/v1.5"
 const ReviewIntegrationCapabilitiesSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/capabilities-v1.5.schema.json"
+const ReviewIntegrationCapabilitiesSchemaV2 = "gentle-ai.review-integration.capabilities/v2"
+const ReviewIntegrationCapabilitiesSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/capabilities.schema.json"
 
 const (
 	reviewRefuterSchemaID   = "https://gentle-ai.dev/schema/review/refuter/v1"
@@ -43,6 +46,7 @@ const (
 // both name this same runnable command instead of only describing the
 // concept, so they cannot drift from each other.
 const reviewNextTransitionRefreshCommand = "gentle-ai review status --cwd <repo> --contract " + ReviewIntegrationContractV1 + " --next-transition"
+const reviewNextTransitionRefreshCommandV2 = "gentle-ai review status --cwd <repo> --contract " + ReviewIntegrationContractV2 + " --next-transition"
 
 var reviewCapabilitiesBuildInfoReader = debug.ReadBuildInfo
 var reviewCapabilitiesExecutablePath = os.Executable
@@ -150,7 +154,7 @@ func RunReviewCapabilities(args []string, stdout io.Writer) error {
 	if err := validateReviewIntegrationContract(*contract); err != nil {
 		return err
 	}
-	result, err := buildReviewCapabilities()
+	result, err := buildReviewCapabilities(*contract)
 	if err != nil {
 		return err
 	}
@@ -158,13 +162,17 @@ func RunReviewCapabilities(args []string, stdout io.Writer) error {
 }
 
 func validateReviewIntegrationContract(contract string) error {
-	if contract != ReviewIntegrationContractV1 {
-		return fmt.Errorf("unsupported review integration contract %q; supported contract is %s", contract, ReviewIntegrationContractV1)
+	if contract != ReviewIntegrationContractV1 && contract != ReviewIntegrationContractV2 {
+		return fmt.Errorf("unsupported review integration contract %q; retry with gentle-ai review capabilities --contract %s or gentle-ai review capabilities --contract %s", contract, ReviewIntegrationContractV1, ReviewIntegrationContractV2)
 	}
 	return nil
 }
 
-func buildReviewCapabilities() (ReviewCapabilitiesResult, error) {
+func buildReviewCapabilities(contracts ...string) (ReviewCapabilitiesResult, error) {
+	contract := ReviewIntegrationContractV1
+	if len(contracts) > 0 {
+		contract = contracts[0]
+	}
 	version := strings.TrimSpace(AppVersion)
 	if version == "" {
 		return ReviewCapabilitiesResult{}, errors.New("gentle-ai package version is unavailable")
@@ -177,7 +185,7 @@ func buildReviewCapabilities() (ReviewCapabilitiesResult, error) {
 	if err != nil {
 		return ReviewCapabilitiesResult{}, err
 	}
-	result := reviewCapabilitiesStaticSurface()
+	result := reviewCapabilitiesStaticSurface(contract)
 	result.Package = ReviewCapabilitiesPackage{Name: "gentle-ai", Version: version, ReleaseChannel: reviewReleaseChannel(version)}
 	result.Build = build
 	result.Executable = ReviewCapabilitiesExecutable{
@@ -189,8 +197,12 @@ func buildReviewCapabilities() (ReviewCapabilitiesResult, error) {
 	return result, nil
 }
 
-func reviewCapabilitiesStaticSurface() ReviewCapabilitiesResult {
-	return ReviewCapabilitiesResult{
+func reviewCapabilitiesStaticSurface(contracts ...string) ReviewCapabilitiesResult {
+	contract := ReviewIntegrationContractV1
+	if len(contracts) > 0 {
+		contract = contracts[0]
+	}
+	result := ReviewCapabilitiesResult{
 		Schema:     ReviewIntegrationCapabilitiesSchema,
 		Contract:   ReviewIntegrationContractV1,
 		Protocol:   ReviewCapabilitiesProtocol{Major: 1, Minor: 5},
@@ -201,8 +213,8 @@ func reviewCapabilitiesStaticSurface() ReviewCapabilitiesResult {
 		},
 		Projections: []string{string(reviewtransaction.ProjectionStaged), string(reviewtransaction.ProjectionWorkspace)},
 		Schemas: []string{
-			reviewtransaction.AdmittedReviewerResultSchema,
-			reviewtransaction.ArtifactSubjectSchema,
+			reviewtransaction.AdmittedReviewerResultSchemaV1,
+			reviewtransaction.ArtifactSubjectSchemaV1,
 			reviewtransaction.AuthorityRepairAssessmentSchema,
 			reviewtransaction.ReviewAuthorityStatusSchema,
 			reviewtransaction.GateRequestSchema,
@@ -212,8 +224,8 @@ func reviewCapabilitiesStaticSurface() ReviewCapabilitiesResult {
 			ReviewIntegrationOperationSchema,
 			ReviewIntegrationProjectionSchema,
 			ReviewIntegrationRepairSchema,
-			ReviewIntegrationStartSchema,
-			ReviewIntegrationStatusSchema,
+			ReviewIntegrationStartSchemaV2,
+			ReviewIntegrationStatusSchemaV2,
 			reviewtransaction.ReceiptSchema,
 			reviewtransaction.CompactReceiptSchema,
 			reviewResultArtifactSchema,
@@ -275,6 +287,41 @@ func reviewCapabilitiesStaticSurface() ReviewCapabilitiesResult {
 			},
 		},
 	}
+	if contract == ReviewIntegrationContractV2 {
+		result.Schema, result.Contract = ReviewIntegrationCapabilitiesSchemaV2, ReviewIntegrationContractV2
+		result.Protocol = ReviewCapabilitiesProtocol{Major: 2, Minor: 0}
+		for index, schema := range result.Schemas {
+			switch schema {
+			case reviewtransaction.AdmittedReviewerResultSchemaV1:
+				result.Schemas[index] = reviewtransaction.AdmittedReviewerResultSchema
+			case reviewtransaction.ArtifactSubjectSchemaV1:
+				result.Schemas[index] = reviewtransaction.ArtifactSubjectSchema
+			case ReviewIntegrationCapabilitiesSchema:
+				result.Schemas[index] = ReviewIntegrationCapabilitiesSchemaV2
+			case ReviewIntegrationFailureSchema:
+				result.Schemas[index] = ReviewIntegrationFailureSchemaV2
+			case ReviewIntegrationConsentSchema:
+				result.Schemas[index] = ReviewIntegrationConsentSchemaV2
+			case ReviewIntegrationOperationSchema:
+				result.Schemas[index] = ReviewIntegrationOperationSchemaV2
+			case ReviewIntegrationRepairSchema:
+				result.Schemas[index] = ReviewIntegrationRepairSchemaV2
+			case ReviewIntegrationStartSchemaV2:
+				result.Schemas[index] = ReviewIntegrationStartSchema
+			case ReviewIntegrationStatusSchemaV2:
+				result.Schemas[index] = ReviewIntegrationStatusSchema
+			}
+		}
+		result.Schemas = append(result.Schemas, ReviewIntegrationConsentSchemaV2)
+		result.Features.Optional = append(result.Features.Optional, ReviewCapabilityFeature{
+			Name: "provider_bound_native_git_context", Supported: true,
+			Requires: []string{"native_frozen_candidate_context", "opaque_repository_context", "provider_artifact_admission"},
+		})
+		result.Bootstrap.Command = reviewNextTransitionRefreshCommandV2
+		result.Compatibility.MinimumProtocolMajor, result.Compatibility.MaximumProtocolMajor = 2, 2
+		result.Compatibility.AdditiveMinorPolicy = "optional-fields-only"
+	}
+	return result
 }
 
 func reviewCapabilitiesBuildIdentity(packageVersion string) (ReviewCapabilitiesBuild, error) {
@@ -353,15 +400,15 @@ func reviewReleaseChannel(version string) string {
 }
 
 func (result ReviewCapabilitiesResult) Validate() error {
-	static := reviewCapabilitiesStaticSurface()
+	static := reviewCapabilitiesStaticSurface(result.Contract)
 	if result.Schema != static.Schema || result.Contract != static.Contract || result.Protocol != static.Protocol ||
 		!reflect.DeepEqual(result.Operations, static.Operations) || !reflect.DeepEqual(result.Gates, static.Gates) ||
 		!reflect.DeepEqual(result.Projections, static.Projections) || !reflect.DeepEqual(result.Schemas, static.Schemas) ||
 		!reflect.DeepEqual(result.Features.Mandatory, static.Features.Mandatory) || !reflect.DeepEqual(result.Features.Optional, static.Features.Optional) || !reflect.DeepEqual(result.Compatibility, static.Compatibility) {
-		return errors.New("capability surface does not match the negotiated v1 contract")
+		return errors.New("capability surface does not match the negotiated contract") // refusal:by-design world-action: provider-generated capabilities require a code fix, not an operator command
 	}
 	if result.Bootstrap != nil && !reflect.DeepEqual(result.Bootstrap, static.Bootstrap) {
-		return errors.New("capability bootstrap does not match the negotiated v1 contract")
+		return errors.New("capability bootstrap does not match the negotiated contract") // refusal:by-design world-action: provider-generated bootstrap requires a code fix, not an operator command
 	}
 	if result.Package.Name != "gentle-ai" || strings.TrimSpace(result.Package.Version) == "" || result.Package.ReleaseChannel != reviewReleaseChannel(result.Package.Version) {
 		return errors.New("capability package identity is invalid")
diff --git a/internal/cli/review_capabilities_test.go b/internal/cli/review_capabilities_test.go
index 8b665cc06..d9d064593 100644
--- a/internal/cli/review_capabilities_test.go
+++ b/internal/cli/review_capabilities_test.go
@@ -83,6 +83,33 @@ func TestReviewCapabilitiesMatchesConformanceFixtureOutsideRepository(t *testing
 	}
 }
 
+func TestReviewCapabilitiesV2MatchesConformanceFixture(t *testing.T) {
+	fixture, err := os.ReadFile(filepath.Join("..", "..", "contracts", "review-integration", "v2", "fixtures", "capabilities.fixture.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	executable := filepath.Join(t.TempDir(), "gentle-ai-fixture")
+	if err := os.WriteFile(executable, []byte(capabilityFixtureExecutable), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	restore := stubReviewCapabilityIdentity(t, executable)
+	defer restore()
+	var output bytes.Buffer
+	if err := RunReview([]string{"capabilities", "--contract", ReviewIntegrationContractV2}, &output); err != nil {
+		t.Fatal(err)
+	}
+	var got, want ReviewCapabilitiesResult
+	if err := json.Unmarshal(output.Bytes(), &got); err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(fixture, &want); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("v2 capabilities do not match conformance fixture:\ngot=%#v\nwant=%#v", got, want)
+	}
+}
+
 func TestReviewCapabilitiesContractValidationIsExactAndReadOnly(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -90,8 +117,9 @@ func TestReviewCapabilitiesContractValidationIsExactAndReadOnly(t *testing.T) {
 		wantErr  bool
 	}{
 		{name: "supported", contract: ReviewIntegrationContractV1},
+		{name: "native Git", contract: ReviewIntegrationContractV2},
 		{name: "empty", contract: "", wantErr: true},
-		{name: "future major", contract: "gentle-ai.review-integration/v2", wantErr: true},
+		{name: "future major", contract: "gentle-ai.review-integration/v3", wantErr: true},
 		{name: "surrounding whitespace", contract: " " + ReviewIntegrationContractV1, wantErr: true},
 	}
 	for _, tt := range tests {
@@ -103,12 +131,13 @@ func TestReviewCapabilitiesContractValidationIsExactAndReadOnly(t *testing.T) {
 	}
 	outside := t.TempDir()
 	var output bytes.Buffer
-	err := RunReview([]string{"capabilities", "--contract", "gentle-ai.review-integration/v2"}, &output)
-	if err == nil {
-		t.Fatalf("unsupported contract result = %q, %v", output.String(), err)
+	err := RunReview([]string{"capabilities", "--contract", ReviewIntegrationContractV2}, &output)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if failure := decodeReviewIntegrationFailure(t, output.Bytes()); failure.Code != "unsupported_contract" {
-		t.Fatalf("unsupported contract failure = %#v", failure)
+	var nativeGit ReviewCapabilitiesResult
+	if err := json.Unmarshal(output.Bytes(), &nativeGit); err != nil || nativeGit.Contract != ReviewIntegrationContractV2 || nativeGit.Schema != ReviewIntegrationCapabilitiesSchemaV2 {
+		t.Fatalf("native Git capabilities = %#v, %v", nativeGit, err)
 	}
 	entries, readErr := os.ReadDir(outside)
 	if readErr != nil || len(entries) != 0 {
@@ -139,7 +168,7 @@ func TestReviewCapabilitiesAdvertisesOnlyNativeSurface(t *testing.T) {
 	if !slices.Equal(result.Operations, wantOperations) || !slices.Equal(result.Gates, wantGates) || !slices.Equal(result.Projections, wantProjections) {
 		t.Fatalf("capability surface = operations %v gates %v projections %v", result.Operations, result.Gates, result.Projections)
 	}
-	if !slices.Contains(result.Schemas, reviewResultArtifactSchema) || !slices.Contains(result.Schemas, ReviewIntegrationOperationSchema) || !slices.Contains(result.Schemas, ReviewIntegrationStartSchema) || !slices.Contains(result.Schemas, ReviewIntegrationStatusSchema) || !slices.Contains(result.Schemas, ReviewIntegrationProjectionSchema) || !slices.Contains(result.Schemas, ReviewIntegrationRepairSchema) || !slices.Contains(result.Schemas, reviewtransaction.AuthorityRepairAssessmentSchema) || !slices.Contains(result.Schemas, reviewtransaction.FinalVerificationIncidentSchema) {
+	if !slices.Contains(result.Schemas, reviewResultArtifactSchema) || !slices.Contains(result.Schemas, ReviewIntegrationOperationSchema) || !slices.Contains(result.Schemas, ReviewIntegrationStartSchemaV2) || !slices.Contains(result.Schemas, ReviewIntegrationStatusSchemaV2) || !slices.Contains(result.Schemas, ReviewIntegrationProjectionSchema) || !slices.Contains(result.Schemas, ReviewIntegrationRepairSchema) || !slices.Contains(result.Schemas, reviewtransaction.AuthorityRepairAssessmentSchema) || !slices.Contains(result.Schemas, reviewtransaction.FinalVerificationIncidentSchema) {
 		t.Fatalf("capability schemas do not advertise the negotiated provider surface: %v", result.Schemas)
 	}
 	if result.Bootstrap == nil || result.Bootstrap.Command != "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition" ||
@@ -563,7 +592,7 @@ func TestReviewIntegrationDocumentationMatchesRuntimeContract(t *testing.T) {
 		"`stop`", "`legacy_v1_read_only`", "`mutation_outcome`", "`not_started`", "`unknown`", "`committed`",
 		"Legacy-v1 never reports `publication_pending`", "retry and replay disabled",
 		"Historical `ordinary_4r` legacy status omits `frozen`", "START, finalize, BIND-SDD, invalidation, and direct append",
-		"`native_frozen_candidate_context`", "`candidate_diff`", "`changed_path_manifest`",
+		"`native_frozen_candidate_context`", "`base_tree`", "`candidate_tree`", "`changed_path_manifest`",
 		"`opaque_repository_context`", "`provider_targeted_validation_request`",
 		"`provider_artifact_admission`", "`validating_result_reopen`", "`recovered_correction_evidence`",
 		"`one_shot_final_verification_retry`", "`outcome_bound_verification_evidence`", "`review.retry_final_verification`", "`procedural_tooling_failure`",
diff --git a/internal/cli/review_capabilities_v12_context_test.go b/internal/cli/review_capabilities_v12_context_test.go
index cdaff04de..c6a32f0fd 100644
--- a/internal/cli/review_capabilities_v12_context_test.go
+++ b/internal/cli/review_capabilities_v12_context_test.go
@@ -27,8 +27,8 @@ func TestReviewCapabilitiesV13AdvertisesProviderAdmissionAndRecovery(t *testing.
 		}
 	}
 	for _, schema := range []string{
-		reviewtransaction.ArtifactSubjectSchema,
-		reviewtransaction.AdmittedReviewerResultSchema,
+		reviewtransaction.ArtifactSubjectSchemaV1,
+		reviewtransaction.AdmittedReviewerResultSchemaV1,
 		reviewtransaction.TargetedValidationRequestSchema,
 	} {
 		if !slices.Contains(surface.Schemas, schema) {
diff --git a/internal/cli/review_consent_contract.go b/internal/cli/review_consent_contract.go
index dcd7cea09..bebb00a5b 100644
--- a/internal/cli/review_consent_contract.go
+++ b/internal/cli/review_consent_contract.go
@@ -10,6 +10,8 @@ import (
 
 const ReviewIntegrationConsentSchema = "gentle-ai.review-integration.consent/v1"
 const ReviewIntegrationConsentSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/consent.schema.json"
+const ReviewIntegrationConsentSchemaV2 = "gentle-ai.review-integration.consent/v2"
+const ReviewIntegrationConsentSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/consent.schema.json"
 
 // ReviewIntegrationConsentResult is the typed per-candidate consent question a
 // relay-declared negotiated START answers with instead of proceeding. It is a
@@ -79,6 +81,7 @@ func newReviewIntegrationConsentResult(
 	snapshot reviewtransaction.Snapshot,
 	assessment reviewtransaction.RiskAssessment,
 	followUpBase string,
+	contract string,
 ) (ReviewIntegrationConsentResult, error) {
 	// The evidence phrases may legitimately be empty (a large change with no
 	// sensitive path still escalates); the reason sentence always explains the
@@ -121,6 +124,9 @@ func newReviewIntegrationConsentResult(
 			Command: reviewConsentOffPathCommand,
 		},
 	}
+	if contract == ReviewIntegrationContractV2 {
+		result.Schema, result.Contract = ReviewIntegrationConsentSchemaV2, ReviewIntegrationContractV2
+	}
 	if err := result.Validate(); err != nil {
 		return ReviewIntegrationConsentResult{}, fmt.Errorf("validate consent question: %w", err)
 	}
@@ -128,7 +134,9 @@ func newReviewIntegrationConsentResult(
 }
 
 func (result ReviewIntegrationConsentResult) Validate() error {
-	if result.Schema != ReviewIntegrationConsentSchema || result.Contract != ReviewIntegrationContractV1 ||
+	legacyContract := result.Schema == ReviewIntegrationConsentSchema && result.Contract == ReviewIntegrationContractV1
+	nativeGitContract := result.Schema == ReviewIntegrationConsentSchemaV2 && result.Contract == ReviewIntegrationContractV2
+	if (!legacyContract && !nativeGitContract) ||
 		result.Operation != "review.start" || result.Action != reviewConsentActionRequired || !result.Blocking {
 		return errors.New("invalid consent question identity") // refusal:by-design world-action: this envelope is built and validated by the same file; the exit is a code fix, not a command
 	}
diff --git a/internal/cli/review_facade.go b/internal/cli/review_facade.go
index f7ec4e9e5..d45dc0bf1 100644
--- a/internal/cli/review_facade.go
+++ b/internal/cli/review_facade.go
@@ -122,18 +122,19 @@ const ReviewStartConsentDeclinedThisCandidate = "declined_this_candidate"
 const reviewStartEmptyCandidateHint = "the candidate has no pending changes; already-committed work can be reviewed by rerunning review start with --base-ref <commit> naming the base to compare against"
 
 // reviewStartNegotiateContractHint makes the negotiated contract path
-// discoverable from the plain START response. It transports the frozen target
-// selector as well as its identity so the rerun rebuilds the same authority.
+// discoverable from the plain START response. It transports the immutable Git
+// trees and preserves the frozen target selector so the rerun rebuilds the same
+// authority.
 func reviewStartNegotiateContractHint(snapshot reviewtransaction.Snapshot) string {
 	command := fmt.Sprintf("gentle-ai review start --contract %s --target %s --projection %s",
-		ReviewIntegrationContractV1, snapshot.Identity, facadeProjection(snapshot.Projection))
+		ReviewIntegrationContractV2, snapshot.Identity, facadeProjection(snapshot.Projection))
 	switch snapshot.Kind {
 	case reviewtransaction.TargetBaseDiff:
 		command += " --base-ref " + snapshot.BaseTree + " --committed-only"
 	case reviewtransaction.TargetBaseWorkspaceOverlay:
 		command += " --base-ref " + snapshot.BaseTree + " --workspace-overlay"
 	}
-	return "this response's selected lenses require the frozen candidate diff, changed-path manifest, and artifact subjects, which only the negotiated contract form returns; rerun with `" + command + "` to receive them"
+	return "this response's selected lenses require the frozen Git trees, changed-path manifest, and artifact subjects, which only the negotiated contract form returns; rerun with `" + command + "` to receive them"
 }
 
 // ReviewFacadeLensBinding pairs one selected lens with its frozen zero-based
@@ -794,7 +795,7 @@ func runReviewStatus(ctx context.Context, args []string, stdout io.Writer) error
 		if selectedBaseTree != "" && native.Projection.BaseTree != selectedBaseTree {
 			return errors.New("--base-tree does not identify an exact Git tree object")
 		}
-		result := newReviewTargetStatusResult(native)
+		result := newReviewTargetStatusResultForContract(native, *contract)
 		if native.Applicability == reviewtransaction.TargetApplicabilityCorrupted &&
 			native.Action == reviewtransaction.TargetStatusActionRepairAuthority {
 			repair, repairErr := reviewtransaction.AssessAuthorityRepairAtRepositoryRoot(ctx, root)
@@ -860,7 +861,11 @@ func runReviewStatus(ctx context.Context, args []string, stdout io.Writer) error
 								LineageID: record.State.LineageID, TargetIdentity: record.State.InitialSnapshot.Identity, Revision: record.Revision,
 							})
 							if artifactErr == nil {
-								frozen, frozenErr := (reviewtransaction.SnapshotBuilder{Repo: root}).FrozenCandidateContext(ctx, record.State.InitialSnapshot)
+								contextBuilder := reviewtransaction.SnapshotBuilder{Repo: root}
+								frozen, frozenErr := contextBuilder.FrozenCandidateContext(ctx, record.State.InitialSnapshot)
+								if frozenErr == nil && *contract == ReviewIntegrationContractV1 {
+									frozen, frozenErr = contextBuilder.WithLegacyCandidateDiff(ctx, record.State.InitialSnapshot, frozen)
+								}
 								if frozenErr != nil {
 									artifactErr = frozenErr
 								} else {
@@ -1239,7 +1244,7 @@ func runReviewBindSDD(ctx context.Context, args []string, stdout io.Writer) erro
 	if err != nil {
 		return err
 	}
-	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationBindSDD, binding, binding)
+	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationBindSDD, binding, binding, *contract)
 }
 
 func RunReviewInvalidate(args []string, stdout io.Writer) error {
@@ -1501,7 +1506,7 @@ func runReviewFacadeStart(ctx context.Context, args []string, stdout io.Writer)
 			question, questionErr := newReviewIntegrationConsentResult(snapshot, assessment,
 				reviewConsentFollowUpBase(*cwd, snapshot.Identity, selectedProjection, strings.TrimSpace(*lineage),
 					strings.TrimSpace(*baseRef), strings.TrimSpace(*policySource), strings.TrimSpace(*focus),
-					strings.TrimSpace(*tracePath), *committedOnly, *workspaceOverlay))
+					strings.TrimSpace(*tracePath), *committedOnly, *workspaceOverlay, *contract), *contract)
 			if questionErr != nil {
 				return questionErr
 			}
@@ -1556,7 +1561,11 @@ func runReviewFacadeStart(ctx context.Context, args []string, stdout io.Writer)
 	// produce. The render is the same bounded Git capture STATUS would run
 	// anyway, so a candidate that starts here is a candidate STATUS can answer.
 	if len(state.SelectedLenses) > 0 {
-		contextResult, contextErr := renderReviewStartFrozenCandidateContext(ctx, reviewtransaction.SnapshotBuilder{Repo: root}, state.InitialSnapshot)
+		contextBuilder := reviewtransaction.SnapshotBuilder{Repo: root}
+		contextResult, contextErr := renderReviewStartFrozenCandidateContext(ctx, contextBuilder, state.InitialSnapshot)
+		if contextErr == nil && *contract == ReviewIntegrationContractV1 {
+			contextResult, contextErr = contextBuilder.WithLegacyCandidateDiff(ctx, state.InitialSnapshot, contextResult)
+		}
 		if contextErr != nil {
 			requestedContextErr = &reviewStartContextError{LineageID: state.LineageID, Cause: contextErr}
 		} else {
@@ -1584,7 +1593,7 @@ func runReviewFacadeStart(ctx context.Context, args []string, stdout io.Writer)
 	}
 	if negotiated && requestedContextErr == nil {
 		preview := reviewFacadeStartResultFor(reviewtransaction.CompactStartCreated, len(state.SelectedLenses) > 0, state)
-		if _, previewErr := newReviewIntegrationStartResult(preview, assessment, state.InitialSnapshot.Kind, requestedFrozenContext, requestedRepositoryContext); previewErr != nil {
+		if _, previewErr := newReviewIntegrationStartResult(preview, assessment, state.InitialSnapshot.Kind, requestedFrozenContext, requestedRepositoryContext, *contract); previewErr != nil {
 			requestedContextErr = &reviewStartContextError{LineageID: state.LineageID, Cause: previewErr}
 		}
 	}
@@ -1643,7 +1652,11 @@ func runReviewFacadeStart(ctx context.Context, args []string, stdout io.Writer)
 		if authority.InitialSnapshot.Identity == state.InitialSnapshot.Identity && requestedFrozenContext != nil {
 			frozenContext = requestedFrozenContext
 		} else {
-			contextResult, contextErr := renderReviewStartFrozenCandidateContext(ctx, reviewtransaction.SnapshotBuilder{Repo: root}, authority.InitialSnapshot)
+			contextBuilder := reviewtransaction.SnapshotBuilder{Repo: root}
+			contextResult, contextErr := renderReviewStartFrozenCandidateContext(ctx, contextBuilder, authority.InitialSnapshot)
+			if contextErr == nil && *contract == ReviewIntegrationContractV1 {
+				contextResult, contextErr = contextBuilder.WithLegacyCandidateDiff(ctx, authority.InitialSnapshot, contextResult)
+			}
 			if contextErr != nil {
 				return &reviewStartContextError{
 					AuthoritySelected: true, LineageID: authority.LineageID, StoreRevision: started.Record.Revision, Cause: contextErr,
@@ -1669,7 +1682,7 @@ func runReviewFacadeStart(ctx context.Context, args []string, stdout io.Writer)
 			TargetIdentity: authority.InitialSnapshot.Identity,
 		}
 	}
-	negotiatedResult, err := newReviewIntegrationStartResult(legacyResult, assessment, authority.InitialSnapshot.Kind, frozenContext, repositoryContext)
+	negotiatedResult, err := newReviewIntegrationStartResult(legacyResult, assessment, authority.InitialSnapshot.Kind, frozenContext, repositoryContext, *contract)
 	if err != nil {
 		return &reviewStartContextError{
 			AuthoritySelected: true, LineageID: authority.LineageID, StoreRevision: started.Record.Revision, Cause: err,
@@ -1828,10 +1841,11 @@ func reviewConsentFollowUpBase(
 	projection reviewtransaction.Projection,
 	lineage, baseRef, policy, focus, trace string,
 	committedOnly, workspaceOverlay bool,
+	contract string,
 ) string {
 	parts := []string{
 		"gentle-ai review start",
-		"--contract " + ReviewIntegrationContractV1,
+		"--contract " + contract,
 		"--cwd " + cwd,
 		"--target " + target,
 		"--projection " + string(projection),
@@ -2184,7 +2198,7 @@ func runReviewFacadeFinalize(ctx context.Context, args []string, stdout io.Write
 		if err := reviewFacadeSyncDirectory(filepath.Dir(store.FinalizeAttemptJournalPath())); err != nil {
 			return fmt.Errorf("sync completed finalize journal directory: %w", err)
 		}
-		return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
+		return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
 	}
 	var attempt reviewtransaction.FinalizeAttempt
 	attemptLoaded := false
@@ -2211,7 +2225,7 @@ func runReviewFacadeFinalize(ctx context.Context, args []string, stdout io.Write
 				if err := store.CompleteFinalizeAttempt(attempt.Request.RequestDigest); err != nil {
 					return err
 				}
-				return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", reviewFinalizeOutputContext{Context: ctx, Repo: root})
+				return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", reviewFinalizeOutputContext{Context: ctx, Repo: root})
 			}
 		}
 	}
@@ -2249,7 +2263,7 @@ func runReviewFacadeFinalize(ctx context.Context, args []string, stdout io.Write
 		if plan.CapturedEvidence != nil {
 			outputContext.CapturedEvidence = &plan.CapturedEvidence.Record
 		}
-		return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", outputContext)
+		return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", outputContext)
 	}
 	request := facadeFinalizeAttemptRequestForCandidate(record, plan.Candidate, reviewerResults, validation, refuter, plan.Evidence, *correctionLines, effectiveFailed, plan.CapturedEvidence)
 	if !terminalAtEntry && pendingAtEntry != nil && !attemptLoaded {
@@ -2311,10 +2325,10 @@ func runReviewFacadeFinalize(ctx context.Context, args []string, stdout io.Write
 	}
 
 	if state.State != reviewtransaction.StateApproved && state.State != reviewtransaction.StateEscalated {
-		return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", reviewFinalizeOutputContext{Context: ctx, Repo: root})
+		return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "continue the current review state", reviewFinalizeOutputContext{Context: ctx, Repo: root})
 	}
 	if terminalAtEntry && terminalReceiptExists {
-		return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
+		return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
 	}
 	receipt := terminalReceipt
 	if !terminalAtEntry {
@@ -2336,7 +2350,7 @@ func runReviewFacadeFinalize(ctx context.Context, args []string, stdout io.Write
 	if err := store.MarkFinalizeAttemptReceiptPublished(requestDigest); err != nil {
 		return err
 	}
-	return encodeCompactFacadeFinalize(stdout, negotiated, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
+	return encodeCompactFacadeFinalize(stdout, negotiated, *contract, *actionEligibility, *nextTransition, state, record.Revision, store, "validate delivery with gentle-ai review validate --gate <gate>", reviewFinalizeOutputContext{Context: ctx, Repo: root})
 }
 
 func facadeFinalizeTransitionIndex(attempt *reviewtransaction.FinalizeAttempt, revision string) int {
@@ -2674,7 +2688,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 				Result:  reviewtransaction.GateAllow,
 				Reason:  reviewEmptyPublicationRangeReason,
 				Context: reviewtransaction.GateContext{Gate: gateInput.Gate},
-			}, negotiated)
+			}, negotiated, *contract)
 		}
 	}
 	compactStore, compactRecord, compactErr := discoverCompactFacadeGateReview(ctx, root, *lineage, gateInput)
@@ -2697,7 +2711,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 			// operator turns reviews back on and resolves it.
 			mixed := &ReviewReceiptDiscoveryError{Kind: ReviewReceiptAmbiguous, Detail: errReviewMixedCompactLegacyAuthority.Error()}
 			if reviewDeliveryDisposition(ctx, root, false) == reviewtransaction.RDDDeliveryDisabledUnmanaged {
-				return emitDisabledUnmanagedDelivery(stdout, gateInput.Gate, mixed, negotiated)
+				return emitDisabledUnmanagedDelivery(stdout, gateInput.Gate, mixed, negotiated, *contract)
 			}
 			return errReviewMixedCompactLegacyAuthority
 		}
@@ -2716,16 +2730,16 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 		if gateInput.Gate == reviewtransaction.GatePrePR && strings.TrimSpace(*lineage) == "" &&
 			evaluation.Context.Denial != nil && evaluation.Context.Denial.Stage == "receipt-binding" && evaluation.Context.Denial.Code == "base-mismatch" {
 			if composed, attempted := reviewtransaction.EvaluateCompactPrePRChain(ctx, root, gateInput); attempted {
-				return emitFacadeGateEvaluationNegotiated(stdout, composed, negotiated)
+				return emitFacadeGateEvaluationNegotiated(stdout, composed, negotiated, *contract)
 			}
 		}
-		return emitFacadeGateEvaluationNegotiated(stdout, evaluation, negotiated)
+		return emitFacadeGateEvaluationNegotiated(stdout, evaluation, negotiated, *contract)
 	}
 	var compactDiscovery *ReviewReceiptDiscoveryError
 	if gateInput.Gate == reviewtransaction.GatePrePR && strings.TrimSpace(*lineage) == "" &&
 		errors.As(compactErr, &compactDiscovery) && compactDiscovery.Kind != ReviewAuthorityCorrupted && compactDiscovery.Kind != ReviewReceiptMissing {
 		if evaluation, attempted := reviewtransaction.EvaluateCompactPrePRChain(ctx, root, gateInput); attempted {
-			return emitFacadeGateEvaluationNegotiated(stdout, evaluation, negotiated)
+			return emitFacadeGateEvaluationNegotiated(stdout, evaluation, negotiated, *contract)
 		}
 	}
 	// The kill switch is consulted BEFORE the negotiation branch and for every
@@ -2750,7 +2764,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 	}
 	if disabledDiscovery != nil &&
 		reviewDeliveryDisposition(ctx, root, false) == reviewtransaction.RDDDeliveryDisabledUnmanaged {
-		return emitDisabledUnmanagedDelivery(stdout, gateInput.Gate, disabledDiscovery, negotiated)
+		return emitDisabledUnmanagedDelivery(stdout, gateInput.Gate, disabledDiscovery, negotiated, *contract)
 	}
 	if !negotiated {
 		if targetResolution != nil {
@@ -2759,7 +2773,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 				Context: reviewtransaction.GateContext{
 					Gate: gateInput.Gate, Denial: &reviewtransaction.GateDenial{Stage: "target-resolution", Code: "target_resolution_failed"},
 				},
-			}, false)
+			}, false, "")
 		}
 		var discovery *ReviewReceiptDiscoveryError
 		if errors.As(compactErr, &discovery) {
@@ -2778,7 +2792,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 			}
 			return emitFacadeGateEvaluationNegotiated(stdout, reviewtransaction.NativeGateEvaluation{
 				Result: result, Reason: reason, Context: context,
-			}, false)
+			}, false, "")
 		}
 	}
 
@@ -2805,7 +2819,7 @@ func runReviewFacadeValidate(ctx context.Context, args []string, stdout io.Write
 	for _, path := range tx.Snapshot.IntendedUntracked {
 		validateArgs = append(validateArgs, "--intended-untracked", path)
 	}
-	return runFacadeLegacyValidateNegotiated(ctx, validateArgs, stdout, negotiated)
+	return runFacadeLegacyValidateNegotiated(ctx, validateArgs, stdout, negotiated, *contract)
 }
 
 func discoverCompactFacadeGateReview(ctx context.Context, repo, lineage string, input reviewtransaction.NativeGateRequestInput) (reviewtransaction.CompactStore, reviewtransaction.CompactRecord, error) {
@@ -3560,7 +3574,7 @@ type reviewFinalizeOutputContext struct {
 	CapturedEvidence *reviewtransaction.VerificationEvidenceRecord
 }
 
-func encodeCompactFacadeFinalize(stdout io.Writer, negotiated, actionEligibility, nextTransition bool, state reviewtransaction.CompactState, revision string, store reviewtransaction.CompactStore, action string, contexts ...reviewFinalizeOutputContext) error {
+func encodeCompactFacadeFinalize(stdout io.Writer, negotiated bool, contract string, actionEligibility, nextTransition bool, state reviewtransaction.CompactState, revision string, store reviewtransaction.CompactStore, action string, contexts ...reviewFinalizeOutputContext) error {
 	var validationRequest *reviewtransaction.TargetedValidationRequest
 	var captureContext *reviewCaptureContext
 	var capturedEvidence *reviewtransaction.VerificationEvidenceRecord
@@ -3653,7 +3667,7 @@ func encodeCompactFacadeFinalize(stdout io.Writer, negotiated, actionEligibility
 		Action: result.Action, Escalation: result.Escalation, StoreRevision: result.StoreRevision,
 		Eligibility: eligibility, NextTransition: transition, ValidationRequest: validationRequest,
 	}
-	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationFinalize, result, public)
+	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationFinalize, result, public, contract)
 }
 
 func rejectFacadeCorrectionUntracked(ctx context.Context, repo string, state reviewtransaction.CompactState) error {
@@ -3750,7 +3764,7 @@ func reviewDisabledUnmanagedDeliveryReason(discovery *ReviewReceiptDiscoveryErro
 // still fails closed is an unreadable KILL SWITCH — reviewDeliveryDisposition
 // treats an unresolvable mode as managed — so a tampered or broken mode record
 // can never manufacture this disposition.
-func emitDisabledUnmanagedDelivery(stdout io.Writer, gate reviewtransaction.GateKind, discovery *ReviewReceiptDiscoveryError, negotiated bool) error {
+func emitDisabledUnmanagedDelivery(stdout io.Writer, gate reviewtransaction.GateKind, discovery *ReviewReceiptDiscoveryError, negotiated bool, contract string) error {
 	context := reviewtransaction.GateContext{
 		Gate:   gate,
 		Denial: &reviewtransaction.GateDenial{Stage: "receipt-discovery", Code: string(discovery.Kind)},
@@ -3765,14 +3779,14 @@ func emitDisabledUnmanagedDelivery(stdout io.Writer, gate reviewtransaction.Gate
 		Delivery: reviewtransaction.RDDDeliveryDisabledUnmanaged,
 		Context:  context,
 	}
-	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationValidate, result, result)
+	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationValidate, result, result, contract)
 }
 
 func emitFacadeGateEvaluation(stdout io.Writer, evaluation reviewtransaction.NativeGateEvaluation) error {
-	return emitFacadeGateEvaluationNegotiated(stdout, evaluation, false)
+	return emitFacadeGateEvaluationNegotiated(stdout, evaluation, false, "")
 }
 
-func emitFacadeGateEvaluationNegotiated(stdout io.Writer, evaluation reviewtransaction.NativeGateEvaluation, negotiated bool) error {
+func emitFacadeGateEvaluationNegotiated(stdout io.Writer, evaluation reviewtransaction.NativeGateEvaluation, negotiated bool, contract string) error {
 	if err := reviewGateContentionError(evaluation); err != nil {
 		return err
 	}
@@ -3780,7 +3794,7 @@ func emitFacadeGateEvaluationNegotiated(stdout io.Writer, evaluation reviewtrans
 		Schema: ReviewValidateSchema, Result: evaluation.Result, Allowed: evaluation.Result == reviewtransaction.GateAllow,
 		Action: reviewGateAction(evaluation.Result), Reason: evaluation.Reason, Context: evaluation.Context,
 	}
-	if err := encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationValidate, result, result); err != nil {
+	if err := encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationValidate, result, result, contract); err != nil {
 		return err
 	}
 	if !result.Allowed {
@@ -3789,7 +3803,7 @@ func emitFacadeGateEvaluationNegotiated(stdout io.Writer, evaluation reviewtrans
 	return nil
 }
 
-func runFacadeLegacyValidateNegotiated(ctx context.Context, args []string, stdout io.Writer, negotiated bool) error {
+func runFacadeLegacyValidateNegotiated(ctx context.Context, args []string, stdout io.Writer, negotiated bool, contract string) error {
 	if !negotiated {
 		return runReviewValidate(ctx, args, stdout)
 	}
@@ -3802,7 +3816,7 @@ func runFacadeLegacyValidateNegotiated(ctx context.Context, args []string, stdou
 	if err := decodeStrictReviewIntegrationResult(output.Bytes(), &result); err != nil {
 		return err
 	}
-	if err := encodeReviewIntegrationOperation(stdout, true, ReviewIntegrationOperationValidate, result, result); err != nil {
+	if err := encodeReviewIntegrationOperation(stdout, true, ReviewIntegrationOperationValidate, result, result, contract); err != nil {
 		return err
 	}
 	return runErr
diff --git a/internal/cli/review_facade_test.go b/internal/cli/review_facade_test.go
index 4c28f423d..9cbb22cd2 100644
--- a/internal/cli/review_facade_test.go
+++ b/internal/cli/review_facade_test.go
@@ -623,7 +623,7 @@ func TestReviewFacadeStartProvableShellAndModeRiskSelectsCanonical4R(t *testing.
 }
 
 // TestReviewFacadeStartUnnegotiatedJSONFieldSetRemainsCompatible proves the
-// unnegotiated response never gains a negotiated field (candidate_diff,
+// unnegotiated response never gains a negotiated field (changed_path_manifest,
 // changed_path_manifest, artifact_subjects, ...); it stays a strict compatible
 // subset. It does NOT promise the field set is frozen forever: "hint" is an
 // existing additive field (see reviewStartEmptyCandidateHint) and now also
@@ -653,7 +653,7 @@ func TestReviewFacadeStartUnnegotiatedJSONFieldSetRemainsCompatible(t *testing.T
 	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("unnegotiated start fields = %v, want %v", got, want)
 	}
-	for _, negotiatedOnly := range []string{"candidate_diff", "changed_path_manifest", "artifact_subjects", "schema", "contract"} {
+	for _, negotiatedOnly := range []string{"changed_path_manifest", "artifact_subjects", "schema", "contract"} {
 		if _, ok := fields[negotiatedOnly]; ok {
 			t.Fatalf("unnegotiated start leaked negotiated-only field %q: %s", negotiatedOnly, output.String())
 		}
diff --git a/internal/cli/review_failure_contract_test.go b/internal/cli/review_failure_contract_test.go
index 3f32140da..60fdb08f7 100644
--- a/internal/cli/review_failure_contract_test.go
+++ b/internal/cli/review_failure_contract_test.go
@@ -60,7 +60,7 @@ func TestNegotiatedReviewContractFailuresArePreMutationAndLegacyErrorsStayCompat
 		args []string
 		code string
 	}{
-		{name: "capabilities unsupported", args: []string{"capabilities", "--contract", "gentle-ai.review-integration/v2"}, code: "unsupported_contract"},
+		{name: "capabilities unsupported", args: []string{"capabilities", "--contract", "gentle-ai.review-integration/v3"}, code: "unsupported_contract"},
 		{name: "start empty", args: []string{"start", "--contract="}, code: "empty_contract"},
 		{name: "finalize malformed", args: []string{"finalize", "--contract"}, code: "invalid_request"},
 	}
@@ -88,6 +88,18 @@ func TestNegotiatedReviewContractFailuresArePreMutationAndLegacyErrorsStayCompat
 	}
 }
 
+func TestNegotiatedReviewV2FailureUsesSuccessorEnvelope(t *testing.T) {
+	var output bytes.Buffer
+	err := RunReview([]string{"start", "--contract", ReviewIntegrationContractV2, "unexpected"}, &output)
+	if err == nil {
+		t.Fatal("invalid v2 request succeeded")
+	}
+	failure := decodeReviewIntegrationFailure(t, output.Bytes())
+	if failure.Schema != ReviewIntegrationFailureSchemaV2 || failure.Contract != ReviewIntegrationContractV2 || failure.Code != "invalid_request" {
+		t.Fatalf("v2 failure = %#v", failure)
+	}
+}
+
 func TestNegotiatedReviewFailuresPreserveRequestedLineage(t *testing.T) {
 	lineage := "review-requested-lineage"
 	tests := []struct {
diff --git a/internal/cli/review_final_verification_retry.go b/internal/cli/review_final_verification_retry.go
index 866df660e..f4b171be0 100644
--- a/internal/cli/review_final_verification_retry.go
+++ b/internal/cli/review_final_verification_retry.go
@@ -128,5 +128,5 @@ func runReviewRetryFinalVerification(ctx context.Context, args []string, stdout
 	if err := result.Validate(); err != nil {
 		return err
 	}
-	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationRetryFinalVerification, result, result)
+	return encodeReviewIntegrationOperation(stdout, negotiated, ReviewIntegrationOperationRetryFinalVerification, result, result, *contract)
 }
diff --git a/internal/cli/review_incident.go b/internal/cli/review_incident.go
index 84d7d217f..de08e275b 100644
--- a/internal/cli/review_incident.go
+++ b/internal/cli/review_incident.go
@@ -35,7 +35,8 @@ type reviewCapturePreflightResult struct {
 	Lens                string                                       `json:"lens"`
 	SelectedOrder       int                                          `json:"selected_order"`
 	ArtifactSubject     reviewtransaction.ArtifactSubject            `json:"artifact_subject"`
-	CandidateDiff       reviewtransaction.FrozenCandidateDiff        `json:"candidate_diff"`
+	BaseTree            string                                       `json:"base_tree"`
+	CandidateTree       string                                       `json:"candidate_tree"`
 	ChangedPathManifest []reviewtransaction.ChangedPathManifestEntry `json:"changed_path_manifest"`
 }
 
diff --git a/internal/cli/review_incident_test.go b/internal/cli/review_incident_test.go
index 72798cbd3..6c599de1d 100644
--- a/internal/cli/review_incident_test.go
+++ b/internal/cli/review_incident_test.go
@@ -61,9 +61,9 @@ func TestReviewCaptureResultPreflightVerifiesBindingWithoutMutation(t *testing.T
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(preflight.CandidateDiff, wantContext.CandidateDiff) ||
+	if preflight.BaseTree != wantContext.BaseTree || preflight.CandidateTree != wantContext.CandidateTree ||
 		!reflect.DeepEqual(preflight.ChangedPathManifest, wantContext.ChangedPathManifest) {
-		t.Fatalf("preflight frozen context differs from authority\ngot=%#v %#v\nwant=%#v %#v", preflight.CandidateDiff, preflight.ChangedPathManifest, wantContext.CandidateDiff, wantContext.ChangedPathManifest)
+		t.Fatalf("preflight frozen context differs from authority\ngot=%s..%s %#v\nwant=%s..%s %#v", preflight.BaseTree, preflight.CandidateTree, preflight.ChangedPathManifest, wantContext.BaseTree, wantContext.CandidateTree, wantContext.ChangedPathManifest)
 	}
 	if _, err := os.Stat(filepath.Join(store.Dir, reviewtransaction.CompactReviewerResultsDir)); !os.IsNotExist(err) {
 		t.Fatal("preflight persisted a reviewer result artifact")
diff --git a/internal/cli/review_integration_contract_guard_test.go b/internal/cli/review_integration_contract_guard_test.go
index f0a671241..d99038b55 100644
--- a/internal/cli/review_integration_contract_guard_test.go
+++ b/internal/cli/review_integration_contract_guard_test.go
@@ -354,7 +354,7 @@ func TestReviewIntegrationDualModeCommandsAreClassified(t *testing.T) {
 // reviewIntegrationEncodeOperationCallRegexp extracts the two result
 // arguments passed to encodeReviewIntegrationOperation(stdout, negotiated|
 // true, <operation constant>, <legacy>, <public>).
-var reviewIntegrationEncodeOperationCallRegexp = regexp.MustCompile(`encodeReviewIntegrationOperation\(stdout, (?:negotiated|true), (ReviewIntegrationOperation\w+), (\w+), (\w+)\)`)
+var reviewIntegrationEncodeOperationCallRegexp = regexp.MustCompile(`encodeReviewIntegrationOperation\(stdout, (?:negotiated|true), (ReviewIntegrationOperation\w+), (\w+), (\w+)(?:, (?:\*?\w+|""))?\)`)
 
 // TestReviewIntegrationVacuousModeClassificationIsProvenBySource is Guard C's
 // evidence half for the "vacuous" classification: it re-derives, from every
diff --git a/internal/cli/review_next_transition.go b/internal/cli/review_next_transition.go
index d67c598e6..63bb7c8a7 100644
--- a/internal/cli/review_next_transition.go
+++ b/internal/cli/review_next_transition.go
@@ -51,6 +51,8 @@ type ReviewTransitionInput struct {
 	Arguments           []ReviewTransitionArgument                    `json:"arguments"`
 	ArtifactSubject     *reviewtransaction.ArtifactSubject            `json:"artifact_subject,omitempty"`
 	CandidateDiff       *reviewtransaction.FrozenCandidateDiff        `json:"candidate_diff,omitempty"`
+	BaseTree            string                                        `json:"base_tree,omitempty"`
+	CandidateTree       string                                        `json:"candidate_tree,omitempty"`
 	ChangedPathManifest *[]reviewtransaction.ChangedPathManifestEntry `json:"changed_path_manifest,omitempty"`
 	ValidationRequest   *reviewtransaction.TargetedValidationRequest  `json:"validation_request,omitempty"`
 }
@@ -387,12 +389,19 @@ func reviewCaptureInput(binding ReviewTransitionBinding, lens string, order int,
 	}
 	if context != nil && order >= 0 && order < len(context.ArtifactSubjects) {
 		subject := context.ArtifactSubjects[order]
-		diff := context.FrozenContext.CandidateDiff
 		manifest := append([]reviewtransaction.ChangedPathManifestEntry(nil), context.FrozenContext.ChangedPathManifest...)
 		if manifest == nil {
 			manifest = []reviewtransaction.ChangedPathManifestEntry{}
 		}
-		input.ArtifactSubject, input.CandidateDiff, input.ChangedPathManifest = &subject, &diff, &manifest
+		input.ArtifactSubject = &subject
+		input.ChangedPathManifest = &manifest
+		if context.FrozenContext.LegacyCandidateDiff != nil {
+			diff := *context.FrozenContext.LegacyCandidateDiff
+			input.CandidateDiff = &diff
+		} else {
+			input.Arguments = append(input.Arguments, ReviewTransitionArgument{Name: "subject-hash", Value: subject.SubjectHash})
+			input.BaseTree, input.CandidateTree = context.FrozenContext.BaseTree, context.FrozenContext.CandidateTree
+		}
 	}
 	return input
 }
@@ -421,8 +430,12 @@ type reviewTransitionSelector struct {
 }
 
 func reviewStartArguments(status ReviewTargetStatusResult, lineage string) []ReviewTransitionArgument {
+	contract := status.Contract
+	if contract == "" {
+		contract = ReviewIntegrationContractV1
+	}
 	arguments := []ReviewTransitionArgument{
-		{Name: "contract", Value: ReviewIntegrationContractV1},
+		{Name: "contract", Value: contract},
 		{Name: "target", Value: status.TargetIdentity},
 		{Name: "projection", Value: string(status.Projection.Projection)},
 	}
@@ -474,7 +487,13 @@ func reviewRepairTransition(status ReviewTargetStatusResult, input reviewNextTra
 func newReviewCaptureContext(state reviewtransaction.CompactState, revision string, frozen reviewtransaction.FrozenCandidateContext) (*reviewCaptureContext, error) {
 	subjects := make([]reviewtransaction.ArtifactSubject, len(state.SelectedLenses))
 	for order, lens := range state.SelectedLenses {
-		subject, err := reviewtransaction.NewArtifactSubject(state, revision, frozen, lens, order, "")
+		var subject reviewtransaction.ArtifactSubject
+		var err error
+		if frozen.LegacyCandidateDiff != nil {
+			subject, err = reviewtransaction.NewLegacyArtifactSubject(state, revision, frozen, lens, order, "")
+		} else {
+			subject, err = reviewtransaction.NewArtifactSubject(state, revision, frozen, lens, order, "")
+		}
 		if err != nil {
 			return nil, fmt.Errorf("derive restart artifact subject %d: %w", order, err)
 		}
diff --git a/internal/cli/review_next_transition_test.go b/internal/cli/review_next_transition_test.go
index 0c4de7692..0f4711854 100644
--- a/internal/cli/review_next_transition_test.go
+++ b/internal/cli/review_next_transition_test.go
@@ -316,7 +316,7 @@ func TestNegotiatedRestartStatusSuppliesFrozenContextForEveryMissingReviewer(t *
 	repo, started, _, record := newArtifactReview(t, true)
 	var output bytes.Buffer
 	if err := RunReview([]string{
-		"status", "--contract", ReviewIntegrationContractV1, "--next-transition",
+		"status", "--contract", ReviewIntegrationContractV2, "--next-transition",
 		"--cwd", repo, "--lineage", started.LineageID,
 	}, &output); err != nil {
 		t.Fatal(err)
@@ -340,30 +340,26 @@ func TestNegotiatedRestartStatusSuppliesFrozenContextForEveryMissingReviewer(t *
 		if err := json.Unmarshal(payload, &document); err != nil {
 			t.Fatal(err)
 		}
-		for _, field := range []string{"artifact_subject", "candidate_diff", "changed_path_manifest"} {
+		for _, field := range []string{"artifact_subject", "base_tree", "candidate_tree", "changed_path_manifest"} {
 			if len(document[field]) == 0 {
 				t.Fatalf("restart reviewer input %d omits %q: %s", order, field, payload)
 			}
 		}
 		var subject reviewtransaction.ArtifactSubject
-		var diff reviewtransaction.FrozenCandidateDiff
 		var manifest []reviewtransaction.ChangedPathManifestEntry
 		if err := json.Unmarshal(document["artifact_subject"], &subject); err != nil {
 			t.Fatal(err)
 		}
-		if err := json.Unmarshal(document["candidate_diff"], &diff); err != nil {
-			t.Fatal(err)
-		}
 		if err := json.Unmarshal(document["changed_path_manifest"], &manifest); err != nil {
 			t.Fatal(err)
 		}
 		if subject.LineageID != record.State.LineageID || subject.AuthorityRevision != record.Revision ||
 			subject.TargetIdentity != record.State.InitialSnapshot.Identity || subject.Lens != record.State.SelectedLenses[order] ||
-			subject.SelectedOrder != order || subject.CandidateDiffSHA256 != wantContext.CandidateDiff.SHA256 {
+			subject.SelectedOrder != order || subject.BaseTree != wantContext.BaseTree || subject.CandidateTree != wantContext.CandidateTree {
 			t.Fatalf("restart subject %d = %#v", order, subject)
 		}
-		if !reflect.DeepEqual(diff, wantContext.CandidateDiff) || !reflect.DeepEqual(manifest, wantContext.ChangedPathManifest) {
-			t.Fatalf("restart context %d differs from frozen candidate\ngot diff=%#v manifest=%#v\nwant diff=%#v manifest=%#v", order, diff, manifest, wantContext.CandidateDiff, wantContext.ChangedPathManifest)
+		if input.BaseTree != wantContext.BaseTree || input.CandidateTree != wantContext.CandidateTree || !reflect.DeepEqual(manifest, wantContext.ChangedPathManifest) {
+			t.Fatalf("restart context %d differs from frozen candidate\ngot trees=%s..%s manifest=%#v\nwant trees=%s..%s manifest=%#v", order, input.BaseTree, input.CandidateTree, manifest, wantContext.BaseTree, wantContext.CandidateTree, wantContext.ChangedPathManifest)
 		}
 	}
 }
@@ -844,12 +840,9 @@ func validateAgainstPublishedStatusNextTransitionSchema(t *testing.T, schemaFile
 
 func nextTransitionTestCaptureContext(t *testing.T, status ReviewTargetStatusResult, lenses []string) *reviewCaptureContext {
 	t.Helper()
-	diff, err := reviewtransaction.NewFrozenCandidateDiff([]byte("immutable candidate\n"))
-	if err != nil {
-		t.Fatal(err)
-	}
+	baseTree, candidateTree := strings.Repeat("c", 40), strings.Repeat("d", 40)
 	frozen := reviewtransaction.FrozenCandidateContext{
-		CandidateDiff: diff,
+		BaseTree: baseTree, CandidateTree: candidateTree,
 		ChangedPathManifest: []reviewtransaction.ChangedPathManifestEntry{{
 			Path: "tracked.txt", Status: reviewtransaction.CandidatePathModified, OldMode: "100644", NewMode: "100644",
 		}},
@@ -857,7 +850,7 @@ func nextTransitionTestCaptureContext(t *testing.T, status ReviewTargetStatusRes
 	state := reviewtransaction.CompactState{
 		LineageID: status.Authority.LineageID,
 		InitialSnapshot: reviewtransaction.Snapshot{
-			Identity: status.TargetIdentity, Paths: []string{"tracked.txt"},
+			Identity: status.TargetIdentity, BaseTree: baseTree, CandidateTree: candidateTree, Paths: []string{"tracked.txt"},
 		},
 		SelectedLenses: append([]string{}, lenses...),
 	}
diff --git a/internal/cli/review_operation_contract.go b/internal/cli/review_operation_contract.go
index 34a0021a5..56ba5307c 100644
--- a/internal/cli/review_operation_contract.go
+++ b/internal/cli/review_operation_contract.go
@@ -18,8 +18,12 @@ import (
 
 const ReviewIntegrationOperationSchema = "gentle-ai.review-integration.operation/v1"
 const ReviewIntegrationOperationSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/operation.schema.json"
+const ReviewIntegrationOperationSchemaV2 = "gentle-ai.review-integration.operation/v2"
+const ReviewIntegrationOperationSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/operation.schema.json"
 const ReviewIntegrationFailureSchema = "gentle-ai.review-integration.failure/v1"
 const ReviewIntegrationFailureSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/failure.schema.json"
+const ReviewIntegrationFailureSchemaV2 = "gentle-ai.review-integration.failure/v2"
+const ReviewIntegrationFailureSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/failure.schema.json"
 
 const (
 	ReviewIntegrationOperationFinalize               = "review.finalize"
@@ -299,7 +303,7 @@ func reviewIntegrationFailureRoute(args []string) (string, bool, *ReviewIntegrat
 		failure.LineageID = safeReviewIntegrationLineage(operation, args[1:])
 		return operation, true, &failure
 	}
-	if contract != ReviewIntegrationContractV1 {
+	if contract != ReviewIntegrationContractV1 && contract != ReviewIntegrationContractV2 {
 		failure := newReviewIntegrationPreflightFailure(operation, "unsupported_contract", "The requested review integration contract is not supported.")
 		failure.LineageID = safeReviewIntegrationLineage(operation, args[1:])
 		return operation, true, &failure
@@ -344,6 +348,9 @@ func newReviewIntegrationFailure(operation string, args []string, runErr error)
 		MutationOutcome: ReviewMutationUnknown, AuthorityApplicability: "not_evaluated", RetrySafe: false,
 		Replayability: reviewtransaction.ReplayabilityStatusRequired, RequiredInputs: []string{}, NextAction: "review.status",
 	}
+	if provided, contract, _ := reviewIntegrationContractArgument(args); provided && contract == ReviewIntegrationContractV2 {
+		failure.Schema, failure.Contract = ReviewIntegrationFailureSchemaV2, ReviewIntegrationContractV2
+	}
 	failure.LineageID = safeReviewIntegrationLineage(operation, args)
 	// Both branches below refuse inside authorizeReviewStart, strictly before
 	// any review authority is created or mutated (organic-dx Phase 3b task
@@ -702,6 +709,7 @@ func newReviewIntegrationFailure(operation string, args []string, runErr error)
 		// cannot forget to name itself.
 		reason := preflight.classification()
 		preflightFailure := newReviewIntegrationPreflightFailure(operation, reason.Code, reason.Message)
+		preflightFailure.Schema, preflightFailure.Contract = failure.Schema, failure.Contract
 		preflightFailure.LineageID = failure.LineageID
 		preflightFailure.RequiredInputs = append([]string{}, reason.RequiredInputs...)
 		preflightFailure.NextAction = reason.NextAction
@@ -1088,7 +1096,9 @@ func validReviewIntegrationLineage(value string) bool {
 }
 
 func (failure ReviewIntegrationFailure) Validate() error {
-	if failure.Schema != ReviewIntegrationFailureSchema || failure.Contract != ReviewIntegrationContractV1 ||
+	legacyContract := failure.Schema == ReviewIntegrationFailureSchema && failure.Contract == ReviewIntegrationContractV1
+	nativeGitContract := failure.Schema == ReviewIntegrationFailureSchemaV2 && failure.Contract == ReviewIntegrationContractV2
+	if (!legacyContract && !nativeGitContract) ||
 		!validReviewIntegrationFailureOperation(failure.Operation) {
 		return errors.New("invalid negotiated review failure identity")
 	}
@@ -1276,7 +1286,7 @@ func reviewFlagWasProvided(flags *flag.FlagSet, name string) bool {
 	return provided
 }
 
-func encodeReviewIntegrationOperation(stdout io.Writer, negotiated bool, operation string, legacyResult, publicResult any) error {
+func encodeReviewIntegrationOperation(stdout io.Writer, negotiated bool, operation string, legacyResult, publicResult any, contracts ...string) error {
 	if !negotiated {
 		return encodeReviewJSON(stdout, legacyResult)
 	}
@@ -1284,8 +1294,12 @@ func encodeReviewIntegrationOperation(stdout io.Writer, negotiated bool, operati
 	if err != nil {
 		return fmt.Errorf("encode negotiated %s result: %w", operation, err)
 	}
+	schema, contract := ReviewIntegrationOperationSchema, ReviewIntegrationContractV1
+	if len(contracts) > 0 && contracts[0] == ReviewIntegrationContractV2 {
+		schema, contract = ReviewIntegrationOperationSchemaV2, ReviewIntegrationContractV2
+	}
 	envelope := ReviewIntegrationOperationResult{
-		Schema: ReviewIntegrationOperationSchema, Contract: ReviewIntegrationContractV1,
+		Schema: schema, Contract: contract,
 		Operation: operation, Result: payload,
 	}
 	if err := envelope.Validate(); err != nil {
@@ -1295,7 +1309,9 @@ func encodeReviewIntegrationOperation(stdout io.Writer, negotiated bool, operati
 }
 
 func (result ReviewIntegrationOperationResult) Validate() error {
-	if result.Schema != ReviewIntegrationOperationSchema || result.Contract != ReviewIntegrationContractV1 || len(result.Result) == 0 {
+	legacyContract := result.Schema == ReviewIntegrationOperationSchema && result.Contract == ReviewIntegrationContractV1
+	nativeGitContract := result.Schema == ReviewIntegrationOperationSchemaV2 && result.Contract == ReviewIntegrationContractV2
+	if (!legacyContract && !nativeGitContract) || len(result.Result) == 0 {
 		return errors.New("invalid negotiated review operation identity")
 	}
 	var document any
diff --git a/internal/cli/review_operation_contract_test.go b/internal/cli/review_operation_contract_test.go
index 2d05f48d5..134a86d2e 100644
--- a/internal/cli/review_operation_contract_test.go
+++ b/internal/cli/review_operation_contract_test.go
@@ -249,7 +249,7 @@ func TestNegotiatedReviewBindSDDRejectsHistoricalLegacyThroughTypedFailureEnvelo
 }
 
 func TestNegotiatedReviewOperationsRejectInvalidContractsBeforeMutation(t *testing.T) {
-	for _, contract := range []string{"", "gentle-ai.review-integration/v2"} {
+	for _, contract := range []string{"", "gentle-ai.review-integration/v3"} {
 		t.Run("finalize_"+contract, func(t *testing.T) {
 			repo := initReviewCLIRepo(t)
 			writeNegotiatedOperationChange(t, repo, "thin")
diff --git a/internal/cli/review_process_boundary_test.go b/internal/cli/review_process_boundary_test.go
index 3ec7d0953..0737971e3 100644
--- a/internal/cli/review_process_boundary_test.go
+++ b/internal/cli/review_process_boundary_test.go
@@ -112,11 +112,10 @@ func TestReviewStartContractValidatesProcessBoundaryReason(t *testing.T) {
 func TestNegotiatedReviewStartResumesFrozenMediumAuthorityAfterClassifierUpgrade(t *testing.T) {
 	legacy := ReviewFacadeStartResult{Action: string(reviewtransaction.CompactStartResumed), LineageID: "pre-upgrade", RiskLevel: reviewtransaction.RiskMedium, SelectedLenses: []string{reviewtransaction.LensReliability}, Projection: reviewtransaction.ProjectionWorkspace, ChangedFiles: 1, ChangedLines: 20, CorrectionBudget: 10}
 	assessment := reviewtransaction.RiskAssessment{Level: reviewtransaction.RiskHigh, ChangedLines: 20, Reasons: []reviewtransaction.RiskReason{{Code: reviewtransaction.RiskReasonCode("process_boundary"), Signal: reviewtransaction.SignalShellProcess, Path: "runner.py"}}}
-	diff, err := reviewtransaction.NewFrozenCandidateDiff([]byte("diff"))
-	if err != nil {
-		t.Fatal(err)
+	contextResult := reviewtransaction.FrozenCandidateContext{
+		BaseTree: strings.Repeat("a", 40), CandidateTree: strings.Repeat("b", 40),
+		ChangedPathManifest: []reviewtransaction.ChangedPathManifestEntry{{Path: "process_helper.go", Status: reviewtransaction.CandidatePathAdded, OldMode: "000000", NewMode: "100644"}},
 	}
-	contextResult := reviewtransaction.FrozenCandidateContext{CandidateDiff: diff, ChangedPathManifest: []reviewtransaction.ChangedPathManifestEntry{{Path: "process_helper.go", Status: reviewtransaction.CandidatePathAdded, OldMode: "000000", NewMode: "100644"}}}
 	result, err := newReviewIntegrationStartResult(legacy, assessment, "", &contextResult, nil)
 	if err != nil || result.RiskLevel != reviewtransaction.RiskMedium || !reflect.DeepEqual(result.SelectedLenses, legacy.SelectedLenses) {
 		t.Fatalf("resumed authority = risk %q lenses %v error %v, want frozen medium %v", result.RiskLevel, result.SelectedLenses, err, legacy.SelectedLenses)
diff --git a/internal/cli/review_provider_artifact_contract_test.go b/internal/cli/review_provider_artifact_contract_test.go
index 25a1f00dd..ae1237add 100644
--- a/internal/cli/review_provider_artifact_contract_test.go
+++ b/internal/cli/review_provider_artifact_contract_test.go
@@ -12,18 +12,26 @@ import (
 	"github.com/gentleman-programming/gentle-ai/v2/internal/reviewtransaction"
 )
 
-func TestReviewProviderArtifactV1ContractsRemainByteIdentical(t *testing.T) {
+func TestReviewProviderArtifactV1ContractsArePinned(t *testing.T) {
 	root := filepath.Join("..", "..", "contracts", "review-integration", "v1")
 	want := map[string]string{
-		"fixtures/start.fixture.json":            "f369160ac26eb3427b57de2dd01c9d8c81e51c8a2bd546446780129d31b1945b",
-		"fixtures/status.fixture.json":           "555054d8046a896162995dcb117752f9cd1ef903fb9ebaad29af1b7e7f319bb3",
-		"fixtures/status-ambiguous.fixture.json": "ee695fd58ba72adfb3b51dfd16432a177498173a45bfcb594d6bdc53bfa32e6e",
-		"fixtures/status-corrupted.fixture.json": "4cfc0048c28a39cec8a32fecfaad66e56e5c1248263ceb4ce66b6717981880b2",
-		"fixtures/status-recover.fixture.json":   "714f762f72380ce93d567626cafbaa536ab3aae02af73d3d40ca123f1f30d8b0",
-		"fixtures/status-unrelated.fixture.json": "deab36c877ced3c9b480ca33724c10d88f75c761d6426fa14be850345122891d",
-		"schemas/result-artifact.schema.json":    "91296bd2c261fd2fe03bffd63efe58badd4927e0d0d8480cd4213f651ecacdf6",
-		"schemas/start.schema.json":              "4296aebbd4128ce51945a2f6d3228aa77ac7215c802978d559bff5279ec56229",
-		"schemas/status.schema.json":             "67f3bddf5f5feeb3213bce489de8548546163b2e1d49a0e3965c0091dabc8c39",
+		"fixtures/capabilities-v1.4.fixture.json": "84e0db457b76b97b35c2be772dfc647f9eab66810ea98f64fed85645c3c266ba",
+		"fixtures/start.fixture.json":             "f369160ac26eb3427b57de2dd01c9d8c81e51c8a2bd546446780129d31b1945b",
+		"fixtures/start-v2.fixture.json":          "388c7c21374b89afe2d42d64bd1987d17ec0e2c7151cab1c56a08969ffb2ea0e",
+		"fixtures/status.fixture.json":            "555054d8046a896162995dcb117752f9cd1ef903fb9ebaad29af1b7e7f319bb3",
+		"fixtures/status-v2.fixture.json":         "5410d8bbae1b7152a43b3a5c4c880e9e98a5e47b76d910456f5ef13f19836f3a",
+		"fixtures/status-ambiguous.fixture.json":  "ee695fd58ba72adfb3b51dfd16432a177498173a45bfcb594d6bdc53bfa32e6e",
+		"fixtures/status-corrupted.fixture.json":  "4cfc0048c28a39cec8a32fecfaad66e56e5c1248263ceb4ce66b6717981880b2",
+		"fixtures/status-recover.fixture.json":    "714f762f72380ce93d567626cafbaa536ab3aae02af73d3d40ca123f1f30d8b0",
+		"fixtures/status-unrelated.fixture.json":  "deab36c877ced3c9b480ca33724c10d88f75c761d6426fa14be850345122891d",
+		"schemas/admitted-result.schema.json":     "7796e8dbba331434594108c902dfab7ec46f691fa447a9259a78f2448111b0de",
+		"schemas/artifact-subject.schema.json":    "f7dcd934e27e8f3735a37f3d0ec8048dd8ccc1811b9df61124a1dcbf8a03f40e",
+		"schemas/capabilities-v1.4.schema.json":   "926b61c8ac0f870f09214f6bd8af1b035c5b72f14f0b83c0d4a7bdbb277f5447",
+		"schemas/result-artifact.schema.json":     "91296bd2c261fd2fe03bffd63efe58badd4927e0d0d8480cd4213f651ecacdf6",
+		"schemas/start.schema.json":               "4296aebbd4128ce51945a2f6d3228aa77ac7215c802978d559bff5279ec56229",
+		"schemas/start-v2.schema.json":            "ec8550cd93bbe84af1ce87dfd7abfa9e24692f42b20f8f0bf9cac1d4b88ea46c",
+		"schemas/status.schema.json":              "67f3bddf5f5feeb3213bce489de8548546163b2e1d49a0e3965c0091dabc8c39",
+		"schemas/status-v2.schema.json":           "63e8988ce276d948ea8305008a3d27c4e26dff664cf54fffed9e188f465d92d1",
 	}
 	for name, expected := range want {
 		payload, err := os.ReadFile(filepath.Join(root, filepath.FromSlash(name)))
@@ -37,7 +45,7 @@ func TestReviewProviderArtifactV1ContractsRemainByteIdentical(t *testing.T) {
 	}
 }
 
-func TestReviewProviderArtifactV2SchemasAreStrictAndBound(t *testing.T) {
+func TestReviewProviderArtifactSchemasAreStrictAndBound(t *testing.T) {
 	root := filepath.Join("..", "..", "contracts", "review-integration", "v1", "schemas")
 	tests := []struct {
 		name string
@@ -46,8 +54,8 @@ func TestReviewProviderArtifactV2SchemasAreStrictAndBound(t *testing.T) {
 		{name: "artifact-subject.schema.json", id: "https://gentle-ai.dev/contracts/review-integration/v1/schemas/artifact-subject.schema.json"},
 		{name: "admitted-result.schema.json", id: "https://gentle-ai.dev/contracts/review-integration/v1/schemas/admitted-result.schema.json"},
 		{name: "result-artifact-v2.schema.json", id: "https://gentle-ai.dev/contracts/review-integration/v1/schemas/result-artifact-v2.schema.json"},
-		{name: "start-v2.schema.json", id: ReviewIntegrationStartSchemaID},
-		{name: "status-v2.schema.json", id: ReviewIntegrationStatusSchemaID},
+		{name: "start-v2.schema.json", id: ReviewIntegrationStartSchemaIDV2},
+		{name: "status-v2.schema.json", id: ReviewIntegrationStatusSchemaIDV2},
 		{name: "authority-repair-assessment.schema.json", id: reviewtransaction.AuthorityRepairAssessmentSchemaID},
 		{name: "repair.schema.json", id: ReviewIntegrationRepairSchemaID},
 	}
@@ -115,14 +123,93 @@ func TestReviewProviderArtifactV2SchemasAreStrictAndBound(t *testing.T) {
 	captureThen := captureRule["then"].(map[string]any)
 	for _, field := range []string{"artifact_subject", "candidate_diff", "changed_path_manifest"} {
 		if !slices.Contains(schemaStringArray(t, captureThen["required"]), field) {
-			t.Fatalf("status v2 capture input omits required frozen context %q: %#v", field, captureThen)
+			t.Fatalf("legacy status v2 capture input omits required frozen context %q: %#v", field, captureThen)
 		}
 	}
 	inputProperties := transitionInput["properties"].(map[string]any)
 	if inputProperties["artifact_subject"].(map[string]any)["$ref"] != "artifact-subject.schema.json" ||
-		inputProperties["candidate_diff"].(map[string]any)["$ref"] != "start-v2.schema.json#/$defs/frozen_candidate_diff" ||
+		inputProperties["candidate_diff"] == nil || inputProperties["base_tree"] != nil || inputProperties["candidate_tree"] != nil ||
 		inputProperties["changed_path_manifest"].(map[string]any)["type"] != "array" {
-		t.Fatalf("status v2 capture input frozen context = %#v", inputProperties)
+		t.Fatalf("legacy status v2 capture input frozen context = %#v", inputProperties)
+	}
+
+	v2Root := filepath.Join("..", "..", "contracts", "review-integration", "v2", "schemas")
+	v2Schemas := []struct {
+		name string
+		id   string
+	}{
+		{name: "artifact-subject.schema.json", id: "https://gentle-ai.dev/contracts/review-integration/v2/schemas/artifact-subject.schema.json"},
+		{name: "admitted-result.schema.json", id: "https://gentle-ai.dev/contracts/review-integration/v2/schemas/admitted-result.schema.json"},
+		{name: "start.schema.json", id: ReviewIntegrationStartSchemaID},
+		{name: "status.schema.json", id: ReviewIntegrationStatusSchemaID},
+		{name: "capabilities.schema.json", id: ReviewIntegrationCapabilitiesSchemaIDV2},
+		{name: "consent.schema.json", id: ReviewIntegrationConsentSchemaIDV2},
+		{name: "failure.schema.json", id: ReviewIntegrationFailureSchemaIDV2},
+		{name: "operation.schema.json", id: ReviewIntegrationOperationSchemaIDV2},
+		{name: "repair.schema.json", id: ReviewIntegrationRepairSchemaIDV2},
+	}
+	v2Documents := make(map[string]map[string]any, len(v2Schemas))
+	for _, tt := range v2Schemas {
+		payload, err := os.ReadFile(filepath.Join(v2Root, tt.name))
+		if err != nil {
+			t.Fatal(err)
+		}
+		var schema map[string]any
+		if err := json.Unmarshal(payload, &schema); err != nil {
+			t.Fatal(err)
+		}
+		if schema["$schema"] != "https://json-schema.org/draft/2020-12/schema" || schema["$id"] != tt.id || schema["additionalProperties"] != false {
+			t.Fatalf("v2 %s header = %#v", tt.name, schema)
+		}
+		v2Documents[tt.name] = schema
+	}
+	v2Input := v2Documents["status.schema.json"]["$defs"].(map[string]any)["transition_input"].(map[string]any)
+	v2CaptureThen := v2Input["allOf"].([]any)[1].(map[string]any)["then"].(map[string]any)
+	for _, field := range []string{"artifact_subject", "base_tree", "candidate_tree", "changed_path_manifest"} {
+		if !slices.Contains(schemaStringArray(t, v2CaptureThen["required"]), field) {
+			t.Fatalf("native Git status capture input omits %q: %#v", field, v2CaptureThen)
+		}
+	}
+	v2Properties := v2Input["properties"].(map[string]any)
+	if v2Properties["candidate_diff"] != nil || v2Properties["base_tree"] == nil || v2Properties["candidate_tree"] == nil {
+		t.Fatalf("native Git status capture input = %#v", v2Properties)
+	}
+}
+
+func TestReviewProviderArtifactV2FixturesValidate(t *testing.T) {
+	root := filepath.Join("..", "..", "contracts", "review-integration", "v2", "fixtures")
+	startPayload, err := os.ReadFile(filepath.Join(root, "start.fixture.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var start ReviewIntegrationStartResult
+	if err := json.Unmarshal(startPayload, &start); err != nil {
+		t.Fatal(err)
+	}
+	if err := start.Validate(); err != nil {
+		t.Fatalf("v2 START fixture: %v", err)
+	}
+	statusPayload, err := os.ReadFile(filepath.Join(root, "status.fixture.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var status ReviewTargetStatusResult
+	if err := json.Unmarshal(statusPayload, &status); err != nil {
+		t.Fatal(err)
+	}
+	if err := status.Validate(); err != nil {
+		t.Fatalf("v2 STATUS fixture: %v", err)
+	}
+	consentPayload, err := os.ReadFile(filepath.Join(root, "consent.fixture.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var consent ReviewIntegrationConsentResult
+	if err := json.Unmarshal(consentPayload, &consent); err != nil {
+		t.Fatal(err)
+	}
+	if err := consent.Validate(); err != nil {
+		t.Fatalf("v2 consent fixture: %v", err)
 	}
 }
 
diff --git a/internal/cli/review_refusal_wording_test.go b/internal/cli/review_refusal_wording_test.go
index 072b1bf37..87c1594b5 100644
--- a/internal/cli/review_refusal_wording_test.go
+++ b/internal/cli/review_refusal_wording_test.go
@@ -32,12 +32,12 @@ func TestReviewStartTargetRequiresContractNamesValue(t *testing.T) {
 }
 
 // TestReviewRepairRequiresContractNamesValue pins that the refusal for an
-// unsupported --contract on review repair names the exact supported value.
+// unsupported --contract on review repair names both exact supported values.
 func TestReviewRepairRequiresContractNamesValue(t *testing.T) {
 	repo := initReviewCLIRepo(t)
-	err := RunReviewRepair([]string{"--cwd", repo, "--contract", "gentle-ai.review-integration/v2"}, io.Discard)
-	if err == nil || !strings.Contains(err.Error(), ReviewIntegrationContractV1) {
-		t.Fatalf("review repair contract error = %v, want it to name %s", err, ReviewIntegrationContractV1)
+	err := RunReviewRepair([]string{"--cwd", repo, "--contract", "gentle-ai.review-integration/v3"}, io.Discard)
+	if err == nil || !strings.Contains(err.Error(), ReviewIntegrationContractV1) || !strings.Contains(err.Error(), ReviewIntegrationContractV2) {
+		t.Fatalf("review repair contract error = %v, want it to name %s and %s", err, ReviewIntegrationContractV1, ReviewIntegrationContractV2)
 	}
 }
 
@@ -128,7 +128,7 @@ func TestReviewCaptureResultOpaqueBindingMismatchNamesRefreshCommand(t *testing.
 		"--expected-revision", started.RepositoryContext.Revision,
 		"--lens", "not-the-selected-lens", "--order", "0", "--preflight",
 	}, io.Discard)
-	if err == nil || !strings.Contains(err.Error(), reviewNextTransitionRefreshCommand) {
-		t.Fatalf("opaque capture binding mismatch error = %v, want it to contain %q", err, reviewNextTransitionRefreshCommand)
+	if err == nil || !strings.Contains(err.Error(), reviewNextTransitionRefreshCommandV2) {
+		t.Fatalf("opaque capture binding mismatch error = %v, want it to contain %q", err, reviewNextTransitionRefreshCommandV2)
 	}
 }
diff --git a/internal/cli/review_repair.go b/internal/cli/review_repair.go
index 73efd1679..cc2b9c848 100644
--- a/internal/cli/review_repair.go
+++ b/internal/cli/review_repair.go
@@ -13,6 +13,8 @@ import (
 
 const ReviewIntegrationRepairSchema = "gentle-ai.review-integration.repair/v1"
 const ReviewIntegrationRepairSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/repair.schema.json"
+const ReviewIntegrationRepairSchemaV2 = "gentle-ai.review-integration.repair/v2"
+const ReviewIntegrationRepairSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/repair.schema.json"
 
 type ReviewRepairMode string
 
@@ -43,7 +45,9 @@ type ReviewRepairResult struct {
 }
 
 func (result ReviewRepairResult) Validate() error {
-	if result.Schema != ReviewIntegrationRepairSchema || result.Contract != ReviewIntegrationContractV1 ||
+	legacyContract := result.Schema == ReviewIntegrationRepairSchema && result.Contract == ReviewIntegrationContractV1
+	nativeGitContract := result.Schema == ReviewIntegrationRepairSchemaV2 && result.Contract == ReviewIntegrationContractV2
+	if (!legacyContract && !nativeGitContract) ||
 		result.Operation != "review.repair" {
 		return errors.New("review repair result identity is invalid")
 	}
@@ -128,8 +132,8 @@ func runReviewRepair(ctx context.Context, args []string, stdout io.Writer) error
 	if flags.NArg() != 0 {
 		return reviewPreflightError(errors.New("review repair received an unexpected positional argument"))
 	}
-	if *contract != ReviewIntegrationContractV1 {
-		return reviewPreflightError(fmt.Errorf("review repair requires --contract %s", ReviewIntegrationContractV1))
+	if err := validateReviewIntegrationContract(*contract); err != nil {
+		return reviewPreflightError(err)
 	}
 	if *lineage != "" && !validReviewIntegrationLineage(*lineage) {
 		return reviewPreflightError(errors.New("review repair lineage is invalid"))
@@ -157,7 +161,7 @@ func runReviewRepair(ctx context.Context, args []string, stdout io.Writer) error
 			(assessment.Candidate == nil || assessment.Candidate.LineageID != *lineage) {
 			return reviewPreflightError(errors.New("review repair selector does not match the unique classified candidate"))
 		}
-		result := newReviewRepairPreflightResult(assessment)
+		result := newReviewRepairPreflightResult(assessment, *contract)
 		if err := result.Validate(); err != nil {
 			return fmt.Errorf("validate review repair preflight: %w", err)
 		}
@@ -186,6 +190,9 @@ func runReviewRepair(ctx context.Context, args []string, stdout io.Writer) error
 		Schema: ReviewIntegrationRepairSchema, Contract: ReviewIntegrationContractV1, Operation: "review.repair",
 		Mode: ReviewRepairModeExecute, Assessment: assessment, RequiredInputs: []string{}, Execution: &execution,
 	}
+	if *contract == ReviewIntegrationContractV2 {
+		result.Schema, result.Contract = ReviewIntegrationRepairSchemaV2, ReviewIntegrationContractV2
+	}
 	if err := result.Validate(); err != nil {
 		return fmt.Errorf("validate review repair execution: %w", err)
 	}
@@ -201,11 +208,14 @@ func repairExecutionInputPresent(values ...string) bool {
 	return false
 }
 
-func newReviewRepairPreflightResult(assessment reviewtransaction.AuthorityRepairAssessment) ReviewRepairResult {
+func newReviewRepairPreflightResult(assessment reviewtransaction.AuthorityRepairAssessment, contracts ...string) ReviewRepairResult {
 	result := ReviewRepairResult{
 		Schema: ReviewIntegrationRepairSchema, Contract: ReviewIntegrationContractV1, Operation: "review.repair",
 		Mode: ReviewRepairModePreflight, Assessment: assessment, RequiredInputs: []string{},
 	}
+	if len(contracts) > 0 && contracts[0] == ReviewIntegrationContractV2 {
+		result.Schema, result.Contract = ReviewIntegrationRepairSchemaV2, ReviewIntegrationContractV2
+	}
 	if assessment.Status != reviewtransaction.AuthorityRepairEligible || assessment.Candidate == nil {
 		return result
 	}
diff --git a/internal/cli/review_start_context_test.go b/internal/cli/review_start_context_test.go
index 516b6f816..e8056528f 100644
--- a/internal/cli/review_start_context_test.go
+++ b/internal/cli/review_start_context_test.go
@@ -49,11 +49,14 @@ func TestNegotiatedReviewStartContextIsFrozenWhileLegacyBytesStayPrivate(t *test
 		t.Fatalf("negotiated replay action = %q, want resumed", resumed.Action)
 	}
 	assertNegotiatedStartFrozenContext(t, repo, resumed)
-	frozenDiff := *resumed.CandidateDiff
+	frozenBase, frozenCandidate := resumed.BaseTree, resumed.CandidateTree
 	frozenManifest := append([]reviewtransaction.ChangedPathManifestEntry(nil), (*resumed.ChangedPathManifest)...)
-	frozenDiffBytes := decodeReviewStartCandidateDiff(t, frozenDiff)
-	if !bytes.Contains(frozenDiffBytes, []byte("+private tracked candidate")) || !bytes.Contains(frozenDiffBytes, []byte("+private intended candidate")) {
-		t.Fatalf("negotiated START omitted frozen candidate bytes:\n%s", frozenDiffBytes)
+	encoded, err := json.Marshal(resumed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(encoded, []byte("private tracked candidate")) || bytes.Contains(encoded, []byte("private intended candidate")) {
+		t.Fatalf("negotiated START leaked candidate bytes: %s", encoded)
 	}
 	if len(frozenManifest) != 2 || frozenManifest[0].Path != "private.txt" || !frozenManifest[0].IntendedUntracked ||
 		frozenManifest[1].Path != "tracked.txt" || frozenManifest[1].IntendedUntracked {
@@ -71,7 +74,7 @@ func TestNegotiatedReviewStartContextIsFrozenWhileLegacyBytesStayPrivate(t *test
 		t.Fatal(err)
 	}
 	blocked := runNegotiatedReviewStart(t, repo, lineage)
-	if blocked.Action != string(reviewtransaction.CompactStartBlocked) || *blocked.CandidateDiff != frozenDiff ||
+	if blocked.Action != string(reviewtransaction.CompactStartBlocked) || blocked.BaseTree != frozenBase || blocked.CandidateTree != frozenCandidate ||
 		!reflect.DeepEqual(*blocked.ChangedPathManifest, frozenManifest) {
 		t.Fatalf("blocked START did not retain frozen context: %#v", blocked)
 	}
@@ -90,7 +93,7 @@ func TestNegotiatedReviewStartContextCoversCreatedReuseAndRecovery(t *testing.T)
 		completeNegotiatedStartReview(t, repo, created, true)
 
 		reused := runNegotiatedReviewStart(t, repo, lineage)
-		if reused.Action != string(reviewtransaction.CompactStartReuseReceipt) || *reused.CandidateDiff != *created.CandidateDiff ||
+		if reused.Action != string(reviewtransaction.CompactStartReuseReceipt) || reused.BaseTree != created.BaseTree || reused.CandidateTree != created.CandidateTree ||
 			!reflect.DeepEqual(*reused.ChangedPathManifest, *created.ChangedPathManifest) {
 			t.Fatalf("receipt replay START = %#v", reused)
 		}
@@ -106,7 +109,7 @@ func TestNegotiatedReviewStartContextCoversCreatedReuseAndRecovery(t *testing.T)
 		writeReviewStartCandidate(t, repo, "tracked.txt", "replacement target after escalation\n", 0o644)
 		recovery := runNegotiatedReviewStart(t, repo, lineage)
 		if recovery.Action != string(reviewtransaction.CompactStartBlocked) || recovery.LineageID != lineage ||
-			*recovery.CandidateDiff != *created.CandidateDiff || !reflect.DeepEqual(*recovery.ChangedPathManifest, *created.ChangedPathManifest) {
+			recovery.BaseTree != created.BaseTree || recovery.CandidateTree != created.CandidateTree || !reflect.DeepEqual(*recovery.ChangedPathManifest, *created.ChangedPathManifest) {
 			t.Fatalf("recovery START = %#v", recovery)
 		}
 	})
@@ -128,30 +131,9 @@ func TestNegotiatedReviewStartContextValidationDistinguishesMissingAndEmpty(t *t
 			subjects[0].SubjectHash = "sha256:" + strings.Repeat("0", 64)
 			result.ArtifactSubjects = subjects
 		}},
-		{name: "missing diff", mutate: func(result *ReviewIntegrationStartResult) { result.CandidateDiff = nil }},
+		{name: "missing base tree", mutate: func(result *ReviewIntegrationStartResult) { result.BaseTree = "" }},
+		{name: "missing candidate tree", mutate: func(result *ReviewIntegrationStartResult) { result.CandidateTree = "" }},
 		{name: "missing manifest", mutate: func(result *ReviewIntegrationStartResult) { result.ChangedPathManifest = nil }},
-		{name: "empty diff for changed path", mutate: func(result *ReviewIntegrationStartResult) {
-			empty, err := reviewtransaction.NewFrozenCandidateDiff(nil)
-			if err != nil {
-				t.Fatal(err)
-			}
-			result.CandidateDiff = &empty
-		}},
-		{name: "noncanonical diff encoding", mutate: func(result *ReviewIntegrationStartResult) {
-			diff := *result.CandidateDiff
-			diff.Encoding = "utf-8"
-			result.CandidateDiff = &diff
-		}},
-		{name: "diff digest mismatch", mutate: func(result *ReviewIntegrationStartResult) {
-			diff := *result.CandidateDiff
-			diff.SHA256 = "sha256:" + strings.Repeat("0", 64)
-			result.CandidateDiff = &diff
-		}},
-		{name: "diff byte size mismatch", mutate: func(result *ReviewIntegrationStartResult) {
-			diff := *result.CandidateDiff
-			diff.ByteSize++
-			result.CandidateDiff = &diff
-		}},
 		{name: "manifest count mismatch", mutate: func(result *ReviewIntegrationStartResult) {
 			empty := []reviewtransaction.ChangedPathManifestEntry{}
 			result.ChangedPathManifest = &empty
@@ -186,12 +168,7 @@ func TestNegotiatedReviewStartContextValidationDistinguishesMissingAndEmpty(t *t
 		})
 	}
 
-	emptyDiff, err := reviewtransaction.NewFrozenCandidateDiff(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
 	emptyManifest := []reviewtransaction.ChangedPathManifestEntry{}
-	valid.CandidateDiff = &emptyDiff
 	valid.ChangedPathManifest = &emptyManifest
 	valid.LensesRequired = false
 	valid.RiskLevel = reviewtransaction.RiskLow
@@ -269,7 +246,7 @@ func TestNegotiatedReviewStartContextFailureReportsTruthfulAuthorityProvenance(t
 
 func assertNegotiatedStartFrozenContext(t *testing.T, repo string, result ReviewIntegrationStartResult) {
 	t.Helper()
-	if result.CandidateDiff == nil || result.ChangedPathManifest == nil {
+	if result.BaseTree == "" || result.CandidateTree == "" || result.ChangedPathManifest == nil {
 		t.Fatalf("negotiated START context is missing: %#v", result)
 	}
 	store, err := reviewtransaction.CompactAuthoritativeStore(context.Background(), repo, result.LineageID)
@@ -284,7 +261,7 @@ func assertNegotiatedStartFrozenContext(t *testing.T, repo string, result Review
 	if err != nil {
 		t.Fatal(err)
 	}
-	if *result.CandidateDiff != want.CandidateDiff || !reflect.DeepEqual(*result.ChangedPathManifest, want.ChangedPathManifest) {
+	if result.BaseTree != want.BaseTree || result.CandidateTree != want.CandidateTree || !reflect.DeepEqual(*result.ChangedPathManifest, want.ChangedPathManifest) {
 		t.Fatalf("START context does not match frozen authority:\ngot=%#v\nwant=%#v", result, want)
 	}
 }
@@ -325,15 +302,6 @@ func completeNegotiatedStartReview(t *testing.T, repo string, started ReviewInte
 	}
 }
 
-func decodeReviewStartCandidateDiff(t *testing.T, diff reviewtransaction.FrozenCandidateDiff) []byte {
-	t.Helper()
-	payload, err := diff.Bytes()
-	if err != nil {
-		t.Fatalf("candidate diff metadata = %#v: %v", diff, err)
-	}
-	return payload
-}
-
 func forceReviewStartContextFailure(forced error) func() {
 	original := renderReviewStartFrozenCandidateContext
 	renderReviewStartFrozenCandidateContext = func(context.Context, reviewtransaction.SnapshotBuilder, reviewtransaction.Snapshot) (reviewtransaction.FrozenCandidateContext, error) {
diff --git a/internal/cli/review_start_contract.go b/internal/cli/review_start_contract.go
index 7b3c86b9e..548cd650e 100644
--- a/internal/cli/review_start_contract.go
+++ b/internal/cli/review_start_contract.go
@@ -11,8 +11,10 @@ import (
 
 const ReviewIntegrationStartSchemaV1 = "gentle-ai.review-integration.start/v1"
 const ReviewIntegrationStartSchemaIDV1 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/start.schema.json"
-const ReviewIntegrationStartSchema = "gentle-ai.review-integration.start/v2"
-const ReviewIntegrationStartSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/start-v2.schema.json"
+const ReviewIntegrationStartSchemaV2 = "gentle-ai.review-integration.start/v2"
+const ReviewIntegrationStartSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/start-v2.schema.json"
+const ReviewIntegrationStartSchema = "gentle-ai.review-integration.start/v3"
+const ReviewIntegrationStartSchemaID = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/start.schema.json"
 
 // ReviewIntegrationStartResult is the explicitly negotiated START response.
 // The legacy ReviewFacadeStartResult remains byte- and schema-compatible.
@@ -50,7 +52,7 @@ type ReviewRepositoryContextReference struct {
 	TargetIdentity string `json:"target_identity"`
 }
 
-func newReviewIntegrationStartResult(legacy ReviewFacadeStartResult, assessment reviewtransaction.RiskAssessment, targetMode reviewtransaction.TargetKind, frozenContext *reviewtransaction.FrozenCandidateContext, repositoryContext *ReviewRepositoryContextReference) (ReviewIntegrationStartResult, error) {
+func newReviewIntegrationStartResult(legacy ReviewFacadeStartResult, assessment reviewtransaction.RiskAssessment, targetMode reviewtransaction.TargetKind, frozenContext *reviewtransaction.FrozenCandidateContext, repositoryContext *ReviewRepositoryContextReference, contracts ...string) (ReviewIntegrationStartResult, error) {
 	assessment, err := reviewStartAssessmentForFrozenAuthority(legacy, assessment)
 	if err != nil {
 		return ReviewIntegrationStartResult{}, err
@@ -58,8 +60,16 @@ func newReviewIntegrationStartResult(legacy ReviewFacadeStartResult, assessment
 	if assessment.Level != legacy.RiskLevel || assessment.ChangedLines != legacy.ChangedLines {
 		return ReviewIntegrationStartResult{}, errors.New("negotiated START risk assessment does not match frozen authority")
 	}
+	legacyTransport := len(contracts) > 0 && contracts[0] == ReviewIntegrationContractV1
+	if legacyTransport && frozenContext != nil && frozenContext.LegacyCandidateDiff == nil {
+		return ReviewIntegrationStartResult{}, errors.New("legacy negotiated START requires its published candidate transport") // refusal:by-design world-action: provider-built v1 START omitted required immutable transport and requires a code fix
+	}
+	schema, contract := ReviewIntegrationStartSchema, ReviewIntegrationContractV2
+	if legacyTransport {
+		schema, contract = ReviewIntegrationStartSchemaV2, ReviewIntegrationContractV1
+	}
 	result := ReviewIntegrationStartResult{
-		Schema: ReviewIntegrationStartSchema, Contract: ReviewIntegrationContractV1, Operation: "review.start",
+		Schema: schema, Contract: contract, Operation: "review.start",
 		Action: legacy.Action, LensesRequired: legacy.LensesRequired, LineageID: legacy.LineageID,
 		State: legacy.State, RiskLevel: legacy.RiskLevel, SelectedLenses: append([]string{}, legacy.SelectedLenses...),
 		Projection: legacy.Projection, ChangedFiles: legacy.ChangedFiles, ChangedLines: legacy.ChangedLines,
@@ -73,12 +83,19 @@ func newReviewIntegrationStartResult(legacy ReviewFacadeStartResult, assessment
 		result.CandidateTree = legacy.CandidateTree
 	}
 	if frozenContext != nil {
-		diff := frozenContext.CandidateDiff
+		if result.BaseTree != "" && (result.BaseTree != frozenContext.BaseTree || result.CandidateTree != frozenContext.CandidateTree) {
+			return ReviewIntegrationStartResult{}, errors.New("negotiated START trees do not match frozen reviewer context") // refusal:by-design world-action: this provider-built envelope is inconsistent; the exit is a code fix, not a command
+		}
+		if legacyTransport {
+			diff := *frozenContext.LegacyCandidateDiff
+			result.CandidateDiff = &diff
+		} else {
+			result.BaseTree, result.CandidateTree = frozenContext.BaseTree, frozenContext.CandidateTree
+		}
 		manifest := append([]reviewtransaction.ChangedPathManifestEntry(nil), frozenContext.ChangedPathManifest...)
 		if manifest == nil {
 			manifest = []reviewtransaction.ChangedPathManifestEntry{}
 		}
-		result.CandidateDiff = &diff
 		result.ChangedPathManifest = &manifest
 		if repositoryContext != nil {
 			paths := make([]string, len(manifest))
@@ -86,15 +103,20 @@ func newReviewIntegrationStartResult(legacy ReviewFacadeStartResult, assessment
 				paths[index] = entry.Path
 			}
 			subjectState := reviewtransaction.CompactState{
-				LineageID:       legacy.LineageID,
-				InitialSnapshot: reviewtransaction.Snapshot{Identity: repositoryContext.TargetIdentity, Paths: paths},
-				SelectedLenses:  append([]string{}, legacy.SelectedLenses...),
+				LineageID: legacy.LineageID,
+				InitialSnapshot: reviewtransaction.Snapshot{
+					Identity: repositoryContext.TargetIdentity, BaseTree: frozenContext.BaseTree,
+					CandidateTree: frozenContext.CandidateTree, Paths: paths,
+				},
+				SelectedLenses: append([]string{}, legacy.SelectedLenses...),
 			}
 			result.ArtifactSubjects = make([]reviewtransaction.ArtifactSubject, len(legacy.SelectedLenses))
 			for order, lens := range legacy.SelectedLenses {
-				result.ArtifactSubjects[order], err = reviewtransaction.NewArtifactSubject(
-					subjectState, repositoryContext.Revision, *frozenContext, lens, order, "",
-				)
+				if legacyTransport {
+					result.ArtifactSubjects[order], err = reviewtransaction.NewLegacyArtifactSubject(subjectState, repositoryContext.Revision, *frozenContext, lens, order, "")
+				} else {
+					result.ArtifactSubjects[order], err = reviewtransaction.NewArtifactSubject(subjectState, repositoryContext.Revision, *frozenContext, lens, order, "")
+				}
 				if err != nil {
 					return ReviewIntegrationStartResult{}, fmt.Errorf("derive artifact subject %d: %w", order, err)
 				}
@@ -137,7 +159,9 @@ func reviewStartAssessmentForFrozenAuthority(legacy ReviewFacadeStartResult, ass
 }
 
 func (result ReviewIntegrationStartResult) Validate() error {
-	if result.Schema != ReviewIntegrationStartSchema || result.Contract != ReviewIntegrationContractV1 || result.Operation != "review.start" {
+	legacyTransport := result.Schema == ReviewIntegrationStartSchemaV2 && result.Contract == ReviewIntegrationContractV1
+	nativeGitTransport := result.Schema == ReviewIntegrationStartSchema && result.Contract == ReviewIntegrationContractV2
+	if (!legacyTransport && !nativeGitTransport) || result.Operation != "review.start" {
 		return errors.New("invalid negotiated START identity")
 	}
 	if strings.TrimSpace(result.LineageID) == "" || result.SelectedLenses == nil || result.RiskReasons == nil || result.ArtifactSubjects == nil {
@@ -159,8 +183,8 @@ func (result ReviewIntegrationStartResult) Validate() error {
 		if !validReviewCapabilitySHA256(result.TargetIdentity) || !validReviewGitTree(result.BaseTree) || !validReviewGitTree(result.CandidateTree) {
 			return errors.New("negotiated overlay START target identity is incomplete")
 		}
-	} else if result.TargetIdentity != "" || result.BaseTree != "" || result.CandidateTree != "" {
-		return errors.New("negotiated non-overlay START cannot contain overlay identity")
+	} else if result.TargetIdentity != "" {
+		return errors.New("negotiated non-overlay START cannot contain overlay target identity") // refusal:by-design world-action: this provider-built envelope is inconsistent; the exit is a code fix, not a command
 	}
 	if result.ChangedFiles < 0 || result.ChangedLines < 0 {
 		return errors.New("negotiated START change counts cannot be negative")
@@ -178,11 +202,17 @@ func (result ReviewIntegrationStartResult) Validate() error {
 	if err := validateReviewStartLenses(result.RiskLevel, result.SelectedLenses); err != nil {
 		return err
 	}
-	hasDiff, hasManifest := result.CandidateDiff != nil, result.ChangedPathManifest != nil
-	if hasDiff != hasManifest {
+	hasTrees := result.BaseTree != "" || result.CandidateTree != ""
+	hasDiff := result.CandidateDiff != nil
+	hasManifest := result.ChangedPathManifest != nil
+	if hasTrees && (!validReviewGitTree(result.BaseTree) || !validReviewGitTree(result.CandidateTree)) {
+		return errors.New("negotiated START candidate tree context is incomplete") // refusal:by-design world-action: this provider-built envelope is inconsistent; the exit is a code fix, not a command
+	}
+	if legacyTransport && hasDiff != hasManifest || nativeGitTransport && result.TargetMode == "" && hasTrees != hasManifest ||
+		legacyTransport && result.TargetMode == "" && hasTrees || nativeGitTransport && hasDiff {
 		return errors.New("negotiated START candidate context is incomplete")
 	}
-	if len(result.SelectedLenses) > 0 && !hasDiff {
+	if len(result.SelectedLenses) > 0 && ((!legacyTransport || !hasDiff) && (!nativeGitTransport || !hasTrees) || !hasManifest) {
 		return errors.New("negotiated START selected lenses require frozen candidate context")
 	}
 	needsRepositoryContext := result.State == reviewtransaction.StateReviewing &&
@@ -207,9 +237,11 @@ func (result ReviewIntegrationStartResult) Validate() error {
 		}
 	}
 	if hasManifest {
-		diffBytes, err := result.CandidateDiff.Bytes()
-		if err != nil {
-			return err
+		if hasDiff {
+			diffBytes, diffErr := result.CandidateDiff.Bytes()
+			if diffErr != nil || (len(*result.ChangedPathManifest) == 0) != (len(diffBytes) == 0) {
+				return errors.New("negotiated START candidate diff does not match changed-path manifest")
+			}
 		}
 		manifest := *result.ChangedPathManifest
 		if err := reviewtransaction.ValidateChangedPathManifest(manifest); err != nil {
@@ -218,16 +250,17 @@ func (result ReviewIntegrationStartResult) Validate() error {
 		if len(manifest) != result.ChangedFiles {
 			return errors.New("negotiated START changed-path manifest does not match changed_files")
 		}
-		if (len(manifest) == 0) != (len(diffBytes) == 0) {
-			return errors.New("negotiated START candidate diff does not match changed-path manifest")
-		}
 		for order, subject := range result.ArtifactSubjects {
 			if err := reviewtransaction.ValidateArtifactSubject(subject); err != nil ||
 				subject.LineageID != result.LineageID || subject.AuthorityRevision != result.RepositoryContext.Revision ||
-				subject.TargetIdentity != result.RepositoryContext.TargetIdentity || subject.CandidateDiffSHA256 != result.CandidateDiff.SHA256 ||
+				subject.TargetIdentity != result.RepositoryContext.TargetIdentity ||
 				subject.Lens != result.SelectedLenses[order] || subject.SelectedOrder != order || subject.CorrectionTargetIdentity != "" {
 				return fmt.Errorf("negotiated START artifact subject %d does not match frozen authority", order)
 			}
+			if legacyTransport && (subject.Schema != reviewtransaction.ArtifactSubjectSchemaV1 || subject.CandidateDiffSHA256 != result.CandidateDiff.SHA256) ||
+				nativeGitTransport && (subject.Schema != reviewtransaction.ArtifactSubjectSchema || subject.BaseTree != result.BaseTree || subject.CandidateTree != result.CandidateTree) {
+				return fmt.Errorf("negotiated START artifact subject %d uses the wrong context contract", order) // refusal:by-design world-action: provider-built START mixed contract identities and requires a code fix
+			}
 			manifestDigest, digestErr := reviewtransaction.ChangedPathManifestDigest(manifest)
 			if digestErr != nil || subject.ChangedPathManifestSHA256 != manifestDigest {
 				return fmt.Errorf("negotiated START artifact subject %d does not match changed-path manifest", order)
diff --git a/internal/cli/review_start_contract_test.go b/internal/cli/review_start_contract_test.go
index c3868e2d9..33b76d7ba 100644
--- a/internal/cli/review_start_contract_test.go
+++ b/internal/cli/review_start_contract_test.go
@@ -37,7 +37,7 @@ func TestNegotiatedReviewStartMatchesVersionedFixture(t *testing.T) {
 		reviewtransaction.LensRisk, reviewtransaction.LensResilience,
 		reviewtransaction.LensReadability, reviewtransaction.LensReliability,
 	}
-	if result.Schema != ReviewIntegrationStartSchema || result.Contract != ReviewIntegrationContractV1 ||
+	if result.Schema != ReviewIntegrationStartSchemaV2 || result.Contract != ReviewIntegrationContractV1 ||
 		result.Operation != "review.start" || result.Action != "created" || !result.LensesRequired ||
 		result.LineageID != "review-start-fixture" || result.State != reviewtransaction.StateReviewing ||
 		result.RiskLevel != reviewtransaction.RiskHigh || !reflect.DeepEqual(result.SelectedLenses, wantLenses) ||
@@ -687,7 +687,7 @@ func TestNegotiatedReviewStartPreservesLegacyPayloadAndAuthorityIdentity(t *test
 	// "hint" is present here (see TestReviewFacadeStartLensesRequiredHintsNegotiatedContract
 	// in review_start_evidence_test.go) because this fixture's tracked.txt
 	// change requires lenses: the unnegotiated response cannot itself carry
-	// the frozen candidate_diff/changed_path_manifest/artifact_subjects those
+	// the frozen tree/changed_path_manifest/artifact_subjects those
 	// lenses need, so it names the exact negotiated rerun that returns them.
 	wantFields := []string{
 		"action", "changed_files", "changed_lines", "correction_budget", "hint", "lens_bindings", "lenses_required",
@@ -744,7 +744,7 @@ func TestNegotiatedReviewStartPreservesLegacyPayloadAndAuthorityIdentity(t *test
 }
 
 func TestNegotiatedReviewStartRejectsInvalidContractsBeforeAuthorityMutation(t *testing.T) {
-	for _, contract := range []string{"", "gentle-ai.review-integration/v2", " " + ReviewIntegrationContractV1} {
+	for _, contract := range []string{"", "gentle-ai.review-integration/v3", " " + ReviewIntegrationContractV1} {
 		t.Run(strings.ReplaceAll(contract, "/", "_"), func(t *testing.T) {
 			repo := initReviewCLIRepo(t)
 			if err := os.WriteFile(filepath.Join(repo, "tracked.txt"), []byte("candidate\n"), 0o644); err != nil {
@@ -838,21 +838,17 @@ func TestNegotiatedReviewStartSchemaAndFixtureAreStrict(t *testing.T) {
 		t.Fatal(err)
 	}
 	if schema["$schema"] != "https://json-schema.org/draft/2020-12/schema" ||
-		schema["$id"] != ReviewIntegrationStartSchemaID || schema["additionalProperties"] != false {
+		schema["$id"] != ReviewIntegrationStartSchemaIDV2 || schema["additionalProperties"] != false {
 		t.Fatalf("START schema header = %#v", schema)
 	}
 	properties := schema["properties"].(map[string]any)
-	if properties["candidate_diff"] == nil || properties["changed_path_manifest"] == nil || schema["allOf"] == nil {
+	if properties["candidate_diff"] == nil || properties["base_tree"] == nil || properties["candidate_tree"] == nil || properties["changed_path_manifest"] == nil || schema["allOf"] == nil {
 		t.Fatalf("START schema does not declare conditional frozen context: %#v", schema)
 	}
 	dependencies := schema["dependentRequired"].(map[string]any)
 	if !reflect.DeepEqual(dependencies["candidate_diff"], []any{"changed_path_manifest"}) ||
 		!reflect.DeepEqual(dependencies["changed_path_manifest"], []any{"candidate_diff"}) {
-		t.Fatalf("START schema does not require frozen context fields as a pair: %#v", dependencies)
-	}
-	candidateDiffSchema := properties["candidate_diff"].(map[string]any)
-	if candidateDiffSchema["$ref"] != "#/$defs/frozen_candidate_diff" {
-		t.Fatalf("START candidate_diff schema = %#v", candidateDiffSchema)
+		t.Fatalf("START schema does not require frozen tree context fields together: %#v", dependencies)
 	}
 	fixture, err := os.ReadFile(filepath.Join(root, "fixtures", "start-v2.fixture.json"))
 	if err != nil {
@@ -896,7 +892,7 @@ func runNegotiatedReviewStart(t *testing.T, repo, lineage string) ReviewIntegrat
 	t.Helper()
 	var output bytes.Buffer
 	if err := RunReview(boundNegotiatedStartArgs(t, []string{
-		"start", "--contract", ReviewIntegrationContractV1, "--cwd", repo, "--lineage", lineage,
+		"start", "--contract", ReviewIntegrationContractV2, "--cwd", repo, "--lineage", lineage,
 	}), &output); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/cli/review_start_evidence_test.go b/internal/cli/review_start_evidence_test.go
index 7f6d56e85..bf11d2235 100644
--- a/internal/cli/review_start_evidence_test.go
+++ b/internal/cli/review_start_evidence_test.go
@@ -286,7 +286,7 @@ func TestReviewFacadeStartNonEmptyCandidateWithoutLensesHasNoHint(t *testing.T)
 
 // TestReviewFacadeStartLensesRequiredHintsNegotiatedContract proves the
 // unnegotiated summary is self-describing: when lenses are required, this
-// response cannot itself carry the frozen candidate_diff/changed_path_manifest
+// response cannot itself carry the frozen tree/changed_path_manifest
 // (that payload only exists on the negotiated form), so the hint must name
 // the exact --contract invocation — reusing this response's own
 // target_identity and projection — that returns it. This closes the reported
@@ -308,7 +308,7 @@ func TestReviewFacadeStartLensesRequiredHintsNegotiatedContract(t *testing.T) {
 	if !started.LensesRequired || len(started.SelectedLenses) == 0 {
 		t.Fatalf("service-token start lenses_required = %v, selected_lenses = %v, want lenses selected", started.LensesRequired, started.SelectedLenses)
 	}
-	wantCommand := fmt.Sprintf("gentle-ai review start --contract %s --target %s --projection %s", ReviewIntegrationContractV1, started.TargetIdentity, started.Projection)
+	wantCommand := fmt.Sprintf("gentle-ai review start --contract %s --target %s --projection %s", ReviewIntegrationContractV2, started.TargetIdentity, started.Projection)
 	if !strings.Contains(started.Hint, wantCommand) {
 		t.Fatalf("lenses-required start hint = %q, want it to contain %q", started.Hint, wantCommand)
 	}
diff --git a/internal/cli/review_start_oversized_candidate_test.go b/internal/cli/review_start_oversized_candidate_test.go
index 8cf062289..064b03d8f 100644
--- a/internal/cli/review_start_oversized_candidate_test.go
+++ b/internal/cli/review_start_oversized_candidate_test.go
@@ -2,24 +2,16 @@ package cli
 
 import (
 	"bytes"
-	"context"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"
-
-	"github.com/gentleman-programming/gentle-ai/v2/internal/reviewtransaction"
 )
 
-// writeReviewStartSizedCandidate stages one deterministic text candidate whose
-// rendered diff lands on the requested side of MaxFrozenCandidateDiffBytes. It
-// returns the exact byte size of the diff START must render, measured with the
-// same bounded capture the product uses, so these tests assert against the real
-// boundary instead of an assumed one.
-func writeReviewStartSizedCandidate(t *testing.T, repo string, lines int) int {
+func writeReviewStartLargeCandidate(t *testing.T, repo string, lines int) []byte {
 	t.Helper()
 	var builder strings.Builder
 	for index := 0; index < lines; index++ {
@@ -29,221 +21,80 @@ func writeReviewStartSizedCandidate(t *testing.T, repo string, lines int) int {
 		t.Fatal(err)
 	}
 	runReviewCLIGit(t, repo, "add", "big.txt")
-	measured := runReviewCLIGitOutput(t, repo, "diff", "--cached", "--binary", "--full-index",
-		"--no-color", "--no-renames", "--no-ext-diff", "--no-textconv")
-	return len(measured)
+	return []byte(runReviewCLIGitOutput(t, repo, "diff", "--cached", "--binary", "--full-index",
+		"--no-color", "--no-renames", "--no-ext-diff", "--no-textconv"))
 }
 
-// TestReviewStartRefusesOversizedCandidateBeforeCommittingAuthority pins the
-// release criterion this defect broke: START may not admit a candidate whose
-// frozen reviewer context cannot be rendered. The unnegotiated form is the one
-// that regressed, because it skipped the pre-mutation render entirely and left
-// an active authority that STATUS could only answer with a stop.
-func TestReviewStartRefusesOversizedCandidateBeforeCommittingAuthority(t *testing.T) {
+func TestLargeCandidateSTARTAndStatusCarryOnlyNativeGitReferences(t *testing.T) {
 	repo := initReviewCLIRepo(t)
-	rendered := writeReviewStartSizedCandidate(t, repo, 110000)
-	if rendered <= reviewtransaction.MaxFrozenCandidateDiffBytes {
-		t.Fatalf("fixture diff = %d bytes, want more than the %d-byte bound", rendered, reviewtransaction.MaxFrozenCandidateDiffBytes)
-	}
-
-	var output bytes.Buffer
-	err := RunReview([]string{"start", "--cwd", repo, "--lineage", "review-start-oversized"}, &output)
-	if err == nil {
-		t.Fatalf("unnegotiated START admitted an unrenderable candidate:\n%s", output.String())
-	}
-
-	stores, storeErr := reviewtransaction.DiscoverCompactStores(context.Background(), repo)
-	if storeErr != nil {
-		t.Fatal(storeErr)
-	}
-	if len(stores) != 0 {
-		t.Fatalf("refused START persisted authority stores: %#v", stores)
+	fullDiff := writeReviewStartLargeCandidate(t, repo, 110000)
+	if len(fullDiff) <= 4<<20 {
+		t.Fatalf("fixture diff = %d bytes, want larger than the retired 4 MiB inline limit", len(fullDiff))
 	}
 
-	message := err.Error()
-	for _, required := range []string{
-		strconv.Itoa(reviewtransaction.MaxFrozenCandidateDiffBytes),
-		"smaller candidates",
-	} {
-		if !strings.Contains(message, required) {
-			t.Fatalf("refusal does not name %q:\n%s", required, message)
-		}
-	}
-	if !strings.Contains(message, strconv.Itoa(rendered)) {
-		t.Fatalf("refusal does not name the rendered size %d:\n%s", rendered, message)
-	}
-}
-
-// TestNegotiatedReviewStartOversizedRefusalNamesBoundAndWayOut asserts the
-// typed negotiated envelope carries the same numbers and the same remedy, so a
-// machine consumer is not handed a bare code it cannot act on.
-func TestNegotiatedReviewStartOversizedRefusalNamesBoundAndWayOut(t *testing.T) {
-	repo := initReviewCLIRepo(t)
-	rendered := writeReviewStartSizedCandidate(t, repo, 110000)
-
-	var output bytes.Buffer
-	err := RunReview(boundNegotiatedStartArgs(t, []string{
-		"start", "--contract", ReviewIntegrationContractV1, "--cwd", repo, "--lineage", "review-start-oversized-negotiated",
-	}), &output)
-	if err == nil {
-		t.Fatalf("negotiated START admitted an unrenderable candidate:\n%s", output.String())
-	}
-	failure := decodeReviewIntegrationFailure(t, output.Bytes())
-	if failure.Phase != "pre_native" || failure.MutationOutcome != ReviewMutationNotStarted || failure.NextAction != "stop" {
-		t.Fatalf("oversized negotiated failure = %#v", failure)
-	}
-	// The remedy is only useful if the envelope carrying it stays valid; the
-	// contract caps a failure message at 240 bytes.
-	if err := failure.Validate(); err != nil {
-		t.Fatalf("oversized negotiated failure envelope is invalid: %v\nmessage (%d bytes) = %s", err, len(failure.Message), failure.Message)
-	}
-	for _, required := range []string{
-		strconv.Itoa(reviewtransaction.MaxFrozenCandidateDiffBytes),
-		strconv.Itoa(rendered),
-		"smaller candidates",
-	} {
-		if !strings.Contains(failure.Message, required) {
-			t.Fatalf("negotiated refusal message does not name %q:\n%s", required, failure.Message)
-		}
-	}
-	stores, storeErr := reviewtransaction.DiscoverCompactStores(context.Background(), repo)
-	if storeErr != nil {
-		t.Fatal(storeErr)
-	}
-	if len(stores) != 0 {
-		t.Fatalf("refused negotiated START persisted authority stores: %#v", stores)
+	var started bytes.Buffer
+	if err := RunReview(boundNegotiatedStartArgs(t, []string{
+		"start", "--contract", ReviewIntegrationContractV2, "--cwd", repo, "--lineage", "review-start-large-native-git",
+	}), &started); err != nil {
+		t.Fatalf("START refused a large Git-addressable candidate: %v\n%s", err, started.String())
 	}
-}
+	assertNoEagerCandidateDiff(t, "START", started.Bytes(), fullDiff)
 
-// TestReviewStartAdmitsCandidateUnderBoundAndStatusYieldsCollect is the guard
-// against a guard that passes by refusing everything: a candidate just under
-// the bound must still start, and its STATUS must produce real reviewer work.
-func TestReviewStartAdmitsCandidateUnderBoundAndStatusYieldsCollect(t *testing.T) {
-	repo := initReviewCLIRepo(t)
-	rendered := writeReviewStartSizedCandidate(t, repo, 95000)
-	if rendered >= reviewtransaction.MaxFrozenCandidateDiffBytes {
-		t.Fatalf("fixture diff = %d bytes, want less than the %d-byte bound", rendered, reviewtransaction.MaxFrozenCandidateDiffBytes)
+	var start ReviewIntegrationStartResult
+	if err := json.Unmarshal(started.Bytes(), &start); err != nil {
+		t.Fatal(err)
 	}
-
-	var started bytes.Buffer
-	if err := RunReview([]string{"start", "--cwd", repo, "--lineage", "review-start-under-bound"}, &started); err != nil {
-		t.Fatalf("START refused a renderable candidate: %v\n%s", err, started.String())
+	if start.BaseTree == "" || start.CandidateTree == "" || start.ChangedPathManifest == nil ||
+		len(*start.ChangedPathManifest) != 1 || (*start.ChangedPathManifest)[0].Path != "big.txt" {
+		t.Fatalf("START native Git context = %#v", start)
 	}
 
 	var status bytes.Buffer
 	if err := RunReview([]string{
-		"status", "--contract", ReviewIntegrationContractV1, "--cwd", repo, "--next-transition",
+		"status", "--contract", ReviewIntegrationContractV2, "--cwd", repo, "--next-transition",
 	}, &status); err != nil {
 		t.Fatal(err)
 	}
+	assertNoEagerCandidateDiff(t, "STATUS", status.Bytes(), fullDiff)
+
 	var result ReviewTargetStatusResult
 	if err := json.Unmarshal(status.Bytes(), &result); err != nil {
 		t.Fatal(err)
 	}
-	if result.NextTransition == nil || result.NextTransition.Kind != reviewNextTransitionCollect ||
-		result.NextTransition.ReasonCode != "reviewer_results_required" {
-		t.Fatalf("under-bound STATUS transition = %#v", result.NextTransition)
-	}
-	if result.NextTransition.Collect == nil || len(result.NextTransition.Collect.Inputs) == 0 {
-		t.Fatalf("under-bound STATUS produced no reviewer collection context: %#v", result.NextTransition)
+	if result.NextTransition == nil || result.NextTransition.Collect == nil || len(result.NextTransition.Collect.Inputs) == 0 {
+		t.Fatalf("large-candidate STATUS produced no reviewer input: %#v", result.NextTransition)
 	}
 	for _, input := range result.NextTransition.Collect.Inputs {
-		if input.CandidateDiff == nil || input.ChangedPathManifest == nil || input.ArtifactSubject == nil {
-			t.Fatalf("collect input is missing frozen reviewer context: %#v", input)
+		if input.BaseTree != start.BaseTree || input.CandidateTree != start.CandidateTree ||
+			input.ChangedPathManifest == nil || input.ArtifactSubject == nil {
+			t.Fatalf("collect input lost native Git context: %#v", input)
 		}
 	}
-}
-
-// TestStuckOversizedReviewingLineageExitsThroughAbandon covers the operators
-// who already carry an authority created before this guard existed. The stuck
-// authority is persisted the way the defective START persisted it -- with no
-// pre-creation render -- so the exit is verified against the real dead end.
-func TestStuckOversizedReviewingLineageExitsThroughAbandon(t *testing.T) {
-	repo := initReviewCLIRepo(t)
-	writeReviewStartSizedCandidate(t, repo, 110000)
-	ctx := context.Background()
-	lineage := "review-stuck-oversized"
-
-	builder := reviewtransaction.SnapshotBuilder{Repo: repo}
-	snapshot, err := builder.Build(ctx, reviewtransaction.Target{
-		Kind: reviewtransaction.TargetCurrentChanges, Projection: reviewtransaction.ProjectionStaged, IntendedUntracked: []string{},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	assessment, err := builder.AssessSnapshotRisk(ctx, snapshot)
-	if err != nil {
-		t.Fatal(err)
-	}
-	lenses, err := facadeSelectedLenses(assessment, "reliability")
-	if err != nil {
-		t.Fatal(err)
-	}
-	policy, err := facadePolicyBytes("")
-	if err != nil {
-		t.Fatal(err)
-	}
-	changedLines := assessment.ChangedLines
-	state, err := reviewtransaction.NewCompactState(reviewtransaction.Start{
-		LineageID: lineage, Mode: reviewtransaction.ModeOrdinaryBounded, Generation: 1,
-		Snapshot: snapshot, PolicyHash: facadePayloadHash(policy), RiskLevel: assessment.Level,
-		SelectedLenses: lenses, OriginalChangedLines: &changedLines,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	started, err := reviewtransaction.StartCompactAuthority(ctx, repo, reviewtransaction.CompactStartRequest{
-		State: state, ExplicitLineage: true,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var stuck bytes.Buffer
-	if err := RunReview([]string{
-		"status", "--contract", ReviewIntegrationContractV1, "--cwd", repo, "--projection", "staged", "--next-transition",
-	}, &stuck); err != nil {
-		t.Fatal(err)
-	}
-	var stuckResult ReviewTargetStatusResult
-	if err := json.Unmarshal(stuck.Bytes(), &stuckResult); err != nil {
-		t.Fatal(err)
-	}
-	if stuckResult.NextTransition == nil || stuckResult.NextTransition.Kind != reviewNextTransitionStop ||
-		stuckResult.NextTransition.ReasonCode != "captured_artifacts_unverifiable" {
-		t.Fatalf("stuck lineage STATUS transition = %#v", stuckResult.NextTransition)
-	}
-
-	reason := "oversized candidate cannot render the frozen reviewer context"
-	actor := "maintainer@example.com"
-	authorization := strings.Join([]string{
-		"gentle-ai.review-abandon-authorization/v1",
-		"lineage=" + lineage,
-		"revision=" + started.Record.Revision,
-		"snapshot_identity=" + snapshot.Identity,
-		"actor=" + actor,
-		"reason=" + reason,
-	}, "\n")
-	var abandoned bytes.Buffer
-	if err := RunReview([]string{
-		"abandon", "--cwd", repo, "--lineage", lineage, "--expected-revision", started.Record.Revision,
-		"--reason", reason, "--actor", actor, "--maintainer-authorization", authorization,
-	}, &abandoned); err != nil {
-		t.Fatalf("abandon did not free the stuck lineage: %v\n%s", err, abandoned.String())
+	// The reviewer recipe is plain read-only native Git against the frozen
+	// trees: compact discovery first, then a literal-pathspec selective diff.
+	discovery := runReviewCLIGitOutput(t, repo, "--no-pager", "diff", "--name-status", "--no-renames",
+		start.BaseTree, start.CandidateTree)
+	if strings.TrimSpace(discovery) != "A\tbig.txt" {
+		t.Fatalf("compact discovery = %q, want the single added path", discovery)
+	}
+	numstat := runReviewCLIGitOutput(t, repo, "--no-pager", "diff", "--numstat", "--no-renames",
+		start.BaseTree, start.CandidateTree)
+	if !strings.Contains(numstat, "big.txt") {
+		t.Fatalf("numstat discovery = %q, want big.txt", numstat)
+	}
+	selective := runReviewCLIGitOutput(t, repo, "--no-pager", "diff", "--no-ext-diff", "--no-textconv",
+		"--full-index", "--no-renames", "--diff-algorithm=myers",
+		start.BaseTree, start.CandidateTree, "--", ":(literal)big.txt")
+	if len(selective) <= 4<<20 || !strings.Contains(selective, "line 00000000 payload") ||
+		!strings.Contains(selective, "line 00109999 payload") {
+		t.Fatalf("selective native Git diff did not reconstruct the oversized candidate (%d bytes)", len(selective))
 	}
+}
 
-	var freed bytes.Buffer
-	if err := RunReview([]string{
-		"status", "--contract", ReviewIntegrationContractV1, "--cwd", repo, "--projection", "staged", "--next-transition",
-	}, &freed); err != nil {
-		t.Fatal(err)
-	}
-	var freedResult ReviewTargetStatusResult
-	if err := json.Unmarshal(freed.Bytes(), &freedResult); err != nil {
-		t.Fatal(err)
-	}
-	if freedResult.NextTransition == nil || freedResult.NextTransition.Kind != reviewNextTransitionExecute ||
-		freedResult.NextTransition.ReasonCode != "fresh_target_ready" {
-		t.Fatalf("STATUS after abandon = %#v", freedResult.NextTransition)
+func assertNoEagerCandidateDiff(t *testing.T, surface string, payload, fullDiff []byte) {
+	t.Helper()
+	if bytes.Contains(payload, []byte(`"candidate_diff"`)) || bytes.Contains(payload, fullDiff) ||
+		bytes.Contains(payload, []byte(base64.StdEncoding.EncodeToString(fullDiff))) {
+		t.Fatalf("%s eagerly contains the full candidate diff or its Base64 encoding", surface)
 	}
 }
diff --git a/internal/cli/review_status_contract.go b/internal/cli/review_status_contract.go
index 6626fbb2c..fd0de00fb 100644
--- a/internal/cli/review_status_contract.go
+++ b/internal/cli/review_status_contract.go
@@ -13,8 +13,10 @@ import (
 
 const ReviewIntegrationStatusSchemaV1 = "gentle-ai.review-integration.status/v1"
 const ReviewIntegrationStatusSchemaIDV1 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/status.schema.json"
-const ReviewIntegrationStatusSchema = "gentle-ai.review-integration.status/v2"
-const ReviewIntegrationStatusSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/status-v2.schema.json"
+const ReviewIntegrationStatusSchemaV2 = "gentle-ai.review-integration.status/v2"
+const ReviewIntegrationStatusSchemaIDV2 = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/status-v2.schema.json"
+const ReviewIntegrationStatusSchema = "gentle-ai.review-integration.status/v3"
+const ReviewIntegrationStatusSchemaID = "https://gentle-ai.dev/contracts/review-integration/v2/schemas/status.schema.json"
 const ReviewIntegrationProjectionSchema = "gentle-ai.review-integration.projection/v1"
 const ReviewIntegrationProjectionSchemaID = "https://gentle-ai.dev/contracts/review-integration/v1/schemas/projection.schema.json"
 
@@ -167,9 +169,13 @@ type ReviewTargetStatusProjection struct {
 	CurrentSnapshotIdentity string                       `json:"current_snapshot_identity"`
 }
 
-func newReviewTargetStatusResult(native reviewtransaction.TargetStatusResult) ReviewTargetStatusResult {
+func newReviewTargetStatusResultForContract(native reviewtransaction.TargetStatusResult, contract string) ReviewTargetStatusResult {
+	schema := ReviewIntegrationStatusSchema
+	if contract == ReviewIntegrationContractV1 {
+		schema = ReviewIntegrationStatusSchemaV2
+	}
 	result := ReviewTargetStatusResult{
-		Schema: ReviewIntegrationStatusSchema, Contract: ReviewIntegrationContractV1, Operation: "review.status",
+		Schema: schema, Contract: contract, Operation: "review.status",
 		Applicability: native.Applicability, Action: native.Action, ActionDisposition: native.ActionDisposition,
 		Replayability:  native.Replayability,
 		TargetIdentity: native.TargetIdentity,
@@ -306,7 +312,9 @@ func reviewStopEligibility(reason string, requiredInputs []string) *ReviewAction
 }
 
 func (result ReviewTargetStatusResult) Validate() error {
-	if result.Schema != ReviewIntegrationStatusSchema || result.Contract != ReviewIntegrationContractV1 || result.Operation != "review.status" {
+	legacyTransport := result.Schema == ReviewIntegrationStatusSchemaV2 && result.Contract == ReviewIntegrationContractV1
+	nativeGitTransport := result.Schema == ReviewIntegrationStatusSchema && result.Contract == ReviewIntegrationContractV2
+	if (!legacyTransport && !nativeGitTransport) || result.Operation != "review.status" {
 		return errors.New("invalid negotiated review status identity")
 	}
 	if !validReviewCapabilitySHA256(result.TargetIdentity) || result.Candidates == nil {
@@ -544,6 +552,10 @@ func (result ReviewTargetStatusResult) validateNextTransitionTargets() error {
 			!reflect.DeepEqual(manifestPathsForStatus(*input.ChangedPathManifest), result.Projection.Paths) {
 			return errors.New("negotiated status capture target differs from the frozen target identity")
 		}
+		if result.Contract == ReviewIntegrationContractV1 && (input.CandidateDiff == nil || input.BaseTree != "" || input.CandidateTree != "") ||
+			result.Contract == ReviewIntegrationContractV2 && (input.CandidateDiff != nil || input.BaseTree != result.Projection.BaseTree || input.CandidateTree != result.Projection.InitialReviewTree) {
+			return errors.New("negotiated status capture transport differs from its contract") // refusal:by-design world-action: provider-built STATUS mixed negotiated transports and requires a code fix
+		}
 	}
 	return nil
 }
@@ -792,10 +804,19 @@ func (transition ReviewNextTransition) Validate() error {
 			}
 			if input.CaptureOperation == "review.capture-result" {
 				order, orderErr := strconv.Atoi(arguments["order"])
-				if len(arguments) != 6 || !reviewStartSupportedLens(arguments["lens"]) || orderErr != nil || order < 0 ||
+				legacyTransport := input.ArtifactSubject != nil && input.ArtifactSubject.Schema == reviewtransaction.ArtifactSubjectSchemaV1
+				nativeGitTransport := input.ArtifactSubject != nil && input.ArtifactSubject.Schema == reviewtransaction.ArtifactSubjectSchema
+				argumentCount := 6
+				if nativeGitTransport {
+					argumentCount = 7
+				}
+				if len(arguments) != argumentCount || !reviewStartSupportedLens(arguments["lens"]) || orderErr != nil || order < 0 ||
 					!validReviewCapabilitySHA256(arguments["expected-revision"]) || !validReviewCapabilitySHA256(arguments["target"]) ||
 					strings.TrimSpace(arguments["lineage"]) == "" || reviewtransaction.ValidateReviewRepositoryContextHandle(arguments["repository-context"]) != nil ||
-					input.ArtifactSubject == nil || input.CandidateDiff == nil || input.ChangedPathManifest == nil {
+					input.ArtifactSubject == nil || input.ChangedPathManifest == nil ||
+					nativeGitTransport && arguments["subject-hash"] != input.ArtifactSubject.SubjectHash ||
+					legacyTransport && input.CandidateDiff == nil || nativeGitTransport && (!validReviewGitTree(input.BaseTree) || !validReviewGitTree(input.CandidateTree)) ||
+					(!legacyTransport && !nativeGitTransport) {
 					return errors.New("review capture transition lacks an exact repository and authority binding")
 				}
 				subject := input.ArtifactSubject
@@ -803,13 +824,19 @@ func (transition ReviewNextTransition) Validate() error {
 				if reviewtransaction.ValidateArtifactSubject(*subject) != nil || manifestErr != nil ||
 					subject.LineageID != arguments["lineage"] || subject.AuthorityRevision != arguments["expected-revision"] ||
 					subject.TargetIdentity != arguments["target"] || subject.Lens != arguments["lens"] || subject.SelectedOrder != order ||
-					subject.CandidateDiffSHA256 != input.CandidateDiff.SHA256 || subject.ChangedPathManifestSHA256 != manifestDigest {
+					subject.ChangedPathManifestSHA256 != manifestDigest ||
+					legacyTransport && subject.CandidateDiffSHA256 != input.CandidateDiff.SHA256 ||
+					nativeGitTransport && (subject.BaseTree != input.BaseTree || subject.CandidateTree != input.CandidateTree) {
 					return errors.New("review capture transition frozen subject or candidate context is invalid")
 				}
-				if _, err := input.CandidateDiff.Bytes(); err != nil {
-					return errors.New("review capture transition candidate diff is invalid")
+				if legacyTransport {
+					if _, diffErr := input.CandidateDiff.Bytes(); diffErr != nil || input.BaseTree != "" || input.CandidateTree != "" {
+						return errors.New("review capture transition legacy candidate diff is invalid") // refusal:by-design world-action: provider-built v1 transition contains invalid immutable transport and requires a code fix
+					}
+				} else if input.CandidateDiff != nil {
+					return errors.New("review capture transition native Git context contains a legacy candidate diff") // refusal:by-design world-action: provider-built v2 transition leaked legacy transport and requires a code fix
 				}
-			} else if input.ArtifactSubject != nil || input.CandidateDiff != nil || input.ChangedPathManifest != nil {
+			} else if input.ArtifactSubject != nil || input.CandidateDiff != nil || input.BaseTree != "" || input.CandidateTree != "" || input.ChangedPathManifest != nil {
 				return errors.New("non-reviewer collection transition contains frozen reviewer context")
 			}
 			if input.CaptureOperation == "review.capture-evidence" &&
diff --git a/internal/cli/review_status_contract_test.go b/internal/cli/review_status_contract_test.go
index 0cfdd23d2..8db204103 100644
--- a/internal/cli/review_status_contract_test.go
+++ b/internal/cli/review_status_contract_test.go
@@ -78,7 +78,7 @@ func TestNegotiatedReviewStatusReportsFreshStartAndPreservesGlobalStatus(t *test
 	if err := status.Validate(); err != nil {
 		t.Fatal(err)
 	}
-	if status.Schema != ReviewIntegrationStatusSchema || status.Contract != ReviewIntegrationContractV1 || status.Operation != "review.status" ||
+	if status.Schema != ReviewIntegrationStatusSchemaV2 || status.Contract != ReviewIntegrationContractV1 || status.Operation != "review.status" ||
 		status.Applicability != reviewtransaction.TargetApplicabilityCurrent || status.Authority == nil ||
 		status.Authority.State != reviewtransaction.StateReviewing || status.Authority.LineageID != started.LineageID ||
 		status.Receipt.Status != ReviewReceiptExpectedMissing || status.Receipt.Identity != "" ||
@@ -156,7 +156,7 @@ func transitionArgumentValue(t *testing.T, transition *ReviewNextTransition, nam
 func TestNegotiatedReviewStatusContractAndSchemasAreStrict(t *testing.T) {
 	repo := initReviewCLIRepo(t)
 	var output bytes.Buffer
-	err := RunReview([]string{"status", "--contract", "gentle-ai.review-integration/v2", "--cwd", repo}, &output)
+	err := RunReview([]string{"status", "--contract", "gentle-ai.review-integration/v3", "--cwd", repo}, &output)
 	if err == nil {
 		t.Fatalf("unsupported status contract = %q, %v", output.String(), err)
 	}
@@ -168,7 +168,7 @@ func TestNegotiatedReviewStatusContractAndSchemasAreStrict(t *testing.T) {
 		name string
 		id   string
 	}{
-		{name: "status-v2.schema.json", id: ReviewIntegrationStatusSchemaID},
+		{name: "status-v2.schema.json", id: ReviewIntegrationStatusSchemaIDV2},
 		{name: "authority-repair-assessment.schema.json", id: reviewtransaction.AuthorityRepairAssessmentSchemaID},
 		{name: "projection.schema.json", id: ReviewIntegrationProjectionSchemaID},
 		{name: "targeted-validation-request.schema.json", id: reviewtransaction.TargetedValidationRequestSchemaID},
@@ -337,7 +337,7 @@ func TestReviewActionEligibilityStopsWithoutCompleteExecutionInputs(t *testing.T
 			Revision: "sha256:" + strings.Repeat("a", 64), OriginalChangedLines: 2, Tier: reviewtransaction.RiskMedium, CorrectionBudget: 1,
 			Action: action, Replayability: replayability,
 		}
-		status := newReviewTargetStatusResult(native)
+		status := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 		status.Projection = publishedStatusFixtureProjection(t)
 		status.TargetIdentity = status.Projection.CurrentSnapshotIdentity
 		status.Eligibility = newReviewActionEligibility(status)
@@ -383,21 +383,36 @@ func TestReviewActionEligibilityStopsWithoutCompleteExecutionInputs(t *testing.T
 }
 
 func TestNegotiatedReviewFinalizeEligibilityRequiresTargetScopedStatus(t *testing.T) {
-	for _, state := range []reviewtransaction.State{
-		reviewtransaction.StateReviewing,
-		reviewtransaction.StateCorrectionRequired,
-		reviewtransaction.StateValidating,
-		reviewtransaction.StateApproved,
+	for _, contract := range []struct {
+		name   string
+		value  string
+		schema string
+	}{
+		{name: "v1", value: ReviewIntegrationContractV1, schema: ReviewIntegrationOperationSchema},
+		{name: "v2", value: ReviewIntegrationContractV2, schema: ReviewIntegrationOperationSchemaV2},
 	} {
-		t.Run(string(state), func(t *testing.T) {
-			var output bytes.Buffer
-			if err := encodeCompactFacadeFinalize(&output, true, true, false, reviewtransaction.CompactState{LineageID: "review-finalize-eligibility", State: state}, "sha256:"+strings.Repeat("a", 64), reviewtransaction.CompactStore{}, "finalize"); err != nil {
-				t.Fatal(err)
-			}
-			var result ReviewIntegrationFinalizeResult
-			decodeStrictReviewJSON(t, decodeReviewOperationEnvelope(t, output.Bytes()).Result, &result)
-			if result.Eligibility == nil || result.Eligibility.ValidateFinalize() != nil {
-				t.Fatalf("finalize eligibility = %#v", result.Eligibility)
+		t.Run(contract.name, func(t *testing.T) {
+			for _, state := range []reviewtransaction.State{
+				reviewtransaction.StateReviewing,
+				reviewtransaction.StateCorrectionRequired,
+				reviewtransaction.StateValidating,
+				reviewtransaction.StateApproved,
+			} {
+				t.Run(string(state), func(t *testing.T) {
+					var output bytes.Buffer
+					if err := encodeCompactFacadeFinalize(&output, true, contract.value, true, false, reviewtransaction.CompactState{LineageID: "review-finalize-eligibility", State: state}, "sha256:"+strings.Repeat("a", 64), reviewtransaction.CompactStore{}, "finalize"); err != nil {
+						t.Fatal(err)
+					}
+					envelope := decodeReviewOperationEnvelope(t, output.Bytes())
+					if envelope.Contract != contract.value || envelope.Schema != contract.schema {
+						t.Fatalf("finalize operation identity = %q, %q; want %q, %q", envelope.Contract, envelope.Schema, contract.value, contract.schema)
+					}
+					var result ReviewIntegrationFinalizeResult
+					decodeStrictReviewJSON(t, envelope.Result, &result)
+					if result.Eligibility == nil || result.Eligibility.ValidateFinalize() != nil {
+						t.Fatalf("finalize eligibility = %#v", result.Eligibility)
+					}
+				})
 			}
 		})
 	}
@@ -602,7 +617,7 @@ func TestNegotiatedStatusPreservesManualRecoveryAuthorityContext(t *testing.T) {
 		Action: reviewtransaction.TargetStatusActionRecover, ActionDisposition: reviewtransaction.RecoveryEscalated,
 		Replayability: reviewtransaction.ReplayabilityManualActionRequired,
 	}
-	got := newReviewTargetStatusResult(native)
+	got := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 	if got.Action != reviewtransaction.TargetStatusActionRecover || got.Replayability != reviewtransaction.ReplayabilityManualActionRequired ||
 		got.ActionDisposition != reviewtransaction.RecoveryEscalated ||
 		got.Authority == nil || got.Authority.LineageID != native.LineageID || got.Authority.Revision != native.Revision {
@@ -622,7 +637,7 @@ func TestNegotiatedStatusBindsRecoveryDispositionToRecoverAction(t *testing.T) {
 			Action: reviewtransaction.TargetStatusActionRecover, ActionDisposition: reviewtransaction.RecoveryScopeChanged,
 			Replayability: reviewtransaction.ReplayabilityManualActionRequired,
 		}
-		result := newReviewTargetStatusResult(native)
+		result := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 		result.Projection = publishedStatusFixtureProjection(t)
 		result.TargetIdentity = result.Projection.CurrentSnapshotIdentity
 		result.Eligibility = newReviewActionEligibility(result)
@@ -673,7 +688,7 @@ func TestReviewActionEligibilityFailsClosedForEscalatedAuthority(t *testing.T) {
 			Revision: "sha256:" + strings.Repeat("a", 64), OriginalChangedLines: 2, Tier: reviewtransaction.RiskMedium, CorrectionBudget: 1,
 			Action: action, ActionDisposition: disposition, Replayability: replayability,
 		}
-		status := newReviewTargetStatusResult(native)
+		status := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 		status.Projection = publishedStatusFixtureProjection(t)
 		status.TargetIdentity = status.Projection.CurrentSnapshotIdentity
 		status.Eligibility = newReviewActionEligibility(status)
@@ -744,7 +759,7 @@ func TestNegotiatedStatusOffersRecoveryForAccountingOnlyEscalatedUnchangedTarget
 		Action: reviewtransaction.TargetStatusActionRecover, ActionDisposition: reviewtransaction.RecoveryEscalated,
 		Replayability: reviewtransaction.ReplayabilityManualActionRequired,
 	}
-	status := newReviewTargetStatusResult(native)
+	status := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 	status.Projection = publishedStatusFixtureProjection(t)
 	status.TargetIdentity = status.Projection.CurrentSnapshotIdentity
 	status.Eligibility = newReviewActionEligibility(status)
@@ -793,12 +808,12 @@ func TestNegotiatedLegacyReceiptStatusNeverUsesCompactPublicationPending(t *test
 		State:            reviewtransaction.StateApproved,
 		ReceiptIdentity:  "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
 	}
-	present := newReviewTargetStatusResult(native)
+	present := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 	if present.Receipt.Status != ReviewReceiptPresent || present.Receipt.Identity != native.ReceiptIdentity {
 		t.Fatalf("approved legacy receipt = %#v", present.Receipt)
 	}
 	native.ReceiptIdentity = ""
-	missing := newReviewTargetStatusResult(native)
+	missing := newReviewTargetStatusResultForContract(native, ReviewIntegrationContractV2)
 	if missing.Receipt.Status == ReviewReceiptPublicationPending || missing.Receipt.Identity != "" {
 		t.Fatalf("legacy receipt inherited compact publication semantics: %#v", missing.Receipt)
 	}
diff --git a/internal/cli/sync_test.go b/internal/cli/sync_test.go
index 190ddb174..66cd4b72c 100644
--- a/internal/cli/sync_test.go
+++ b/internal/cli/sync_test.go
@@ -2706,7 +2706,7 @@ func TestRunSyncWithSelection_WritesExpectedFiles(t *testing.T) {
 		"orchestrator": settings.Agent["gentle-orchestrator"].Prompt,
 		"post-apply":   string(applyPayload),
 	} {
-		if !strings.Contains(content, "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition") {
+		if !strings.Contains(content, "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition") {
 			t.Errorf("synced OpenCode %s controller does not use negotiated STATUS routing", name)
 		}
 		for _, stale := range []string{
diff --git a/internal/components/sdd/bounded_review_contract_test.go b/internal/components/sdd/bounded_review_contract_test.go
index fc717f3bb..f76f086c5 100644
--- a/internal/components/sdd/bounded_review_contract_test.go
+++ b/internal/components/sdd/bounded_review_contract_test.go
@@ -12,32 +12,40 @@ import (
 
 var boundedReviewRequiredClauses = []string{
 	"Parent orchestrator and native CLI only",
-	"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition",
+	"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition",
 	"route only from the returned `next_transition`",
 	"exact operation and ordered argument tokens unchanged",
 	"exact `review.capture-result` collection input once in the foreground",
 	"exact literal prefix `GENTLE_AI_REVIEW_BINDING `",
 	"including the trailing space and never `=`",
-	"prefix and JSON are the first bytes of the prompt",
-	"one-line bound JSON assembled only from that input's arguments and `artifact_subject`",
+	"These are the prompt's first bytes",
+	"one-line JSON assembled only from that input",
 	"`revision` from `expected-revision`",
 	"`subject_hash` from `artifact_subject.subject_hash`",
-	"gentle-ai review capture-result",
-	"repeated `--result-artifact-file <path>` arguments",
+	"Capture follows the native transition",
+	"via repeated `--result-artifact-file <path>`",
 	"BOM-less UTF-8 on Windows PowerShell 5.1",
-	"POSIX inline `--result-artifact '<manifest-json>'` form remains compatible",
-	"Native Go validates, canonicalizes, persists, hashes, reopens, and binds results",
-	"Only `introduced`, `behavior-activated`, or `worsened`",
-	"Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates",
+	"POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible",
+	"Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding",
+	"Only candidate-caused severe findings block",
+	"pre-existing/base-only become follow-ups, unknown escalates",
 	"canonical four-lens selection is long work",
 	"one cost/side-effect forecast",
 	"four reviewer model runs",
-	"typed `gentle-ai.review-integration.consent/v1` envelope",
+	"typed `gentle-ai.review-integration.consent/v2` envelope",
 	"Lossless Blocking Prompt",
 	"not the kill switch",
 	"one correction transaction",
 	"positive forecast before editing",
 	"one read-only scoped fix validator",
+	// The fix validator's capability is named because leaving it unnamed cost a
+	// real correction attempt: an orchestrator routed targeted validation to the
+	// refuter, which has no shell by design, and its inconclusive answer was
+	// submitted as a failed check that escalated the lineage irreversibly.
+	"must hold read-only Git execution against the immutable trees",
+	"never route it to the refuter or any other actor that cannot run Git",
+	"produced no verdict",
+	"surface one blocked human decision and submit nothing",
 	"one independent requirements/runtime verification",
 	"### Authority-First Terminal Procedure",
 	"query STATUS again",
@@ -50,14 +58,21 @@ var boundedReviewRequiredClauses = []string{
 func TestBoundedReviewContractRequiresProviderOwnedReviewerContext(t *testing.T) {
 	content := boundedReviewContract()
 	for _, want := range []string{
-		"Never hand a reviewer input through `/tmp`",
+		"Never hand candidate bytes through `/tmp`",
 		"another external file",
 		"a repository scratch file",
-		"or any path reference",
-		"Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`",
-		"rely on native/plugin injection",
-		"only after native preflight succeeds",
-		"stop without launching the reviewer",
+		"`GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`",
+		"OpenCode preflights the opaque binding, discards the caller-authored task body",
+		"injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest",
+		"broad deny precedes narrow allows",
+		"Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete",
+		"read-only native Git commands against those exact immutable trees",
+		"compact `--name-status`/`--numstat` discovery",
+		"replacement objects, external diff and textconv, forces `--text`",
+		"literal pathspecs",
+		"Never pass `--binary`",
+		"Never add `candidate_diff`",
+		"read live worktree/index/HEAD",
 	} {
 		if !strings.Contains(content, want) {
 			t.Errorf("orchestrator contract missing reviewer context rule %q", want)
@@ -76,7 +91,7 @@ func TestGeneratedOpenCodeReviewControllersUseNegotiatedStatusRouting(t *testing
 	for name, content := range controllers {
 		t.Run(name, func(t *testing.T) {
 			for _, required := range []string{
-				"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition",
+				"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition",
 				"route only from the returned `next_transition`",
 				"exact operation and ordered argument tokens unchanged",
 				"`execute`", "`collect`", "`stop`",
@@ -194,7 +209,7 @@ func TestRenderedReviewersAreReadOnlyAndSingleResult(t *testing.T) {
 			path := family + "/agents/review-" + lens + ".md"
 			t.Run(family+"/"+lens, func(t *testing.T) {
 				content := renderBoundedReviewAsset(path)
-				for _, want := range []string{"read-only reviewer", "immutable candidate diff once", "## Candidate-Causal Admission", "Return one JSON object and no prose", `"subject_hash":"<artifact_subject.subject_hash>"`, `"inspection":{"status":"completed","paths":["<every changed_path_manifest.path in exact order>"]}`, "Never emit summary, skill_resolution, or any other unknown field", "evidence contains only genuine inspection evidence"} {
+				for _, want := range []string{"Review once", "GENTLE_AI_REVIEW_CONTEXT", "sole source of artifact_subject", "changed_path_manifest", "base_tree", "candidate_tree", "env -i", "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null", "GIT_ATTR_NOSYSTEM=1", "--no-replace-objects", "diff --name-status --text --no-ext-diff --no-textconv --no-renames", "diff --numstat --text --no-ext-diff --no-textconv --no-renames", "diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3", "cat-file -p '<tree>:<path>'", ":(literal)<path>", "never pass --binary", "attributes must never suppress a hunk", "incomplete inspection", "Never read the live worktree", "## Candidate-Causal Admission", "Return one JSON object and no prose", `"subject_hash":"<artifact_subject.subject_hash>"`, "GENTLE_AI_REVIEW_BINDING.subject_hash", `"inspection":{"status":"completed","paths":["<every changed_path_manifest.path in exact order>"]}`, "lens triage", "Emit no unknown fields"} {
 					if !strings.Contains(content, want) {
 						t.Errorf("%s missing %q", path, want)
 					}
@@ -246,7 +261,7 @@ func TestBoundedReviewContractListsOnlySupportedLifecycleGates(t *testing.T) {
 func TestAuthorityFirstTerminalProcedureIsStructuredAndMirrorEligibilityIsClosed(t *testing.T) {
 	rows := parseAuthorityFirstRows(t, authorityFirstTerminalProcedure())
 	wantOperations := []string{
-		"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition",
+		"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition",
 		"provider-returned transition", "repeat 01–02", "reconcile-terminal-mirrors",
 	}
 	if len(rows) != len(wantOperations) {
@@ -290,7 +305,7 @@ func TestOpenCodeAndClaudeApplyCommandsRequireAuthorityBeforeMirrors(t *testing.
 			if strings.Contains(content, authorityFirstProcedurePlaceholder) || strings.Count(content, authorityFirstTerminalProcedure()) != 1 {
 				t.Fatalf("%s did not render the centralized terminal procedure", path)
 			}
-			if !strings.Contains(content, "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition") {
+			if !strings.Contains(content, "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition") {
 				t.Fatalf("%s does not begin negotiated review routing with STATUS", path)
 			}
 			if strings.Contains(content, "runs `gentle-ai review start --cwd <repo>`") {
diff --git a/internal/components/sdd/boundedreview.go b/internal/components/sdd/boundedreview.go
index e49eef9c1..33d92164e 100644
--- a/internal/components/sdd/boundedreview.go
+++ b/internal/components/sdd/boundedreview.go
@@ -20,6 +20,16 @@ const reviewerBindingEnvironmentVariable = "GENTLE_AI_REVIEW_BINDING"
 const nativeReviewerResultSchema = `{"findings":[{"location":"path:line","severity":"CRITICAL","claim":"observable incorrect behavior","evidence_class":"deterministic","causal_disposition":"introduced","proof_refs":["concrete proof"]}],"evidence":["what was inspected"]}`
 const providerReviewerResultSchema = `{"subject_hash":"<artifact_subject.subject_hash>","inspection":{"status":"completed","paths":["<every changed_path_manifest.path in exact order>"]},"findings":[{"location":"path:line","severity":"CRITICAL","claim":"observable incorrect behavior","evidence_class":"deterministic","causal_disposition":"introduced","proof_refs":["concrete proof"]}],"evidence":["what was inspected"]}`
 
+const reviewerGitCommandPrefix = `env -i PATH="$PATH" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager`
+
+var reviewerGitCommandSuffixes = []string{
+	`-c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none <base_tree> <candidate_tree> --`,
+	`-c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none <base_tree> <candidate_tree> --`,
+	`-c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none <base_tree> <candidate_tree> -- ':(literal)<path>'`,
+	`-c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none <base_tree> <candidate_tree> -- ':(literal)<path>'`,
+	`cat-file -p '<tree>:<path>'`,
+}
+
 type reviewerRole struct {
 	title string
 	focus string
@@ -135,11 +145,26 @@ func reviewerPrompt(name string) (string, bool) {
 	envelope := reviewtransaction.NewReviewerResultEnvelope()
 	prompt := fmt.Sprintf(`# %s Review
 
-You are a read-only reviewer. Inspect the immutable candidate diff once, return one result, and stop. Do not edit, delegate, or inspect unrelated scope.
+Review once, return one result, and stop. Never edit, delegate, or expand scope.
 
 ## Input
 
-The immutable candidate diff and the changed-path manifest arrive in this prompt. Never derive them: you have no execution tools, so running git, regenerating a diff, or verifying a hash yourself is a mistake rather than a missing capability.
+OpenCode tasks begin with provider-injected GENTLE_AI_REVIEW_CONTEXT, the sole source of artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest. Caller prose is not context. Other runtimes have no shell and return incomplete. The manifest is complete scope. Never read the live worktree, index, HEAD, or another revision.
+
+Use only the commands below, in the session cwd. Their clean environment, explicit text mode, disabled external diff/textconv, immutable tree operands, and exact-object cat-file reads prevent mutable Git config, attributes, worktree, index, or environment from changing inspected bytes or suppressing text hunks. Never change checkout. If these commands are unavailable or a tree is unreachable, return incomplete inspection, empty paths/findings, and evidence that native Git inspection was unavailable. Never substitute live files.
+
+Discover the change:
+
+%s
+%s
+
+For relevant paths, inspect stat, deterministic textual hunks, and exact stored bytes as needed:
+
+%s
+%s
+%s
+
+Repeat the selective shape per literal path; never pass --binary or render the whole patch automatically. --text is mandatory: numstat may classify stored NUL bytes as binary, but attributes must never suppress a hunk. Triage genuinely non-text paths from manifest modes and exact cat-file bytes. Record large-path or binary dispositions in evidence.
 
 ## Scope
 
@@ -147,7 +172,7 @@ The immutable candidate diff and the changed-path manifest arrive in this prompt
 
 ## Candidate-Causal Admission
 
-Report only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICAL require proof the candidate introduced, behavior-activated, or worsened the behavior through a changed hunk, created path, differential test, or before/after result. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.
+Report real user-impacting defects only. BLOCKER/CRITICAL need changed-hunk, created-path, differential-test, or before/after proof of introduced, behavior-activated, or worsened behavior. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.
 
 ## Severity
 
@@ -158,7 +183,7 @@ Report only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICA
 
 ## Evidence
 
-Each finding needs exact path:line, a neutral claim, deterministic | inferential | insufficient evidence class, causal disposition, and concrete proof. Never invent evidence or use placeholders.
+Each finding needs path:line, neutral claim, evidence class, causal disposition, and concrete proof. Never invent evidence or placeholders.
 
 ## Output
 
@@ -166,19 +191,38 @@ Return one JSON object and no prose. Use exactly this native result shape:
 
 %s
 
-subject_hash is not yours to compute: copy it verbatim from the %s object your task carries, field artifact_subject.subject_hash. Never invent, recompute, or omit it — a result that does not echo the binding is refused, not repaired. Without a binding, stop and say so.
+Copy subject_hash from %s.subject_hash; never compute or invent it. Missing or different bindings are refused.
 
-Inspection is complete only when status is %q and paths lists every changed_path_manifest path in exact order — the only status this shape defines. If you cannot read what you were handed, say so in your reply and stop rather than inventing another one.
+Status %q requires every manifest path in exact order. Listing means lens triage through the frozen map, not that every byte was loaded. Otherwise return incomplete and stop.
 
-The required top-level fields are %s; a result missing any of them is refused. Finding fields are location, severity, claim, evidence_class, causal_disposition, and proof_refs. Never emit summary, skill_resolution, or any other unknown field. Keep orchestration metadata outside the native result JSON; evidence contains only genuine inspection evidence.
+Required top-level fields: %s. Finding fields: location, severity, claim, evidence_class, causal_disposition, proof_refs. Emit no unknown fields or orchestration metadata.
 
-When clean, return the same subject_hash and completed inspection with "findings":[] and one evidence entry.`,
-		role.title, role.focus, providerReviewerResultSchema,
+When clean, return the bound subject, completed inspection, "findings":[], and one evidence entry.`,
+		role.title,
+		reviewerGitCommandPrefix+" "+reviewerGitCommandSuffixes[0],
+		reviewerGitCommandPrefix+" "+reviewerGitCommandSuffixes[1],
+		reviewerGitCommandPrefix+" "+reviewerGitCommandSuffixes[2],
+		reviewerGitCommandPrefix+" "+reviewerGitCommandSuffixes[3],
+		reviewerGitCommandPrefix+" "+reviewerGitCommandSuffixes[4],
+		role.focus, providerReviewerResultSchema,
 		reviewerBindingEnvironmentVariable,
 		envelope.CompletedInspectionStatus, strings.Join(envelope.RequiredTopLevelFields, ", "))
 	return prompt, true
 }
 
+func openCodeReviewerPermission() map[string]any {
+	bash := map[string]any{"*": "deny"}
+	for _, suffix := range reviewerGitCommandSuffixes {
+		pattern := reviewerGitCommandPrefix + " " + suffix
+		pattern = strings.ReplaceAll(pattern, "<base_tree>", "*")
+		pattern = strings.ReplaceAll(pattern, "<candidate_tree>", "*")
+		pattern = strings.ReplaceAll(pattern, "<tree>", "*")
+		pattern = strings.ReplaceAll(pattern, "<path>", "*")
+		bash[pattern] = "allow"
+	}
+	return map[string]any{"edit": "deny", "bash": bash}
+}
+
 func judgmentDayReviewerContract() string {
 	return fmt.Sprintf(`You are a read-only adversarial reviewer. Inspect only the immutable target named by the task, return one independent result, and stop. Do not edit, delegate, or inspect unrelated scope.
 
diff --git a/internal/components/sdd/inject.go b/internal/components/sdd/inject.go
index 8b16633ff..df99cca07 100644
--- a/internal/components/sdd/inject.go
+++ b/internal/components/sdd/inject.go
@@ -943,7 +943,8 @@ func expandOpenCodeBoundedReviewAgents(agentsMap map[string]any) {
 		}
 		prompt, _ := reviewerPrompt(name)
 		agent["prompt"] = prompt
-		agent["tools"] = map[string]any{"*": false, "read": true, "write": false, "edit": false, "bash": false, "task": false}
+		agent["tools"] = map[string]any{"*": false, "read": true, "write": false, "edit": false, "bash": true, "task": false}
+		agent["permission"] = openCodeReviewerPermission()
 	}
 
 	for _, name := range []string{"jd-judge-a", "jd-judge-b"} {
diff --git a/internal/components/sdd/prompts_test.go b/internal/components/sdd/prompts_test.go
index 303b2d7e6..f7c073341 100644
--- a/internal/components/sdd/prompts_test.go
+++ b/internal/components/sdd/prompts_test.go
@@ -151,8 +151,7 @@ func sddReviewSubAgentsForCodeGraphTest() []string {
 }
 
 func sddShellDisabledSubAgentsForCodeGraphTest() []string {
-	agents := []string{"jd-judge-a", "jd-judge-b"}
-	return append(agents, sddReviewSubAgentsForCodeGraphTest()...)
+	return []string{"jd-judge-a", "jd-judge-b", "review-refuter"}
 }
 
 func assertOpenCodeSubAgentReadOnlyTools(t *testing.T, agentsMap map[string]any, agentName string) {
diff --git a/internal/components/sdd/review_ledger_contract_test.go b/internal/components/sdd/review_ledger_contract_test.go
index a3bb84ce4..b87a558c1 100644
--- a/internal/components/sdd/review_ledger_contract_test.go
+++ b/internal/components/sdd/review_ledger_contract_test.go
@@ -20,10 +20,11 @@ const requiredOrchestratorMergeModeClause = "Parent orchestrator and native CLI
 func TestBoundedReviewContractLeavesCanonicalizationToNativeGo(t *testing.T) {
 	content := boundedReviewContract()
 	for _, want := range []string{
-		"Native Go validates, canonicalizes, persists, hashes, reopens, and binds results",
-		"models never construct canonical bytes or hashes",
-		"Freeze merged findings",
-		"plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds",
+		"Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding",
+		"Only candidate-caused severe findings block",
+		"OpenCode preflights the opaque binding",
+		"injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest",
+		"read-only native Git commands",
 	} {
 		if !strings.Contains(content, want) {
 			t.Errorf("orchestrator contract missing %q", want)
@@ -61,7 +62,10 @@ func TestDedicatedReviewAndJudgmentAssetsRenderRoleContracts(t *testing.T) {
 		for _, path := range paths {
 			t.Run(family+"/"+path, func(t *testing.T) {
 				content := renderBoundedReviewAsset(path)
-				assertTextContainsClauses(t, path, content, []string{"read-only", "candidate", "BLOCKER", "CRITICAL", "causal", "proof"})
+				assertTextContainsClauses(t, path, content, []string{"candidate", "BLOCKER", "CRITICAL", "causal", "proof"})
+				if !strings.Contains(content, "read-only") && !strings.Contains(content, "Never edit") {
+					t.Errorf("%s does not state its non-mutating role", path)
+				}
 				assertNoReviewerLifecycleInstructions(t, path, content)
 			})
 		}
@@ -72,20 +76,29 @@ func TestDedicatedReviewersAndRefutersAreStructurallyReadOnly(t *testing.T) {
 	for _, path := range []string{
 		"claude/agents/review-risk.md", "claude/agents/review-readability.md",
 		"claude/agents/review-reliability.md", "claude/agents/review-resilience.md",
-		"claude/agents/review-refuter.md",
 	} {
 		frontmatter := markdownFrontmatter(t, path)
-		for _, forbidden := range []string{"Bash", "Write", "Edit"} {
+		if strings.Contains(frontmatter, "Bash") {
+			t.Errorf("%s grants unrestricted Bash without a per-command policy", path)
+		}
+		for _, forbidden := range []string{"Write", "Edit"} {
 			if strings.Contains(frontmatter, forbidden) {
 				t.Errorf("%s frontmatter grants %s", path, forbidden)
 			}
 		}
 	}
+	if frontmatter := markdownFrontmatter(t, "claude/agents/review-refuter.md"); strings.Contains(frontmatter, "Bash") || strings.Contains(frontmatter, "Write") || strings.Contains(frontmatter, "Edit") {
+		t.Errorf("Claude refuter grants an execution or mutation tool: %s", frontmatter)
+	}
 	for _, path := range []string{
 		"kiro/agents/review-risk.md", "kiro/agents/review-readability.md",
 		"kiro/agents/review-reliability.md", "kiro/agents/review-resilience.md",
-		"kiro/agents/review-refuter.md", "kiro/agents/jd-judge-a.md", "kiro/agents/jd-judge-b.md",
 	} {
+		if frontmatter := markdownFrontmatter(t, path); !strings.Contains(frontmatter, `tools: ["read"]`) || strings.Contains(frontmatter, "shell") {
+			t.Errorf("%s does not fail closed without a narrow shell policy:\n%s", path, frontmatter)
+		}
+	}
+	for _, path := range []string{"kiro/agents/review-refuter.md", "kiro/agents/jd-judge-a.md", "kiro/agents/jd-judge-b.md"} {
 		if frontmatter := markdownFrontmatter(t, path); !strings.Contains(frontmatter, `tools: ["read"]`) {
 			t.Errorf("%s is not read-only:\n%s", path, frontmatter)
 		}
@@ -108,7 +121,6 @@ func TestDedicatedReviewersAndRefutersAreStructurallyReadOnly(t *testing.T) {
 	for _, path := range []string{
 		"kimi/agents/review-risk.yaml", "kimi/agents/review-readability.yaml",
 		"kimi/agents/review-reliability.yaml", "kimi/agents/review-resilience.yaml",
-		"kimi/agents/review-refuter.yaml",
 	} {
 		content := assets.MustRead(path)
 		for _, excluded := range []string{"multiagent:Task", "shell:Shell", "file:WriteFile", "file:StrReplaceFile"} {
@@ -117,6 +129,12 @@ func TestDedicatedReviewersAndRefutersAreStructurallyReadOnly(t *testing.T) {
 			}
 		}
 	}
+	refuter := assets.MustRead("kimi/agents/review-refuter.yaml")
+	for _, excluded := range []string{"multiagent:Task", "shell:Shell", "file:WriteFile", "file:StrReplaceFile"} {
+		if !strings.Contains(refuter, excluded) {
+			t.Errorf("Kimi refuter does not exclude %s", excluded)
+		}
+	}
 }
 
 func TestOpenCodeOverlaysRenderBoundedReadOnlyReviewRoles(t *testing.T) {
@@ -133,7 +151,8 @@ func TestOpenCodeOverlaysRenderBoundedReadOnlyReviewRoles(t *testing.T) {
 				prompt := agent["prompt"].(string)
 				assertTextContainsClauses(t, path+" "+name, prompt, []string{"## Scope", "## Candidate-Causal Admission", "## Severity", "## Evidence", "## Output"})
 				assertNoReviewerLifecycleInstructions(t, path+" "+name, prompt)
-				assertOpenCodeReadOnlyTools(t, path+" "+name, agent["tools"].(map[string]any))
+				assertOpenCodeReadOnlyTools(t, path+" "+name, agent["tools"].(map[string]any), true)
+				assertOpenCodeReviewerPermission(t, path+" "+name, agent["permission"])
 			}
 			for _, name := range []string{"jd-judge-a", "jd-judge-b"} {
 				agent := agentsMap[name].(map[string]any)
@@ -142,7 +161,7 @@ func TestOpenCodeOverlaysRenderBoundedReadOnlyReviewRoles(t *testing.T) {
 					t.Errorf("%s %s does not use the native role-only judgment contract", path, name)
 				}
 				assertNoReviewerLifecycleInstructions(t, path+" "+name, prompt)
-				assertOpenCodeReadOnlyTools(t, path+" "+name, agent["tools"].(map[string]any))
+				assertOpenCodeReadOnlyTools(t, path+" "+name, agent["tools"].(map[string]any), false)
 			}
 			refuter := agentsMap[opencode.ReviewRefuterAgent].(map[string]any)
 			refuterPrompt := refuter["prompt"].(string)
@@ -150,11 +169,41 @@ func TestOpenCodeOverlaysRenderBoundedReadOnlyReviewRoles(t *testing.T) {
 				t.Errorf("%s refuter prompt is not bounded: %s", path, refuterPrompt)
 			}
 			assertNoReviewerLifecycleInstructions(t, path+" refuter", refuterPrompt)
-			assertOpenCodeReadOnlyTools(t, path+" refuter", refuter["tools"].(map[string]any))
+			assertOpenCodeReadOnlyTools(t, path+" refuter", refuter["tools"].(map[string]any), false)
 		})
 	}
 }
 
+func assertOpenCodeReviewerPermission(t *testing.T, label string, raw any) {
+	t.Helper()
+	permission, ok := raw.(map[string]any)
+	if !ok || permission["edit"] != "deny" {
+		t.Fatalf("%s permission = %#v, want edit deny", label, raw)
+	}
+	bash, ok := permission["bash"].(map[string]any)
+	if !ok || bash["*"] != "deny" || len(bash) != len(reviewerGitCommandSuffixes)+1 {
+		t.Fatalf("%s bash permission = %#v", label, permission["bash"])
+	}
+	for _, suffix := range reviewerGitCommandSuffixes {
+		pattern := reviewerGitCommandPrefix + " " + suffix
+		for _, replacement := range []string{"<base_tree>", "<candidate_tree>", "<tree>", "<path>"} {
+			pattern = strings.ReplaceAll(pattern, replacement, "*")
+		}
+		if bash[pattern] != "allow" {
+			t.Errorf("%s does not allow exact reviewer Git shape %q", label, pattern)
+		}
+	}
+	encoded, err := json.Marshal(permission)
+	if err != nil {
+		t.Fatal(err)
+	}
+	deny := strings.Index(string(encoded), `"*":"deny"`)
+	allow := strings.Index(string(encoded), `":"allow"`)
+	if deny < 0 || allow < 0 || deny > allow {
+		t.Fatalf("%s permission order does not put broad deny before narrow allows: %s", label, encoded)
+	}
+}
+
 func TestOpenCodeRenderedReviewProtocolCost(t *testing.T) {
 	home := t.TempDir()
 	if _, err := Inject(home, opencodeAdapter(), ""); err != nil {
@@ -193,7 +242,7 @@ func TestOpenCodeRenderedReviewProtocolCost(t *testing.T) {
 		// contract. Two field reports cost a review each because the prompt
 		// left both unsaid: one lens returned findings/evidence with no
 		// subject_hash and no inspection, and one reported inspection.status
-		// "access_failure" after trying to generate the candidate diff and
+		// "access_failure" after trying to inspect the candidate and
 		// verify its SHA-256 itself, which its declared read-only tools never
 		// permitted. The prompt now names GENTLE_AI_REVIEW_BINDING as the only
 		// source of subject_hash, forbids inventing it, says the diff and
@@ -224,6 +273,49 @@ func TestOpenCodeRenderedReviewProtocolCost(t *testing.T) {
 		// collect, and stop, and derives reviewer bindings from the exact
 		// collection input so resumed reviews never depend on a prior START reply.
 		//
+		// One authority-bound native reader replaces per-lens bare-repository setup
+		// and plumbing instructions (12,307 -> 11,597 / 25,954 -> 23,270). The
+		// command is runtime-independent and candidate bytes remain absent.
+		//
+		// Retiring `review read-diff` for direct read-only native Git against the
+		// frozen trees grew the recipe (11,597 -> 12,316 / 23,270 -> 25,873): the
+		// prompt now carries compact discovery plus selective literal-pathspec
+		// commands, environment hygiene, the no---binary rule, oversized-path
+		// triage, and the Git-unavailable incomplete result. Candidate bytes
+		// remain absent and prompt size still scales with path count, not patch
+		// size.
+		//
+		// Checkout independence grew both surfaces (12,316 -> 13,074 / 25,873 ->
+		// 27,981): reviewers now run the recipe in their session working
+		// directory because frozen trees resolve through the shared object
+		// store, orchestrators never send reviewers into another checkout, and
+		// a denied optional preparatory read no longer aborts inspection. This
+		// closes the cross-checkout regression where a main-repo session
+		// reviewing a worktree candidate denied every subagent tool call.
+		//
+		// The numstat-vs-manifest suspicion rule (13,074 -> 13,294 / 27,981 ->
+		// 28,861) came out of the first admitted resilience finding: a mutable
+		// Git attribute can reclassify changed text as binary and silently
+		// suppress its hunk, so a path numstat calls binary while its manifest
+		// entry is an ordinary text-mode modification must be named in
+		// evidence, never metadata-triaged in silence.
+		//
+		// Naming the fix validator's capability added 379 shared-contract
+		// characters to both rows (13,294 -> 13,673 / 28,861 -> 29,240). It cost
+		// a real correction attempt to learn: the contract said "run one
+		// read-only scoped fix validator" without naming who, an orchestrator
+		// routed targeted validation to the refuter (no shell, by design), and
+		// that inconclusive answer was submitted as a failed check, escalating
+		// the lineage irreversibly.
+		//
+		// The ceilings move with it (14,000 -> 15,700 / 29,500 -> 33,600) to
+		// restore the ~15% margin below. This is not slackening the guard: a
+		// ceiling left fixed while the pin legitimately grows converges on the
+		// pin and becomes the second copy the paragraph below forbids. Both new
+		// ceilings still fail loudly on the regression they exist for — one
+		// agent falling through to the un-rendered contract adds roughly 28,600
+		// (standard) or 19,400 (per agent, full-4R), far above either ceiling.
+		//
 		// maxCharacters is NOT a second copy of wantChars. wantChars catches
 		// every byte of change and must be updated by hand with a reason; the
 		// ceiling exists only to catch the rendering silently giving up on
@@ -233,8 +325,11 @@ func TestOpenCodeRenderedReviewProtocolCost(t *testing.T) {
 		// un-rendered protocol). The ceilings below sit ~15% above the pins so
 		// an ordinary wording fix never touches them, and 4-5x below the
 		// un-rendered sizes so a renderer regression still fails loudly.
-		{name: "standard", agents: []string{"review-reliability"}, beforeChars: 42_301, wantChars: 10_428, maxCharacters: 12_000},
-		{name: "full-4R", agents: []string{"review-risk", "review-resilience", "review-readability", "review-reliability"}, beforeChars: 106_998, wantChars: 19_632, maxCharacters: 22_600},
+		// Provider-bound preflight and the immutable Git recipe initially pushed
+		// the pins too close to those ceilings. Removing repeated prose restores
+		// more than 15% headroom without weakening either contract.
+		{name: "standard", agents: []string{"review-reliability"}, beforeChars: 42_301, wantChars: 13_536, maxCharacters: 15_700},
+		{name: "full-4R", agents: []string{"review-risk", "review-resilience", "review-readability", "review-reliability"}, beforeChars: 106_998, wantChars: 28_956, maxCharacters: 33_600},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -251,6 +346,9 @@ func TestOpenCodeRenderedReviewProtocolCost(t *testing.T) {
 			if chars > tt.maxCharacters {
 				t.Fatalf("rendered protocol cost = %d characters / %d estimated tokens, target <= %d / %d", chars, tokens, tt.maxCharacters, tt.maxCharacters/4)
 			}
+			if chars*115 > tt.maxCharacters*100 {
+				t.Fatalf("rendered protocol cost = %d characters leaves less than 15%% headroom below ceiling %d", chars, tt.maxCharacters)
+			}
 		})
 	}
 }
@@ -269,9 +367,9 @@ func markdownFrontmatter(t *testing.T, path string) string {
 	return parts[1]
 }
 
-func assertOpenCodeReadOnlyTools(t *testing.T, label string, tools map[string]any) {
+func assertOpenCodeReadOnlyTools(t *testing.T, label string, tools map[string]any, bash bool) {
 	t.Helper()
-	want := map[string]bool{"*": false, "read": true, "write": false, "edit": false, "bash": false, "task": false}
+	want := map[string]bool{"*": false, "read": true, "write": false, "edit": false, "bash": bash, "task": false}
 	if len(tools) != len(want) {
 		t.Fatalf("%s tools = %#v", label, tools)
 	}
@@ -322,5 +420,5 @@ func readGentleOrchestratorPrompt(t *testing.T, settingsPath string) string {
 
 func assertOpenCodeRefuterToolsReadOnly(t *testing.T, label string, tools map[string]any) {
 	t.Helper()
-	assertOpenCodeReadOnlyTools(t, label, tools)
+	assertOpenCodeReadOnlyTools(t, label, tools, false)
 }
diff --git a/internal/components/sdd/reviewer_envelope_guard_test.go b/internal/components/sdd/reviewer_envelope_guard_test.go
index b685441d8..6a5887ab6 100644
--- a/internal/components/sdd/reviewer_envelope_guard_test.go
+++ b/internal/components/sdd/reviewer_envelope_guard_test.go
@@ -199,41 +199,31 @@ func declaredLensTools(t *testing.T, path string) (tools []string, readOnlyAsser
 }
 
 // TestLensAgentPromptsStateWhereTheirInputComesFrom is the input-side twin of
-// the envelope guard. A reviewer that is not told the immutable candidate diff
-// and changed-path manifest arrive in its prompt invents an input contract:
-// one real run tried to generate the diff and verify its SHA-256 itself,
-// reported inspection.status "access_failure" when it could not, and blocked a
-// publication. Its declared tools never permitted execution in the first place.
+// the envelope guard. Every runtime receives the same immutable Git reference
+// contract and must never substitute mutable workspace files.
 func TestLensAgentPromptsStateWhereTheirInputComesFrom(t *testing.T) {
 	envelope := reviewtransaction.NewReviewerResultEnvelope()
 
-	// The orchestrator contract is the source for what it promises the provider
-	// will inject after native preflight.
+	// The orchestrator contract is the source for the one native-Git
+	// inspection recipe every managed runtime must give reviewers.
 	contract := assets.MustRead(boundedReviewContractAsset)
-	if !strings.Contains(contract, "plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds") {
-		t.Fatalf("%s no longer requires native injection of the diff and manifest; update the guard's derivation", boundedReviewContractAsset)
+	if !strings.Contains(contract, "injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest") ||
+		!strings.Contains(contract, "read-only native Git commands") {
+		t.Fatalf("%s no longer requires native-Git frozen-tree inspection; update the guard's derivation", boundedReviewContractAsset)
 	}
 
 	for _, paths := range lensAgentAssetPaths(t, envelope.LensAgentNames) {
 		for _, path := range paths {
-			tools, readOnlyAsserted := declaredLensTools(t, path)
-			for _, tool := range tools {
-				for _, execution := range executionToolVocabulary {
-					if strings.Contains(strings.ToLower(tool), execution) {
-						t.Errorf("%s declares the execution-capable tool %q; a lens prompt that tells the reviewer it cannot execute would now be lying", path, tool)
-					}
-				}
-			}
-			if len(tools) == 0 && !readOnlyAsserted {
-				continue
-			}
-
 			prompt := strings.ToLower(renderBoundedReviewAsset(path))
 			for claim, why := range map[string]string{
-				"candidate diff":        "does not say the immutable candidate diff arrives in the prompt",
-				"changed-path manifest": "does not say the changed-path manifest arrives in the prompt",
-				"never derive":          "does not forbid deriving its own input",
-				"no execution tools":    "does not state that it cannot execute anything",
+				"artifact_subject":      "does not name the bound artifact subject",
+				"changed_path_manifest": "does not name the ordered manifest",
+				"base_tree":             "does not name the immutable base tree",
+				"candidate_tree":        "does not name the immutable candidate tree",
+				":(literal)":            "does not require literal pathspec selection",
+				"--numstat":             "does not require compact numstat discovery",
+				"session cwd":           "does not run the recipe checkout-independently",
+				"never read the live":   "does not prohibit mutable workspace inspection",
 			} {
 				if !strings.Contains(prompt, claim) {
 					t.Errorf("%s %s (missing %q)", path, why, claim)
diff --git a/internal/reviewtransaction/artifact_admission.go b/internal/reviewtransaction/artifact_admission.go
index 6b7d2aa26..04bd86c15 100644
--- a/internal/reviewtransaction/artifact_admission.go
+++ b/internal/reviewtransaction/artifact_admission.go
@@ -145,8 +145,9 @@ func AdmitArtifact(request ArtifactAdmissionRequest) (LensResult, ArtifactAdmiss
 			"reviewer result echoed a different artifact subject: "+artifactRecaptureContinuation+
 				", which is "+request.ExpectedSubject.SubjectHash)
 	}
-	if _, err := request.FrozenContext.CandidateDiff.Bytes(); err != nil || request.FrozenContext.CandidateDiff.SHA256 != request.ExpectedSubject.CandidateDiffSHA256 {
-		return fail(ArtifactAdmissionBindingMismatch, "frozen candidate diff does not match the artifact subject")
+	if request.FrozenContext.BaseTree != request.ExpectedSubject.BaseTree ||
+		request.FrozenContext.CandidateTree != request.ExpectedSubject.CandidateTree {
+		return fail(ArtifactAdmissionBindingMismatch, "frozen candidate trees do not match the artifact subject")
 	}
 	manifestDigest, err := ChangedPathManifestDigest(request.FrozenContext.ChangedPathManifest)
 	if err != nil || manifestDigest != request.ExpectedSubject.ChangedPathManifestSHA256 {
diff --git a/internal/reviewtransaction/artifact_subject.go b/internal/reviewtransaction/artifact_subject.go
index 0be5df2d2..524c3c352 100644
--- a/internal/reviewtransaction/artifact_subject.go
+++ b/internal/reviewtransaction/artifact_subject.go
@@ -8,24 +8,47 @@ import (
 	"reflect"
 )
 
-const ArtifactSubjectSchema = "gentle-ai.review-artifact-subject/v1"
+const ArtifactSubjectSchemaV1 = "gentle-ai.review-artifact-subject/v1"
+const ArtifactSubjectSchema = "gentle-ai.review-artifact-subject/v2"
 
 // ArtifactSubject is the provider-owned identity of one reviewer execution.
-// It binds the exact authority revision, immutable candidate bytes and path
-// manifest, selected lens slot, and (when present) correction target.
+// It binds the exact authority revision, immutable Git trees and path manifest,
+// selected lens slot, and (when present) correction target.
 type ArtifactSubject struct {
 	Schema                    string `json:"schema"`
 	SubjectHash               string `json:"subject_hash"`
 	LineageID                 string `json:"lineage_id"`
 	AuthorityRevision         string `json:"authority_revision"`
 	TargetIdentity            string `json:"target_identity"`
-	CandidateDiffSHA256       string `json:"candidate_diff_sha256"`
+	CandidateDiffSHA256       string `json:"candidate_diff_sha256,omitempty"`
+	BaseTree                  string `json:"base_tree,omitempty"`
+	CandidateTree             string `json:"candidate_tree,omitempty"`
 	ChangedPathManifestSHA256 string `json:"changed_path_manifest_sha256"`
 	Lens                      string `json:"lens"`
 	SelectedOrder             int    `json:"selected_order"`
 	CorrectionTargetIdentity  string `json:"correction_target_identity,omitempty"`
 }
 
+// NewLegacyArtifactSubject preserves the published v1 subject preimage for
+// consumers that explicitly negotiate review-integration/v1.
+func NewLegacyArtifactSubject(state CompactState, revision string, frozen FrozenCandidateContext, lens string, order int, correctionTargetIdentity string) (ArtifactSubject, error) {
+	if frozen.LegacyCandidateDiff == nil {
+		return ArtifactSubject{}, errors.New("legacy artifact subject requires candidate diff") // refusal:by-design world-action: provider construction omitted required immutable v1 transport and must be fixed before retry
+	}
+	if _, err := frozen.LegacyCandidateDiff.Bytes(); err != nil {
+		return ArtifactSubject{}, err
+	}
+	subject, err := newArtifactSubjectIdentity(state, revision, frozen, lens, order, correctionTargetIdentity)
+	if err != nil {
+		return ArtifactSubject{}, err
+	}
+	subject.Schema = ArtifactSubjectSchemaV1
+	subject.CandidateDiffSHA256 = frozen.LegacyCandidateDiff.SHA256
+	subject.BaseTree, subject.CandidateTree = "", ""
+	subject.SubjectHash = artifactSubjectHashV1(subject)
+	return subject, ValidateArtifactSubject(subject)
+}
+
 // ChangedPathManifestDigest returns the canonical provider-owned identity of
 // an ordered immutable changed-path manifest.
 func ChangedPathManifestDigest(entries []ChangedPathManifestEntry) (string, error) {
@@ -43,6 +66,16 @@ func ChangedPathManifestDigest(entries []ChangedPathManifestEntry) (string, erro
 // NewArtifactSubject derives one slot identity from native compact authority
 // and the exact frozen context already rendered for that authority.
 func NewArtifactSubject(state CompactState, revision string, frozen FrozenCandidateContext, lens string, order int, correctionTargetIdentity string) (ArtifactSubject, error) {
+	subject, err := newArtifactSubjectIdentity(state, revision, frozen, lens, order, correctionTargetIdentity)
+	if err != nil {
+		return ArtifactSubject{}, err
+	}
+	subject.Schema = ArtifactSubjectSchema
+	subject.SubjectHash = artifactSubjectHash(subject)
+	return subject, ValidateArtifactSubject(subject)
+}
+
+func newArtifactSubjectIdentity(state CompactState, revision string, frozen FrozenCandidateContext, lens string, order int, correctionTargetIdentity string) (ArtifactSubject, error) {
 	if validateLineageID(state.LineageID) != nil || !validSHA256(revision) || !validSHA256(state.InitialSnapshot.Identity) {
 		return ArtifactSubject{}, errors.New("artifact subject authority binding is incomplete")
 	}
@@ -52,8 +85,9 @@ func NewArtifactSubject(state CompactState, revision string, frozen FrozenCandid
 	if correctionTargetIdentity != "" && !validSHA256(correctionTargetIdentity) {
 		return ArtifactSubject{}, errors.New("artifact subject correction identity is invalid")
 	}
-	if _, err := frozen.CandidateDiff.Bytes(); err != nil {
-		return ArtifactSubject{}, err
+	if !validGitTree(frozen.BaseTree) || !validGitTree(frozen.CandidateTree) ||
+		frozen.BaseTree != state.InitialSnapshot.BaseTree || frozen.CandidateTree != state.InitialSnapshot.CandidateTree {
+		return ArtifactSubject{}, errors.New("artifact subject trees do not match the frozen snapshot") // refusal:by-design world-action: this provider-built subject is inconsistent; the exit is a code fix, not a command
 	}
 	manifestDigest, err := ChangedPathManifestDigest(frozen.ChangedPathManifest)
 	if err != nil {
@@ -66,33 +100,46 @@ func NewArtifactSubject(state CompactState, revision string, frozen FrozenCandid
 	if !reflect.DeepEqual(paths, state.InitialSnapshot.Paths) {
 		return ArtifactSubject{}, errors.New("artifact subject manifest does not match the frozen snapshot paths")
 	}
-	subject := ArtifactSubject{
-		Schema: ArtifactSubjectSchema, LineageID: state.LineageID, AuthorityRevision: revision,
-		TargetIdentity: state.InitialSnapshot.Identity, CandidateDiffSHA256: frozen.CandidateDiff.SHA256,
+	return ArtifactSubject{
+		LineageID: state.LineageID, AuthorityRevision: revision,
+		TargetIdentity: state.InitialSnapshot.Identity, BaseTree: frozen.BaseTree, CandidateTree: frozen.CandidateTree,
 		ChangedPathManifestSHA256: manifestDigest, Lens: lens, SelectedOrder: order,
 		CorrectionTargetIdentity: correctionTargetIdentity,
-	}
-	subject.SubjectHash = artifactSubjectHash(subject)
-	return subject, ValidateArtifactSubject(subject)
+	}, nil
 }
 
 // ValidateArtifactSubject verifies the canonical self-hash and every identity
 // field without consulting mutable repository state.
 func ValidateArtifactSubject(subject ArtifactSubject) error {
-	if subject.Schema != ArtifactSubjectSchema || validateLineageID(subject.LineageID) != nil ||
+	if validateLineageID(subject.LineageID) != nil ||
 		!validSHA256(subject.AuthorityRevision) || !validSHA256(subject.TargetIdentity) ||
-		!validSHA256(subject.CandidateDiffSHA256) || !validSHA256(subject.ChangedPathManifestSHA256) ||
+		!validSHA256(subject.ChangedPathManifestSHA256) ||
 		!isSupportedLens(subject.Lens) || subject.SelectedOrder < 0 ||
 		(subject.CorrectionTargetIdentity != "" && !validSHA256(subject.CorrectionTargetIdentity)) {
 		return errors.New("artifact subject identity is incomplete")
 	}
-	if !validSHA256(subject.SubjectHash) || artifactSubjectHash(subject) != subject.SubjectHash {
+	var wantHash string
+	switch subject.Schema {
+	case ArtifactSubjectSchemaV1:
+		if !validSHA256(subject.CandidateDiffSHA256) || subject.BaseTree != "" || subject.CandidateTree != "" {
+			return errors.New("legacy artifact subject identity is incomplete") // refusal:by-design world-action: the immutable provider-owned v1 identity must be replaced by its producer
+		}
+		wantHash = artifactSubjectHashV1(subject)
+	case ArtifactSubjectSchema:
+		if subject.CandidateDiffSHA256 != "" || !validGitTree(subject.BaseTree) || !validGitTree(subject.CandidateTree) {
+			return errors.New("artifact subject tree identity is incomplete") // refusal:by-design world-action: the immutable provider-owned native Git identity must be replaced by its producer
+		}
+		wantHash = artifactSubjectHash(subject)
+	default:
+		return errors.New("artifact subject schema is unsupported") // refusal:by-design world-action: the immutable provider-owned subject must be replaced with a supported contract identity
+	}
+	if !validSHA256(subject.SubjectHash) || wantHash != subject.SubjectHash {
 		return errors.New("artifact subject hash does not match its binding")
 	}
 	return nil
 }
 
-func artifactSubjectHash(subject ArtifactSubject) string {
+func artifactSubjectHashV1(subject ArtifactSubject) string {
 	preimage := struct {
 		Schema                    string `json:"schema"`
 		LineageID                 string `json:"lineage_id"`
@@ -113,3 +160,26 @@ func artifactSubjectHash(subject ArtifactSubject) string {
 	sum := sha256.Sum256(append([]byte("gentle-ai.review-artifact-subject/v1\x00"), payload...))
 	return "sha256:" + hex.EncodeToString(sum[:])
 }
+
+func artifactSubjectHash(subject ArtifactSubject) string {
+	preimage := struct {
+		Schema                    string `json:"schema"`
+		LineageID                 string `json:"lineage_id"`
+		AuthorityRevision         string `json:"authority_revision"`
+		TargetIdentity            string `json:"target_identity"`
+		BaseTree                  string `json:"base_tree"`
+		CandidateTree             string `json:"candidate_tree"`
+		ChangedPathManifestSHA256 string `json:"changed_path_manifest_sha256"`
+		Lens                      string `json:"lens"`
+		SelectedOrder             int    `json:"selected_order"`
+		CorrectionTargetIdentity  string `json:"correction_target_identity,omitempty"`
+	}{
+		Schema: subject.Schema, LineageID: subject.LineageID, AuthorityRevision: subject.AuthorityRevision,
+		TargetIdentity: subject.TargetIdentity, BaseTree: subject.BaseTree, CandidateTree: subject.CandidateTree,
+		ChangedPathManifestSHA256: subject.ChangedPathManifestSHA256, Lens: subject.Lens,
+		SelectedOrder: subject.SelectedOrder, CorrectionTargetIdentity: subject.CorrectionTargetIdentity,
+	}
+	payload, _ := json.Marshal(preimage)
+	sum := sha256.Sum256(append([]byte("gentle-ai.review-artifact-subject/v2\x00"), payload...))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
diff --git a/internal/reviewtransaction/artifact_subject_test.go b/internal/reviewtransaction/artifact_subject_test.go
index f0b8caf90..87b585990 100644
--- a/internal/reviewtransaction/artifact_subject_test.go
+++ b/internal/reviewtransaction/artifact_subject_test.go
@@ -7,18 +7,15 @@ import (
 
 func artifactSubjectFixture(t *testing.T) (CompactState, string, FrozenCandidateContext) {
 	t.Helper()
-	diff, err := NewFrozenCandidateDiff([]byte("diff --git a/internal/a.go b/internal/a.go\n"))
-	if err != nil {
-		t.Fatal(err)
-	}
 	paths := []string{"internal/a.go", "internal/b.go"}
+	baseTree, candidateTree := strings.Repeat("a", 40), strings.Repeat("b", 40)
 	state := CompactState{
 		LineageID:       "review-artifact-subject",
 		SelectedLenses:  []string{LensReliability, LensReadability},
-		InitialSnapshot: Snapshot{Identity: "sha256:" + strings.Repeat("1", 64), Paths: paths},
+		InitialSnapshot: Snapshot{Identity: "sha256:" + strings.Repeat("1", 64), BaseTree: baseTree, CandidateTree: candidateTree, Paths: paths},
 	}
 	context := FrozenCandidateContext{
-		CandidateDiff: diff,
+		BaseTree: baseTree, CandidateTree: candidateTree,
 		ChangedPathManifest: []ChangedPathManifestEntry{
 			{Path: paths[0], Status: CandidatePathModified, OldMode: "100644", NewMode: "100644"},
 			{Path: paths[1], Status: CandidatePathAdded, OldMode: "000000", NewMode: "100644", IntendedUntracked: true},
@@ -39,7 +36,7 @@ func TestArtifactSubjectBindsFrozenCandidateAndSlot(t *testing.T) {
 	}
 	if subject.Schema != ArtifactSubjectSchema || subject.SubjectHash == "" ||
 		subject.LineageID != state.LineageID || subject.AuthorityRevision != revision ||
-		subject.TargetIdentity != state.InitialSnapshot.Identity || subject.CandidateDiffSHA256 != context.CandidateDiff.SHA256 ||
+		subject.TargetIdentity != state.InitialSnapshot.Identity || subject.BaseTree != context.BaseTree || subject.CandidateTree != context.CandidateTree ||
 		subject.Lens != LensReadability || subject.SelectedOrder != 1 {
 		t.Fatalf("subject = %#v", subject)
 	}
@@ -82,3 +79,29 @@ func TestArtifactSubjectOptionalCorrectionIdentityIsBound(t *testing.T) {
 		t.Fatal("subject hash ignored correction identity")
 	}
 }
+
+func TestLegacyArtifactSubjectRetainsCandidateDiffBinding(t *testing.T) {
+	state, revision, frozen := artifactSubjectFixture(t)
+	diff, err := NewFrozenCandidateDiff([]byte("diff --git a/internal/a.go b/internal/a.go\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	frozen.LegacyCandidateDiff = &diff
+	legacy, err := NewLegacyArtifactSubject(state, revision, frozen, LensReliability, 0, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if legacy.Schema != ArtifactSubjectSchemaV1 || legacy.CandidateDiffSHA256 != diff.SHA256 || legacy.BaseTree != "" || legacy.CandidateTree != "" {
+		t.Fatalf("legacy subject = %#v", legacy)
+	}
+	if err := ValidateArtifactSubject(legacy); err != nil {
+		t.Fatal(err)
+	}
+	nativeGit, err := NewArtifactSubject(state, revision, frozen, LensReliability, 0, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if nativeGit.SubjectHash == legacy.SubjectHash {
+		t.Fatal("v1 candidate-diff and v2 native-Git subjects share an identity")
+	}
+}
diff --git a/internal/reviewtransaction/compact_result_reopen.go b/internal/reviewtransaction/compact_result_reopen.go
index 6b73a83ad..80a0b67cd 100644
--- a/internal/reviewtransaction/compact_result_reopen.go
+++ b/internal/reviewtransaction/compact_result_reopen.go
@@ -16,13 +16,21 @@ import (
 )
 
 const (
-	AdmittedReviewerResultSchema           = "gentle-ai.review-admitted-result/v1"
+	AdmittedReviewerResultSchemaV1         = "gentle-ai.review-admitted-result/v1"
+	AdmittedReviewerResultSchema           = "gentle-ai.review-admitted-result/v2"
 	CompactResultReopenOperation           = "review/reopen-results"
 	CompactQuarantinedReviewerResultsDir   = "quarantined-reviewer-results"
 	compactResultReopenAuthorizationSchema = "gentle-ai.review-result-reopen-authorization/v1"
 	compactReviewerResultSizeLimit         = 4 << 20
 )
 
+func admittedReviewerResultSchemaForSubject(subject ArtifactSubject) string {
+	if subject.Schema == ArtifactSubjectSchemaV1 {
+		return AdmittedReviewerResultSchemaV1
+	}
+	return AdmittedReviewerResultSchema
+}
+
 type CompactResultReopenRequest struct {
 	LineageID        string
 	ExpectedRevision string
@@ -211,7 +219,7 @@ func ReopenCompactReviewerResults(ctx context.Context, repo string, request Comp
 		} else if !os.IsNotExist(statErr) {
 			return statErr
 		}
-		quarantined, retained, inspectErr := classifyCompactResultReopenSlots(store.Dir, record.State, frozen, plan.AuthorizedLenses)
+		quarantined, retained, inspectErr := classifyCompactResultReopenSlots(repository, store.Dir, record.State, frozen, plan.AuthorizedLenses)
 		if inspectErr != nil {
 			return inspectErr
 		}
@@ -293,7 +301,7 @@ func buildCompactResultReopenPlan(ctx context.Context, repository string, store
 	if err != nil {
 		return CompactResultReopenPlan{}, err
 	}
-	quarantined, retained, err := classifyCompactResultReopenSlots(store.Dir, state, frozen, authorizedLenses)
+	quarantined, retained, err := classifyCompactResultReopenSlots(repository, store.Dir, state, frozen, authorizedLenses)
 	if err != nil {
 		return CompactResultReopenPlan{}, err
 	}
@@ -314,7 +322,7 @@ func buildCompactResultReopenPlan(ctx context.Context, repository string, store
 // reporting that candidate inspection was unavailable. authorizedLenses adds
 // the maintainer's explicitly named admitted slots — the one and only path by
 // which a structurally valid, provider-admitted result leaves its slot.
-func classifyCompactResultReopenSlots(storeDir string, state CompactState, frozen FrozenCandidateContext, authorizedLenses []string) ([]CompactResultReopenSlot, []CompactResultReopenSlot, error) {
+func classifyCompactResultReopenSlots(repository, storeDir string, state CompactState, frozen FrozenCandidateContext, authorizedLenses []string) ([]CompactResultReopenSlot, []CompactResultReopenSlot, error) {
 	authorized := make(map[string]struct{}, len(authorizedLenses))
 	for _, lens := range authorizedLenses {
 		authorized[lens] = struct{}{}
@@ -322,7 +330,7 @@ func classifyCompactResultReopenSlots(storeDir string, state CompactState, froze
 	quarantined := make([]CompactResultReopenSlot, 0)
 	retained := make([]CompactResultReopenSlot, 0)
 	for order, lens := range state.SelectedLenses {
-		slot, trusted, err := inspectCompactResultReopenSlot(storeDir, state, frozen, order, lens)
+		slot, trusted, err := inspectCompactResultReopenSlot(repository, storeDir, state, frozen, order, lens)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -340,7 +348,7 @@ func classifyCompactResultReopenSlots(storeDir string, state CompactState, froze
 	return quarantined, retained, nil
 }
 
-func inspectCompactResultReopenSlot(storeDir string, state CompactState, frozen FrozenCandidateContext, order int, lens string) (CompactResultReopenSlot, bool, error) {
+func inspectCompactResultReopenSlot(repository, storeDir string, state CompactState, frozen FrozenCandidateContext, order int, lens string) (CompactResultReopenSlot, bool, error) {
 	if order >= len(state.LensResults) {
 		return CompactResultReopenSlot{}, false, errors.New("validating authority does not contain every selected lens result")
 	}
@@ -359,10 +367,10 @@ func inspectCompactResultReopenSlot(storeDir string, state CompactState, frozen
 		return slot, false, nil
 	}
 	var extra any
-	if err := decoder.Decode(&extra); err != io.EOF || envelope.Schema != AdmittedReviewerResultSchema || len(envelope.Result) == 0 {
+	if err := decoder.Decode(&extra); err != io.EOF || envelope.Schema != admittedReviewerResultSchemaForSubject(envelope.Subject) || len(envelope.Result) == 0 {
 		return slot, false, nil
 	}
-	expected, err := NewArtifactSubject(state, envelope.Subject.AuthorityRevision, frozen, lens, order, envelope.Subject.CorrectionTargetIdentity)
+	frozen, expected, err := artifactSubjectForSchema(context.Background(), SnapshotBuilder{Repo: repository}, state, envelope.Subject.AuthorityRevision, frozen, lens, order, envelope.Subject.CorrectionTargetIdentity, envelope.Subject.Schema)
 	if err != nil || envelope.Subject != expected || envelope.Admission.Validate(expected) != nil {
 		return slot, false, nil
 	}
diff --git a/internal/reviewtransaction/compact_reviewer_capture.go b/internal/reviewtransaction/compact_reviewer_capture.go
index 88e2379da..d845fe066 100644
--- a/internal/reviewtransaction/compact_reviewer_capture.go
+++ b/internal/reviewtransaction/compact_reviewer_capture.go
@@ -39,11 +39,12 @@ func (store CompactStore) ResolveAdmittedReviewerResult(ctx context.Context, exp
 		return LensResult{}, false, errors.New("resolve admitted reviewer result requires an exact revision and target")
 	}
 	err = store.CaptureReviewerResult(expectedRevision, targetIdentity, subject.Lens, subject.SelectedOrder, func(state CompactState) error {
-		nativeFrozen, err := (SnapshotBuilder{Repo: store.repo}).FrozenCandidateContext(ctx, state.InitialSnapshot)
+		builder := SnapshotBuilder{Repo: store.repo}
+		nativeFrozen, err := builder.FrozenCandidateContext(ctx, state.InitialSnapshot)
 		if err != nil {
 			return err
 		}
-		expected, err := NewArtifactSubject(state, expectedRevision, nativeFrozen, subject.Lens, subject.SelectedOrder, subject.CorrectionTargetIdentity)
+		nativeFrozen, expected, err := artifactSubjectForSchema(ctx, builder, state, expectedRevision, nativeFrozen, subject.Lens, subject.SelectedOrder, subject.CorrectionTargetIdentity, subject.Schema)
 		if err != nil {
 			return err
 		}
@@ -67,7 +68,7 @@ func (store CompactStore) ResolveAdmittedReviewerResult(ctx context.Context, exp
 			return fmt.Errorf("decode admitted reviewer result: %w", err)
 		}
 		var extra any
-		if err := decoder.Decode(&extra); err != io.EOF || envelope.Schema != AdmittedReviewerResultSchema || envelope.Subject != expected || envelope.Admission.Validate(expected) != nil || len(envelope.Result) == 0 {
+		if err := decoder.Decode(&extra); err != io.EOF || envelope.Schema != admittedReviewerResultSchemaForSubject(expected) || envelope.Subject != expected || envelope.Admission.Validate(expected) != nil || len(envelope.Result) == 0 {
 			return errors.New("admitted reviewer result does not match locked authority")
 		}
 		result, found = reAdmitCompactReviewerResult(envelope, expected, nativeFrozen)
@@ -142,9 +143,17 @@ func (store CompactStore) CaptureAdmittedReviewerResult(
 			if err := ctx.Err(); err != nil {
 				return err
 			}
-			nativeContext, err := (SnapshotBuilder{
+			builder := SnapshotBuilder{
 				Repo: store.repo,
-			}).FrozenCandidateContext(ctx, state.InitialSnapshot)
+			}
+			nativeContext, err := builder.FrozenCandidateContext(ctx, state.InitialSnapshot)
+			if err != nil {
+				return err
+			}
+			nativeContext, expected, err := artifactSubjectForSchema(
+				ctx, builder, state, request.ExpectedRevision, nativeContext, request.ArtifactSubject.Lens,
+				request.ArtifactSubject.SelectedOrder, request.ArtifactSubject.CorrectionTargetIdentity, request.ArtifactSubject.Schema,
+			)
 			if err != nil {
 				return err
 			}
@@ -153,17 +162,6 @@ func (store CompactStore) CaptureAdmittedReviewerResult(
 					"reviewer frozen context does not match repository authority",
 				)
 			}
-			expected, err := NewArtifactSubject(
-				state,
-				request.ExpectedRevision,
-				nativeContext,
-				request.ArtifactSubject.Lens,
-				request.ArtifactSubject.SelectedOrder,
-				request.ArtifactSubject.CorrectionTargetIdentity,
-			)
-			if err != nil {
-				return err
-			}
 			if expected != request.ArtifactSubject {
 				return errors.New(
 					"reviewer artifact subject does not match the locked authority",
@@ -185,7 +183,7 @@ func (store CompactStore) CaptureAdmittedReviewerResult(
 				return err
 			}
 			envelopePayload, err := json.Marshal(compactAdmittedReviewerResult{
-				Schema:    AdmittedReviewerResultSchema,
+				Schema:    admittedReviewerResultSchemaForSubject(expected),
 				Subject:   expected,
 				Admission: admission,
 				Result: append(
@@ -216,6 +214,29 @@ func (store CompactStore) CaptureAdmittedReviewerResult(
 	return admitted, nil
 }
 
+func artifactSubjectForSchema(
+	ctx context.Context,
+	builder SnapshotBuilder,
+	state CompactState,
+	revision string,
+	frozen FrozenCandidateContext,
+	lens string,
+	order int,
+	correctionTargetIdentity string,
+	schema string,
+) (FrozenCandidateContext, ArtifactSubject, error) {
+	if schema == ArtifactSubjectSchemaV1 {
+		legacy, err := builder.WithLegacyCandidateDiff(ctx, state.InitialSnapshot, frozen)
+		if err != nil {
+			return FrozenCandidateContext{}, ArtifactSubject{}, err
+		}
+		subject, err := NewLegacyArtifactSubject(state, revision, legacy, lens, order, correctionTargetIdentity)
+		return legacy, subject, err
+	}
+	subject, err := NewArtifactSubject(state, revision, frozen, lens, order, correctionTargetIdentity)
+	return frozen, subject, err
+}
+
 func publishCompactAdmittedReviewerResult(
 	storeDir string,
 	subject ArtifactSubject,
diff --git a/internal/reviewtransaction/frozen_candidate_context.go b/internal/reviewtransaction/frozen_candidate_context.go
index 825d34d39..d76b6704b 100644
--- a/internal/reviewtransaction/frozen_candidate_context.go
+++ b/internal/reviewtransaction/frozen_candidate_context.go
@@ -16,17 +16,13 @@ import (
 
 const (
 	FrozenCandidateDiffEncodingBase64 = "base64"
-	// MaxFrozenCandidateDiffBytes matches the native reviewer-artifact ceiling:
-	// four MiB is large enough for bounded review slices while preventing the
-	// inline START response and its base64/JSON copies from growing without bound.
 	MaxFrozenCandidateDiffBytes       = 4 << 20
 	MaxFrozenCandidateDiffBase64Bytes = 5_592_408
 	maxFrozenCandidateManifestBytes   = 4 << 20
 )
 
-// FrozenCandidateDiff transports arbitrary Git patch bytes without converting
-// them through UTF-8. Data is canonical padded base64; SHA256 and ByteSize bind
-// the decoded bytes and make missing context distinct from a valid empty patch.
+// FrozenCandidateDiff is retained only for negotiated v1 compatibility.
+// Provider-managed native-Git reviewers never receive this payload.
 type FrozenCandidateDiff struct {
 	Encoding string `json:"encoding"`
 	Data     string `json:"data"`
@@ -34,23 +30,17 @@ type FrozenCandidateDiff struct {
 	ByteSize int    `json:"byte_size"`
 }
 
-// NewFrozenCandidateDiff builds the canonical exact-byte transport object.
 func NewFrozenCandidateDiff(payload []byte) (FrozenCandidateDiff, error) {
 	if len(payload) > MaxFrozenCandidateDiffBytes {
-		return FrozenCandidateDiff{}, &GitOutputLimitError{
-			Args: []string{"diff"}, Limit: MaxFrozenCandidateDiffBytes, Actual: len(payload),
-		}
+		return FrozenCandidateDiff{}, &GitOutputLimitError{Args: []string{"diff"}, Limit: MaxFrozenCandidateDiffBytes, Actual: len(payload)}
 	}
 	digest := sha256.Sum256(payload)
 	return FrozenCandidateDiff{
-		Encoding: FrozenCandidateDiffEncodingBase64,
-		Data:     base64.StdEncoding.EncodeToString(payload),
-		SHA256:   fmt.Sprintf("sha256:%x", digest),
-		ByteSize: len(payload),
+		Encoding: FrozenCandidateDiffEncodingBase64, Data: base64.StdEncoding.EncodeToString(payload),
+		SHA256: fmt.Sprintf("sha256:%x", digest), ByteSize: len(payload),
 	}, nil
 }
 
-// Bytes validates and decodes the exact patch bytes.
 func (diff FrozenCandidateDiff) Bytes() ([]byte, error) {
 	if diff.Encoding != FrozenCandidateDiffEncodingBase64 || diff.ByteSize < 0 || diff.ByteSize > MaxFrozenCandidateDiffBytes ||
 		len(diff.Data) > MaxFrozenCandidateDiffBase64Bytes || len(diff.Data) != base64.StdEncoding.EncodedLen(diff.ByteSize) {
@@ -98,13 +88,45 @@ type ChangedPathManifestEntry struct {
 // FrozenCandidateContext is the deterministic reviewer input derived only
 // from the immutable Git trees and metadata persisted in a Snapshot.
 type FrozenCandidateContext struct {
-	CandidateDiff       FrozenCandidateDiff
+	BaseTree            string
+	CandidateTree       string
+	LegacyCandidateDiff *FrozenCandidateDiff
 	ChangedPathManifest []ChangedPathManifestEntry
 	repositoryPaths     []string
 }
 
-// FrozenCandidateContext renders the exact immutable candidate patch and its
-// typed path manifest. It never consults the live index or worktree.
+// WithLegacyCandidateDiff adds the exact published v1 candidate transport.
+// Callers use it only after explicitly negotiating the legacy contract.
+func (builder SnapshotBuilder) WithLegacyCandidateDiff(ctx context.Context, snapshot Snapshot, frozen FrozenCandidateContext) (FrozenCandidateContext, error) {
+	if frozen.BaseTree != snapshot.BaseTree || frozen.CandidateTree != snapshot.CandidateTree {
+		return FrozenCandidateContext{}, errors.New("legacy candidate transport does not match frozen trees") // refusal:by-design world-action: provider code mixed immutable contexts and must be fixed before retry
+	}
+	repo, err := builder.repositoryRoot(ctx)
+	if err != nil {
+		return FrozenCandidateContext{}, err
+	}
+	isolation, cleanup, err := isolatedImmutableTreeGit(ctx, repo)
+	if err != nil {
+		return FrozenCandidateContext{}, err
+	}
+	defer cleanup()
+	payload, err := runGitLimited(ctx, repo, isolation, nil, MaxFrozenCandidateDiffBytes,
+		"diff", "--binary", "--full-index", "--no-color", "--no-renames", "--no-ext-diff", "--no-textconv",
+		"--diff-algorithm=myers", "--no-indent-heuristic", "--unified=3", "--ignore-submodules=none",
+		"--src-prefix=a/", "--dst-prefix=b/", snapshot.BaseTree, snapshot.CandidateTree, "--")
+	if err != nil {
+		return FrozenCandidateContext{}, fmt.Errorf("render legacy frozen candidate diff: %w", err)
+	}
+	diff, err := NewFrozenCandidateDiff(payload)
+	if err != nil {
+		return FrozenCandidateContext{}, err
+	}
+	frozen.LegacyCandidateDiff = &diff
+	return frozen, nil
+}
+
+// FrozenCandidateContext returns immutable Git tree references and their typed
+// path manifest. Reviewers read only path-scoped diffs between these trees.
 func (builder SnapshotBuilder) FrozenCandidateContext(ctx context.Context, snapshot Snapshot) (FrozenCandidateContext, error) {
 	repo, err := builder.repositoryRoot(ctx)
 	if err != nil {
@@ -120,32 +142,6 @@ func (builder SnapshotBuilder) FrozenCandidateContext(ctx context.Context, snaps
 	}
 	defer cleanup()
 
-	diff, err := runGitLimited(ctx, repo, isolation, nil, MaxFrozenCandidateDiffBytes,
-		"diff",
-		"--binary",
-		"--full-index",
-		"--no-color",
-		"--no-renames",
-		"--no-ext-diff",
-		"--no-textconv",
-		"--diff-algorithm=myers",
-		"--no-indent-heuristic",
-		"--unified=3",
-		"--ignore-submodules=none",
-		"--src-prefix=a/",
-		"--dst-prefix=b/",
-		snapshot.BaseTree,
-		snapshot.CandidateTree,
-		"--",
-	)
-	if err != nil {
-		return FrozenCandidateContext{}, fmt.Errorf("render frozen candidate diff: %w", err)
-	}
-	candidateDiff, err := NewFrozenCandidateDiff(diff)
-	if err != nil {
-		return FrozenCandidateContext{}, fmt.Errorf("encode frozen candidate diff: %w", err)
-	}
-
 	raw, err := runGitLimited(ctx, repo, isolation, nil, maxFrozenCandidateManifestBytes,
 		"diff",
 		"--raw",
@@ -196,7 +192,10 @@ func (builder SnapshotBuilder) FrozenCandidateContext(ctx context.Context, snaps
 	if err != nil {
 		return FrozenCandidateContext{}, err
 	}
-	return FrozenCandidateContext{CandidateDiff: candidateDiff, ChangedPathManifest: manifest, repositoryPaths: repositoryPaths}, nil
+	return FrozenCandidateContext{
+		BaseTree: snapshot.BaseTree, CandidateTree: snapshot.CandidateTree,
+		ChangedPathManifest: manifest, repositoryPaths: repositoryPaths,
+	}, nil
 }
 
 // frozenRepositoryPathManifest returns the canonical logical paths present in
diff --git a/internal/reviewtransaction/frozen_candidate_context_test.go b/internal/reviewtransaction/frozen_candidate_context_test.go
index 7aa83eefb..6afb2d124 100644
--- a/internal/reviewtransaction/frozen_candidate_context_test.go
+++ b/internal/reviewtransaction/frozen_candidate_context_test.go
@@ -3,9 +3,6 @@ package reviewtransaction
 import (
 	"bytes"
 	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -53,7 +50,13 @@ func TestFrozenCandidateContextUsesImmutableTreesAndCanonicalManifest(t *testing
 	if err != nil {
 		t.Fatalf("FrozenCandidateContext() error = %v", err)
 	}
-	baselineDiff := frozenCandidateDiffBytes(t, baseline.CandidateDiff)
+	if baseline.BaseTree != snapshot.BaseTree || baseline.CandidateTree != snapshot.CandidateTree {
+		t.Fatalf("frozen trees = %s..%s, want %s..%s", baseline.BaseTree, baseline.CandidateTree, snapshot.BaseTree, snapshot.CandidateTree)
+	}
+	baselineDiff := frozenCandidatePathDiff(t, repo, baseline)
+	if wholeDiff := frozenCandidateGitDiff(t, repo, baseline, ""); !bytes.Equal(baselineDiff, wholeDiff) {
+		t.Fatalf("ordered path-scoped diffs do not reconstruct the canonical tree diff\npaths=%s\nwhole=%s", baselineDiff, wholeDiff)
+	}
 
 	want := []ChangedPathManifestEntry{
 		{Path: "added.txt", Status: CandidatePathAdded, OldMode: "000000", NewMode: "100644"},
@@ -111,6 +114,9 @@ func TestFrozenCandidateContextUsesImmutableTreesAndCanonicalManifest(t *testing
 	if !reflect.DeepEqual(replayed, baseline) {
 		t.Fatalf("replayed context changed after hostile config/workspace mutation\nfirst=%#v\nreplayed=%#v", baseline, replayed)
 	}
+	if replayedDiff := frozenCandidatePathDiff(t, repo, replayed); !bytes.Equal(replayedDiff, baselineDiff) {
+		t.Fatalf("path-scoped tree diff changed after live mutation\nfirst=%s\nreplayed=%s", baselineDiff, replayedDiff)
+	}
 }
 
 func TestFrozenCandidateContextMarksIntendedUntrackedAndSupportsEmptyCandidate(t *testing.T) {
@@ -134,7 +140,7 @@ func TestFrozenCandidateContextMarksIntendedUntrackedAndSupportsEmptyCandidate(t
 		if !reflect.DeepEqual(contextResult.ChangedPathManifest, want) {
 			t.Fatalf("manifest = %#v, want %#v", contextResult.ChangedPathManifest, want)
 		}
-		if diff := frozenCandidateDiffBytes(t, contextResult.CandidateDiff); !bytes.Contains(diff, []byte("+reviewed untracked")) {
+		if diff := frozenCandidatePathDiff(t, repo, contextResult); !bytes.Contains(diff, []byte("+reviewed untracked")) {
 			t.Fatalf("candidate diff does not contain intended-untracked bytes:\n%s", diff)
 		}
 	})
@@ -151,7 +157,7 @@ func TestFrozenCandidateContextMarksIntendedUntrackedAndSupportsEmptyCandidate(t
 		if err != nil {
 			t.Fatalf("FrozenCandidateContext() error = %v", err)
 		}
-		if diff := frozenCandidateDiffBytes(t, contextResult.CandidateDiff); len(diff) != 0 {
+		if diff := frozenCandidatePathDiff(t, repo, contextResult); len(diff) != 0 {
 			t.Fatalf("empty candidate diff = %q", diff)
 		}
 		if contextResult.ChangedPathManifest == nil || len(contextResult.ChangedPathManifest) != 0 {
@@ -160,6 +166,107 @@ func TestFrozenCandidateContextMarksIntendedUntrackedAndSupportsEmptyCandidate(t
 	})
 }
 
+func TestFrozenCandidateReviewerDiffUsesLiteralManifestPaths(t *testing.T) {
+	requireSnapshotGit(t)
+	repo := initSnapshotRepo(t)
+	paths := []string{
+		"literal*.txt", "literal-one.txt",
+		"literal?.txt", "literal1.txt",
+		"literal[1].txt", ":(top)magic.txt", "magic.txt",
+	}
+	for _, version := range []string{"base", "candidate"} {
+		for _, logicalPath := range paths {
+			blob := strings.TrimSpace(gitSnapshotInput(t, repo, []byte(version+" "+logicalPath+"\n"), "hash-object", "-w", "--stdin"))
+			gitSnapshot(t, repo, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+logicalPath)
+		}
+		gitSnapshot(t, repo, "commit", "-m", version)
+	}
+	candidateCommit := strings.TrimSpace(gitSnapshot(t, repo, "rev-parse", "HEAD"))
+	snapshot, err := (SnapshotBuilder{Repo: repo}).Build(context.Background(), Target{
+		Kind: TargetExactRevision, Revision: candidateCommit,
+	})
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+	frozen, err := (SnapshotBuilder{Repo: repo}).FrozenCandidateContext(context.Background(), snapshot)
+	if err != nil {
+		t.Fatalf("FrozenCandidateContext() error = %v", err)
+	}
+	if len(frozen.ChangedPathManifest) != len(paths) {
+		t.Fatalf("manifest has %d paths, want %d: %#v", len(frozen.ChangedPathManifest), len(paths), frozen.ChangedPathManifest)
+	}
+	for _, entry := range frozen.ChangedPathManifest {
+		scoped := frozenCandidateGitDiff(t, repo, frozen, entry.Path)
+		if count := bytes.Count(scoped, []byte("diff --git ")); count != 1 {
+			t.Fatalf("literal path %q rendered %d diffs:\n%s", entry.Path, count, scoped)
+		}
+		if !bytes.Contains(scoped, []byte("+candidate "+entry.Path)) {
+			t.Fatalf("literal path %q selected different candidate bytes:\n%s", entry.Path, scoped)
+		}
+	}
+	if scoped, whole := frozenCandidatePathDiff(t, repo, frozen), frozenCandidateGitDiff(t, repo, frozen, ""); !bytes.Equal(scoped, whole) {
+		t.Fatalf("literal path-scoped diffs do not reconstruct the whole tree diff\npaths=%s\nwhole=%s", scoped, whole)
+	}
+}
+
+func TestFrozenCandidateReviewerDiffIgnoresMutableAttributeSources(t *testing.T) {
+	requireSnapshotGit(t)
+	repo := initSnapshotRepo(t)
+	writeSnapshotFile(t, repo, "attribute-target.txt", "base\n")
+	gitSnapshot(t, repo, "add", "--", "attribute-target.txt")
+	gitSnapshot(t, repo, "commit", "-m", "base")
+	writeSnapshotFile(t, repo, "attribute-target.txt", "candidate\n")
+	gitSnapshot(t, repo, "add", "--", "attribute-target.txt")
+	gitSnapshot(t, repo, "commit", "-m", "candidate")
+	candidateCommit := strings.TrimSpace(gitSnapshot(t, repo, "rev-parse", "HEAD"))
+	snapshot, err := (SnapshotBuilder{Repo: repo}).Build(context.Background(), Target{
+		Kind: TargetExactRevision, Revision: candidateCommit,
+	})
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+	frozen, err := (SnapshotBuilder{Repo: repo}).FrozenCandidateContext(context.Background(), snapshot)
+	if err != nil {
+		t.Fatalf("FrozenCandidateContext() error = %v", err)
+	}
+	baseline := frozenCandidateGitDiff(t, repo, frozen, "attribute-target.txt")
+	if !bytes.Contains(baseline, []byte("+candidate")) || bytes.Contains(baseline, []byte("GIT binary patch")) {
+		t.Fatalf("baseline reviewer diff is not canonical text:\n%s", baseline)
+	}
+
+	attributes := filepath.Join(t.TempDir(), "attributes")
+	if err := os.WriteFile(attributes, []byte("attribute-target.txt binary\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gitSnapshot(t, repo, "config", "core.attributesFile", attributes)
+	for _, config := range []string{"global.gitconfig", "system.gitconfig"} {
+		path := filepath.Join(t.TempDir(), config)
+		writeFrozenCandidateHostileGitConfig(t, path, attributes)
+		if strings.HasPrefix(config, "global") {
+			t.Setenv("GIT_CONFIG_GLOBAL", path)
+		} else {
+			t.Setenv("GIT_CONFIG_SYSTEM", path)
+		}
+	}
+	if err := os.WriteFile(filepath.Join(repo, ".git", "info", "attributes"), []byte("attribute-target.txt binary\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSnapshotFile(t, repo, ".gitattributes", "attribute-target.txt binary\n")
+	t.Setenv("GIT_ATTR_SOURCE", "HEAD")
+	t.Setenv("GIT_CONFIG_COUNT", "1")
+	t.Setenv("GIT_CONFIG_KEY_0", "core.attributesFile")
+	t.Setenv("GIT_CONFIG_VALUE_0", attributes)
+
+	replayed := frozenCandidateGitDiff(t, repo, frozen, "attribute-target.txt")
+	if !bytes.Equal(replayed, baseline) {
+		t.Fatalf("reviewer tree diff changed under mutable Git attributes\nfirst=%s\nreplayed=%s", baseline, replayed)
+	}
+	porcelain := frozenCandidatePorcelainGitDiff(t, repo, frozen, "attribute-target.txt")
+	if bytes.Equal(porcelain, baseline) || !bytes.Contains(porcelain, []byte("GIT binary patch")) {
+		t.Fatalf("hostile attributes did not exercise the porcelain regression:\n%s", porcelain)
+	}
+}
+
 func TestFrozenCandidateContextIsolatesAllGitAttributesConfigAndLocale(t *testing.T) {
 	requireSnapshotGit(t)
 	repo := initSnapshotRepo(t)
@@ -187,11 +294,6 @@ func TestFrozenCandidateContextIsolatesAllGitAttributesConfigAndLocale(t *testin
 	if err != nil {
 		t.Fatalf("DiffStats() error = %v", err)
 	}
-	baselineBytes := frozenCandidateDiffBytes(t, baseline.CandidateDiff)
-	if !bytes.Contains(baselineBytes, []byte("-base\n+candidate\n")) || bytes.Contains(baselineBytes, []byte("GIT binary patch")) {
-		t.Fatalf("committed attributes influenced isolated diff:\n%s", baselineBytes)
-	}
-
 	globalAttributes := filepath.Join(t.TempDir(), "global-attributes")
 	if err := os.WriteFile(globalAttributes, []byte("attribute-target.txt binary\n"), 0o644); err != nil {
 		t.Fatal(err)
@@ -263,66 +365,6 @@ func writeFrozenCandidateHostileGitConfig(t *testing.T, path, attributesFile str
 	}
 }
 
-func TestFrozenCandidateContextPreservesInvalidUTF8PatchBytesAcrossJSON(t *testing.T) {
-	requireSnapshotGit(t)
-	repo := initSnapshotRepo(t)
-	if err := os.WriteFile(filepath.Join(repo, "invalid.txt"), []byte("base\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	gitSnapshot(t, repo, "add", "--", "invalid.txt")
-	gitSnapshot(t, repo, "commit", "-m", "base")
-	if err := os.WriteFile(filepath.Join(repo, "invalid.txt"), []byte{'c', 'a', 'n', 'd', 0xff, '\n'}, 0o644); err != nil {
-		t.Fatal(err)
-	}
-	gitSnapshot(t, repo, "add", "--", "invalid.txt")
-	gitSnapshot(t, repo, "commit", "-m", "candidate")
-	candidateCommit := strings.TrimSpace(gitSnapshot(t, repo, "rev-parse", "HEAD"))
-	snapshot, err := (SnapshotBuilder{Repo: repo}).Build(context.Background(), Target{
-		Kind: TargetExactRevision, Revision: candidateCommit,
-	})
-	if err != nil {
-		t.Fatalf("Build() error = %v", err)
-	}
-
-	contextResult, err := (SnapshotBuilder{Repo: repo}).FrozenCandidateContext(context.Background(), snapshot)
-	if err != nil {
-		t.Fatalf("FrozenCandidateContext() error = %v", err)
-	}
-	wantBytes := frozenCandidateDiffBytes(t, contextResult.CandidateDiff)
-	if !bytes.Contains(wantBytes, []byte{0xff}) {
-		t.Fatalf("candidate diff lost invalid UTF-8 byte: %x", wantBytes)
-	}
-	payload, err := json.Marshal(contextResult.CandidateDiff)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var roundTrip FrozenCandidateDiff
-	if err := json.Unmarshal(payload, &roundTrip); err != nil {
-		t.Fatal(err)
-	}
-	if got := frozenCandidateDiffBytes(t, roundTrip); !bytes.Equal(got, wantBytes) {
-		t.Fatalf("JSON round trip changed patch bytes\nwant=%x\ngot=%x", wantBytes, got)
-	}
-}
-
-func TestFrozenCandidateDiffCaptureAndMetadataEnforceRawByteLimit(t *testing.T) {
-	requireSnapshotGit(t)
-	if got := base64.StdEncoding.EncodedLen(MaxFrozenCandidateDiffBytes); got != MaxFrozenCandidateDiffBase64Bytes {
-		t.Fatalf("encoded max = %d, want %d", got, MaxFrozenCandidateDiffBase64Bytes)
-	}
-	repo := initSnapshotRepo(t)
-	blob := bytes.Repeat([]byte("bounded-output\n"), 64)
-	oid := strings.TrimSpace(gitSnapshotInput(t, repo, blob, "hash-object", "-w", "--stdin"))
-	_, err := runGitLimited(context.Background(), repo, nil, nil, 64, "cat-file", "blob", oid)
-	var limitErr *GitOutputLimitError
-	if !errors.As(err, &limitErr) || limitErr.Limit != 64 {
-		t.Fatalf("runGitLimited() error = %v, want 64-byte GitOutputLimitError", err)
-	}
-	if _, err := NewFrozenCandidateDiff(make([]byte, MaxFrozenCandidateDiffBytes+1)); !errors.As(err, &limitErr) || limitErr.Limit != MaxFrozenCandidateDiffBytes {
-		t.Fatalf("NewFrozenCandidateDiff() error = %v, want max-size rejection", err)
-	}
-}
-
 func TestFrozenCandidateContextRejectsSnapshotMetadataMismatch(t *testing.T) {
 	requireSnapshotGit(t)
 	repo := initSnapshotRepo(t)
@@ -358,11 +400,48 @@ func manifestPaths(entries []ChangedPathManifestEntry) []string {
 	return paths
 }
 
-func frozenCandidateDiffBytes(t *testing.T, diff FrozenCandidateDiff) []byte {
+func frozenCandidatePathDiff(t *testing.T, repo string, frozen FrozenCandidateContext) []byte {
 	t.Helper()
-	payload, err := diff.Bytes()
-	if err != nil {
-		t.Fatalf("candidate diff metadata = %#v: %v", diff, err)
+	var payload []byte
+	for _, entry := range frozen.ChangedPathManifest {
+		payload = append(payload, frozenCandidateGitDiff(t, repo, frozen, entry.Path)...)
 	}
 	return payload
 }
+
+func frozenCandidateGitDiff(t *testing.T, repo string, frozen FrozenCandidateContext, logicalPath string) []byte {
+	t.Helper()
+	isolation, cleanup, err := isolatedImmutableTreeGit(context.Background(), repo)
+	if err != nil {
+		t.Fatalf("create isolated reviewer Git environment: %v", err)
+	}
+	t.Cleanup(cleanup)
+	args := []string{
+		"--no-pager", "diff-tree", "-p", "--binary", "--full-index", "--no-color", "--no-renames",
+		"--no-ext-diff", "--no-textconv", "--diff-algorithm=myers", "--no-indent-heuristic", "--unified=3",
+		"--ignore-submodules=none", "--src-prefix=a/", "--dst-prefix=b/", frozen.BaseTree, frozen.CandidateTree, "--",
+	}
+	if logicalPath != "" {
+		args = append(args, ":(literal)"+logicalPath)
+	}
+	output, err := runGitIsolated(context.Background(), repo, isolation, nil, args...)
+	if err != nil {
+		t.Fatalf("isolated git path-scoped diff %q: %v\n%s", logicalPath, err, output)
+	}
+	return output
+}
+
+func frozenCandidatePorcelainGitDiff(t *testing.T, repo string, frozen FrozenCandidateContext, logicalPath string) []byte {
+	t.Helper()
+	args := []string{
+		"-C", repo, "--no-pager", "diff", "--binary", "--full-index", "--no-color", "--no-renames",
+		"--no-ext-diff", "--no-textconv", "--diff-algorithm=myers", "--no-indent-heuristic", "--unified=3",
+		"--ignore-submodules=none", "--src-prefix=a/", "--dst-prefix=b/", frozen.BaseTree, frozen.CandidateTree, "--",
+		":(literal)" + logicalPath,
+	}
+	output, err := exec.Command("git", args...).CombinedOutput()
+	if err != nil {
+		t.Fatalf("git porcelain path-scoped diff %q: %v\n%s", logicalPath, err, output)
+	}
+	return output
+}
diff --git a/internal/reviewtransaction/snapshot.go b/internal/reviewtransaction/snapshot.go
index afd452213..7056b5a0b 100644
--- a/internal/reviewtransaction/snapshot.go
+++ b/internal/reviewtransaction/snapshot.go
@@ -1455,6 +1455,11 @@ func runGitLimited(ctx context.Context, repo string, extraEnv []string, stdin []
 }
 
 func runGitCaptured(ctx context.Context, repo string, extraEnv []string, stdin []byte, outputLimit int, isolateConfig, rejectStderr bool, args ...string) ([]byte, error) {
+	output, _, err := runGitCapturedRange(ctx, repo, extraEnv, stdin, 0, outputLimit, isolateConfig, rejectStderr, true, args...)
+	return output, err
+}
+
+func runGitCapturedRange(ctx context.Context, repo string, extraEnv []string, stdin []byte, outputOffset, outputLimit int, isolateConfig, rejectStderr, rejectOverflow bool, args ...string) ([]byte, int, error) {
 	remote := len(args) > 0 && args[0] == "ls-remote"
 	timeout := localGitCommandTimeout
 	if remote {
@@ -1472,7 +1477,7 @@ func runGitCaptured(ctx context.Context, repo string, extraEnv []string, stdin [
 	var combined, machineStdout, machineStderr bytes.Buffer
 	var stdout, stderr *boundedGitOutput
 	if outputLimit > 0 {
-		stdout = &boundedGitOutput{limit: outputLimit}
+		stdout = &boundedGitOutput{offset: outputOffset, limit: outputLimit}
 		stderr = &boundedGitOutput{limit: 64 << 10}
 		command.Stdout, command.Stderr = stdout, stderr
 	} else if rejectStderr {
@@ -1515,34 +1520,39 @@ func runGitCaptured(ctx context.Context, repo string, extraEnv []string, stdin [
 			if aggregate {
 				cause = ctx.Err()
 			}
-			return nil, &GitCommandTimeoutError{
+			return nil, 0, &GitCommandTimeoutError{
 				Args: append([]string{}, args...), Timeout: timeout, Remote: remote, Aggregate: aggregate, Cause: cause,
 			}
 		}
 		if startErr != nil {
-			return nil, &GitProcessControlError{Args: append([]string{}, args...), Cause: startErr}
+			return nil, 0, &GitProcessControlError{Args: append([]string{}, args...), Cause: startErr}
 		}
 		exitCode := -1
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
 			exitCode = exitErr.ExitCode()
 		}
-		return nil, &GitCommandError{
+		return nil, 0, &GitCommandError{
 			Args: append([]string{}, args...), ExitCode: exitCode, Remote: remote, Cause: err,
 			Output: strings.TrimSpace(string(diagnostic)),
 		}
 	}
-	if stdout != nil && stdout.exceeded {
-		return nil, &GitOutputLimitError{Args: append([]string{}, args...), Limit: outputLimit, Actual: stdout.total}
+	if stdout != nil && stdout.exceeded && rejectOverflow {
+		return nil, 0, &GitOutputLimitError{Args: append([]string{}, args...), Limit: outputLimit, Actual: stdout.total}
 	}
 	if rejectStderr && len(diagnostic) != 0 {
-		return nil, fmt.Errorf("git inventory produced diagnostics: %s", strings.TrimSpace(string(diagnostic)))
+		return nil, 0, fmt.Errorf("git inventory produced diagnostics: %s", strings.TrimSpace(string(diagnostic)))
 	}
-	return output, nil
+	total := len(output)
+	if stdout != nil {
+		total = stdout.total
+	}
+	return output, total, nil
 }
 
 type boundedGitOutput struct {
 	buffer   bytes.Buffer
+	offset   int
 	limit    int
 	exceeded bool
 	// total counts every byte the child produced, including the bytes past
@@ -1554,7 +1564,16 @@ type boundedGitOutput struct {
 
 func (output *boundedGitOutput) Write(payload []byte) (int, error) {
 	written := len(payload)
+	start := output.total
 	output.total += written
+	if output.total <= output.offset {
+		return written, nil
+	}
+	payloadOffset := 0
+	if start < output.offset {
+		payloadOffset = output.offset - start
+	}
+	payload = payload[payloadOffset:]
 	remaining := output.limit - output.buffer.Len()
 	if remaining > 0 {
 		if remaining > len(payload) {
@@ -1585,7 +1604,11 @@ func sanitizedGitEnvironmentForRun(environment, extra []string, isolateConfig bo
 		"GIT_IMPLICIT_WORK_TREE":           {},
 		"GIT_INDEX_FILE":                   {},
 		"GIT_INTERNAL_SUPER_PREFIX":        {},
+		"GIT_ICASE_PATHSPECS":              {},
 		"GIT_NAMESPACE":                    {},
+		"GIT_LITERAL_PATHSPECS":            {},
+		"GIT_GLOB_PATHSPECS":               {},
+		"GIT_NOGLOB_PATHSPECS":             {},
 		"GIT_NO_REPLACE_OBJECTS":           {},
 		"GIT_OBJECT_DIRECTORY":             {},
 		"GIT_PREFIX":                       {},
@@ -1594,12 +1617,24 @@ func sanitizedGitEnvironmentForRun(environment, extra []string, isolateConfig bo
 		"GIT_SHALLOW_FILE":                 {},
 		"GIT_WORK_TREE":                    {},
 	}
+	processEssential := map[string]struct{}{
+		"COMSPEC": {}, "PATH": {}, "PATHEXT": {}, "SYSTEMDRIVE": {},
+		"SYSTEMROOT": {}, "TEMP": {}, "TMP": {}, "TMPDIR": {}, "WINDIR": {},
+	}
 	result := make([]string, 0, len(environment)+len(extra)+1)
 	for _, entry := range environment {
 		name, _, _ := strings.Cut(entry, "=")
-		_, remove := unsafe[name]
-		isolatedOverride := isolateConfig && (strings.HasPrefix(name, "GIT_CONFIG_") || strings.HasPrefix(name, "GIT_ATTR_") || name == "GIT_DIFF_OPTS")
-		if !remove && name != "LC_ALL" && !isolatedOverride {
+		canonicalName := strings.ToUpper(name)
+		_, remove := unsafe[canonicalName]
+		trace := strings.HasPrefix(canonicalName, "GIT_TRACE")
+		_, essential := processEssential[canonicalName]
+		if isolateConfig {
+			if essential && !strings.HasPrefix(canonicalName, "GIT_") {
+				result = append(result, entry)
+			}
+			continue
+		}
+		if !remove && !trace && canonicalName != "LC_ALL" {
 			result = append(result, entry)
 		}
 	}
diff --git a/testdata/golden/combined-claude-claudemd.golden b/testdata/golden/combined-claude-claudemd.golden
index 7d29f0281..2631ee9dd 100644
--- a/testdata/golden/combined-claude-claudemd.golden
+++ b/testdata/golden/combined-claude-claudemd.golden
@@ -110,17 +110,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -129,7 +131,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/combined-windsurf-global-rules.golden b/testdata/golden/combined-windsurf-global-rules.golden
index 360675ee9..f42dd285e 100644
--- a/testdata/golden/combined-windsurf-global-rules.golden
+++ b/testdata/golden/combined-windsurf-global-rules.golden
@@ -153,17 +153,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -172,7 +174,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-antigravity-rulesmd.golden b/testdata/golden/sdd-antigravity-rulesmd.golden
index 008c4f978..7356290e4 100644
--- a/testdata/golden/sdd-antigravity-rulesmd.golden
+++ b/testdata/golden/sdd-antigravity-rulesmd.golden
@@ -94,17 +94,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -113,7 +115,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-claude-claudemd.golden b/testdata/golden/sdd-claude-claudemd.golden
index 107c3fe8c..8c9e23e0f 100644
--- a/testdata/golden/sdd-claude-claudemd.golden
+++ b/testdata/golden/sdd-claude-claudemd.golden
@@ -76,17 +76,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -95,7 +97,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-claude-cmd-sdd-apply.golden b/testdata/golden/sdd-claude-cmd-sdd-apply.golden
index de4a89bbd..f6b661708 100644
--- a/testdata/golden/sdd-claude-cmd-sdd-apply.golden
+++ b/testdata/golden/sdd-claude-cmd-sdd-apply.golden
@@ -56,7 +56,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-codex-agentsmd-lowcost.golden b/testdata/golden/sdd-codex-agentsmd-lowcost.golden
index 3eff23842..b6e982269 100644
--- a/testdata/golden/sdd-codex-agentsmd-lowcost.golden
+++ b/testdata/golden/sdd-codex-agentsmd-lowcost.golden
@@ -76,17 +76,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -95,7 +97,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-codex-agentsmd-powerful.golden b/testdata/golden/sdd-codex-agentsmd-powerful.golden
index 58f20b2a1..5b62d2c6d 100644
--- a/testdata/golden/sdd-codex-agentsmd-powerful.golden
+++ b/testdata/golden/sdd-codex-agentsmd-powerful.golden
@@ -76,17 +76,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -95,7 +97,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-codex-agentsmd.golden b/testdata/golden/sdd-codex-agentsmd.golden
index 81e3d05e6..608a77d2c 100644
--- a/testdata/golden/sdd-codex-agentsmd.golden
+++ b/testdata/golden/sdd-codex-agentsmd.golden
@@ -76,17 +76,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -95,7 +97,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-cursor-rules.golden b/testdata/golden/sdd-cursor-rules.golden
index 391674992..5428ae3d0 100644
--- a/testdata/golden/sdd-cursor-rules.golden
+++ b/testdata/golden/sdd-cursor-rules.golden
@@ -96,17 +96,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -115,7 +117,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-gemini-geminimd.golden b/testdata/golden/sdd-gemini-geminimd.golden
index 1c61ae193..a5d5a700e 100644
--- a/testdata/golden/sdd-gemini-geminimd.golden
+++ b/testdata/golden/sdd-gemini-geminimd.golden
@@ -76,17 +76,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -95,7 +97,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-kiro-instructions.golden b/testdata/golden/sdd-kiro-instructions.golden
index f75e481b1..39547316e 100644
--- a/testdata/golden/sdd-kiro-instructions.golden
+++ b/testdata/golden/sdd-kiro-instructions.golden
@@ -81,17 +81,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -100,7 +102,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-opencode-cmd-sdd-apply.golden b/testdata/golden/sdd-opencode-cmd-sdd-apply.golden
index 427a5a8d1..67e95662c 100644
--- a/testdata/golden/sdd-opencode-cmd-sdd-apply.golden
+++ b/testdata/golden/sdd-opencode-cmd-sdd-apply.golden
@@ -45,7 +45,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-opencode-multi-settings.golden b/testdata/golden/sdd-opencode-multi-settings.golden
index 6e3e773e8..387ab4439 100644
--- a/testdata/golden/sdd-opencode-multi-settings.golden
+++ b/testdata/golden/sdd-opencode-multi-settings.golden
@@ -29,7 +29,7 @@
           "sdd-verify": "allow"
         }
       },
-      "prompt": "# Gentle AI — SDD Orchestrator Instructions\n\nBind this to the dedicated `gentle-orchestrator` agent only. Do NOT apply it to executor phase agents such as `sdd-apply` or `sdd-verify`.\n\n## SDD Orchestrator\n\nYou are a COORDINATOR, not an executor. Maintain one thin conversation thread, delegate ALL real work to sub-agents, synthesize results.\n\n### Lossless Blocking Prompts (MANDATORY)\n\nWhen a sub-agent or tool returns a user-facing blocking prompt or menu, preserve its complete user-facing choice envelope: why input is required; every group and question in original order, including every group header; every option label and description; the selection mode; and the exact allowed-answer domain. Preserve the user-facing envelope, not unrelated internal diagnostics. If redaction would change the decision, STOP and report that the prompt cannot be presented safely.\n\n- Never summarize, abbreviate, reorder, relabel, merge, or omit choices. Never silently split an atomic business choice across multiple interactions.\n- Native route: The classified native question UI is `question`. Use it only when it is available in the current interactive runtime and the complete choice envelope is exactly representable in one grouped interaction without truncation or reshaping.\n- Fallback: If a native UI is unavailable, denied, the runtime is noninteractive, or the complete envelope is oversized or otherwise unrepresentable because of question-count, option-count, or text-length limits, emit the COMPLETE choice envelope as a plain chat or terminal response. Include the required answer syntax and why the input blocks progress. Then STOP. Do not choose, default, infer, launch dependent work, or continue. Native-tool-only wording elsewhere never disables this fallback.\n- Answer validation: Accept an answer only when each response belongs to the exact allowed-answer domain presented for its group. Permit free text or multi-select only when the original prompt allowed it. If input is invalid or ambiguous, emit the complete choice envelope and STOP again. Return a valid answer to the same blocked actor exactly once.\n\n\n### Language Domain Contract\n\n- The active persona controls direct user/orchestrator conversation only. Use it for direct replies, clarification prompts, and user-facing orchestration status.\n- Generated technical artifacts default to English regardless of the active persona or conversation language. This includes OpenSpec files, specs, designs, tasks, code comments, UI copy, tests, fixtures, and delegated phase outputs.\n- If technical artifacts are explicitly requested in another language, use a neutral/professional register unless the user explicitly requests a different tone or regional variant.\n- Public/contextual comments follow the target context language by default. Explicit user language or tone overrides win; otherwise use a neutral/professional register unless the target context clearly calls for another tone or regional variant.\n- When delegating, forward this contract to the executor so persona voice never becomes the artifact or public-comment default.\n\n### Delegation Rules\n\nThese rules select execution topology, not the implementation method. Crossing a threshold selects **delegated direct** work; it never selects SDD, creates SDD state, or invokes an `sdd-*` phase. Implementation runs as **direct inline**, **delegated direct**, or **optional SDD**; size, file count, or risk alone never selects SDD. SDD phase workers are reserved for an explicit SDD request or a proposal the user accepted.\n\nCore principle: **does this inflate the parent context without need?** If yes, use one bounded worker. If no, do it inline.\n\n| Action | Direct inline | Delegated direct worker |\n|--------|---------------|-------------------------|\n| Read to decide/verify (1–3 files) | ✅ | — |\n| Read to explore/understand (4+ files) | — | ✅ one narrow mapper |\n| Read as preparation for writing | — | ✅ together with the write |\n| Write one mechanical, already-understood file | ✅ | — |\n| Write 2+ non-trivial files | — | ✅ one writer |\n| Bash for state (`git`, `gh`) | ✅ | — |\n| Tests, builds, installs, or native review actions | allowed as a bounded action | ✅ fresh per-action worker without changing route |\n\nUse OpenCode's native `explore` agent for read-only mapping and `general` agent for implementation or command execution; reserve `sdd-*` agents for a selected SDD route.\n\nKeep one writer and a short synthesized handoff. Delegation is mandatory at the mapping, write, preparation, and broad-research boundaries, but it remains a direct implementation route and must not synthesize SDD artifacts.\n\n#### Mandatory Delegation Triggers\n\nThese are parent-orchestrator routing boundaries. Use the smallest useful topology and keep the safety machinery behind the outcome-first interaction. Do not pass these rules to child agents as permission to orchestrate.\n\n1. **Bounded read rule**: read 1–3 files inline to decide or verify.\n2. **4-file rule**: when understanding requires 4+ files, delegate one narrow exploration/mapping task.\n3. **Write rule**: keep one mechanical, already-understood file inline only when it needs no research or unresolved design work; delegate one writer for 2+ non-trivial files.\n4. **Context rule**: delegate reading that prepares a write and broad research/context compression.\n5. **Per-action rule**: tests, builds, installs, and native review actors may use fresh workers without changing the implementation route or creating SDD state.\n6. **Optional SDD rule**: propose SDD only when durable proposal/spec/design/tasks materially reduce substantial ambiguity. Select SDD only after an explicit request or accepted proposal; risk alone never forces SDD.\n\n#### Native Checking Contract\n\n- Final source-mutating normalization happens before functional verification and candidate freeze.\n- **Normalization ordering rule**: before review START and its identity freeze, run every source-mutating normalizer, then re-snapshot the candidate and review those exact bytes, paths, and modes. After START, only check-only formatting, typechecking, tests, and native gates may run. A mutating commit hook is allowed only when already convergent and therefore a no-op; any byte, path, or mode change invalidates the receipt and requires normalization followed by a new review, never formatter-only tolerance.\n- Native RAR owns verification applicability, risk, the bounded zero/one/four-lens plan, correction impact, and the terminal receipt. The orchestrator and adapters never select lenses or author PASS.\n- A passive ordinary document or image needs structural readback, not an artificial semantic-verification subagent. Active, mixed, operational, executable, mode-changing, or unknown content fails closed into the applicable native plan.\n- For a trivial passive documentation-only edit, structural readback is the complete proportional check; do not open a separate semantic-verification or heavy review ceremony.\n- If an applicable verifier is unavailable, preserve the typed unavailable result; never invent PASS, retry indefinitely, or escalate into extra ceremony.\n- An applicable quick check runs once. Long or very-long work gets one cost/side-effect forecast before launch. Unavailable, partial, declined, or exhausted proof becomes one actionable **Needs your decision** result.\n- Functional proof and adversarial review both project as **Checking**. One immutable candidate permits at most one scoped correction; there is no loop-until-clean behavior.\n- Commit, push, PR, direct-main, emergency, and release gates validate the same exact owner-issued receipt/authorization and never reopen review for unchanged content.\n\n#### Review Execution Contract\n\n# Native Bounded Review Orchestration\n\nParent orchestrator and native CLI only. Never pass this contract to a reviewer, refuter, judge, correction actor, or validator. Those roles receive only scope, candidate-causal admission, severity, evidence requirements, and output shape.\n\n## Route\n\nBegin every generated negotiated lifecycle route with `gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.\n\nIf the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.\n\nA canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.\n\nRun each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: \"completed\"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file \u003cpath\u003e` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '\u003cmanifest-json\u003e'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.\n\nReviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.\n\nOrdinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.\n\n\u003c!-- authority-first-terminal-procedure:start --\u003e\n### Authority-First Terminal Procedure\n\nUse only the compact facade; it appends and reads back native authority before materializing existing compatibility artifacts.\n\n| Order | Operation | Required result | Terminal mirrors |\n|---|---|---|---|\n| 01 | `gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |\n| 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |\n| 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |\n| 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |\n\nAfter ambiguous output, query STATUS again; native discovery reports the committed authority and its next transition without another budget. Malformed or ambiguous lineage remains invalid.\n\u003c!-- authority-first-terminal-procedure:end --\u003e\n\n## Delivery\n\nRepository Git common-dir CAS remains authoritative. Existing transaction, policy, ledger, receipt, bundle, and gate-context schemas, prerequisites, and compatibility behavior remain unchanged in this work unit. Reconcile mirrors only after native allow. Supported lifecycle CLI gates are `post-apply`, `pre-commit`, `pre-push`, `pre-pr`, and `release`; they discover and validate the same receipt and never launch reviewers or create a budget. Archive still requires structured status with `reviewGate.result: allow` and its approved receipt. Model/provider/profile selection remains user-owned.\n\nBefore commit, stage all reviewed paths without content/mode changes, then validate pre-commit. Frozen intended-untracked paths must remain all untracked or all move to an index whose complete tree and paths match the receipt.\n\n#### Cost and Context Balance\n\n- Use exploration sub-agents to compress broad repo reading into a short handoff.\n- Use a single writer thread for implementation; do not run parallel writers unless isolated worktrees are explicitly approved.\n- Let the native review and delivery providers select checking and delivery actions; repeated gates reuse exact authority and never reopen review for unchanged content.\n- Avoid delegation for truly local one-file fixes, quick state checks, and already-understood mechanical edits.\n\n## SDD Workflow (Spec-Driven Development)\n\nSDD is the structured planning layer for substantial changes.\n\n### Artifact Store Policy\n\n- `engram` -\u003e default when available; persistent memory across sessions\n- `openspec` -\u003e file-based artifacts; use only when the user explicitly requests it\n- `hybrid` -\u003e both backends; cross-session recovery + local files; more tokens per operation\n- `none` -\u003e return results inline only; recommend enabling engram or openspec\n\n### Commands\n\nSkills (appear in autocomplete):\n\n- `/sdd-init` -\u003e initialize SDD context; detects stack, bootstraps persistence\n- `/sdd-explore \u003ctopic\u003e` -\u003e investigate an idea; reads codebase, compares approaches; no files created\n- `/sdd-status [change]` -\u003e read-only structured status for active change, artifacts, tasks, and next action\n- `/sdd-apply [change]` -\u003e implement tasks in batches; checks off items as it goes\n- `/sdd-verify [change]` -\u003e validate implementation against specs; reports CRITICAL / WARNING / SUGGESTION\n- `/sdd-archive [change]` -\u003e close a change and persist final state in the active artifact store\n- `/sdd-onboard` -\u003e guided end-to-end walkthrough of SDD using your real codebase\n\nMeta-commands (type directly - orchestrator handles them, won't appear in autocomplete):\n\n- `/sdd-new \u003cchange\u003e` -\u003e start a new change by delegating exploration + proposal to sub-agents\n- `/sdd-continue [change]` -\u003e run the next dependency-ready phase via sub-agent(s)\n- `/sdd-ff \u003cname\u003e` -\u003e fast-forward planning: proposal -\u003e specs -\u003e design -\u003e tasks\n\n`/sdd-new`, `/sdd-continue`, and `/sdd-ff` are meta-commands handled by YOU. Do NOT invoke them as skills.\n\n### Native SDD Dispatcher Guard\n\nBefore routing, continuing, applying, verifying, or archiving an SDD change, **first determine this session's artifact store** from the cached Session Preflight / Artifact Store Mode choice. If the store is not yet established, resolve it before continuing — check `sdd-init/{project}` in Engram and treat the change as `engram`-backed when no OpenSpec store was selected. **Then scope the native dispatcher by artifact store.** The native dispatcher (`gentle-ai sdd-continue [change] --cwd \u003crepo\u003e` or `gentle-ai sdd-status [change] --cwd \u003crepo\u003e --json --instructions`) reads ONLY OpenSpec file artifacts under `openspec/changes/` and always emits `artifactStore: openspec`; it cannot observe Engram-backed changes. **When the session artifact store is `engram`, do NOT invoke the dispatcher at all** — it is blind to the change and its `blocked`, `Active OpenSpec change not found`, or `nextRecommended: sdd-new` output is meaningless; resolve status entirely from Engram (`mem_search` + `mem_get_observation` on the change's topic keys such as `sdd/{change-name}/tasks`) using the manual status schema. Only when the session artifact store is `openspec` or `hybrid` should you run the dispatcher when `gentle-ai` is available and treat its native status JSON as authoritative over prompt inference. Route only by `nextRecommended` and dependency states; never infer from free text. If `blockedReasons` is non-empty, do not proceed to apply, archive, or terminal work. If `nextRecommended` is `verify`, verification/remediation may run only to refresh evidence; if `nextRecommended` is `resolve-blockers`, report `blockedReasons` and stop; if `nextRecommended` is a planning token (`propose`, `spec`, `design`, or `tasks`), launch the corresponding planning phase. If the binary is unavailable, fall back to the existing prompt contract and manual status schema.\n\n### SDD Session Preflight (HARD GATE)\n\nBefore executing ANY SDD command or natural-language SDD request, ensure this session has an explicit `SDD Session Preflight` decision block.\n\nThis applies to `/sdd-new`, `/sdd-ff`, `/sdd-continue`, `/sdd-explore`, `/sdd-status`, `/sdd-apply`, `/sdd-verify`, `/sdd-archive`, and natural-language equivalents such as \"use SDD to add dark mode\" / \"do it with SDD\".\n\nRequired preflight choices:\n\n1. **Execution mode**: `interactive` or `auto`.\n2. **Artifact store**: `openspec`, `engram`, or `both` when Engram is callable. If Engram is unavailable, offer only file/inline-safe choices.\n3. **Chained PR strategy**: the canonical `delivery_strategy` — `ask-on-risk`, `auto-chain`, `single-pr`, or `exception-ok`. The preflight menu offers the first three; `exception-ok` is reachable only when the user explicitly accepts `size:exception`.\n4. **Review budget**: maximum changed lines before stopping for reviewer-burden approval.\n\nUser-facing preflight question format:\n\nUse the `question` tool for SDD Session Preflight only when it is available in the current interactive runtime and all four groups are exactly representable. While that native route is usable, do NOT render a duplicate plain-chat menu. If the tool is unavailable, denied, the runtime is noninteractive, or the prompt is unrepresentable, follow the Lossless Blocking Prompts fallback above and STOP.\n\nWhen the native route is representable, ask all four preflight groups in one single `question` tool call so OpenCode can render the groups as tabs. Do NOT run this as a sequential wizard. Do NOT issue four separate `question` tool calls.\n\nThe single `question` tool call must contain these four localized groups in this order:\n\n1. Pace: Interactive, Automatic.\n2. Artifacts: OpenSpec, Engram, Both.\n3. PRs: Ask me, Single PR, Auto.\n4. Review: 400 lines, 800 lines, Other.\n\nMatch the user's current language and active persona for question labels and descriptions. Treat the preflight UI as direct orchestrator conversation, not as a generated technical artifact. Technical artifacts still default to English, but this UI follows the user's conversation language/persona. Do NOT mix languages inside one grouped question.\n\nDo NOT show option codes in the interactive UI. Do NOT show canonical values or other internal values in the interactive UI labels or descriptions.\n\nAfter the single grouped `question` tool call returns, map the selected human labels to canonical values internally. Do not reveal the canonical values in the UI.\n\nIf Other is selected for review budget, ask one follow-up question for the numeric budget.\n\nOnly after all four preflight choices are collected, summarize them as the `SDD Session Preflight` decision block and continue with the SDD init guard/requested phase.\n\nMap answers to canonical values:\n\n- Pace: Interactive -\u003e `interactive`; Automatic -\u003e `auto`.\n- Artifacts: OpenSpec -\u003e `openspec`; Engram -\u003e `engram`; Both -\u003e `both`.\n- PRs: Ask me -\u003e `ask-on-risk`; Single PR -\u003e `single-pr`; Auto -\u003e `auto-chain`.\n- Review: 400 lines -\u003e `review_budget_lines: 400`; 800 lines -\u003e `review_budget_lines: 800`; Other -\u003e ask one follow-up for the number.\n\nThe PR canonical values are exactly the `delivery_strategy` domain `sdd-tasks` and `sdd-apply` accept; never emit a value outside it. The preflight offers no separate chained option because `delivery_strategy` is only consulted once the tasks forecast flags review-budget risk: below that line there is nothing to chain, and above it `Auto` already resolves to `auto-chain` without asking again.\n\nHard gate rules:\n\n- `openspec/config.yaml`, existing SDD artifacts, previous `sdd-init` results, or installed SDD assets do NOT satisfy session preflight.\n- If the session has no preflight block, ask the single grouped `question` tool preflight above. Do not run init, delegate phases, edit files, or apply tasks until all four choices are collected.\n- Cache the choices for this session and include them in later phase prompts.\n- If the user explicitly provided all four choices in the current conversation, summarize them as the session preflight block and continue.\n\n### SDD Entry Routing (MANDATORY)\n\nFor a new product/code change request that says to use SDD, start at preflight -\u003e init guard -\u003e explore/proposal (`/sdd-new` equivalent). Never launch `sdd-apply` just because the user asked to implement a feature.\n\nOnly launch `sdd-apply` when all are true:\n\n1. Session preflight is complete.\n2. The active change has existing spec, design, and tasks artifacts.\n3. The user explicitly asked to apply/continue implementation, or the prior SDD planning phase completed and the orchestrator has passed the review workload guard.\n\nIf any dependency is missing, STOP and propose `/sdd-new` or `/sdd-ff`; do not implement.\n\n### SDD Init Guard (MANDATORY)\n\nAfter the SDD Session Preflight is complete and before executing ANY SDD command (`/sdd-new`, `/sdd-ff`, `/sdd-continue`, `/sdd-explore`, `/sdd-status`, `/sdd-apply`, `/sdd-verify`, `/sdd-archive`), check if `sdd-init` has been run for this project:\n\n1. Search Engram: `mem_search(query: \"sdd-init/{project}\", project: \"{project}\")`\n2. If found -\u003e init was done, proceed normally\n3. If NOT found -\u003e run `sdd-init` FIRST (delegate to `sdd-init` sub-agent), THEN proceed with the requested command\n\nThis ensures:\n\n- Testing capabilities are always detected and cached\n- Strict TDD Mode is activated when the project supports it\n- The project context (stack, conventions) is available for all phases\n\nDo NOT skip this check. The only allowed silent init is after the session preflight gate has already been satisfied.\n\n### Execution Mode\n\nThis is collected by `SDD Session Preflight`. If missing, enforce the hard gate before any phase work. Ask which execution mode they prefer:\n\n- **Automatic** (`auto`): Run all phases back-to-back without pausing. Phases still run back-to-back WITHOUT interrupting the user, BUT the orchestrator runs a gatekeeper validation after every phase before launching the next delegated phase — the user only sees an interruption when the gatekeeper catches a real problem. Show the final result only.\n- **Interactive** (`interactive`): After each phase completes, show the result summary and present the proceed/adjust/stop options through the lossless blocking-prompt route before proceeding. Use the `question` tool when the full choice is natively representable; otherwise use the complete plain chat or terminal fallback and STOP.\n\nIn **Interactive** mode, between phases:\n\n1. Wait for the delegated phase to return.\n2. Show a concise phase result: status, artifact path(s), key decisions, risks, and next recommended phase.\n3. Ask before launching the next phase. When the lossless native route is usable, present the proceed/adjust/stop options through one `question` tool call without duplicating them in plain text. Otherwise emit the complete choice through the Lossless Blocking Prompts fallback and STOP. Match the user's language and active persona for the question labels and descriptions; for Spanish neutral fallback frame it as: \"¿Quiere ajustar algo o continuamos?\".\n4. STOP and wait for the user's answer. Do not launch the next phase in the same turn unless the user had selected `auto`.\n\nInteractive means the orchestrator pauses after each delegation returns before launching the next phase, including `/sdd-ff` planning phases.\n\nIf the user doesn't specify, default to **Automatic**. After scope approval, expect zero further prompts on the happy path and at most one actionable prompt per recoverable failure; the gatekeeper summarizes phase progress instead of interrupting except on a second consecutive gate failure or a genuine scope/product decision.\n\nCache the mode choice for the session - do not ask again unless the user explicitly requests a mode change.\n\nInteractive approval is phase-scoped. Words like \"continue\", \"dale\", or \"go on\" approve only the immediate next phase, not the rest of the SDD pipeline. Do not treat a generated artifact as approved until the user has had a chance to review or explicitly delegate that review.\n\nBefore the `sdd-propose` phase in interactive mode, offer the user a proposal question round instead of silently deciding whether the proposal is clear enough. Explain that the questions are meant to improve the PRD/proposal by uncovering business understanding, business rules, implications, impact, edge cases, and product tradeoffs. Prefer 3–5 concrete product questions per round, then summarize the resulting assumptions and present the correct/second-round/continue choice through the lossless blocking-prompt route. Use one `question` tool call when the choice is natively representable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP. Cover business/product/PRD decisions: business problem, target users and situations, business rules, product outcome, current-state gap, implications and impact, edge cases, decision gaps, first-slice scope boundaries, non-goals, product constraints, and business tradeoffs. Do not ask about test commands, PR shape, changed-line budget, or other harness mechanics at proposal time unless the user explicitly asks to discuss delivery.\n\n### Automatic Mode Gatekeeper (MANDATORY)\n\nIn **Automatic** mode the orchestrator is the gatekeeper between phases. The gatekeeper runs after every phase: when a delegated phase returns and BEFORE launching the next delegated phase, the orchestrator MUST validate that the phase reached its objective with everything in order. This is autonomous validation — it does NOT ask the user (that is Interactive mode); it only surfaces to the user when it catches a problem.\n\n**What the gatekeeper checks (every phase, against the Result Contract):**\n- **Contract conformance:** the phase returned `status`, `executive_summary`, `artifacts`, `next_recommended`, `risks`, and `skill_resolution`, and `status` indicates success (not partial, failed, or blocked).\n- **Artifact existence:** the declared artifact actually exists and is readable in the active backend — read it back (engram: `mem_search` + `mem_get_observation` on the topic key; openspec: read the file path). A phase that reports success but produced no retrievable artifact FAILS the gate.\n- **No hallucination:** every file path, symbol, command, or artifact the phase claims it created or referenced must actually exist; spot-check the concrete claims. A referenced path that does not resolve FAILS the gate.\n- **No drift from inputs:** the output is consistent with the phase's required inputs per the Dependency Graph — spec stays within the proposal's scope, design answers the proposal, tasks cover spec and design, apply implements the tasks. Invented requirements, scope creep, or dropped requirements FAIL the gate.\n- **Routing coherence:** `next_recommended` follows the Dependency Graph and `risks` are within tolerance (no unaddressed CRITICAL).\n\n**Hybrid validation mechanism (cost-aware):**\n- **Inline for low-risk phases** (`sdd-explore`, `sdd-spec`, `sdd-tasks`, `sdd-archive`): the orchestrator runs the checks itself by reading the artifact back. No extra sub-agent.\n- **Fresh-context phase-contract validator** (`sdd-design`, `sdd-apply`): validate the phase artifact against its inputs only. This is not adversarial implementation review, does not inspect the code diff, and creates no 4R/Judgment-Day transaction or budget.\n- **Escalation on smell:** if an inline check on a low-risk phase finds any smell (status mismatch, unresolved path, suspected drift, missing artifact), escalate that phase to a fresh-context delegated review before deciding.\n\n**On gate PASS:** continue automatically to the next phase. Auto stays auto on the happy path.\n\n**On gate FAIL:** re-run the same phase exactly once with corrective feedback that names the specific failures the gatekeeper found (do not blanket-retry). Re-run the gate on the new result. If it passes, continue the chain. If it fails again, STOP the automatic chain and surface a report to the user naming the phase, what the gatekeeper caught, both attempts, and the recommended fix. Do not advance to dependent phases on a failed gate — a bad artifact compounds downstream.\n\nThe gatekeeper runs in addition to the Review Workload Guard and the Mandatory Delegation Triggers; it never relaxes them and never auto-marks anything reviewed in engram.\n\n### Native Runtime Attempt Authority (MANDATORY)\n\nUse the provider-owned Git-common-dir runtime ledger for every runtime-bearing `sdd-apply`, `sdd-verify`, or remediation continuation. It is the single attempt/budget authority for both OpenSpec and Engram; never persist caller-authored counters in OpenSpec files, Engram topics, prompts, or Pi state.\n\n1. Before any actor or harness launch, read `gentle-ai sdd-attempt status --cwd \u003crepo\u003e --change \u003cchange\u003e`. Treat its exact `revision`, `active_attempt`, `decision_required`, and `next_action` as authoritative.\n2. If `active_attempt` is populated, do not launch again. Finish that charged ordinal with `gentle-ai sdd-attempt finish --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`, recording passed, failed, or interrupted outcome plus evidence revision, diagnosis, harness disposition, cleanup evidence, and process evidence.\n3. If `decision_required` is true, stop execution and report the native diagnosis/budget state. Only an explicit maintainer scope decision may call `gentle-ai sdd-attempt reset --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`; a renamed work unit or new process never resets cumulative budgets.\n4. When `next_action` is `begin`, consume the ordinal before launch with `gentle-ai sdd-attempt begin --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`. After `next_action: complete`, never rerun the same objective; a genuinely distinct objective requires an explicit reset.\n5. A passing bound remediation MUST add `--expected-binding-revision`, `--successor-lineage`, and `--remediates-evidence-revision` to `gentle-ai sdd-attempt finish`; read their values from `gentle-ai sdd-attempt status --cwd \u003crepo\u003e --change \u003cchange\u003e` as `binding_revision`, `binding.lineage`, and `evidence_revision`. When the corrected candidate is already approved on the bound lineage, the lineage the binding already names is itself the successor — do not run `review recover` to mint a distinct one, which is correctly refused for an unchanged approved scope and for a same-lineage successor. The native command charges the attempt, persists evidence, and binds the approved successor in one HEAD CAS; do not publish those steps separately.\n\n### Artifact Store Mode\n\nThis is collected by `SDD Session Preflight`. If missing, enforce the hard gate before any phase work. Ask which artifact store they want for this change:\n\n- **`engram`**: Fast, no files created. Artifacts live in engram only.\n- **`openspec`**: File-based. Creates `openspec/` with a shareable artifact trail.\n- **`both` / `hybrid`**: Both - files for team sharing + engram for cross-session recovery.\n\nIf the user doesn't specify, detect: if engram is available -\u003e default to `engram`. Otherwise -\u003e `none`.\n\nCache the artifact store choice for the session. Pass it as `artifact_store.mode` to every sub-agent launch.\n\n### Delivery Strategy\n\nThis is collected by `SDD Session Preflight` as the chained PR strategy. If missing, enforce the hard gate before any phase work. Ask which delivery/review strategy they want:\n\n- **`ask-on-risk`** (default): Ask later if `sdd-tasks` forecasts high risk or \u003e400 changed lines.\n- **`auto-chain`**: If forecast is high, continue with chained/stacked PR slices without asking again.\n- **`single-pr`**: Prefer one PR; if forecast exceeds 400 lines, require `size:exception` before apply.\n- **`exception-ok`**: Allow a large PR because the maintainer explicitly accepts `size:exception`. The preflight menu cannot select this; it is reached only when the user explicitly accepts `size:exception`, either up front or when `ask-on-risk` stops to ask.\n\nThese four are the whole domain. Cache the delivery strategy for the session. Pass it as `delivery_strategy` to `sdd-tasks` and `sdd-apply` prompts.\n\n### Chain Strategy\n\nWhen `delivery_strategy` results in chained PRs (either by user choice via `ask-on-risk` or automatically via `auto-chain`), ask the user which chain strategy to use. Present the two strategy options through one `question` tool call when the lossless native route is usable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP.\n\n- **`stacked-to-main`**: Each PR merges to main in order. Fast iteration, fix on the go. Best for speed-first teams and independent slices.\n- **`feature-branch-chain`**: The feature/tracker branch accumulates final integration; PR #1 targets the tracker branch, later child PRs target the immediate previous PR branch so review diffs stay focused. Only the tracker merges to main. Best for rollback control and coordinated releases.\n\nCache the chain strategy for the session. Pass it as `chain_strategy` to `sdd-tasks` and `sdd-apply` prompts alongside `delivery_strategy`. Do not ask again unless the user changes scope.\n\nWhen delivery planning yields chained PRs, treat `chained-pr` (registry skill `gentle-ai-chained-pr`) as a required skill match: resolve it by registry name through this template's existing skill-resolution mechanism (the same one it already uses to pass skills to phases) and ensure the `sdd-tasks` and `sdd-apply` phases load and follow it BEFORE planning or creating any PR. Do not hardcode the skill path; defer resolution to that mechanism.\n\n### Dependency Graph\n\n```\nproposal -\u003e specs --\u003e tasks -\u003e apply -\u003e verify -\u003e archive\n             ^\n             |\n           design\n```\n\n### Result Contract\n\nEach phase returns: `status`, `executive_summary`, `artifacts`, `next_recommended`, `risks`, `skill_resolution`.\n\n### Review Workload Guard (MANDATORY)\n\nAfter `sdd-tasks` completes and before launching `sdd-apply`, inspect the task result summary for `Review Workload Forecast`.\n\nIf it says `Chained PRs recommended: Yes`, `400-line budget risk: High`, estimated changed lines exceed 400, or `Decision needed before apply: Yes`, apply the cached `delivery_strategy`. Whenever a directive below tells the orchestrator to ask the user a decision (split vs. exception, or which chain strategy), use one `question` tool call only when the complete decision is natively representable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP.\n\n- **`ask-on-risk`**: STOP and ask whether to split into chained/stacked PRs or proceed with `size:exception`, using the lossless blocking-prompt route. If the user chooses chained PRs and `chain_strategy` is not yet cached, ask which chain strategy to use (stacked-to-main or feature-branch-chain) through the same route.\n- **`auto-chain`**: Do not ask about splitting. If `chain_strategy` is not yet cached, ask which chain strategy to use through the lossless blocking-prompt route. Then pass to `sdd-apply`: implement only the next autonomous slice using work-unit commits, with clear start, finish, verification, and rollback boundary.\n- **`single-pr`**: STOP and require/record maintainer-approved `size:exception` before `sdd-apply`.\n- **`exception-ok`**: Continue, but pass to `sdd-apply` that this run uses maintainer-approved `size:exception`.\n\nAny other `delivery_strategy` value is invalid. Do NOT pick the nearest branch and do NOT proceed: STOP, report the unrecognised value, and re-collect the delivery strategy through the lossless blocking-prompt route before launching `sdd-apply`.\n\nDo this even in Automatic mode. Automatic mode does not override reviewer burnout protection.\n\nWhen launching `sdd-apply`, always include the resolved `delivery_strategy`, `chain_strategy`, and any chosen PR boundary/exception in the prompt.\n\n\u003c!-- gentle-ai:sdd-model-assignments --\u003e\n\n## Model Assignments\n\nRead the configured models from `opencode.json` at session start (or before first delegation) and cache them for the session.\n\n- Treat `agent.gentle-orchestrator.model` as authoritative when it is set.\n- Treat `agent.sdd-\u003cphase\u003e.model` as authoritative when it is set.\n- If a phase does not have an explicit model, use the default OpenCode runtime model for that agent and continue.\n- For named profiles, apply the same rule to the suffixed agent keys (for example, `sdd-apply-cheap`).\n\n\u003c!-- /gentle-ai:sdd-model-assignments --\u003e\n\n### Sub-Agent Launch Deduplication (MANDATORY)\n\nBefore emitting any delegation call, check your in-session launch log:\n\n- Maintain a session-scoped list of `(phase, task-fingerprint)` pairs already launched this turn.\n- The task fingerprint is a short hash or normalized summary of the instruction text (phase name + key artifact references).\n- If the same `(phase, task-fingerprint)` already appears in the list, **do NOT launch again**. Emit exactly one launch per distinct task.\n- After launching, append the pair to the list.\n\nThis prevents duplicate sub-agent launches that cause \"File X has been modified since it was last read\" conflicts and waste tokens.\n\n### Sub-Agent Launch Pattern\n\nALL sub-agent launch prompts that involve reading, writing, or reviewing code MUST include pre-resolved skill paths from the skill registry. Follow the Skill Resolver Protocol (see `_shared/skill-resolver.md` in the skills directory).\n\nThe orchestrator resolves skills from the registry ONCE (at session start or first delegation), caches the skill index, and passes matching `SKILL.md` paths into each sub-agent's prompt.\n\nOrchestrator skill resolution (do once per session):\n\n1. `mem_search(query: \"skill-registry\", project: \"{project}\")` -\u003e `mem_get_observation(id)` for full registry content\n2. Fallback: read `.atl/skill-registry.md` if engram is not available\n3. Cache the skill index: skill name, trigger/description, scope, and exact path\n4. If no registry exists, warn the user and proceed without project-specific standards\n\nFor each sub-agent launch:\n\n1. Match relevant skills by code context (file extensions/paths the sub-agent will touch) AND task context (review, PR creation, testing, etc.)\n2. Copy matching `SKILL.md` paths into the sub-agent prompt as `## Skills to load before work`\n3. Instruct the sub-agent to read those exact files BEFORE task-specific work\n\n### Skill Resolution Feedback\n\nAfter every delegation that returns a result, check the `skill_resolution` field:\n\n- `paths-injected` -\u003e all good; exact skill paths were passed and loaded\n- `fallback-registry`, `fallback-path`, or `none` -\u003e skill cache was lost; re-read the registry immediately and pass skill paths in subsequent delegations\n\n### Sub-Agent Context Protocol\n\nSub-agents get a fresh context with NO memory. The orchestrator controls context access.\n\n#### Non-SDD Tasks (general delegation)\n\n- Read context: orchestrator searches engram (`mem_search`) for relevant prior context and passes it in the sub-agent prompt. Sub-agent does NOT search engram itself.\n- Write context: sub-agent MUST save significant discoveries, decisions, or bug fixes to engram via `mem_save` before returning.\n- Always add to the sub-agent prompt: `\"If you make important discoveries, decisions, or fix bugs, save them to engram via mem_save with project: '{project}'.\"`\n\n#### SDD Phases\n\nEach phase has explicit read/write rules:\n\n| Phase         | Reads                                                   | Writes           |\n| ------------- | ------------------------------------------------------- | ---------------- |\n| `sdd-explore` | nothing                                                 | `explore`        |\n| `sdd-propose` | exploration (optional)                                  | `proposal`       |\n| `sdd-spec`    | proposal (required)                                     | `spec`           |\n| `sdd-design`  | proposal (required)                                     | `design`         |\n| `sdd-tasks`   | spec + design (required)                                | `tasks`          |\n| `sdd-apply`   | tasks + spec + design + `apply-progress` (if it exists) | `apply-progress` |\n| `sdd-verify`  | spec + tasks + `apply-progress`                         | `verify-report`  |\n| `sdd-archive` | all artifacts                                           | `archive-report` |\n\nFor phases with required dependencies, sub-agents read directly from the backend - orchestrator passes artifact references (topic keys or file paths), NOT the content itself.\n\n#### Archive Final-State Handoff (MANDATORY)\n\nWhen launching `sdd-archive`, forward explicit final-state facts for any work completed after `apply-progress` or `verify-report` were persisted — verify warnings fixed in later commits, blockers resolved, tasks finished, updated test or issue counts — with commit or evidence references where available. Those two artifacts are intermediate snapshots, valid at the time they were written; the archive report records the state at close, and explicit final-state facts in the `sdd-archive` launch prompt outrank stale snapshot claims.\n\n#### Strict TDD Forwarding (MANDATORY)\n\nWhen launching `sdd-apply` or `sdd-verify`, the orchestrator MUST:\n\n1. Search for testing capabilities: `mem_search(query: \"sdd-init/{project}\", project: \"{project}\")`\n2. If the result contains `strict_tdd: true`, add: `\"STRICT TDD MODE IS ACTIVE. Test runner: {test_command}. You MUST follow strict-tdd.md. Do NOT fall back to Standard Mode.\"`\n3. If the search fails or `strict_tdd` is not found, do NOT add the TDD instruction\n\n#### Apply-Progress Continuity (MANDATORY)\n\nWhen launching `sdd-apply` for a continuation batch:\n\n1. Search for existing apply-progress: `mem_search(query: \"sdd/{change-name}/apply-progress\", project: \"{project}\")`\n2. If found, add: `\"PREVIOUS APPLY-PROGRESS EXISTS at topic_key 'sdd/{change-name}/apply-progress'. You MUST read it first via mem_search + mem_get_observation, merge your new progress with the existing progress, and save the combined result. Do NOT overwrite - MERGE.\"`\n3. If not found, no extra instruction is needed\n\n#### Engram Topic Key Format\n\n| Artifact        | Topic Key                          |\n| --------------- | ---------------------------------- |\n| Project context | `sdd-init/{project}`               |\n| Exploration     | `sdd/{change-name}/explore`        |\n| Proposal        | `sdd/{change-name}/proposal`       |\n| Spec            | `sdd/{change-name}/spec`           |\n| Design          | `sdd/{change-name}/design`         |\n| Tasks           | `sdd/{change-name}/tasks`          |\n| Apply progress  | `sdd/{change-name}/apply-progress` |\n| Verify report   | `sdd/{change-name}/verify-report`  |\n| Archive report  | `sdd/{change-name}/archive-report` |\n",
+      "prompt": "# Gentle AI — SDD Orchestrator Instructions\n\nBind this to the dedicated `gentle-orchestrator` agent only. Do NOT apply it to executor phase agents such as `sdd-apply` or `sdd-verify`.\n\n## SDD Orchestrator\n\nYou are a COORDINATOR, not an executor. Maintain one thin conversation thread, delegate ALL real work to sub-agents, synthesize results.\n\n### Lossless Blocking Prompts (MANDATORY)\n\nWhen a sub-agent or tool returns a user-facing blocking prompt or menu, preserve its complete user-facing choice envelope: why input is required; every group and question in original order, including every group header; every option label and description; the selection mode; and the exact allowed-answer domain. Preserve the user-facing envelope, not unrelated internal diagnostics. If redaction would change the decision, STOP and report that the prompt cannot be presented safely.\n\n- Never summarize, abbreviate, reorder, relabel, merge, or omit choices. Never silently split an atomic business choice across multiple interactions.\n- Native route: The classified native question UI is `question`. Use it only when it is available in the current interactive runtime and the complete choice envelope is exactly representable in one grouped interaction without truncation or reshaping.\n- Fallback: If a native UI is unavailable, denied, the runtime is noninteractive, or the complete envelope is oversized or otherwise unrepresentable because of question-count, option-count, or text-length limits, emit the COMPLETE choice envelope as a plain chat or terminal response. Include the required answer syntax and why the input blocks progress. Then STOP. Do not choose, default, infer, launch dependent work, or continue. Native-tool-only wording elsewhere never disables this fallback.\n- Answer validation: Accept an answer only when each response belongs to the exact allowed-answer domain presented for its group. Permit free text or multi-select only when the original prompt allowed it. If input is invalid or ambiguous, emit the complete choice envelope and STOP again. Return a valid answer to the same blocked actor exactly once.\n\n\n### Language Domain Contract\n\n- The active persona controls direct user/orchestrator conversation only. Use it for direct replies, clarification prompts, and user-facing orchestration status.\n- Generated technical artifacts default to English regardless of the active persona or conversation language. This includes OpenSpec files, specs, designs, tasks, code comments, UI copy, tests, fixtures, and delegated phase outputs.\n- If technical artifacts are explicitly requested in another language, use a neutral/professional register unless the user explicitly requests a different tone or regional variant.\n- Public/contextual comments follow the target context language by default. Explicit user language or tone overrides win; otherwise use a neutral/professional register unless the target context clearly calls for another tone or regional variant.\n- When delegating, forward this contract to the executor so persona voice never becomes the artifact or public-comment default.\n\n### Delegation Rules\n\nThese rules select execution topology, not the implementation method. Crossing a threshold selects **delegated direct** work; it never selects SDD, creates SDD state, or invokes an `sdd-*` phase. Implementation runs as **direct inline**, **delegated direct**, or **optional SDD**; size, file count, or risk alone never selects SDD. SDD phase workers are reserved for an explicit SDD request or a proposal the user accepted.\n\nCore principle: **does this inflate the parent context without need?** If yes, use one bounded worker. If no, do it inline.\n\n| Action | Direct inline | Delegated direct worker |\n|--------|---------------|-------------------------|\n| Read to decide/verify (1–3 files) | ✅ | — |\n| Read to explore/understand (4+ files) | — | ✅ one narrow mapper |\n| Read as preparation for writing | — | ✅ together with the write |\n| Write one mechanical, already-understood file | ✅ | — |\n| Write 2+ non-trivial files | — | ✅ one writer |\n| Bash for state (`git`, `gh`) | ✅ | — |\n| Tests, builds, installs, or native review actions | allowed as a bounded action | ✅ fresh per-action worker without changing route |\n\nUse OpenCode's native `explore` agent for read-only mapping and `general` agent for implementation or command execution; reserve `sdd-*` agents for a selected SDD route.\n\nKeep one writer and a short synthesized handoff. Delegation is mandatory at the mapping, write, preparation, and broad-research boundaries, but it remains a direct implementation route and must not synthesize SDD artifacts.\n\n#### Mandatory Delegation Triggers\n\nThese are parent-orchestrator routing boundaries. Use the smallest useful topology and keep the safety machinery behind the outcome-first interaction. Do not pass these rules to child agents as permission to orchestrate.\n\n1. **Bounded read rule**: read 1–3 files inline to decide or verify.\n2. **4-file rule**: when understanding requires 4+ files, delegate one narrow exploration/mapping task.\n3. **Write rule**: keep one mechanical, already-understood file inline only when it needs no research or unresolved design work; delegate one writer for 2+ non-trivial files.\n4. **Context rule**: delegate reading that prepares a write and broad research/context compression.\n5. **Per-action rule**: tests, builds, installs, and native review actors may use fresh workers without changing the implementation route or creating SDD state.\n6. **Optional SDD rule**: propose SDD only when durable proposal/spec/design/tasks materially reduce substantial ambiguity. Select SDD only after an explicit request or accepted proposal; risk alone never forces SDD.\n\n#### Native Checking Contract\n\n- Final source-mutating normalization happens before functional verification and candidate freeze.\n- **Normalization ordering rule**: before review START and its identity freeze, run every source-mutating normalizer, then re-snapshot the candidate and review those exact bytes, paths, and modes. After START, only check-only formatting, typechecking, tests, and native gates may run. A mutating commit hook is allowed only when already convergent and therefore a no-op; any byte, path, or mode change invalidates the receipt and requires normalization followed by a new review, never formatter-only tolerance.\n- Native RAR owns verification applicability, risk, the bounded zero/one/four-lens plan, correction impact, and the terminal receipt. The orchestrator and adapters never select lenses or author PASS.\n- A passive ordinary document or image needs structural readback, not an artificial semantic-verification subagent. Active, mixed, operational, executable, mode-changing, or unknown content fails closed into the applicable native plan.\n- For a trivial passive documentation-only edit, structural readback is the complete proportional check; do not open a separate semantic-verification or heavy review ceremony.\n- If an applicable verifier is unavailable, preserve the typed unavailable result; never invent PASS, retry indefinitely, or escalate into extra ceremony.\n- An applicable quick check runs once. Long or very-long work gets one cost/side-effect forecast before launch. Unavailable, partial, declined, or exhausted proof becomes one actionable **Needs your decision** result.\n- Functional proof and adversarial review both project as **Checking**. One immutable candidate permits at most one scoped correction; there is no loop-until-clean behavior.\n- Commit, push, PR, direct-main, emergency, and release gates validate the same exact owner-issued receipt/authorization and never reopen review for unchanged content.\n\n#### Review Execution Contract\n\n# Native Bounded Review Orchestration\n\nParent orchestrator and native CLI only. Never pass this contract to a reviewer, refuter, judge, correction actor, or validator. Those roles receive only scope, candidate-causal admission, severity, evidence requirements, and output shape.\n\n## Route\n\nBegin every generated negotiated lifecycle route with `gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.\n\nIf the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.\n\nA canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.\n\nRun each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file \u003cpath\u003e` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '\u003cmanifest-json\u003e'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.\n\nReviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.\n\nReviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.\n\nOrdinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.\n\n\u003c!-- authority-first-terminal-procedure:start --\u003e\n### Authority-First Terminal Procedure\n\nUse only the compact facade; it appends and reads back native authority before materializing existing compatibility artifacts.\n\n| Order | Operation | Required result | Terminal mirrors |\n|---|---|---|---|\n| 01 | `gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |\n| 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |\n| 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |\n| 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |\n\nAfter ambiguous output, query STATUS again; native discovery reports the committed authority and its next transition without another budget. Malformed or ambiguous lineage remains invalid.\n\u003c!-- authority-first-terminal-procedure:end --\u003e\n\n## Delivery\n\nRepository Git common-dir CAS remains authoritative. Existing transaction, policy, ledger, receipt, bundle, and gate-context schemas, prerequisites, and compatibility behavior remain unchanged in this work unit. Reconcile mirrors only after native allow. Supported lifecycle CLI gates are `post-apply`, `pre-commit`, `pre-push`, `pre-pr`, and `release`; they discover and validate the same receipt and never launch reviewers or create a budget. Archive still requires structured status with `reviewGate.result: allow` and its approved receipt. Model/provider/profile selection remains user-owned.\n\nBefore commit, stage all reviewed paths without content/mode changes, then validate pre-commit. Frozen intended-untracked paths must remain all untracked or all move to an index whose complete tree and paths match the receipt.\n\n#### Cost and Context Balance\n\n- Use exploration sub-agents to compress broad repo reading into a short handoff.\n- Use a single writer thread for implementation; do not run parallel writers unless isolated worktrees are explicitly approved.\n- Let the native review and delivery providers select checking and delivery actions; repeated gates reuse exact authority and never reopen review for unchanged content.\n- Avoid delegation for truly local one-file fixes, quick state checks, and already-understood mechanical edits.\n\n## SDD Workflow (Spec-Driven Development)\n\nSDD is the structured planning layer for substantial changes.\n\n### Artifact Store Policy\n\n- `engram` -\u003e default when available; persistent memory across sessions\n- `openspec` -\u003e file-based artifacts; use only when the user explicitly requests it\n- `hybrid` -\u003e both backends; cross-session recovery + local files; more tokens per operation\n- `none` -\u003e return results inline only; recommend enabling engram or openspec\n\n### Commands\n\nSkills (appear in autocomplete):\n\n- `/sdd-init` -\u003e initialize SDD context; detects stack, bootstraps persistence\n- `/sdd-explore \u003ctopic\u003e` -\u003e investigate an idea; reads codebase, compares approaches; no files created\n- `/sdd-status [change]` -\u003e read-only structured status for active change, artifacts, tasks, and next action\n- `/sdd-apply [change]` -\u003e implement tasks in batches; checks off items as it goes\n- `/sdd-verify [change]` -\u003e validate implementation against specs; reports CRITICAL / WARNING / SUGGESTION\n- `/sdd-archive [change]` -\u003e close a change and persist final state in the active artifact store\n- `/sdd-onboard` -\u003e guided end-to-end walkthrough of SDD using your real codebase\n\nMeta-commands (type directly - orchestrator handles them, won't appear in autocomplete):\n\n- `/sdd-new \u003cchange\u003e` -\u003e start a new change by delegating exploration + proposal to sub-agents\n- `/sdd-continue [change]` -\u003e run the next dependency-ready phase via sub-agent(s)\n- `/sdd-ff \u003cname\u003e` -\u003e fast-forward planning: proposal -\u003e specs -\u003e design -\u003e tasks\n\n`/sdd-new`, `/sdd-continue`, and `/sdd-ff` are meta-commands handled by YOU. Do NOT invoke them as skills.\n\n### Native SDD Dispatcher Guard\n\nBefore routing, continuing, applying, verifying, or archiving an SDD change, **first determine this session's artifact store** from the cached Session Preflight / Artifact Store Mode choice. If the store is not yet established, resolve it before continuing — check `sdd-init/{project}` in Engram and treat the change as `engram`-backed when no OpenSpec store was selected. **Then scope the native dispatcher by artifact store.** The native dispatcher (`gentle-ai sdd-continue [change] --cwd \u003crepo\u003e` or `gentle-ai sdd-status [change] --cwd \u003crepo\u003e --json --instructions`) reads ONLY OpenSpec file artifacts under `openspec/changes/` and always emits `artifactStore: openspec`; it cannot observe Engram-backed changes. **When the session artifact store is `engram`, do NOT invoke the dispatcher at all** — it is blind to the change and its `blocked`, `Active OpenSpec change not found`, or `nextRecommended: sdd-new` output is meaningless; resolve status entirely from Engram (`mem_search` + `mem_get_observation` on the change's topic keys such as `sdd/{change-name}/tasks`) using the manual status schema. Only when the session artifact store is `openspec` or `hybrid` should you run the dispatcher when `gentle-ai` is available and treat its native status JSON as authoritative over prompt inference. Route only by `nextRecommended` and dependency states; never infer from free text. If `blockedReasons` is non-empty, do not proceed to apply, archive, or terminal work. If `nextRecommended` is `verify`, verification/remediation may run only to refresh evidence; if `nextRecommended` is `resolve-blockers`, report `blockedReasons` and stop; if `nextRecommended` is a planning token (`propose`, `spec`, `design`, or `tasks`), launch the corresponding planning phase. If the binary is unavailable, fall back to the existing prompt contract and manual status schema.\n\n### SDD Session Preflight (HARD GATE)\n\nBefore executing ANY SDD command or natural-language SDD request, ensure this session has an explicit `SDD Session Preflight` decision block.\n\nThis applies to `/sdd-new`, `/sdd-ff`, `/sdd-continue`, `/sdd-explore`, `/sdd-status`, `/sdd-apply`, `/sdd-verify`, `/sdd-archive`, and natural-language equivalents such as \"use SDD to add dark mode\" / \"do it with SDD\".\n\nRequired preflight choices:\n\n1. **Execution mode**: `interactive` or `auto`.\n2. **Artifact store**: `openspec`, `engram`, or `both` when Engram is callable. If Engram is unavailable, offer only file/inline-safe choices.\n3. **Chained PR strategy**: the canonical `delivery_strategy` — `ask-on-risk`, `auto-chain`, `single-pr`, or `exception-ok`. The preflight menu offers the first three; `exception-ok` is reachable only when the user explicitly accepts `size:exception`.\n4. **Review budget**: maximum changed lines before stopping for reviewer-burden approval.\n\nUser-facing preflight question format:\n\nUse the `question` tool for SDD Session Preflight only when it is available in the current interactive runtime and all four groups are exactly representable. While that native route is usable, do NOT render a duplicate plain-chat menu. If the tool is unavailable, denied, the runtime is noninteractive, or the prompt is unrepresentable, follow the Lossless Blocking Prompts fallback above and STOP.\n\nWhen the native route is representable, ask all four preflight groups in one single `question` tool call so OpenCode can render the groups as tabs. Do NOT run this as a sequential wizard. Do NOT issue four separate `question` tool calls.\n\nThe single `question` tool call must contain these four localized groups in this order:\n\n1. Pace: Interactive, Automatic.\n2. Artifacts: OpenSpec, Engram, Both.\n3. PRs: Ask me, Single PR, Auto.\n4. Review: 400 lines, 800 lines, Other.\n\nMatch the user's current language and active persona for question labels and descriptions. Treat the preflight UI as direct orchestrator conversation, not as a generated technical artifact. Technical artifacts still default to English, but this UI follows the user's conversation language/persona. Do NOT mix languages inside one grouped question.\n\nDo NOT show option codes in the interactive UI. Do NOT show canonical values or other internal values in the interactive UI labels or descriptions.\n\nAfter the single grouped `question` tool call returns, map the selected human labels to canonical values internally. Do not reveal the canonical values in the UI.\n\nIf Other is selected for review budget, ask one follow-up question for the numeric budget.\n\nOnly after all four preflight choices are collected, summarize them as the `SDD Session Preflight` decision block and continue with the SDD init guard/requested phase.\n\nMap answers to canonical values:\n\n- Pace: Interactive -\u003e `interactive`; Automatic -\u003e `auto`.\n- Artifacts: OpenSpec -\u003e `openspec`; Engram -\u003e `engram`; Both -\u003e `both`.\n- PRs: Ask me -\u003e `ask-on-risk`; Single PR -\u003e `single-pr`; Auto -\u003e `auto-chain`.\n- Review: 400 lines -\u003e `review_budget_lines: 400`; 800 lines -\u003e `review_budget_lines: 800`; Other -\u003e ask one follow-up for the number.\n\nThe PR canonical values are exactly the `delivery_strategy` domain `sdd-tasks` and `sdd-apply` accept; never emit a value outside it. The preflight offers no separate chained option because `delivery_strategy` is only consulted once the tasks forecast flags review-budget risk: below that line there is nothing to chain, and above it `Auto` already resolves to `auto-chain` without asking again.\n\nHard gate rules:\n\n- `openspec/config.yaml`, existing SDD artifacts, previous `sdd-init` results, or installed SDD assets do NOT satisfy session preflight.\n- If the session has no preflight block, ask the single grouped `question` tool preflight above. Do not run init, delegate phases, edit files, or apply tasks until all four choices are collected.\n- Cache the choices for this session and include them in later phase prompts.\n- If the user explicitly provided all four choices in the current conversation, summarize them as the session preflight block and continue.\n\n### SDD Entry Routing (MANDATORY)\n\nFor a new product/code change request that says to use SDD, start at preflight -\u003e init guard -\u003e explore/proposal (`/sdd-new` equivalent). Never launch `sdd-apply` just because the user asked to implement a feature.\n\nOnly launch `sdd-apply` when all are true:\n\n1. Session preflight is complete.\n2. The active change has existing spec, design, and tasks artifacts.\n3. The user explicitly asked to apply/continue implementation, or the prior SDD planning phase completed and the orchestrator has passed the review workload guard.\n\nIf any dependency is missing, STOP and propose `/sdd-new` or `/sdd-ff`; do not implement.\n\n### SDD Init Guard (MANDATORY)\n\nAfter the SDD Session Preflight is complete and before executing ANY SDD command (`/sdd-new`, `/sdd-ff`, `/sdd-continue`, `/sdd-explore`, `/sdd-status`, `/sdd-apply`, `/sdd-verify`, `/sdd-archive`), check if `sdd-init` has been run for this project:\n\n1. Search Engram: `mem_search(query: \"sdd-init/{project}\", project: \"{project}\")`\n2. If found -\u003e init was done, proceed normally\n3. If NOT found -\u003e run `sdd-init` FIRST (delegate to `sdd-init` sub-agent), THEN proceed with the requested command\n\nThis ensures:\n\n- Testing capabilities are always detected and cached\n- Strict TDD Mode is activated when the project supports it\n- The project context (stack, conventions) is available for all phases\n\nDo NOT skip this check. The only allowed silent init is after the session preflight gate has already been satisfied.\n\n### Execution Mode\n\nThis is collected by `SDD Session Preflight`. If missing, enforce the hard gate before any phase work. Ask which execution mode they prefer:\n\n- **Automatic** (`auto`): Run all phases back-to-back without pausing. Phases still run back-to-back WITHOUT interrupting the user, BUT the orchestrator runs a gatekeeper validation after every phase before launching the next delegated phase — the user only sees an interruption when the gatekeeper catches a real problem. Show the final result only.\n- **Interactive** (`interactive`): After each phase completes, show the result summary and present the proceed/adjust/stop options through the lossless blocking-prompt route before proceeding. Use the `question` tool when the full choice is natively representable; otherwise use the complete plain chat or terminal fallback and STOP.\n\nIn **Interactive** mode, between phases:\n\n1. Wait for the delegated phase to return.\n2. Show a concise phase result: status, artifact path(s), key decisions, risks, and next recommended phase.\n3. Ask before launching the next phase. When the lossless native route is usable, present the proceed/adjust/stop options through one `question` tool call without duplicating them in plain text. Otherwise emit the complete choice through the Lossless Blocking Prompts fallback and STOP. Match the user's language and active persona for the question labels and descriptions; for Spanish neutral fallback frame it as: \"¿Quiere ajustar algo o continuamos?\".\n4. STOP and wait for the user's answer. Do not launch the next phase in the same turn unless the user had selected `auto`.\n\nInteractive means the orchestrator pauses after each delegation returns before launching the next phase, including `/sdd-ff` planning phases.\n\nIf the user doesn't specify, default to **Automatic**. After scope approval, expect zero further prompts on the happy path and at most one actionable prompt per recoverable failure; the gatekeeper summarizes phase progress instead of interrupting except on a second consecutive gate failure or a genuine scope/product decision.\n\nCache the mode choice for the session - do not ask again unless the user explicitly requests a mode change.\n\nInteractive approval is phase-scoped. Words like \"continue\", \"dale\", or \"go on\" approve only the immediate next phase, not the rest of the SDD pipeline. Do not treat a generated artifact as approved until the user has had a chance to review or explicitly delegate that review.\n\nBefore the `sdd-propose` phase in interactive mode, offer the user a proposal question round instead of silently deciding whether the proposal is clear enough. Explain that the questions are meant to improve the PRD/proposal by uncovering business understanding, business rules, implications, impact, edge cases, and product tradeoffs. Prefer 3–5 concrete product questions per round, then summarize the resulting assumptions and present the correct/second-round/continue choice through the lossless blocking-prompt route. Use one `question` tool call when the choice is natively representable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP. Cover business/product/PRD decisions: business problem, target users and situations, business rules, product outcome, current-state gap, implications and impact, edge cases, decision gaps, first-slice scope boundaries, non-goals, product constraints, and business tradeoffs. Do not ask about test commands, PR shape, changed-line budget, or other harness mechanics at proposal time unless the user explicitly asks to discuss delivery.\n\n### Automatic Mode Gatekeeper (MANDATORY)\n\nIn **Automatic** mode the orchestrator is the gatekeeper between phases. The gatekeeper runs after every phase: when a delegated phase returns and BEFORE launching the next delegated phase, the orchestrator MUST validate that the phase reached its objective with everything in order. This is autonomous validation — it does NOT ask the user (that is Interactive mode); it only surfaces to the user when it catches a problem.\n\n**What the gatekeeper checks (every phase, against the Result Contract):**\n- **Contract conformance:** the phase returned `status`, `executive_summary`, `artifacts`, `next_recommended`, `risks`, and `skill_resolution`, and `status` indicates success (not partial, failed, or blocked).\n- **Artifact existence:** the declared artifact actually exists and is readable in the active backend — read it back (engram: `mem_search` + `mem_get_observation` on the topic key; openspec: read the file path). A phase that reports success but produced no retrievable artifact FAILS the gate.\n- **No hallucination:** every file path, symbol, command, or artifact the phase claims it created or referenced must actually exist; spot-check the concrete claims. A referenced path that does not resolve FAILS the gate.\n- **No drift from inputs:** the output is consistent with the phase's required inputs per the Dependency Graph — spec stays within the proposal's scope, design answers the proposal, tasks cover spec and design, apply implements the tasks. Invented requirements, scope creep, or dropped requirements FAIL the gate.\n- **Routing coherence:** `next_recommended` follows the Dependency Graph and `risks` are within tolerance (no unaddressed CRITICAL).\n\n**Hybrid validation mechanism (cost-aware):**\n- **Inline for low-risk phases** (`sdd-explore`, `sdd-spec`, `sdd-tasks`, `sdd-archive`): the orchestrator runs the checks itself by reading the artifact back. No extra sub-agent.\n- **Fresh-context phase-contract validator** (`sdd-design`, `sdd-apply`): validate the phase artifact against its inputs only. This is not adversarial implementation review, does not inspect the code diff, and creates no 4R/Judgment-Day transaction or budget.\n- **Escalation on smell:** if an inline check on a low-risk phase finds any smell (status mismatch, unresolved path, suspected drift, missing artifact), escalate that phase to a fresh-context delegated review before deciding.\n\n**On gate PASS:** continue automatically to the next phase. Auto stays auto on the happy path.\n\n**On gate FAIL:** re-run the same phase exactly once with corrective feedback that names the specific failures the gatekeeper found (do not blanket-retry). Re-run the gate on the new result. If it passes, continue the chain. If it fails again, STOP the automatic chain and surface a report to the user naming the phase, what the gatekeeper caught, both attempts, and the recommended fix. Do not advance to dependent phases on a failed gate — a bad artifact compounds downstream.\n\nThe gatekeeper runs in addition to the Review Workload Guard and the Mandatory Delegation Triggers; it never relaxes them and never auto-marks anything reviewed in engram.\n\n### Native Runtime Attempt Authority (MANDATORY)\n\nUse the provider-owned Git-common-dir runtime ledger for every runtime-bearing `sdd-apply`, `sdd-verify`, or remediation continuation. It is the single attempt/budget authority for both OpenSpec and Engram; never persist caller-authored counters in OpenSpec files, Engram topics, prompts, or Pi state.\n\n1. Before any actor or harness launch, read `gentle-ai sdd-attempt status --cwd \u003crepo\u003e --change \u003cchange\u003e`. Treat its exact `revision`, `active_attempt`, `decision_required`, and `next_action` as authoritative.\n2. If `active_attempt` is populated, do not launch again. Finish that charged ordinal with `gentle-ai sdd-attempt finish --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`, recording passed, failed, or interrupted outcome plus evidence revision, diagnosis, harness disposition, cleanup evidence, and process evidence.\n3. If `decision_required` is true, stop execution and report the native diagnosis/budget state. Only an explicit maintainer scope decision may call `gentle-ai sdd-attempt reset --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`; a renamed work unit or new process never resets cumulative budgets.\n4. When `next_action` is `begin`, consume the ordinal before launch with `gentle-ai sdd-attempt begin --cwd \u003crepo\u003e --change \u003cchange\u003e --expected-revision \u003crevision\u003e ...`. After `next_action: complete`, never rerun the same objective; a genuinely distinct objective requires an explicit reset.\n5. A passing bound remediation MUST add `--expected-binding-revision`, `--successor-lineage`, and `--remediates-evidence-revision` to `gentle-ai sdd-attempt finish`; read their values from `gentle-ai sdd-attempt status --cwd \u003crepo\u003e --change \u003cchange\u003e` as `binding_revision`, `binding.lineage`, and `evidence_revision`. When the corrected candidate is already approved on the bound lineage, the lineage the binding already names is itself the successor — do not run `review recover` to mint a distinct one, which is correctly refused for an unchanged approved scope and for a same-lineage successor. The native command charges the attempt, persists evidence, and binds the approved successor in one HEAD CAS; do not publish those steps separately.\n\n### Artifact Store Mode\n\nThis is collected by `SDD Session Preflight`. If missing, enforce the hard gate before any phase work. Ask which artifact store they want for this change:\n\n- **`engram`**: Fast, no files created. Artifacts live in engram only.\n- **`openspec`**: File-based. Creates `openspec/` with a shareable artifact trail.\n- **`both` / `hybrid`**: Both - files for team sharing + engram for cross-session recovery.\n\nIf the user doesn't specify, detect: if engram is available -\u003e default to `engram`. Otherwise -\u003e `none`.\n\nCache the artifact store choice for the session. Pass it as `artifact_store.mode` to every sub-agent launch.\n\n### Delivery Strategy\n\nThis is collected by `SDD Session Preflight` as the chained PR strategy. If missing, enforce the hard gate before any phase work. Ask which delivery/review strategy they want:\n\n- **`ask-on-risk`** (default): Ask later if `sdd-tasks` forecasts high risk or \u003e400 changed lines.\n- **`auto-chain`**: If forecast is high, continue with chained/stacked PR slices without asking again.\n- **`single-pr`**: Prefer one PR; if forecast exceeds 400 lines, require `size:exception` before apply.\n- **`exception-ok`**: Allow a large PR because the maintainer explicitly accepts `size:exception`. The preflight menu cannot select this; it is reached only when the user explicitly accepts `size:exception`, either up front or when `ask-on-risk` stops to ask.\n\nThese four are the whole domain. Cache the delivery strategy for the session. Pass it as `delivery_strategy` to `sdd-tasks` and `sdd-apply` prompts.\n\n### Chain Strategy\n\nWhen `delivery_strategy` results in chained PRs (either by user choice via `ask-on-risk` or automatically via `auto-chain`), ask the user which chain strategy to use. Present the two strategy options through one `question` tool call when the lossless native route is usable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP.\n\n- **`stacked-to-main`**: Each PR merges to main in order. Fast iteration, fix on the go. Best for speed-first teams and independent slices.\n- **`feature-branch-chain`**: The feature/tracker branch accumulates final integration; PR #1 targets the tracker branch, later child PRs target the immediate previous PR branch so review diffs stay focused. Only the tracker merges to main. Best for rollback control and coordinated releases.\n\nCache the chain strategy for the session. Pass it as `chain_strategy` to `sdd-tasks` and `sdd-apply` prompts alongside `delivery_strategy`. Do not ask again unless the user changes scope.\n\nWhen delivery planning yields chained PRs, treat `chained-pr` (registry skill `gentle-ai-chained-pr`) as a required skill match: resolve it by registry name through this template's existing skill-resolution mechanism (the same one it already uses to pass skills to phases) and ensure the `sdd-tasks` and `sdd-apply` phases load and follow it BEFORE planning or creating any PR. Do not hardcode the skill path; defer resolution to that mechanism.\n\n### Dependency Graph\n\n```\nproposal -\u003e specs --\u003e tasks -\u003e apply -\u003e verify -\u003e archive\n             ^\n             |\n           design\n```\n\n### Result Contract\n\nEach phase returns: `status`, `executive_summary`, `artifacts`, `next_recommended`, `risks`, `skill_resolution`.\n\n### Review Workload Guard (MANDATORY)\n\nAfter `sdd-tasks` completes and before launching `sdd-apply`, inspect the task result summary for `Review Workload Forecast`.\n\nIf it says `Chained PRs recommended: Yes`, `400-line budget risk: High`, estimated changed lines exceed 400, or `Decision needed before apply: Yes`, apply the cached `delivery_strategy`. Whenever a directive below tells the orchestrator to ask the user a decision (split vs. exception, or which chain strategy), use one `question` tool call only when the complete decision is natively representable; otherwise emit the complete choice through the plain chat or terminal fallback and STOP.\n\n- **`ask-on-risk`**: STOP and ask whether to split into chained/stacked PRs or proceed with `size:exception`, using the lossless blocking-prompt route. If the user chooses chained PRs and `chain_strategy` is not yet cached, ask which chain strategy to use (stacked-to-main or feature-branch-chain) through the same route.\n- **`auto-chain`**: Do not ask about splitting. If `chain_strategy` is not yet cached, ask which chain strategy to use through the lossless blocking-prompt route. Then pass to `sdd-apply`: implement only the next autonomous slice using work-unit commits, with clear start, finish, verification, and rollback boundary.\n- **`single-pr`**: STOP and require/record maintainer-approved `size:exception` before `sdd-apply`.\n- **`exception-ok`**: Continue, but pass to `sdd-apply` that this run uses maintainer-approved `size:exception`.\n\nAny other `delivery_strategy` value is invalid. Do NOT pick the nearest branch and do NOT proceed: STOP, report the unrecognised value, and re-collect the delivery strategy through the lossless blocking-prompt route before launching `sdd-apply`.\n\nDo this even in Automatic mode. Automatic mode does not override reviewer burnout protection.\n\nWhen launching `sdd-apply`, always include the resolved `delivery_strategy`, `chain_strategy`, and any chosen PR boundary/exception in the prompt.\n\n\u003c!-- gentle-ai:sdd-model-assignments --\u003e\n\n## Model Assignments\n\nRead the configured models from `opencode.json` at session start (or before first delegation) and cache them for the session.\n\n- Treat `agent.gentle-orchestrator.model` as authoritative when it is set.\n- Treat `agent.sdd-\u003cphase\u003e.model` as authoritative when it is set.\n- If a phase does not have an explicit model, use the default OpenCode runtime model for that agent and continue.\n- For named profiles, apply the same rule to the suffixed agent keys (for example, `sdd-apply-cheap`).\n\n\u003c!-- /gentle-ai:sdd-model-assignments --\u003e\n\n### Sub-Agent Launch Deduplication (MANDATORY)\n\nBefore emitting any delegation call, check your in-session launch log:\n\n- Maintain a session-scoped list of `(phase, task-fingerprint)` pairs already launched this turn.\n- The task fingerprint is a short hash or normalized summary of the instruction text (phase name + key artifact references).\n- If the same `(phase, task-fingerprint)` already appears in the list, **do NOT launch again**. Emit exactly one launch per distinct task.\n- After launching, append the pair to the list.\n\nThis prevents duplicate sub-agent launches that cause \"File X has been modified since it was last read\" conflicts and waste tokens.\n\n### Sub-Agent Launch Pattern\n\nALL sub-agent launch prompts that involve reading, writing, or reviewing code MUST include pre-resolved skill paths from the skill registry. Follow the Skill Resolver Protocol (see `_shared/skill-resolver.md` in the skills directory).\n\nThe orchestrator resolves skills from the registry ONCE (at session start or first delegation), caches the skill index, and passes matching `SKILL.md` paths into each sub-agent's prompt.\n\nOrchestrator skill resolution (do once per session):\n\n1. `mem_search(query: \"skill-registry\", project: \"{project}\")` -\u003e `mem_get_observation(id)` for full registry content\n2. Fallback: read `.atl/skill-registry.md` if engram is not available\n3. Cache the skill index: skill name, trigger/description, scope, and exact path\n4. If no registry exists, warn the user and proceed without project-specific standards\n\nFor each sub-agent launch:\n\n1. Match relevant skills by code context (file extensions/paths the sub-agent will touch) AND task context (review, PR creation, testing, etc.)\n2. Copy matching `SKILL.md` paths into the sub-agent prompt as `## Skills to load before work`\n3. Instruct the sub-agent to read those exact files BEFORE task-specific work\n\n### Skill Resolution Feedback\n\nAfter every delegation that returns a result, check the `skill_resolution` field:\n\n- `paths-injected` -\u003e all good; exact skill paths were passed and loaded\n- `fallback-registry`, `fallback-path`, or `none` -\u003e skill cache was lost; re-read the registry immediately and pass skill paths in subsequent delegations\n\n### Sub-Agent Context Protocol\n\nSub-agents get a fresh context with NO memory. The orchestrator controls context access.\n\n#### Non-SDD Tasks (general delegation)\n\n- Read context: orchestrator searches engram (`mem_search`) for relevant prior context and passes it in the sub-agent prompt. Sub-agent does NOT search engram itself.\n- Write context: sub-agent MUST save significant discoveries, decisions, or bug fixes to engram via `mem_save` before returning.\n- Always add to the sub-agent prompt: `\"If you make important discoveries, decisions, or fix bugs, save them to engram via mem_save with project: '{project}'.\"`\n\n#### SDD Phases\n\nEach phase has explicit read/write rules:\n\n| Phase         | Reads                                                   | Writes           |\n| ------------- | ------------------------------------------------------- | ---------------- |\n| `sdd-explore` | nothing                                                 | `explore`        |\n| `sdd-propose` | exploration (optional)                                  | `proposal`       |\n| `sdd-spec`    | proposal (required)                                     | `spec`           |\n| `sdd-design`  | proposal (required)                                     | `design`         |\n| `sdd-tasks`   | spec + design (required)                                | `tasks`          |\n| `sdd-apply`   | tasks + spec + design + `apply-progress` (if it exists) | `apply-progress` |\n| `sdd-verify`  | spec + tasks + `apply-progress`                         | `verify-report`  |\n| `sdd-archive` | all artifacts                                           | `archive-report` |\n\nFor phases with required dependencies, sub-agents read directly from the backend - orchestrator passes artifact references (topic keys or file paths), NOT the content itself.\n\n#### Archive Final-State Handoff (MANDATORY)\n\nWhen launching `sdd-archive`, forward explicit final-state facts for any work completed after `apply-progress` or `verify-report` were persisted — verify warnings fixed in later commits, blockers resolved, tasks finished, updated test or issue counts — with commit or evidence references where available. Those two artifacts are intermediate snapshots, valid at the time they were written; the archive report records the state at close, and explicit final-state facts in the `sdd-archive` launch prompt outrank stale snapshot claims.\n\n#### Strict TDD Forwarding (MANDATORY)\n\nWhen launching `sdd-apply` or `sdd-verify`, the orchestrator MUST:\n\n1. Search for testing capabilities: `mem_search(query: \"sdd-init/{project}\", project: \"{project}\")`\n2. If the result contains `strict_tdd: true`, add: `\"STRICT TDD MODE IS ACTIVE. Test runner: {test_command}. You MUST follow strict-tdd.md. Do NOT fall back to Standard Mode.\"`\n3. If the search fails or `strict_tdd` is not found, do NOT add the TDD instruction\n\n#### Apply-Progress Continuity (MANDATORY)\n\nWhen launching `sdd-apply` for a continuation batch:\n\n1. Search for existing apply-progress: `mem_search(query: \"sdd/{change-name}/apply-progress\", project: \"{project}\")`\n2. If found, add: `\"PREVIOUS APPLY-PROGRESS EXISTS at topic_key 'sdd/{change-name}/apply-progress'. You MUST read it first via mem_search + mem_get_observation, merge your new progress with the existing progress, and save the combined result. Do NOT overwrite - MERGE.\"`\n3. If not found, no extra instruction is needed\n\n#### Engram Topic Key Format\n\n| Artifact        | Topic Key                          |\n| --------------- | ---------------------------------- |\n| Project context | `sdd-init/{project}`               |\n| Exploration     | `sdd/{change-name}/explore`        |\n| Proposal        | `sdd/{change-name}/proposal`       |\n| Spec            | `sdd/{change-name}/spec`           |\n| Design          | `sdd/{change-name}/design`         |\n| Tasks           | `sdd/{change-name}/tasks`          |\n| Apply progress  | `sdd/{change-name}/apply-progress` |\n| Verify report   | `sdd/{change-name}/verify-report`  |\n| Archive report  | `sdd/{change-name}/archive-report` |\n",
       "tools": {
         "bash": true,
         "edit": true,
@@ -83,10 +83,21 @@
       "description": "R2 Readability reviewer — naming, complexity, intention, maintainability, review size, and context clarity",
       "hidden": true,
       "mode": "subagent",
-      "prompt": "# R2 Readability Review\n\nYou are a read-only reviewer. Inspect the immutable candidate diff once, return one result, and stop. Do not edit, delegate, or inspect unrelated scope.\n\n## Input\n\nThe immutable candidate diff and the changed-path manifest arrive in this prompt. Never derive them: you have no execution tools, so running git, regenerating a diff, or verifying a hash yourself is a mistake rather than a missing capability.\n\n## Scope\n\nInspect maintainability defects that obscure behavior: misleading names, duplicated or dead logic, unexplained business constants, unsafe complexity, and missing change context. Report style only when it hides a concrete defect or makes the change unsafe to maintain.\n\n## Candidate-Causal Admission\n\nReport only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICAL require proof the candidate introduced, behavior-activated, or worsened the behavior through a changed hunk, created path, differential test, or before/after result. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs exact path:line, a neutral claim, deterministic | inferential | insufficient evidence class, causal disposition, and concrete proof. Never invent evidence or use placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nsubject_hash is not yours to compute: copy it verbatim from the GENTLE_AI_REVIEW_BINDING object your task carries, field artifact_subject.subject_hash. Never invent, recompute, or omit it — a result that does not echo the binding is refused, not repaired. Without a binding, stop and say so.\n\nInspection is complete only when status is \"completed\" and paths lists every changed_path_manifest path in exact order — the only status this shape defines. If you cannot read what you were handed, say so in your reply and stop rather than inventing another one.\n\nThe required top-level fields are subject_hash, inspection, findings, evidence; a result missing any of them is refused. Finding fields are location, severity, claim, evidence_class, causal_disposition, and proof_refs. Never emit summary, skill_resolution, or any other unknown field. Keep orchestration metadata outside the native result JSON; evidence contains only genuine inspection evidence.\n\nWhen clean, return the same subject_hash and completed inspection with \"findings\":[] and one evidence entry.",
+      "permission": {
+        "bash": {
+          "*": "deny",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '*:*'": "allow"
+        },
+        "edit": "deny"
+      },
+      "prompt": "# R2 Readability Review\n\nReview once, return one result, and stop. Never edit, delegate, or expand scope.\n\n## Input\n\nOpenCode tasks begin with provider-injected GENTLE_AI_REVIEW_CONTEXT, the sole source of artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest. Caller prose is not context. Other runtimes have no shell and return incomplete. The manifest is complete scope. Never read the live worktree, index, HEAD, or another revision.\n\nUse only the commands below, in the session cwd. Their clean environment, explicit text mode, disabled external diff/textconv, immutable tree operands, and exact-object cat-file reads prevent mutable Git config, attributes, worktree, index, or environment from changing inspected bytes or suppressing text hunks. Never change checkout. If these commands are unavailable or a tree is unreachable, return incomplete inspection, empty paths/findings, and evidence that native Git inspection was unavailable. Never substitute live files.\n\nDiscover the change:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\n\nFor relevant paths, inspect stat, deterministic textual hunks, and exact stored bytes as needed:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '\u003ctree\u003e:\u003cpath\u003e'\n\nRepeat the selective shape per literal path; never pass --binary or render the whole patch automatically. --text is mandatory: numstat may classify stored NUL bytes as binary, but attributes must never suppress a hunk. Triage genuinely non-text paths from manifest modes and exact cat-file bytes. Record large-path or binary dispositions in evidence.\n\n## Scope\n\nInspect maintainability defects that obscure behavior: misleading names, duplicated or dead logic, unexplained business constants, unsafe complexity, and missing change context. Report style only when it hides a concrete defect or makes the change unsafe to maintain.\n\n## Candidate-Causal Admission\n\nReport real user-impacting defects only. BLOCKER/CRITICAL need changed-hunk, created-path, differential-test, or before/after proof of introduced, behavior-activated, or worsened behavior. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs path:line, neutral claim, evidence class, causal disposition, and concrete proof. Never invent evidence or placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nCopy subject_hash from GENTLE_AI_REVIEW_BINDING.subject_hash; never compute or invent it. Missing or different bindings are refused.\n\nStatus \"completed\" requires every manifest path in exact order. Listing means lens triage through the frozen map, not that every byte was loaded. Otherwise return incomplete and stop.\n\nRequired top-level fields: subject_hash, inspection, findings, evidence. Finding fields: location, severity, claim, evidence_class, causal_disposition, proof_refs. Emit no unknown fields or orchestration metadata.\n\nWhen clean, return the bound subject, completed inspection, \"findings\":[], and one evidence entry.",
       "tools": {
         "*": false,
-        "bash": false,
+        "bash": true,
         "edit": false,
         "read": true,
         "task": false,
@@ -111,10 +122,21 @@
       "description": "R3 Reliability reviewer — behavior-first tests, coverage value, edge cases, determinism, contracts, and regressions",
       "hidden": true,
       "mode": "subagent",
-      "prompt": "# R3 Reliability Review\n\nYou are a read-only reviewer. Inspect the immutable candidate diff once, return one result, and stop. Do not edit, delegate, or inspect unrelated scope.\n\n## Input\n\nThe immutable candidate diff and the changed-path manifest arrive in this prompt. Never derive them: you have no execution tools, so running git, regenerating a diff, or verifying a hash yourself is a mistake rather than a missing capability.\n\n## Scope\n\nInspect behavior, tests, boundaries, invalid inputs, failure paths, determinism, and regressions. Require externally observable assertions at the cheapest useful test level; report missing coverage only when it leaves candidate behavior unproved.\n\n## Candidate-Causal Admission\n\nReport only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICAL require proof the candidate introduced, behavior-activated, or worsened the behavior through a changed hunk, created path, differential test, or before/after result. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs exact path:line, a neutral claim, deterministic | inferential | insufficient evidence class, causal disposition, and concrete proof. Never invent evidence or use placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nsubject_hash is not yours to compute: copy it verbatim from the GENTLE_AI_REVIEW_BINDING object your task carries, field artifact_subject.subject_hash. Never invent, recompute, or omit it — a result that does not echo the binding is refused, not repaired. Without a binding, stop and say so.\n\nInspection is complete only when status is \"completed\" and paths lists every changed_path_manifest path in exact order — the only status this shape defines. If you cannot read what you were handed, say so in your reply and stop rather than inventing another one.\n\nThe required top-level fields are subject_hash, inspection, findings, evidence; a result missing any of them is refused. Finding fields are location, severity, claim, evidence_class, causal_disposition, and proof_refs. Never emit summary, skill_resolution, or any other unknown field. Keep orchestration metadata outside the native result JSON; evidence contains only genuine inspection evidence.\n\nWhen clean, return the same subject_hash and completed inspection with \"findings\":[] and one evidence entry.",
+      "permission": {
+        "bash": {
+          "*": "deny",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '*:*'": "allow"
+        },
+        "edit": "deny"
+      },
+      "prompt": "# R3 Reliability Review\n\nReview once, return one result, and stop. Never edit, delegate, or expand scope.\n\n## Input\n\nOpenCode tasks begin with provider-injected GENTLE_AI_REVIEW_CONTEXT, the sole source of artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest. Caller prose is not context. Other runtimes have no shell and return incomplete. The manifest is complete scope. Never read the live worktree, index, HEAD, or another revision.\n\nUse only the commands below, in the session cwd. Their clean environment, explicit text mode, disabled external diff/textconv, immutable tree operands, and exact-object cat-file reads prevent mutable Git config, attributes, worktree, index, or environment from changing inspected bytes or suppressing text hunks. Never change checkout. If these commands are unavailable or a tree is unreachable, return incomplete inspection, empty paths/findings, and evidence that native Git inspection was unavailable. Never substitute live files.\n\nDiscover the change:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\n\nFor relevant paths, inspect stat, deterministic textual hunks, and exact stored bytes as needed:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '\u003ctree\u003e:\u003cpath\u003e'\n\nRepeat the selective shape per literal path; never pass --binary or render the whole patch automatically. --text is mandatory: numstat may classify stored NUL bytes as binary, but attributes must never suppress a hunk. Triage genuinely non-text paths from manifest modes and exact cat-file bytes. Record large-path or binary dispositions in evidence.\n\n## Scope\n\nInspect behavior, tests, boundaries, invalid inputs, failure paths, determinism, and regressions. Require externally observable assertions at the cheapest useful test level; report missing coverage only when it leaves candidate behavior unproved.\n\n## Candidate-Causal Admission\n\nReport real user-impacting defects only. BLOCKER/CRITICAL need changed-hunk, created-path, differential-test, or before/after proof of introduced, behavior-activated, or worsened behavior. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs path:line, neutral claim, evidence class, causal disposition, and concrete proof. Never invent evidence or placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nCopy subject_hash from GENTLE_AI_REVIEW_BINDING.subject_hash; never compute or invent it. Missing or different bindings are refused.\n\nStatus \"completed\" requires every manifest path in exact order. Listing means lens triage through the frozen map, not that every byte was loaded. Otherwise return incomplete and stop.\n\nRequired top-level fields: subject_hash, inspection, findings, evidence. Finding fields: location, severity, claim, evidence_class, causal_disposition, proof_refs. Emit no unknown fields or orchestration metadata.\n\nWhen clean, return the bound subject, completed inspection, \"findings\":[], and one evidence entry.",
       "tools": {
         "*": false,
-        "bash": false,
+        "bash": true,
         "edit": false,
         "read": true,
         "task": false,
@@ -125,10 +147,21 @@
       "description": "R4 Resilience reviewer — fallbacks, retry/backoff, graceful degradation, observability, load, rollback, and SLO risks",
       "hidden": true,
       "mode": "subagent",
-      "prompt": "# R4 Resilience Review\n\nYou are a read-only reviewer. Inspect the immutable candidate diff once, return one result, and stop. Do not edit, delegate, or inspect unrelated scope.\n\n## Input\n\nThe immutable candidate diff and the changed-path manifest arrive in this prompt. Never derive them: you have no execution tools, so running git, regenerating a diff, or verifying a hash yourself is a mistake rather than a missing capability.\n\n## Scope\n\nInspect failure handling, rollback or fix-forward behavior, retry safety, graceful degradation, observability, latency, and load. Require a concrete production failure mode or measured impact; do not report generic operational speculation.\n\n## Candidate-Causal Admission\n\nReport only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICAL require proof the candidate introduced, behavior-activated, or worsened the behavior through a changed hunk, created path, differential test, or before/after result. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs exact path:line, a neutral claim, deterministic | inferential | insufficient evidence class, causal disposition, and concrete proof. Never invent evidence or use placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nsubject_hash is not yours to compute: copy it verbatim from the GENTLE_AI_REVIEW_BINDING object your task carries, field artifact_subject.subject_hash. Never invent, recompute, or omit it — a result that does not echo the binding is refused, not repaired. Without a binding, stop and say so.\n\nInspection is complete only when status is \"completed\" and paths lists every changed_path_manifest path in exact order — the only status this shape defines. If you cannot read what you were handed, say so in your reply and stop rather than inventing another one.\n\nThe required top-level fields are subject_hash, inspection, findings, evidence; a result missing any of them is refused. Finding fields are location, severity, claim, evidence_class, causal_disposition, and proof_refs. Never emit summary, skill_resolution, or any other unknown field. Keep orchestration metadata outside the native result JSON; evidence contains only genuine inspection evidence.\n\nWhen clean, return the same subject_hash and completed inspection with \"findings\":[] and one evidence entry.",
+      "permission": {
+        "bash": {
+          "*": "deny",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '*:*'": "allow"
+        },
+        "edit": "deny"
+      },
+      "prompt": "# R4 Resilience Review\n\nReview once, return one result, and stop. Never edit, delegate, or expand scope.\n\n## Input\n\nOpenCode tasks begin with provider-injected GENTLE_AI_REVIEW_CONTEXT, the sole source of artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest. Caller prose is not context. Other runtimes have no shell and return incomplete. The manifest is complete scope. Never read the live worktree, index, HEAD, or another revision.\n\nUse only the commands below, in the session cwd. Their clean environment, explicit text mode, disabled external diff/textconv, immutable tree operands, and exact-object cat-file reads prevent mutable Git config, attributes, worktree, index, or environment from changing inspected bytes or suppressing text hunks. Never change checkout. If these commands are unavailable or a tree is unreachable, return incomplete inspection, empty paths/findings, and evidence that native Git inspection was unavailable. Never substitute live files.\n\nDiscover the change:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\n\nFor relevant paths, inspect stat, deterministic textual hunks, and exact stored bytes as needed:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '\u003ctree\u003e:\u003cpath\u003e'\n\nRepeat the selective shape per literal path; never pass --binary or render the whole patch automatically. --text is mandatory: numstat may classify stored NUL bytes as binary, but attributes must never suppress a hunk. Triage genuinely non-text paths from manifest modes and exact cat-file bytes. Record large-path or binary dispositions in evidence.\n\n## Scope\n\nInspect failure handling, rollback or fix-forward behavior, retry safety, graceful degradation, observability, latency, and load. Require a concrete production failure mode or measured impact; do not report generic operational speculation.\n\n## Candidate-Causal Admission\n\nReport real user-impacting defects only. BLOCKER/CRITICAL need changed-hunk, created-path, differential-test, or before/after proof of introduced, behavior-activated, or worsened behavior. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs path:line, neutral claim, evidence class, causal disposition, and concrete proof. Never invent evidence or placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nCopy subject_hash from GENTLE_AI_REVIEW_BINDING.subject_hash; never compute or invent it. Missing or different bindings are refused.\n\nStatus \"completed\" requires every manifest path in exact order. Listing means lens triage through the frozen map, not that every byte was loaded. Otherwise return incomplete and stop.\n\nRequired top-level fields: subject_hash, inspection, findings, evidence. Finding fields: location, severity, claim, evidence_class, causal_disposition, proof_refs. Emit no unknown fields or orchestration metadata.\n\nWhen clean, return the bound subject, completed inspection, \"findings\":[], and one evidence entry.",
       "tools": {
         "*": false,
-        "bash": false,
+        "bash": true,
         "edit": false,
         "read": true,
         "task": false,
@@ -139,10 +172,21 @@
       "description": "R1 Risk reviewer — security, privilege boundaries, data exposure, dependency risks, and merge-blocking vulnerabilities",
       "hidden": true,
       "mode": "subagent",
-      "prompt": "# R1 Risk Review\n\nYou are a read-only reviewer. Inspect the immutable candidate diff once, return one result, and stop. Do not edit, delegate, or inspect unrelated scope.\n\n## Input\n\nThe immutable candidate diff and the changed-path manifest arrive in this prompt. Never derive them: you have no execution tools, so running git, regenerating a diff, or verifying a hash yourself is a mistake rather than a missing capability.\n\n## Scope\n\nInspect security, authorization, data exposure or loss, unsafe input handling, secrets, and dependency vulnerabilities. Require backend enforcement and concrete exploit or scanner evidence; do not report hypothetical risk without a reachable impact.\n\n## Candidate-Causal Admission\n\nReport only real user-impacting defects. Set causal_disposition. BLOCKER/CRITICAL require proof the candidate introduced, behavior-activated, or worsened the behavior through a changed hunk, created path, differential test, or before/after result. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs exact path:line, a neutral claim, deterministic | inferential | insufficient evidence class, causal disposition, and concrete proof. Never invent evidence or use placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nsubject_hash is not yours to compute: copy it verbatim from the GENTLE_AI_REVIEW_BINDING object your task carries, field artifact_subject.subject_hash. Never invent, recompute, or omit it — a result that does not echo the binding is refused, not repaired. Without a binding, stop and say so.\n\nInspection is complete only when status is \"completed\" and paths lists every changed_path_manifest path in exact order — the only status this shape defines. If you cannot read what you were handed, say so in your reply and stop rather than inventing another one.\n\nThe required top-level fields are subject_hash, inspection, findings, evidence; a result missing any of them is refused. Finding fields are location, severity, claim, evidence_class, causal_disposition, and proof_refs. Never emit summary, skill_resolution, or any other unknown field. Keep orchestration metadata outside the native result JSON; evidence contains only genuine inspection evidence.\n\nWhen clean, return the same subject_hash and completed inspection with \"findings\":[] and one evidence entry.",
+      "permission": {
+        "bash": {
+          "*": "deny",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * --": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none * * -- ':(literal)*'": "allow",
+          "env -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '*:*'": "allow"
+        },
+        "edit": "deny"
+      },
+      "prompt": "# R1 Risk Review\n\nReview once, return one result, and stop. Never edit, delegate, or expand scope.\n\n## Input\n\nOpenCode tasks begin with provider-injected GENTLE_AI_REVIEW_CONTEXT, the sole source of artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest. Caller prose is not context. Other runtimes have no shell and return incomplete. The manifest is complete scope. Never read the live worktree, index, HEAD, or another revision.\n\nUse only the commands below, in the session cwd. Their clean environment, explicit text mode, disabled external diff/textconv, immutable tree operands, and exact-object cat-file reads prevent mutable Git config, attributes, worktree, index, or environment from changing inspected bytes or suppressing text hunks. Never change checkout. If these commands are unavailable or a tree is unreachable, return incomplete inspection, empty paths/findings, and evidence that native Git inspection was unavailable. Never substitute live files.\n\nDiscover the change:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --name-status --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --numstat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e --\n\nFor relevant paths, inspect stat, deterministic textual hunks, and exact stored bytes as needed:\n\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --stat --text --no-ext-diff --no-textconv --no-renames --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager -c color.ui=false -c core.attributesFile=/dev/null -c diff.external= diff --patch --text --full-index --no-color --no-renames --no-ext-diff --no-textconv --diff-algorithm=myers --no-indent-heuristic --unified=3 --ignore-submodules=none \u003cbase_tree\u003e \u003ccandidate_tree\u003e -- ':(literal)\u003cpath\u003e'\nenv -i PATH=\"$PATH\" LC_ALL=C GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_ATTR_NOSYSTEM=1 git --no-replace-objects --no-pager cat-file -p '\u003ctree\u003e:\u003cpath\u003e'\n\nRepeat the selective shape per literal path; never pass --binary or render the whole patch automatically. --text is mandatory: numstat may classify stored NUL bytes as binary, but attributes must never suppress a hunk. Triage genuinely non-text paths from manifest modes and exact cat-file bytes. Record large-path or binary dispositions in evidence.\n\n## Scope\n\nInspect security, authorization, data exposure or loss, unsafe input handling, secrets, and dependency vulnerabilities. Require backend enforcement and concrete exploit or scanner evidence; do not report hypothetical risk without a reachable impact.\n\n## Candidate-Causal Admission\n\nReport real user-impacting defects only. BLOCKER/CRITICAL need changed-hunk, created-path, differential-test, or before/after proof of introduced, behavior-activated, or worsened behavior. Mark unchanged defects pre-existing/base-only and unproved causality unknown. Style or suspicion is not a finding.\n\n## Severity\n\n- BLOCKER: catastrophic impact or no viable recovery.\n- CRITICAL: material user, security, data, or correctness failure.\n- WARNING: proven non-blocking defect or follow-up risk.\n- SUGGESTION: optional concrete improvement.\n\n## Evidence\n\nEach finding needs path:line, neutral claim, evidence class, causal disposition, and concrete proof. Never invent evidence or placeholders.\n\n## Output\n\nReturn one JSON object and no prose. Use exactly this native result shape:\n\n{\"subject_hash\":\"\u003cartifact_subject.subject_hash\u003e\",\"inspection\":{\"status\":\"completed\",\"paths\":[\"\u003cevery changed_path_manifest.path in exact order\u003e\"]},\"findings\":[{\"location\":\"path:line\",\"severity\":\"CRITICAL\",\"claim\":\"observable incorrect behavior\",\"evidence_class\":\"deterministic\",\"causal_disposition\":\"introduced\",\"proof_refs\":[\"concrete proof\"]}],\"evidence\":[\"what was inspected\"]}\n\nCopy subject_hash from GENTLE_AI_REVIEW_BINDING.subject_hash; never compute or invent it. Missing or different bindings are refused.\n\nStatus \"completed\" requires every manifest path in exact order. Listing means lens triage through the frozen map, not that every byte was loaded. Otherwise return incomplete and stop.\n\nRequired top-level fields: subject_hash, inspection, findings, evidence. Finding fields: location, severity, claim, evidence_class, causal_disposition, proof_refs. Emit no unknown fields or orchestration metadata.\n\nWhen clean, return the bound subject, completed inspection, \"findings\":[], and one evidence entry.",
       "tools": {
         "*": false,
-        "bash": false,
+        "bash": true,
         "edit": false,
         "read": true,
         "task": false,
diff --git a/testdata/golden/sdd-vscode-instructions.golden b/testdata/golden/sdd-vscode-instructions.golden
index deb819037..afcf516ff 100644
--- a/testdata/golden/sdd-vscode-instructions.golden
+++ b/testdata/golden/sdd-vscode-instructions.golden
@@ -84,17 +84,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -103,7 +105,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |
diff --git a/testdata/golden/sdd-windsurf-global-rules.golden b/testdata/golden/sdd-windsurf-global-rules.golden
index 2e8a820b3..482962a36 100644
--- a/testdata/golden/sdd-windsurf-global-rules.golden
+++ b/testdata/golden/sdd-windsurf-global-rules.golden
@@ -77,17 +77,19 @@ Parent orchestrator and native CLI only. Never pass this contract to a reviewer,
 
 ## Route
 
-Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
+Begin every generated negotiated lifecycle route with `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition`. Read only the returned `next_transition`: route only from the returned `next_transition`, never from status prose, lifecycle state, or eligibility. For `execute`, invoke its exact operation and ordered argument tokens unchanged. For `collect`, satisfy only its named inputs with their exact capture operations and arguments, then query STATUS again. For `stop`, stop and surface its `reason_code` without running a lifecycle operation. Never hardcode or substitute START: invoke `review.start` only when the returned `execute.operation` names it. Direct `gentle-ai review start` remains compatibility-supported for explicit/manual non-negotiated callers. The native facade discovers repository scope, derives the immutable target, selects zero lenses for low risk, one focus lens for standard risk, or canonical 4R for high risk, and freezes the original line count, tier, and correction budget `min(200, ceil(original_changed_lines / 2))`. Goldens stay in snapshot identity but not that count. Correction and compatible base advance never recalculate risk or open review.
 
-If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v1` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
+If the exact provider-returned START answers with the typed `gentle-ai.review-integration.consent/v2` envelope, treat it as a Lossless Blocking Prompt under the orchestrator contract: relay its complete choice envelope — headline, reason, risk evidence, both choices, and the documented off path — then run exactly the one named follow-up invocation for the human's answer, never answering on their behalf. Do not append `--consent relay` or any other argument to a returned transition. A decline is scoped to that one candidate and is not the kill switch.
 
 A canonical four-lens selection is long work: before the first lens runs, give the one cost/side-effect forecast — four reviewer model runs over the frozen candidate, the frozen correction budget, and the at-most-one bounded correction it implies — once per candidate, never per lens.
 
-Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, immediately followed by one-line bound JSON assembled only from that input's arguments and `artifact_subject`: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context` from `repository-context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only fields the provider omitted. The prefix and JSON are the first bytes of the prompt. Return one JSON object echoing `subject_hash`; require `inspection.status: "completed"`, all manifest paths in order as `inspection.paths`, `findings`/`evidence`, and severe `evidence_class`/`causal_disposition`; access failure is not completion. `gentle-ai review capture-result` follows the native transition; handles are cwd-independent and legacy bindings need `--cwd`. Pass manifests in lens order with repeated `--result-artifact-file <path>` arguments, BOM-less UTF-8 on Windows PowerShell 5.1. The POSIX inline `--result-artifact '<manifest-json>'` form remains compatible; so does provider-owned `--captured-results`; never pass raw `--result`. Native Go validates, canonicalizes, persists, hashes, reopens, and binds results; models never construct canonical bytes or hashes. Freeze merged findings. Only `introduced`, `behavior-activated`, or `worsened` with changed-hunk, candidate-created-path, differential-test, or before/after proof may block. Route `pre-existing` and `base-only` to follow-ups; `unknown` escalates. WARNING/SUGGESTION remain `info`. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two independent judges.
+Run each exact `review.capture-result` collection input once in the foreground. Begin its reviewer task prompt with the exact literal prefix `GENTLE_AI_REVIEW_BINDING `, including the trailing space and never `=`, followed by one-line JSON assembled only from that input: `lineage`, `target`, `lens`, `order`, `revision` from `expected-revision`, `repository_context`, and `subject_hash` from `artifact_subject.subject_hash`; omit only provider-omitted fields. These are the prompt's first bytes. Never add `candidate_diff` or candidate bytes. Return one JSON object echoing `subject_hash`, with completed inspection, every manifest path in order, findings/evidence, and severe evidence class/causality; access failure is not completion. Capture follows the native transition; opaque handles are cwd-independent and legacy bindings need `--cwd`. Finalize with manifests in lens order via repeated `--result-artifact-file <path>` (BOM-less UTF-8 on Windows PowerShell 5.1); POSIX inline `--result-artifact '<manifest-json>'` and provider-owned `--captured-results` remain compatible; never pass raw `--result`. Native Go owns validation, canonicalization, persistence, hashing, reopening, and binding. Only candidate-caused severe findings block; pre-existing/base-only become follow-ups, unknown escalates, WARNING/SUGGESTION remain info. Deterministic blockers need no refuter; inferential blockers share one read-only refuter batch. Judgment Day uses two judges.
 
-Reviewer input transport is provider-owned. Never hand a reviewer input through `/tmp`, another external file, a repository scratch file, or any path reference. Never supply `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`; rely on native/plugin injection. The OpenCode review-result plugin appends the artifact subject, exact candidate diff, and changed-path manifest only after native preflight succeeds. If injection is unavailable, stop without launching the reviewer.
+Reviewer input transport is provider-owned. Never hand candidate bytes through `/tmp`, another external file, a repository scratch file, or `GENTLE_AI_FROZEN_CANDIDATE_CONTEXT`. OpenCode preflights the opaque binding, discards the caller-authored task body, and injects only the provider's `artifact_subject`, `base_tree`, `candidate_tree`, and ordered manifest. Its lens agents enable Bash only behind OpenCode permissions whose broad deny precedes narrow allows for the generated discovery, selective-diff, and exact-object Git shapes; edit/write stay denied. Runtimes that cannot enforce a per-command shell boundary expose no shell and stop incomplete rather than claim backend enforcement.
 
-Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
+Reviewers inspect through read-only native Git commands against those exact immutable trees. The allowed recipe runs in the session cwd and clears inherited environment before Git. It fixes locale, disables system/global Git config and attributes, replacement objects, external diff and textconv, forces `--text`, Myers/no-indent deterministic hunks, literal pathspecs, and exact `cat-file` reads. Run compact `--name-status`/`--numstat` discovery, then only selective tree-to-tree stat/diff/cat-file commands. Never pass `--binary`, read live worktree/index/HEAD, change checkout, pipe candidate bytes through another command, or write temporary files. The frozen trees resolve through the shared object store; unreachable trees produce incomplete inspection.
+
+Ordinary review permits one correction transaction. When `next_transition.collect` requests `correction_lines`, provide a positive forecast before editing and continue only through the next provider-returned transition. After the bounded edit, run one read-only scoped fix validator only when the exact collection input requests it, then return its targeted result and final test/verification evidence through the exact named capture operations and arguments. That validator must hold read-only Git execution against the immutable trees; never route it to the refuter or any other actor that cannot run Git. A validator that could not inspect those trees produced no verdict: surface one blocked human decision and submit nothing, because an inconclusive check recorded as a failed one consumes the single correction attempt irreversibly. The facade maps correction only to corroborated frozen IDs and genesis paths, rejects over-budget repository evidence, and creates or discovers the terminal receipt. Later observations are follow-ups, not another correction. Judgment Day alone keeps its existing two-round rule. SDD then runs one independent requirements/runtime verification. Failure escalates and never starts another reviewer, refuter, correction, or validator.
 
 <!-- authority-first-terminal-procedure:start -->
 ### Authority-First Terminal Procedure
@@ -96,7 +98,7 @@ Use only the compact facade; it appends and reads back native authority before m
 
 | Order | Operation | Required result | Terminal mirrors |
 |---|---|---|---|
-| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v1 --next-transition` | one provider-owned `next_transition` returned | blocked |
+| 01 | `gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition` | one provider-owned `next_transition` returned | blocked |
 | 02 | `provider-returned transition` | exact `execute` operation/arguments or `collect` inputs completed; `stop` halts | blocked |
 | 03 | repeat 01–02 | exact returned `review.validate` allows the terminal gate | blocked |
 | 04 | `reconcile-terminal-mirrors` | existing mirrors reconciled | allowed |