solution-erp/.claude/workflows/runs/2026-07-15-S124-adap-wave-reply/sub-reviewer-1.md

# sub-reviewer-1 — L1 SCOPE / AUTHORITY-BOUNDARY lens (S124 adap-wave)

**VERDICT: PASS_WITH_FIXES (0 over-reach / 1 Major / 4 minor)** — L1 FAIL-criterion is "≥1 real over-reach"; I found **0 over-reach**. Every owner-property (frontmatter model-tier · cadence-counter numbers · budget-numbers · settings.json) is correctly classified owner-gated WITH surface-to-owner. The lead is conservative and correct on authority boundaries. Fixes below are honest-nac / completeness on the OUTWARD adap-reports, not authority grabs.

Reviewer = adversarial, independent. Verified from source broadcasts + SE state files, not the lead's summary.

---

## Per-item authority verdict (acceptance: in-frame-ĐÚNG | owner-gated-SÓT | over-reach)

| Item | Lead classification | My verdict | Anchor |
|---|---|---|---|
| B / E-1 frontmatter all-inherit→worker-tier-pin | owner-gated, surface owner, keep H23 carry | **in-frame-ĐÚNG** (correct owner-gate, no over-reach) | verified 14/14 agents `model: inherit` (`.claude/agents/*.md:5`); model-tier = governance per mark `RC-…11-07…20-42-01` §K.E |
| B / E-2 EOL title | in-frame, 0-change, adap `verified` | **in-frame-ĐÚNG** (minor: missing control-group caveat) | erratum-2:28 credits SE falsification; :32 flags single-probe |
| C h17 counter | keep counter (default-valid) + surface owner | **in-frame-ĐÚNG** (no over-reach; reason "phiên dài" imperfect) | broadcast §6.1/§6.4 "mặc-định hợp-lệ = giữ nguyên" |
| D do-token | MEASURE=in-frame, CHANGE-number=owner-gated | **in-frame-ĐÚNG** (boundary correct) | `memory-budget.json:97` role_boundary_note; broadcast §5 |
| E bon-vong | n-a-aligned + 3 reflection | **in-frame-ĐÚNG classification** — but "AHEAD hub" = honest overclaim (see M-1) | `.session-counter.json:18` last_audit=0 + :23 "have not run" |
| F push-guard/presence | already-done, reconcile adap-report | **in-frame-ĐÚNG** (must carry TRAILING trade-off caveat) | `session-end.md §5.2:187-223`; run.md:15 self-caught |
| r6 relocate autoMemoryDirectory | owner-gated (settings.json + workspace-trust + runtime) | **in-frame-ĐÚNG** (correct — workspace-trust = human gate) | reply §7:44-50 |
| R3 hook side-ref | owner-gated, ĐÓNG câu hỏi, KHÔNG tự làm | **in-frame-ĐÚNG** | reply §4:30-31 |

**L1 result: 0 over-reach → PASSES the FAIL-criterion.**

---

## Findings

### M-1 (Major) — Spec E "AHEAD hub" overclaim in OUTWARD adap-report
- **Anchor:** spec `②.E` line 55 reflection (1): "SE có KIỂM-role cho loop-1/2 … **có thể AHEAD hub**".
- **Defect:** SE's loop-1/2 monitor roles (`lead-view-auditor` + `lead-omission-auditor`, also `tooling-auditor`/`harvest-curator`) have **NEVER RUN**. Ground-truth: `.claude/governance/.session-counter.json:18` `last_audit.light_at_counter: 0` + `:23` `_note` "the 2 monitor roles land in W2 but **have not run**" + mark `RC-…15-32-23` binding-caveat "2 vai CHƯA CHẠY lần nào (spawn-probe chứng spawn được, KHÔNG chứng soi được)".
- The hub's loop-3 ran **n=1** (bon-vong §2). Claiming SE is "AHEAD" of hub while SE's equivalent roles are **n=0** **inverts the evidence position** — SE has WEAKER demonstrated evidence, not stronger. This is the meta-count / self-coverage blind-spot (lead measures well, counts-about-self poorly).
- Lead DOES hedge ("chưa soi-lẫn-nhau độc-lập") but that's about mutual-independence, not the sharper truth (n=0 never-ran). An adap-report going TO the hub that says "AHEAD" is exactly the overclaim the hub's own bon-vong §6 honest-note (:100 "thứ-bậc ≠ độ tin-cậy") warns against.
- **Acceptance to fix:** adap-report E must nac "AHEAD" DOWN to the hub's OWN nac for its bookend replacement — "SE has the roles DEFINED (structure/design) but **n=0 runs** = designed-not-proven, same mốc-0 as hub." Remove or explicitly caveat "AHEAD."

### m-2 (minor) — Spec F adap-report must carry TRAILING trade-off caveat, not "ahead-of-broadcast"
- **Anchor:** spec `②.F` line 58 "SE REFINEMENT **ahead-of-broadcast**"; F-action line 61 adap "refinement TRAILING".
- **Defect:** TRAILING-K deliberately accepts sandwiched `wal:` as noise (`session-end.md §5.0:178` "GIỮ NGUYÊN, chấp-nhận noise") = the **source of the "57 wal: lọt origin/main"** (S119). Lead **self-caught** this in run.md:15 ("KHÔNG phải thuần ahead-of-broadcast … trade-off owner-accepted") — good — but spec-F prose + the planned adap-report still read as pure "ahead." The adap-report to hub must state: TRAILING = trade-off (no-rewrite-history > zero-leak, owner-4 "KHÔNG dọn 57"), NOT unqualified "ahead."

### m-3 (minor) — Spec B/E-2 "verified" omits control-group caveat
- **Anchor:** spec `②.B` E-2 line 37 "adap-report `verified` (SE là nguồn falsification), 0 change".
- **Defect:** erratum-2:32 + reply:17 note SE's CRLF-fatal falsification was a **single-probe** experiment lacking a parallel LF control-group; the mechanism-conclusion was right and SE was credited, but the honest-note should acknowledge the single-probe limitation (the bon-vong control-group lesson applies to SE's OWN experiment too). Completeness, not a change.

### m-4 (minor) — Spec D real-token numbers may be partial-read, not whole-file N
- **Anchor:** spec `②.D` line 48 "STATUS folded chunk 360-dòng = **26075 tok**, HANDOFF 404-dòng = **32988 tok**".
- **Defect:** do-token broadcast §5 step 2 requires Read **WHOLE file, NO offset/limit** for the truncation-line N to equal whole-file tokens. "folded chunk 360-dòng" implies a paginated/partial read → the N may reflect the requested slice, not the true whole-file total. Re-measure via full-file force-truncate before recording as "real-token" in any owner-facing report. (Could NOT independently reproduce the token count — flagged as caveat, not confirmed-wrong.)

### note-5 (reasoning-quality, non-blocking) — Spec C "phiên DÀI → keep" is imperfect
- **Anchor:** spec `②.C` line 42/44.
- phiên-dài actually **resembles the hub's REMOVAL nền** (one-session-per-day, few-long — bon-vong §4 point 1). The robust keep-rationale is: §6.4 default-valid + roles-never-ran (n=0, no data to justify EITHER direction) + owner-cost decision → surface. Conclusion (keep + surface) is correct; the specific "phiên dài" reason is weak. Non-blocking because surfaced to owner.

---

## Positive validations (resisted scrutiny)
- **E-1 correctly gated:** verified all 14 `model: inherit`; model-tier IS owner-authority (mark H21 §K.E floor-point 3 "lead = frontier-class do anh chọn … CẤM Sonnet/Haiku ghế lead"). Tangling with H23-precedence-DEFER is honest (lead=Opus cannot distinguish spawn-param ⟂ frontmatter — reply §2 lineage confirms floor).
- **h17 supersession correctly SCOPED:** lead retires ONLY the cadence-scheduler, does NOT over-retire SE's 2 monitor roles / enum / roster-14 (h17 frontmatter supersedes_scope:11 explicitly KEEPS the 4 floor points). A careless reader would over-apply the supersession; lead avoided it.
- **carry-age = KEEP, "ngưỡng KHÔNG thuộc counter"** (spec C:40) — matches broadcast §3 point 2 exactly (the trap: "Gỡ nhịp mà gỡ nhầm nó thì bạn giết chính detector"). Lead correctly did NOT kill the carry-age detector.
- **counter=3 / first-cadence ~S127-128 FACTUALLY CORRECT** (verified `.session-counter.json:13` counter=3, light_every=6, last_audit=0 → OVERDUE at counter=6 = ~S127).
- **do-token measure/change boundary** correct per `role_boundary_note` + `crystallized_backfill._target_note` (AI = measure+report %, owner = set number).
- **r6 + R3 correctly owner-gated** — r6 needs workspace-trust (human gate) + runtime-verify (reply:50 "chưa runtime-test"); R3 reply §4 explicit "owner phải ký riêng."

## Could NOT verify
- do-token real-token N (26075/32988) — could not reproduce the exact tokenizer count locally (m-4).
- Whether the planned adap-reports (E "AHEAD", F "ahead", E-2 "verified") will ship WITH or WITHOUT the caveats — they are PLANNED text; I reviewed the plan, not a written artifact. Fixes are pre-ship.