diff --git a/packages/cli/src/commands/review/cleanup.test.ts b/packages/cli/src/commands/review/cleanup.test.ts
index 9530465b45d..690d0794c0e 100644
--- a/packages/cli/src/commands/review/cleanup.test.ts
+++ b/packages/cli/src/commands/review/cleanup.test.ts
@@ -7,6 +7,9 @@ const mocks = vi.hoisted(() => ({
   execFileSync: vi.fn(),
   existsSync: vi.fn(() => false),
   readdirSync: vi.fn(() => []),
+  readFileSync: vi.fn((_path: string): string => {
+    throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+  }),
   rmSync: vi.fn(),
   writeStdoutLine: vi.fn(),
   writeStderrLine: vi.fn(),
@@ -17,6 +20,10 @@ const mocks = vi.hoisted(() => ({
     freed: false,
     reason: undefined,
   })),
+  ghApiAll: vi.fn((_path: string): unknown[] => []),
+  currentUser: vi.fn(() => 'reviewer'),
+  setGhHost: vi.fn(),
+  getGhHost: vi.fn((): string | undefined => undefined),
 }));
 
 vi.mock('node:child_process', async (importOriginal) => {
@@ -36,10 +43,12 @@ vi.mock('node:fs', async (importOriginal) => {
       ...actual,
       existsSync: mocks.existsSync,
       readdirSync: mocks.readdirSync,
+      readFileSync: mocks.readFileSync,
       rmSync: mocks.rmSync,
     },
     existsSync: mocks.existsSync,
     readdirSync: mocks.readdirSync,
+    readFileSync: mocks.readFileSync,
     rmSync: mocks.rmSync,
   };
 });
@@ -58,15 +67,30 @@ vi.mock('./lib/git.js', () => ({
   releaseWorktree: mocks.releaseWorktree,
 }));
 
+vi.mock('./lib/gh.js', () => ({
+  ghApiAll: mocks.ghApiAll,
+  currentUser: mocks.currentUser,
+  setGhHost: mocks.setGhHost,
+  getGhHost: mocks.getGhHost,
+}));
+
 vi.mock('./lib/paths.js', () => ({
   worktreePath: (prNumber: string) => `/repo/.qwen/tmp/review-pr-${prNumber}`,
   probeWorktreePath: (path: string) => `${path}-probe`,
   reviewBranch: (prNumber: string) => `qwen-review/pr-${prNumber}`,
   REVIEW_TMP_DIR: '/repo/.qwen/tmp',
+  tmpFile: (target: string, suffix: string) =>
+    `/repo/.qwen/tmp/qwen-review-${target}-${suffix}`,
   tmpPrefix: (target: string) => `qwen-review-${target}-`,
 }));
 
-import { runCleanup } from './cleanup.js';
+import {
+  findUnsanctionedIssueComments,
+  findUnsanctionedReviews,
+  runCleanup,
+  type RawIssueComment,
+  type RawReview,
+} from './cleanup.js';
 
 describe('runCleanup', () => {
   beforeEach(() => {
@@ -109,3 +133,525 @@ describe('runCleanup', () => {
     );
   });
 });
+
+describe('findUnsanctionedIssueComments', () => {
+  const since = '2026-07-24T08:00:00Z';
+  const comment = (over: Partial<RawIssueComment> & { id: number }) =>
+    ({
+      user: { login: 'reviewer' },
+      created_at: '2026-07-24T09:00:00Z',
+      ...over,
+    }) as RawIssueComment;
+
+  it('keeps only the reviewing account inside the window, case-insensitively', () => {
+    const got = findUnsanctionedIssueComments(
+      [
+        comment({ id: 1 }),
+        comment({ id: 2, user: { login: 'Reviewer' } }),
+        comment({ id: 3, user: { login: 'someone-else' } }),
+        comment({ id: 4, created_at: '2026-07-24T07:59:59Z' }),
+      ],
+      'reviewer',
+      since,
+    );
+    expect(got.posted.map((c) => c.id)).toEqual([1, 2]);
+    expect(got.edited).toEqual([]);
+  });
+
+  it('classifies a pre-window comment edited inside the window as an edit', () => {
+    const got = findUnsanctionedIssueComments(
+      [
+        comment({
+          id: 5,
+          created_at: '2026-07-24T07:00:00Z',
+          updated_at: '2026-07-24T09:00:00Z',
+        }),
+        comment({
+          id: 6,
+          created_at: '2026-07-24T07:00:00Z',
+          updated_at: '2026-07-24T07:00:00Z',
+        }),
+      ],
+      'reviewer',
+      since,
+    );
+    expect(got.edited.map((c) => c.id)).toEqual([5]);
+    expect(got.posted).toEqual([]);
+  });
+
+  it('still flags a comment that merely QUOTES an automation marker mid-body', () => {
+    // The filter is anchored to the body start: a hand-posted summary quoting
+    // a marked bot comment (or hiding the marker mid-body) stays visible.
+    const got = findUnsanctionedIssueComments(
+      [
+        comment({
+          id: 9,
+          body: 'summary quoting:\n<!-- qwen-triage stage=1 -->',
+        }),
+      ],
+      'reviewer',
+      since,
+    );
+    expect(got.posted.map((c) => c.id)).toEqual([9]);
+  });
+
+  it('drops comments carrying the repo automation marker — CI shares the bot account', () => {
+    const got = findUnsanctionedIssueComments(
+      [
+        comment({
+          id: 7,
+          body: '<!-- qwen-pr-precheck:manual-required -->\nchecks…',
+        }),
+        comment({ id: 8, body: 'a human sentence' }),
+      ],
+      'reviewer',
+      since,
+    );
+    expect(got.posted.map((c) => c.id)).toEqual([8]);
+  });
+
+  it('drops comments with no author or no timestamp instead of guessing', () => {
+    const got = findUnsanctionedIssueComments(
+      [
+        comment({ id: 1, user: null }),
+        comment({ id: 2, created_at: undefined }),
+      ],
+      'reviewer',
+      since,
+    );
+    expect(got.posted).toEqual([]);
+    expect(got.edited).toEqual([]);
+  });
+});
+
+describe('findUnsanctionedReviews', () => {
+  const since = '2026-07-24T08:00:00Z';
+  const review = (over: Partial<RawReview> & { id: number }) =>
+    ({
+      user: { login: 'reviewer' },
+      state: 'COMMENTED',
+      submitted_at: '2026-07-24T09:00:00Z',
+      ...over,
+    }) as RawReview;
+
+  it('flags in-window reviews by the account that the receipt does not vouch for', () => {
+    const got = findUnsanctionedReviews(
+      [
+        review({ id: 1 }),
+        review({ id: 2, user: { login: 'someone-else' } }),
+        review({ id: 3, submitted_at: '2026-07-24T07:00:00Z' }),
+      ],
+      'reviewer',
+      since,
+      new Set(),
+    );
+    expect(got.map((r) => r.id)).toEqual([1]);
+  });
+
+  it('excludes every receipt-vouched review id, not just the last', () => {
+    // Two sanctioned submits in one window (drift restart) — both ids are on
+    // the receipt, and NEITHER may be flagged.
+    const got = findUnsanctionedReviews(
+      [review({ id: 1 }), review({ id: 2 }), review({ id: 3 })],
+      'reviewer',
+      since,
+      new Set([2, 3]),
+    );
+    expect(got.map((r) => r.id)).toEqual([1]);
+  });
+});
+
+describe('runCleanup — bypass-write audit', () => {
+  const fetchReport = JSON.stringify({
+    prNumber: '123',
+    ownerRepo: 'acme/widgets',
+    fetchedAt: '2026-07-24T08:00:00Z',
+    host: 'ghe.example.com',
+  });
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.existsSync.mockReturnValue(false);
+    mocks.execFileSync.mockReturnValue(Buffer.from(''));
+    mocks.readFileSync.mockImplementation(() => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+    });
+    mocks.currentUser.mockReturnValue('reviewer');
+    mocks.ghApiAll.mockReturnValue([]);
+  });
+
+  it('flags reviewer issue comments posted inside the window', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockReturnValue([
+      {
+        id: 42,
+        user: { login: 'reviewer' },
+        created_at: '2026-07-24T09:02:32Z',
+        html_url: 'https://ghe.example.com/acme/widgets/pull/123#c42',
+      },
+      {
+        id: 43,
+        user: { login: 'pr-author' },
+        created_at: '2026-07-24T09:03:00Z',
+      },
+    ]);
+
+    runCleanup('pr-123');
+
+    expect(mocks.readFileSync).toHaveBeenCalledWith(
+      '/repo/.qwen/tmp/qwen-review-pr-123-fetch.json',
+      'utf8',
+    );
+    expect(mocks.setGhHost).toHaveBeenCalledWith('ghe.example.com');
+    expect(mocks.ghApiAll).toHaveBeenCalledWith(
+      expect.stringContaining('repos/acme/widgets/issues/123/comments'),
+    );
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain('posted comment 42');
+    expect(warnings.join('\n')).not.toContain('comment 43');
+    expect(warnings.join('\n')).toContain('qwen review submit');
+  });
+
+  it('stays silent when the window is clean', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockReturnValue([
+      {
+        id: 7,
+        user: { login: 'pr-author' },
+        created_at: '2026-07-24T09:00:00Z',
+      },
+    ]);
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings).toEqual([]);
+  });
+
+  it('skips the audit without gh calls when the fetch report is absent or pre-fetchedAt, and names the skip', () => {
+    runCleanup('pr-123'); // report missing (readFileSync throws)
+    mocks.readFileSync.mockReturnValue(
+      JSON.stringify({ prNumber: '123', ownerRepo: 'acme/widgets' }),
+    );
+    runCleanup('pr-123'); // old report without fetchedAt
+
+    expect(mocks.ghApiAll).not.toHaveBeenCalled();
+    expect(mocks.setGhHost).not.toHaveBeenCalled();
+    const notes = mocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('note: bypass audit skipped'));
+    expect(notes.some((l) => l.includes('no fetch report'))).toBe(true);
+    expect(notes.some((l) => l.includes('no fetchedAt'))).toBe(true);
+  });
+
+  it('skips when the fetch report names a different PR than the cleanup target', () => {
+    mocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '999',
+        ownerRepo: 'acme/widgets',
+        fetchedAt: '2026-07-24T08:00:00Z',
+      }),
+    );
+
+    runCleanup('pr-123');
+
+    expect(mocks.ghApiAll).not.toHaveBeenCalled();
+    const notes = mocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('note: bypass audit skipped'));
+    expect(notes.some((l) => l.includes('for PR 999'))).toBe(true);
+  });
+
+  it('clears any prior Enterprise host for a github.com report (host: null)', () => {
+    // setGhHost(undefined) is what un-routes gh after an Enterprise review in
+    // the same process; only the Enterprise fixture was asserted before.
+    mocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '123',
+        ownerRepo: 'acme/widgets',
+        fetchedAt: '2026-07-24T08:00:00Z',
+        host: null,
+      }),
+    );
+    mocks.ghApiAll.mockReturnValue([
+      {
+        id: 9,
+        user: { login: 'reviewer' },
+        created_at: '2026-07-24T09:00:00Z',
+      },
+    ]);
+
+    runCleanup('pr-123');
+
+    expect(mocks.setGhHost).toHaveBeenCalledWith(undefined);
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain('posted comment 9');
+  });
+
+  it('restores the prior gh host after the audit instead of leaking the override', () => {
+    // A host set before cleanup ran must be back in place afterwards — the
+    // audit's Enterprise override is scoped to the audit block.
+    mocks.getGhHost.mockReturnValue('prior.example.com');
+    mocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '123',
+        ownerRepo: 'acme/widgets',
+        fetchedAt: '2026-07-24T08:00:00Z',
+        host: 'ghe.example.com',
+      }),
+    );
+    mocks.ghApiAll.mockReturnValue([]);
+
+    runCleanup('pr-123');
+
+    // Override applied, then the prior host restored (the last call).
+    expect(mocks.setGhHost).toHaveBeenCalledWith('ghe.example.com');
+    expect(mocks.setGhHost).toHaveBeenLastCalledWith('prior.example.com');
+  });
+
+  it('does not resolve the current user when the window has no comments at all', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockReturnValue([]);
+
+    runCleanup('pr-123');
+
+    expect(mocks.currentUser).not.toHaveBeenCalled();
+  });
+
+  it('reaches back past the recorded opening by the clock-skew allowance', () => {
+    // fetchedAt 08:00:00 → boundary 07:58:00; a comment at 07:58:30 predates
+    // the recorded opening but only by less than the allowance, so a fast
+    // local clock cannot hide it.
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockImplementation((path: string) =>
+      path.includes('/issues/')
+        ? [
+            {
+              id: 11,
+              user: { login: 'reviewer' },
+              created_at: '2026-07-24T07:58:30Z',
+            },
+          ]
+        : [],
+    );
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain('posted comment 11');
+    expect(
+      String(
+        mocks.ghApiAll.mock.calls.find(([p]) =>
+          String(p).includes('/issues/'),
+        )![0],
+      ),
+    ).toContain(encodeURIComponent('2026-07-24T07:58:00.000Z'));
+  });
+
+  it('audits from auditSince when drift restarts pushed fetchedAt forward', () => {
+    mocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '123',
+        ownerRepo: 'acme/widgets',
+        fetchedAt: '2026-07-24T10:00:00Z',
+        auditSince: '2026-07-24T08:00:00Z',
+        host: null,
+      }),
+    );
+    mocks.ghApiAll.mockImplementation((path: string) =>
+      path.includes('/issues/')
+        ? [
+            {
+              id: 12,
+              user: { login: 'reviewer' },
+              created_at: '2026-07-24T08:30:00Z',
+            },
+          ]
+        : [],
+    );
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain('posted comment 12');
+  });
+
+  it('renders the edited-comment warning with id, timestamp and URL through runCleanup', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockImplementation((path: string) =>
+      path.includes('/issues/')
+        ? [
+            {
+              id: 21,
+              user: { login: 'reviewer' },
+              created_at: '2026-07-24T06:00:00Z',
+              updated_at: '2026-07-24T09:10:00Z',
+              html_url: 'https://ghe.example.com/acme/widgets/pull/123#c21',
+            },
+          ]
+        : [],
+    );
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain(
+      'edited comment 21 at 2026-07-24T09:10:00Z — https://ghe.example.com/acme/widgets/pull/123#c21',
+    );
+  });
+
+  it('flags an in-window review with no receipt, and spares the receipt-vouched one', () => {
+    mocks.readFileSync.mockImplementation((path: string) => {
+      if (String(path).endsWith('submit-receipt.json')) {
+        return JSON.stringify({ reviewId: 500 });
+      }
+      return fetchReport;
+    });
+    mocks.ghApiAll.mockImplementation((path: string) =>
+      path.includes('/reviews')
+        ? [
+            {
+              id: 500,
+              user: { login: 'reviewer' },
+              state: 'COMMENT',
+              submitted_at: '2026-07-24T09:00:00Z',
+            },
+            {
+              id: 501,
+              user: { login: 'reviewer' },
+              state: 'APPROVED',
+              submitted_at: '2026-07-24T09:05:00Z',
+              html_url: 'https://ghe.example.com/acme/widgets/pull/123#r501',
+            },
+          ]
+        : [],
+    );
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    expect(warnings.join('\n')).toContain('review 501 (APPROVED)');
+    expect(warnings.join('\n')).toContain('no submit receipt vouches for it');
+    expect(warnings.join('\n')).not.toContain('review 500');
+  });
+
+  it('spares every review in a multi-id receipt (two sanctioned submits in one window)', () => {
+    mocks.readFileSync.mockImplementation((path: string) => {
+      if (String(path).endsWith('submit-receipt.json')) {
+        return JSON.stringify({ reviewIds: [500, 502] });
+      }
+      return fetchReport;
+    });
+    mocks.ghApiAll.mockImplementation((path: string) =>
+      path.includes('/reviews')
+        ? [
+            {
+              id: 500,
+              user: { login: 'reviewer' },
+              state: 'COMMENT',
+              submitted_at: '2026-07-24T09:00:00Z',
+            },
+            {
+              id: 502,
+              user: { login: 'reviewer' },
+              state: 'COMMENT',
+              submitted_at: '2026-07-24T09:05:00Z',
+            },
+          ]
+        : [],
+    );
+
+    runCleanup('pr-123');
+
+    const warnings = mocks.writeStdoutLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('warning:'));
+    // Both are receipt-vouched → no bypass warning at all.
+    expect(warnings.join('\n')).not.toContain('review 500');
+    expect(warnings.join('\n')).not.toContain('review 502');
+  });
+
+  it('names each malformed-report shape and never reaches GitHub', () => {
+    const cases: Array<[string, string]> = [
+      ['not json at all {', 'not valid JSON'],
+      [
+        JSON.stringify({ fetchedAt: '2026-07-24T08:00:00Z' }),
+        'missing prNumber/ownerRepo',
+      ],
+      [
+        JSON.stringify({
+          prNumber: '123',
+          ownerRepo: 'evil repo/../../x',
+          fetchedAt: '2026-07-24T08:00:00Z',
+        }),
+        'not owner/repo-shaped',
+      ],
+    ];
+    for (const [raw, expected] of cases) {
+      vi.clearAllMocks();
+      mocks.readFileSync.mockReturnValue(raw);
+      runCleanup('pr-123');
+      expect(mocks.ghApiAll).not.toHaveBeenCalled();
+      const notes = mocks.writeStderrLine.mock.calls
+        .map((c) => String(c[0]))
+        .filter((l) => l.startsWith('note: bypass audit skipped'));
+      expect(notes.join('\n')).toContain(expected);
+    }
+  });
+
+  it('distinguishes an unreadable report from an absent one', () => {
+    mocks.readFileSync.mockImplementation(() => {
+      throw Object.assign(new Error('EACCES: permission denied'), {
+        code: 'EACCES',
+      });
+    });
+
+    runCleanup('pr-123');
+
+    const notes = mocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('note: bypass audit skipped'));
+    expect(notes.join('\n')).toContain('cannot read fetch report (EACCES)');
+    expect(notes.join('\n')).not.toContain('no fetch report');
+  });
+
+  it('surfaces the first non-empty stderr line when gh fails, not the generic wrapper', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockImplementation(() => {
+      throw Object.assign(new Error('Command failed: gh api …'), {
+        stderr: '\ngh: Not authenticated. Run gh auth login.\n',
+      });
+    });
+
+    runCleanup('pr-123');
+
+    const notes = mocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .filter((l) => l.startsWith('note: bypass audit skipped'));
+    expect(notes.join('\n')).toContain('gh: Not authenticated');
+  });
+
+  it('never fails the cleanup when the audit itself fails', () => {
+    mocks.readFileSync.mockReturnValue(fetchReport);
+    mocks.ghApiAll.mockImplementation(() => {
+      throw new Error('gh: not authenticated');
+    });
+
+    expect(() => runCleanup('pr-123')).not.toThrow();
+    expect(mocks.clearReviewWorktreeLease).toHaveBeenCalled();
+  });
+});
diff --git a/packages/cli/src/commands/review/cleanup.ts b/packages/cli/src/commands/review/cleanup.ts
index 517fb4aa31f..efdccc5119d 100644
--- a/packages/cli/src/commands/review/cleanup.ts
+++ b/packages/cli/src/commands/review/cleanup.ts
@@ -5,6 +5,7 @@
  */
 
 // Post-review cleanup for /review Step 9.
+//   - Audit the PR for writes that bypassed `qwen review submit` (PR targets).
 //   - Remove the temporary worktree at .qwen/tmp/review-pr-<n>.
 //   - Delete the local branch ref qwen-review/pr-<n>.
 //   - Remove any .qwen/tmp/qwen-review-<target>-* side files.
@@ -13,16 +14,19 @@
 
 import type { CommandModule } from 'yargs';
 import { execFileSync } from 'node:child_process';
-import { existsSync, readdirSync, rmSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { writeStdoutLine, writeStderrLine } from '../../utils/stdioHelpers.js';
 import { clearReviewWorktreeLease } from '../../services/review-worktree-lease.js';
+import { currentUser, getGhHost, ghApiAll, setGhHost } from './lib/gh.js';
+import { parseReceiptIds } from './lib/receipt.js';
 import { refExists, releaseWorktree } from './lib/git.js';
 import {
   worktreePath,
   probeWorktreePath,
   reviewBranch,
   REVIEW_TMP_DIR,
+  tmpFile,
   tmpPrefix,
 } from './lib/paths.js';
 
@@ -30,6 +34,339 @@ interface CleanupArgs {
   target: string;
 }
 
+/** An issue comment, as listed by `GET /issues/{n}/comments`. */
+export interface RawIssueComment {
+  id: number;
+  user?: { login: string } | null;
+  body?: string | null;
+  created_at?: string;
+  updated_at?: string;
+  html_url?: string;
+}
+
+/**
+ * Marker prefix every bot comment in this repo's own automation carries
+ * (`<!-- qwen-review-ack -->`, `<!-- qwen-pr-precheck:… -->`,
+ * `<!-- qwen-triage:… -->`, …). In CI the review runs under the same bot
+ * account those workflows post from, and a push mid-review triggers them —
+ * without this filter every such comment would be flagged as a bypass.
+ */
+const AUTOMATION_MARKER = '<!-- qwen-';
+
+/**
+ * The bot workflows put their marker on the FIRST line of the body; anchoring
+ * the test there keeps a hand-posted summary that merely QUOTES a marked
+ * comment (or deliberately embeds the marker mid-body to hide) visible to
+ * the tripwire.
+ */
+function isAutomationComment(body: string | null | undefined): boolean {
+  return (body ?? '').trimStart().startsWith(AUTOMATION_MARKER);
+}
+
+/**
+ * Clock-skew allowance subtracted from the recorded window opening before it
+ * is used as the audit boundary. `fetchedAt` is a LOCAL timestamp compared
+ * against GitHub's SERVER timestamps: a fast local clock would otherwise
+ * hide bypass writes made in the first moments of the review. Two minutes
+ * errs toward over-flagging (fail-safe — the warning copy already covers
+ * "the user did this themselves").
+ */
+const CLOCK_SKEW_MS = 2 * 60 * 1000;
+
+export interface WindowWrites {
+  /** Created inside the window by the reviewing account — the incident shape. */
+  posted: RawIssueComment[];
+  /** Created before the window but edited inside it. Reactions do NOT bump
+   * an issue comment's `updated_at` (verified empirically), so an entry here
+   * is a real body edit. */
+  edited: RawIssueComment[];
+}
+
+/**
+ * Issue-comment writes by the reviewing account inside the review window.
+ *
+ * `qwen review submit` is the ONLY sanctioned write in `/review`, and it
+ * posts a *review* — never an issue comment. So an issue comment the
+ * reviewing account created (or edited — the Step 7 ban covers edits too,
+ * and `?since=` filters on `updated_at`, so edited rows are already in the
+ * response) inside the window is a write that bypassed the submit gate,
+ * something the user did by hand from another terminal, or another workflow
+ * running under the same account; the warning below names all three
+ * readings and lets the human decide. Zero overlap with sanctioned output
+ * means zero correlation bookkeeping. Comments carrying this repo's own
+ * automation marker are dropped: in CI the reviewing account IS the bot
+ * that precheck/triage post from.
+ *
+ * This is a tripwire, not a wall. The gate itself lives in `submit` (it
+ * refuses unauthorised posts), but a model that stops *calling* submit walks
+ * around it — dogfooded: after four context compressions a run hand-posted
+ * its summary with `gh pr comment`, printed no completion line, and nothing
+ * anywhere noticed. Prose bans are exactly what compression loses, so the
+ * detection has to live in the deterministic layer that always runs.
+ */
+export function findUnsanctionedIssueComments(
+  comments: RawIssueComment[],
+  reviewer: string,
+  sinceIso: string,
+): WindowWrites {
+  const reviewerLc = reviewer.toLowerCase();
+  const relevant = comments.filter(
+    (c) =>
+      (c.user?.login ?? '').toLowerCase() === reviewerLc &&
+      typeof c.created_at === 'string' &&
+      !isAutomationComment(c.body),
+  );
+  return {
+    posted: relevant.filter((c) => c.created_at! >= sinceIso),
+    edited: relevant.filter(
+      (c) =>
+        c.created_at! < sinceIso &&
+        typeof c.updated_at === 'string' &&
+        c.updated_at >= sinceIso,
+    ),
+  };
+}
+
+/**
+ * Fields the audit needs from the fetch report. The report is the carrier
+ * (not the worktree lease) because it is written on every PR run — the lease
+ * only exists when the session env vars are set.
+ */
+interface AuditWindow {
+  prNumber: string;
+  ownerRepo: string;
+  fetchedAt: string;
+  /** Earliest window opening across drift restarts (fetch-pr preserves it);
+   * falls back to fetchedAt for reports written before it existed. A restart
+   * must not blind the audit to writes made during the abandoned attempt. */
+  auditSince: string;
+  host: string | null;
+}
+
+/** A review, as listed by `GET /pulls/{n}/reviews`. */
+export interface RawReview {
+  id: number;
+  user?: { login: string } | null;
+  state?: string;
+  submitted_at?: string;
+  html_url?: string;
+}
+
+/**
+ * Reviews the reviewing account submitted inside the window that the submit
+ * receipt does not vouch for. Step 7's ban covers this channel too (`gh pr
+ * review`, direct POSTs to `pulls/<n>/reviews`), and unlike issue comments
+ * a review CAN legitimately appear here — the sanctioned submit posts one —
+ * so sanctioned-vs-bypass is decided by id against the receipt submit wrote.
+ * The receipt vouches for a SET of ids, not one: the window spans drift
+ * restarts, so two sanctioned submits can fall in it, and excluding only the
+ * last would flag the earlier legitimate review as a bypass. No receipt
+ * vouches for nothing: with zero sanctioned writes recorded, every in-window
+ * review by the account is flagged (fail-safe).
+ */
+export function findUnsanctionedReviews(
+  reviews: RawReview[],
+  reviewer: string,
+  sinceIso: string,
+  receiptReviewIds: ReadonlySet<number>,
+): RawReview[] {
+  const reviewerLc = reviewer.toLowerCase();
+  return reviews.filter(
+    (r) =>
+      (r.user?.login ?? '').toLowerCase() === reviewerLc &&
+      typeof r.submitted_at === 'string' &&
+      r.submitted_at >= sinceIso &&
+      !receiptReviewIds.has(r.id),
+  );
+}
+
+const OWNER_REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+
+function readAuditWindow(
+  target: string,
+  expectedPrNumber: string,
+): { window: AuditWindow } | { skip: string } {
+  let raw: string;
+  try {
+    raw = readFileSync(tmpFile(target, 'fetch.json'), 'utf8');
+  } catch (err) {
+    // Only ENOENT means "no report"; any other failure (permissions, EISDIR,
+    // I/O) is a different problem and pointing the operator at "no fetch
+    // report" sends them the wrong way.
+    const code = (err as NodeJS.ErrnoException).code;
+    return code === 'ENOENT'
+      ? { skip: 'no fetch report' }
+      : {
+          skip: `cannot read fetch report (${code ?? (err as Error).message})`,
+        };
+  }
+  try {
+    const report = JSON.parse(raw) as Partial<AuditWindow>;
+    if (typeof report.fetchedAt !== 'string') {
+      return {
+        skip: 'fetch report has no fetchedAt (written by an older CLI)',
+      };
+    }
+    if (
+      typeof report.prNumber !== 'string' ||
+      typeof report.ownerRepo !== 'string'
+    ) {
+      return { skip: 'fetch report is missing prNumber/ownerRepo' };
+    }
+    // The report is a file on disk; before its values reach a gh api path,
+    // hold them to the same standard the rest of this surface applies
+    // (HOSTNAME_RE in setGhHost, safeTarget in paths). The cross-check
+    // against the cleanup target is strictly stronger than a shape test.
+    if (report.prNumber !== expectedPrNumber) {
+      return {
+        skip: `fetch report is for PR ${report.prNumber}, not ${expectedPrNumber}`,
+      };
+    }
+    if (!OWNER_REPO_RE.test(report.ownerRepo)) {
+      return { skip: 'fetch report ownerRepo is not owner/repo-shaped' };
+    }
+    const auditSince =
+      typeof report.auditSince === 'string' &&
+      !Number.isNaN(Date.parse(report.auditSince))
+        ? report.auditSince
+        : report.fetchedAt;
+    if (Number.isNaN(Date.parse(auditSince))) {
+      return { skip: 'fetch report fetchedAt is not a timestamp' };
+    }
+    return {
+      window: {
+        prNumber: report.prNumber,
+        ownerRepo: report.ownerRepo,
+        fetchedAt: report.fetchedAt,
+        auditSince,
+        host: typeof report.host === 'string' ? report.host : null,
+      },
+    };
+  } catch {
+    return { skip: 'fetch report is not valid JSON' };
+  }
+}
+
+/**
+ * The set of review ids sanctioned submits recorded this session — empty when
+ * none did. The shape parse is shared with submit's writer
+ * (`lib/receipt.ts`); only the empty-case wrapper (a `Set` here, `[]` there)
+ * differs.
+ */
+function readSubmitReceipt(target: string): Set<number> {
+  try {
+    return new Set(
+      parseReceiptIds(
+        readFileSync(tmpFile(target, 'submit-receipt.json'), 'utf8'),
+      ),
+    );
+  } catch {
+    return new Set();
+  }
+}
+
+/** First line that actually says something: gh puts the HTTP/auth/DNS cause
+ * on stderr while `err.message` is often the generic "Command failed" wrap. */
+function briefErrorLine(err: unknown): string {
+  const stderr = (err as { stderr?: unknown }).stderr;
+  if (typeof stderr === 'string') {
+    const line = stderr.split('\n').find((l) => l.trim().length > 0);
+    if (line) return line.trim();
+  }
+  return err instanceof Error
+    ? (err.message.split('\n')[0] ?? String(err))
+    : String(err);
+}
+
+/**
+ * Best-effort by design: cleanup must stay idempotent and offline-safe, so
+ * any failure here (no gh, no auth, no network, report missing) skips the
+ * audit rather than failing the cleanup. Every skip is named on STDERR —
+ * without that, a skipped audit and a clean window produce identical
+ * output, and the tripwire's off state is indistinguishable from its
+ * all-clear state.
+ */
+function auditPrWrites(target: string, prNumber: string): void {
+  const skipNote = (reason: string) =>
+    writeStderrLine(`note: bypass audit skipped (${reason})`);
+  const read = readAuditWindow(target, prNumber);
+  if ('skip' in read) {
+    skipNote(read.skip);
+    return;
+  }
+  const window = read.window;
+  // The audit routes gh at the PR's host, but that override must not leak out
+  // of this block — cleanup runs last today, but a future caller after it (or
+  // a second auditPrWrites) would otherwise inherit the Enterprise host. Save
+  // and restore around the block.
+  const prevHost = getGhHost();
+  try {
+    setGhHost(window.host ?? undefined);
+    // The boundary backs off from the recorded opening: fetchedAt is local
+    // time compared against GitHub's server timestamps (see CLOCK_SKEW_MS),
+    // and auditSince already reaches back across drift restarts.
+    const boundary = new Date(
+      Date.parse(window.auditSince) - CLOCK_SKEW_MS,
+    ).toISOString();
+    const comments = ghApiAll(
+      `repos/${window.ownerRepo}/issues/${window.prNumber}/comments?since=${encodeURIComponent(boundary)}&per_page=100`,
+    ) as RawIssueComment[];
+    const reviews = (
+      ghApiAll(
+        `repos/${window.ownerRepo}/pulls/${window.prNumber}/reviews?per_page=100`,
+      ) as RawReview[]
+    ).filter(
+      (r) => typeof r.submitted_at === 'string' && r.submitted_at >= boundary,
+    );
+    // The common case; skipping currentUser() here saves a network round
+    // trip on every clean cleanup.
+    if (comments.length === 0 && reviews.length === 0) return;
+    const me = currentUser();
+    const { posted, edited } = findUnsanctionedIssueComments(
+      comments,
+      me,
+      boundary,
+    );
+    const rogueReviews = findUnsanctionedReviews(
+      reviews,
+      me,
+      boundary,
+      readSubmitReceipt(target),
+    );
+    const total = posted.length + edited.length + rogueReviews.length;
+    if (total === 0) return;
+    writeStdoutLine(
+      `warning: ${total} write(s) by the reviewing account on ` +
+        `${window.ownerRepo}#${window.prNumber} during this review window were not made by ` +
+        `\`qwen review submit\` — the only sanctioned write in /review:`,
+    );
+    for (const c of posted) {
+      writeStdoutLine(
+        `warning:   posted comment ${c.id} at ${c.created_at}${c.html_url ? ` — ${c.html_url}` : ''}`,
+      );
+    }
+    for (const c of edited) {
+      writeStdoutLine(
+        `warning:   edited comment ${c.id} at ${c.updated_at}${c.html_url ? ` — ${c.html_url}` : ''}`,
+      );
+    }
+    for (const r of rogueReviews) {
+      writeStdoutLine(
+        `warning:   review ${r.id} (${r.state ?? 'UNKNOWN'}) at ${r.submitted_at}${r.html_url ? ` — ${r.html_url}` : ''} — no submit receipt vouches for it`,
+      );
+    }
+    writeStdoutLine(
+      `warning: if the user did this themselves — or another workflow posts under the same ` +
+        `account — ignore this; otherwise a write bypassed the submit gate. ` +
+        `Relay this warning verbatim in the terminal summary.`,
+    );
+  } catch (err) {
+    skipNote(briefErrorLine(err));
+  } finally {
+    setGhHost(prevHost);
+  }
+}
+
 export function runCleanup(target: string): void {
   let removedAny = false;
   // Tracked separately from `removedAny`, because a failure is neither. Without
@@ -44,6 +381,10 @@ export function runCleanup(target: string): void {
   if (prMatch) {
     const prNumber = prMatch[1];
 
+    // Before the sweep below deletes the fetch report (the audit window's
+    // carrier), check the PR for writes that bypassed `qwen review submit`.
+    auditPrWrites(target, prNumber);
+
     // Report what actually happened, in both directions. Announcing "Removed …"
     // off a path that is still on disk is a lie; saying nothing at all when we
     // could not remove it leaves a leftover that will wedge the next run's
diff --git a/packages/cli/src/commands/review/fetch-pr.test.ts b/packages/cli/src/commands/review/fetch-pr.test.ts
index e1a4b20705b..ce07a1484f3 100644
--- a/packages/cli/src/commands/review/fetch-pr.test.ts
+++ b/packages/cli/src/commands/review/fetch-pr.test.ts
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import type { Argv, CommandModule } from 'yargs';
 import { fetchPrCommand } from './fetch-pr.js';
 import { classifyHeavy } from './lib/heavy.js';
@@ -192,3 +192,213 @@ describe('fetchPrCommand builder', () => {
     expect(opts).toContain('host');
   });
 });
+
+// ---------------------------------------------------------------------------
+// Producer half of the cleanup bypass-audit contract.
+//
+// `cleanup` reads `fetchedAt` / `host` back out of this report; if either is
+// dropped in a refactor, `readAuditWindow` returns a skip and the audit turns
+// off with output identical to a clean window. A tripwire whose off state is
+// indistinguishable from its all-clear state is the one property worth a test.
+// The run is steered down the lightest real path: merge-base unresolvable, so
+// no diff capture, an empty plan, and the report write is the observable.
+// ---------------------------------------------------------------------------
+
+const producerMocks = vi.hoisted(() => ({
+  writeFileSync: vi.fn(),
+  readFileSync: vi.fn((): string => {
+    throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+  }),
+  gh: vi.fn(),
+  git: vi.fn(),
+  writeStderrLine: vi.fn(),
+}));
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>();
+  return {
+    ...actual,
+    default: {
+      ...actual,
+      mkdirSync: vi.fn(),
+      readFileSync: producerMocks.readFileSync,
+      writeFileSync: producerMocks.writeFileSync,
+    },
+    mkdirSync: vi.fn(),
+    readFileSync: producerMocks.readFileSync,
+    writeFileSync: producerMocks.writeFileSync,
+  };
+});
+
+vi.mock('node:child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:child_process')>();
+  return {
+    ...actual,
+    default: { ...actual, execFileSync: vi.fn() },
+    execFileSync: vi.fn(),
+  };
+});
+
+vi.mock('../../utils/stdioHelpers.js', () => ({
+  writeStdoutLine: vi.fn(),
+  writeStderrLine: producerMocks.writeStderrLine,
+}));
+
+vi.mock('../../services/review-worktree-lease.js', () => ({
+  createReviewWorktreeLease: vi.fn(),
+}));
+
+vi.mock('./lib/gh.js', () => ({
+  ensureAuthenticated: vi.fn(),
+  gh: producerMocks.gh,
+  setGhHost: vi.fn(),
+}));
+
+vi.mock('./lib/git.js', () => ({
+  git: producerMocks.git,
+  gitOpt: vi.fn(() => null),
+  gitRaw: vi.fn(() => Buffer.from('')),
+  refExists: vi.fn(() => false),
+  releaseWorktree: vi.fn(() => ({ existed: false, freed: true })),
+}));
+
+vi.mock('./lib/merge-base.js', () => ({
+  resolveMergeBase: vi.fn(() => ({ sha: null, baseFetchFailed: false })),
+}));
+
+describe('fetch-pr report — audit-window contract', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // clearAllMocks resets call history but NOT implementations, so a
+    // mockReturnValue a prior test set on readFileSync would leak into a test
+    // that relies on the default. Re-assert the default (no prior report →
+    // ENOENT) here so every test starts from a known state regardless of
+    // order.
+    producerMocks.readFileSync.mockImplementation(() => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+    });
+    producerMocks.git.mockImplementation((...args: string[]) =>
+      args[0] === 'rev-parse' ? 'f00df00df00d' : '',
+    );
+    producerMocks.gh.mockReturnValue(
+      JSON.stringify({
+        headRefName: 'feat/x',
+        headRefOid: 'f00df00df00d',
+        baseRefName: 'main',
+        additions: 1,
+        deletions: 0,
+        changedFiles: 1,
+        isCrossRepository: false,
+        body: '',
+      }),
+    );
+  });
+
+  async function reportFor(extraArgs: Record<string, unknown>) {
+    const handler = fetchPrCommand.handler;
+    if (!handler) throw new Error('fetch-pr handler missing');
+    await handler({
+      _: [],
+      $0: 'qwen',
+      pr_number: '42',
+      owner_repo: 'acme/widgets',
+      remote: 'origin',
+      out: '/tmp/fetch-report.json',
+      maxChunkLines: 400,
+      ...extraArgs,
+    } as unknown as Parameters<typeof handler>[0]);
+    const call = producerMocks.writeFileSync.mock.calls.find(
+      ([path]) => path === '/tmp/fetch-report.json',
+    );
+    if (!call) throw new Error('report was not written');
+    return JSON.parse(String(call[1]));
+  }
+
+  it('stamps fetchedAt as a real timestamp and host as null off-Enterprise', async () => {
+    const before = Date.now();
+    const report = await reportFor({});
+    expect(report.host).toBeNull();
+    const stamped = Date.parse(report.fetchedAt);
+    expect(Number.isNaN(stamped)).toBe(false);
+    expect(stamped).toBeGreaterThanOrEqual(before - 1000);
+  });
+
+  it('carries --host into the report for the cleanup audit to reuse', async () => {
+    const report = await reportFor({ host: 'ghe.example.com' });
+    expect(report.host).toBe('ghe.example.com');
+  });
+
+  it('preserves the earliest window opening across drift restarts of the same PR', async () => {
+    // A drift restart reruns fetch-pr and overwrites this report; the audit
+    // boundary must keep reaching back to the abandoned attempt's opening.
+    producerMocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '42',
+        fetchedAt: '2020-01-01T00:00:00.000Z',
+      }),
+    );
+    const report = await reportFor({});
+    expect(report.auditSince).toBe('2020-01-01T00:00:00.000Z');
+    expect(report.fetchedAt).not.toBe('2020-01-01T00:00:00.000Z');
+  });
+
+  it('prefers a prior auditSince over its fetchedAt (the third-restart case)', async () => {
+    // On a third restart the prior report already carries an auditSince
+    // EARLIER than its own fetchedAt; that earliest opening must win, not the
+    // prior fetchedAt. Seeds both so the auditSince-preference branch runs.
+    producerMocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '42',
+        auditSince: '2020-01-01T00:00:00.000Z',
+        fetchedAt: '2022-06-01T00:00:00.000Z',
+      }),
+    );
+    const report = await reportFor({});
+    expect(report.auditSince).toBe('2020-01-01T00:00:00.000Z');
+  });
+
+  it('does not inherit a window from a DIFFERENT PR left at the same path', async () => {
+    producerMocks.readFileSync.mockReturnValue(
+      JSON.stringify({
+        prNumber: '999',
+        fetchedAt: '2020-01-01T00:00:00.000Z',
+      }),
+    );
+    const report = await reportFor({});
+    expect(report.auditSince).toBe(report.fetchedAt);
+  });
+
+  it('warns (not silently resets) when a prior report exists but is corrupt', async () => {
+    // A crash mid-write leaves truncated JSON. Silently resetting auditSince
+    // would let a bypass write from the abandoned attempt escape the window.
+    producerMocks.readFileSync.mockReturnValue('{"prNumber":"42","audit');
+    const report = await reportFor({});
+    expect(report.auditSince).toBe(report.fetchedAt); // best available
+    const warned = producerMocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .some((l) => l.includes('not valid JSON'));
+    expect(warned).toBe(true);
+  });
+
+  it('stays silent on ENOENT (a genuine first attempt)', async () => {
+    producerMocks.readFileSync.mockImplementation(() => {
+      throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+    });
+    await reportFor({});
+    const warnedAboutReport = producerMocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .some((l) => l.includes('previous fetch report'));
+    expect(warnedAboutReport).toBe(false);
+  });
+
+  it('names a non-ENOENT read failure of the prior report', async () => {
+    producerMocks.readFileSync.mockImplementation(() => {
+      throw Object.assign(new Error('EACCES'), { code: 'EACCES' });
+    });
+    await reportFor({});
+    const warned = producerMocks.writeStderrLine.mock.calls
+      .map((c) => String(c[0]))
+      .some((l) => l.includes('could not read the previous fetch report'));
+    expect(warned).toBe(true);
+  });
+});
diff --git a/packages/cli/src/commands/review/fetch-pr.ts b/packages/cli/src/commands/review/fetch-pr.ts
index 4ac8ae81712..3bc6c0e4395 100644
--- a/packages/cli/src/commands/review/fetch-pr.ts
+++ b/packages/cli/src/commands/review/fetch-pr.ts
@@ -27,7 +27,7 @@
 
 import type { CommandModule } from 'yargs';
 import { execFileSync } from 'node:child_process';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { writeStdoutLine, writeStderrLine } from '../../utils/stdioHelpers.js';
 import { createReviewWorktreeLease } from '../../services/review-worktree-lease.js';
@@ -70,6 +70,7 @@ interface FetchPrArgs {
   owner_repo: string;
   remote: string;
   out: string;
+  host?: string;
   /** yargs camelCases `--max-chunk-lines`; the snake_case form does not exist. */
   maxChunkLines: number;
 }
@@ -80,6 +81,21 @@ type FetchPrResult = PlanReport & {
   remote: string;
   ref: string;
   fetchedSha: string;
+  /**
+   * When this review window opened (ISO-8601). `cleanup` audits the PR for
+   * writes by the current user inside [fetchedAt, cleanup) that did not go
+   * through `qwen review submit` — the submit-only contract's tripwire.
+   */
+  fetchedAt: string;
+  /**
+   * Earliest `fetchedAt` across drift restarts of the SAME PR (the head-drift
+   * rule reruns fetch-pr, overwriting this report). Cleanup audits from here,
+   * so a write made during an abandoned attempt stays inside the window.
+   */
+  auditSince: string;
+  /** GitHub host this PR lives on (Enterprise), null for github.com — so the
+   * cleanup audit queries the same host the review did. */
+  host: string | null;
   worktreePath: string;
   baseRefName: string;
   headRefName: string;
@@ -276,13 +292,73 @@ async function runFetchPr(args: FetchPrArgs): Promise<void> {
     plan = buildDiffPlan('', args.maxChunkLines);
   }
 
-  // 6. Emit the report.
+  // 6. Emit the report. The window opening survives drift restarts: this
+  // command overwrites its own report, and a reset boundary would hide any
+  // bypass write made during the abandoned attempt from cleanup's audit.
+  const fetchedAt = new Date().toISOString();
+  let auditSince = fetchedAt;
+  let prevRaw: string | null = null;
+  try {
+    prevRaw = readFileSync(out, 'utf8');
+  } catch (err) {
+    // ENOENT is the normal first attempt for this target — silent. Any other
+    // read failure (EACCES, EISDIR, I/O) is NOT "no previous report"; name it
+    // so an operator is not sent toward the wrong cause.
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code !== 'ENOENT') {
+      writeStderrLine(
+        `WARNING: could not read the previous fetch report at ${out} (${code ?? (err as Error).message}); ` +
+          `the audit window starts at this fetch and may not reach an earlier abandoned attempt.`,
+      );
+    }
+  }
+  if (prevRaw !== null) {
+    try {
+      const prev = JSON.parse(prevRaw) as {
+        prNumber?: unknown;
+        fetchedAt?: unknown;
+        auditSince?: unknown;
+      };
+      const prevSince =
+        typeof prev.auditSince === 'string'
+          ? prev.auditSince
+          : typeof prev.fetchedAt === 'string'
+            ? prev.fetchedAt
+            : null;
+      if (
+        prev.prNumber === prNumber &&
+        prevSince !== null &&
+        !Number.isNaN(Date.parse(prevSince)) &&
+        // `< auditSince` (which is `fetchedAt`, i.e. now) is also the upper
+        // bound: the window opening only ever moves BACKWARD to an earlier
+        // attempt, never forward. A corrupted far-future `auditSince`
+        // (`"2099-…"`) is therefore rejected here — it would push the window
+        // ahead of every real comment and silently report a clean audit.
+        // (ISO-8601 strings from `toISOString()` compare chronologically.)
+        prevSince < auditSince
+      ) {
+        auditSince = prevSince;
+      }
+    } catch {
+      // The file exists but is unparseable — a crash mid-write leaves
+      // truncated JSON. Silently resetting the window to this fetch would let
+      // a bypass write from the abandoned attempt escape the audit, so warn:
+      // the window may not reach it.
+      writeStderrLine(
+        `WARNING: the previous fetch report at ${out} is not valid JSON (a crash mid-write?); ` +
+          `the audit window starts at this fetch and may not reach an earlier abandoned attempt.`,
+      );
+    }
+  }
   const result: FetchPrResult = {
     prNumber,
     ownerRepo,
     remote,
     ref,
     fetchedSha,
+    fetchedAt,
+    auditSince,
+    host: args.host ?? null,
     worktreePath: wt,
     baseRefName: meta.baseRefName,
     headRefName: meta.headRefName,
diff --git a/packages/cli/src/commands/review/lib/gh.ts b/packages/cli/src/commands/review/lib/gh.ts
index f68e629ac2d..32af78fdddc 100644
--- a/packages/cli/src/commands/review/lib/gh.ts
+++ b/packages/cli/src/commands/review/lib/gh.ts
@@ -93,6 +93,16 @@ export function setGhHost(host: string | undefined): void {
   ghHost = host;
 }
 
+/**
+ * The host `gh` calls are currently routed at, or `undefined` for the
+ * default (github.com / an operator-exported GH_HOST). Lets a caller that
+ * overrides the host for a scoped block save and restore the prior value
+ * instead of leaking the override into module state.
+ */
+export function getGhHost(): string | undefined {
+  return ghHost;
+}
+
 /**
  * Environment for `gh` child processes. `undefined` means "inherit the
  * parent env untouched"; with a host set, the inherited env is extended
diff --git a/packages/cli/src/commands/review/lib/receipt.test.ts b/packages/cli/src/commands/review/lib/receipt.test.ts
new file mode 100644
index 00000000000..c9365bb1243
--- /dev/null
+++ b/packages/cli/src/commands/review/lib/receipt.test.ts
@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { parseReceiptIds } from './receipt.js';
+
+describe('parseReceiptIds', () => {
+  it('reads the current reviewIds array', () => {
+    expect(parseReceiptIds(JSON.stringify({ reviewIds: [1, 2, 3] }))).toEqual([
+      1, 2, 3,
+    ]);
+  });
+
+  it('migrates a legacy single reviewId', () => {
+    expect(parseReceiptIds(JSON.stringify({ reviewId: 7 }))).toEqual([7]);
+  });
+
+  it('prefers reviewIds over a legacy reviewId when both are present', () => {
+    expect(
+      parseReceiptIds(JSON.stringify({ reviewIds: [1], reviewId: 9 })),
+    ).toEqual([1]);
+  });
+
+  it('drops non-numeric entries rather than trusting them', () => {
+    expect(
+      parseReceiptIds(JSON.stringify({ reviewIds: [1, 'x', null, 2] })),
+    ).toEqual([1, 2]);
+  });
+
+  it('returns [] for malformed JSON, a missing field, or a wrong-typed field', () => {
+    expect(parseReceiptIds('not json {')).toEqual([]);
+    expect(parseReceiptIds(JSON.stringify({}))).toEqual([]);
+    expect(parseReceiptIds(JSON.stringify({ reviewId: 'nope' }))).toEqual([]);
+    expect(parseReceiptIds(JSON.stringify({ reviewIds: 'nope' }))).toEqual([]);
+  });
+
+  it('does not throw on valid JSON that is not an object (null, number, array, string)', () => {
+    // `JSON.parse('null')` succeeds; dereferencing it would break the
+    // never-throws contract.
+    expect(parseReceiptIds('null')).toEqual([]);
+    expect(parseReceiptIds('42')).toEqual([]);
+    expect(parseReceiptIds('"x"')).toEqual([]);
+    expect(parseReceiptIds('[1,2]')).toEqual([]);
+  });
+});
diff --git a/packages/cli/src/commands/review/lib/receipt.ts b/packages/cli/src/commands/review/lib/receipt.ts
new file mode 100644
index 00000000000..c87708f9c08
--- /dev/null
+++ b/packages/cli/src/commands/review/lib/receipt.ts
@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+// The submit receipt is the WRITE half of cleanup's bypass-audit contract:
+// `submit` records the review ids it was authorised to create, and `cleanup`
+// reads them to tell a sanctioned review from a bypass. Both sides parse the
+// same on-disk shape, so the parse lives here — a schema change (new field,
+// renamed key) is a single edit both call sites inherit, rather than two
+// implementations that must be kept in lockstep.
+
+/**
+ * The review ids a receipt vouches for. Accepts the current
+ * `reviewIds: number[]` shape and migrates a legacy single `reviewId` a
+ * receipt written by an older CLI carries. Never throws: a malformed shape
+ * yields an empty list, and the caller decides what an empty list means.
+ */
+export function parseReceiptIds(raw: string): number[] {
+  let value: unknown;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  // `JSON.parse('null')` (and any non-object) succeeds but has no fields to
+  // read — dereferencing it would throw, breaking the "never throws"
+  // contract callers may rely on.
+  if (value === null || typeof value !== 'object') return [];
+  const parsed = value as { reviewIds?: unknown; reviewId?: unknown };
+  const ids = Array.isArray(parsed.reviewIds)
+    ? parsed.reviewIds
+    : typeof parsed.reviewId === 'number'
+      ? [parsed.reviewId]
+      : [];
+  return ids.filter((n): n is number => typeof n === 'number');
+}
diff --git a/packages/cli/src/commands/review/presubmit.test.ts b/packages/cli/src/commands/review/presubmit.test.ts
index b0905752b82..e95fb849d63 100644
--- a/packages/cli/src/commands/review/presubmit.test.ts
+++ b/packages/cli/src/commands/review/presubmit.test.ts
@@ -5,7 +5,13 @@
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { presubmitCommand, classifyCi } from './presubmit.js';
+import {
+  presubmitCommand,
+  classifyCi,
+  classifyHeadDrift,
+  parseFindingsFile,
+  type CompareSummary,
+} from './presubmit.js';
 
 // A `skipped` check run arrives as `status: completed` with `conclusion:
 // "skipped"`. It used to fall through both branches of the classifier and land
@@ -340,7 +346,10 @@ describe('presubmitCommand', () => {
     vi.clearAllMocks();
     ensureAuthenticatedMock.mockReturnValue(undefined);
     currentUserMock.mockReturnValue('qwen-code-ci-bot');
-    ghMock.mockReturnValue('contributor');
+    // The pulls fetch returns author + live head in one jq projection; a live
+    // head equal to baseArgs' commit_sha means "no drift" for tests that are
+    // not about drift.
+    ghMock.mockReturnValue('{"author":"contributor","headSha":"abc123"}');
     ghApiAllMock.mockReturnValue([]);
     ghApiAllNestedMock.mockReturnValue([]);
     readFileSyncMock.mockReturnValue('[]');
@@ -385,6 +394,242 @@ describe('presubmitCommand', () => {
     expect(result.downgradeReasons.join(' ')).toContain('CI did not run');
   });
 
+  it('downgrades the Approve and reports headDrift when the PR advanced mid-review', async () => {
+    // Two gh('api', …) calls now: the pulls fetch (author + live head) and,
+    // once drift is seen, the compare fetch for detail.
+    ghMock.mockImplementation((...args: string[]) => {
+      const path = args[1] ?? '';
+      if (path.includes('/compare/')) {
+        return '{"status":"ahead","aheadBy":2,"files":["src/x.ts"]}';
+      }
+      return '{"author":"contributor","headSha":"def456"}';
+    });
+    ghApiMock.mockReturnValue(null);
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.headDrift).toEqual({
+      reviewedSha: 'abc123',
+      liveHeadSha: 'def456',
+      drifted: true,
+      compare: {
+        status: 'ahead',
+        aheadBy: 2,
+        filesTouched: ['src/x.ts'],
+        filesTotal: 1,
+      },
+      // No --new-findings in baseArgs: the anchor set is unknown, so risk
+      // fails safe.
+      anchorsAtRisk: true,
+    });
+    expect(result.downgradeApprove).toBe(true);
+    expect(result.downgradeReasons.join(' ')).toContain(
+      'PR head advanced during review',
+    );
+  });
+
+  it('makes exactly one gh() call on the no-drift happy path', async () => {
+    // The PR's efficiency claim: live head rides the author fetch, and no
+    // compare call happens when nothing moved.
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+
+    expect(ghMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps the drift verdict when the compare call itself throws', async () => {
+    ghMock.mockImplementation((...args: string[]) => {
+      const path = args[1] ?? '';
+      if (path.includes('/compare/')) {
+        throw new Error('HTTP 404: no common ancestor');
+      }
+      return '{"author":"contributor","headSha":"def456"}';
+    });
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.headDrift.drifted).toBe(true);
+    expect(result.headDrift.compare).toBeNull();
+    expect(result.headDrift.anchorsAtRisk).toBe(true);
+    expect(result.downgradeApprove).toBe(true);
+  });
+
+  it('survives a deleted PR author (author: null) instead of dying pre-submission', async () => {
+    ghMock.mockReturnValue('{"author":null,"headSha":"abc123"}');
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.isSelfPr).toBe(false);
+    expect(result.headDrift.drifted).toBe(false);
+  });
+
+  it('fails closed and caps the Approve when PR metadata cannot be read', async () => {
+    // A thrown pulls fetch (transport/auth/404 on this endpoint) is different
+    // from author:null — the head is unknown, so drift and self-PR cannot be
+    // checked and the run must not proceed as if they passed.
+    ghMock.mockImplementation((...args: string[]) => {
+      if (args[0] === 'api' && String(args[1]).includes('/pulls/')) {
+        throw new Error('HTTP 502: Bad Gateway');
+      }
+      return 'contributor';
+    });
+    ghApiMock.mockReturnValue(null);
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.downgradeApprove).toBe(true);
+    expect(result.downgradeReasons.join(' ')).toContain(
+      'PR metadata unavailable',
+    );
+  });
+
+  it('counts a renamed file by BOTH its new and previous path in the drift file set', async () => {
+    // An unreviewed commit that renamed a finding's anchor file (old path)
+    // must still intersect — the projection keeps previous_filename.
+    ghMock.mockImplementation((...args: string[]) => {
+      const path = String(args[1] ?? '');
+      if (path.includes('/compare/')) {
+        return JSON.stringify({
+          status: 'ahead',
+          aheadBy: 1,
+          files: ['src/new-name.ts', 'src/old-name.ts'],
+        });
+      }
+      return '{"author":"contributor","headSha":"def456"}';
+    });
+    ghApiMock.mockReturnValue(null);
+    readFileSyncMock.mockImplementation((path: string) =>
+      String(path).includes('findings')
+        ? JSON.stringify([{ path: 'src/old-name.ts', line: 5 }])
+        : '[]',
+    );
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler({
+      ...baseArgs,
+      'new-findings': '/tmp/findings.json',
+    } as unknown as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.headDrift.compare.filesTouched).toContain('src/old-name.ts');
+    expect(result.headDrift.anchorsAtRisk).toBe(true);
+  });
+
+  it('fails safe (anchorsAtRisk) when the findings file is malformed, even on disjoint files', async () => {
+    // The drift touches a file the (garbage) findings do not name. A trusted
+    // empty/valid list would rule disjoint → submit; a malformed one must not
+    // prove that all-clear.
+    ghMock.mockImplementation((...args: string[]) => {
+      const path = String(args[1] ?? '');
+      if (path.includes('/compare/')) {
+        return JSON.stringify({
+          status: 'ahead',
+          aheadBy: 1,
+          files: ['src/unrelated.ts'],
+        });
+      }
+      return '{"author":"contributor","headSha":"def456"}';
+    });
+    ghApiMock.mockReturnValue(null);
+    readFileSyncMock.mockImplementation((path: string) =>
+      String(path).includes('findings')
+        ? '[{"line":5}]' // entry without a string path → whole file rejected
+        : '[]',
+    );
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler({
+      ...baseArgs,
+      'new-findings': '/tmp/findings.json',
+    } as unknown as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.headDrift.anchorsAtRisk).toBe(true);
+  });
+
+  it('surfaces a malformed findings file (flag + downgrade) even with no drift', async () => {
+    // No drift this time (heads match), so anchorsAtRisk is not the signal;
+    // the malformed file still silently emptied the overlap set, which must
+    // not pass unreported.
+    ghMock.mockReturnValue('{"author":"contributor","headSha":"abc123"}');
+    ghApiMock.mockReturnValue(null);
+    readFileSyncMock.mockImplementation((path: string) =>
+      String(path).includes('findings') ? 'not json at all {' : '[]',
+    );
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    await handler({
+      ...baseArgs,
+      'new-findings': '/tmp/findings.json',
+    } as unknown as Parameters<typeof handler>[0]);
+
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    const result = JSON.parse(String(content));
+
+    expect(result.findingsFileInvalid).toBe(true);
+    expect(result.downgradeApprove).toBe(true);
+    expect(result.downgradeReasons.join(' ')).toContain(
+      'the --new-findings file was malformed',
+    );
+  });
+
+  it('does not flag findingsFileInvalid when the file is valid or absent', async () => {
+    ghMock.mockReturnValue('{"author":"contributor","headSha":"abc123"}');
+    ghApiMock.mockReturnValue(null);
+    readFileSyncMock.mockReturnValue('[]');
+
+    const handler = presubmitCommand.handler;
+    if (!handler) throw new Error('presubmit handler missing');
+    // Absent findings file.
+    await handler(baseArgs as Parameters<typeof handler>[0]);
+    const [, content] = writeFileSyncMock.mock.calls.find(
+      ([path]) => path === '/tmp/presubmit.json',
+    ) ?? [null, null];
+    expect(JSON.parse(String(content)).findingsFileInvalid).toBe(false);
+  });
+
   it('ignores the running Qwen PR review check when deciding whether CI is still pending', async () => {
     ghApiAllNestedMock.mockImplementation((path: string) =>
       path.endsWith('/check-runs')
@@ -426,7 +671,7 @@ describe('presubmitCommand', () => {
     ghApiAllMock.mockReturnValue([]);
     ghApiAllNestedMock.mockReturnValue([]);
     currentUserMock.mockReturnValue('someone');
-    ghMock.mockReturnValue('{}');
+    ghMock.mockReturnValue('{"author":"someone","headSha":"abc123"}');
 
     const handler = presubmitCommand.handler;
     if (!handler) throw new Error('presubmit handler missing');
@@ -450,3 +695,179 @@ describe('presubmitCommand', () => {
     expect(setGhHostMock).toHaveBeenCalledWith(undefined);
   });
 });
+
+// The PR advancing mid-review means commits exist that no agent read. An
+// Approve issued past them certifies unreviewed code — dogfooded on a live PR
+// whose head moved four times in one day, where the only run that noticed did
+// so by accident. Drift is a fact about two SHAs; the classifier is pure.
+describe('classifyHeadDrift', () => {
+  const ahead: CompareSummary = {
+    status: 'ahead',
+    aheadBy: 3,
+    filesTouched: ['src/a.ts', 'src/b.ts'],
+    filesTotal: 2,
+  };
+
+  it('reports no drift when the head has not moved', () => {
+    const got = classifyHeadDrift('sha-aaa', 'sha-aaa', null, []);
+    expect(got.headDrift.drifted).toBe(false);
+    expect(got.headDrift.anchorsAtRisk).toBe(false);
+    expect(got.downgradeReason).toBeUndefined();
+  });
+
+  it('does not claim drift when the live head could not be read', () => {
+    const got = classifyHeadDrift('sha-aaa', '', null, []);
+    expect(got.headDrift.drifted).toBe(false);
+  });
+
+  it('trusts an identical/zero-ahead compare over a SHA-string mismatch', () => {
+    // An abbreviated commit_sha differs as a string from the full head, but
+    // the compare's own evidence says nothing is unreviewed.
+    const identical: CompareSummary = {
+      status: 'identical',
+      aheadBy: 0,
+      filesTouched: [],
+      filesTotal: 0,
+    };
+    const got = classifyHeadDrift('abc123', 'abc123def456', identical, []);
+    expect(got.headDrift.drifted).toBe(false);
+    expect(got.downgradeReason).toBeUndefined();
+  });
+
+  it('names both SHAs even when the compare detail is unavailable, and fails anchors safe', () => {
+    const got = classifyHeadDrift(
+      '57a9273ade45a43b9f16ae1f84cc3ba448a87429',
+      '08ede5645612adca7d4193c1503d9c9e0f4387fb',
+      null,
+      [],
+    );
+    expect(got.headDrift.drifted).toBe(true);
+    expect(got.headDrift.compare).toBeNull();
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+    expect(got.downgradeReason).toBe(
+      'PR head advanced during review: reviewed 57a9273a, PR is now at 08ede564',
+    );
+  });
+
+  it('carries the unreviewed-commit count and the PRE-cap file count', () => {
+    const got = classifyHeadDrift('sha-old', 'sha-new', ahead, []);
+    expect(got.downgradeReason).toContain('+3 unreviewed commit(s)');
+    expect(got.downgradeReason).toContain('2 file(s)');
+    expect(got.headDrift.compare).toEqual(ahead);
+  });
+
+  it('calls out a force-push as rewritten history and puts anchors at risk', () => {
+    const got = classifyHeadDrift(
+      'sha-old',
+      'sha-new',
+      {
+        status: 'diverged',
+        aheadBy: 1,
+        filesTouched: [],
+        filesTotal: 0,
+      },
+      [],
+    );
+    expect(got.downgradeReason).toContain('history rewritten');
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+  });
+
+  it('treats a `behind` force-push-to-earlier as drift with anchors at risk, not "+0 unreviewed"', () => {
+    // The head moved BACK to an earlier commit: aheadBy 0, but the reviewed
+    // SHA is off the PR's line now. Must not read as proved-same or emit the
+    // self-contradictory "+0 unreviewed commit(s)".
+    const got = classifyHeadDrift(
+      'sha-ahead',
+      'sha-earlier',
+      { status: 'behind', aheadBy: 0, filesTouched: [], filesTotal: 0 },
+      ['src/z.ts'],
+    );
+    expect(got.headDrift.drifted).toBe(true);
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+    expect(got.downgradeReason).toContain('earlier commit');
+    expect(got.downgradeReason).not.toContain('unreviewed commit(s)');
+  });
+
+  it('renders an API-capped file total as a lower bound in the public reason', () => {
+    const got = classifyHeadDrift(
+      'sha-old',
+      'sha-new',
+      {
+        status: 'ahead',
+        aheadBy: 5,
+        filesTouched: Array.from({ length: 300 }, (_, i) => `f${i}.ts`),
+        filesTotal: 300,
+      },
+      null,
+    );
+    expect(got.downgradeReason).toContain('300+ file(s)');
+  });
+
+  it('rules anchors safe only when a complete file list provably misses every finding', () => {
+    const got = classifyHeadDrift('sha-old', 'sha-new', ahead, ['src/z.ts']);
+    expect(got.headDrift.anchorsAtRisk).toBe(false);
+  });
+
+  it('rules anchors at risk when a finding path intersects the touched files', () => {
+    const got = classifyHeadDrift('sha-old', 'sha-new', ahead, ['src/b.ts']);
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+  });
+
+  it('fails safe when the touched-file list was truncated — a dropped path cannot intersect', () => {
+    const truncated: CompareSummary = {
+      status: 'ahead',
+      aheadBy: 41,
+      filesTouched: ['docs/a.md'],
+      filesTotal: 283,
+    };
+    const got = classifyHeadDrift('sha-old', 'sha-new', truncated, [
+      'src/z.ts',
+    ]);
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+    // The reason reports the REAL count, not the cap.
+    expect(got.downgradeReason).toContain('283 file(s)');
+  });
+
+  it("fails safe at the compare API's own 300-file cap even when nothing was cut locally", () => {
+    const apiCapped: CompareSummary = {
+      status: 'ahead',
+      aheadBy: 5,
+      filesTouched: Array.from({ length: 300 }, (_, i) => `f${i}.ts`),
+      filesTotal: 300,
+    };
+    const got = classifyHeadDrift('sha-old', 'sha-new', apiCapped, ['zz.ts']);
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+  });
+
+  it('fails safe when no findings list was supplied to intersect against', () => {
+    const got = classifyHeadDrift('sha-old', 'sha-new', ahead, null);
+    expect(got.headDrift.anchorsAtRisk).toBe(true);
+  });
+});
+
+// The --new-findings list is a SAFETY PROOF (a disjoint intersection lets a
+// review submit past head drift), so a malformed file must fail safe to
+// `null` (unknown → at-risk), never to a silently-shorter set.
+describe('parseFindingsFile (via mocked fs)', () => {
+  // A tiny fs shim scoped to this block; the handler tests above mock the
+  // module already, so reuse it by importing the mocked readFileSync.
+  const cases: Array<[string, unknown]> = [
+    ['not json {', null],
+    ['{"path":"a.ts"}', null], // object, not array
+    ['[{"line":5}]', null], // entry without a string path → reject WHOLE file
+    ['[{"path":"a.ts","line":5}]', [{ path: 'a.ts', line: 5 }]],
+    ['[{"path":"a.ts"}]', [{ path: 'a.ts', line: 0 }]], // missing line → 0
+    ['[]', []],
+  ];
+  it.each(cases)('rejects/normalizes %s', (raw, expected) => {
+    readFileSyncMock.mockReturnValue(raw as string);
+    expect(parseFindingsFile('/tmp/findings.json')).toEqual(expected);
+  });
+
+  it('returns null when the file cannot be read at all', () => {
+    readFileSyncMock.mockImplementation(() => {
+      throw new Error('ENOENT');
+    });
+    expect(parseFindingsFile('/tmp/missing.json')).toBeNull();
+  });
+});
diff --git a/packages/cli/src/commands/review/presubmit.ts b/packages/cli/src/commands/review/presubmit.ts
index eb63519cc4f..9e16e546e4b 100644
--- a/packages/cli/src/commands/review/presubmit.ts
+++ b/packages/cli/src/commands/review/presubmit.ts
@@ -125,6 +125,164 @@ interface PresubmitArgs {
   'new-findings'?: string;
 }
 
+/**
+ * Read the `--new-findings` file into a validated anchor list, or `null` when
+ * it cannot be trusted. `null` is the fail-safe value: `classifyHeadDrift`
+ * treats an unknown finding set as at-risk, so a malformed file downgrades
+ * the verdict rather than proving a false all-clear. A shorter-than-real list
+ * would be the dangerous outcome (a dropped finding reads as disjoint), so
+ * any entry lacking a string `path` rejects the WHOLE file rather than being
+ * skipped.
+ */
+export function parseFindingsFile(path: string): FindingAnchor[] | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(parsed)) return null;
+  const out: FindingAnchor[] = [];
+  for (const entry of parsed) {
+    if (
+      typeof entry !== 'object' ||
+      entry === null ||
+      typeof (entry as { path?: unknown }).path !== 'string'
+    ) {
+      return null;
+    }
+    const e = entry as { path: string; line?: unknown };
+    out.push({
+      path: e.path,
+      line: typeof e.line === 'number' ? e.line : 0,
+    });
+  }
+  return out;
+}
+
+/** Best-effort delta between the reviewed SHA and the live head. */
+export interface CompareSummary {
+  /** GitHub compare `status`: ahead | behind | diverged | identical.
+   * `diverged` means the reviewed commit is no longer an ancestor — a
+   * force-push rewrote the history the review read. */
+  status: string;
+  aheadBy: number;
+  /** Files the unreviewed commits touched (capped at FILES_TOUCHED_CAP). */
+  filesTouched: string[];
+  /** Count before the cap. When it exceeds `filesTouched.length` the list
+   * was cut — and the compare endpoint itself caps at 300, so a total of
+   * 300 may also be incomplete. `anchorsAtRisk` accounts for both. */
+  filesTotal: number;
+}
+
+/** GitHub's compare endpoint returns at most this many files. */
+const COMPARE_API_FILES_CAP = 300;
+const FILES_TOUCHED_CAP = 50;
+
+export interface HeadDrift {
+  reviewedSha: string;
+  liveHeadSha: string;
+  drifted: boolean;
+  compare: CompareSummary | null;
+  /**
+   * The submit-or-restart decision, computed here rather than delegated to
+   * prose: could the unreviewed commits have invalidated the review's inline
+   * anchors? True whenever the answer cannot be PROVEN no — compare
+   * unavailable, history diverged (force-push), the touched-file list
+   * truncated (locally or by the API's own 300 cap), or no findings list
+   * supplied to intersect against. A dropped path cannot intersect, so a
+   * naive intersection over a truncated list fails open — measured on a real
+   * 283-file base-merge drift where the 50 surviving alphabetically-first
+   * paths contained no packages/cli or packages/core file at all, i.e. the
+   * gate read "safe" on exactly the largest drifts.
+   */
+  anchorsAtRisk: boolean;
+}
+
+/**
+ * Did the PR advance while the review ran, and what does that do to the
+ * verdict?
+ *
+ * A drifted head means commits exist on the PR that no agent read; an
+ * Approve issued past them certifies code nobody reviewed. Dogfooded on a
+ * live PR whose head moved four times in one day: the run that noticed did
+ * so by luck (a context compression happened to trigger a re-fetch), and
+ * runs that would not have noticed had no gate. So drift is detected here,
+ * at the submission gate, and the downgrade rides the machinery that
+ * already exists rather than a new rule the model must remember.
+ *
+ * `findingPaths` is the file set the review's inline comments anchor to
+ * (null = unknown, which is fail-safe). Kept pure for unit testing; the gh
+ * calls stay in `runPresubmit`.
+ */
+export function classifyHeadDrift(
+  reviewedSha: string,
+  liveHeadSha: string,
+  compare: CompareSummary | null,
+  findingPaths: string[] | null,
+): { headDrift: HeadDrift; downgradeReason?: string } {
+  // `identical` is the only status that proves the reviewed SHA and the live
+  // head are the SAME commit (an abbreviated SHA vs its full form) — a
+  // SHA-string mismatch must not cap the verdict against that. `behind` is
+  // NOT proof of sameness: it means the head force-pushed BACK to an earlier
+  // commit, so the reviewed SHA is ahead of the head and no longer on the
+  // PR's line — its anchors may not exist in the head at all. That is drift.
+  const provedSame = compare !== null && compare.status === 'identical';
+  const drifted =
+    liveHeadSha !== '' && reviewedSha !== liveHeadSha && !provedSame;
+  if (!drifted) {
+    return {
+      headDrift: {
+        reviewedSha,
+        liveHeadSha,
+        drifted: false,
+        compare: null,
+        anchorsAtRisk: false,
+      },
+    };
+  }
+  const truncated =
+    compare !== null &&
+    (compare.filesTotal > compare.filesTouched.length ||
+      compare.filesTotal >= COMPARE_API_FILES_CAP);
+  const anchorsAtRisk =
+    compare === null ||
+    compare.status === 'diverged' ||
+    // `behind` moved the head off the reviewed commit's line — treat its
+    // anchors as at risk like a force-push, regardless of the touched files.
+    compare.status === 'behind' ||
+    truncated ||
+    findingPaths === null ||
+    findingPaths.some((p) => compare.filesTouched.includes(p));
+  // GitHub's compare caps `files` at 300, so a total AT the cap may be an
+  // undercount — render it as a lower bound rather than a precise (and
+  // possibly wrong) public number.
+  const fileCount =
+    compare !== null && compare.filesTotal >= COMPARE_API_FILES_CAP
+      ? `${COMPARE_API_FILES_CAP}+`
+      : `${compare?.filesTotal ?? 0}`;
+  const detail =
+    compare === null
+      ? ''
+      : compare.status === 'diverged'
+        ? ' (history rewritten — the reviewed commit is no longer on the PR)'
+        : compare.status === 'behind'
+          ? ' (PR head moved to an earlier commit — the reviewed commit is no longer the head)'
+          : ` (+${compare.aheadBy} unreviewed commit(s) touching ${fileCount} file(s))`;
+  return {
+    headDrift: {
+      reviewedSha,
+      liveHeadSha,
+      drifted: true,
+      compare,
+      anchorsAtRisk,
+    },
+    downgradeReason:
+      `PR head advanced during review: reviewed ${reviewedSha.slice(0, 8)}, ` +
+      `PR is now at ${liveHeadSha.slice(0, 8)}${detail}`,
+  };
+}
+
 export function classifyCi(checkRuns: CheckRun[], statuses: CommitStatus[]) {
   const failedCheckNames: string[] = [];
   let hasPending = false;
@@ -279,15 +437,90 @@ async function runPresubmit(args: PresubmitArgs): Promise<void> {
 
   ensureAuthenticated();
 
-  // --- Self-PR detection -------------------------------------------------
-  const author = gh(
-    'api',
-    `repos/${owner}/${repo}/pulls/${prNumber}`,
-    '--jq',
-    '.user.login',
-  );
+  // --- Self-PR detection + live head (one fetch) -------------------------
+  // Two different failures, two different responses. A SUCCESSFUL response
+  // with `author: null` (deleted account) is fail-SOFT — isSelfPr false is
+  // the right answer and the unguarded dereference here once killed the whole
+  // presubmit. A THROWN call (transport, auth, rate limit, a 404 on this one
+  // endpoint) is fail-CLOSED: with no head to compare, self-PR and drift are
+  // both undetectable, so the run must not silently proceed as if it had
+  // checked. It emits a downgrade reason and caps the Approve.
+  let prMeta: { author?: string | null; headSha?: string | null } = {};
+  let metaUnavailable = false;
+  try {
+    prMeta = JSON.parse(
+      gh(
+        'api',
+        `repos/${owner}/${repo}/pulls/${prNumber}`,
+        '--jq',
+        '{author: .user.login, headSha: .head.sha}',
+      ),
+    ) as { author?: string | null; headSha?: string | null };
+  } catch {
+    metaUnavailable = true;
+  }
+  const author = prMeta.author ?? '';
+  const liveHeadSha = prMeta.headSha ?? '';
   const me = currentUser();
-  const isSelfPr = author.toLowerCase() === me.toLowerCase();
+  const isSelfPr = author !== '' && author.toLowerCase() === me.toLowerCase();
+
+  // --- Head drift ---------------------------------------------------------
+  // Detail is best-effort: the drift itself (and its downgrade) never
+  // depends on the compare call succeeding — a force-pushed-away reviewed
+  // SHA can make compare 404, and that case is precisely `drifted`.
+  let compare: CompareSummary | null = null;
+  if (liveHeadSha && liveHeadSha !== commitSha) {
+    try {
+      const c = JSON.parse(
+        gh(
+          'api',
+          `repos/${owner}/${repo}/compare/${commitSha}...${liveHeadSha}`,
+          // Both the new path AND `previous_filename`: an unreviewed commit
+          // that RENAMED a file a finding anchors to (under its old path)
+          // would otherwise miss the intersection — the rename bypasses the
+          // at-risk check and the stale anchor reads as safe.
+          '--jq',
+          '{status, aheadBy: .ahead_by, files: [.files[] | .filename, .previous_filename] | map(select(. != null))}',
+        ),
+      ) as { status: string; aheadBy: number; files: string[] };
+      const allFiles = [...new Set(c.files ?? [])];
+      compare = {
+        status: c.status,
+        aheadBy: c.aheadBy,
+        filesTouched: allFiles.slice(0, FILES_TOUCHED_CAP),
+        filesTotal: allFiles.length,
+      };
+    } catch {
+      /* detail only — drift stands without it */
+    }
+  }
+
+  // Parsed before drift classification: the findings' file set is what
+  // anchorsAtRisk intersects against (absent file = unknown = fail-safe).
+  // This list is used as a SAFETY PROOF — a disjoint intersection lets the
+  // review submit past drift — so it is validated, not trusted: a file that
+  // will not parse, is not an array, or holds an entry without a string
+  // `path` collapses to `null` (unknown → fail-safe at-risk), never to a
+  // silently-shorter set that could make a real overlap read as disjoint.
+  const newFindings = newFindingsPath
+    ? parseFindingsFile(newFindingsPath)
+    : null;
+  // A path was given but did not parse into a usable list. The drift path
+  // already fails safe (findingPaths=null → anchorsAtRisk true), but the SAME
+  // null silently empties `newFindingKeys` below, disabling the existing-
+  // comment overlap check — a run then can't tell "no overlaps" from "the
+  // dedup input was garbage", and may re-post comments a prior run already
+  // made. Surface it (report flag + downgrade reason) instead of degrading in
+  // two directions in silence.
+  const findingsFileInvalid =
+    newFindingsPath !== undefined && newFindings === null;
+
+  const { headDrift, downgradeReason: driftReason } = classifyHeadDrift(
+    commitSha,
+    liveHeadSha,
+    compare,
+    newFindings === null ? null : newFindings.map((f) => f.path),
+  );
 
   // --- CI status ---------------------------------------------------------
   // Paginate: a busy CI matrix produces more than 30 check runs on one commit,
@@ -321,11 +554,9 @@ async function runPresubmit(args: PresubmitArgs): Promise<void> {
     if (c.in_reply_to_id) repliedToIds.add(c.in_reply_to_id);
   }
 
-  let newFindings: FindingAnchor[] = [];
-  if (newFindingsPath) {
-    newFindings = JSON.parse(readFileSync(newFindingsPath, 'utf8'));
-  }
-  const newFindingKeys = new Set(newFindings.map((f) => `${f.path}:${f.line}`));
+  const newFindingKeys = new Set(
+    (newFindings ?? []).map((f) => `${f.path}:${f.line}`),
+  );
 
   const buckets = classifyExistingComments(
     qwenComments,
@@ -353,6 +584,18 @@ async function runPresubmit(args: PresubmitArgs): Promise<void> {
       `CI did not run: every check was skipped (${ciStatus.skippedCheckNames.join(', ')})`,
     );
   }
+  if (driftReason) downgradeReasons.push(driftReason);
+  if (metaUnavailable) {
+    downgradeReasons.push(
+      'PR metadata unavailable — could not verify self-PR status or head drift',
+    );
+  }
+  if (findingsFileInvalid) {
+    downgradeReasons.push(
+      'the --new-findings file was malformed — overlap dedup was disabled and ' +
+        'anchor-risk defaulted to at-risk; regenerate it and re-run',
+    );
+  }
 
   const result = {
     prNumber,
@@ -381,10 +624,23 @@ async function runPresubmit(args: PresubmitArgs): Promise<void> {
       isSelfPr ||
       ciStatus.class === 'any_failure' ||
       ciStatus.class === 'all_pending' ||
-      (ciStatus.class === 'no_checks' && ciStatus.totalChecks > 0),
+      (ciStatus.class === 'no_checks' && ciStatus.totalChecks > 0) ||
+      // Commits nobody reviewed are on the PR — an Approve would certify them.
+      headDrift.drifted ||
+      // Could not read the PR head at all: neither self-PR nor drift could be
+      // checked, so an Approve would rest on unverified state.
+      metaUnavailable ||
+      // The findings input the anchor-risk and overlap checks both rely on was
+      // unreadable — the run cannot certify against inputs it could not read.
+      findingsFileInvalid,
     downgradeRequestChanges: isSelfPr,
     downgradeReasons,
     blockOnExistingComments: buckets.overlap.length > 0,
+    // Distinguishes "no overlaps" from "the dedup input was garbage": a true
+    // value means the overlap check ran on an empty set and duplicate comments
+    // are possible, so the skill should regenerate the findings file.
+    findingsFileInvalid,
+    headDrift,
   };
 
   writeFileSync(outPath, JSON.stringify(result, null, 2) + '\n', 'utf8');
diff --git a/packages/cli/src/commands/review/submit.test.ts b/packages/cli/src/commands/review/submit.test.ts
index d69c3892ab6..f7852206fcb 100644
--- a/packages/cli/src/commands/review/submit.test.ts
+++ b/packages/cli/src/commands/review/submit.test.ts
@@ -13,6 +13,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import {
   mkdtempSync,
   mkdirSync,
+  readFileSync,
   rmSync,
   utimesSync,
   writeFileSync,
@@ -704,3 +705,55 @@ describe('what the reviewer caught in this change', () => {
     expect(out.cappedBy).toContain('uncoverable-chunk');
   });
 });
+
+// The submit receipt is the WRITE half of cleanup's bypass-audit contract:
+// cleanup reads the review ids it records to tell a sanctioned review from a
+// bypass. Every other test here leaves ghMock returning '' (so JSON.parse of
+// the response throws and the receipt block hits its catch), which means the
+// happy path where a receipt is actually written was never exercised. These
+// run the command from inside the fixture dir so the relative .qwen/tmp
+// receipt lands there.
+describe('submit receipt (producer half of the audit contract)', () => {
+  const receiptPath = () =>
+    join(dir, '.qwen', 'tmp', 'qwen-review-pr-6771-submit-receipt.json');
+
+  const authorizedPost = (over: Record<string, unknown> = {}) =>
+    args({ userAuthorized: true, ...over });
+
+  let savedCwd: string;
+  beforeEach(() => {
+    savedCwd = process.cwd();
+    process.chdir(dir);
+  });
+  afterEach(() => process.chdir(savedCwd));
+
+  it('writes the posted review id, event and a timestamp', () => {
+    ghMock.mockImplementationOnce(() => JSON.stringify({ id: 42 }));
+    runSubmit(authorizedPost());
+    const receipt = JSON.parse(readFileSync(receiptPath(), 'utf8'));
+    expect(receipt.reviewIds).toEqual([42]);
+    expect(receipt.event).toBe('COMMENT');
+    expect(typeof receipt.postedAt).toBe('string');
+  });
+
+  it('accumulates ids across two submits in the same window (drift restart)', () => {
+    ghMock.mockImplementationOnce(() => JSON.stringify({ id: 42 }));
+    runSubmit(authorizedPost());
+    ghMock.mockImplementationOnce(() => JSON.stringify({ id: 43 }));
+    runSubmit(authorizedPost());
+    const receipt = JSON.parse(readFileSync(receiptPath(), 'utf8'));
+    expect(receipt.reviewIds).toEqual([42, 43]);
+  });
+
+  it('migrates a legacy single-id receipt on the next submit', () => {
+    mkdirSync(join(dir, '.qwen', 'tmp'), { recursive: true });
+    writeFileSync(
+      receiptPath(),
+      JSON.stringify({ reviewId: 7, event: 'COMMENT', postedAt: 'x' }),
+    );
+    ghMock.mockImplementationOnce(() => JSON.stringify({ id: 8 }));
+    runSubmit(authorizedPost());
+    const receipt = JSON.parse(readFileSync(receiptPath(), 'utf8'));
+    expect(receipt.reviewIds).toEqual([7, 8]);
+  });
+});
diff --git a/packages/cli/src/commands/review/submit.ts b/packages/cli/src/commands/review/submit.ts
index 2e2ea60c5c6..730c22bfe44 100644
--- a/packages/cli/src/commands/review/submit.ts
+++ b/packages/cli/src/commands/review/submit.ts
@@ -44,9 +44,11 @@
 // caller's.
 
 import type { CommandModule } from 'yargs';
-import { readFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { writeStdoutLine, writeStderrLine } from '../../utils/stdioHelpers.js';
 import { ghWithInput, setGhHost } from './lib/gh.js';
+import { REVIEW_TMP_DIR, tmpFile } from './lib/paths.js';
+import { parseReceiptIds } from './lib/receipt.js';
 import { parseReviewArgs } from './parse-args.js';
 import { composeReview, type ComposeReviewInput } from './compose-review.js';
 import {
@@ -78,6 +80,20 @@ function defaultSkillArgsPath(): string {
 /** The only events GitHub's Create Review API accepts. */
 const EVENTS = new Set(['APPROVE', 'REQUEST_CHANGES', 'COMMENT']);
 
+/**
+ * Review ids a prior submit in this window already recorded. Best-effort: an
+ * absent or unreadable receipt is an empty list, never a throw — the caller
+ * adds the current id regardless. The shape parse is shared with cleanup's
+ * reader (`lib/receipt.ts`) so the two halves cannot drift.
+ */
+function readReceiptIds(receiptPath: string): number[] {
+  try {
+    return parseReceiptIds(readFileSync(receiptPath, 'utf8'));
+  } catch {
+    return [];
+  }
+}
+
 /**
  * A line number GitHub will take: a positive whole number.
  *
@@ -520,7 +536,42 @@ export function runSubmit(args: SubmitArgs): void {
   // GitHub would receive a payload that never passed the gate. `--input -` posts
   // exactly the object we parsed and checked. (Still `--input`, never `-f body=`,
   // so the body's newlines reach GitHub as newlines.)
-  ghWithInput(JSON.stringify(post), 'api', target, '--input', '-');
+  const response = ghWithInput(
+    JSON.stringify(post),
+    'api',
+    target,
+    '--input',
+    '-',
+  );
+  // Receipt for cleanup's bypass audit: EVERY review this session was
+  // authorised to create, by id. The audit lists reviews by the reviewing
+  // account inside the window and flags any the receipt does not vouch for —
+  // without the id, a bypass posted through `gh pr review` (a review, not an
+  // issue comment) would be indistinguishable from the sanctioned one.
+  //
+  // The receipt ACCUMULATES ids rather than overwriting: the audit window
+  // spans drift restarts (fetch-pr preserves `auditSince`), so two sanctioned
+  // submits can fall in one window. A single-id receipt vouched only for the
+  // last, and the earlier legitimate review was then flagged as a bypass —
+  // a false positive for a write submit itself made. So read the prior ids,
+  // add this one, dedupe, write back. Best-effort: a receipt failure must
+  // never fail a review that DID post.
+  try {
+    const reviewId = (JSON.parse(response) as { id?: number }).id;
+    if (typeof reviewId === 'number') {
+      const receiptPath = tmpFile(`pr-${args.pr}`, 'submit-receipt.json');
+      const priorIds = readReceiptIds(receiptPath);
+      const reviewIds = [...new Set([...priorIds, reviewId])];
+      mkdirSync(REVIEW_TMP_DIR, { recursive: true });
+      writeFileSync(
+        receiptPath,
+        `${JSON.stringify({ reviewIds, event, postedAt: new Date().toISOString() })}\n`,
+        'utf8',
+      );
+    }
+  } catch {
+    /* audit metadata only — the post itself succeeded */
+  }
   writeStderrLine(
     `Posted ${event} to ${args.repo}#${args.pr} — ${auth.why}` +
       (cappedBy.length ? ` (capped by ${cappedBy.join(', ')})` : '') +
diff --git a/packages/core/src/skills/bundled/review/SKILL.md b/packages/core/src/skills/bundled/review/SKILL.md
index c490836e155..657c0ed4ea0 100644
--- a/packages/core/src/skills/bundled/review/SKILL.md
+++ b/packages/core/src/skills/bundled/review/SKILL.md
@@ -93,6 +93,8 @@ Based on the parsed `target.type`:
     "${QWEN_CODE_CLI:-qwen}" review fetch-pr <pr_number> <owner>/<repo> \
       --remote <remote> \
       --out .qwen/tmp/qwen-review-pr-<pr_number>-fetch.json
+    # GitHub Enterprise: add --host <host>. The report records it, and Step 9's
+    # bypass audit queries that host — a dropped host here silently audits github.com.
     ```
 
     **Where `<owner>/<repo>` and `<remote>` come from — do not guess either.** For a `pr-url` target both are already decided: the URL carries the owner/repo, and the remote is the one matched against it above. For a bare **`pr-number`** there is no URL, and a PR number alone says nothing about which repository it belongs to. Derive it:
@@ -666,7 +668,7 @@ If the user responds with "post comments" (or similar intent like "yes post them
 
 ## Step 7: Submit PR review
 
-**You do not post. `qwen review submit` posts, and it refuses when the run is not authorised.** Do NOT call `gh api repos/.../pulls/<n>/reviews` yourself — not to submit the review, not to "test" an anchor, not at all. That command is the one write in this skill, and it now lives behind a check:
+**You do not post. `qwen review submit` posts, and it refuses when the run is not authorised.** That is a claim about **every write path to the pull request**, not one API route: no `gh api repos/.../pulls/<n>/reviews` (not to submit, not to "test" an anchor), no `gh pr comment`, no `gh pr review`, no `gh issue comment`, no `gh api` with POST/PATCH/PUT/DELETE against the PR's `issues/*` or `pulls/*` endpoints, and no editing or deleting existing comments. **You do not author PR-facing prose at all** — `compose-review` computes the review body from structured state (the verdict, the downgrade reasons, the body-Criticals), and there is no free-text field to pass through it; a free-form note you want to add is a note for the **terminal summary**, which the user reads, not for the pull request. The only text that reaches the PR is that computed body plus the inline finding comments, and both ride the one sanctioned write below. Dogfooded the hard way: a run that had lost these instructions to four context compressions decided its findings were "all duplicates", never called submit, and hand-posted a consolidated summary with `gh pr comment` — a write with no authorisation gate, no downgrade semantics, no `posted` fact, and no completion line; nothing downstream could tell it had happened. `cleanup` now audits the review window and flags issue comments by the reviewing account (submit never posts one — see Step 9), so that bypass is at least named in the terminal — a tripwire, not permission. The one write in this skill lives behind a check:
 
 ```bash
 "${QWEN_CODE_CLI:-qwen}" review submit \
@@ -761,13 +763,35 @@ Read `.qwen/tmp/qwen-review-{target}-presubmit.json`. Schema:
   downgradeRequestChanges: boolean; // submit COMMENT instead of REQUEST_CHANGES (self-PR only)
   downgradeReasons: string[];       // human-readable; join with '; ' for body
   blockOnExistingComments: boolean; // one or more overlaps — drop those findings
+  findingsFileInvalid: boolean;     // the --new-findings file was unreadable:
+                                    // overlap dedup ran on an empty set (dupes
+                                    // possible) and anchor-risk defaulted to
+                                    // at-risk. Regenerate it and re-run.
+  headDrift: {                      // did the PR advance while the review ran?
+    reviewedSha: string;            // the fetchedSha this review actually read
+    liveHeadSha: string;
+    drifted: boolean;               // true → downgradeApprove already fired
+    compare: {                      // best-effort delta; null when unavailable
+      status: string;               // 'diverged' = force-push rewrote history
+      aheadBy: number;
+      filesTouched: string[];       // capped list — see filesTotal
+      filesTotal: number;           // real count; > filesTouched.length = cut
+    } | null;
+    anchorsAtRisk: boolean;         // the submit-or-restart decision, computed
+                                    // fail-safe (truncation, diverged, no
+                                    // compare, or no findings list ⇒ true)
+  };
 }
 ```
 
 **Apply the report:**
 
-- `blockOnExistingComments=true` → **an overlap is a duplicate; the disposal is deterministic — do not ask the user.** Drop each finding whose `(path, line)` appears in `existingComments.overlap` from your `comments` array — the inline counts follow automatically, because `submit` counts the comments you actually attach, so a dropped Critical is simply no longer there to count (and a dropped Critical that was already on the PR does not belong in `state.bodyCriticals` either). List the dropped findings in the terminal summary as "already reported at <path>:<line>", and submit the remainder without pausing. Dogfooding measured this exact decision point improvised as an interactive question in 2 of 6 runs — which stalls a headless run forever — while the other 4 runs proceeded; the Exclusion Criteria already forbid re-reporting discussed issues, so there is nothing to ask. (If dropping overlaps leaves zero findings, that is still not a question: submit with an empty `comments` array like any other run.)
+- `blockOnExistingComments=true` → **an overlap is a duplicate; the disposal is deterministic — do not ask the user.** Drop each finding whose `(path, line)` appears in `existingComments.overlap` from your `comments` array — the inline counts follow automatically, because `submit` counts the comments you actually attach, so a dropped Critical is simply no longer there to count (and a dropped Critical that was already on the PR does not belong in `state.bodyCriticals` either). List the dropped findings in the terminal summary as "already reported at <path>:<line>", and submit the remainder without pausing. Dogfooding measured this exact decision point improvised as an interactive question in 2 of 6 runs — which stalls a headless run forever — while the other 4 runs proceeded; the Exclusion Criteria already forbid re-reporting discussed issues, so there is nothing to ask. (If dropping overlaps leaves zero findings, that is still not a question: submit with an empty `comments` array like any other run — `submit` composes the body from `state`, and a run with nothing to add posts whatever that computes. A recap like "all already reported, N resolved by `<sha>`, two still standing" goes in the **terminal summary**, not the PR: `compose-review` has no free-text body field to carry it (see Step 7 — you do not author PR-facing prose), and it is never a `gh pr comment` — a hand-posted issue comment bypasses the authorisation gate, the downgrade semantics, and the `posted` contract all at once.)
 - `downgradeApprove` / `downgradeRequestChanges` / `downgradeReasons` → **do not apply these by hand.** Copy them into the `presubmit` field of the `compose-review` input (below); the subcommand owns the semantics its tests pin — a downgrade fires only when the verdict it names is the one on the table (a Suggestion-only review is already Comment, so nothing is downgraded and no "Downgraded" sentence is emitted), the downgrade sentence carries the reasons, and a downgraded Request changes keeps its body Criticals after the sentence so the self-PR downgrade never erases the only copy of a blocker.
+- `headDrift.drifted=true` → **commits nobody reviewed are on the PR; the verdict can no longer certify the pull request as it stands.** The Approve cap has already fired through the downgrade machinery (the reason names both SHAs — it rides into the body with the other reasons; never hand-apply). What happens to the _submission_ is decided by **`headDrift.anchorsAtRisk`, which presubmit computes — do not re-derive it by hand**: pass `--new-findings` so it has your anchors, and it rules fail-safe on every hole a hand intersection falls into (a truncated `filesTouched` list — measured on a real 283-file base-merge drift where the cap silently dropped every path findings actually anchor to — the compare API's own 300-file ceiling, a `diverged` force-push, an unavailable compare, or a missing findings list). **`--new-findings` must carry EVERY finding's file, not only the inline-anchored ones** — a body-only Critical (one that could not be mapped to a diff line) still names a file, and if that file is omitted a drift touching it reads as `anchorsAtRisk=false`; include one `{path, line}` per body Critical (any placeholder `line`, e.g. `1` — presubmit intersects on `path` only). **`anchorsAtRisk=true`**: the anchors themselves are at risk and the findings may already be fixed — apply the 422-recovery rule _proactively_: abandon this submission, say so, and restart at the new SHA from Step 1's `fetch-pr`. **`anchorsAtRisk=false`**: submit as planned — the review is of `fetchedSha` (`submit` posts that very SHA as `commit_id`), the body's downgrade sentence says so, and if GitHub still answers 422 the recovery path below takes over. Name the drift in the terminal summary either way.
+
+  > **The restart bound is per-review and covers BOTH restart paths — this proactive drift restart AND the reactive 422 recovery below.** Track it as one fact: a review restarts **at most once** for head movement, whichever path triggers it. If a run that already restarted once reaches a drift restart _or_ a 422 again, do NOT restart a second time — submit at that run's reviewed SHA with the drift named (the Approve cap holds either way). A live PR that keeps moving must not be able to starve the review in an unbounded restart loop; one clean re-read is the review, a second is the PR outrunning it.
+
 - `ciStatus.skippedCheckNames` → **a green CI is not evidence about a check that never ran.** These are checks that reached `completed` with `skipped`, `neutral`, `stale`, or **no conclusion at all** at this commit — GitHub reports them alongside the passing ones, and this classifier used to score them as passes. Most are routing jobs and are noise; a docs-only PR legitimately skips the test matrix. But **presubmit cannot know which of them would have exercised _this_ diff, and you can** — you have `files[]`. So rule on the list: for each skipped check, ask whether it is the one that would have run the code this PR changes (a test job whose suite covers the changed package; the integration/E2E job for a feature whose only new test lives there). If one is, then **CI verified nothing about this change**, and the review must say so rather than resting on the green:
   - Name the skipped check in the terminal output, always.
   - If Agent 7's build/test did not cover that ground either — and it usually does not: a skipped **integration** job is exactly the suite `npm test` excludes — record `build-and-test — <check> was skipped in CI and its suite did not run locally` in `unreviewedDimensions`. That already caps a would-be Approve at `COMMENT`, through machinery that exists.
@@ -859,7 +883,7 @@ Then submit it — through `submit`, which checks the authorisation and the payl
   [--host <host>]     # required for GitHub Enterprise; omit on github.com
 ```
 
-**If the call fails with HTTP 422**, the review is created all-or-nothing — nothing was posted, including the Critical findings. This should now be unreachable for anchor arithmetic: every `line` you posted came out of `resolve-anchors`, which only ever considers lines it collected from **inside a hunk** of the very diff you are reviewing. So before working the recovery below, check the likelier remaining causes: **the diff you resolved against is not the commit you are posting to** — re-run `gh pr view <n> --repo <owner>/<repo> --json headRefOid` (with `GH_HOST=<host>` for Enterprise; a bare `<n>` queries whatever same-numbered PR the current branch points at) and compare it to the `commit_id` in your review JSON (which is the `fetchedSha` Step 1 captured; `fetchedSha` is a field of the _fetch report_, not of the review JSON). If they differ, the head advanced mid-review and **this review is of a commit that is no longer the pull request.** Do not re-resolve the old findings against the new diff and submit those: re-resolving relocates the _anchors_, it does not review the new code, re-verify the old conclusions, re-check the open Criticals, or re-run presubmit. You would be approving lines nobody read, or filing a blocker the new commit already fixed. **Abandon this submission and start the review again at the new SHA** — say so in your output, and go back to Step 1's `fetch-pr`. Step 8 writes no cache for an abandoned run. The other cause is a `line` hand-edited after the resolver returned it. GitHub's error names the failing field (`pull_request_review_thread.line must be part of the diff`) but **does not tell you which entry is at fault**, so do not try to read the offender out of the error text.
+**If the call fails with HTTP 422**, the review is created all-or-nothing — nothing was posted, including the Critical findings. This should now be unreachable for anchor arithmetic: every `line` you posted came out of `resolve-anchors`, which only ever considers lines it collected from **inside a hunk** of the very diff you are reviewing. So before working the recovery below, check the likelier remaining causes: **the diff you resolved against is not the commit you are posting to** — re-run `gh pr view <n> --repo <owner>/<repo> --json headRefOid` (with `GH_HOST=<host>` for Enterprise; a bare `<n>` queries whatever same-numbered PR the current branch points at) and compare it to the `commit_id` in your review JSON (which is the `fetchedSha` Step 1 captured; `fetchedSha` is a field of the _fetch report_, not of the review JSON). If they differ, the head advanced mid-review and **this review is of a commit that is no longer the pull request.** Do not re-resolve the old findings against the new diff and submit those: re-resolving relocates the _anchors_, it does not review the new code, re-verify the old conclusions, re-check the open Criticals, or re-run presubmit. You would be approving lines nobody read, or filing a blocker the new commit already fixed. **Abandon this submission and start the review again at the new SHA** — say so in your output, and go back to Step 1's `fetch-pr` — **unless this review has already restarted once for head movement** (the shared per-review bound the drift rule states above): in that case do NOT restart again, submit at the current reviewed SHA with the drift named, and let the Approve cap stand. Step 8 writes no cache for an abandoned run. The other cause is a `line` hand-edited after the resolver returned it. GitHub's error names the failing field (`pull_request_review_thread.line must be part of the diff`) but **does not tell you which entry is at fault**, so do not try to read the offender out of the error text.
 
 Recovery, if it is genuinely an anchor: recheck them against `files[].hunks[]` from the fetch report — a pure lookup, no API calls (in lightweight mode, against the `gh pr diff` output you already have): an entry is valid if its `line` appears **anywhere inside a diff hunk** for `path` — an added or modified line, or an unchanged context line rendered within the hunk (every comment is on the `RIGHT` side: a single-line one by default, a multi-line one because it says so explicitly). For a multi-line entry, **one hunk must contain the whole range**: `newStart <= start_line <= line <= newEnd` for the _same_ hunk. Checking the two ends independently passes a range whose endpoints sit in different hunks, and a reversed range (`start_line > line`) passes both checks and 422s anyway — a second rejection you paid a round trip to discover. Check that it carries `side` and `start_side` too, whose absence is itself a 422. What GitHub rejects is a line in **no hunk at all**, or a file the PR does not touch. Drop every entry that fails that test, then resubmit once: move each failing **Critical** into the `body` as a whole-PR observation, and discard each failing **Suggestion** (it stays in the terminal output and the Step 8 report — Suggestion text must not enter `body`, see above). **You recompute nothing.** Update the payload and resubmit: each relocated Critical moves into `state.bodyCriticals`, each discarded Suggestion increments `state.suggestionsDiscarded`, and the failing entries come out of `comments`. `submit` recomposes the event and body from what you hand it, so the guarantees the recovery used to hand-derive are structural: a discarded Suggestion still counts toward `S`, so the verdict never upgrades to `APPROVE` on the resubmit; a context-unavailable run keeps its diff-only wording; a relocated blocker keeps `REQUEST_CHANGES` (body Criticals count toward `C` exactly like anchored ones). If the resubmit still 422s, submit once more with `"comments": []` — every remaining Critical in `state.bodyCriticals`, every Suggestion counted in `state.suggestionsDiscarded`: a review with the blockers in prose beats no review at all, and the truth table produces a non-empty `COMMENT` body when no Critical remains, so the one combination GitHub is documented to reject (no body, no comments) cannot be constructed. Never let a single mis-anchored Suggestion suppress a Critical blocker. Log which entries were relocated and which were discarded.
 
@@ -923,7 +947,7 @@ Run the bundled cleanup subcommand:
 "${QWEN_CODE_CLI:-qwen}" review cleanup <target>
 ```
 
-`<target>` is the same suffix used throughout (`pr-<n>`, `local`, or filename). The command removes the worktree at `.qwen/tmp/review-pr-<n>` (PR targets only), deletes the local branch ref `qwen-review/pr-<n>`, and clears any `.qwen/tmp/qwen-review-<target>-*` side files (review JSON, PR context, presubmit / findings reports). It is idempotent — missing files are silent OK. Also remove `.qwen/tmp/qwen-review-parse-args.json` and the session args directory `.qwen/tmp/s-<session>/` (the path from the `<skill-args>` note) — both are written before the target suffix is known, so the pattern above misses them. (Leave the args file in place if you had to fall back to writing it yourself and the run failed: it is the only record of what the review was actually asked to do.)
+`<target>` is the same suffix used throughout (`pr-<n>`, `local`, or filename). The command removes the worktree at `.qwen/tmp/review-pr-<n>` (PR targets only), deletes the local branch ref `qwen-review/pr-<n>`, and clears any `.qwen/tmp/qwen-review-<target>-*` side files (review JSON, PR context, presubmit / findings reports). It is idempotent — missing files are silent OK. For PR targets it first **audits the review window**: any issue comment the reviewing account posted — or edited — since `fetch-pr` opened the window (the boundary reaches back across drift restarts and a clock-skew allowance), and any **review** the account submitted that `submit`'s receipt does not vouch for, is flagged with `warning:` lines, because submit's one sanctioned write is receipt-recorded and never touches issue comments (Step 7's write ban) — so such a comment is a write that bypassed the gate, something the user did by hand, or **another workflow posting under the same account** (in CI the review shares the bot identity with precheck/triage; their marker-stamped comments are filtered out automatically, but the third reading stays real for anything unmarked). **Relay those `warning:` lines verbatim in your terminal summary** — the user can dismiss their own comment; a bypass they were never told about, they cannot. The audit is best-effort: when it cannot run (offline, unauthenticated, no report) it says so once on stderr — `note: bypass audit skipped (…)` — so a skipped audit is never mistaken for a clean one. Also remove `.qwen/tmp/qwen-review-parse-args.json` and the session args directory `.qwen/tmp/s-<session>/` (the path from the `<skill-args>` note) — both are written before the target suffix is known, so the pattern above misses them. (Leave the args file in place if you had to fall back to writing it yourself and the run failed: it is the only record of what the review was actually asked to do.)
 
 This step runs **after** Step 7 and Step 8 to ensure all review outputs are saved before cleanup.