Self-review confirms, it does not check.
The failure is structural, not moral. The context that produced a conclusion is the worst possible context for testing it: every assumption that generated the error is still loaded, still feels obvious, and is never the thing questioned.
So correctness-critical work gets a reviewer with a fresh context and an explicit instruction to find the flaw rather than to bless the result.
Four fixed ways to attack a finding.
A claimed defect is refuted on four named lenses rather than by general skepticism, because general skepticism converges on agreement.
- Citation — attack the evidence itself. Does the cited line say what the finding claims?
- Reproduction — construct the inputs that actually trigger it. If none exist, it is not a defect.
- Guarded — check whether something upstream already prevents it.
- Stakes — establish whether the consequence is real.
An unfinished review is not a pass.
A finding needs a quorum of completed votes before it counts as verified at all. If too few votes return, the result is recorded as unresolved rather than quietly dropped.
When the adjudicating reviewer fails outright, that is recorded too, and the finding is marked as panel-only. The one outcome the design refuses is an unfinished check that reads as a clean bill of health.
- Below quorum, the verdict is abstain, not pass.
- A crashed adjudicator is logged as a failure, never as a confirmation.
- Review has a hard cost ceiling, with budget reserved for high-severity findings so cheap dimensions cannot starve expensive ones.
Review is priced to the stakes.
Cheap reviewers do the wide pass; the expensive adjudicator is reserved for work where correctness is consequential, and skipped for configuration and documentation unless a finding is severe.
Reviewing everything at maximum depth costs enough that it stops happening. Tiering is what keeps the expensive pass available for the cases that need it.
The rule that makes it work.
The mechanism is worth less than the habit: the author does not sign off. In practice that means the session that wrote the code orders the review and does not get a vote in it.
Every number on this site follows the same rule. Where a count is claimed, the command that produces it is printed next to it, so the claim is checkable by someone who does not trust the claimer.