Is Human Review of AI-Authored Code Still a Real Control, or Already Rubber-Stamping?

Five-question synthesis of the oversight cluster. (1) 'Acceptance' at 60% blends three acts of different evidentiary weight — affirmative adoption, reviewed non-reversion, and bare non-reversion — and only the third is the rubber-stamp class; the construct, not the data, is why Faros and CMU can headline opposite trends. (2) The allocator-rubber-stamp risk is documented at three evidence layers (brain-fry error rates +11/+39%, 31.3% no-review telemetry, P2–P4 practitioner discourse): volume plus surface plausibility push the human past engagement, so the framing survives only with structural countermeasures (quiz gate, sample-based depth, risk-tiered gating) that make understanding rather than signature the merge condition. (3) 'How far to automate review' is a partition, not a dial: automate mechanical verification fully, keep human depth on a sampled/high-stakes slice — because the binding constraint isn't defect-catching (contested P9) but ownership, skill growth, and comprehension debt, which accrue regardless of who catches bugs. (4) Faros-vs-DORA is partly a category error — surveys measure felt productivity, telemetry measures system outcomes, both true at their layer — but the maturity-protection disagreement is substantive and unresolved. (5) Ng-vs-Faros is both-and: the 0-to-1/production scope split is real and does most of the work, while documented optimism bias means Ng's self-reported QA relief can't be read as measurement