diff --git a/ce-base.sh b/ce-base.sh
index a11e837..ca517d1 100644
--- a/ce-base.sh
+++ b/ce-base.sh
@@ -72,5 +72,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 0 — Base" "${LOG_FILE}"
 
 log_info "=== TIER 0 COMPLETE ==="
diff --git a/ce-basic.sh b/ce-basic.sh
index f7ea808..9000cb0 100644
--- a/ce-basic.sh
+++ b/ce-basic.sh
@@ -79,5 +79,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 2 — Basic" "${LOG_FILE}"
 
 log_info "=== TIER 2 COMPLETE ==="
diff --git a/ce-minimal.sh b/ce-minimal.sh
index 932b6fd..4ab0a6e 100644
--- a/ce-minimal.sh
+++ b/ce-minimal.sh
@@ -85,5 +85,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 1 — Minimal" "${LOG_FILE}"
 
 log_info "=== TIER 1 COMPLETE ==="
diff --git a/lib/ce-common.sh b/lib/ce-common.sh
index 53d450b..9373178 100644
--- a/lib/ce-common.sh
+++ b/lib/ce-common.sh
@@ -149,3 +149,29 @@ print_summary() {
         done
     fi
 }
+
+# review_pause <label> [log_file]
+# Greps the tier log for WARN/ERROR lines and displays them.
+# If issues found: blocks until OHIOD confirms reviewed.
+# If clean: logs OK and continues without prompting.
+# Not bypassed by CE_INSTALL_NO_CONFIRM — this is an OHIOD safety gate.
+review_pause() {
+    local label="${1:-this step}"
+    local log="${2:-${LOG_FILE}}"
+    local issues
+
+    issues="$(grep -E '\[(WARN |ERROR)\]' "${log}" 2>/dev/null || true)"
+
+    echo ""
+    if [[ -n "${issues}" ]]; then
+        log_warn "=== REVIEW REQUIRED — ${label} ==="
+        echo ""
+        echo "${issues}"
+        echo ""
+        read -r -p "Address any issues above. Ready to proceed? [y/N] " confirm
+        [[ "${confirm,,}" == "y" ]] \
+            || { log_info "Stopped at ${label} — address issues and re-run from this tier."; exit 0; }
+    else
+        log_info "${label} — no issues found, continuing."
+    fi
+}