@feng0531/dsh-code-review 0.49.0 → 0.51.0

package/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.51.0 — 组合验收
+
+新增多轮×窗口×检索×预算的组合端到端验收，校验覆盖统计、每文件轮次、输入预算上界与窗口覆盖一致。只读批准快照，不改变审查行为或参数。
+
+## 0.50.0 — 生命周期与并发提示细化
+
+Objective-C、Swift、Java、Kotlin、C# 补充线程/队列约束、并发隔离、版本门控 API 与生命周期清理提示；均以实际运行环境为证据前提，不推断线程亲和或内存保证。431 项完整回归、实际宿主、9 项独立安装专项与四组 CI 通过；npm、Release 与原产物 102,412 字节一致，双哈希和清单通过。
+
 ## 0.49.0 — Go/Python/Rust 运行时提示细化与 ArkTS
 
-Go 关注构建标签/版本与 GC 假设；Python 关注版本语法与调用契约；Rust 关注 edition/MSRV、cfg/宏展开与 panic 模式；新增 ArkTS（.ets）UI 线程/生命周期与受限边界提示。仍为证据门控提示，不是语义解析。
+Go 关注构建标签/版本与 GC 假设；Python 关注版本语法与调用契约；Rust 关注 edition/MSRV、cfg/宏展开与 panic 模式；新增 ArkTS（.ets）UI 线程/生命周期与受限边界提示。仍为证据门控提示，不是语义解析。430 项完整回归、实际宿主、11 项独立安装专项与四组 CI 通过；npm、Release 与原产物 101,770 字节一致，双哈希和清单通过。
 
 ## 0.48.0 — 剩余语言与格式的保守缺陷提示
 

package/CORE-ALIGNMENT-TASKS.md

@@ -26,15 +26,18 @@
 | 1 | 实例与成员级上下文 | 命名/默认定义、保守调用方线索、历史同版本线索、命名空间成员导航已交付；类实例与继承仍待验收 |
 | 2 | 剩余历史来源与旧侧组合 | Git 历史与 SVN 三层链已交付；其他旧侧来源仍待验收 |
 | 3 | 其他旧侧独有来源 | 来源、版本、权限与删除场景保持一致 |
-| 4 | 路径专用指导与生命周期细化 | 函数式/HDL/智能合约/格式语言与 Go/Python/Rust 运行时提示已交付；部分生命周期并发细化仍待验收 |
-| 5 | 剩余预算组合与端到端矩阵 | 分组、窗口、检索、多次审查的终态与覆盖一致 |
+| 4 | 路径专用指导与引擎版本约束 | 函数式/HDL/智能合约/格式语言、Go/Python/Rust 与 ObjC/Swift/Kotlin/Java/C# 提示已交付；模板与依赖清单引擎版本仍保持通用 |
+| 5 | 剩余预算组合与端到端矩阵 | 多轮×窗口×检索×预算对账已验收；分组/验证/综合的组合仍待验收 |
 | 后置 | 真实模型质量评测 | 保存真实输出，人工裁决，分开统计失败和未完成 |
 
-Git 工作区、Git 历史两侧与 SVN 当前侧支持安全的三层字面依赖链；手动批准上下文可以作为入口。命名与默认导入支持批准正文中的唯一声明位置。这些能力不是完整语义绑定。调用方语法绑定的 v0.45.0 存在逐条导入歧义与历史发现元数据混侧错误，不计作安全对齐；v0.45.1 已修正并正式交付；历史调用方的同版本语法导航已随 v0.46.0 正式交付；命名空间成员调用导航已随 v0.47.0 正式交付；剩余函数式/HDL/智能合约/格式语言的保守缺陷提示已随 v0.48.0 正式交付；Go/Python/Rust 运行前提与 ArkTS 提示已随 v0.49.0 正式交付；歧义后缀不猜测，转化用签名探测，提示不代替语义解析。
+Git 工作区、Git 历史两侧与 SVN 当前侧支持安全的三层字面依赖链；手动批准上下文可以作为入口。命名与默认导入支持批准正文中的唯一声明位置。这些能力不是完整语义绑定。调用方语法绑定的 v0.45.0 存在逐条导入歧义与历史发现元数据混侧错误，不计作安全对齐；v0.45.1 已修正并正式交付；历史调用方的同版本语法导航已随 v0.46.0 正式交付；命名空间成员调用导航已随 v0.47.0 正式交付；剩余函数式/HDL/智能合约/格式语言的保守缺陷提示已随 v0.48.0 正式交付；Go/Python/Rust 运行前提与 ArkTS 提示已随 v0.49.0 正式交付；ObjC/Swift/Kotlin/Java/C# 生命周期与并发细化已随 v0.50.0 正式交付；歧义后缀不猜测，转化用签名探测，提示不代替语义解析。
 
 ## 当前验证结论
 
-- 最近完整回归：429 项通过。
+- 最近完整回归：432 项通过。
+- v0.51.0 已正式交付多轮×窗口×检索×预算的组合验收。432 项回归、实际宿主与四组 CI 覆盖该组合；不改变审查行为或参数。
+- v0.50.0 已正式交付 ObjC/Swift/Kotlin/Java/C# 生命周期与并发细化提示。431 项回归、实际宿主、9 项独立安装专项和四组 CI 通过；npm、Release 与原包 102,412 字节一致，SHA-256、SHA-512 与清单核验通过。
+- v0.49.0 已正式交付 Go/Python/Rust 运行时提示与 ArkTS 提示。430 项回归、实际宿主、11 项独立安装专项和四组 CI 通过；npm、Release 与原包 101,770 字节一致，SHA-256、SHA-512 与清单核验通过。发布阶段 npm 成功、Release 创建因 registry 瞬时 404 由保存原产物手工补建并复核一致。
 - v0.48.0 已正式交付剩余函数式/HDL/智能合约/格式语言的保守缺陷提示。429 项回归、实际宿主、10 项独立安装专项和四组 CI 通过；npm、Release 与原包 101,539 字节一致，SHA-256、SHA-512 与清单核验通过。
 - v0.47.0 已正式交付命名空间成员调用导航。424 项回归、实际宿主、17 项独立安装专项和四组 CI 通过；npm、Release 与原包 98,883 字节一致，SHA-256、SHA-512 与清单核验通过。
 - v0.46.0 已正式交付历史同版本调用方导航与可选线索预算回退。416 项回归、实际宿主、13 项独立安装专项和四组 CI 通过；npm、Release 与原包 97,482 字节一致，SHA-256、SHA-512 与清单核验通过。

package/CORE-SOURCE-INVENTORY.md

@@ -38,7 +38,7 @@
 - PO/POT、MyBatis 映射：文本身份、复数、占位符、绑定值与动态 SQL 提示。
 - JS/TS/React：hook、异步清理与渲染副作用提示。
 
-Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示也已交付。以下仍以通用或大类指导为主，需进一步细化：Objective-C/Swift/Kotlin/Java/C/C++ 的具体生命周期与并发场景，以及模板、依赖清单与基础设施的引擎版本和消费者约束。全部提示不是语义解析、迁移执行结果或缺陷证据。
+Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示、Objective-C/Swift/Kotlin/Java/C/C++ 的生命周期与并发细化提示也已交付。以下仍以通用指导为主：模板、依赖清单与基础设施的引擎版本和消费者约束，按“不按文件名推定行为”保留通用提示。全部提示不是语义解析、迁移执行结果或缺陷证据。
 
 ## 固定参考文件索引
 

package/RELEASE-NOTES.md

@@ -1,12 +1,12 @@
-# v0.49.0 发布说明
+# v0.51.0 发布说明
 
-## Go/Python/Rust 运行时提示细化与 ArkTS 支持
+## 组合验收
 
-为 Go、Python、Rust 补充版本与运行环境前提提示：Go 关注构建标签、go.mod/runtime 版本和 GC/finalizer 假设；Python 关注版本相关语法与关键字/位置调用契约；Rust 关注 edition/MSRV、cfg 与 proc-macro 展开及 panic 模式。新增 ArkTS（.ets）指导，关注 UI 线程/组件生命周期、状态不可变规则与受限 ArkTS/动态执行边界。
+新增组合端到端验收：同一审查生命周期内验证多次审查轮次、大文件变更窗口、批准快照检索与输入预算的终态一致性。断言覆盖统计总和等于审查文件数、每文件轮次完整、每个入口输入不超过预算、窗口文件上报窗口覆盖、检索在受限预算下实际发生。
 
-## 限制
+## 范围
 
-- 提示仍只针对具体缺陷和反证，不是语义解析、迁移执行结果或缺陷证据，不授予读取权限。
-- .ts/.tsx 仍按 JavaScript/TypeScript 提示，不自动转为 ArkTS；仅 .ets 命中 ArkTS 指导。
+- 只读批准快照；不新增读取、不放宽预算，不改变任何审查行为或参数。
+- 分组、验证与综合阶段的组合以既有专项测试与两两组合覆盖为准，仍保持部分待验收。
 
 使用方法见 [README](README.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -3,17 +3,17 @@ import {protocolGuidance} from './protocol-guidance.mjs';
 const common = ['Only report a concrete defect with trigger, impact and changed-code evidence.', 'Check before/after behavior and counterexamples; absent context means uncertainty, not an invented contract.'];
 const checklists = {
  shader: ['Check coordinate spaces, matrix/vector order, normal transforms, UV units and screen/projection conventions against captured pipeline evidence.', 'Check division/normalization and precision near zero, NaN propagation, sampling/LOD behavior and bounds for changed input domains.', 'Check resource bindings, pass/keyword variants, depth/blend state and synchronization against actual consumers; do not invent platform/compiler behavior or include search paths.'],
- objc: ['Check ARC/manual ownership, retain cycles, weak/unowned callbacks and Objective-C++ lifetime crossings against captured contracts.', 'Check observer/block cancellation and queue affinity before teardown; message to nil is not proof that required work completed.'],
- swift: ['Check optional force unwraps and unowned captures against actual object lifetime and failure paths.', 'Check actor isolation, task cancellation, continuation completion exactly once and resources surviving asynchronous work.'],
+ objc: ['Check ARC/manual ownership, retain cycles, weak/unowned callbacks and Objective-C++ lifetime crossings against captured contracts.', 'Check observer/block cancellation and queue affinity before teardown; message to nil is not proof that required work completed.', 'Check Core Data/URLSession/notification teardown and UI updates dispatched to the documented main/queue contract; do not infer thread-safety away.'],
+ swift: ['Check optional force unwraps and unowned captures against actual object lifetime and failure paths.', 'Check actor isolation, task cancellation, continuation completion exactly once and resources surviving asynchronous work.', 'Check @MainActor/@preconcurrency isolation and strict-concurrency diagnostics against the actual compiler mode; do not assume actor isolation away.'],
  matlab: ['Check matrix dimensions, elementwise versus matrix operations and indexing against captured input contracts.', 'Check empty/NaN values, numeric precision, resource cleanup and changed output shapes with actual consumers.'],
- java: ['Check checked/unchecked exception exits, try-with-resources ownership and suppressed failures.', 'Check null/unboxing, equality/hash contracts and mutable keys; confirm the actual consumer contract.', 'Check synchronization/volatile publication, executor shutdown, interruption propagation and transaction rollback.'],
+ java: ['Check checked/unchecked exception exits, try-with-resources ownership and suppressed failures.', 'Check null/unboxing, equality/hash contracts and mutable keys; confirm the actual consumer contract.', 'Check synchronization/volatile publication, executor shutdown, interruption propagation and transaction rollback.', 'Check virtual-thread pinning, parallel-stream pool assumptions and version-gated APIs against the actual JDK; do not infer preview syntax as stable.'],
  go: ['Check error handling including typed-nil interfaces, deferred cleanup and panic paths.', 'Check goroutine/channel ownership, cancellation, close/send races and synchronization before shared-state teardown.', 'Check slice backing-array aliasing, map races and integer/bounds contracts with concrete callers.', 'Check build tags/constraints, go.mod and runtime version, and GC/finalizer assumptions against the actual build; do not infer memory or scheduling guarantees.'],
  python: ['Check exception paths, context manager cleanup, iterator exhaustion and mutable default/shared state.', 'Check async task exception observation, cancellation and blocking operations on the event loop.', 'Check untrusted serialization, subprocess/SQL interpolation and authorization boundaries against actual input flows.', 'Check version-gated syntax (async/await, walrus, match, positional-only, type hints) and keyword/positional call contracts against the runtime version; do not assume newer feature availability.'],
  rust: ['Check unsafe pointer validity, aliasing, initialization, alignment and lifetime obligations against the safety contract.', 'Check panic/error cleanup, lock guards across await and deadlocks or cancellation between state updates.', 'Check integer conversions, indexing, FFI ownership and Send/Sync assumptions without treating compiler acceptance as runtime proof.', 'Check edition/MSRV, cfg and proc-macro expansion, and panic/unwind versus abort mode against the declared build; do not treat hygiene or source order as evaluated runtime proof.'],
- kotlin: ['Check nullable/platform types, unsafe casts and Java interoperability at actual runtime boundaries.', 'Check structured coroutine lifetime, cancellation propagation, exception supervision and shared state synchronization.', 'Check use/close cleanup, collection mutation and transaction failure paths.'],
+ kotlin: ['Check nullable/platform types, unsafe casts and Java interoperability at actual runtime boundaries.', 'Check structured coroutine lifetime, cancellation propagation, exception supervision and shared state synchronization.', 'Check use/close cleanup, collection mutation and transaction failure paths.', 'Check expect/actual and multiplatform specifics, @Volatile/@Synchronized interop and version-gated stdlib APIs against the actual target; do not infer JVM guarantees elsewhere.'],
  php: ['Check coercion and loose comparison at authentication or validation boundaries with concrete input.', 'Check SQL/command/template injection, deserialization and output escaping in the actual execution context.', 'Check exception/early-return cleanup, transactions and session/concurrent request state.'],
  cpp: ['Check ownership, dangling references, double release and allocator/object lifetime across all exits.', 'Check stop publication, synchronization, join completion and remaining users before teardown; source order alone is not a happens-before proof.', 'Check exception/early-return resource cleanup, iterator invalidation, bounds, integer conversion and undefined behavior.', 'Do not assume macro expansion, overload binding, build flags or virtual dispatch targets without evidence.'],
- csharp: ['Check IDisposable/async disposal, cancellation propagation and completion before releasing shared state.', 'Check nullability and actual runtime guards, event subscription lifetime, deferred enumeration and captured mutable state.', 'Check async exception observation, synchronization and thread-affinity; do not assume await establishes unrelated ordering.'],
+ csharp: ['Check IDisposable/async disposal, cancellation propagation and completion before releasing shared state.', 'Check nullability and actual runtime guards, event subscription lifetime, deferred enumeration and captured mutable state.', 'Check async exception observation, synchronization and thread-affinity; do not assume await establishes unrelated ordering.', 'Check ValueTask double-await, ConfigureAwait scheduling and .NET version nullable rollout against the actual runtime; do not infer marshaling or affinity.'],
  javascript: ['Check null/undefined contract changes, promise rejection handling and missing await or cleanup on failure.', 'Check event/timer/listener lifecycle, closure state, cancellation races and concurrent updates.', 'Check untrusted input at injection/authentication boundaries; do not report style or infer TypeScript runtime checks.'],
  configuration: ['Check changed configuration keys against consumer/schema evidence, type/unit/default mismatches and compatibility.', 'Check exposed secrets, privilege expansion and unsafe interpolation only with concrete supported evidence.'],
  arkts: ['Check UI-thread and component lifecycle, state immutability rules and task/coroutine cleanup against the actual framework contract.', 'Check restricted ArkTS and dynamic-eval boundaries, typed borrow/copy semantics and module strictness; do not infer behavior from plain TypeScript rules.'],