@feng0531/dsh-code-review 0.85.11 → 0.86.0

package/src/review.mjs

@@ -29,6 +29,8 @@ import { changesConcurrency, retrievalRounds } from './review-execution-policy.m
 import { scheduleFileChains } from './file-chain-scheduler.mjs';
 import { reviewReaderBudget, readerAdmission } from './review-reader-policy.mjs';
 import { primarySeeds } from './primary-seeds.mjs';
+import { prepareGroupPrimary, validateGroupPrimary } from './group-primary.mjs';
+import { configureWireBudget, modelWireBudget } from './model-wire-budget.mjs';
 
 export { REVIEW_INSTRUCTIONS };
 export { PROJECT_REVIEW_INSTRUCTIONS };
@@ -99,6 +101,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   const maxRetrievalRounds = retrievalRounds(options.maxRetrievalRounds);
   let checkpointFailed = false, checkpointFailure;
   const progress = options.onProgress;
+  const resumeCheckpoint = options.onResumeCheckpoint;
+  if (resumeCheckpoint) options = { ...options, onResumeCheckpoint: async report => { try { await resumeCheckpoint(report); } catch (error) { checkpointFailed = true; checkpointFailure = error; controller.abort(error); throw error; } } };
   options = { ...options, onProgress: progress ? async event => {
     if (checkpointFailed) throw checkpointFailure;
     try { await progress(structuredClone(event)); }
@@ -140,25 +144,85 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   if(input.workingScope)report.workingScope=structuredClone(input.workingScope);
   if(input.effectiveMergeSources)report.effectiveMergeSources=structuredClone(input.effectiveMergeSources);
   report.rules = (input.rules ?? []).map(({ path, hash }) => ({ path, hash }));
+  if (scope) configureWireBudget(scope, { nativeOutputTools: options.nativeOutputTools === true });
   if (options.enableGrouping === true) report.grouping = buildReviewGroups(input.files, inferFileRelations(input.files));
   report.interactions = [];
   const interactionPlans = scope && report.grouping ? report.grouping.groups.filter(g => g.fileIds.length > 1).map(group => ({ group, prepared: prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes)) })) : [];
   for (const plan of interactionPlans.filter(p => p.prepared.status !== 'not-applicable')) report.interactions.push({ groupId: plan.group.id, fileIds: plan.prepared.fileIds, status: plan.prepared.status === 'ready' ? 'pending' : 'blocked', reason: plan.prepared.reason, lifecycle: 'shares-last-primary-timeout' });
   const fileResults = new Array(input.files.length);
+  const sharedState = report.orchestration = { modelMetrics: {}, modelCallPurposes: {} };
+  const retainArtifact = options.onModelArtifact ? async artifact => { const reference = await options.onModelArtifact(artifact); if (reference) (report.artifacts ??= []).push(reference); } : undefined;
+  report.resume = { reusedFiles: options.resumeState?.completed?.length ?? 0 };
+  const reserveShared = ({ correction = false } = {}) => {
+    if (!correction && options.remainingCalls?.() <= 0) throw Object.assign(new Error('Shared project model call limit exceeded'), { code: 'PROJECT_MODEL_CALL_LIMIT' });
+    if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
+    report.modelCalls++;
+  };
+  const sharedModel = async request => {
+    let correction;
+    return model({ ...request, nativeOutputTools: options.nativeOutputTools === true, maxInputBytes: options.nativeOutputTools === true ? maxInputBytes : request.maxInputBytes, onModelArtifact: retainArtifact ? artifact => retainArtifact({ ...artifact, snapshotId: input.id, phase: request.reviewPhase }) : undefined,
+      onProtocolEvent: async info => { if (info.action === 'json-transport-recovery') (sharedState.modelRecoveries ??= []).push(info); await request.onProtocolEvent?.(info); },
+      onProtocolCorrection: async info => { reserveShared({ correction: true }); correction = info; await request.onProtocolCorrection?.(info); },
+      onModelEvent: async info => {
+        if (info.action === 'model-end') {
+          const phase = request.reviewPhase, metrics = sharedState.modelMetrics[phase] ??= { calls: 0, durationMs: 0, inputBytes: 0, totalOutputBytes: 0 };
+          metrics.calls++; metrics.durationMs += info.durationMs; metrics.inputBytes += info.inputBytes; metrics.totalOutputBytes += info.totalOutputBytes;
+          if (info.callPurpose) sharedState.modelCallPurposes[info.callPurpose] = (sharedState.modelCallPurposes[info.callPurpose] ?? 0) + 1;
+          if (info.callPurpose === 'json-correction' && correction) { (sharedState.modelCorrections ??= []).push({ action: 'explicit-json-correction', code: 'MODEL_INVALID_JSON', jsonIssue: correction.jsonIssue }); correction = undefined; }
+        }
+        await options.onProgress?.({ stage: info.action, snapshotId: input.id, phase: request.reviewPhase, ...info });
+      } });
+  };
+  const groupPrepared = new Map(), groupResults = new Map(), groupStarted = new Map();
+  const groupResult = async group => {
+    if (!groupResults.has(group.id)) {
+      groupStarted.set(group.id, performance.now());
+      groupResults.set(group.id, invoke(async request => {
+      const prepared = groupPrepared.get(group.id); let limited = false; const reads = [];
+      const response = await retrievalLoop(sharedModel, { ...request, nativeOutputTools: options.nativeOutputTools === true, input: prepared.payload, instructions: prepared.instructions, reviewPhase: 'group-primary' }, scope, {
+        maxRounds: maxRetrievalRounds, maxInputBytes, beforeCall: reserveShared, correctProtocol: options.correctProtocol === true,
+        enableSearchSeeds: options.enableSearchSeeds === true,
+        onRetrieved: records => { reads.push(...records); (sharedState.retrievalAudit ??= []).push(...records); },
+        onBudgetLimited: info => { limited = true; (sharedState.retrievalLimits ??= []).push(info); },
+      });
+      const results = validateGroupPrimary(response, prepared, input, validateResponse, scope.catalog());
+      for (const generated of results.values()) {
+        generated.groupLimited = limited;
+        if (generated.groupRisk) {
+          generated.groupRisk.sourceReadCoverage = riskReadCoverage(generated.groupRisk.risks, reads, scope.catalog(), input.id);
+          if (generated.groupRisk.status !== 'completed') generated.limitations.push('组主审的合并风险计划缺失或无效，未补发规划调用；不表示已完成风险条件核查');
+          if (generated.groupRisk.sourceReadCoverage.some(item => item.unreadSourceIds.length)) generated.limitations.push('组风险计划请求的部分来源未在本次组生成读取；不表示已核查或排除风险条件');
+        }
+      }
+      return results;
+    }, { input: groupPrepared.get(group.id).payload, instructions: groupPrepared.get(group.id).instructions }, timeoutMs, signal));
+    }
+    return groupResults.get(group.id);
+  };
   const runFile = async index => {
     const file = input.files[index];
     const state = { fileId: file.id, path: file.path, status: file.eligibility === 'reviewable' ? 'pending' : file.eligibility, reason: file.reason, ...(file.blockCode ? {blockCode:file.blockCode} : {}) };
-    const result = { state, findings: [], limitations: [] };
+    let result = { state, findings: [], limitations: [] };
     fileResults[index] = result;
     try {
     await options.onProgress?.({stage:'file-started',snapshotId:input.id,fileId:file.id,path:file.path,status:state.status});
     if (state.status !== 'pending') return;
+    const reusable = options.resumeState?.completed?.find(row => row.fileId === file.id && row.path === file.path);
+    if (reusable) {
+      const prior = structuredClone(reusable.state);
+      for (const key of ['modelMetrics', 'modelCallPurposes', 'modelCorrections', 'modelRecoveries', 'retrievalAudit', 'protocolAttempts', 'protocolDiagnostic', 'responseAttempts', 'responseCorrections', 'anchorCorrections', 'retrievalLimits']) delete prior[key];
+      Object.assign(state, prior, { reused: true, reuseNotice: 'Prior completed evidence retained for an identical approved snapshot/configuration; no new model or evidence receipt claimed.' });
+      result.findings = structuredClone(reusable.findings).map(finding => ({ ...finding, reused: true, priorRun: { snapshotId: options.resumeState.snapshotId, evidenceStatus: 'historical-verified-evidence-not-current-run-receipts' } }));
+      result.limitations = structuredClone(reusable.limitations ?? []);
+      return;
+    }
     if (signal?.aborted) { state.status = 'cancelled'; state.reason = '用户取消'; return; }
-    if (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0) { state.reason = '模型调用预算耗尽'; return; }
-    const prepared = preparePrimaryInput(input, file, { instructions, scope, grouping: report.grouping, maxInputBytes, riskPlanningMode: options.riskPlanningMode, enableRiskPlanning: options.enableRiskPlanning, skipSmallRiskPlans: options.skipSmallRiskPlans });
+    const assignedGroup = [...groupPrepared].find(([, value]) => value.fileIds.includes(file.id));
+    if (!assignedGroup && (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0)) { state.reason = '模型调用预算耗尽'; return; }
+    const prepared = preparePrimaryInput(input, file, { instructions, scope, grouping: report.grouping, maxInputBytes, riskPlanningMode: options.riskPlanningMode, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning, skipSmallRiskPlans: options.skipSmallRiskPlans });
     const { changes, payload } = prepared;
     Object.assign(state, prepared.metadata);
-    if (state.contextMode === 'approved-retrieval') result.limitations.push({ fileId: file.id, text: '窗口初始输入仅带上下文身份目录，全文须按需读取；不声明所有上下文已核查。' });
+    if (state.contextMode === 'approved-retrieval') result.limitations.push({ fileId: file.id, text: '初始输入仅提供聚焦上下文或身份目录，其他批准全文须按需读取；不声明所有上下文已核查。' });
     if (prepared.synthesis) state.synthesisStatus = prepared.synthesis.status === 'ready' ? 'pending' : 'blocked';
     if (prepared.synthesis?.status === 'blocked') result.limitations.push({ fileId: file.id, text: (prepared.synthesis.reason === 'batch-limit' ? '跨窗口综合批次数超过上限（20），未发送；全部主窗口仍独立审查' : '跨窗口综合输入超限，未发送') + '；单窗口完成不表示交互影响已检查' });
     if (state.sourceMode === 'change-windows') state.windowCoverage = { completed: [], pending: [...state.windowIds] };
@@ -177,11 +241,26 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         (state.retrievalLimits ??= []).push(info);
         result.limitations.push({ fileId: file.id, text: '检索预算受限，已保留现有结果但不能视为完整审查：' + info.reason });
       };
-      const onProtocolEvent = async info => { await options.onProgress?.({ stage: 'protocol-correction', fileId: file.id, path: file.path, ...info }); };
-      const trackedModel = request => model({ ...request, callPurpose: request.callPurpose ?? request.reviewPhase ?? 'primary-initial', onProtocolEvent,
+      let pendingStageCorrection;
+      const onProtocolEvent = async info => {
+        if (info.action === 'json-transport-recovery') (state.modelRecoveries ??= []).push(info);
+        if (info.action === 'retrieval-protocol-correction') pendingStageCorrection = { action: info.action, code: 'RETRIEVAL_PROTOCOL_ERROR' };
+        await options.onProgress?.({ stage: 'protocol-correction', fileId: file.id, path: file.path, ...info });
+      };
+      const trackedModel = request => {
+        request.signal?.throwIfAborted();
+        // The executor has admitted this call; budget-vetoed retries never reach here.
+        if (pendingStageCorrection) { (state.modelCorrections ??= []).push(pendingStageCorrection); pendingStageCorrection = undefined; }
+        let pendingJsonCorrection;
+        return model({ ...request, nativeOutputTools: options.nativeOutputTools === true, maxInputBytes: options.nativeOutputTools === true ? maxInputBytes : request.maxInputBytes, callPurpose: request.callPurpose ?? request.reviewPhase ?? 'primary-initial', onProtocolEvent,
+        onModelArtifact: retainArtifact ? artifact => retainArtifact({ ...artifact, snapshotId: input.id, fileId: file.id, path: file.path, phase: request.reviewPhase ?? 'primary' }) : undefined,
         onModelEvent: async info => {
           if (info.action === 'model-end') {
             const phase = request.reviewPhase ?? 'primary';
+            if (info.callPurpose === 'json-correction' && pendingJsonCorrection) {
+              (state.modelCorrections ??= []).push({ action: 'explicit-json-correction', code: 'MODEL_INVALID_JSON', ...(pendingJsonCorrection.jsonIssue ? { jsonIssue: pendingJsonCorrection.jsonIssue } : {}), phase });
+              pendingJsonCorrection = undefined;
+            }
             const metrics = (state.modelMetrics ??= {});
             const item = (metrics[phase] ??= { calls: 0, durationMs: 0, inputBytes: 0, totalOutputBytes: 0 });
             item.calls++; item.durationMs += info.durationMs; item.inputBytes += info.inputBytes; item.totalOutputBytes += info.totalOutputBytes;
@@ -189,43 +268,32 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
           await options.onProgress?.({ stage: info.action, snapshotId: input.id, fileId: file.id, path: file.path, phase: request.reviewPhase ?? 'primary', ...info });
         },
-        onProtocolCorrection: async info => { beforeCall({ reserved: true }); await request.onProtocolCorrection?.(info); await options.onProgress?.({stage:'protocol-correction',fileId:file.id,path:file.path,...info}); },
+        onProtocolCorrection: async info => {
+          beforeCall({ reserved: true });
+          await request.onProtocolCorrection?.(info);
+          pendingJsonCorrection = { jsonIssue: info.jsonIssue };
+          await options.onProgress?.({stage:'protocol-correction',fileId:file.id,path:file.path,...info});
+        },
       });
+      };
       const executor = scope
-        ? (request, onLimited = () => {}) => retrievalLoop(trackedModel, { ...request, onProtocolEvent }, scope, { correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, initialRetrieved: request.initialRetrieved ?? [], allowExhaustedInitial: request.allowExhaustedInitial === true, onBudgetLimited: info => { onBudgetLimited(info); onLimited(info); }, onRetrieved: records => {
+        ? (request, onLimited = () => {}) => retrievalLoop(trackedModel, { ...request, nativeOutputTools: options.nativeOutputTools === true, onProtocolEvent }, scope, { correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, initialRetrieved: request.initialRetrieved ?? [], allowExhaustedInitial: request.allowExhaustedInitial === true, enableSearchSeeds: options.enableSearchSeeds === true && !request.reviewPhase?.includes('verification'), onBudgetLimited: info => { onBudgetLimited(info); onLimited(info); }, onRetrieved: records => {
           (state.retrievalAudit ??= []).push(...records);
         }, onTruncated: () => {
           if (!state.retrievalTruncated) result.limitations.push({ fileId: file.id, text: '检索结果达到数量上限，部分匹配未提供给模型' });
           state.retrievalTruncated = true;
         } })
         : request => { beforeCall(); return trackedModel(request); };
+      const grouped = assignedGroup;
+      const groupedGeneration = grouped ? (await groupResult({ id: grouped[0] })).get(file.id) : null;
+      if (grouped) {
+        state.primaryGroupId = grouped[0]; state.primaryMethod = 'group-primary';
+        if (groupedGeneration.groupLimited) state.retrievalLimited = true;
+        if (groupedGeneration.groupRisk) (state.riskPlans ??= []).push({ ...groupedGeneration.groupRisk, method: 'inline', scope: 'group-all-edits', groupId: grouped[0], decision: { required: true, reason: 'group-inline-primary' } });
+      }
+      const chainTimeout = grouped && timeoutMs > 0 ? Math.max(0, timeoutMs - (performance.now() - groupStarted.get(grouped[0]))) : timeoutMs;
+      if (grouped && timeoutMs > 0 && chainTimeout <= 0) throw Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' });
       await invoke(async enclosingRequest => {
-        if (options.enableBusinessGrouping === true && !report.businessGrouping && prepareBusinessGroups(input.files)) {
-          report.businessGrouping = { status: 'pending' };
-          try {
-            const local = localBusinessGroups(input.files);
-            let grouped = local;
-            if (!local) {
-            const groupInput = prepareBusinessGroups(input.files);
-            if (Buffer.byteLength(groupInput) + Buffer.byteLength(BUSINESS_GROUP_INSTRUCTIONS) > maxInputBytes) throw new Error('Business grouping input budget exceeded');
-            beforeCall();
-            const response = await trackedModel({ ...enclosingRequest, instructions: BUSINESS_GROUP_INSTRUCTIONS, input: groupInput, reviewPhase: 'business-grouping' });
-            enclosingRequest.signal.throwIfAborted();
-            grouped = validateBusinessGroups(response, input.files);
-            }
-            report.businessGrouping = { status: 'completed', ...grouped };
-            for (const group of grouped.groups.filter(g => g.fileIds.length > 1)) {
-              if (interactionPlans.some(p => [...p.group.fileIds].sort().join(',') === [...group.fileIds].sort().join(','))) continue;
-              const prepared = prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes));
-              interactionPlans.push({ group, prepared });
-              if (prepared.status !== 'not-applicable') report.interactions.push({ groupId: group.id, fileIds: prepared.fileIds, status: prepared.status === 'ready' ? 'pending' : 'blocked', reason: prepared.reason, lifecycle: 'shares-last-primary-timeout' });
-            }
-          } catch (error) {
-            report.businessGrouping = { status: 'fallback', reason: error.message };
-            result.limitations.push({ text: '业务分组未完成，保留原分组：' + error.message });
-            enclosingRequest.signal.throwIfAborted();
-          }
-        }
         const batches = [...(prepared.batches ?? [{ payload, windowIds: state.windowIds ?? [] }])];
         if (prepared.synthesis?.status === 'ready') batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
         const matchingInteractionPlans = interactionPlans.filter(p => input.files.filter(f => p.group.fileIds.includes(f.id)).at(-1)?.id === file.id);
@@ -248,14 +316,14 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           continue;
         }
         let batchPayload = batch.payload;
-        const inlineRisk = prepared.inlineRisk === true && batch.round === 1 && !batch.synthesis && !batch.interaction;
+        const inlineRisk = !groupedGeneration && prepared.inlineRisk === true && batch.round === 1 && !batch.synthesis && !batch.interaction;
         const batchInstructions = inlineRisk ? prepared.instructions : instructions;
         let riskEntry, activeRisks = [];
         if (inlineRisk) {
-          riskEntry = { status: 'pending', method: 'inline', windowIds: [], scope: 'full-file', risks: [], decision: { required: true, reason: 'inline-primary' } };
+          riskEntry = { status: 'pending', method: 'inline', windowIds: batch.windowIds, scope: state.sourceMode === 'change-windows' ? 'all-edits' : 'full-file', risks: [], decision: { required: true, reason: 'inline-primary' } };
           (state.riskPlans ??= []).push(riskEntry);
         }
-        if (options.enableRiskPlanning === true && !inlineRisk && !batch.synthesis && batch.round === 1) {
+        if (options.enableRiskPlanning === true && (!groupedGeneration || batch.interaction) && !inlineRisk && !batch.synthesis && batch.round === 1) {
           const reusable = !batch.interaction && riskInput.cacheable;
           riskEntry = reusable ? primaryRiskPlan : undefined;
           if (!riskEntry) {
@@ -296,9 +364,9 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             }
           }
         }
-        if(report.modelCalls>=maxCalls)throw new Error('Model call budget exceeded before next review pass');
+        if(report.modelCalls>=maxCalls && !(groupedGeneration && !batch.synthesis && !batch.interaction))throw new Error('Model call budget exceeded before next review pass');
         if(rounds>1) state.reviewPasses[batchIndex].status='running';
-        const request = { ...enclosingRequest, instructions: batchInstructions, input: batchPayload, reviewPhase: phase, allowExhaustedInitial: options.optimizeReviewCalls === true && !batch.synthesis && !batch.interaction && prepared.metadata.contextMode !== 'approved-retrieval' };
+        const request = { ...enclosingRequest, nativeOutputTools: options.nativeOutputTools === true, instructions: batchInstructions, input: batchPayload, reviewPhase: phase, allowExhaustedInitial: options.optimizeReviewCalls === true && !batch.synthesis && !batch.interaction && prepared.metadata.contextMode !== 'approved-retrieval' };
         let auditStart = state.retrievalAudit?.length ?? 0;
         let finalResponseOnly = false;
         const generate = async attempt => {
@@ -328,13 +396,14 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           if (!batch.interaction && state.sourceMode === 'change-windows') validateWindowFindings(generated.findings, batch.synthesis ? prepared.synthesis.windows : JSON.parse(batch.payload).windows, batch.synthesis === true);
           return generated;
         };
-        const generated = await correctedResponse(generate, validate, request, {
+        const generated = groupedGeneration && !batch.synthesis && !batch.interaction ? structuredClone(groupedGeneration) : await correctedResponse(generate, validate, request, {
           enabled: options.correctProtocol === true,
           canCorrect: () => !finalResponseOnly,
           onCorrection: async info => {
             // A fresh generation must establish its own synthesis/interaction read evidence.
             auditStart = state.retrievalAudit?.length ?? 0;
             (state.responseCorrections ??= []).push({ code: info.code, round: batch.round, phase });
+            pendingStageCorrection = { action: 'review-format-correction', code: info.code, phase };
             result.limitations.push({ fileId: file.id, text: '主审响应校验失败，已请求一次显式纠正；原响应未接受，纠正不证明缺陷成立。' });
             await options.onProgress?.({ stage: 'protocol-correction', fileId: file.id, path: file.path, ...info });
           },
@@ -348,7 +417,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
           delete generated.inlineRisks;
         }
-        if (options.enableRiskPlanning === true && !batch.synthesis && batch.round === 1) {
+        if (options.enableRiskPlanning === true && (!groupedGeneration || batch.interaction) && !batch.synthesis && batch.round === 1) {
           const coverage = riskReadCoverage(activeRisks,(state.retrievalAudit??[]).slice(auditStart),scope?.catalog()??[],input.id);
           (riskEntry.generations ??= []).push({ round: batch.round, windowIds: batch.windowIds, coverage });
           // Preserve the single-generation field without unioning evidence across windows.
@@ -374,6 +443,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             if (verdicts.some(v => v.verdict === 'supported' && v.regression?.classification === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分模型支持候选缺少充分前后对照，不能确认由本次变更引入' });
             if (verdicts.some(v => v.verdict === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分候选复核仍不确定，不能视为已确认或已排除' });
           } catch (error) {
+            if (error?.code === 'MODEL_ARTIFACT_FAILED') throw error;
             for (const finding of generated.findings) finding.verification = { status: 'incomplete', causality: 'unverified' };
             result.limitations.push({ fileId: file.id, text: '候选复核未完成：' + (error?.message ?? String(error)) });
             request.signal.throwIfAborted();
@@ -393,7 +463,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         await options.onProgress?.({stage:'window-complete',snapshotId:input.id,fileId:file.id,path:file.path,windowIds:batch.windowIds,round:batch.round,findings:generated.findings,windowCoverage:state.windowCoverage});
         }catch(error){
           enclosingRequest.signal.throwIfAborted();
-          if(phase==='primary'||/budget exceeded/i.test(error.message))throw error;
+          if(phase==='primary'||error.code==='MODEL_ARTIFACT_FAILED'||(/budget exceeded/i.test(error.message)&&!groupedGeneration))throw error;
           const failure={phase,status:'failed',code:error.code??'REVIEW_EXECUTION_FAILED',reason:error.message,round:batch.round,...(error.attempts?{attempts:error.attempts}:{}),...(error.diagnostic?{diagnostic:error.diagnostic}:{})};
           (state.stageFailures??=[]).push(failure);
           if(batch.synthesis)state.synthesisStatus='failed';
@@ -403,13 +473,20 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           await options.onProgress?.({stage:'synthesis-failed',snapshotId:input.id,fileId:file.id,path:file.path,...failure,windowCoverage:state.windowCoverage});
         }
         }
-      }, { instructions, input: payload }, timeoutMs, signal);
+      }, { instructions, input: payload }, chainTimeout, signal);
       if (signal?.aborted) throw signal.reason;
 
       state.status = state.retrievalLimited ? 'pending' : 'completed';
-      if (state.retrievalLimited) state.reason = '检索预算受限，未完成完整审查；已有发现保留，不表示通过';
+      if (state.retrievalLimited) {
+        const codes = new Set((state.retrievalLimits ?? []).map(limit => limit.code));
+        state.reason = codes.has('RETRIEVAL_ROUND_BUDGET_EXCEEDED')
+          ? '单阶段检索轮数上限达到，未完成完整审查；共享读取额度可能仍有余量，已有发现保留，不表示通过'
+          : '共享读取调用或输出预算受限，未完成完整审查；已有发现保留，不表示通过';
+        if (codes.size === 1) state.failureCode = [...codes][0];
+      }
 
     } catch (error) {
+      if (error?.code === 'MODEL_ARTIFACT_FAILED') { checkpointFailed = true; checkpointFailure = error; controller.abort(error); throw error; }
       state.status = signal?.aborted ? 'cancelled' : error?.code === 'PROJECT_MODEL_CALL_LIMIT' ? 'pending' : 'failed';
       state.reason = error?.message ?? String(error);
       if(error?.attempts)state.protocolAttempts=error.attempts;
@@ -419,13 +496,49 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       state.failureCode = signal?.aborted ? 'CANCELLED' : ['MODEL_INVALID_JSON','MODEL_INCOMPLETE_OUTPUT','MODEL_TIMEOUT','MODEL_INVALID_READ_REQUEST','MODEL_OUTPUT_LIMIT','MODEL_PROTOCOL_ERROR','MODEL_INVALID_REVIEW_RESPONSE','MODEL_INVALID_FINDING_IDENTITY','MODEL_INVALID_FINDING_SEVERITY','MODEL_MISSING_FINDING_FIELD','MODEL_INVALID_ANCHOR','MODEL_ANCHOR_MISMATCH','READER_CALL_BUDGET_EXCEEDED','READER_OUTPUT_BUDGET_EXCEEDED','RETRIEVAL_ROUND_BUDGET_EXCEEDED','RETRIEVAL_FINAL_RESPONSE_REQUIRED','PROJECT_MODEL_CALL_LIMIT'].includes(error?.code) ? error.code : 'REVIEW_EXECUTION_FAILED';
     }
     } finally {
+      state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && result.findings.every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(file.id)).every(item => item.status === 'completed');
       await options.onProgress?.({stage:'file-complete',snapshotId:input.id,file:state,findings:result.findings});
+      await options.onResumeCheckpoint?.({ ...report, files: fileResults.filter(Boolean).map(item => item.state), findings: fileResults.filter(Boolean).flatMap(item => item.findings), limitations: [...report.limitations, ...fileResults.filter(Boolean).flatMap(item => item.limitations)] });
     }
   };
-  // Bootstrap lazy business grouping once before freezing dependency admission.
-  let first = 0;
-  if (options.enableBusinessGrouping === true && prepareBusinessGroups(input.files)) {
-    while (first < input.files.length && !report.businessGrouping && !signal.aborted) await runFile(first++);
+  if (options.resumeState?.businessGrouping) report.businessGrouping = structuredClone(options.resumeState.businessGrouping);
+  for (const interaction of report.interactions) {
+    if (interaction.fileIds.every(id => options.resumeState?.completed?.some(row => row.fileId === id))) Object.assign(interaction, { status: 'completed', reused: true });
+  }
+  // Freeze grouping before admitting file chains, without serializing a whole first file.
+  if (options.enableBusinessGrouping === true && prepareBusinessGroups(input.files) && !signal.aborted) {
+    try {
+      const local = report.businessGrouping?.groups ? report.businessGrouping : localBusinessGroups(input.files);
+      const grouped = local ?? await invoke(async request => {
+        const groupInput = prepareBusinessGroups(input.files);
+        if ((options.nativeOutputTools === true ? !modelWireBudget({ input: groupInput, instructions: BUSINESS_GROUP_INSTRUCTIONS, nativeOutputTools: true }, maxInputBytes).fits : Buffer.byteLength(groupInput) + Buffer.byteLength(BUSINESS_GROUP_INSTRUCTIONS) > maxInputBytes)) throw new Error('Business grouping input budget exceeded');
+        reserveShared();
+        return validateBusinessGroups(await sharedModel({ ...request, reviewPhase: 'business-grouping', callPurpose: 'business-grouping' }), input.files);
+      }, { input: prepareBusinessGroups(input.files), instructions: BUSINESS_GROUP_INSTRUCTIONS }, timeoutMs, signal);
+      report.businessGrouping = { status: 'completed', ...grouped };
+      for (const group of grouped.groups.filter(g => g.fileIds.length > 1)) {
+        if (interactionPlans.some(p => [...p.group.fileIds].sort().join(',') === [...group.fileIds].sort().join(','))) continue;
+        const prepared = prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes));
+        interactionPlans.push({ group, prepared });
+        if (prepared.status !== 'not-applicable') report.interactions.push({ groupId: group.id, fileIds: prepared.fileIds, status: group.fileIds.every(id => options.resumeState?.completed?.some(row => row.fileId === id)) ? 'completed' : prepared.status === 'ready' ? 'pending' : 'blocked', reason: prepared.reason, lifecycle: 'shares-last-primary-timeout' });
+      }
+    } catch (error) {
+      if (signal.aborted || checkpointFailed || error.code === 'MODEL_ARTIFACT_FAILED') throw error;
+      report.businessGrouping = { status: 'fallback', reason: error.message };
+      report.limitations.push({ text: '业务分组未完成，保留原分组：' + error.message });
+    }
+  }
+  if (options.enableGroupPrimary === true && scope && rounds === 1) {
+    const seen = new Set();
+    const groups = report.businessGrouping?.groups ?? report.grouping?.groups ?? [];
+    for (const group of groups) {
+      if (group.fileIds.some(id => seen.has(id) || options.resumeState?.completed?.some(row => row.fileId === id))) continue;
+      const prepared = prepareGroupPrimary(input, group, { instructions, scope, maxInputBytes, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning === true });
+      if (!prepared) continue;
+      groupPrepared.set(group.id, prepared);
+      for (const id of group.fileIds) seen.add(id);
+    }
+    report.primaryGroups = [...groupPrepared].map(([groupId, p]) => ({ groupId, fileIds: p.fileIds, mode: 'group-primary' }));
   }
   const dependencies = new Map();
   for (const plan of interactionPlans.filter(p => p.prepared.status === 'ready')) {
@@ -433,7 +546,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     const owner = members.at(-1);
     if (owner !== undefined) dependencies.set(owner, [...new Set([...(dependencies.get(owner) ?? []), ...members.slice(0, -1)])]);
   }
-  await scheduleFileChains(input.files.map((_, index) => index).slice(first), async index => {
+  await scheduleFileChains(input.files.map((_, index) => index), async index => {
     try { await runFile(index); }
     catch (error) { controller.abort(error); throw error; }
   }, dependencies, fileConcurrency);
@@ -442,6 +555,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   report.findings = fileResults.flatMap(result => result.findings);
   report.limitations.push(...fileResults.flatMap(result => result.limitations));
   report.execution = { fileConcurrency, maxRetrievalRounds };
+  report.readerLimits = { maxRounds: maxRetrievalRounds };
   await options.onProgress?.({stage:'batch-complete',snapshotId:input.id,files:report.files,findings:report.findings,limitations:report.limitations});
   for (const interaction of report.interactions) if (interaction.status !== 'completed') report.limitations.push({ text: '跨文件综合未完成：' + interaction.groupId + ' (' + interaction.status + ')' });
   if (report.grouping?.links.some(l => l.split)) report.limitations.push({ text: '跨组关系未综合覆盖；关联分组不代表全部跨文件交互覆盖' });
@@ -458,6 +572,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   }
   report.regressionCoverage = Object.fromEntries(['introduced', 'preexisting', 'uncertain', 'unassessed'].map(classification => [classification, report.findings.filter(f => (f.verification?.regression?.classification ?? 'unassessed') === classification).length]));
   report.findingGroups = groupDuplicateFindings(report.findings);
+  for (const state of report.files) state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && report.findings.filter(f => f.fileId === state.fileId).every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(state.fileId)).every(item => item.status === 'completed');
+  await options.onResumeCheckpoint?.(report);
   report.followup = coverageFollowup(report);
   if (scope) report.readerBudget = { ...scope.usage(), ...scope.budget(), ...readerLimits };
   report.diagnostics = reviewDiagnostics(report, { reviewWallMs: performance.now() - startedAt });
@@ -491,7 +607,7 @@ function renderFinding(output, finding, index, duplicates) {
     const verification = finding.verification;
     if (verification) {
       const label = verification.status !== 'completed' ? '未完成' : ({ supported: '模型复核支持', refuted: '模型复核反驳（保留候选供追溯）', uncertain: '不确定' }[verification.verdict] ?? '未知');
-      output.push('- 复核状态：' + label + '；不是事实或因果证明');
+      output.push('- 复核状态：' + label + (finding.reused ? '（相同快照的既往轮次结果，本次未重新取证）' : '') + '；不是事实或因果证明');
       if (verification.reason) output.push('- 复核理由：' + safe(verification.reason));
       for (const ref of verification.evidence ?? []) output.push('- 复核证据：' + safe(ref.sourceId) + ':' + ref.start + '（' + ref.count + '行） · SHA256 ' + safe(ref.hash) + ' · ' + safe(ref.text));
     }

package/src/risk-strategy.mjs

@@ -1,12 +1,43 @@
 import { riskPlanningDecision } from './risk-plan.mjs';
 import { INLINE_RISK_INSTRUCTIONS } from './prompts.mjs';
 import { initialInputBudget } from './input-budget.mjs';
+import { changeMap } from './change-map.mjs';
+import { changeWindows } from './change-windows.mjs';
+import { sourceSegments } from './source-segments.mjs';
+import { isDeepStrictEqual } from 'node:util';
 
 export function riskPlanningMode(value = 'separate') {
   if (!['auto', 'separate'].includes(value)) throw new Error('riskPlanningMode must be auto or separate');
   return value;
 }
 
+// Compare the entire host projection, not just edit IDs: a claimed edit can be
+// split across several windows and both sides (including zero counts) must match.
+function completeWindowScope(file, prepared, payload) {
+  if (payload.sourceMode !== 'change-windows' || prepared.metadata?.sourceMode !== 'change-windows' ||
+      prepared.synthesis !== undefined || prepared.metadata?.windowBlocked?.length ||
+      (prepared.metadata?.batchCount !== undefined && prepared.metadata.batchCount !== 1) ||
+      (prepared.batches !== undefined && prepared.batches.length !== 1)) return false;
+  const changes = changeMap(file.left.text, file.right.text);
+  if (changes.status !== 'changed' || changes.precision !== 'exact' || !changes.edits.length ||
+      !isDeepStrictEqual(prepared.changes, changes) || !isDeepStrictEqual(payload.changes, changes)) return false;
+  const projected = changeWindows(file, changes);
+  if (!projected) return false;
+  const windows = sourceSegments(projected), ids = windows.map(w => w.id);
+  if (!isDeepStrictEqual(payload.windows, windows) || !isDeepStrictEqual(prepared.metadata.windowIds, ids)) return false;
+  const referenced = new Set(windows.flatMap(w => w.editIds));
+  if (referenced.size !== changes.edits.length || changes.edits.some(e => !referenced.has(e.id))) return false;
+  const compact = { ...file, left: { ...file.left, text: undefined }, right: { ...file.right, text: undefined } };
+  // JSON transport omits undefined; retained hashes/encoding/existence/identity
+  // must still be identical to the approved file, never another source copy.
+  if (!isDeepStrictEqual(payload.file, JSON.parse(JSON.stringify(compact)))) return false;
+  if (prepared.batches !== undefined) {
+    const batch = prepared.batches[0];
+    if (batch.payload !== prepared.payload || !isDeepStrictEqual(batch.windowIds, ids)) return false;
+  }
+  return true;
+}
+
 // One pure decision over the actual prepared envelope, shared by preview and execution.
 // It never reads sources, changes payloads, expands scope or forces window preparation.
 export function chooseRiskStrategy(input, file, prepared, options) {
@@ -14,14 +45,23 @@ export function chooseRiskStrategy(input, file, prepared, options) {
   const decision = options.enableRiskPlanning === true
     ? options.skipSmallRiskPlans === true ? riskPlanningDecision([file]) : { required: true, reason: 'unconditional' }
     : { required: false, reason: 'disabled' };
-  const fallback = { mode: decision.required ? 'separate' : 'disabled', decision, instructions: options.instructions };
-  if (mode !== 'auto' || !decision.required || input.projectScope || file.reviewMode === 'project' || (options.round ?? 1) !== 1 ||
-      prepared.batches !== undefined || prepared.synthesis !== undefined || prepared.metadata?.sourceMode) return fallback;
-  const payload = JSON.parse(prepared.payload);
-  if (payload.projectScope || payload.sourceMode || payload.windows || payload.file?.id !== file.id ||
-      typeof payload.file?.left?.text !== 'string' || typeof payload.file?.right?.text !== 'string' ||
-      payload.file.left.text !== file.left.text || payload.file.right.text !== file.right.text) return fallback;
+  const fallback = fallbackReason => ({ mode: decision.required ? 'separate' : 'disabled', decision, instructions: options.instructions, fallbackReason });
+  if (mode !== 'auto') return fallback('mode-notauto');
+  if (!decision.required) return fallback(options.enableRiskPlanning === true ? 'smallchange' : 'disabled');
+  if (input.projectScope || file.reviewMode === 'project') return fallback('project');
+  if ((options.round ?? 1) !== 1) return fallback('laterround');
+  if (prepared.batches?.length > 1) return fallback('multi-batch');
+  if (typeof file.left?.text !== 'string' || typeof file.right?.text !== 'string') return fallback('incomplete-edit-scope');
+  let payload;
+  try { payload = JSON.parse(prepared.payload); } catch { return fallback('incomplete-edit-scope'); }
+  if (!payload || payload.projectScope || payload.file?.id !== file.id) return fallback('incomplete-edit-scope');
+  if (payload.sourceMode === 'change-windows') {
+    if (payload.snapshotId !== input.id || !completeWindowScope(file, prepared, payload)) return fallback('incomplete-edit-scope');
+  } else if (payload.sourceMode || payload.windows || prepared.batches !== undefined || prepared.synthesis !== undefined ||
+      prepared.metadata?.sourceMode || payload.file?.left?.text !== file.left.text || payload.file?.right?.text !== file.right.text) {
+    return fallback('incomplete-edit-scope');
+  }
   const instructions = options.instructions + '\n' + INLINE_RISK_INSTRUCTIONS;
   const budget = initialInputBudget({ instructions, input: prepared.payload }, options.scope, options.maxInputBytes);
-  return budget.fits ? { mode: 'inline', decision, instructions, budget } : fallback;
+  return budget.fits ? { mode: 'inline', decision, instructions, budget } : fallback('input-budget');
 }

package/src/search-seeds.mjs

@@ -0,0 +1,75 @@
+import { retrievalRequest } from './retrieval-loop.mjs';
+import { modelWireBudget } from './model-wire-budget.mjs';
+
+const validLine = value => Number.isSafeInteger(value) && value > 0;
+const capacity = () => Object.assign(new Error('Optional search seed unavailable'), { code: 'SEARCH_SEED_CAPACITY' });
+const inside = (range, line) => validLine(range?.start) && Number.isSafeInteger(range.count) && range.count > 0 && typeof range.text === 'string' && range.start <= line && line < range.start + range.count;
+
+function provided(payload, source, coordinate) {
+  if (['old', 'new'].includes(source.side)) {
+    const files = [payload.file, ...(Array.isArray(payload.relatedFiles) ? payload.relatedFiles : [])];
+    if (files.some(file => file?.path === source.path && file.id === source.fileId && typeof (source.side === 'old' ? file.left?.text : file.right?.text) === 'string')) return true;
+    if (payload.file?.path === source.path && payload.file.id === source.fileId && payload.sourceMode === 'change-windows' && Array.isArray(payload.windows)) return payload.windows.some(window => inside(window[source.side], coordinate));
+  }
+  if (['context', 'context-old'].includes(source.side)) return (payload.context ?? []).some(context => context?.path === source.path && typeof context[source.side === 'context-old' ? 'oldText' : 'text'] === 'string');
+  return false;
+}
+
+// Host-only follow-up coalescing. Search fragments are navigation, not evidence;
+// only a fresh approved read can supply the exact original body. No cache/audit
+// or receipts are created here. The caller admits/audits outgoing seeds normally.
+export function searchSeeds(scope, request, records, { existing = [], maxReads = 2, maxInputBytes = 98304, buildRequest = values => retrievalRequest(request, scope, values), signal = request?.signal } = {}) {
+  if (!Number.isSafeInteger(maxReads) || maxReads < 0 || maxReads > 2 || !Number.isSafeInteger(maxInputBytes) || maxInputBytes < 1 || !Array.isArray(records) || !Array.isArray(existing) || typeof buildRequest !== 'function' || signal !== undefined && !(signal instanceof AbortSignal) || request?.signal !== undefined && !(request.signal instanceof AbortSignal)) throw new Error('Invalid search seed options');
+  const check = () => { request?.signal?.throwIfAborted(); signal?.throwIfAborted(); };
+  check();
+  const seeds = []; let attempts = 0;
+  if (!maxReads) return { seeds, attempts };
+  if (typeof request?.input !== 'string' || typeof request.instructions !== 'string') throw new Error('Invalid search seed request');
+  const payload = JSON.parse(request.input);
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || typeof payload.snapshotId !== 'string' || !payload.snapshotId || typeof scope?.transaction !== 'function' || typeof scope.preflight !== 'function' || typeof scope.budget !== 'function') return { seeds, attempts };
+  const catalog = scope.catalog(), seen = new Set();
+  for (const record of records) {
+    check();
+    if (record?.request?.kind !== 'search' || record.result?.snapshotId !== payload.snapshotId || !Array.isArray(record.result.matches) || record.result.matches.length > 100) continue;
+    for (const match of record.result.matches) {
+      check();
+      if (attempts >= maxReads) return { seeds, attempts };
+      const sources = catalog.filter(source => source.id === match?.sourceId);
+      if (sources.length !== 1 || typeof match.hash !== 'string' || !/^[a-f0-9]{64}$/.test(match.hash) || !validLine(match.line)) continue;
+      const source = sources[0];
+      if (!validLine(source.lineCount) || match.line > source.lineCount || source.hash !== undefined && source.hash !== match.hash || record.request.sourceIds !== undefined && (!Array.isArray(record.request.sourceIds) || !record.request.sourceIds.includes(source.id))) continue;
+      const key = JSON.stringify([source.id, match.line]);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      if (provided(payload, source, match.line)) continue;
+      if ([...existing, ...seeds].some(item => item?.request?.kind === 'read' && item.result?.snapshotId === payload.snapshotId && item.result.sourceId === source.id && item.result.hash === match.hash && inside(item.result, match.line))) continue;
+      const budget = scope.budget();
+      // Keep four normal reader calls and 16KiB output headroom; this is not
+      // authority expansion or a guarantee that arbitrary final evidence fits.
+      if (budget.remainingCalls <= 4 || budget.remainingOutputBytes <= 16 * 1024) return { seeds, attempts };
+      const start = Math.max(1, match.line - 3);
+      const operation = { kind: 'read', id: source.id, start, count: Math.min(24, source.lineCount - start + 1) };
+      attempts++;
+      try {
+        const item = scope.transaction(() => {
+          check(); scope.preflight([operation]);
+          const result = scope.read(operation);
+          check();
+          if (result.snapshotId !== record.result.snapshotId || result.sourceId !== source.id || result.hash !== match.hash || !inside(result, match.line) || result.receiptId !== undefined) throw capacity();
+          const next = buildRequest([...existing, ...seeds, { request: operation, result }]);
+          check();
+          const remaining = scope.budget();
+          if (typeof next?.input !== 'string' || typeof next.instructions !== 'string') throw new Error('Invalid search seed request builder');
+          if ((request.nativeOutputTools === true ? !modelWireBudget(next, maxInputBytes).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) > maxInputBytes) || remaining.remainingCalls < 4 || remaining.remainingOutputBytes < 16 * 1024) throw capacity();
+          return { request: operation, result };
+        });
+        seeds.push(item);
+      } catch (error) {
+        check();
+        if (!['SEARCH_SEED_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code)) throw error;
+      }
+    }
+  }
+  check();
+  return { seeds, attempts };
+}