@feng0531/dsh-code-review 0.85.13 → 0.86.1

package/src/review.mjs

@@ -29,6 +29,9 @@ import { changesConcurrency, retrievalRounds } from './review-execution-policy.m
 import { scheduleFileChains } from './file-chain-scheduler.mjs';
 import { reviewReaderBudget, readerAdmission } from './review-reader-policy.mjs';
 import { primarySeeds } from './primary-seeds.mjs';
+import { createReviewReaderAllocation } from './review-reader-allocation.mjs';
+import { prepareGroupPrimary, validateGroupPrimary } from './group-primary.mjs';
+import { configureWireBudget, modelWireBudget } from './model-wire-budget.mjs';
 
 export { REVIEW_INSTRUCTIONS };
 export { PROJECT_REVIEW_INSTRUCTIONS };
@@ -99,6 +102,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   const maxRetrievalRounds = retrievalRounds(options.maxRetrievalRounds);
   let checkpointFailed = false, checkpointFailure;
   const progress = options.onProgress;
+  const resumeCheckpoint = options.onResumeCheckpoint;
+  if (resumeCheckpoint) options = { ...options, onResumeCheckpoint: async report => { try { await resumeCheckpoint(report); } catch (error) { checkpointFailed = true; checkpointFailure = error; controller.abort(error); throw error; } } };
   options = { ...options, onProgress: progress ? async event => {
     if (checkpointFailed) throw checkpointFailure;
     try { await progress(structuredClone(event)); }
@@ -120,7 +125,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   if (options.enableBusinessGrouping === true && options.enableRetrieval !== true) throw new Error('Business grouping requires approved retrieval scope');
   if (options.enableVerification === true && options.enableRetrieval !== true) throw new Error('Verification requires approved retrieval scope');
   const readerLimits = reviewReaderBudget(input, options.readerBudgetPolicy ?? 'fixed');
-  const scope = options.enableRetrieval === true ? createRetrievalScope({ ...input, context: input.context ?? [] }, { ...readerLimits, signal }) : null;
+  const scope = options.enableRetrieval === true ? createRetrievalScope({ ...input, context: input.context ?? [] }, { ...readerLimits, signal, ...(options.optimizeReviewCalls === true ? { reuseResults: true } : {}) }) : null;
   const report = { schemaVersion: 1, snapshotId: input.id, vcs: input.vcs, status: 'completed', files: [], findings: [], limitations: [], modelCalls: 0 };
   validateBusinessRequirement(input.businessRequirement);
   if(input.businessRequirement!==undefined)report.businessRequirement={hash:hash(input.businessRequirement),bytes:Buffer.byteLength(input.businessRequirement),status:'untrusted-constraint'};
@@ -140,21 +145,85 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   if(input.workingScope)report.workingScope=structuredClone(input.workingScope);
   if(input.effectiveMergeSources)report.effectiveMergeSources=structuredClone(input.effectiveMergeSources);
   report.rules = (input.rules ?? []).map(({ path, hash }) => ({ path, hash }));
+  if (scope) configureWireBudget(scope, { nativeOutputTools: options.nativeOutputTools === true });
   if (options.enableGrouping === true) report.grouping = buildReviewGroups(input.files, inferFileRelations(input.files));
   report.interactions = [];
   const interactionPlans = scope && report.grouping ? report.grouping.groups.filter(g => g.fileIds.length > 1).map(group => ({ group, prepared: prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes)) })) : [];
   for (const plan of interactionPlans.filter(p => p.prepared.status !== 'not-applicable')) report.interactions.push({ groupId: plan.group.id, fileIds: plan.prepared.fileIds, status: plan.prepared.status === 'ready' ? 'pending' : 'blocked', reason: plan.prepared.reason, lifecycle: 'shares-last-primary-timeout' });
   const fileResults = new Array(input.files.length);
+  const sharedState = report.orchestration = { modelMetrics: {}, modelCallPurposes: {} };
+  const retainArtifact = options.onModelArtifact ? async artifact => { const reference = await options.onModelArtifact(artifact); if (reference) (report.artifacts ??= []).push(reference); } : undefined;
+  report.resume = { reusedFiles: options.resumeState?.completed?.length ?? 0 };
+  const reserveShared = ({ correction = false } = {}) => {
+    if (!correction && options.remainingCalls?.() <= 0) throw Object.assign(new Error('Shared project model call limit exceeded'), { code: 'PROJECT_MODEL_CALL_LIMIT' });
+    if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
+    report.modelCalls++;
+  };
+  const sharedModel = async request => {
+    let correction;
+    return model({ ...request, nativeOutputTools: options.nativeOutputTools === true, maxInputBytes: options.nativeOutputTools === true ? maxInputBytes : request.maxInputBytes, onModelArtifact: retainArtifact ? artifact => retainArtifact({ ...artifact, snapshotId: input.id, phase: request.reviewPhase }) : undefined,
+      onProtocolEvent: async info => { if (info.action === 'json-transport-recovery') (sharedState.modelRecoveries ??= []).push(info); await request.onProtocolEvent?.(info); },
+      onProtocolCorrection: async info => { reserveShared({ correction: true }); correction = info; await request.onProtocolCorrection?.(info); },
+      onModelEvent: async info => {
+        if (info.action === 'model-end') {
+          const phase = request.reviewPhase, metrics = sharedState.modelMetrics[phase] ??= { calls: 0, durationMs: 0, inputBytes: 0, totalOutputBytes: 0 };
+          metrics.calls++; metrics.durationMs += info.durationMs; metrics.inputBytes += info.inputBytes; metrics.totalOutputBytes += info.totalOutputBytes;
+          if (info.callPurpose) sharedState.modelCallPurposes[info.callPurpose] = (sharedState.modelCallPurposes[info.callPurpose] ?? 0) + 1;
+          if (info.callPurpose === 'json-correction' && correction) { (sharedState.modelCorrections ??= []).push({ action: 'explicit-json-correction', code: 'MODEL_INVALID_JSON', jsonIssue: correction.jsonIssue }); correction = undefined; }
+        }
+        await options.onProgress?.({ stage: info.action, snapshotId: input.id, phase: request.reviewPhase, ...info });
+      } });
+  };
+  const groupPrepared = new Map(), groupResults = new Map(), groupStarted = new Map();
+  let readerAllocation;
+  const stageScope = id => readerAllocation
+    ? configureWireBudget(readerAllocation.scope(id), { nativeOutputTools: options.nativeOutputTools === true }) : scope;
+  const releaseStage = id => readerAllocation?.release(id);
+  const groupResult = async group => {
+    if (!groupResults.has(group.id)) {
+      groupStarted.set(group.id, performance.now());
+      groupResults.set(group.id, invoke(async request => {
+      const prepared = groupPrepared.get(group.id), groupScope = stageScope('group:' + group.id); const limits = [], reads = [];
+      const response = await retrievalLoop(sharedModel, { ...request, nativeOutputTools: options.nativeOutputTools === true, input: prepared.payload, instructions: prepared.instructions, reviewPhase: 'group-primary' }, groupScope, {
+        maxRounds: maxRetrievalRounds, maxInputBytes, beforeCall: reserveShared, correctProtocol: options.correctProtocol === true,
+        enableSearchSeeds: options.enableSearchSeeds === true,
+        onRetrieved: records => { reads.push(...records); (sharedState.retrievalAudit ??= []).push(...records); },
+        onBudgetLimited: info => { limits.push(info); (sharedState.retrievalLimits ??= []).push(info); },
+      });
+      const results = validateGroupPrimary(response, prepared, input, validateResponse, scope.catalog());
+      for (const generated of results.values()) {
+        generated.groupLimits = structuredClone(limits);
+        if (generated.groupRisk) {
+          generated.groupRisk.sourceReadCoverage = riskReadCoverage(generated.groupRisk.risks, reads, scope.catalog(), input.id);
+          if (generated.groupRisk.status !== 'completed') generated.limitations.push('组主审的合并风险计划缺失或无效，未补发规划调用；不表示已完成风险条件核查');
+          if (generated.groupRisk.sourceReadCoverage.some(item => item.unreadSourceIds.length)) generated.limitations.push('组风险计划请求的部分来源未在本次组生成读取；不表示已核查或排除风险条件');
+        }
+      }
+      return results;
+    }, { input: groupPrepared.get(group.id).payload, instructions: groupPrepared.get(group.id).instructions }, timeoutMs, signal));
+    }
+    try { return await groupResults.get(group.id); } finally { releaseStage('group:' + group.id); }
+  };
   const runFile = async index => {
     const file = input.files[index];
     const state = { fileId: file.id, path: file.path, status: file.eligibility === 'reviewable' ? 'pending' : file.eligibility, reason: file.reason, ...(file.blockCode ? {blockCode:file.blockCode} : {}) };
-    const result = { state, findings: [], limitations: [] };
+    let result = { state, findings: [], limitations: [] };
     fileResults[index] = result;
     try {
     await options.onProgress?.({stage:'file-started',snapshotId:input.id,fileId:file.id,path:file.path,status:state.status});
     if (state.status !== 'pending') return;
+    const reusable = options.resumeState?.completed?.find(row => row.fileId === file.id && row.path === file.path);
+    if (reusable) {
+      const prior = structuredClone(reusable.state);
+      for (const key of ['modelMetrics', 'modelCallPurposes', 'modelCorrections', 'modelRecoveries', 'retrievalAudit', 'protocolAttempts', 'protocolDiagnostic', 'responseAttempts', 'responseCorrections', 'anchorCorrections', 'retrievalLimits']) delete prior[key];
+      Object.assign(state, prior, { reused: true, reuseNotice: 'Prior completed evidence retained for an identical approved snapshot/configuration; no new model or evidence receipt claimed.' });
+      result.findings = structuredClone(reusable.findings).map(finding => ({ ...finding, reused: true, priorRun: { snapshotId: options.resumeState.snapshotId, evidenceStatus: 'historical-verified-evidence-not-current-run-receipts' } }));
+      result.limitations = structuredClone(reusable.limitations ?? []);
+      return;
+    }
     if (signal?.aborted) { state.status = 'cancelled'; state.reason = '用户取消'; return; }
-    if (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0) { state.reason = '模型调用预算耗尽'; return; }
+    const assignedGroup = [...groupPrepared].find(([, value]) => value.fileIds.includes(file.id));
+    if (!assignedGroup && (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0)) { state.reason = '模型调用预算耗尽'; return; }
     const prepared = preparePrimaryInput(input, file, { instructions, scope, grouping: report.grouping, maxInputBytes, riskPlanningMode: options.riskPlanningMode, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning, skipSmallRiskPlans: options.skipSmallRiskPlans });
     const { changes, payload } = prepared;
     Object.assign(state, prepared.metadata);
@@ -165,20 +234,23 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     if(changes.precision==='envelope')result.limitations.push({fileId:file.id,text:'精确差异不可得，按保守包络分段检查；包络包含可能未变的行，不证明精确编辑或回归因果。'});
     if (changes.status === 'limited') result.limitations.push({ fileId: file.id, text: '精确变更分析受限：' + changes.reason + '；仍按完整两侧内容审查' });
     if (state.groupFallback) result.limitations.push({ fileId: file.id, text: '关联组上下文超过输入预算，回退单文件审查' });
-    if (state.initialInputBytes > maxInputBytes) { state.status = 'blocked'; state.reason = '输入超过预算，未截断或提交模型'; return; }
+    if (state.initialInputBytes > maxInputBytes) { state.status = 'blocked'; state.reason = '输入超过预算，未截断或提交模型'; releaseStage('primary:' + file.id); releaseStage('synthesis:' + file.id); releaseStage('verification:' + file.id); return; }
     try {
       const beforeCall = ({ reserved = false } = {}) => {
         if (!reserved && options.remainingCalls?.() <= 0) throw Object.assign(new Error('Shared project model call limit exceeded'), { code: 'PROJECT_MODEL_CALL_LIMIT' });
         if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
         report.modelCalls++;
       };
+      let activeReader = scope, activeStage = 'primary';
       const onBudgetLimited = info => {
+        if (activeStage !== 'primary') (state.secondaryRetrievalLimits ??= []).push({ phase: activeStage, ...info });
         state.retrievalLimited = true;
         (state.retrievalLimits ??= []).push(info);
         result.limitations.push({ fileId: file.id, text: '检索预算受限，已保留现有结果但不能视为完整审查：' + info.reason });
       };
       let pendingStageCorrection;
       const onProtocolEvent = async info => {
+        if (info.action === 'json-transport-recovery') (state.modelRecoveries ??= []).push(info);
         if (info.action === 'retrieval-protocol-correction') pendingStageCorrection = { action: info.action, code: 'RETRIEVAL_PROTOCOL_ERROR' };
         await options.onProgress?.({ stage: 'protocol-correction', fileId: file.id, path: file.path, ...info });
       };
@@ -187,7 +259,8 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         // The executor has admitted this call; budget-vetoed retries never reach here.
         if (pendingStageCorrection) { (state.modelCorrections ??= []).push(pendingStageCorrection); pendingStageCorrection = undefined; }
         let pendingJsonCorrection;
-        return model({ ...request, callPurpose: request.callPurpose ?? request.reviewPhase ?? 'primary-initial', onProtocolEvent,
+        return model({ ...request, nativeOutputTools: options.nativeOutputTools === true, maxInputBytes: options.nativeOutputTools === true ? maxInputBytes : request.maxInputBytes, callPurpose: request.callPurpose ?? request.reviewPhase ?? 'primary-initial', onProtocolEvent,
+        onModelArtifact: retainArtifact ? artifact => retainArtifact({ ...artifact, snapshotId: input.id, fileId: file.id, path: file.path, phase: request.reviewPhase ?? 'primary' }) : undefined,
         onModelEvent: async info => {
           if (info.action === 'model-end') {
             const phase = request.reviewPhase ?? 'primary';
@@ -211,40 +284,27 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       });
       };
       const executor = scope
-        ? (request, onLimited = () => {}) => retrievalLoop(trackedModel, { ...request, onProtocolEvent }, scope, { correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, initialRetrieved: request.initialRetrieved ?? [], allowExhaustedInitial: request.allowExhaustedInitial === true, enableSearchSeeds: options.enableSearchSeeds === true && !request.reviewPhase?.includes('verification'), onBudgetLimited: info => { onBudgetLimited(info); onLimited(info); }, onRetrieved: records => {
+        ? (request, onLimited = () => {}) => retrievalLoop(trackedModel, { ...request, nativeOutputTools: options.nativeOutputTools === true, onProtocolEvent }, activeReader, { correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, initialRetrieved: request.initialRetrieved ?? [], allowExhaustedInitial: request.allowExhaustedInitial === true, enableSearchSeeds: options.enableSearchSeeds === true && !request.reviewPhase?.includes('verification'), onBudgetLimited: info => { onBudgetLimited(info); onLimited(info); }, onRetrieved: records => {
           (state.retrievalAudit ??= []).push(...records);
         }, onTruncated: () => {
           if (!state.retrievalTruncated) result.limitations.push({ fileId: file.id, text: '检索结果达到数量上限，部分匹配未提供给模型' });
           state.retrievalTruncated = true;
         } })
         : request => { beforeCall(); return trackedModel(request); };
-      await invoke(async enclosingRequest => {
-        if (options.enableBusinessGrouping === true && !report.businessGrouping && prepareBusinessGroups(input.files)) {
-          report.businessGrouping = { status: 'pending' };
-          try {
-            const local = localBusinessGroups(input.files);
-            let grouped = local;
-            if (!local) {
-            const groupInput = prepareBusinessGroups(input.files);
-            if (Buffer.byteLength(groupInput) + Buffer.byteLength(BUSINESS_GROUP_INSTRUCTIONS) > maxInputBytes) throw new Error('Business grouping input budget exceeded');
-            beforeCall();
-            const response = await trackedModel({ ...enclosingRequest, instructions: BUSINESS_GROUP_INSTRUCTIONS, input: groupInput, reviewPhase: 'business-grouping' });
-            enclosingRequest.signal.throwIfAborted();
-            grouped = validateBusinessGroups(response, input.files);
-            }
-            report.businessGrouping = { status: 'completed', ...grouped };
-            for (const group of grouped.groups.filter(g => g.fileIds.length > 1)) {
-              if (interactionPlans.some(p => [...p.group.fileIds].sort().join(',') === [...group.fileIds].sort().join(','))) continue;
-              const prepared = prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes));
-              interactionPlans.push({ group, prepared });
-              if (prepared.status !== 'not-applicable') report.interactions.push({ groupId: group.id, fileIds: prepared.fileIds, status: prepared.status === 'ready' ? 'pending' : 'blocked', reason: prepared.reason, lifecycle: 'shares-last-primary-timeout' });
-            }
-          } catch (error) {
-            report.businessGrouping = { status: 'fallback', reason: error.message };
-            result.limitations.push({ text: '业务分组未完成，保留原分组：' + error.message });
-            enclosingRequest.signal.throwIfAborted();
-          }
+      const grouped = assignedGroup;
+      const groupedGeneration = grouped ? (await groupResult({ id: grouped[0] })).get(file.id) : null;
+      if (grouped) {
+        state.primaryGroupId = grouped[0]; state.primaryMethod = 'group-primary';
+        if (groupedGeneration.groupLimits?.length) {
+          state.retrievalLimited = true;
+          state.groupRetrievalLimits = structuredClone(groupedGeneration.groupLimits);
+          result.limitations.push(...state.groupRetrievalLimits.map(limit => ({ fileId: file.id, text: '组主审检索受限：' + limit.code + '；已接受的本成员成果保留，不表示完整审查' })));
         }
+        if (groupedGeneration.groupRisk) (state.riskPlans ??= []).push({ ...groupedGeneration.groupRisk, method: 'inline', scope: 'group-all-edits', groupId: grouped[0], decision: { required: true, reason: 'group-inline-primary' } });
+      }
+      const chainTimeout = grouped && timeoutMs > 0 ? Math.max(0, timeoutMs - (performance.now() - groupStarted.get(grouped[0]))) : timeoutMs;
+      if (grouped && timeoutMs > 0 && chainTimeout <= 0) throw Object.assign(new Error('Model timeout'), { code: 'MODEL_TIMEOUT' });
+      await invoke(async enclosingRequest => {
         const batches = [...(prepared.batches ?? [{ payload, windowIds: state.windowIds ?? [] }])];
         if (prepared.synthesis?.status === 'ready') batches.push({ payload: prepared.synthesis.payload, windowIds: [], synthesis: true });
         const matchingInteractionPlans = interactionPlans.filter(p => input.files.filter(f => p.group.fileIds.includes(f.id)).at(-1)?.id === file.id);
@@ -257,9 +317,14 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         enclosingRequest.signal.throwIfAborted();
         const phase=batch.interaction?'file-interaction':batch.synthesis?'window-synthesis':'primary';
         try{
-        const admission = scope && options.optimizeReviewCalls === true ? readerAdmission({ synthesis: batch.synthesis === true, interaction: !!batch.interaction, metadata: prepared.metadata }, scope.budget()) : { permitted: true };
+        activeStage = phase;
+        activeReader = groupedGeneration && !batch.synthesis && !batch.interaction ? scope : stageScope(batch.interaction ? 'interaction:' + batch.interaction.id : batch.synthesis ? 'synthesis:' + file.id : 'primary:' + file.id);
+        // Consuming an already validated group member performs no new source/model work.
+        const cachedPrimary = groupedGeneration && !batch.synthesis && !batch.interaction;
+        const admission = !cachedPrimary && activeReader && options.optimizeReviewCalls === true
+          ? readerAdmission({ synthesis: batch.synthesis === true, interaction: !!batch.interaction, metadata: prepared.metadata }, activeReader.budget()) : { permitted: true };
         if (!admission.permitted) {
-          state.readerAdmission = { code: admission.code, remaining: scope.budget() };
+          state.readerAdmission = { code: admission.code, remaining: activeReader.budget() };
           if (batch.synthesis || batch.interaction) throw Object.assign(new Error('Required evidence budget unavailable before stage admission'), { code: admission.code });
           state.reason = '检索预算不足以取得本阶段所需证据，未启动模型；需重新预览补审';
           state.failureCode = admission.code;
@@ -267,14 +332,14 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           continue;
         }
         let batchPayload = batch.payload;
-        const inlineRisk = prepared.inlineRisk === true && batch.round === 1 && !batch.synthesis && !batch.interaction;
+        const inlineRisk = !groupedGeneration && prepared.inlineRisk === true && batch.round === 1 && !batch.synthesis && !batch.interaction;
         const batchInstructions = inlineRisk ? prepared.instructions : instructions;
         let riskEntry, activeRisks = [];
         if (inlineRisk) {
           riskEntry = { status: 'pending', method: 'inline', windowIds: batch.windowIds, scope: state.sourceMode === 'change-windows' ? 'all-edits' : 'full-file', risks: [], decision: { required: true, reason: 'inline-primary' } };
           (state.riskPlans ??= []).push(riskEntry);
         }
-        if (options.enableRiskPlanning === true && !inlineRisk && !batch.synthesis && batch.round === 1) {
+        if (options.enableRiskPlanning === true && (!groupedGeneration || batch.interaction) && !inlineRisk && !batch.synthesis && batch.round === 1) {
           const reusable = !batch.interaction && riskInput.cacheable;
           riskEntry = reusable ? primaryRiskPlan : undefined;
           if (!riskEntry) {
@@ -315,15 +380,15 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             }
           }
         }
-        if(report.modelCalls>=maxCalls)throw new Error('Model call budget exceeded before next review pass');
+        if(report.modelCalls>=maxCalls && !(groupedGeneration && !batch.synthesis && !batch.interaction))throw new Error('Model call budget exceeded before next review pass');
         if(rounds>1) state.reviewPasses[batchIndex].status='running';
-        const request = { ...enclosingRequest, instructions: batchInstructions, input: batchPayload, reviewPhase: phase, allowExhaustedInitial: options.optimizeReviewCalls === true && !batch.synthesis && !batch.interaction && prepared.metadata.contextMode !== 'approved-retrieval' };
+        const request = { ...enclosingRequest, nativeOutputTools: options.nativeOutputTools === true, instructions: batchInstructions, input: batchPayload, reviewPhase: phase, allowExhaustedInitial: options.optimizeReviewCalls === true && !batch.synthesis && !batch.interaction && prepared.metadata.contextMode !== 'approved-retrieval' };
         let auditStart = state.retrievalAudit?.length ?? 0;
         let finalResponseOnly = false;
         const generate = async attempt => {
           if (!initialInputBudget(attempt, scope, maxInputBytes).fits) throw new Error('Review correction input budget exceeded');
           const initialRetrieved = scope && options.enablePrimarySeeds === true && maxRetrievalRounds > 0 && !batch.synthesis && !batch.interaction
-            ? primarySeeds(scope, attempt, { maxInputBytes, signal: attempt.signal }) : [];
+            ? primarySeeds(activeReader, attempt, { maxInputBytes, signal: attempt.signal }) : [];
           return executor({ ...attempt, initialRetrieved }, () => { finalResponseOnly = true; });
         };
         const validate = response => {
@@ -347,7 +412,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           if (!batch.interaction && state.sourceMode === 'change-windows') validateWindowFindings(generated.findings, batch.synthesis ? prepared.synthesis.windows : JSON.parse(batch.payload).windows, batch.synthesis === true);
           return generated;
         };
-        const generated = await correctedResponse(generate, validate, request, {
+        const generated = groupedGeneration && !batch.synthesis && !batch.interaction ? structuredClone(groupedGeneration) : await correctedResponse(generate, validate, request, {
           enabled: options.correctProtocol === true,
           canCorrect: () => !finalResponseOnly,
           onCorrection: async info => {
@@ -368,7 +433,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
           delete generated.inlineRisks;
         }
-        if (options.enableRiskPlanning === true && !batch.synthesis && batch.round === 1) {
+        if (options.enableRiskPlanning === true && (!groupedGeneration || batch.interaction) && !batch.synthesis && batch.round === 1) {
           const coverage = riskReadCoverage(activeRisks,(state.retrievalAudit??[]).slice(auditStart),scope?.catalog()??[],input.id);
           (riskEntry.generations ??= []).push({ round: batch.round, windowIds: batch.windowIds, coverage });
           // Preserve the single-generation field without unioning evidence across windows.
@@ -381,10 +446,12 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         result.findings.push(...generated.findings);
         if (generated.findings.some(f => f.attribution.status === 'missing')) result.limitations.push({ fileId: file.id, text: '部分发现缺少变更归因，仅校验了定位，尚不能确认属于本次回归' });
         result.limitations.push(...generated.limitations.map(text => ({ fileId: file.id, text })));
+        if (!groupedGeneration && !scheduled.slice(batchIndex + 1).some(next => !next.synthesis && !next.interaction)) releaseStage('primary:' + file.id);
         if (options.enableVerification === true && generated.findings.length) {
           for (const finding of generated.findings) finding.verification = { status: 'pending', causality: 'unverified' };
           try {
-            const verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, scope, {
+            activeStage = 'verification';
+            const verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, stageScope('verification:' + file.id), {
               correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, onBudgetLimited,
               onRetrieved: records => { (state.retrievalAudit ??= []).push(...records); },
               onTruncated: () => { result.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
@@ -394,6 +461,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             if (verdicts.some(v => v.verdict === 'supported' && v.regression?.classification === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分模型支持候选缺少充分前后对照，不能确认由本次变更引入' });
             if (verdicts.some(v => v.verdict === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分候选复核仍不确定，不能视为已确认或已排除' });
           } catch (error) {
+            if (error?.code === 'MODEL_ARTIFACT_FAILED') throw error;
             for (const finding of generated.findings) finding.verification = { status: 'incomplete', causality: 'unverified' };
             result.limitations.push({ fileId: file.id, text: '候选复核未完成：' + (error?.message ?? String(error)) });
             request.signal.throwIfAborted();
@@ -413,7 +481,11 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         await options.onProgress?.({stage:'window-complete',snapshotId:input.id,fileId:file.id,path:file.path,windowIds:batch.windowIds,round:batch.round,findings:generated.findings,windowCoverage:state.windowCoverage});
         }catch(error){
           enclosingRequest.signal.throwIfAborted();
-          if(phase==='primary'||/budget exceeded/i.test(error.message))throw error;
+          if(phase==='primary'||error.code==='MODEL_ARTIFACT_FAILED')throw error;
+          if (['Model call budget exceeded', 'Model call budget exceeded before next review pass'].includes(error.message) || error.code === 'PROJECT_MODEL_CALL_LIMIT') {
+            result.limitations.push({ fileId: file.id, text: phase + '模型调用额度不足，尚未启动的阶段保留 pending；已完成主审成果保留' });
+            break;
+          }
           const failure={phase,status:'failed',code:error.code??'REVIEW_EXECUTION_FAILED',reason:error.message,round:batch.round,...(error.attempts?{attempts:error.attempts}:{}),...(error.diagnostic?{diagnostic:error.diagnostic}:{})};
           (state.stageFailures??=[]).push(failure);
           if(batch.synthesis)state.synthesisStatus='failed';
@@ -423,19 +495,20 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           await options.onProgress?.({stage:'synthesis-failed',snapshotId:input.id,fileId:file.id,path:file.path,...failure,windowCoverage:state.windowCoverage});
         }
         }
-      }, { instructions, input: payload }, timeoutMs, signal);
+      }, { instructions, input: payload }, chainTimeout, signal);
       if (signal?.aborted) throw signal.reason;
 
       state.status = state.retrievalLimited ? 'pending' : 'completed';
       if (state.retrievalLimited) {
-        const codes = new Set((state.retrievalLimits ?? []).map(limit => limit.code));
+        const codes = new Set([...(state.retrievalLimits ?? []), ...(state.groupRetrievalLimits ?? [])].map(limit => limit.code));
         state.reason = codes.has('RETRIEVAL_ROUND_BUDGET_EXCEEDED')
-          ? '单阶段检索轮数上限达到，未完成完整审查；共享读取额度可能仍有余量，已有发现保留，不表示通过'
-          : '共享读取调用或输出预算受限，未完成完整审查；已有发现保留，不表示通过';
+          ? '单阶段检索轮数上限达到，未完成完整审查；读取额度可能仍有余量，已有发现保留，不表示通过'
+          : (readerAllocation ? '阶段取证分配或共享读取预算受限，未完成完整审查；其他阶段保留额度不表示本阶段已完成，已有发现保留' : '共享读取调用或输出预算受限，未完成完整审查；已有发现保留，不表示通过');
         if (codes.size === 1) state.failureCode = [...codes][0];
       }
 
     } catch (error) {
+      if (error?.code === 'MODEL_ARTIFACT_FAILED') { checkpointFailed = true; checkpointFailure = error; controller.abort(error); throw error; }
       state.status = signal?.aborted ? 'cancelled' : error?.code === 'PROJECT_MODEL_CALL_LIMIT' ? 'pending' : 'failed';
       state.reason = error?.message ?? String(error);
       if(error?.attempts)state.protocolAttempts=error.attempts;
@@ -445,13 +518,68 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       state.failureCode = signal?.aborted ? 'CANCELLED' : ['MODEL_INVALID_JSON','MODEL_INCOMPLETE_OUTPUT','MODEL_TIMEOUT','MODEL_INVALID_READ_REQUEST','MODEL_OUTPUT_LIMIT','MODEL_PROTOCOL_ERROR','MODEL_INVALID_REVIEW_RESPONSE','MODEL_INVALID_FINDING_IDENTITY','MODEL_INVALID_FINDING_SEVERITY','MODEL_MISSING_FINDING_FIELD','MODEL_INVALID_ANCHOR','MODEL_ANCHOR_MISMATCH','READER_CALL_BUDGET_EXCEEDED','READER_OUTPUT_BUDGET_EXCEEDED','RETRIEVAL_ROUND_BUDGET_EXCEEDED','RETRIEVAL_FINAL_RESPONSE_REQUIRED','PROJECT_MODEL_CALL_LIMIT'].includes(error?.code) ? error.code : 'REVIEW_EXECUTION_FAILED';
     }
     } finally {
+      if (readerAllocation && file.eligibility === 'reviewable' && !options.resumeState?.completed?.some(row => row.fileId === file.id)) {
+        if (![...groupPrepared.values()].some(group => group.fileIds.includes(file.id))) releaseStage('primary:' + file.id);
+        releaseStage('verification:' + file.id);
+        releaseStage('synthesis:' + file.id);
+        for (const plan of interactionPlans.filter(plan => input.files.filter(member => plan.group.fileIds.includes(member.id)).at(-1)?.id === file.id)) releaseStage('interaction:' + plan.group.id);
+      }
+      state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && result.findings.every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(file.id)).every(item => item.status === 'completed');
       await options.onProgress?.({stage:'file-complete',snapshotId:input.id,file:state,findings:result.findings});
+      await options.onResumeCheckpoint?.({ ...report, files: fileResults.filter(Boolean).map(item => item.state), findings: fileResults.filter(Boolean).flatMap(item => item.findings), limitations: [...report.limitations, ...fileResults.filter(Boolean).flatMap(item => item.limitations)] });
     }
   };
-  // Bootstrap lazy business grouping once before freezing dependency admission.
-  let first = 0;
-  if (options.enableBusinessGrouping === true && prepareBusinessGroups(input.files)) {
-    while (first < input.files.length && !report.businessGrouping && !signal.aborted) await runFile(first++);
+  if (options.resumeState?.businessGrouping) report.businessGrouping = structuredClone(options.resumeState.businessGrouping);
+  for (const interaction of report.interactions) {
+    if (interaction.fileIds.every(id => options.resumeState?.completed?.some(row => row.fileId === id))) Object.assign(interaction, { status: 'completed', reused: true });
+  }
+  // Freeze grouping before admitting file chains, without serializing a whole first file.
+  if (options.enableBusinessGrouping === true && prepareBusinessGroups(input.files) && !signal.aborted) {
+    try {
+      const local = report.businessGrouping?.groups ? report.businessGrouping : localBusinessGroups(input.files);
+      const grouped = local ?? await invoke(async request => {
+        const groupInput = prepareBusinessGroups(input.files);
+        if ((options.nativeOutputTools === true ? !modelWireBudget({ input: groupInput, instructions: BUSINESS_GROUP_INSTRUCTIONS, nativeOutputTools: true }, maxInputBytes).fits : Buffer.byteLength(groupInput) + Buffer.byteLength(BUSINESS_GROUP_INSTRUCTIONS) > maxInputBytes)) throw new Error('Business grouping input budget exceeded');
+        reserveShared();
+        return validateBusinessGroups(await sharedModel({ ...request, reviewPhase: 'business-grouping', callPurpose: 'business-grouping' }), input.files);
+      }, { input: prepareBusinessGroups(input.files), instructions: BUSINESS_GROUP_INSTRUCTIONS }, timeoutMs, signal);
+      report.businessGrouping = { status: 'completed', ...grouped };
+      for (const group of grouped.groups.filter(g => g.fileIds.length > 1)) {
+        if (interactionPlans.some(p => [...p.group.fileIds].sort().join(',') === [...group.fileIds].sort().join(','))) continue;
+        const prepared = prepareInteractionInput(input, group, payload => initialInputBudget({ instructions, input: payload }, scope, maxInputBytes));
+        interactionPlans.push({ group, prepared });
+        if (prepared.status !== 'not-applicable') report.interactions.push({ groupId: group.id, fileIds: prepared.fileIds, status: group.fileIds.every(id => options.resumeState?.completed?.some(row => row.fileId === id)) ? 'completed' : prepared.status === 'ready' ? 'pending' : 'blocked', reason: prepared.reason, lifecycle: 'shares-last-primary-timeout' });
+      }
+    } catch (error) {
+      if (signal.aborted || checkpointFailed || error.code === 'MODEL_ARTIFACT_FAILED') throw error;
+      report.businessGrouping = { status: 'fallback', reason: error.message };
+      report.limitations.push({ text: '业务分组未完成，保留原分组：' + error.message });
+    }
+  }
+  if (options.enableGroupPrimary === true && scope && rounds === 1) {
+    const seen = new Set();
+    const groups = report.businessGrouping?.groups ?? report.grouping?.groups ?? [];
+    for (const group of groups) {
+      if (group.fileIds.some(id => seen.has(id) || options.resumeState?.completed?.some(row => row.fileId === id))) continue;
+      const prepared = prepareGroupPrimary(input, group, { instructions, scope, maxInputBytes, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning === true });
+      if (!prepared) continue;
+      groupPrepared.set(group.id, prepared);
+      for (const id of group.fileIds) seen.add(id);
+    }
+    report.primaryGroups = [...groupPrepared].map(([groupId, p]) => ({ groupId, fileIds: p.fileIds, mode: 'group-primary' }));
+  }
+  if (scope && options.optimizeReviewCalls === true) {
+    const units = [];
+    const reusable = new Set((options.resumeState?.completed ?? []).map(row => row.fileId));
+    for (const [id, prepared] of groupPrepared) units.push({ id: 'group:' + id, weight: prepared.fileIds.length * 4 });
+    for (const file of input.files.filter(file => file.eligibility === 'reviewable' && !reusable.has(file.id))) {
+      const prepared = preparePrimaryInput(input, file, { instructions, scope, grouping: report.grouping, maxInputBytes, riskPlanningMode: options.riskPlanningMode, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning, skipSmallRiskPlans: options.skipSmallRiskPlans });
+      if (![...groupPrepared.values()].some(group => group.fileIds.includes(file.id))) units.push({ id: 'primary:' + file.id, weight: 4 * Math.max(1, prepared.batches?.length ?? 1) });
+      if (prepared.synthesis?.status === 'ready') units.push({ id: 'synthesis:' + file.id, weight: 2 });
+      if (options.enableVerification === true) units.push({ id: 'verification:' + file.id, weight: 2 });
+    }
+    for (const plan of interactionPlans.filter(plan => plan.prepared.status === 'ready' && !plan.group.fileIds.every(id => reusable.has(id)))) units.push({ id: 'interaction:' + plan.group.id, weight: 2 });
+    if (units.length) readerAllocation = createReviewReaderAllocation(scope, units);
   }
   const dependencies = new Map();
   for (const plan of interactionPlans.filter(p => p.prepared.status === 'ready')) {
@@ -459,7 +587,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     const owner = members.at(-1);
     if (owner !== undefined) dependencies.set(owner, [...new Set([...(dependencies.get(owner) ?? []), ...members.slice(0, -1)])]);
   }
-  await scheduleFileChains(input.files.map((_, index) => index).slice(first), async index => {
+  await scheduleFileChains(input.files.map((_, index) => index), async index => {
     try { await runFile(index); }
     catch (error) { controller.abort(error); throw error; }
   }, dependencies, fileConcurrency);
@@ -485,8 +613,11 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   }
   report.regressionCoverage = Object.fromEntries(['introduced', 'preexisting', 'uncertain', 'unassessed'].map(classification => [classification, report.findings.filter(f => (f.verification?.regression?.classification ?? 'unassessed') === classification).length]));
   report.findingGroups = groupDuplicateFindings(report.findings);
+  for (const state of report.files) state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && report.findings.filter(f => f.fileId === state.fileId).every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(state.fileId)).every(item => item.status === 'completed');
+  await options.onResumeCheckpoint?.(report);
   report.followup = coverageFollowup(report);
   if (scope) report.readerBudget = { ...scope.usage(), ...scope.budget(), ...readerLimits };
+  if (readerAllocation) report.readerAllocation = readerAllocation.summary();
   report.diagnostics = reviewDiagnostics(report, { reviewWallMs: performance.now() - startedAt });
   return report;
 }
@@ -518,7 +649,7 @@ function renderFinding(output, finding, index, duplicates) {
     const verification = finding.verification;
     if (verification) {
       const label = verification.status !== 'completed' ? '未完成' : ({ supported: '模型复核支持', refuted: '模型复核反驳（保留候选供追溯）', uncertain: '不确定' }[verification.verdict] ?? '未知');
-      output.push('- 复核状态：' + label + '；不是事实或因果证明');
+      output.push('- 复核状态：' + label + (finding.reused ? '（相同快照的既往轮次结果，本次未重新取证）' : '') + '；不是事实或因果证明');
       if (verification.reason) output.push('- 复核理由：' + safe(verification.reason));
       for (const ref of verification.evidence ?? []) output.push('- 复核证据：' + safe(ref.sourceId) + ':' + ref.start + '（' + ref.count + '行） · SHA256 ' + safe(ref.hash) + ' · ' + safe(ref.text));
     }
@@ -551,7 +682,7 @@ export function markdownReport(report) {
   }
   for (const file of report.files) if (file.windowCoverage) output.push('- ' + safe(file.path) + '：变更窗口已完成 ' + file.windowCoverage.completed.length + '，待审 ' + file.windowCoverage.pending.length + '；仅表示窗口分析完成，不证明全文正确');
   for (const file of report.files) if (file.synthesisStatus) output.push('- ' + safe(file.path) + '：跨窗口综合 ' + safe(file.synthesisStatus) + '；不等于事实正确性证明');
-  for (const interaction of report.interactions ?? []) output.push('- 跨文件综合 ' + safe(interaction.groupId) + '：' + safe(interaction.status) + '；共享组末主文件超时，不证明完整交互覆盖');
+  for (const interaction of report.interactions ?? []) output.push('- 跨文件综合 ' + safe(interaction.groupId) + '：' + safe(interaction.status) + (interaction.failureCode ? ' · ' + safe(interaction.failureCode) : '') + (interaction.reason ? ' — ' + safe(interaction.reason) : '') + '；与组末主文件共享生命周期，不证明完整交互覆盖');
   if (report.rules?.length) output.push('', '## 项目规则', '规则仅为已批准约束数据，不扩大权限或证明缺陷。', ...report.rules.map(rule => '- ' + safe(rule.path) + ' · SHA256 ' + safe(rule.hash)));
   if (report.followup?.suggestedPaths.length) output.push('', '## 后续选择建议', '仅为原快照未完成项；不会自动续审。再次执行需新预览、新审批，并显式选择规则和上下文。阻断项需先处理原因；关联上下文不等于主文件已审查。', ...report.followup.items.filter(item => item.followup).map(item => '- ' + safe(item.path) + '：' + item.status + (item.incompleteVerification ? '（候选复核未完成）' : '')));
   output.push('', '## 审查发现');

package/src/search-seeds.mjs

@@ -1,4 +1,5 @@
 import { retrievalRequest } from './retrieval-loop.mjs';
+import { modelWireBudget } from './model-wire-budget.mjs';
 
 const validLine = value => Number.isSafeInteger(value) && value > 0;
 const capacity = () => Object.assign(new Error('Optional search seed unavailable'), { code: 'SEARCH_SEED_CAPACITY' });
@@ -59,7 +60,7 @@ export function searchSeeds(scope, request, records, { existing = [], maxReads =
           check();
           const remaining = scope.budget();
           if (typeof next?.input !== 'string' || typeof next.instructions !== 'string') throw new Error('Invalid search seed request builder');
-          if (Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) > maxInputBytes || remaining.remainingCalls < 4 || remaining.remainingOutputBytes < 16 * 1024) throw capacity();
+          if ((request.nativeOutputTools === true ? !modelWireBudget(next, maxInputBytes).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) > maxInputBytes) || remaining.remainingCalls < 4 || remaining.remainingOutputBytes < 16 * 1024) throw capacity();
           return { request: operation, result };
         });
         seeds.push(item);

package/src/service.mjs

@@ -1,4 +1,6 @@
+import { configureWireBudget } from './model-wire-budget.mjs';
 import {REVIEW_RUNTIME} from './runtime-identity.mjs';
+import { buildResumeState, validateResumeState, resumePreview } from './review-resume.mjs';
 import { reviewDiagnostics } from './review-diagnostics.mjs';
 import {createProjectReviewService} from './project-review-service.mjs';
 import {svnDiagnostic} from './svn-diagnostics.mjs';
@@ -53,15 +55,16 @@ function buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcur
   return scopeNotice + (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + `执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多${maxRetrievalRounds}轮检索；独立文件审查链最多${changesConcurrency}条并发，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先向用户展示范围，获得确认后执行。`;
 }
 
-function createSessionReviewService(llm, { capture = captureSnapshot, now = Date.now, ttlMs = 300000, maxPreviews = 8, allowModelSending = false, enableRiskPlanning = false, skipSmallRiskPlans = true, reviewRounds = 1, enableBusinessGrouping = false, enableAnchorCorrection = false, changesConcurrency = 2, maxRetrievalRounds = 3, riskPlanningMode = 'separate', readerBudgetPolicy = 'fixed', optimizeReviewCalls = false, enablePrimarySeeds = false, focusPrimaryContext = false, enableSearchSeeds = false, authorize = async () => false } = {}) {
+function createSessionReviewService(llm, { capture = captureSnapshot, now = Date.now, ttlMs = 300000, maxPreviews = 8, allowModelSending = false, enableRiskPlanning = false, skipSmallRiskPlans = true, reviewRounds = 1, enableBusinessGrouping = false, enableAnchorCorrection = false, changesConcurrency = 2, maxRetrievalRounds = 3, riskPlanningMode = 'separate', readerBudgetPolicy = 'fixed', optimizeReviewCalls = false, enablePrimarySeeds = false, focusPrimaryContext = false, enableSearchSeeds = false, nativeOutputTools = false, enableGroupPrimary = false, authorize = async () => false } = {}) {
   for (const value of [ttlMs, maxPreviews]) if (!Number.isSafeInteger(value) || value < 1) throw new Error('Invalid preview limit');
   changesConcurrency = reviewConcurrency(changesConcurrency);
   maxRetrievalRounds = reviewRetrievalRounds(maxRetrievalRounds);
   riskPlanningMode = validateRiskPlanningMode(riskPlanningMode);
   reviewReaderBudget({ files: [] }, readerBudgetPolicy);
-  for (const value of [optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds]) if (typeof value !== 'boolean') throw new Error('Invalid review optimization option');
+  for (const value of [optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, nativeOutputTools, enableGroupPrimary]) if (typeof value !== 'boolean') throw new Error('Invalid review optimization option');
   const lifetime = new AbortController();
   const bind = exec => ({ ...exec, signal: exec.signal ? AbortSignal.any([exec.signal, lifetime.signal]) : lifetime.signal });
+  const resumeOptions = (options, route, rounds) => ({ captureOptions: options, route, runtime: REVIEW_RUNTIME, instructionsHash: hash(REVIEW_INSTRUCTIONS), execution: { rounds, enableRiskPlanning, skipSmallRiskPlans, enableBusinessGrouping, enableAnchorCorrection, changesConcurrency, maxRetrievalRounds, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, nativeOutputTools, enableGroupPrimary } });
   const previews = new Map();
   let busy = false;
   function prune() { for (const [id, p] of previews) if (p.expires <= now()) previews.delete(id); }
@@ -70,7 +73,8 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
       exec = bind(exec);
       exec.signal.throwIfAborted();
       if (busy) throw new Error('Review service busy');
-      if (!args || Object.keys(args).some(k => !['repositoryPath', 'selectedPaths', 'contextPaths', 'rulePaths', 'autoContext', 'commit', 'baseRevision', 'targetRevision','businessRequirement','callerScopePaths','oldContextPaths','reviewRounds','svnRevision','svnBaseRevision','svnTargetRevision','svnAllowNetwork','svnEffectiveMergeinfo','svnBasePath','svnTargetPath','svnReplacementBaseRevision','svnReplacementAllowNetwork','changeScope'].includes(k))) throw new Error('Unknown preview argument');
+      if (!args || Object.keys(args).some(k => !['repositoryPath', 'selectedPaths', 'contextPaths', 'rulePaths', 'autoContext', 'commit', 'baseRevision', 'targetRevision','businessRequirement','callerScopePaths','oldContextPaths','reviewRounds','svnRevision','svnBaseRevision','svnTargetRevision','svnAllowNetwork','svnEffectiveMergeinfo','svnBasePath','svnTargetPath','svnReplacementBaseRevision','svnReplacementAllowNetwork','changeScope','resumeFromJobId'].includes(k))) throw new Error('Unknown preview argument');
+      if (args.resumeFromJobId !== undefined && (typeof args.resumeFromJobId !== 'string' || !/^[a-f0-9-]{36}$/.test(args.resumeFromJobId))) throw new Error('Invalid resume job id');
       if (args.autoContext !== undefined && typeof args.autoContext !== 'boolean') throw new Error('Invalid autoContext option');
       for (const key of ['selectedPaths', 'contextPaths', 'rulePaths', 'oldContextPaths']) if (args[key] !== undefined && (!Array.isArray(args[key]) || args[key].length > (key === 'rulePaths' ? 4 : key === 'oldContextPaths' ? 20 : 200) || args[key].some(p => typeof p !== 'string'))) throw new Error('Invalid path list');
       const rounds=validateReviewRounds(args.reviewRounds === undefined ? reviewRounds : args.reviewRounds);
@@ -80,24 +84,34 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
       busy = true;
       try {
         const options = structuredClone(args);
+        const sourceJobId = options.resumeFromJobId;
+        delete options.resumeFromJobId;
+        let savedResume;
+        if (sourceJobId !== undefined) {
+          if (typeof exec.resolveReviewResume !== 'function') throw new Error('Durable job resume is unavailable; use a new background preview');
+          savedResume = await exec.resolveReviewResume(sourceJobId);
+        }
         const target = await resolveWorkspaceRepository(current.cwd, options.repositoryPath);
         const snapshot = await capture(target, { ...options, signal: exec.signal });
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd) throw new Error('Agent directory changed; preview again');
+        const resumeState = savedResume === undefined ? undefined : validateResumeState(savedResume, snapshot, resumeOptions(options, current.route, rounds));
         const readerBudget = reviewReaderBudget(snapshot, readerBudgetPolicy);
-        const plan = buildCoveragePlan(snapshot, { focusPrimaryContext, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:rounds, enableBusinessGrouping, instructions: REVIEW_INSTRUCTIONS, scope: createRetrievalScope(snapshot, { ...readerBudget, signal: exec.signal }), grouping: buildReviewGroups(snapshot.files, inferFileRelations(snapshot.files)), maxInputBytes: 96 * 1024, signal: exec.signal });
+        const plan = buildCoveragePlan(snapshot, { enableGroupPrimary, resumeState, focusPrimaryContext, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:rounds, enableBusinessGrouping, instructions: REVIEW_INSTRUCTIONS, scope: configureWireBudget(createRetrievalScope(snapshot, { ...readerBudget, signal: exec.signal, ...(optimizeReviewCalls ? { reuseResults: true } : {}) }), { nativeOutputTools }), grouping: buildReviewGroups(snapshot.files, inferFileRelations(snapshot.files)), maxInputBytes: 96 * 1024, signal: exec.signal });
         prune();
         while (previews.size >= maxPreviews) previews.delete(previews.keys().next().value);
         const previewId = randomUUID();
-        previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, expires: now() + ttlMs });
+        previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, resumeState, sourceJobId, expires: now() + ttlMs });
         return {
   ...(options.businessRequirement !== undefined
     ? { businessRequirement: { text: options.businessRequirement, hash: hash(options.businessRequirement), bytes: Buffer.byteLength(options.businessRequirement) } }
     : {}),
   previewId,
+  ...(resumeState ? { resume: resumePreview(resumeState, sourceJobId) } : {}),
   plan,
   snapshotId: snapshot.id,
-  execution: { fileConcurrency: changesConcurrency, maxRetrievalRounds, ...(optimizeReviewCalls ? { riskPlanningMode, readerBudget: { policy: readerBudgetPolicy, ...readerBudget }, missingContextSeeds: enablePrimarySeeds, focusPrimaryContext, searchContextSeeds: enableSearchSeeds } : {}) },
+  privateArtifacts: { enabled: typeof exec.onModelArtifact === 'function', sourceBearing: true, maxArtifactBytes: 1048576, maxJobBytes: 8388608, maxArtifacts: 4096, notice: 'Background jobs retain bounded untrusted model output outside the reviewed workspace; omissions/truncation explicit. Never included in ordinary status or reused as evidence; explicit consent required to read.' },
+  execution: { nativeOutputTools, enableGroupPrimary, fileConcurrency: changesConcurrency, maxRetrievalRounds, ...(optimizeReviewCalls ? { riskPlanningMode, readerBudget: { policy: readerBudgetPolicy, ...readerBudget }, missingContextSeeds: enablePrimarySeeds, focusPrimaryContext, searchContextSeeds: enableSearchSeeds } : {}) },
   repositoryRoot: snapshot.root,
   vcs: snapshot.vcs,
   ...(snapshot.changeScope ? { changeScope: snapshot.changeScope } : options.changeScope !== undefined ? { changeScope: options.changeScope } : {}),
@@ -127,7 +141,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
   ...(snapshot.callerDiscovery ? { callerDiscovery: snapshot.callerDiscovery } : {}),
   ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}),
   rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })),
-  notice: buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcurrency, maxRetrievalRounds) + (optimizeReviewCalls ? ` 完整正文或覆盖全部精确编辑的单批窗口可将风险问题合并入主审（非独立规划）；仅对批准上下文的确定坐标预取小片段，不代表完整核查。${focusPrimaryContext ? " 主审优先保留主文件全文，仅附带有关联的有界完整上下文；其余批准来源保留目录按需读，不表示不存在或已核查。" : ""}${enableSearchSeeds ? " 可将模型搜索命中的批准原行小片段与搜索结果同轮提供，每阶段最多2次额外读取，共用原预算；不猜测另侧坐标，不增加检索轮次。" : ""}共享检索上限按本次范围计算：${readerBudget.maxCalls}次操作／${readerBudget.maxOutputBytes}字节，所有阶段共用、不逐文件重置；无法取得必要证据的阶段不再无效启动。` : ''),
+  notice: buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcurrency, maxRetrievalRounds) + (optimizeReviewCalls ? ` 完整正文或覆盖全部精确编辑的单批窗口可将风险问题合并入主审（非独立规划）；仅对批准上下文的确定坐标预取小片段，不代表完整核查。${focusPrimaryContext ? " 主审优先保留主文件全文，仅附带有关联的有界完整上下文；其余批准来源保留目录按需读，不表示不存在或已核查。" : ""}${enableSearchSeeds ? " 可将模型搜索命中的批准原行小片段与搜索结果同轮提供，每阶段最多2次额外读取，共用原预算；不猜测另侧坐标，不增加检索轮次。" : ""}共享检索上限按本次范围计算：${readerBudget.maxCalls}次唯一操作结果生成／${readerBudget.maxOutputBytes}交付字节，所有阶段共用、不逐文件重置；同快照相同请求可复用原始结果，每次交付仍计字节并重新签发复核回执；主审、综合及复核按权重预留最低额度，未用额度释放，额度不足仍如实标记未完成。` : ''),
 };
       } finally { busy = false; }
     },
@@ -148,12 +162,15 @@ function createSessionReviewService(llm, { capture = captureSnapshot, now = Date
         const snapshot = await capture(target, { ...preview.options, signal: exec.signal });
         exec.signal?.throwIfAborted();
         if (snapshot.id !== preview.snapshotId || owner(exec).cwd !== current.cwd) throw new Error('Files changed since preview; preview again');
+        const resumeIdentity = resumeOptions(preview.options, preview.route, preview.rounds);
+        const resumeState = preview.resumeState ? validateResumeState(preview.resumeState, snapshot, resumeIdentity) : undefined;
         if (await authorize({ snapshot, route: preview.route, exec }) !== true) throw new Error('Model sending approval denied or unavailable');
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd || JSON.stringify(owner(exec).route) !== JSON.stringify(preview.route)) throw new Error('Agent changed during approval');
         await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:snapshot.id,files:snapshot.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility}))});
-        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route,{correctJson:true}), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableVerification: true, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection,changesConcurrency,maxRetrievalRounds,correctProtocol:true, onProgress:exec.reviewCheckpoint });
+        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route,{correctJson:true,useNativeTools:nativeOutputTools}), { signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableGroupPrimary, nativeOutputTools, enableVerification: true, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection,changesConcurrency,maxRetrievalRounds,correctProtocol:true, onProgress:exec.reviewCheckpoint, resumeState, onModelArtifact: exec.onModelArtifact, onResumeCheckpoint: exec.reviewResumeCheckpoint ? async checkpoint => { await exec.reviewResumeCheckpoint(buildResumeState(snapshot, resumeIdentity, checkpoint)); } : undefined });
         report.model = preview.route;
+        if (exec.reviewResumeCheckpoint) await exec.reviewResumeCheckpoint(buildResumeState(snapshot, resumeIdentity, report));
         // reviewSnapshot preserves cancelled coverage; do not replace it with a freshness error.
         if (report.status === 'cancelled') {
           report.outdated = true;