@feng0531/dsh-code-review 0.86.0 → 0.87.0

package/src/evidence-context.mjs

@@ -0,0 +1,96 @@
+import { retrievalRequest } from './retrieval-loop.mjs';
+import { modelWireBudget, nativeWireEnabled } from './model-wire-budget.mjs';
+
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const contains = (outer, inner) => positive(outer?.start) && positive(outer?.count) && outer.start <= inner.start && outer.start + outer.count >= inner.start + inner.count;
+const capacity = () => Object.assign(new Error('Optional evidence context unavailable'), { code: 'EVIDENCE_CONTEXT_CAPACITY' });
+const optional = error => ['EVIDENCE_CONTEXT_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code);
+
+function supplied(payload, source, range) {
+  if (source.side === 'context' || source.side === 'context-old') return (Array.isArray(payload.context) ? payload.context : []).some(item => item?.path === source.path && typeof item[source.side === 'context' ? 'text' : 'oldText'] === 'string');
+  if (!['old', 'new'].includes(source.side)) return false;
+  const files = [payload.file, ...(Array.isArray(payload.relatedFiles) ? payload.relatedFiles : []), ...(Array.isArray(payload.reviews) ? payload.reviews.flatMap(review => [review.file, ...(Array.isArray(review.relatedFiles) ? review.relatedFiles : [])]) : [])];
+  if (files.some(file => file?.id === source.fileId && file.path === source.path && typeof (source.side === 'old' ? file.left?.text : file.right?.text) === 'string')) return true;
+  return payload.file?.id === source.fileId && payload.file.path === source.path && payload.sourceMode === 'change-windows' && (payload.windows ?? []).some(window => typeof window?.[source.side]?.text === 'string' && contains(window[source.side], range));
+}
+
+// A review-lifetime navigation index, NOT evidence, authority, or a receipt store.
+// remember() must be called only for reads admitted to an actual model input.
+// seed() never audits or remembers its own results; the sender does that after
+// its normal fit/beforeCall/cancellation checks, just like ordinary retrieval.
+export function createEvidenceContext(snapshotId, { maxEntries = 128 } = {}) {
+  if (typeof snapshotId !== 'string' || !snapshotId || snapshotId.length > 500 || !positive(maxEntries) || maxEntries > 512) throw new Error('Invalid evidence context options');
+  const entries = new Map();
+  return Object.freeze({
+    size: () => entries.size,
+    remember(records) {
+      if (!Array.isArray(records) || records.length > 256) throw new Error('Invalid evidence context records');
+      for (const record of records) {
+        if (record?.kind !== 'read' || record.snapshotId !== snapshotId || record.omitted === true || typeof record.sourceId !== 'string' || !record.sourceId || record.sourceId.length > 200 || typeof record.hash !== 'string' || !/^[a-f0-9]{64}$/.test(record.hash) || !positive(record.start) || !positive(record.count) || record.count > 200 || !Number.isSafeInteger(record.start + record.count)) continue;
+        const item = { sourceId: record.sourceId, hash: record.hash, start: record.start, count: record.count };
+        const key = JSON.stringify(item);
+        if (entries.has(key)) continue;
+        if (entries.size >= maxEntries) entries.delete(entries.keys().next().value);
+        entries.set(key, item);
+      }
+    },
+    seed(scope, request, { sourceIds = [], ranges = [], existing = [], maxReads = 4, maxLines = 80, maxBytes = 16384, maxInputBytes = 98304, reserveCalls = 2, reserveBytes = 4096, signal = request?.signal, buildRequest = records => retrievalRequest(request, scope, records) } = {}) {
+      if (!Array.isArray(sourceIds) || sourceIds.length > 200 || sourceIds.some(id => typeof id !== 'string' || !id || id.length > 200) || !Array.isArray(ranges) || ranges.length > 200 || ranges.some(range => typeof range?.sourceId !== 'string' || !positive(range.start) || !positive(range.count) || !Number.isSafeInteger(range.start + range.count)) || !Array.isArray(existing) || existing.length > 50 || !Number.isSafeInteger(maxReads) || maxReads < 0 || maxReads > 8 || !positive(maxLines) || maxLines > 200 || !positive(maxBytes) || maxBytes > 65536 || !positive(maxInputBytes) || !Number.isSafeInteger(reserveCalls) || reserveCalls < 0 || reserveCalls > 100 || !Number.isSafeInteger(reserveBytes) || reserveBytes < 0 || reserveBytes > 1048576 || typeof buildRequest !== 'function' || signal !== undefined && !(signal instanceof AbortSignal) || request?.signal !== undefined && !(request.signal instanceof AbortSignal)) throw new Error('Invalid evidence context seed options');
+      const check = () => { request?.signal?.throwIfAborted(); signal?.throwIfAborted(); };
+      check();
+      const seeds = [];
+      if (!maxReads || !entries.size || !sourceIds.length && !ranges.length) return seeds;
+      if (typeof request?.input !== 'string' || typeof request.instructions !== 'string') throw new Error('Invalid evidence context request');
+      const payload = JSON.parse(request.input);
+      if (payload?.snapshotId !== snapshotId || typeof scope?.transaction !== 'function' || typeof scope.preflight !== 'function' || typeof scope.catalog !== 'function' || typeof scope.read !== 'function' || typeof scope.budget !== 'function') return seeds;
+      const catalog = scope.catalog(), selected = new Set(sourceIds);
+      const attempted = new Set();
+      let attempts = 0;
+      try {
+        return scope.transaction(() => {
+          for (const entry of entries.values()) {
+            check();
+            if (attempts >= maxReads) break;
+            const sources = catalog.filter(source => source.id === entry.sourceId);
+            if (sources.length !== 1) continue;
+            const source = sources[0];
+            if (!positive(source.lineCount) || entry.start > source.lineCount || source.hash !== undefined && source.hash !== entry.hash) continue;
+            const overlap = ranges.find(range => range.sourceId === entry.sourceId && range.start < entry.start + entry.count && entry.start < range.start + range.count);
+            if (!selected.has(entry.sourceId) && !overlap) continue;
+            const start = overlap ? Math.max(entry.start, overlap.start) : entry.start;
+            const count = Math.min(maxLines, entry.start + entry.count - start, source.lineCount - start + 1, overlap ? overlap.start + overlap.count - start : Infinity);
+            const operation = { kind: 'read', id: source.id, start, count };
+            const key = JSON.stringify(operation);
+            if (attempted.has(key) || supplied(payload, source, operation)) continue;
+            if ([...existing, ...seeds].some(item => item?.request?.kind === 'read' && item.result?.snapshotId === snapshotId && item.result.sourceId === source.id && item.result.hash === entry.hash && typeof item.result.text === 'string' && contains(item.result, operation))) continue;
+            attempted.add(key); attempts++;
+            check();
+            const budget = scope.budget(), cost = scope.preflight([operation]);
+            const cached = budget.reusableResults === true && cost?.calls === 0;
+            if ((!cached && budget.remainingCalls <= reserveCalls) || budget.remainingOutputBytes <= reserveBytes) throw capacity();
+            const result = scope.read(operation);
+            check();
+            if (result.snapshotId !== snapshotId || result.sourceId !== source.id || result.hash !== entry.hash || result.start !== start || result.count !== count || typeof result.text !== 'string' || result.receiptId !== undefined || result.omitted === true) throw capacity();
+            const proposed = [...seeds, { request: operation, result }];
+            if (Buffer.byteLength(JSON.stringify(proposed)) > maxBytes) throw capacity();
+            const next = buildRequest([...existing, ...proposed]);
+            if (typeof next?.input !== 'string' || typeof next.instructions !== 'string') throw new Error('Invalid evidence context request builder');
+            const fits = nativeWireEnabled(request, scope) ? modelWireBudget({ ...next, nativeOutputTools: true }, maxInputBytes).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) <= maxInputBytes;
+            check();
+            const remaining = scope.budget();
+            if (!fits || (!cached && remaining.remainingCalls < reserveCalls) || remaining.remainingOutputBytes < reserveBytes) throw capacity();
+            seeds.push({ request: operation, result });
+          }
+          check();
+          return seeds;
+        });
+      } catch (error) {
+        check();
+        if (!optional(error)) throw error;
+        // One rejected item abandons the entire optional batch: previously read
+        // siblings must not consume bytes/calls when no seed array is returned.
+        return [];
+      }
+    },
+  });
+}

package/src/group-interaction.mjs

@@ -0,0 +1,48 @@
+import { createHash } from 'node:crypto';
+import { validateInteractionFindings } from './interaction-findings.mjs';
+import { validateSynthesisReads } from './synthesis-evidence.mjs';
+
+export const GROUP_INTERACTION_INSTRUCTIONS = ' GROUP_INTERACTIONS: 本次精确完整组主审可在根结果附带可选 interactions:{groupId:"原groupId",findings:[],limitations:[]}。不要放在reviews成员内。只有在本次生成通过批准read实际读取组内所有精确编辑至少一侧后才可声明交互结果；完整正文、历史audit、风险或search不是该read证据。交互finding必须包含普通finding字段、主文件精确anchor/attribution以及跨至少两个不同成员的interaction.editRefs:[{fileId,editId}]。缺少或无法满足证据时可省略interactions，宿主保留独立交互阶段；不能以空数组伪造已检查。本开关覆盖前述“专门交互阶段仍独立校验”的传输安排：宿主仅在本channel全部验收成功后省去匹配的专门交互生成，缺失或失败仍独立执行；候选复核绝不省略。风险不是证据，分组不证明因果，独立候选复核仍需执行。';
+
+// Call independently AFTER validateGroupPrimary. Optional channel failure never
+// discards accepted primary findings, grants evidence, or triggers hidden retries.
+export function validateGroupInteraction(response, prepared, snapshot, reads = [], catalog = []) {
+  const groupId = prepared?.groupId;
+  const fallback = reason => ({ status: 'fallback', groupId, reason, findings: [], limitations: [] });
+  if (prepared?.groupInteraction !== true) return { status: 'disabled', groupId, findings: [], limitations: [] };
+  try {
+    const serialized = typeof response === 'string' ? response : JSON.stringify(response);
+    if (typeof serialized !== 'string' || Buffer.byteLength(serialized) > 128 * 1024) return fallback('invalid-channel');
+    const value = typeof response === 'string' ? JSON.parse(response) : response;
+    if (!value || !Object.hasOwn(value, 'interactions')) return fallback('missing-channel');
+    const channel = value.interactions;
+    if (!channel || Array.isArray(channel) || Object.keys(channel).sort().join(',') !== 'findings,groupId,limitations' || channel.groupId !== groupId) return fallback('invalid-channel');
+    const ids = prepared.fileIds;
+    if (!Array.isArray(ids) || ids.length < 2 || ids.length > 4 || new Set(ids).size !== ids.length || !Array.isArray(value.reviews) || value.reviews.length !== ids.length || new Set(value.reviews.map(row => row?.fileId)).size !== ids.length || value.reviews.some(row => !ids.includes(row?.fileId) || row.findings?.some(finding => finding?.interaction !== undefined))) return fallback('invalid-members');
+    const original = JSON.parse(prepared.payload);
+    if (original.snapshotId !== snapshot.id || original.sourceMode !== 'group-primary' || original.groupInteraction?.groupId !== groupId || !Array.isArray(original.groupInteraction.fileIds) || original.groupInteraction.fileIds.length !== ids.length || original.groupInteraction.fileIds.some((id, index) => id !== ids[index]) || !Array.isArray(original.reviews) || original.reviews.length !== ids.length || ids.some(id => { const captured = original.reviews.find(row => row.fileId === id)?.file; const current = snapshot.files.find(file => file.id === id); return !captured || !current || captured.path !== current.path || captured.left?.text !== current.left?.text || captured.right?.text !== current.right?.text; })) return fallback('stale-preparation');
+    if (!Array.isArray(reads) || !Array.isArray(catalog) || new Set(catalog.map(source => source.id)).size !== catalog.length) return fallback('invalid-evidence');
+    // Only successful current-generation source/hash identities participate.
+    const audit = reads.filter(read => {
+      const source = catalog.find(source => source.id === read?.sourceId);
+      const file = snapshot.files.find(file => file.id === source?.fileId && file.path === source.path);
+      const text = source?.side === 'old' ? file?.left?.text : source?.side === 'new' ? file?.right?.text : undefined;
+      return typeof text === 'string' && read.kind === 'read' && read.snapshotId === snapshot.id && read.omitted !== true && read.hash === createHash('sha256').update(text).digest('hex') && (source.hash === undefined || source.hash === read.hash);
+    });
+    // Replacing an entire dedicated interaction requires current-generation
+    // evidence for EVERY member/edit, not just a selected subset of findings.
+    for (const id of ids) {
+      const changes = prepared.changes?.get(id);
+      if (changes?.precision !== 'exact' || changes.status !== 'changed' || !changes.edits.length) return fallback('inexact-members');
+      validateSynthesisReads([{ attribution: { editIds: changes.edits.map(edit => edit.id) } }], changes, audit, catalog, id, snapshot.id);
+    }
+    const validated = validateInteractionFindings(channel, snapshot, { id: groupId, fileIds: ids }, audit, catalog);
+    const seen = new Set();
+    for (const finding of validated.findings) {
+      const key = JSON.stringify([finding.fileId, finding.anchor, finding.interaction.editRefs.map(ref => [ref.fileId, ref.editId]).sort()]);
+      if (seen.has(key)) return fallback('duplicate-findings');
+      seen.add(key);
+    }
+    return { status: 'accepted', groupId, findings: validated.findings, limitations: validated.limitations };
+  } catch { return fallback('invalid-evidence-or-findings'); }
+}

package/src/group-primary.mjs

@@ -2,10 +2,12 @@ import { preparePrimaryInput } from './primary-input.mjs';
 import { initialInputBudget } from './input-budget.mjs';
 import { INLINE_RISK_INSTRUCTIONS } from './prompts.mjs';
 import { validateRiskPlan } from './risk-plan.mjs';
+import { GROUP_INTERACTION_INSTRUCTIONS } from './group-interaction.mjs';
 
 export const GROUP_PRIMARY_INSTRUCTIONS = '批准的group-primary输入包含多个完整主文件。逐个审核所有reviews成员的新旧正文，并结合组内其他文件分析；不能仅审核一个文件。返回 {"reviews":[{"fileId":"原成员身份","findings":[],"limitations":[]}],"limitations":[]}，每个成员恰好一项，包括没有发现的成员。各finding仍需原审查指令全部字段、精确原行anchor及该fileId本次变化归因；不能用其他成员的身份或坐标替代。缺证据写limitations，不声明跨文件综合已完成；专门交互阶段仍独立校验。可按批准检索协议先返回requests。';
 
-export function prepareGroupPrimary(snapshot, group, { instructions, scope, maxInputBytes, focusPrimaryContext = false, enableRiskPlanning = false } = {}) {
+export function prepareGroupPrimary(snapshot, group, { instructions, scope, maxInputBytes, focusPrimaryContext = false, enableRiskPlanning = false, enableGroupInteractions = false, migrationContracts = [] } = {}) {
+  if (typeof enableGroupInteractions !== 'boolean') throw new Error('Invalid group interaction option');
   if (!scope || snapshot.projectScope || !Array.isArray(group?.fileIds) || group.fileIds.length < 2 || group.fileIds.length > 4 || new Set(group.fileIds).size !== group.fileIds.length) return null;
   const members = group.fileIds.map(id => snapshot.files.find(file => file.id === id));
   if (members.some(file => !file || file.eligibility !== 'reviewable')) return null;
@@ -15,8 +17,17 @@ export function prepareGroupPrimary(snapshot, group, { instructions, scope, maxI
   const context = [...new Map(reviews.flatMap(r => r.context ?? []).map(item => [JSON.stringify(item), item])).values()];
   for (const item of reviews) { delete item.context; delete item.rules; delete item.businessRequirement; delete item.requirementNotice; }
   const value = { snapshotId: snapshot.id, sourceMode: 'group-primary', groupId: group.id, reviews, context, rules: snapshot.rules ?? [], ...(snapshot.businessRequirement !== undefined ? { businessRequirement: snapshot.businessRequirement } : {}) };
-  const payload = JSON.stringify(value), combined = instructions + '\n' + GROUP_PRIMARY_INSTRUCTIONS + (enableRiskPlanning ? '\n各成员可附带risks；组风险可引用所有成员精确编辑，仍只是假设，不增加规划调用。' + INLINE_RISK_INSTRUCTIONS.replace('Final JSON requires findings/limitations;', 'Each reviews member requires findings/limitations;') : '');
-  return initialInputBudget({ input: payload, instructions: combined }, scope, maxInputBytes).fits ? { payload, instructions: combined, fileIds: [...group.fileIds], inlineRisk: enableRiskPlanning, changes: new Map(members.map((f, i) => [f.id, prepared[i].changes])) } : null;
+  let payload = JSON.stringify(value);
+  let combined = instructions + '\n' + GROUP_PRIMARY_INSTRUCTIONS + (enableRiskPlanning ? '\n各成员可附带risks；组风险可引用所有成员精确编辑，仍只是假设，不增加规划调用。' + INLINE_RISK_INSTRUCTIONS.replace('Final JSON requires findings/limitations;', 'Each reviews member requires findings/limitations;') : '');
+  if (!initialInputBudget({ input: payload, instructions: combined }, scope, maxInputBytes).fits) return null;
+  const contracts = migrationContracts.filter(contract => contract.candidateFileIds?.some(id => group.fileIds.includes(id)));
+  if (contracts.length) { const proposed = JSON.stringify({ ...JSON.parse(payload), migrationContracts: contracts, migrationNotice: 'Host navigation hypotheses only. Compare the old public gate, new entry and callers under the same trigger. Neither semantics nor causality are established; independent verification is required.' }); if (initialInputBudget({ input: proposed, instructions: combined }, scope, maxInputBytes).fits) payload = proposed; }
+  let groupInteraction = false;
+  if (enableGroupInteractions && typeof group.id === 'string' && group.id.length > 0 && group.id.length <= 200 && prepared.every(p => p.changes.status === 'changed' && p.changes.edits.length)) {
+    const proposed = JSON.stringify({ ...JSON.parse(payload), groupInteraction: { groupId: group.id, fileIds: [...group.fileIds] } });
+    if (initialInputBudget({ input: proposed, instructions: combined + GROUP_INTERACTION_INSTRUCTIONS }, scope, maxInputBytes).fits) { payload = proposed; combined += GROUP_INTERACTION_INSTRUCTIONS; groupInteraction = true; }
+  }
+  return { payload, instructions: combined, fileIds: [...group.fileIds], inlineRisk: enableRiskPlanning, changes: new Map(members.map((f, i) => [f.id, prepared[i].changes])), ...(enableGroupInteractions ? { groupId: group.id, groupInteraction, ...(!groupInteraction ? { groupInteractionFallback: 'input-budget-or-inexact' } : {}) } : {}) };
 }
 
 export function validateGroupPrimary(response, prepared, snapshot, validate, catalog = []) {

package/src/interaction-risk.mjs

@@ -0,0 +1,71 @@
+import { isDeepStrictEqual } from 'node:util';
+import { prepareInteractionInput } from './interaction-input.mjs';
+import { riskPlanningDecision, validateRiskPlan } from './risk-plan.mjs';
+import { initialInputBudget } from './input-budget.mjs';
+import { INLINE_RISK_INSTRUCTIONS } from './prompts.mjs';
+
+// Reuse the existing optional-risks schema. Do not add the planning-only schema
+// which forbids findings and requests. Interaction references remain file-qualified.
+export const INTERACTION_RISK_INSTRUCTIONS = 'INLINE_INTERACTION_RISKS ' + INLINE_RISK_INSTRUCTIONS +
+  ' Interaction risks must reference real edits in at least two distinct files from this interaction group. The supplied files[].edits cover the complete exact group edits, not source evidence. Source bodies must still be read in this generation; hypotheses never replace interaction evidence or independent verification. Missing or invalid optional risks do not invalidate findings and must not trigger another planning call.';
+
+function canonicalInteraction(snapshot, group) {
+  const prepared = prepareInteractionInput(snapshot, group, () => ({ fits: true }));
+  return prepared.status === 'ready' ? JSON.parse(prepared.payload) : undefined;
+}
+
+/** Pure first-generation decision; no reads, receipts, state mutation or model sends. */
+export function prepareInteractionRisk(snapshot, group, prepared, options) {
+  const { instructions, scope, maxInputBytes } = options;
+  if (options.inlineInteractionRisks !== undefined && typeof options.inlineInteractionRisks !== 'boolean') throw new Error('inlineInteractionRisks must be boolean');
+  const files = group.fileIds.map(id => snapshot.files.find(file => file.id === id));
+  const decision = options.enableRiskPlanning === true
+    ? options.skipSmallRiskPlans === true ? riskPlanningDecision(files) : { required: true, reason: 'unconditional' }
+    : { required: false, reason: 'disabled' };
+  const fallback = fallbackReason => ({ mode: decision.required ? 'separate' : 'disabled', decision,
+    instructions, planningCalls: decision.required ? 1 : 0, fallbackReason });
+  if (!decision.required) return fallback(options.enableRiskPlanning === true ? 'smallchange' : 'disabled');
+  if (options.inlineInteractionRisks !== true) return fallback('option-disabled');
+  if (snapshot.projectScope || files.some(file => file?.reviewMode === 'project')) return fallback('project');
+  if ((options.round ?? 1) !== 1) return fallback('laterround');
+  if (!scope) return fallback('approved-reader-required');
+  if (prepared?.status !== 'ready' || prepared.budget?.fits !== true || prepared.batches !== undefined) return fallback('incomplete-edit-scope');
+  let canonical, payload;
+  try {
+    canonical = canonicalInteraction(snapshot, group);
+    payload = JSON.parse(prepared.payload);
+  } catch { return fallback('incomplete-edit-scope'); }
+  if (!canonical || !payload || payload.snapshotId !== snapshot.id || payload.groupId !== group.id ||
+      payload.sourceMode !== 'file-interaction' || !isDeepStrictEqual(prepared.fileIds, group.fileIds) ||
+      !isDeepStrictEqual(payload.files, canonical.files)) return fallback('incomplete-edit-scope');
+  const combined = instructions + '\n' + INTERACTION_RISK_INSTRUCTIONS;
+  // Exactly the same retrieval envelope and native/text wire policy as execution.
+  const budget = initialInputBudget({ instructions: combined, input: prepared.payload,
+    ...(options.nativeOutputTools !== undefined ? { nativeOutputTools: options.nativeOutputTools } : {}) }, scope, maxInputBytes);
+  return budget.fits ? { mode: 'inline', decision, instructions: combined, budget, planningCalls: 0 }
+    : fallback('input-budget');
+}
+
+/** Separate optional hypotheses from the unchanged final findings envelope.
+ * Malformed stage JSON still throws; missing/invalid optional risks never do.
+ * No arbitrary exception message or untrusted hypothesis text enters limitations.
+ */
+export function consumeInteractionRisks(response, snapshot, group, catalog = []) {
+  // The stage transport already bounds the complete response. Do not reject a
+  // sound findings envelope just because optional risks exceed their own limit.
+  const decoded = typeof response === 'string' ? JSON.parse(response) : structuredClone(response);
+  if (!decoded || typeof decoded !== 'object' || Array.isArray(decoded)) throw new Error('Invalid interaction response');
+  const { risks, ...rest } = decoded;
+  if (!Object.hasOwn(decoded, 'risks')) return { response: rest, risk: { status: 'absent', method: 'inline', risks: [],
+    reason: 'optional-risks-missing', limitation: '交互内联风险未返回；保留可独立校验的发现，未补发规划。' } };
+  try {
+    const canonical = canonicalInteraction(snapshot, group);
+    if (!canonical) throw new Error('Inexact interaction');
+    const hypotheses = validateRiskPlan({ risks }, canonical.files, catalog);
+    if (hypotheses.some(risk => new Set(risk.editRefs.map(ref => ref.fileId)).size < 2)) throw new Error('Single-file hypothesis');
+    return { response: rest, risk: { status: 'completed', method: 'inline', reason: 'inline-interaction', risks: hypotheses } };
+  } catch {
+    return { response: rest, risk: { status: 'invalid', method: 'inline', risks: [], reason: 'optional-risks-invalid',
+      limitation: '交互内联风险无效；保留可独立校验的发现，风险不作为证据，未补发规划。' } };
+  }
+}

package/src/migration-contracts.mjs

@@ -0,0 +1,160 @@
+import { changeMap } from './change-map.mjs';
+import { createRetrievalScope } from './retrieval-scope.mjs';
+import { inferImportRelations } from './import-relations.mjs';
+import { inferCppRelations } from './cpp-relations.mjs';
+import { buildReviewGroups } from './review-groups.mjs';
+import { cppMigrationBindings } from './cpp-migration-bindings.mjs';
+
+const NOTICE = 'Conservative syntax navigation only; not semantic migration, call reachability, authorization, read coverage or causality proof.';
+const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+
+// Deliberately reject unsupported lexical constructs instead of treating comments,
+// strings or overloaded/template syntax as executable bindings.
+function functions(text, cpp) {
+  if (typeof text !== 'string' || Buffer.byteLength(text) > 256 * 1024 || /[\x60]|\/\*|\\\r?\n/.test(text)) return [];
+  const lines = text.split('\n'), found = [];
+  if (cpp && lines.some(line => /^\s*#\s*(?:if|ifdef|ifndef|elif|else|endif|define|undef)\b/.test(line))) return [];
+  for (let i = 0; i < lines.length; i++) {
+    const match = cpp ? /^\s*(?:(?:inline|static)\s+)*(?:void|bool|int|auto)\s+([A-Za-z_]\w*)\s*\([^;{}]*\)\s*\{\s*$/.exec(lines[i])
+      : /^\s*export\s+(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\([^;{}]*\)\s*\{\s*$/.exec(lines[i]);
+    if (!match) continue;
+    let depth = 1, end;
+    for (let j = i + 1; j < lines.length; j++) {
+      // Braces inside strings/comments must not fabricate an enclosing function.
+      const plain = lines[j].replace(/\/\/.*$/, '');
+      if (/['"\x60\/]/.test(plain)) break;
+      for (const char of plain) { if (char === '{') depth++; else if (char === '}') depth--; }
+      if (depth === 0) { end = j + 1; break; }
+      if (depth < 0) break;
+    }
+    if (end) found.push({ symbol: match[1], start: i + 1, end });
+  }
+  return found.filter(f => found.filter(other => other.symbol === f.symbol).length === 1).slice(0, 100);
+}
+
+/** Pure host navigation over one approved fixed snapshot. No I/O or model calls. */
+export function buildMigrationContracts(snapshot, { maxContracts = 32, maxGroupFiles = 4 } = {}) {
+  if (!snapshot || typeof snapshot.id !== 'string' || !Array.isArray(snapshot.files) || snapshot.files.length > 200 ||
+      !Number.isSafeInteger(maxContracts) || maxContracts < 1 || maxContracts > 100 ||
+      !Number.isSafeInteger(maxGroupFiles) || maxGroupFiles < 1 || maxGroupFiles > 20) throw new Error('Invalid migration contract input');
+  const result = { contracts: [], groups: [], links: [], limitations: [NOTICE] };
+  if (snapshot.projectScope || snapshot.files.some(f => f.reviewMode === 'project')) { result.limitations.push('Project comparison has no approved old/new migration baseline.'); return result; }
+  const catalog = createRetrievalScope(snapshot).catalog(), byId = new Map(snapshot.files.map(f => [f.id, f]));
+  const contexts = catalog.filter(s => !s.fileId).map(s => ({ id: '@migration-context:' + s.id, source: s,
+    item: snapshot.context.find(c => c.path === s.path) }));
+  if (contexts.some(c => byId.has(c.id))) throw new Error('Migration context identity collision');
+  const contextIds = new Map(contexts.map(c => [c.id, c]));
+  const maps = new Map(snapshot.files.filter(f => f.eligibility === 'reviewable').map(f => [f.id, changeMap(f.left.text, f.right.text)]));
+  const source = (id, side) => contextIds.get(id)?.source ?? catalog.find(s => s.fileId === id && s.side === side);
+  const graph = { old: [], new: [] }, definitions = new Map();
+  const unresolved = new Set();
+  for (const side of ['old', 'new']) {
+    // Distinct path indices: an old import must never resolve using the new path.
+    const entries = snapshot.files.map(f => ({ ...f, path: side === 'old' ? f.oldPath ?? f.path : f.path, oldPath: undefined,
+      left: { text: '' }, right: { text: (side === 'old' ? f.left : f.right)?.text ?? '' } }));
+    const sideContexts = contexts.filter(c => side === 'old' ? c.source.side === 'context-old' : c.source.side === 'context');
+    if (entries.length + sideContexts.length <= 200) for (const c of sideContexts) entries.push({ id: c.id, path: c.source.path,
+      eligibility: 'reviewable', left: { text: '' }, right: { text: side === 'old' ? c.item.oldText : c.item.text } });
+    else unresolved.add('Context caller navigation exceeds relation budget; selected-file chains only.');
+    const paths = new Map();
+    for (const f of entries) { const row = paths.get(f.path) ?? []; row.push(f); paths.set(f.path, row); }
+    const unique = entries.map(f => ({ ...f, eligibility: paths.get(f.path).length > 1 ? 'blocked' : f.eligibility }));
+    // Duplicate paths cannot be passed to the relation helpers; retain a blocked competitor.
+    const indexed = [...paths.values()].map(rows => rows.length === 1 ? unique.find(f => f.id === rows[0].id) : { ...rows[0], eligibility: 'blocked' });
+    for (const f of unique.filter(f => f.eligibility === 'reviewable')) {
+      const cpp = /\.(?:c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(f.path);
+      definitions.set(side + ':' + f.id, functions(f.right.text, cpp));
+    }
+    const classNavigation = cppMigrationBindings(indexed.map(f => ({ id: f.id, path: f.path, eligibility: f.eligibility,
+      text: f.right.text, source: source(f.id, side) ?? { id: 'unavailable', side } })));
+    for (const def of classNavigation.definitions) definitions.get(side + ':' + def.fileId)?.push(def);
+    graph[side].push(...classNavigation.bindings);
+    for (const limitation of classNavigation.limitations) unresolved.add(limitation);
+    const imports = inferImportRelations(indexed).filter(e => e.side === 'new' && e.bindingHints?.length);
+    for (const edge of imports) for (const binding of edge.bindingHints) {
+      if (binding.declarationKind !== 'function') continue;
+      graph[side].push({ from: edge.from, to: edge.to, importLine: binding.importLine, callLine: binding.callLine, symbol: binding.imported, declarationLine: binding.declarationLine });
+    }
+    const cppIncludes = inferCppRelations(indexed).filter(e => e.side === 'new' && e.specifier);
+    for (const f of indexed.filter(f => f.eligibility === 'reviewable' && /\.(?:c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(f.path))) {
+      const defs = definitions.get(side + ':' + f.id) ?? [];
+      if (!defs.length) continue;
+      const lines = f.right.text.split('\n');
+      for (const [i, line] of lines.entries()) {
+        const call = /^\s*([A-Za-z_]\w*)\s*\([^;"'{}\/]*\)\s*;\s*$/.exec(line);
+        if (!call || defs.some(d => d.symbol === call[1]) || !defs.some(d => i + 1 > d.start && i + 1 < d.end)) continue;
+        // A parameter/local alias/using declaration can shadow the included name.
+        // Keep only direct calls as its other token occurrences, never guess scope.
+        const token = new RegExp('(^|[^A-Za-z0-9_])' + call[1] + '(?=[^A-Za-z0-9_]|$)');
+        if (lines.some(line => token.test(line) && !/^\s*#\s*include\b/.test(line) &&
+          !new RegExp('^\\s*' + call[1] + '\\s*\\([^;\"\'{}\\/]*\\)\\s*;\\s*$').test(line))) continue;
+        const targets = cppIncludes.filter(e => e.from === f.id).flatMap(e => (definitions.get(side + ':' + e.to) ?? [])
+          .filter(d => d.symbol === call[1]).map(d => ({ edge: e, def: d })));
+        if (targets.length !== 1) { unresolved.add('Unresolved C++ direct call identity at ' + f.path + ':L' + (i + 1) + ' (' + side + ').'); continue; }
+        const { edge, def } = targets[0];
+        graph[side].push({ from: f.id, to: edge.to, importLine: edge.line, callLine: i + 1, symbol: def.symbol, declarationLine: def.start });
+      }
+    }
+  }
+  const role = (id, side, def) => {
+    const file = byId.get(id), map = maps.get(id), src = source(id, side);
+    if (!file || !src || map?.precision !== 'exact' || !def) return undefined;
+    const edits = map.edits.filter(e => e[side].count > 0 && e[side].start <= def.end && e[side].start + e[side].count - 1 >= def.start);
+    if (!edits.length || edits.length > 50) return undefined;
+    return { fileId: id, sourceId: src.id, side, path: side === 'old' ? file.oldPath ?? file.path : file.path,
+      sourcePath: src.path, symbol: def.symbol, line: Math.max(def.start, edits[0][side].start), declarationLine: def.start,
+      editId: edits[0].id, editIds: edits.map(e => e.id) };
+  };
+  const caller = (edge, side) => {
+    const src = source(edge.from, side), file = byId.get(edge.from), map = maps.get(edge.from);
+    return { ...(file ? { fileId: edge.from } : {}), sourceId: src.id, side: src.side, sourcePath: src.path,
+      path: file ? side === 'old' ? file.oldPath ?? file.path : file.path : src.path,
+      line: edge.callLine, callLine: edge.callLine, importLine: edge.importLine, targetFileId: edge.to, targetSymbol: edge.symbol,
+      editIds: map?.precision === 'exact' ? map.edits.filter(e => e[side].count > 0 && edge.callLine >= e[side].start && edge.callLine < e[side].start + e[side].count).map(e => e.id) : [] };
+  };
+  for (const side of ['old', 'new']) if (graph[side].length > 2000) {
+    graph[side] = graph[side].slice(0, 2000);
+    unresolved.add('Migration call navigation limit reached; remaining bindings unresolved.');
+  }
+  const seen = new Set();
+  for (const bridge of graph.new) {
+    const enclosing = (definitions.get('new:' + bridge.from) ?? []).filter(d => bridge.callLine > d.start && bridge.callLine < d.end);
+    if (enclosing.length !== 1) continue;
+    // A new entry calls the existing public entry, or the old entry now delegates
+    // to a new entry. Neither direction proves where a guard moved.
+    for (const [oldId, newId, newDef, publicSymbol] of [[bridge.to, bridge.from, enclosing[0], bridge.symbol],
+      [bridge.from, bridge.to, (definitions.get('new:' + bridge.to) ?? []).find(d => d.start === bridge.declarationLine), enclosing[0].symbol]]) {
+      const oldCalls = graph.old.filter(e => e.to === oldId && e.symbol === publicSymbol && e.from !== newId);
+      for (const oldCall of oldCalls) {
+        const oldDef = (definitions.get('old:' + oldId) ?? []).find(d => d.start === oldCall.declarationLine);
+        const oldRole = role(oldId, 'old', oldDef), newRole = role(newId, 'new', newDef);
+        if (!oldRole || !newRole || oldId === newId) continue;
+        const key = JSON.stringify([oldId, oldRole.symbol, newId, newRole.symbol]);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        if (result.contracts.length >= maxContracts) { unresolved.add('Migration contract limit reached; additional chains remain unresolved.'); continue; }
+        const oldCallerPath = source(oldCall.from, 'old')?.path;
+        const newCalls = graph.new.filter(e => e.to === oldId && e.symbol === publicSymbol && (e.from === oldCall.from ||
+          contextIds.has(e.from) && contextIds.has(oldCall.from) && source(e.from, 'new')?.path === oldCallerPath));
+        const callers = [caller(oldCall, 'old'), ...newCalls.slice(0, 10).map(e => caller(e, 'new')), caller(bridge, 'new')];
+        const pending = newCalls.length ? [] : ['Old caller has no independently resolved new-side binding.'];
+        result.contracts.push({ id: 'mc' + (result.contracts.length + 1), snapshotId: snapshot.id, candidateFileIds: [oldId, newId],
+          old: [oldRole], new: [newRole], callers, sourceIds: [...new Set([oldRole.sourceId, newRole.sourceId, ...callers.map(c => c.sourceId)])],
+          status: 'navigation-only', causality: 'unverified', unresolved: pending,
+          navigationBindings: [...new Map([...(oldDef.navigation ? [oldDef.navigation] : []),
+            ...(newDef.navigation ? [newDef.navigation] : []), ...(oldCall.navigationBindings ?? []),
+            ...newCalls.flatMap(e => e.navigationBindings ?? []), ...(bridge.navigationBindings ?? [])]
+            .map(row => [JSON.stringify(row), row])).values()] });
+      }
+    }
+  }
+  for (const contract of result.contracts) contract.sourceIds = [...new Set([...contract.sourceIds, ...contract.navigationBindings.map(row => row.sourceId)])];
+  const edges = result.contracts.flatMap(c => [{ from: c.old[0].fileId, to: c.new[0].fileId, reason: 'migration-contract:' + c.id },
+    ...c.callers.filter(row => row.fileId && row.fileId !== row.targetFileId).map(row => ({ from: row.fileId, to: row.targetFileId, reason: 'migration-caller:' + c.id }))]);
+  const involved = new Set(edges.flatMap(e => [e.from, e.to]));
+  const grouped = buildReviewGroups(snapshot.files.filter(f => involved.has(f.id)), edges, { maxFiles: maxGroupFiles });
+  result.groups = grouped.groups; result.links = grouped.links;
+  result.limitations.push(...[...unresolved].sort(cmp).slice(0, 100));
+  if (!result.contracts.length) result.limitations.push('No complete, unambiguous, changed old-entry/new-entry/caller syntax chain resolved.');
+  return result;
+}

package/src/migration-regression.mjs

@@ -0,0 +1,103 @@
+import { changeMap } from './change-map.mjs';
+import { contextSources } from './context-identity.mjs';
+import { hash } from './content.mjs';
+
+const contexts = new WeakSet();
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const overlap = (ref, range) => range?.count > 0 && ref.start < range.start + range.count && range.start < ref.start + ref.count;
+const fail = () => { throw new Error('Invalid approved migration regression contract'); };
+const freeze = value => { if (value && typeof value === 'object') { for (const item of Object.values(value)) freeze(item); Object.freeze(value); } return value; };
+
+// Compile host navigation against the exact approved snapshot. No model-provided
+// contract object or copied input metadata can replace this invocation capability.
+export function prepareMigrationRegression(snapshot, scope, contracts, candidates) {
+  if (!snapshot || typeof snapshot.id !== 'string' || snapshot.projectScope || snapshot.files?.some(file => file.reviewMode === 'project') || !Array.isArray(snapshot.files) || !Array.isArray(contracts) || contracts.length > 100 || !Array.isArray(candidates)) fail();
+  const catalog = scope.catalog();
+  const role = (value, expectedSide) => {
+    if (!value || typeof value.sourceId !== 'string') fail();
+    const matches = catalog.filter(source => source.id === value.sourceId);
+    if (matches.length !== 1) fail();
+    const source = matches[0];
+    if (source.path !== (value.sourcePath ?? value.path) || source.side !== value.side || source.fileId !== value.fileId || expectedSide && !(expectedSide === 'old' ? ['old', 'context-old'] : ['new', 'context']).includes(source.side)) fail();
+    let body, edits = [];
+    if (source.fileId) {
+      const file = snapshot.files.find(file => file.id === source.fileId && file.path === source.path && file.eligibility === 'reviewable');
+      if (!file || !['old', 'new'].includes(source.side) || value.path !== (source.side === 'old' ? file.oldPath ?? file.path : file.path)) fail();
+      body = (source.side === 'old' ? file.left : file.right)?.text;
+      if (!Array.isArray(value.editIds) || value.editIds.length > 50 || new Set(value.editIds).size !== value.editIds.length || expectedSide && !value.editIds.length) fail();
+      if (value.editIds.length) {
+        const changes = changeMap(file.left.text, file.right.text);
+        const side = expectedSide ?? source.side;
+        if (changes.status !== 'changed' || changes.precision !== 'exact') fail();
+        edits = value.editIds.map(id => {
+          const edit = changes.edits.find(edit => edit.id === id);
+          if (!edit || edit[side].count < 1) fail();
+          return { fileId: file.id, editId: edit.id, range: edit[side] };
+        });
+      }
+    } else {
+      const item = snapshot.context?.find(item => item.path === source.path);
+      if (!item || value.path !== source.path || !Array.isArray(value.editIds) || value.editIds.length) fail();
+      body = contextSources(item, snapshot.history).find(item => item.side === source.side)?.text;
+    }
+    const line = value.line ?? value.callLine;
+    if (typeof body !== 'string' || !positive(line) || line > source.lineCount || value.importLine !== undefined && (!positive(value.importLine) || value.importLine > source.lineCount) || edits.length && !edits.some(edit => line >= edit.range.start && line < edit.range.start + edit.range.count)) fail();
+    return { sourceId: source.id, side: source.side, path: value.path, sourcePath: source.path, ...(source.fileId ? { fileId: source.fileId } : {}), line, hash: hash(body), edits };
+  };
+  const ids = new Set(), compiled = [];
+  for (const contract of contracts) {
+    if (!contract || typeof contract.id !== 'string' || !contract.id || contract.id.length > 200 || ids.has(contract.id) || contract.snapshotId !== snapshot.id || contract.status !== 'navigation-only' || contract.causality !== 'unverified' || !Array.isArray(contract.callers) || contract.callers.length > 32) fail();
+    ids.add(contract.id);
+    if (!Array.isArray(contract.old) || contract.old.length !== 1 || !Array.isArray(contract.new) || contract.new.length !== 1 || !Array.isArray(contract.candidateFileIds)) fail();
+    const oldValue = contract.old[0], newValue = contract.new[0];
+    const old = role(oldValue, 'old'), current = role(newValue, 'new');
+    if (!old.fileId || !current.fileId || old.fileId === current.fileId || old.sourceId === current.sourceId || !old.edits.length || !current.edits.length) fail();
+    const callers = contract.callers.map(caller => {
+      const result = role(caller);
+      if (!['old', 'new', 'context-old', 'context'].includes(result.side) || caller.targetFileId !== oldValue.fileId && caller.targetFileId !== newValue.fileId) fail();
+      return result;
+    });
+    // The navigation chain has an explicit old-entry caller; a new-role source
+    // alone cannot manufacture a migration relation between arbitrary files.
+    if (!contract.callers.some(caller => caller.targetFileId === oldValue.fileId && ['old', 'context-old'].includes(caller.side))) fail();
+    const fileIds = [...new Set([old.fileId, current.fileId].filter(Boolean))];
+    if (new Set(contract.candidateFileIds).size !== contract.candidateFileIds.length || contract.candidateFileIds.length !== fileIds.length || contract.candidateFileIds.some(id => !fileIds.includes(id))) fail();
+    compiled.push({ id: contract.id, snapshotId: snapshot.id, old, new: current, callers, candidateFileIds: fileIds });
+  }
+  const context = freeze({ snapshotId: snapshot.id, contracts: compiled, candidates: structuredClone(candidates) });
+  contexts.add(context);
+  return context;
+}
+
+export function migrationRegressionMetadata(context) {
+  if (!contexts.has(context)) fail();
+  return context.contracts.map(contract => ({ ...structuredClone(contract), old: [structuredClone(contract.old)], new: [structuredClone(contract.new)], status: 'navigation-only', causality: 'unverified' }));
+}
+
+export function validateMigrationRegression(value, evidence, fileId, context, candidateId) {
+  if (!contexts.has(context) || typeof value.migrationContractId !== 'string') fail();
+  const contract = context.contracts.find(contract => contract.id === value.migrationContractId && contract.candidateFileIds.includes(fileId));
+  const candidate = context.candidates.find((candidate, index) => candidate.fileId === fileId && (!candidateId || candidateId === 'c' + (index + 1)));
+  if (!contract || !candidate || candidate.attribution?.status !== 'references-validated' || !Array.isArray(candidate.attribution.editIds)) fail();
+  const ownRoles = [contract.old, contract.new].filter(role => role.fileId === fileId);
+  if (!ownRoles.some(role => role.edits.some(edit => candidate.attribution.editIds.includes(edit.editId) && candidate.anchor?.kind === 'line' && candidate.anchor.side === (role.side === 'old' ? 'old' : 'new') && overlap({ start: candidate.anchor.start, count: candidate.anchor.end - candidate.anchor.start + 1 }, edit.range)))) fail();
+  let actualEdit = false;
+  for (const [field, edge, sides] of [['oldEvidence', contract.old, ['old', 'context-old']], ['newEvidence', contract.new, ['new', 'context']]]) {
+    const indices = value[field];
+    if (!Array.isArray(indices) || indices.length > 8 || new Set(indices).size !== indices.length) fail();
+    let entry = false;
+    for (const index of indices) {
+      if (!Number.isSafeInteger(index) || index < 0 || index >= evidence.length) fail();
+      const ref = evidence[index];
+      const binding = [edge, ...contract.callers.filter(role => sides.includes(role.side))].find(role => role.sourceId === ref.sourceId && sides.includes(role.side));
+      if (!binding || ref.status !== 'references-validated' || ref.snapshotId !== context.snapshotId || ref.hash !== binding.hash || !positive(ref.start) || !positive(ref.count) || binding !== edge && !(ref.start <= binding.line && binding.line < ref.start + ref.count)) fail();
+      if (binding === edge && ref.start <= edge.line && edge.line < ref.start + ref.count) {
+        entry = true;
+        if (edge.edits.some(edit => overlap(ref, edit.range))) actualEdit = true;
+      }
+    }
+    if (value.classification !== 'uncertain' && !entry) throw new Error('Migration comparison requires both explicit entry roles');
+  }
+  if (value.classification !== 'uncertain' && !actualEdit) throw new Error('Migration comparison requires actual changed-role evidence');
+  return { ...value, oldEvidence: [...value.oldEvidence], newEvidence: [...value.newEvidence], migrationContractId: contract.id, migrationSnapshotId: context.snapshotId, status: 'comparison-references-validated', causality: 'unverified' };
+}

package/src/model-contract.mjs

@@ -9,11 +9,11 @@ const INTERACTION_CONTRACT = '本阶段返回 {"findings":[],"limitations":[]}
 const FINDINGS_CONTRACT = '本阶段最终返回 {"findings":[],"limitations":[]}。每项finding必须含fileId、severity（critical/high/medium/low）、title、evidence、trigger、impact、suggestion和anchor；fileId原样复制file.id，不用文件名替代。行定位写成 anchor:{kind:"line",side:"new",start:1,end:1,snippet:"逐行原文"}（仅为形状示例，不是证据）；start/end用原来源一基行号而非窗口内序号，精确匹配原行；old/new按当前阶段允许侧选择，示例不改变授权；仅当没有retrievalFinalization且仍有检索余量时，需要更多证据可按检索协议先返回requests。';
 
 function stageContract(p, instructions) {
-  if (Array.isArray(p.candidates)) return VERDICT_CONTRACT;
+  if (Array.isArray(p.candidates)) return VERDICT_CONTRACT + (Array.isArray(p.migrationContracts) && p.migrationContracts.length ? ' 若明确按宿主migrationContracts跨文件比较，regression仅在原classification/reason/oldEvidence/newEvidence之外附带migrationContractId；必须逐字来自本次宿主contract.id，不允许模型声明新的contract、source授权或角色。缺边证据保留uncertain；未启用时仍按原同主文件规则。' : '');
   if (/返回\{groups:/.test(instructions)) return GROUPS_CONTRACT;
   if (/仅制定审查计划/.test(instructions)) return instructions.includes(RISK_PLAN_SCHEMA) ? '本阶段严格按上述risks schema返回，禁止requests/findings；身份逐项核对输入。' : RISK_CONTRACT;
-  if (p.sourceMode === 'group-primary') return '本阶段返回{reviews:[{fileId,findings:[],limitations:[],risks:可选数组}],limitations:[]}；每项fileId仅来自reviews[].file.id，按文件原始坐标审查，不将分组自动视为交互证据。可按批准检索协议单独返回requests。';
-  if (p.sourceMode === 'file-interaction') return INTERACTION_CONTRACT;
+  if (p.sourceMode === 'group-primary') return '本阶段返回{reviews:[{fileId,findings:[],limitations:[],risks:可选数组}],limitations:[]}；每项fileId仅来自reviews[].file.id，按文件原始坐标审查，不将分组自动视为交互证据。可按批准检索协议单独返回requests。' + (p.groupInteraction ? ' 根结果可附带可选interactions:{groupId,findings:[],limitations:[]}，groupId严格来自groupInteraction.groupId；只有本次实际read覆盖各成员编辑并通过交互校验才替代独立交互阶段。缺失/非法交互不抹主审结果且保留独立阶段；reviews成员不能夹带interaction发现。' : '');
+  if (p.sourceMode === 'file-interaction') return INTERACTION_CONTRACT + (instructions.includes('INLINE_INTERACTION_RISKS') ? ' 可同时返回risks数组，风险schema与原指令一致；风险是假设而非已确认发现，不代替交互证据。' : '');
   if (p.file) return FINDINGS_CONTRACT;
   return '';
 }

package/src/model-tools.mjs

@@ -34,11 +34,13 @@ export function modelResultStage(input, instructions = '') {
 export function modelResultTools(input, instructions = '') {
   const stage = modelResultStage(input, instructions);
   if (!stage) return [];
+  let p; try { p = JSON.parse(input); } catch { return []; }
+  const migrationIds = Array.isArray(p.migrationContracts) ? p.migrationContracts.map(contract => contract?.id).filter(id => typeof id === 'string' && id.length > 0 && id.length <= 200).slice(0, 128) : [];
+  const regression = migrationIds.length ? object({ classification: { enum: ['introduced', 'preexisting', 'uncertain'] }, reason: text, oldEvidence: array({ type: 'integer', minimum: 0 }), newEvidence: array({ type: 'integer', minimum: 0 }), migrationContractId: { type: 'string', maxLength: 200, enum: [...new Set(migrationIds)] } }, ['classification', 'reason', 'oldEvidence', 'newEvidence']) : { type: 'object' };
   const final = stage === 'findings' ? review : stage === 'risks' ? object({ risks: array(risk) }) :
     stage === 'groups' ? object({ groups: array(object({ fileIds: strings, reason: { type: 'string' } })) }) :
-    stage === 'reviews' ? object({ reviews: array(object({ fileId: { type: 'string' }, findings, limitations: strings, risks: array(risk) }, ['fileId', 'findings', 'limitations'])), limitations: strings }) :
-    object({ verdicts: array(object({ candidateId: text, verdict: { enum: ['supported', 'refuted', 'uncertain'] }, reason: text, evidence: array({ type: 'object' }), regression: { type: 'object' } }, ['candidateId', 'verdict', 'reason', 'evidence'])) });
-  let p; try { p = JSON.parse(input); } catch { return []; }
+    stage === 'reviews' ? object({ reviews: array(object({ fileId: { type: 'string' }, findings, limitations: strings, risks: array(risk) }, ['fileId', 'findings', 'limitations'])), limitations: strings, ...(p.groupInteraction ? { interactions: object({ groupId: { const: p.groupInteraction.groupId }, findings, limitations: strings }) } : {}) }, ['reviews', 'limitations']) :
+    object({ verdicts: array(object({ candidateId: text, verdict: { enum: ['supported', 'refuted', 'uncertain'] }, reason: text, evidence: array({ type: 'object' }), regression }, ['candidateId', 'verdict', 'reason', 'evidence'])) });
   const parameters = p.retrievalFinalization || stage === 'risks' || stage === 'groups' ? final : { type: 'object', oneOf: [final, requests] };
   return [{ name: RESULT_TOOL_NAME, description: 'Submit only the current approved review stage result or approved retrieval requests as JSON data. Does not execute actions.', parameters }];
 }
@@ -52,7 +54,7 @@ export function validateNativeResult(text, input, instructions) {
   const p = JSON.parse(input);
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
   if (Object.hasOwn(value, 'requests')) return !p.retrievalFinalization && !['risks', 'groups'].includes(stage) && Object.keys(value).length === 1 && Array.isArray(value.requests);
-  const allowed = stage === 'findings' ? ['findings', 'limitations', 'risks'] : stage === 'reviews' ? ['reviews', 'limitations'] : [stage];
+  const allowed = stage === 'findings' ? ['findings', 'limitations', 'risks'] : stage === 'reviews' ? ['reviews', 'limitations', ...(p.groupInteraction ? ['interactions'] : [])] : [stage];
   const required = stage === 'findings' ? ['findings', 'limitations'] : stage === 'reviews' ? ['reviews', 'limitations'] : [stage];
   return !!stage && Object.keys(value).every(k => allowed.includes(k)) && required.every(k => Array.isArray(value[k]));
 }

package/src/primary-seeds.mjs

@@ -65,13 +65,17 @@ export function primarySeeds(scope, request, { maxInputBytes = 96 * 1024, onRetr
     if (attempted.size >= MAX_READS) break;
     if (seeds.some(item => item.request.id === source.id && item.result.start <= coordinate && coordinate < item.result.start + item.result.count)) continue;
     const budget = scope.budget();
-    if (budget.remainingCalls <= RESERVE_CALLS || budget.remainingOutputBytes <= RESERVE_BYTES) break;
+    if (budget.remainingOutputBytes <= RESERVE_BYTES) break;
     const operation = { kind: 'read', id: source.id, start: Math.max(1, coordinate - 4), count: MAX_LINES };
     const key = JSON.stringify(operation);
     if (attempted.has(key)) continue;
     attempted.add(key);
     let item;
     try {
+      // A cached raw delivery costs no new materialization call, but still uses
+      // output bytes and must pass the exact operation's approved preflight.
+      const cached = budget.reusableResults === true && scope.preflight([operation])?.calls === 0 && scope.canServe?.([operation]) === true;
+      if (!cached && budget.remainingCalls <= RESERVE_CALLS) continue;
       item = scope.transaction(() => {
         checkSignal();
         scope.preflight([operation]);
@@ -79,7 +83,7 @@ export function primarySeeds(scope, request, { maxInputBytes = 96 * 1024, onRetr
         checkSignal();
         const next = retrievalRequest(request, scope, [...seeds, { request: operation, result }]);
         const remaining = scope.budget();
-        if (result.start + result.count <= coordinate || remaining.remainingCalls < RESERVE_CALLS || remaining.remainingOutputBytes < RESERVE_BYTES || (request.nativeOutputTools === true ? !modelWireBudget(next, maxInputBytes).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) > maxInputBytes)) throw optionalError();
+        if (result.start + result.count <= coordinate || (!cached && remaining.remainingCalls < RESERVE_CALLS) || remaining.remainingOutputBytes < RESERVE_BYTES || (request.nativeOutputTools === true ? !modelWireBudget(next, maxInputBytes).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) > maxInputBytes)) throw optionalError();
         return { request: operation, result };
       });
     } catch (error) {