@feng0531/dsh-code-review 0.87.0 → 0.87.1

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.87.1 — 修复阶段续审缓存中断
+
+- 主审、窗口归因和续审导入从同一批准原文重建包络坐标；包络仍不表示精确编辑或回归因果。
+- 阶段生成先校验再进入缓存，单条拒绝或容量不足不污染已保存记录、不再在文件收尾中止整任务；当前发现与独立复核保留。
+- 组成员、组级和宿主限制按组合后的有界数量保存，单次模型响应仍最多50条；续审不继承旧复核回执。
+- 续审导出总容量不足时仅保存适配的完整记录并披露省略数量，不中止当前审查；非法导入、取消及真实落盘错误不被容量退化吞掉。
+
 ## 0.87.0 — 连续取证、迁移契约与阶段续审
 
 - 当前阶段按批准来源重新投递有限相关正文，交互风险可内联；未送入模型不计证据，缓存仍扣字节，独立复核使用新回执。

package/RELEASE-NOTES.md

@@ -1,27 +1,21 @@
-# v0.87.0 发布说明
+# v0.87.1 发布说明
 
 使用方式见 [README](README.md)，历史变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。
 
-## 减少重复建立上下文，保留证据边界
+## 修复阶段续审中断
 
-变更审查把此前实际交付过的相关片段，经当前阶段 reader 重新读取并有限投递；输入不适配、已知调用否决、取消或失败时，不留下孤立预算或虚假读取。缓存命中仍计算投递字节，复核回执重新签发。精确适配的交互单元可以内联风险问题，缺失或非法可选风险不会抹去合法发现，也不会隐藏补发规划。
+修复 v0.87.0 中主审已接受的结果被续审缓存再次拒绝，并在文件收尾扩大为整个任务中止的问题。主审、窗口归因及续审校验现从同一批准原文重建大文件包络坐标；包络仍只是保守区域，不代表精确编辑或回归因果。
 
-报告把结论摘要与发现放在逐文件覆盖和诊断前。确认新增须满足独立复核与旧新对照引用校验；仅 supported、缺比较或未完成复核仍列未决，未完成范围保留。
+组成员与组级限制合并后按宿主有界结果保存；模型成员及组级响应各自最多50条的限制不变。阶段生成先校验再入缓存，拒绝或容量不足不污染此前有效记录，也不省略当前候选的独立复核。不能继续的候选明确保持未完成，不通过重新生成掩盖失败。
 
-## 迁移链与组交互
+## 续审容量与安全边界
 
-新增宿主生成的旧入口→新入口→调用方契约导航，分别解析旧新来源并保留跨组联系；不以同名／相似度认定迁移。跨文件回归复核仅接受契约限定的批准来源、精确编辑及本次独立证据，不放开任意跨文件引用。C++ 线索支持字面 include、唯一类声明／类外定义和明确接收者；重载、继承、虚分派、宏与复杂别名仍保守拒绝。
+续审导出超过总字节或节点容量时，按完整记录保留适配部分，披露未保存数量；不截断发现或假装已保存全部进度。省略主审或完整文件链时不继承相关继续状态。未保存部分在后续新授权审查中重新执行。
 
-精确完整组可附带可选交互结果，只有当前代真实读取覆盖所有成员编辑并通过引用验收，才替代完全匹配的专门交互生成。缺失、非法或缺证据时保留合法主审并回退；候选独立复核不省略。预览披露条件性节省与回退成本，不承诺固定调用量。
+批准快照、身份与原始坐标校验仍严格。非法导入、伪造窗口和属性、访问器等不安全数据继续拒绝；旧复核回执不作为新证据。真实落盘错误及用户取消不被容量退化吞掉。
 
-## 有界继续与配置
+## 验证与交付
 
-阶段额度不足可让出，其他阶段释放后有限继续；不抢活动份额、不扩大根预算、不重置原截止或调用账，无进展仍 pending／partial。schema2 续审检查点仅复用身份匹配的已接受 primary 生成；综合、交互和候选复核从新安全边界进入，旧回执不作为新证据。仍需新预览、确认与授权。
+新增实际执行回归覆盖包络窗口开启／关闭阶段继续、非空候选、51／101条合法合并限制、缓存拒绝后继续处理其他文件、断点复用主审但重新独立复核，以及容量、取消和落盘失败。修复冻结验收完整回归1249项：1245通过、0失败、4跳过；关键组合66/66通过，宿主离线smoke通过。这些不是业务项目重跑或真实模型质量、速度保证。
 
-六项开关 enableEvidenceContext、inlineInteractionRisks、enableMigrationContracts、enableMigrationRegression、enableGroupInteractions、enableStageContinuation 在生产变更入口默认 true，底层和直接 service 默认 false，可逐项关闭。项目模式不启用后四项，保留原批次与续审协议。
-
-## 验证与发布边界
-
-受控离线夹具覆盖开关实际调用对照、原生／文本预算、无效可选通道回退、新回执、取消回滚及续审配置绑定。它们验证机制，不是用户业务重跑，也不证明真实模型召回、速度或成本。增量多轮早停、多轮／窗口组主审、推理记忆压缩和安全检索模式仍未实现，见 [能力清单](CORE-ALIGNMENT-TASKS.md)。
-
-正式交付仍须完成冻结标签 Ubuntu／Windows × Node.js22／24 四矩阵及 Actions、npm、GitHub Release 原始安装包逐字节与校验清单核验。本说明不是已发布或已安装声明；发布不会自动升级或重启当前 DSH。
+正式发布还须通过该版本冻结标签 Ubuntu／Windows × Node.js22／24 四矩阵，并核验 Actions、npm 与 GitHub Release 的同一原始安装包及校验清单。发布不会自动安装、升级或重启当前 DSH。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.87.0",
+  "version": "0.87.1",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/primary-input.mjs

@@ -1,6 +1,5 @@
 import { sourceSegments } from './source-segments.mjs';
 import { primaryContextFocus } from './primary-context.mjs';
-import { changeRegion } from './change-region.mjs';
 import { CONTEXT_SIDE_NOTICE } from './context-identity.mjs';
 import { approvedCallerBindings } from './caller-binding-input.mjs';
 import { REQUIREMENT_NOTICE } from './business-requirement.mjs';
@@ -12,7 +11,7 @@ import { inferContextRelations } from './context-relations.mjs';
 import { prepareWindowSynthesis } from './window-synthesis.mjs';
 import { planWindowBatches } from './window-batches.mjs';
 import { changeWindows } from './change-windows.mjs';
-import { changeMap } from './change-map.mjs';
+import { reviewChangeMap } from './review-change-map.mjs';
 import { initialInputBudget } from './input-budget.mjs';
 import { changeScopeNotice } from './git-change-scope.mjs';
 import { chooseRiskStrategy, riskPlanningMode as validateRiskPlanningMode } from './risk-strategy.mjs';
@@ -25,18 +24,7 @@ const optional = h => h.confidence === 'namespace-member-syntax-only' || h.confi
 export function preparePrimaryInput(input, file, { instructions, scope, grouping, maxInputBytes, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, round, focusPrimaryContext = false }) {
   validateRiskPlanningMode(riskPlanningMode);
   if (typeof focusPrimaryContext !== 'boolean') throw new Error('focusPrimaryContext must be boolean');
-  let changes = changeMap(file.left.text, file.right.text);
-  if (changes.status === 'limited') {
-    const region = changeRegion(file.left.text, file.right.text);
-    if (region.status === 'changed') {
-      changes = {
-        status: 'changed', precision: 'envelope',
-        reason: 'Exact diff unavailable; broad region includes potentially unchanged lines, not exact edits or causal proof.',
-        edits: [{ id: 'envelope1', old: region.old, new: region.new }],
-        hunks: [{ id: 'envelope-h1', old: region.old, new: region.new, editIds: ['envelope1'] }],
-      };
-    }
-  }
+  const changes = reviewChangeMap(file.left.text, file.right.text);
 
   let base = {
     ...(input.projectScope ? { projectScope: input.projectScope, reviewNotice: 'Full current-file review; empty left is a sentinel, not a historical baseline. changes are transport coordinates only, do not infer introduced regression.' } : {}),

package/src/review-change-map.mjs

@@ -0,0 +1,17 @@
+import { changeMap } from './change-map.mjs';
+import { changeRegion } from './change-region.mjs';
+
+// Canonical review transport coordinates, recomputed solely from approved source.
+// An envelope is a bounded broad region, never an exact edit or causal proof.
+export function reviewChangeMap(before, after) {
+  const changes = changeMap(before, after);
+  if (changes.status !== 'limited') return changes;
+  const region = changeRegion(before, after);
+  if (region.status !== 'changed') return changes;
+  return {
+    status: 'changed', precision: 'envelope',
+    reason: 'Exact diff unavailable; broad region includes potentially unchanged lines, not exact edits or causal proof.',
+    edits: [{ id: 'envelope1', old: region.old, new: region.new }],
+    hunks: [{ id: 'envelope-h1', old: region.old, new: region.new, editIds: ['envelope1'] }],
+  };
+}

package/src/review-resume.mjs

@@ -9,11 +9,18 @@ const digest = value => hash(JSON.stringify(canonical(value)));
 const MAX_BYTES = 8 * 1024 * 1024;
 const stageEnabled = options => options?.execution?.enableStageContinuation === true || options?.enableStageContinuation === true;
 const invalid = () => { throw new Error('Invalid stage resume checkpoint'); };
+// Private export-only sentinel: never infer capacity from an arbitrary error/code.
+class ResumeStorageCapacityError extends Error {
+  constructor() { super('Resume checkpoint exceeds storage capacity'); this.code = 'RESUME_STORAGE_CAPACITY_EXCEEDED'; }
+}
+const capacity = mode => { if (mode === 'export') throw new ResumeStorageCapacityError(); if (mode !== 'scan') invalid(); };
+export const RESUME_CHECKPOINT_CAPACITY_LIMITATION = '续审检查点容量受限：仅保存适配容量的完整历史单元，未保存部分将重新执行；不影响本次发现或授予证据权限。';
 const exact = (value, keys) => { if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(k => !keys.includes(k))) invalid(); };
 const RECEIPT_KEYS = new Set(['receiptId', 'receipts', 'retrievalAudit', 'retrieved', 'resolveEvidence']);
-function privateClone(value, { stripReceipts = false } = {}, seen = new Set(), depth = 0, budget = { nodes: 0, bytes: 0 }) {
-  if (++budget.nodes > 300000 || depth > 32) invalid();
-  if (typeof value === 'string') { budget.bytes += Buffer.byteLength(value); if (budget.bytes > MAX_BYTES) invalid(); return value; }
+function privateClone(value, { stripReceipts = false, capacityMode } = {}, seen = new Set(), depth = 0, budget = { nodes: 0, bytes: 0 }) {
+  if (depth > 32) invalid();
+  if (++budget.nodes > 300000) capacity(capacityMode);
+  if (typeof value === 'string') { budget.bytes += Buffer.byteLength(value); if (budget.bytes > MAX_BYTES) capacity(capacityMode); return value; }
   if (value === null || typeof value === 'boolean' || typeof value === 'number' && Number.isFinite(value)) return value;
   if (!value || typeof value !== 'object' || seen.has(value) || ![Object.prototype, Array.prototype, null].includes(Object.getPrototypeOf(value))) invalid();
   if (Array.isArray(value) && (value.length > 100000 || Object.keys(value).length !== value.length)) invalid();
@@ -26,11 +33,57 @@ function privateClone(value, { stripReceipts = false } = {}, seen = new Set(), d
     // Imported checkpoints remain JSON-only and reject undefined explicitly.
     if (stripReceipts && !Array.isArray(value) && d.value === undefined) continue;
     if (RECEIPT_KEYS.has(key)) { if (stripReceipts) continue; invalid(); }
-    out[key] = privateClone(d.value, { stripReceipts }, seen, depth + 1, budget);
+    out[key] = privateClone(d.value, { stripReceipts, capacityMode }, seen, depth + 1, budget);
   }
   seen.delete(value);return out;
 }
-function bounded(value) { if (Buffer.byteLength(JSON.stringify(value)) > MAX_BYTES) invalid(); return value; }
+function bounded(value, capacityMode) { if (Buffer.byteLength(JSON.stringify(value)) > MAX_BYTES) capacity(capacityMode); return value; }
+
+function exportWithinCapacity(value) {
+  const cloned = bounded(privateClone(value, { stripReceipts: true, capacityMode: 'export' }), 'export');
+  // Accepted-stage import has a stricter aggregate node budget than the wrapper.
+  const stageBudget = { nodes: 0, bytes: 0 };
+  privateClone(cloned.stageGenerations, { capacityMode: 'export' }, new Set(), 0, stageBudget);
+  if (stageBudget.nodes > 200000) throw new ResumeStorageCapacityError();
+  return cloned;
+}
+function capacityFits(value) {
+  try { exportWithinCapacity(value); return true; }
+  catch (error) { if (error instanceof ResumeStorageCapacityError) return false; throw error; }
+}
+function boundedExport(result, report, snapshot) {
+  // Every unit has already passed structural and semantic checks before admission.
+  // Only the serialized storage/node aggregate may degrade; unknown errors escape.
+  if (capacityFits(result)) return prepareV2(exportWithinCapacity(result), snapshot);
+  const next = { schemaVersion: 2, snapshotId: result.snapshotId, identityHash: result.identityHash, completed: [], interactions: [], stageGenerations: [] };
+  exportWithinCapacity(next); // Even an unusable identity shell must fail normally.
+  const omitted = { completed: 0, stageGenerations: 0, interactions: 0, continuation: 0, businessGrouping: 0 };
+  for (const row of result.completed) {
+    const candidate = { ...next, completed: [...next.completed, row] };
+    if (capacityFits(candidate)) next.completed.push(row); else omitted.completed++;
+  }
+  if (result.businessGrouping !== undefined) {
+    if (capacityFits({ ...next, businessGrouping: result.businessGrouping })) next.businessGrouping = result.businessGrouping; else omitted.businessGrouping++;
+  }
+  for (const row of result.stageGenerations) {
+    if (capacityFits({ ...next, stageGenerations: [...next.stageGenerations, row] })) next.stageGenerations.push(row); else omitted.stageGenerations++;
+  }
+  if (result.continuation !== undefined) {
+    // Historical continuation cannot imply completion for a dropped primary unit.
+    if (!omitted.stageGenerations && !omitted.completed && capacityFits({ ...next, continuation: result.continuation })) next.continuation = result.continuation; else omitted.continuation++;
+  }
+  const kept = new Set(next.completed.map(row => row.fileId));
+  for (const row of result.interactions) {
+    if (row.fileIds.every(id => kept.has(id)) && capacityFits({ ...next, interactions: [...next.interactions, row] })) next.interactions.push(row); else omitted.interactions++;
+  }
+  const limitation = { code: 'RESUME_CHECKPOINT_CAPACITY_EXCEEDED', text: RESUME_CHECKPOINT_CAPACITY_LIMITATION, omitted };
+  report.resumeLimitations ??= [];
+  const previous = report.resumeLimitations.findIndex(row => row.code === limitation.code);
+  if (previous < 0) report.resumeLimitations.push(limitation); else report.resumeLimitations[previous] = limitation;
+  report.limitations ??= [];
+  if (!report.limitations.some(row => row.text === limitation.text)) report.limitations.push({ text: limitation.text });
+  return prepareV2(exportWithinCapacity(next), snapshot);
+}
 function continuationState(snapshot, wrapper) {
   exact(wrapper, ['options', 'state']);
   const o = wrapper.options, cp = wrapper.state;
@@ -60,7 +113,28 @@ const safeFile = file => !file?.stageFailures?.length && !file?.reviewPasses?.so
 // neither source authority nor model approval. Exact whole-snapshot binding is
 // deliberately conservative: any changed context/rule/source invalidates reuse.
 export function buildResumeState(snapshot, options, report) {
-  if (typeof snapshot?.id !== 'string' || !Array.isArray(snapshot.files) || !report || !Array.isArray(report.files) || !Array.isArray(report.findings)) throw new Error('Invalid resume checkpoint');
+  if (typeof snapshot?.id !== 'string' || !Array.isArray(snapshot.files) || !report || typeof report !== 'object') throw new Error('Invalid resume checkpoint');
+  if (stageEnabled(options)) {
+    // Scan the entire export payload before any filtering/size admission. Unlike
+    // imports this scan records no storage entitlement, but never executes hooks.
+    if (![Object.prototype, null].includes(Object.getPrototypeOf(report))) invalid();
+    const noticeDescriptor = Object.getOwnPropertyDescriptor(report, 'resumeLimitations');
+    if (noticeDescriptor && (!noticeDescriptor.enumerable || !Object.hasOwn(noticeDescriptor, 'value') || !Array.isArray(noticeDescriptor.value))) invalid();
+    const keys = ['files', 'findings', 'limitations', 'interactions', 'businessGrouping', 'stageGenerations', 'continuationOptions', 'continuation', 'resumeLimitations'];
+    const candidate = {};
+    for (const key of keys) {
+      const descriptor = Object.getOwnPropertyDescriptor(report, key);
+      if (descriptor) { if (!descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) invalid(); candidate[key] = descriptor.value; }
+    }
+    const safe = privateClone(candidate, { stripReceipts: true, capacityMode: 'scan' });
+    // Preserve mutation target only for explicit capacity notices below.
+    return buildStageResumeState(snapshot, options, safe, report);
+  }
+  return buildStageResumeState(snapshot, options, report, report);
+}
+
+function buildStageResumeState(snapshot, options, report, noticeTarget) {
+  if (!Array.isArray(report.files) || !Array.isArray(report.findings)) throw new Error('Invalid resume checkpoint');
   const approved = new Map(snapshot.files.filter(file => file.eligibility === 'reviewable').map(file => [file.id, file]));
   const completed = [];
   for (const state of report.files) {
@@ -81,9 +155,21 @@ export function buildResumeState(snapshot, options, report) {
   const result = { schemaVersion: 1, snapshotId: snapshot.id, identityHash: identity, completed, ...(businessGrouping ? { businessGrouping } : {}), interactions };
   if (stageEnabled(options)) {
     result.schemaVersion = 2;
-    result.stageGenerations = prepareStageGenerations(snapshot, report.stageGenerations ?? []).filter(row => row.phase === 'primary' && !completed.some(item => item.fileId === row.fileId));
-    if (report.continuation !== undefined) result.continuation = continuationState(snapshot, privateClone({ options: report.continuationOptions, state: report.continuation }));
-    return prepareV2(bounded(privateClone(result, { stripReceipts: true })), snapshot);
+    const stageKeys = new Set();
+    result.stageGenerations = (report.stageGenerations ?? []).flatMap(record => {
+      const [row] = prepareStageGenerations(snapshot, [record]);
+      if (stageKeys.has(row.key)) invalid(); stageKeys.add(row.key);
+      return row.phase === 'primary' && !completed.some(item => item.fileId === row.fileId) ? [row] : [];
+    });
+    if (report.continuation !== undefined) result.continuation = continuationState(snapshot, { options: report.continuationOptions, state: report.continuation });
+    // Check every completed chain, including units later omitted for capacity.
+    for (const item of completed) {
+      const file = approved.get(item.fileId);
+      if (!file || !safeFile(item.state) || item.state.fileId !== item.fileId || item.state.path !== item.path ||
+          !Array.isArray(item.findings) || item.findings.some(f => f?.fileId !== item.fileId || f.verification?.status !== 'completed') ||
+          !Array.isArray(item.limitations) || item.limitations.some(row => row?.fileId !== item.fileId)) throw new Error('Invalid completed resume chain');
+    }
+    return boundedExport(result, noticeTarget, snapshot);
   }
   if (Buffer.byteLength(JSON.stringify(result)) > 8 * 1024 * 1024) throw new Error('Resume checkpoint exceeds storage limit');
   return result;

package/src/review-stage-state.mjs

@@ -1,11 +1,15 @@
 import { hash } from './content.mjs';
 import { changeMap } from './change-map.mjs';
+import { reviewChangeMap } from './review-change-map.mjs';
 import { changeWindows } from './change-windows.mjs';
 import { sourceSegments } from './source-segments.mjs';
 import { validateWindowFindings } from './window-findings.mjs';
 import { validateAttribution } from './attribution.mjs';
 
 const LIMIT = 8 * 1024 * 1024;
+// Host-only accepted generation: member model 50 + group model 50 + host notes 2.
+// This is checkpoint/report metadata, never a wider model response or evidence grant.
+export const MAX_STAGE_LIMITATIONS = 102;
 const PHASES = ['primary', 'window-synthesis', 'file-interaction'];
 const DROP = ['verification', 'regression', 'priorRun', 'retrievalAudit', 'receipts', 'receiptId'];
 const fail = () => { throw Object.assign(new Error('Invalid accepted stage generation'), { code: 'INVALID_STAGE_GENERATION' }); };
@@ -71,6 +75,7 @@ function normalizeFinding(raw, file, changes, phase, files) {
     if (raw.attribution?.status === 'missing' && Object.keys(raw.attribution).some(k => !['status', 'causality'].includes(k))) fail();
     attribution = validateAttribution(value, { ...file, properties: file.properties ?? [] }, changes);
     if (raw.attribution?.status !== undefined && raw.attribution.status !== attribution.status) fail();
+    for (const key of ['precision', 'notice', 'causality']) if (raw.attribution?.[key] !== undefined && raw.attribution[key] !== attribution[key]) fail();
   }
   const result = { fileId: file.id, path: file.path, severity: raw.severity, anchor, attribution };
   for (const key of ['title', 'evidence', 'trigger', 'impact', 'suggestion']) result[key] = raw[key];
@@ -120,8 +125,8 @@ export function prepareStageGenerations(snapshot, records, { maxBytes = LIMIT, v
     seen.add(key);
     exact(record.generation, ['findings', 'limitations', ...DROP]);
     const g = record.generation;
-    if (!Array.isArray(g.findings) || g.findings.length > 50 || !Array.isArray(g.limitations) || g.limitations.length > 50 || g.limitations.some(s => !text(s))) fail();
-    const changes = changeMap(file.left.text, file.right.text);
+    if (!Array.isArray(g.findings) || g.findings.length > 50 || !Array.isArray(g.limitations) || g.limitations.length > MAX_STAGE_LIMITATIONS || g.limitations.some(s => !text(s))) fail();
+    const changes = reviewChangeMap(file.left.text, file.right.text);
     const findings = g.findings.map(raw => {
       if (raw.reviewRound !== undefined && raw.reviewRound !== round) fail();
       return normalizeFinding(raw, file, changes, phase, files);

package/src/review.mjs

@@ -36,7 +36,9 @@ import { createEvidenceContext } from './evidence-context.mjs';
 import { prepareInteractionRisk, consumeInteractionRisks } from './interaction-risk.mjs';
 import { reportSummaryMarkdown } from './report-summary.mjs';
 import { validateGroupInteraction } from './group-interaction.mjs';
-import { stageKey, prepareStageGenerations } from './review-stage-state.mjs';
+import { stageKey } from './review-stage-state.mjs';
+import { createStageGenerationCache } from './stage-generation-cache.mjs';
+import { reviewChangeMap } from './review-change-map.mjs';
 import { createStageContinuation } from './stage-continuation.mjs';
 import { buildMigrationContracts } from './migration-contracts.mjs';
 
@@ -54,7 +56,7 @@ function validateResponse(response, file, knownChanges) {
   if (Buffer.byteLength(typeof response === 'string' ? response : JSON.stringify(response) ?? '') > 128 * 1024) throw new Error('Review response too large');
   if (typeof response === 'string') response = JSON.parse(response);
   if (!response || !Array.isArray(response.findings) || response.findings.length > 50 || !Array.isArray(response.limitations) || response.limitations.length > 50 || response.limitations.some(s => !nonempty(s))) throw protocolError('MODEL_INVALID_REVIEW_RESPONSE', 'Invalid review response');
-  const changes = knownChanges ?? changeMap(file.left.text, file.right.text);
+  const changes = knownChanges ?? reviewChangeMap(file.left.text, file.right.text);
   const findings = response.findings.map(raw => {
     if (!raw || raw.fileId !== file.id) throw protocolError('MODEL_INVALID_FINDING_IDENTITY', 'Invalid finding identity or severity');
     if (!['critical', 'high', 'medium', 'low'].includes(raw.severity)) throw protocolError('MODEL_INVALID_FINDING_SEVERITY', 'Invalid finding identity or severity');
@@ -189,11 +191,12 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
       } });
   };
   const groupPrepared = new Map(), groupResults = new Map(), groupStarted = new Map(), groupInteractions = new Map();
-  const acceptedStages = new Map(prepareStageGenerations(input, options.resumeState?.stageGenerations ?? []).filter(record => record.phase === 'primary').map(record => [record.key, { generation: record.generation, record, restored: true }]));
+  const generationCache = createStageGenerationCache(input, options.resumeState?.stageGenerations ?? []);
+  const acceptedStages = new Map(generationCache.records().filter(record => record.phase === 'primary').map(record => [record.key, { generation: record.generation, record, restored: true }]));
   const deferredStages = [], yieldedUnits = new Set(), fileDeadlines = new Map(), primaryStageKeys = new Map();
   const checkpointStages = () => {
     if (!options.enableStageContinuation) return;
-    report.stageGenerations = prepareStageGenerations(input, [...acceptedStages.values()].map(entry => entry.record).filter(record => record?.phase === 'primary'));
+    report.stageGenerations = generationCache.records().filter(record => record.phase === 'primary');
   };
   let readerAllocation;
   const stageScope = id => readerAllocation
@@ -357,9 +360,10 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         const key = stageKey(file.id, { phase: batch.interaction ? 'file-interaction' : batch.synthesis ? 'window-synthesis' : 'primary', round: batch.round, windowIds: batch.windowIds ?? [], ...(batch.interaction ? { groupId: batch.interaction.id } : {}) });
         const priorStage = acceptedStages.get(key);
         if (retry && priorStage?.completed) return;
+        let cacheRejected = false;
         const allocationId = batch.interaction ? 'interaction:' + batch.interaction.id : batch.synthesis ? 'synthesis:' + file.id : 'primary:' + file.id;
         const defer = (error, unitId = allocationId) => {
-          if (!options.enableStageContinuation || !readerAllocation || !['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code)) return false;
+          if (cacheRejected || !options.enableStageContinuation || !readerAllocation || !['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code)) return false;
           if (!yieldedUnits.has(unitId)) { readerAllocation.yield(unitId, { reason: error.code }); yieldedUnits.add(unitId); }
           let pending = deferredStages.find(item => item.key === key);
           if (pending && pending.allocationId !== unitId) { const previousUnit = pending.allocationId; pending.allocationId = unitId; if (!deferredStages.some(other => other !== pending && !other.done && other.allocationId === previousUnit)) { yieldedUnits.delete(previousUnit); readerAllocation.release(previousUnit); } }
@@ -521,8 +525,15 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if(rounds>1)generated.findings.forEach(f=>{f.reviewRound=batch.round;});
         if (options.enableStageContinuation && !priorStage && !state.retrievalLimited) {
           const record = { key, fileId: file.id, phase, round: batch.round, windowIds: batch.windowIds ?? [], ...(batch.interaction ? { groupId: batch.interaction.id } : {}), generation: { findings: structuredClone(generated.findings), limitations: structuredClone(generated.limitations) } };
-          acceptedStages.set(key, { generation: generated, record, completed: false });
-          checkpointStages();
+          const admission = generationCache.admit(record);
+          if (admission.accepted) {
+            acceptedStages.set(key, { generation: generated, record: admission.record, completed: false });
+            checkpointStages();
+          } else {
+            cacheRejected = true;
+            (state.stageCacheLimits ??= []).push({ phase, round: batch.round, code: admission.code });
+            result.limitations.push({ fileId: file.id, text: '阶段生成未纳入续审缓存：' + admission.code + '；保留本次有效审查结果和独立复核，不复用未缓存生成、不扩大容量。' });
+          }
         }
         for (const finding of generated.findings) { const index = priorStage ? result.findings.findIndex(existing => existing.id === finding.id) : -1; if (index < 0) result.findings.push(finding); else result.findings[index] = finding; }
         if (generated.findings.some(f => f.attribution.status === 'missing')) result.limitations.push({ fileId: file.id, text: '部分发现缺少变更归因，仅校验了定位，尚不能确认属于本次回归' });
@@ -530,7 +541,13 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (!groupedGeneration && !scheduled.slice(batchIndex + 1).some(next => !next.synthesis && !next.interaction)) releaseStage('primary:' + file.id);
         if (options.enableStageContinuation && !batch.interaction && !batch.synthesis && state.windowCoverage && batch.round === 1) { state.windowCoverage.completed = [...new Set([...state.windowCoverage.completed, ...batch.windowIds])]; state.windowCoverage.pending = state.windowCoverage.pending.filter(id => !batch.windowIds.includes(id)); }
         if (options.enableVerification === true && generated.findings.length && !priorStage?.completed) {
-          if (yieldedUnits.has('verification:' + file.id)) { defer(Object.assign(new Error('Verification allocation is waiting for released capacity'), { code: 'READER_CALL_BUDGET_EXCEEDED' }), 'verification:' + file.id); return; }
+          if (yieldedUnits.has('verification:' + file.id)) {
+            if (!defer(Object.assign(new Error('Verification allocation is waiting for released capacity'), { code: 'READER_CALL_BUDGET_EXCEEDED' }), 'verification:' + file.id)) {
+              for (const finding of generated.findings) finding.verification = { status: 'incomplete', causality: 'unverified' };
+              result.limitations.push({ fileId: file.id, text: '复核额度等待释放且生成未缓存，不能继续本阶段；候选仍未复核，不重新生成或标为完成。' });
+            }
+            return;
+          }
           for (const finding of generated.findings) finding.verification = { status: 'pending', causality: 'unverified' };
           try {
             activeStage = 'verification';

package/src/stage-generation-cache.mjs

@@ -0,0 +1,22 @@
+import { prepareStageGenerations } from './review-stage-state.mjs';
+
+// Only host-validated generations enter this cache. Failed admission leaves the
+// last good set unchanged; imported checkpoints still fail closed in the validator.
+export function createStageGenerationCache(snapshot, records = [], { maxBytes = 8 * 1024 * 1024 } = {}) {
+  let saved = prepareStageGenerations(snapshot, records, { maxBytes });
+  return {
+    records() { return structuredClone(saved); },
+    admit(record) {
+      let normalized;
+      try { [normalized] = prepareStageGenerations(snapshot, [record]); }
+      catch { return { accepted: false, code: 'STAGE_CACHE_RECORD_REJECTED' }; }
+      const next = saved.filter(row => row.key !== normalized.key);
+      next.push(normalized);
+      let checked;
+      try { checked = prepareStageGenerations(snapshot, next, { maxBytes }); }
+      catch { return { accepted: false, code: 'STAGE_CACHE_CAPACITY_EXCEEDED' }; }
+      saved = checked;
+      return { accepted: true, record: structuredClone(normalized) };
+    },
+  };
+}