@feng0531/dsh-code-review 0.87.4 → 0.87.6

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.87.6 — 迁移复核成套取证
+
+- 复用宿主已校验的迁移契约，为匹配候选有界预取旧入口、旧委托实现和新入口；同套证据原子接纳，容量、预算或输入不满足时回退普通检索，减少模型重新寻找已知路径的往返。
+- 保留共享总账、独立新回执、最终原文复验与迁移分类限制；成套预取成功不等于模型已调用或候选成立。诊断区分预取接纳和回退，不记录源码。
+- 优化按同任务直接审核对照耗时、具体触发链、最小修复建议、覆盖与可读性；本版离线回归不代表真实业务审核已经提速或确认既往候选。
+
+## 0.87.5 — 主审优先与依赖感知续审
+
+- 先完成所有文件的主审扫描，再执行跨窗口／跨文件综合，避免后续分析在尚有文件未主审时抢先消耗模型调用；继续保留有限续跑、原截止时间和完整覆盖分母。
+- 读取恢复按当前真实就绪阶段排队，跳过依赖未满足的队头；首次精确请求可利用自身保留额度或缓存恢复，不释放其他阶段保留额、不重置总账或检索轮数。
+- 跟进取证输入超限时只移除重复初始源码正文，保留精确编辑、风险／调用线索与已交付证据回执；避免大文件重复正文挤掉新读证据。
+- 未完成原因从阶段关联回文件和报告，保留依赖、分配等待、超时、调用上限与尝试状态；一个阶段受限不再阻止其他健康阶段保留生成。仍受限时明确 partial，不把评论、候选或报告收尾当作审核完成。
+
 ## 0.87.4 — 默认交付人能读懂的审核报告
 
 - 默认主文先给是否查完、问题卡、未完成原因和下一步；完整证据与执行台账移到同一报告折叠附录，不要求使用者手动拼接批次。

package/DEVELOPMENT.md

@@ -24,14 +24,26 @@
 - `confirmed:true` 是 Agent 对当前人类明确授权且本次预览匹配的声明，不是取消确认参数或无授权绕过。保留 preview→execute 两阶段与 service 确认参数，不新增一键执行 API；宿主／会话工具权限、模型发送许可、快照新鲜度、会话／目录／路由身份及预算校验均不变。
 - 源变化、预览过期或身份变化须生成新 preview 并重新核对当前授权，不能将旧预览批准用于新快照。保存的后台记录、`resumeFromJobId`、自动续跑及 host 重启本身都不授予外发权限；显式续审须有当前人类授权和新预览，匹配时无需重复询问。私有模型工件的源码提示与独立明确同意要求保持不变。
 
+## 同任务质量与效率对照
+
+每轮优化以相同固定范围、模型和尽量相同运行条件下的直接 Agent 审核作参照，分开记录用户请求到交付、工具执行和审查阶段墙钟，不将并发累计调用时间当作墙钟。比较具体触发条件、新旧入口行为、反证、最小可行动建议、主审／跨文件覆盖和默认报告可读性。直接审核结论也需证据核验，不作为绝对真值；合成响应只验证协议与接线，不证明模型召回或真实提速。测试不复制私有业务源码或模型工件。
+
 ## 变更审查调度与离线对照
 
 生产 changes 服务默认 `changesConcurrency=2`，配置范围 1～4；底层 `reviewSnapshot` 未传该选项时保持串行兼容。所有文件共用原批准快照 reader，不能按 worker 重置额度。业务分组先完成，交互 owner 等待此前成员链结束；窗口、轮次与复核仍串行依赖，固定索引归并结果。取消或 checkpoint 失败必须先排空所有在途链再释放锁。
 
-`maxRetrievalRounds` 默认 3、范围 0～50；主审/综合/复核分别使用该轮数上限，独立风险规划为一次待证问题生成而非检索对话，保留最终答复回合与 partial/uncertain。复核预取仅来自本次 reader 的候选同侧锚点范围，受输入/输出和最终校验预留约束；缺少事务、超预算或非行锚点回退普通检索，不信任模型自报证据。全范围风险计划仅限本次不可变文件调用内复用，规划元数据超过输入预算回退原窗口；预览与执行估算使用相同规划输入。
+`maxRetrievalRounds` 默认 3、范围 0～50；主审/综合/复核分别使用该轮数上限，独立风险规划为一次待证问题生成而非检索对话，保留最终答复回合与 partial/uncertain。复核预取来自本次 reader 的候选同侧锚点；对于匹配宿主已校验迁移契约的候选，优先原子预取完整旧入口、旧委托实现和新入口。全局仍限 8 次种子读取、16 KiB 和每次 200 行，受输入/输出及最终原文校验预留约束；角色不完整、缺事务或超预算回退普通检索，不信任模型自报契约或证据。预取接纳仅为宿主步骤，不代表已外发、已复核或已确认新增回归；删除导出路由仍仅允许 uncertain。全范围风险计划仅限本次不可变文件调用内复用，规划元数据超过输入预算回退原窗口；预览与执行估算使用相同规划输入。
 
 运行 `node scripts/changes-speed-benchmark.mjs [baseline-directory]` 比较真实 review 入口上的 8 文件 SVN 受控候选/反驳夹具，包含 receipt 复核与最终精确原文校验；每次模型响应模拟 20ms。可先将冻结版本的 src 解包到独立目录作为 baseline。比较调用数、峰值并发和原文证据，不把离线计时或 mock 结论一致当作真实质量、token 成本或 45→12 分钟保证。`model-start/model-end` 检查点只记录计时、字节、状态及阶段，不写入源码或推理；各文件 `modelMetrics` 是提供方实际调用（含纠错）累计时间，并行时不可相加当作墙钟耗时。
 
+### 主审优先与依赖感知恢复
+
+启用 `enableStageContinuation` 时，跨窗口／跨文件综合先登记为依赖阶段，待全体文件主审扫描后由 continuation 运行；独立复核可在主审链内进行，受限后进入同一有界队列。读取恢复传入完整当前 ready allocation IDs，跳过依赖未就绪队头但不释放其 floor；首次精确请求可无 release 尝试自身可负担成本，实际 admission 计次，同 revision 无进展不忙重试。未知成本的 scalar admission 仍要求容量释放，不声称它足以支付任意 verifier 预取。
+
+跟进输入超限时只瘦身重复的原始 source text，保留完整编辑／元数据和已读取证据；既有窗口／综合的元数据也不再为压缩而删除。原始输入、当前接收的证据、独立复核与历史复用保持不同信任层。阶段限制按当前生成判定，不用文件曾经受限的 sticky 标记阻止健康阶段缓存；文件总体受限和不完整窗口仍阻止完成。
+
+`continuation.units` 保存真实 pendingReason、依赖与尝试；报告按 fileIds 关联并在附录保留完整身份。模型额度、超时、依赖阻断和读取分配等待不互相冒充。预算仍有余额不保证所有保护中的阶段可运行，全体大请求超过各自 floor 时不偷取其他阶段保留额，仍保留 partial。
+
 ### 大上下文回归与纠正记账
 
 正式变更入口默认 `focusPrimaryContext:true`，纯准备阶段只附带直接关系、C#和调用方线索对应的完整批准上下文对象，序列化最多16KiB／输入四分之一，稳定原顺序保留新旧版本对象。其余来源保留批准目录按需读；不会因缺少检索能力隐藏正文。底层API默认false，设置false可回退。主文件、规则与需求不删减；即使旧输入能容纳整批上下文，也应用该附带上限。

package/README.md

@@ -239,9 +239,9 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 重启后可按原jobId读回保存记录，原运行标记interrupted，不自动继续外发。recovery给出已观察文件/窗口与未完成路径；它不是完整分母或新授权；宿主重启及自动恢复本身不授权外发，补审必须有当前明确授权并重新预览核对。新预览的runtime包含实际加载版本和模块位置，排查不同工作区时分别核对，不根据另一台机器推断。
 
-变更审查的独立文件链默认最多 2 条并行；配置 `changesConcurrency` 为 1～4（1 回退串行），跨文件综合等待相关前置主审结束。配置 `maxRetrievalRounds` 为 0～50，默认为 3，限制每阶段检索请求回合数（不是成功读取次数；非法请求也会消耗回合）（0 只允许最终答复）。配置不是 preview 参数，不改变模型或来源授权；并发仍共享同一份读取/调用预算，额度不足时完成顺序可能影响哪些任务未完成，不能保证与串行逐项结果相同。提供方限流时应降低并发。复核可预取批准快照中候选锚点附近的同侧原文，仍允许追加反证读取并逐字校验；不复用主审结论或其他会话凭据。完整变更计划可容纳时仅生成一次再分发到窗口，否则保留原分窗口计划并在预览估算中体现。
+变更审查的独立文件链默认最多 2 条并行；配置 `changesConcurrency` 为 1～4（1 回退串行），启用阶段续审时先扫描全体文件主审，再调度跨窗口／跨文件综合；恢复队列按真实依赖就绪情况排队，保留其他阶段的读取最低份额。配置 `maxRetrievalRounds` 为 0～50，默认为 3，限制每阶段检索请求回合数（不是成功读取次数；非法请求也会消耗回合）（0 只允许最终答复）。配置不是 preview 参数，不改变模型或来源授权；并发仍共享同一份读取/调用预算，额度不足时完成顺序可能影响哪些任务未完成，不能保证与串行逐项结果相同。提供方限流时应降低并发。复核可预取批准快照中候选锚点附近的同侧原文，仍允许追加反证读取并逐字校验；不复用主审结论或其他会话凭据。完整变更计划可容纳时仅生成一次再分发到窗口，否则保留原分窗口计划并在预览估算中体现。
 
-大文件超出单次输入时按原行号分段。精确差异算不出时使用明确标注的包络，可能包含未变行，不声称精确归因。完整结束但 JSON 语法无效时会按当前阶段 schema 最多请求两次明确纠正，记录额外调用；检索请求非法时整批不执行并明确纠正，回填采用可追溯的滚动工作集、必要时延后重复窗口正文，不虚构证据。主审与复核默认各最多 3 轮检索；到限后只允许最终答复，保留未完成范围，不把已用完预算当成审核通过。不会给错误输出补括号、猜字段或当成无缺陷。
+大文件超出单次输入时按原行号分段。精确差异算不出时使用明确标注的包络，可能包含未变行，不声称精确归因。完整结束但 JSON 语法无效时会按当前阶段 schema 最多请求两次明确纠正，记录额外调用；检索请求非法时整批不执行并明确纠正，回填采用可追溯的滚动工作集、必要时延后重复初始源码正文，保留精确编辑、风险／调用线索和已读证据回执，不虚构证据。主审与复核默认各最多 3 轮检索；到限后只允许最终答复，保留未完成范围，不把已用完预算当成审核通过。不会给错误输出补括号、猜字段或当成无缺陷。
 
 ### 显式续审与私有模型工件
 

package/RELEASE-NOTES.md

@@ -1,17 +1,17 @@
-# v0.87.4 发布说明
+# v0.87.6 发布说明
 
-## 默认报告先给人能读懂的结论
+## 让已知迁移路径更早成为本次复核证据
 
-默认输出不再把执行台账平铺为报告。仍只交付一份统一 Markdown：先说明是否查完、形成了什么问题记录，再按复核支持本次新增／当前源码问题、待核实、原有问题、已反驳分区，先讲触发条件、影响和建议。没有问题记录不等于没有缺陷，主审完成不等于可以放行。
+复核已能接收宿主校验的迁移契约，但此前默认种子只覆盖候选锚点附近，旧公开入口、旧委托实现与新入口仍需模型自行检索。本版为匹配候选增加有界成套取证，减少寻找已有导航坐标的往返；完整角色无法容纳时回退普通检索，不宣称已完成比较。
 
-未完成范围按原因和受影响条目聚合，区分单阶段检索轮数、读取分配或共享额度、输入预算和前置依赖。完整证据、逐项覆盖、计划、执行诊断和保留归属的限制放在同一报告的折叠技术附录；重复限制只集中显示一次原文，保留次数、差异字段及可重建的原记录。
+种子沿用同一批准快照和读取总账；保留最多 8 次读取、16 KiB 种子输入、每次最多 200 行及最终证据复验余量。同套读取采用事务，失败或取消不发布部分回执。每次复核重新签发回执，不能借用既往主审／复核证据身份。
 
-## 保留真实性与证据边界
+## 诊断与安全边界
 
-此修复仅改变本地呈现，不额外调用模型、不重新审核业务源码、不改变读取和执行预算、不放宽证据或新增归因校验。原始报告 JSON 保持完整。分页不足、取消、失败、过期、复用、窗口／复核／跨文件未完成仍明确披露；项目报告保留结论冲突的候选，SVN 历史不再误标为 Git。
+执行诊断记录迁移种子接纳／回退计数，不含源码正文；预取接纳不证明模型已调用，更不证明复核支持或新增因果成立。普通比较仍要求正确主文件与来源侧；跨文件仅限已校验契约，删除导出路由仍仅允许不确定归因。
 
-## 验证
+不增加模型调用额度、检索轮数、读取总额或并发；不降低复核证据门槛。未来同任务对照同时检查端到端与分段耗时、触发链、最小修复建议、覆盖及可读性，不能以减少调用或缩短报告代替质量提升。本版没有重新执行 r7364 真实模型审核，不承诺固定提速或确认两项既往候选。
 
-新增报告端到端、问题卡、限制聚合与安全转义测试，并使用保留归档中74条目、290限制、34跨文件未完成这一计数模式的合成呈现夹具回归。公开夹具不含原始路径、源码或限制正文；另在本地验证真实归档呈现，不是新的源码审核结论。发布以全量测试及四矩阵标签 CI 为门禁。
+## 验证与升级
 
-安装与使用见 [README](README.md)，历史变化见 [变更记录](CHANGELOG.md)，发布门禁见 [开发说明](DEVELOPMENT.md)。发布不自动安装或重启当前宿主。
+新增迁移成套种子、事务回退、新鲜回执及预算边界回归，并通过全量测试与冻结标签四矩阵 CI 后发布。发布不自动安装或重启当前宿主。安装见 [README](README.md)，门禁见 [开发说明](DEVELOPMENT.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.87.4",
+  "version": "0.87.6",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/migration-regression.mjs

@@ -128,6 +128,36 @@ export function migrationRegressionMetadata(context) {
   return context.contracts.map(contract => ({ ...structuredClone(contract), old: [structuredClone(contract.old)], new: [structuredClone(contract.new)], status: 'navigation-only', causality: 'unverified' }));
 }
 
+// Host-only read plans. The capability, candidate attribution and coordinates all
+// come from this compiler invocation, never from a later candidate/contract copy.
+export function migrationVerificationPlans(context) {
+  if (!contexts.has(context)) fail();
+  return context.candidates.map((candidate, index) => {
+    const candidateId = 'c' + (index + 1);
+    const matches = context.contracts.filter(contract => contract.candidateFileIds.includes(candidate.fileId) &&
+      candidate.attribution?.status === 'references-validated' && Array.isArray(candidate.attribution.editIds) &&
+      [contract.old, contract.new].some(role => role.fileId === candidate.fileId && role.edits.some(edit =>
+        candidate.attribution.editIds.includes(edit.editId) && candidate.anchor?.kind === 'line' &&
+        candidate.anchor.side === (role.side === 'old' ? 'old' : 'new') &&
+        positive(candidate.anchor.start) && positive(candidate.anchor.end) && candidate.anchor.end >= candidate.anchor.start &&
+        overlap({ start: candidate.anchor.start, count: candidate.anchor.end - candidate.anchor.start + 1 }, edit.range))));
+    const contract = matches[0];
+    if (!contract) return { candidateId, candidate, reason: 'NO_MATCHING_CONTRACT' };
+    const roles = [contract.old, contract.new, ...(contract.baseline ?? [])];
+    const identity = { candidateId, candidate, contractId: contract.id, kind: contract.kind ?? 'migration', rolesCount: roles.length };
+    if (roles.some(role => !positive(role.startLine) || !positive(role.endLine) || role.endLine < role.startLine)) return { ...identity, reason: 'INCOMPLETE_ROLE_RANGE' };
+    const requests = new Map();
+    for (const role of roles) {
+      for (let start = role.startLine; start <= role.endLine; start += 200) {
+        const request = { kind: 'read', id: role.sourceId, start, count: Math.min(200, role.endLine - start + 1) };
+        requests.set(JSON.stringify(request), request);
+        if (requests.size > 8) return { ...identity, reason: 'EVIDENCE_LIMIT' };
+      }
+    }
+    return { ...identity, requests: [...requests.values()] };
+  });
+}
+
 export function validateMigrationRegression(value, evidence, fileId, context, candidateId) {
   if (!contexts.has(context) || typeof value.migrationContractId !== 'string') fail();
   const contract = context.contracts.find(contract => contract.id === value.migrationContractId && contract.candidateFileIds.includes(fileId));

package/src/migration-verification-seeds.mjs

@@ -0,0 +1,90 @@
+import { createEvidenceReceipts } from './evidence-receipts.mjs';
+import { migrationVerificationPlans } from './migration-regression.mjs';
+
+const size = value => Buffer.byteLength(JSON.stringify(value));
+const key = request => JSON.stringify(request);
+const capacity = reason => Object.assign(new Error('Optional migration seed capacity exceeded'), { code: 'VERIFICATION_SEED_CAPACITY', reason });
+const optional = error => ['VERIFICATION_SEED_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code) || error?.message === 'Line range outside source';
+
+// No external plans are accepted: only the compiled context selects candidates.
+export function migrationVerificationSeeds(context, scope, { signal, fits, onReceipt = () => {}, onMigrationSeeds = () => {} }) {
+  signal?.throwIfAborted();
+  const plans = migrationVerificationPlans(context), catalog = scope.catalog();
+  const seeds = [], selected = new Map(), assignments = new Map();
+  const ordinary = candidate => {
+    const anchor = candidate.anchor;
+    if (anchor?.kind !== 'line' || !['old', 'new'].includes(anchor.side) || !Number.isSafeInteger(anchor.start) || !Number.isSafeInteger(anchor.end) || anchor.start < 1 || anchor.end < anchor.start) return [];
+    const sources = catalog.filter(source => source.fileId === candidate.fileId && source.side === anchor.side);
+    if (sources.length !== 1) return [];
+    const start = Math.max(1, anchor.start - 4);
+    return [{ kind: 'read', id: sources[0].id, start, count: Math.min(200, anchor.end - start + 5) }];
+  };
+  const notify = (plan, status, reason) => {
+    // Deliberately reconstruct a source-free allowlist, never spread a plan.
+    onMigrationSeeds({ candidateId: plan.candidateId, ...(plan.contractId ? { contractId: plan.contractId } : {}), kind: plan.kind ?? 'migration', status, reason, rolesCount: plan.rolesCount ?? 0 });
+    signal?.throwIfAborted();
+  };
+  const admit = (plan, requests, complete) => {
+    if (!requests.length || typeof scope.transaction !== 'function' || typeof scope.preflight !== 'function') throw capacity('TRANSACTION_UNAVAILABLE');
+    const fresh = requests.filter(request => !selected.has(key(request)));
+    if (seeds.length + fresh.length > 8) throw capacity('SEED_LIMIT');
+    const receipts = createEvidenceReceipts(scope.read, { limit: Math.max(1, fresh.length) });
+    const items = scope.transaction(() => {
+      signal?.throwIfAborted();
+      if (fresh.length) scope.preflight(fresh);
+      const items = fresh.map(request => {
+        const result = receipts.read(request);
+        signal?.throwIfAborted();
+        if (result.sourceId !== request.id || result.start !== request.start || !result.text || (complete ? result.count !== request.count : result.start + result.count <= plan.candidate.anchor.start)) throw capacity('INCOMPLETE_READ');
+        return { request, result };
+      });
+      const proposed = [...seeds, ...items], lookup = new Map(proposed.map(item => [key(item.request), item]));
+      const nextAssignments = new Map(assignments).set(plan.candidateId, requests.map(key));
+      // Reserve repeated candidates now, not after the first set has consumed
+      // headroom. Exact shared plans need no additional materialization call.
+      for (const other of plans) {
+        // A prior fallback does not limit what this candidate may reference from
+        // the globally visible role set admitted by a later candidate. Upgrade its
+        // reserve whenever its complete plan becomes available.
+        const completeReferences = other.requests?.map(key);
+        const references = completeReferences?.every(reference => lookup.has(reference)) ? completeReferences : nextAssignments.get(other.candidateId) ?? ordinary(other.candidate).map(key);
+        if (references.length && references.every(reference => lookup.has(reference))) nextAssignments.set(other.candidateId, references);
+      }
+      let calls = plans.length - nextAssignments.size, bytes = 0;
+      // Every candidate reference is a final delivery, even for shared cached
+      // results. EOF-clamped validation counts have their own exact cache key.
+      for (const references of nextAssignments.values()) for (const reference of references) {
+        const result = lookup.get(reference).result;
+        const cost = scope.preflight([{ kind: 'read', id: result.sourceId, start: result.start, count: result.count }]);
+        if (!Number.isSafeInteger(cost?.calls) || cost.calls < 0) throw capacity('FINAL_RESERVE');
+        calls += cost.calls;
+        bytes += size(result);
+      }
+      const budget = scope.budget?.();
+      if (budget && (budget.remainingCalls < calls || budget.remainingOutputBytes < bytes)) throw capacity('FINAL_RESERVE');
+      if (size(proposed) > 16 * 1024 || !fits(proposed)) throw capacity('INPUT_CAPACITY');
+      signal?.throwIfAborted();
+      return items;
+    });
+    for (const item of items) {
+      selected.set(key(item.request), item);
+      seeds.push(item);
+      onReceipt(item.result.receiptId, receipts.resolve);
+    }
+    assignments.set(plan.candidateId, requests.map(key));
+  };
+  for (const plan of plans) {
+    signal?.throwIfAborted();
+    let reason = plan.reason;
+    if (plan.requests) {
+      let accepted = false;
+      try { admit(plan, plan.requests, true); accepted = true; }
+      catch (error) { signal?.throwIfAborted(); if (!optional(error)) throw error; reason = error.reason ?? error.code ?? 'INCOMPLETE_READ'; }
+      if (accepted) { notify(plan, 'accepted', 'COMPLETE_ROLE_SET'); continue; }
+    }
+    notify(plan, 'fallback', reason ?? 'NO_MATCHING_CONTRACT');
+    try { admit(plan, ordinary(plan.candidate), false); }
+    catch (error) { signal?.throwIfAborted(); if (!optional(error)) throw error; }
+  }
+  return seeds;
+}

package/src/report-readability.mjs

@@ -5,12 +5,23 @@ const brief = value => { const text = String(value ?? ''); return escape(text.le
 const html = value => String(value).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 const stages = { primary: '主审', verification: '独立复核', synthesis: '综合', 'window-synthesis': '跨窗口综合', interaction: '跨文件综合' };
 const stage = value => Object.hasOwn(stages, value) ? stages[value] : String(value ?? '未标明阶段');
+const reasonKeys = ['failureCode', 'blockCode', 'code', 'reason', 'pendingReason'];
+const hasReason = record => typeof record === 'string' ? record !== '' : reasonKeys.some(key => record?.[key] != null && record[key] !== '');
+const unknownReason = label => /未知|原因未记录/.test(label);
+const unitKeys = ['id', 'kind', 'fileIds', 'dependencies', 'status', 'attempts', 'pendingReason', 'stopped'];
+const unitMetadata = unit => Object.fromEntries(unitKeys.filter(key => Object.hasOwn(unit ?? {}, key)).map(key => [key, unit[key]]));
 
 function reason(record = {}) {
-  const value = typeof record === 'string' ? record : record?.failureCode ?? record?.blockCode ?? record?.code ?? record?.reason;
+  const value = typeof record === 'string' ? record : record?.failureCode ?? record?.blockCode ?? record?.code ?? record?.reason ?? record?.pendingReason;
   const text = String(value ?? '');
   // Dependency state must not be relabelled as an input-budget failure.
   if (/dependenc|primary.*incomplete|member.*incomplete|prerequisite|依赖.*未完成|主审.*未完成/i.test(text)) return '依赖的主审或前置阶段未完成';
+  if (/STAGE_ATTEMPTS_EXHAUSTED/i.test(text)) return '阶段尝试次数达到上限（不等同于模型调用或读取额度耗尽）';
+  if (/STAGE_ALLOCATION_WAITING/i.test(text)) return '阶段等待读取分配（不代表总额度已耗尽）';
+  if (/STAGE_NO_PROGRESS/i.test(text)) return '阶段未取得进展而停止（未记录具体预算耗尽原因）';
+  if (/STAGE_INTERRUPTED/i.test(text)) return '阶段执行中断，尚待续审';
+  if (/STAGE_FAILED/i.test(text)) return '阶段执行失败';
+  if (/STAGE_TIMEOUT/i.test(text)) return '阶段执行超时';
   if (/RETRIEVAL_ROUND_BUDGET_EXCEEDED|检索轮数|retrieval.*round.*(budget|limit)/i.test(text)) return '单阶段检索轮数达到上限（读取额度可能仍有余量）';
   if (/READER_CALL_BUDGET_EXCEEDED|reader.*call.*(budget|limit)|读取调用.*(不足|耗尽|上限)/i.test(text)) return '阶段分配或共享读取调用次数不足';
   if (/READER_OUTPUT_BUDGET_EXCEEDED|reader.*output.*(budget|limit)|读取.*字节|输出字节/i.test(text)) return '阶段分配或共享读取输出字节预算不足';
@@ -23,19 +34,25 @@ function reason(record = {}) {
   return text ? '未知／其他原因（完整原文见附录）' : '原因未记录（未知；不推测为预算不足）';
 }
 
-function fileReasons(file, findings) {
+function fileReasons(file, findings, units = []) {
   const result = [];
   const limits = [...rows(file?.retrievalLimits), ...rows(file?.groupRetrievalLimits)];
   const failures = rows(file?.stageFailures);
-  const hasReason = record => record != null && ['failureCode', 'blockCode', 'code', 'reason'].some(key => record[key] != null && record[key] !== '');
+  // Compare phase-local evidence before rendering: a legacy unknown must not
+  // obscure a concrete continuation reason for that same stage. Raw values stay in the appendix.
+  const evidence = [...failures, ...limits, ...units.map(item => item.evidence)];
+  const phase = record => record?.phase ?? record?.stage ?? record?.kind;
+  const explained = record => unknownReason(reason(record)) && evidence.some(other => phase(record) != null && phase(other) === phase(record) && !unknownReason(reason(other)));
   if (['pending', 'blocked', 'failed', 'cancelled', 'running'].includes(file?.status)) {
     // A missing top-level code does not erase concrete phase/group evidence.
-    const evidence = hasReason(file) ? [file] : [...failures, ...limits].filter(hasReason);
-    result.push(...(evidence.length ? evidence : [file]).map(reason));
+    const causes = hasReason(file) && !explained(file) ? [file] : [...failures, ...limits].filter(record => hasReason(record) && !explained(record));
+    if (causes.length) result.push(...causes.map(reason));
+    else if (!units.length) result.push(reason(file));
   }
-  for (const failure of failures) result.push(stage(failure?.phase ?? failure?.stage) + '未完成；' + reason(failure));
+  for (const failure of failures.filter(record => !explained(record))) result.push(stage(phase(failure)) + '未完成；' + reason(failure));
+  for (const item of units.filter(item => !explained(item.evidence))) result.push(stage(item.record.kind) + '未完成；' + reason(item.evidence));
   if (file?.retrievalLimited || limits.length) {
-    result.push(...(limits.length ? limits.map(reason) : [reason(file)]));
+    result.push(...(limits.length ? limits.filter(record => !explained(record)).map(reason) : units.length ? [] : [reason(file)]));
   }
   if (rows(file?.windowCoverage?.pending).length) result.push('变更窗口尚未完成');
   if (file?.continuationPending) result.push('阶段续审尚未完成');
@@ -53,9 +70,32 @@ function collect(report) {
     if (record == null || typeof record !== 'object') return [];
     return [...new Set([...(record.path != null ? [String(record.path)] : []), ...(record.fileId != null ? [identity(record.fileId)] : []), ...rows(record.fileIds).map(identity)])];
   };
-  const unfinished = files.map(record => ({ record, reasons: fileReasons(record, findings), paths: record?.path != null ? [String(record.path)] : paths(record) })).filter(item => item.reasons.length);
+  const allUnits = rows(report?.continuation?.units);
+  const byId = new Map(allUnits.filter(unit => unit?.id != null).map(unit => [unit.id, unit]));
+  const completedPrimary = rows(report?.continuation?.completedPrimary);
+  const dependency = id => {
+    const unit = byId.get(id);
+    if (unit) return { ...unitMetadata(unit), paths: paths(unit) };
+    if (typeof id === 'string' && id.startsWith('primary:')) {
+      const fileId = id.slice(8);
+      return { id, kind: 'primary', fileIds: [fileId], paths: [identity(fileId)], status: completedPrimary.includes(fileId) ? 'completed' : 'pending' };
+    }
+    return { id, status: 'unknown' };
+  };
+  const units = allUnits.flatMap((record, position) => {
+    if (!record || record.status === 'completed') return [];
+    const dependencies = rows(record.dependencies).map(dependency);
+    const blocked = dependencies.some(dep => dep.status !== 'completed');
+    // An explicit reason always wins. Dependency readiness is not a call-budget signal.
+    const evidence = !hasReason(record) && blocked ? { ...record, pendingReason: 'DEPENDENCY' } : record;
+    return [{ record, position, dependencies, evidence, paths: paths(record) }];
+  });
+  const unfinished = files.map(record => {
+    const associated = record?.fileId == null ? [] : units.filter(item => rows(item.record.fileIds).includes(record.fileId));
+    return { record, reasons: fileReasons(record, findings, associated), paths: record?.path != null ? [String(record.path)] : paths(record) };
+  }).filter(item => item.reasons.length);
   const interactions = rows(report?.interactions).filter(record => record?.status !== 'completed').map(record => ({ record, reasons: [reason(record)], paths: paths(record) }));
-  return { unfinished, interactions, limitations: rows(report?.limitations), paths };
+  return { unfinished, interactions, units, limitations: rows(report?.limitations), paths };
 }
 
 function grouped(items) {
@@ -83,7 +123,7 @@ export function readabilityMarkdown(report = {}) {
   const output = ['', '## 未完成范围与原因', '以下为处理状态与限制记录数，非缺陷数；同一文件可能涉及多个阶段，限制不自动表示待审或缺陷。'];
   summary(output, '未完成条目', data.unfinished);
   summary(output, '跨文件综合未完成', data.interactions);
-  if (!data.unfinished.length && !data.interactions.length) output.push(report?.partial || data.limitations.length ? '- 报告仍有部分完成标记或限制；未逐项记录待续审范围，不表示全部查完。' : '- 未记录未完成条目或跨文件综合；这不是正确性证明。');
+  if (!data.unfinished.length && !data.interactions.length) output.push(report?.status === 'partial' || report?.partial || data.limitations.length ? '- 报告仍有部分完成标记或限制；未逐项记录待续审范围，不表示全部查完。' : '- 未记录未完成条目或跨文件综合；这不是正确性证明。');
   if (data.limitations.length) output.push('- 另有 ' + data.limitations.length + ' 条限制记录，按原文聚合保留在本报告限制附录；不将这些限制全部计入未完成范围。');
   if (data.unfinished.length || data.interactions.length) output.push('- 以上仅列有界摘要；全部路径、身份、阶段及原始记录见本报告限制附录。');
   output.push('', '## 下一步');
@@ -139,9 +179,13 @@ export function limitationDetailsMarkdown(report = {}) {
     for (const item of items) output.push('- ' + (item.paths.length ? item.paths.map(escape).join('、') : '未标明文件身份') + '：' + item.reasons.map(escape).join('；'));
     // State/reason metadata includes window IDs and pass statuses; full source and candidates already
     // exist in the complete report JSON and must not be duplicated into this appendix.
-    const keys = ['fileId', 'path', 'groupId', 'fileIds', 'status', 'failureCode', 'blockCode', 'code', 'reason', 'stage', 'phase', 'stageFailures', 'retrievalLimited', 'retrievalLimits', 'groupRetrievalLimits', 'continuationPending', 'synthesisStatus', 'verificationStatus', 'windowCoverage', 'reviewPasses'];
+    const keys = ['fileId', 'path', 'groupId', 'fileIds', 'status', 'failureCode', 'blockCode', 'code', 'reason', 'pendingReason', 'stage', 'phase', 'stageFailures', 'retrievalLimited', 'retrievalLimits', 'groupRetrievalLimits', 'continuationPending', 'synthesisStatus', 'verificationStatus', 'windowCoverage', 'reviewPasses'];
     output.push('以下仅为状态与原因元数据；源码、候选及其他完整字段见完整源报告 JSON。');
     originalDetails(output, packed(items.map(item => Object.fromEntries(keys.filter(key => Object.hasOwn(item.record ?? {}, key)).map(key => [key, item.record[key]])))));
   }
+  if (data.units.length) {
+    output.push('', '### 未完成阶段续审元数据', '按 continuation.units 原始索引保留对应阶段及依赖身份；record 为原始状态元数据，resolvedReason 仅为展示解释，不覆盖原始 pendingReason。');
+    originalDetails(output, data.units.map(item => ({ position: item.position, record: unitMetadata(item.record), paths: item.paths, resolvedReason: reason(item.evidence), dependencies: item.dependencies })));
+  }
   return output;
 }

package/src/retrieval-loop.mjs

@@ -7,16 +7,33 @@ export { RETRIEVAL_INSTRUCTIONS };
 
 function compactFollowup(input) {
   const p = JSON.parse(input);
-  if (p.windows) {
-    p.windows = p.windows.map(w => ({ ...w, old: { ...w.old, text: undefined }, new: { ...w.new, text: undefined } }));
-    p.windowBodyNotice = 'Window bodies deferred; use approved catalog read. Omitted results are not evidence.';
-  }
-  if (p.sourceMode === 'window-synthesis') {
-    for (const key of ['contextRelations', 'contextRelationNotice', 'cppCallSites', 'cppCallNotice', 'callerBindings', 'callerBindingNotice', 'windowNotice', 'defectGuidance', 'contextNotice', 'contextMode']) delete p[key];
-    if (p.changes) p.changes = { status: p.changes.status, precision: p.changes.precision, edits: p.changes.edits };
-    p.followupNotice = 'Synthesis metadata compacted; windowIndex retains original coordinates. Read approved sides for evidence.';
-  }
-  return JSON.stringify(p);
+  let removed = false;
+  const strip = (source, keys = ['text']) => {
+    if (!source || typeof source !== 'object') return;
+    for (const key of keys) if (typeof source[key] === 'string' && source[key].length) {
+      delete source[key];
+      removed = true;
+    }
+  };
+  const file = value => {
+    if (!value || typeof value !== 'object') return;
+    // Full snapshot files use left/right; windows use old/new. Never traverse
+    // arbitrary claims, exact edits, or retrieved results looking for text.
+    for (const side of ['left', 'right', 'old', 'new']) strip(value[side]);
+  };
+  const envelope = value => {
+    file(value.file);
+    for (const key of ['relatedFiles', 'files', 'windows']) {
+      if (Array.isArray(value[key])) value[key].forEach(file);
+    }
+    if (Array.isArray(value.context)) value.context.forEach(item => strip(item, ['text', 'oldText']));
+  };
+  envelope(p);
+  if (Array.isArray(p.reviews)) p.reviews.forEach(envelope);
+  if (!removed) return input;
+  p.followupSourceNotice = 'Repeated initial source bodies deferred; identity, sides and original coordinates remain. Use approved catalog reader operations for source evidence. Previously supplied bodies are not independent reads or complete coverage; deferred/omitted bodies are not evidence. Retrieved results and receipts are unchanged.';
+  const compact = JSON.stringify(p);
+  return Buffer.byteLength(compact) < Buffer.byteLength(input) ? compact : input;
 }
 
 export function retrievalRequest(request, scope, retrieved = []) {
@@ -105,7 +122,7 @@ export async function retrievalLoop(model, request, scope, { correctProtocol = f
     let parsed = pendingResponse;
     if (!parsed) {
     let { input, instructions } = nextRequest(retrieved);
-    if (correctProtocol && retrieved.length && !fits({ ...request, input, instructions })) input = compactFollowup(input);
+    if (correctProtocol && round > 0 && !fits({ ...request, input, instructions })) input = compactFollowup(input);
     if (!fits({ ...request, input, instructions })) throw new Error('Retrieval input budget exceeded');
     request.signal?.throwIfAborted();
     beforeCall();
@@ -174,7 +191,7 @@ export async function retrievalLoop(model, request, scope, { correctProtocol = f
             next.instructions = request.instructions + '\n' + RETRIEVAL_INSTRUCTIONS + FINAL_SUFFIX;
           }
           next.input = JSON.stringify(value);
-          if (correctProtocol) next.input = compactFollowup(next.input);
+          if (correctProtocol && !fits(next)) next.input = compactFollowup(next.input);
           return next;
         }, signal: request.signal,
       });
@@ -186,7 +203,7 @@ export async function retrievalLoop(model, request, scope, { correctProtocol = f
       let candidate = [...retrieved, item];
       let next = nextRequest(candidate);
       if (correctProtocol) {
-        while (retrieved.length && !fits({ ...next, input: compactFollowup(next.input) })) {
+        while (retrieved.length && !fits(next) && !fits({ ...next, input: compactFollowup(next.input) })) {
           retrieved.shift();
           await request.onProtocolEvent?.({ action: 'prior-retrieval-deferred', notice: 'Prior returned fragment no longer in current prompt; reread approved source for evidence.' });
           candidate = [...retrieved, item];

package/src/review-diagnostics.mjs

@@ -41,11 +41,21 @@ export function reviewDiagnostics(report, { reviewWallMs = null, executionWallMs
   const riskPlanningFallbackReasons = FALLBACK_REASONS.flatMap(reason => { const calls = (report.files ?? []).filter(f => f.riskPlanningFallbackReason === reason).length; return calls ? [{ reason, calls }] : []; });
   const recoveryEvents = sources.flatMap(source => source.modelRecoveries ?? []);
   const transportRecoveries = RECOVERY_KINDS.flatMap(kind => { const calls = recoveryEvents.filter(event => event?.action === 'json-transport-recovery' && event.kind === kind).length; return calls ? [{ kind, calls }] : []; });
+  const migrationEvents = sources.flatMap(source => Array.isArray(source.migrationSeedEvents) ? source.migrationSeedEvents : []);
+  const migrationSeeds = ['entry-migration', 'old-delegation', 'deleted-export-route'].flatMap(kind =>
+    ['accepted', 'fallback'].flatMap(status => {
+      const count = migrationEvents.filter(event => event?.kind === kind && event.status === status).length;
+      return count ? [{ kind, status, count }] : [];
+    }));
+  const migrationSeedReasons = ['COMPLETE_ROLE_SET', 'NO_MATCHING_CONTRACT', 'INCOMPLETE_ROLE_RANGE', 'EVIDENCE_LIMIT', 'TRANSACTION_UNAVAILABLE', 'SEED_LIMIT', 'INCOMPLETE_READ', 'FINAL_RESERVE', 'INPUT_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED', 'OTHER'].flatMap(reason => {
+    const count = migrationEvents.filter(event => ['accepted', 'fallback'].includes(event?.status) && ['entry-migration', 'old-delegation', 'deleted-export-route'].includes(event.kind) && event.reason === reason).length;
+    return count ? [{ reason, count }] : [];
+  });
   const resume = { reusedFiles: number(report.resume?.reusedFiles) };
   const artifactRecords = Array.isArray(report.artifacts) ? report.artifacts : null;
   const artifacts = { retained: artifactRecords ? artifactRecords.filter(record => record?.omitted === false && record.recorded === true).length : null, omitted: artifactRecords ? artifactRecords.filter(record => record?.omitted === true).length : null };
   return { schemaVersion: 2, resume, artifacts, transportRecoveries, pluginVersion: REVIEW_RUNTIME.version, reviewWallMs: number(reviewWallMs), executionWallMs: number(executionWallMs),
-    modelCalls: number(report.modelCalls), observedModelCalls, phases, modelCallPurposes, readerBudget, correctionReasons, readerLimitReasons, readerLimits, riskPlanningFallbackReasons,
+    modelCalls: number(report.modelCalls), observedModelCalls, phases, modelCallPurposes, readerBudget, correctionReasons, readerLimitReasons, readerLimits, riskPlanningFallbackReasons, migrationSeeds, migrationSeedReasons,
     planning: { completed: plans.filter(p => p.status === 'completed' && p.method !== 'inline').length, inline: plans.filter(p => p.method === 'inline' && p.status === 'completed').length, inlineAbsent: plans.filter(p => p.method === 'inline' && p.status === 'absent').length, inlineInvalid: plans.filter(p => p.method === 'inline' && p.status === 'invalid').length, fallback: plans.filter(p => p.status === 'fallback').length, skipped: plans.filter(p => p.status === 'skipped').length },
     callPurposeNotice: 'primary-initial is the first call of a retrieval-enabled stage, not only primary review; phase identifies the stage. Correction reason counts include actual correction invocation records only, not both failures and completion notices.',
     timingNotice: 'Observed call wall sums overlap under concurrency and include lifecycle observation; not pure provider latency. Missing values are unavailable, not zero.' };
@@ -73,6 +83,16 @@ export function diagnosticsMarkdown(d) {
   if (number(d.readerLimits?.maxRounds) !== null) output.push('- 每阶段最大检索轮次：' + number(d.readerLimits.maxRounds) + '；调用数／输出字节耗尽与轮次耗尽分别记录，不能混同。');
   if (d.riskPlanningFallbackReasons?.length) output.push('- 风险策略回退原因：' + d.riskPlanningFallbackReasons.filter(r => FALLBACK_REASONS.includes(r.reason)).map(r => r.reason + ' ' + (number(r.calls) ?? '不可用')).join('；') + '。');
   if (d.transportRecoveries?.length) output.push('- 本地结果传输：' + d.transportRecoveries.filter(row => RECOVERY_KINDS.includes(row.kind)).map(row => row.kind + ' ' + (number(row.calls) ?? '不可用')).join('；') + '；仅计成功解析的传输事件，不表示额外模型调用或缺陷确认。');
+  if (d.migrationSeeds?.length) {
+    const labels = { 'entry-migration': '入口迁移', 'old-delegation': '旧入口委托', 'deleted-export-route': '删除导出导航' };
+    const rows = d.migrationSeeds.filter(row => Object.hasOwn(labels, row.kind) && ['accepted', 'fallback'].includes(row.status) && Number.isSafeInteger(row.count) && row.count >= 0);
+    if (d.migrationSeedReasons?.length) {
+      const reasons = { COMPLETE_ROLE_SET: '完整角色接纳', NO_MATCHING_CONTRACT: '无匹配契约', INCOMPLETE_ROLE_RANGE: '角色范围不完整', EVIDENCE_LIMIT: '证据条数上限', TRANSACTION_UNAVAILABLE: '无事务能力', SEED_LIMIT: '种子数量上限', INCOMPLETE_READ: '读取不完整', FINAL_RESERVE: '最终复验预留不足', INPUT_CAPACITY: '输入容量不足', READER_CALL_BUDGET_EXCEEDED: '读取调用不足', READER_OUTPUT_BUDGET_EXCEEDED: '读取字节不足', OTHER: '其他回退' };
+      const details = d.migrationSeedReasons.filter(row => Object.hasOwn(reasons, row.reason) && Number.isSafeInteger(row.count) && row.count >= 0);
+      if (details.length) output.push('- 迁移种子原因：' + details.map(row => reasons[row.reason] + ' ' + row.count).join('；') + '。');
+    }
+    if (rows.length) output.push('- 迁移证据成套预取：' + rows.map(row => labels[row.kind] + ' ' + (row.status === 'accepted' ? '预取接纳' : '回退普通检索') + ' ' + row.count).join('；') + '；计预取尝试，不表示模型已调用、复核通过或新增缺陷成立，删除导出导航仍仅允许不确定归因。');
+  }
   if (number(d.resume?.reusedFiles) !== null) output.push('- 续审复用已完成文件：' + number(d.resume.reusedFiles) + '；复用成果不计为本次模型调用或新读取证据。');
   if (number(d.artifacts?.retained) !== null || number(d.artifacts?.omitted) !== null) output.push('- 私有模型工件：已留存 ' + (number(d.artifacts.retained) ?? '不可用') + '，未留存 ' + (number(d.artifacts.omitted) ?? '不可用') + '；诊断仅含计数，不包含正文或访问标识。');
   output.push('- primary-initial 表示启用检索的某阶段初始调用，不仅是主审；具体阶段以阶段统计为准。');

package/src/review-reader-allocation.mjs

@@ -30,24 +30,39 @@ export function createReviewReaderAllocation(root, units, { maxResumeAttempts =
     return { ...remaining, remainingCalls: Math.max(0, remaining.remainingCalls - protectedCalls), remainingOutputBytes: Math.max(0, remaining.remainingOutputBytes - protectedBytes) };
   };
   const check = (state, cost) => { const remaining = available(state); if (cost.calls > remaining.remainingCalls) fail('call'); if (cost.outputBytes > remaining.remainingOutputBytes) fail('output'); };
-  const resumeWithCost = (id, costForAttempt) => {
-    const state = states.get(id);
+  // Only the host knows dependencies. An explicit COMPLETE current ready-ID set
+  // filters FIFO opportunities, never the protected floors in available().
+  const readyIds = eligibleIds => {
+    if (eligibleIds === undefined) return null;
+    if (!(Array.isArray(eligibleIds) || eligibleIds instanceof Set) || eligibleIds.size > states.size || eligibleIds.length > states.size) throw new Error('Invalid reader resume eligibility');
+    const ready = new Set(eligibleIds);
+    if ([...ready].some(id => !states.has(id))) throw new Error('Invalid reader resume eligibility');
+    return ready;
+  };
+  const resumeWithCost = (id, costForAttempt, { eligibleIds, exact = false } = {}) => {
+    const state = states.get(id), ready = readyIds(eligibleIds);
     if (!state || state.released || !state.yielded) throw new Error('Reader allocation unit unavailable');
     if (state.resumeAttempts >= maxResumeAttempts) return { resumed: false, reason: 'READER_RESUME_ATTEMPTS_EXHAUSTED', attempts: state.resumeAttempts };
-    const head = yielded.find(key => { const row = states.get(key); return row && !row.released && row.yielded && row.resumeAttempts < maxResumeAttempts && row.yieldRevision < releaseRevision; });
-    if (head !== id || state.yieldRevision >= releaseRevision) return { resumed: false, reason: 'READER_RESUME_WAITING', attempts: state.resumeAttempts };
-    state.resumeAttempts++; state.yieldRevision = releaseRevision;
-    yielded.splice(yielded.indexOf(id), 1); yielded.push(id);
+    const waiting = () => ({ resumed: false, reason: 'READER_RESUME_WAITING', attempts: state.resumeAttempts });
+    // One first exact admission may use existing own-floor/cache capacity. Later
+    // opportunities require a release; readiness changes cannot reset this gate.
+    const opportunity = row => row.yieldRevision < releaseRevision || (exact && row.resumeAttempts === 0);
+    const head = yielded.find(key => { const row = states.get(key); return (!ready || ready.has(key)) && row && !row.released && row.yielded && row.resumeAttempts < maxResumeAttempts && opportunity(row); });
+    if (head !== id || !opportunity(state)) return waiting();
+    let failure = null;
     try {
       const cost = costForAttempt();
       if (!cost || !Number.isSafeInteger(cost.calls) || cost.calls < 0 || !Number.isSafeInteger(cost.outputBytes) || cost.outputBytes < 0) throw new Error('Reader allocation preflight unavailable');
       check(state, cost);
-      state.yielded = false; state.pendingReason = null; yielded.splice(yielded.indexOf(id), 1);
-      return { resumed: true, reason: null, attempts: state.resumeAttempts };
     } catch (error) {
       if (!['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code)) throw error;
-      return { resumed: false, reason: error.code, attempts: state.resumeAttempts };
+      failure = error.code;
     }
+    state.resumeAttempts++; state.yieldRevision = releaseRevision;
+    yielded.splice(yielded.indexOf(id), 1);
+    if (failure) { yielded.push(id); return { resumed: false, reason: failure, attempts: state.resumeAttempts }; }
+    state.yielded = false; state.pendingReason = null;
+    return { resumed: true, reason: null, attempts: state.resumeAttempts };
   };
   const scopes = new Map();
   return Object.freeze({
@@ -99,17 +114,17 @@ export function createReviewReaderAllocation(root, units, { maxResumeAttempts =
       state.yielded = true; state.yieldRevision = releaseRevision; state.pendingReason = reason; yielded.push(id);
       return { yielded: true, attempts: state.resumeAttempts };
     },
-    resume(id, requests = []) {
+    resume(id, requests = [], { eligibleIds } = {}) {
       const state = states.get(id);
       if (!state || state.released || !state.yielded) throw new Error('Reader allocation unit unavailable');
       if (!Array.isArray(requests) || !requests.length) return { resumed: false, reason: 'READER_RESUME_REQUESTS_REQUIRED', attempts: state.resumeAttempts };
-      return resumeWithCost(id, () => root.preflight(requests));
+      return resumeWithCost(id, () => root.preflight(requests), { eligibleIds, exact: true });
     },
     // Scalar admission is only a retry opportunity, never authority to read.
     // Every actual read still goes through exact preflight and root accounting.
-    resumeBudget(id, { requiredCalls = 1, requiredOutputBytes = 1 } = {}) {
+    resumeBudget(id, { requiredCalls = 1, requiredOutputBytes = 1, eligibleIds } = {}) {
       if (![requiredCalls, requiredOutputBytes].every(value => Number.isSafeInteger(value) && value >= 0) || requiredCalls + requiredOutputBytes === 0) throw new Error('Invalid reader resume budget');
-      return resumeWithCost(id, () => ({ calls: requiredCalls, outputBytes: requiredOutputBytes }));
+      return resumeWithCost(id, () => ({ calls: requiredCalls, outputBytes: requiredOutputBytes }), { eligibleIds });
     },
     release(id) { const state = states.get(id); if (!state) return; if (state.inTransaction) throw new Error('Reader allocation transaction active'); if (!state.released) { state.released = true; releaseRevision++; } },
     summary() { const usage = root.usage(); return { units: states.size, releasedUnits: [...states.values()].filter(state => state.released).length, calls: usage.calls, outputBytes: usage.outputBytes, ...(usage.cacheHits !== undefined ? { cacheHits: usage.cacheHits } : {}) }; },

package/src/review.mjs

@@ -196,7 +196,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   const generationCache = createStageGenerationCache(input, options.resumeState?.stageGenerations ?? []);
   const acceptedStages = new Map(generationCache.records().filter(record => record.phase === 'primary').map(record => [record.key, { generation: record.generation, record, restored: true }]));
   const primarySuspensions = new Map(), correctedStages = new Set();
-  const deferredStages = [], yieldedUnits = new Set(), fileDeadlines = new Map(), primaryStageKeys = new Map();
+  const deferredStages = [], yieldedUnits = new Set(), queuedStageUnits = new Set(), fileDeadlines = new Map(), primaryStageKeys = new Map();
   const checkpointStages = () => {
     if (!options.enableStageContinuation) return;
     report.stageGenerations = generationCache.records().filter(record => record.phase === 'primary');
@@ -204,7 +204,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   let readerAllocation;
   const stageScope = id => readerAllocation
     ? configureWireBudget(readerAllocation.scope(id), { nativeOutputTools: options.nativeOutputTools === true }) : scope;
-  const releaseStage = id => { if (!yieldedUnits.has(id)) readerAllocation?.release(id); };
+  const releaseStage = id => { if (!yieldedUnits.has(id) && !queuedStageUnits.has(id) && !deferredStages.some(stage => !stage.done && stage.allocationId === id)) readerAllocation?.release(id); };
   const contextSeeds = (reader, request, existing = [], buildRequest = records => retrievalRequest(request, reader, records)) => {
     if (!evidenceContext || !reader || maxRetrievalRounds === 0) return [];
     const payload = JSON.parse(request.input), catalog = reader.catalog();
@@ -282,7 +282,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     }
     if (signal?.aborted) { state.status = 'cancelled'; state.reason = '用户取消'; return; }
     const assignedGroup = [...groupPrepared].find(([, value]) => value.fileIds.includes(file.id));
-    if (!assignedGroup && (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0)) { state.reason = '模型调用预算耗尽'; return; }
+    if (!assignedGroup && (report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0)) { state.reason = '模型调用预算耗尽'; state.failureCode = 'PROJECT_MODEL_CALL_LIMIT'; return; }
     const prepared = preparePrimaryInput(input, file, { instructions, scope, grouping: report.grouping, maxInputBytes, riskPlanningMode: options.riskPlanningMode, focusPrimaryContext: options.focusPrimaryContext === true, enableRiskPlanning: options.enableRiskPlanning, skipSmallRiskPlans: options.skipSmallRiskPlans });
     const { changes, payload } = prepared;
     Object.assign(state, prepared.metadata);
@@ -300,8 +300,9 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         if (report.modelCalls >= maxCalls) throw new Error('Model call budget exceeded');
         report.modelCalls++;
       };
-      let activeReader = scope, activeStage = 'primary';
+      let activeReader = scope, activeStage = 'primary', activeStageLimited = false;
       const onBudgetLimited = info => {
+        activeStageLimited = true;
         if (activeStage !== 'primary') (state.secondaryRetrievalLimits ??= []).push({ phase: activeStage, ...info });
         state.retrievalLimited = true;
         (state.retrievalLimits ??= []).push(info);
@@ -404,6 +405,22 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         const phase=batch.interaction?'file-interaction':batch.synthesis?'window-synthesis':'primary';
         try{
         activeStage = phase;
+        activeStageLimited = phase === 'primary' && !!groupedGeneration?.groupLimits?.length;
+        // Seal the complete primary sweep before spending reads on secondary synthesis.
+        // A scheduled dependency is not a reader failure and does not consume a retry.
+        if (options.enableStageContinuation && !retry && (batch.synthesis || batch.interaction)) {
+          if (!deferredStages.some(stage => stage.key === key)) deferredStages.push({
+            key, allocationId, fileId: file.id, phase: batch.synthesis ? 'synthesis' : 'interaction',
+            fileIds: batch.interaction?.fileIds ?? [file.id], attempts: 0, requests: [], reason: 'STAGE_DEPENDENCY_PENDING',
+            run: () => invoke(next => executeStage(batch, batchIndex, next, true), { instructions, input: payload }, timeoutMs > 0 ? Math.max(1, fileDeadlines.get(file.id) - performance.now()) : 0, signal),
+          });
+          queuedStageUnits.add(allocationId);
+          if (options.enableVerification) queuedStageUnits.add('verification:' + file.id);
+          if (batch.synthesis) state.continuationPending = true;
+          if (batch.synthesis) state.synthesisStatus = 'pending';
+          if (batch.interaction) Object.assign(report.interactions.find(item => item.groupId === batch.interaction.id), { status: 'pending', reason: 'STAGE_DEPENDENCY_PENDING' });
+          return;
+        }
         if (options.enableStageContinuation && (batch.synthesis || batch.interaction) && (batch.interaction?.fileIds ?? [file.id]).some(id => deferredStages.some(stage => stage.fileId === id && stage.phase === 'primary' && !acceptedStages.has(stage.key)))) {
           defer(Object.assign(new Error('Stage is waiting for accepted primary generations'), { code: 'READER_CALL_BUDGET_EXCEEDED' })); return;
         }
@@ -560,7 +577,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
         }
         request.signal.throwIfAborted();
         if(rounds>1)generated.findings.forEach(f=>{f.reviewRound=batch.round;});
-        if (options.enableStageContinuation && !priorStage && !state.retrievalLimited) {
+        if (options.enableStageContinuation && !priorStage && !activeStageLimited) {
           const record = { key, fileId: file.id, phase, round: batch.round, windowIds: batch.windowIds ?? [], ...(batch.interaction ? { groupId: batch.interaction.id } : {}), generation: { findings: structuredClone(generated.findings), limitations: structuredClone(generated.limitations) } };
           const admission = generationCache.admit(record);
           if (admission.accepted) {
@@ -591,6 +608,13 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
             const verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, stageScope('verification:' + file.id), {
               correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, onBudgetLimited, yieldOnBudget: options.enableStageContinuation === true,
               enableMigrationRegression: options.enableMigrationRegression === true, migrationContracts: report.migrationContracts?.contracts ?? [], migrationSnapshot: input,
+              onMigrationSeeds: event => {
+                // Source-free host events only; never persist model text or reader bodies.
+                if (!['accepted', 'fallback'].includes(event?.status)) return;
+                const kind = ['old-delegation', 'deleted-export-route'].includes(event.kind) ? event.kind : 'entry-migration';
+                const reason = ['COMPLETE_ROLE_SET', 'NO_MATCHING_CONTRACT', 'INCOMPLETE_ROLE_RANGE', 'EVIDENCE_LIMIT', 'TRANSACTION_UNAVAILABLE', 'SEED_LIMIT', 'INCOMPLETE_READ', 'FINAL_RESERVE', 'INPUT_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(event.reason) ? event.reason : 'OTHER';
+                (state.migrationSeedEvents ??= []).push({ status: event.status, kind, reason });
+              },
               onRetrieved: records => { (state.retrievalAudit ??= []).push(...records); },
               onTruncated: () => { result.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
             });
@@ -607,19 +631,19 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           }
         }
         if (acceptedStages.has(key)) acceptedStages.get(key).completed = !options.enableVerification || generated.findings.every(finding => finding.verification?.status === 'completed');
-        if (batch.synthesis) state.synthesisStatus = 'completed';
+        if (batch.synthesis) state.synthesisStatus = activeStageLimited ? 'pending' : 'completed';
         if (batch.interaction) {
           const interaction=report.interactions.find(p => p.groupId === batch.interaction.id);
           if (combinedInteraction) Object.assign(interaction, { method: 'group-primary-validated-channel', channelGroupId: combinedInteraction.groupId });
-          if(rounds>1){interaction.completedRounds??=[];interaction.completedRounds.push(batch.round);interaction.reviewRounds=rounds;}
-          if(batch.round===rounds)interaction.status='completed';
+          if(rounds>1){interaction.completedRounds??=[];if(!activeStageLimited)interaction.completedRounds.push(batch.round);interaction.reviewRounds=rounds;}
+          if(batch.round===rounds) { interaction.status = activeStageLimited || rounds > 1 && new Set(interaction.completedRounds).size !== rounds ? 'pending' : 'completed'; if (activeStageLimited) interaction.reason = state.secondaryRetrievalLimits?.at(-1)?.code ?? 'STAGE_FAILED'; }
         }
         if (state.windowCoverage && batch.round === 1) {
           state.windowCoverage.completed.push(...batch.windowIds);
           state.windowCoverage.pending = state.windowCoverage.pending.filter(id => !batch.windowIds.includes(id));
         }
         if(rounds>1)state.reviewPasses[batchIndex].status='completed';
-        if (retry) { const pending = deferredStages.find(stage => stage.key === key); if (pending) pending.succeeded = !options.enableVerification || generated.findings.every(finding => finding.verification?.status === 'completed'); }
+        if (retry) { const pending = deferredStages.find(stage => stage.key === key); if (pending) { pending.succeeded = !activeStageLimited && (!options.enableVerification || generated.findings.every(finding => finding.verification?.status === 'completed')); if (activeStageLimited) pending.reason = state.retrievalLimits?.at(-1)?.code ?? 'STAGE_FAILED'; } }
         await options.onProgress?.({stage:'window-complete',snapshotId:input.id,fileId:file.id,path:file.path,windowIds:batch.windowIds,round:batch.round,findings:generated.findings,windowCoverage:state.windowCoverage});
         }catch(error){
           enclosingRequest.signal.throwIfAborted();
@@ -740,7 +764,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   }, dependencies, fileConcurrency);
   if (options.enableStageContinuation === true && deferredStages.length && !signal.aborted) {
     const primaryDone = input.files.filter(file => file.eligibility === 'reviewable' && (options.resumeState?.completed?.some(row => row.fileId === file.id) || primaryStageKeys.get(file.id)?.length && primaryStageKeys.get(file.id).every(key => acceptedStages.has(key)))).map(file => file.id);
-    const units = deferredStages.map((stage, index) => ({ id: hash(stage.key), kind: stage.phase, fileIds: stage.fileIds,
+    const units = deferredStages.map((stage, index) => ({ id: hash(stage.key), kind: stage.phase, fileIds: stage.fileIds, pendingReason: stage.reason,
       dependencies: stage.phase === 'primary'
         ? deferredStages.slice(0, index).filter(other => other.phase === 'primary' && other.fileId === stage.fileId).map(other => hash(other.key))
         : stage.fileIds.flatMap(id => { const pending = deferredStages.filter(other => other.phase === 'primary' && other.fileId === id); return pending.length ? pending.map(other => hash(other.key)) : ['primary:' + id]; }) }));
@@ -753,17 +777,26 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     }
     for (let pass = 0; pass < 2; pass++) {
       let progressed = false;
-      for (const stage of deferredStages) {
+      for (const stage of [...deferredStages].sort((a, b) => (a.phase === 'primary' ? 0 : a.phase === 'verification' ? 1 : 2) - (b.phase === 'primary' ? 0 : b.phase === 'verification' ? 1 : 2))) {
         if (stage.done || !continuation.ready().some(unit => unit.id === hash(stage.key))) continue;
-        if (performance.now() >= fileDeadlines.get(stage.fileId) || signal.aborted || report.modelCalls >= maxCalls) { continuation.stop(hash(stage.key), 'STAGE_NO_PROGRESS'); continue; }
-        const admitted = !yieldedUnits.has(stage.allocationId) ? { resumed: true } : stage.requests.length ? readerAllocation.resume(stage.allocationId, stage.requests) : readerAllocation.resumeBudget(stage.allocationId);
-        if (!admitted.resumed) continue;
+        if (performance.now() >= fileDeadlines.get(stage.fileId) || signal.aborted || report.modelCalls >= maxCalls || options.remainingCalls?.() <= 0) {
+          stage.reason = signal.aborted ? 'STAGE_CANCELLED' : performance.now() >= fileDeadlines.get(stage.fileId) ? 'STAGE_TIMEOUT' : 'PROJECT_MODEL_CALL_LIMIT';
+          continuation.stop(hash(stage.key), stage.reason); continue;
+        }
+        const eligibleIds = [...new Set(deferredStages.filter(candidate => !candidate.done && continuation.ready().some(unit => unit.id === hash(candidate.key))).map(candidate => candidate.allocationId))];
+        const admitted = !yieldedUnits.has(stage.allocationId) ? { resumed: true } : stage.requests.length ? readerAllocation.resume(stage.allocationId, stage.requests, { eligibleIds }) : readerAllocation.resumeBudget(stage.allocationId, { eligibleIds });
+        if (!admitted.resumed) { stage.reason = ['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(admitted.reason) ? admitted.reason : 'STAGE_ALLOCATION_WAITING'; continue; }
         yieldedUnits.delete(stage.allocationId);
+        if (!stage.allocationId.startsWith('verification:') || !deferredStages.some(other => other !== stage && !other.done && other.fileId === stage.fileId)) queuedStageUnits.delete(stage.allocationId);
         const token = continuation.start(hash(stage.key), { signal });
         stage.attempts++; await stage.run();
         progressed = true;
-        if (stage.succeeded && !yieldedUnits.has(stage.allocationId)) { stage.done = true; continuation.complete(hash(stage.key), token.attempt, { signal }); if (!deferredStages.some(other => other !== stage && !other.done && other.allocationId === stage.allocationId)) readerAllocation.release(stage.allocationId); }
-        else { continuation.yield(hash(stage.key), stage.reason); if (!yieldedUnits.has(stage.allocationId)) continuation.stop(hash(stage.key), 'STAGE_FAILED'); }
+        if (stage.succeeded && !yieldedUnits.has(stage.allocationId)) { stage.done = true; continuation.complete(hash(stage.key), token.attempt, { signal }); if (!deferredStages.some(other => other !== stage && !other.done && other.allocationId === stage.allocationId) && !queuedStageUnits.has(stage.allocationId)) readerAllocation?.release(stage.allocationId); }
+        else { const cause = stage.reason === 'STAGE_DEPENDENCY_PENDING' ? 'STAGE_FAILED' : stage.reason ?? 'STAGE_FAILED'; continuation.yield(hash(stage.key), cause); if (!yieldedUnits.has(stage.allocationId)) continuation.stop(hash(stage.key), cause); }
+        if (!deferredStages.some(other => !other.done && other.fileId === stage.fileId)) {
+          queuedStageUnits.delete('verification:' + stage.fileId);
+          releaseStage('verification:' + stage.fileId);
+        }
       }
       if (!progressed) break;
     }
@@ -771,6 +804,10 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     for (const [id, keys] of primaryStageKeys) if (!primaryDone.includes(id) && keys.length && keys.every(key => acceptedStages.has(key))) primaryDone.push(id);
     report.stageContinuation = continuation.summary();
     report.continuation = continuation.checkpoint();
+    for (const unit of report.continuation.units) if (unit.status !== 'completed') {
+      const stage = deferredStages.find(item => hash(item.key) === unit.id);
+      if (stage?.reason && !unit.stopped) unit.pendingReason = stage.reason;
+    }
     report.continuationOptions = continuationOptions;
     for (const file of input.files) {
       const result = fileResults[input.files.indexOf(file)];
@@ -780,7 +817,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
     checkpointStages();
     await options.onResumeCheckpoint?.({ ...report, files: fileResults.map(result => result.state), findings: fileResults.flatMap(result => result.findings), limitations: [...report.limitations, ...fileResults.flatMap(result => result.limitations)] });
   }
-  for (const id of yieldedUnits) readerAllocation?.release(id);
+  for (const id of new Set([...yieldedUnits, ...queuedStageUnits])) readerAllocation?.release(id);
   if (checkpointFailed) throw checkpointFailure;
   for (const result of fileResults) if (result?.state.continuationPending === false) { const state = result.state; state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && result.findings.every(finding => finding.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(state.fileId)).every(item => item.status === 'completed'); }
   report.files = fileResults.map(result => result.state);
@@ -795,7 +832,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   report.selection = { total: input.files.length, reviewable: reviewableCount, excluded: input.files.filter(f => f.eligibility === 'excluded').length, blocked: input.files.filter(f => f.eligibility === 'blocked').length };
   if (!reviewableCount) report.limitations.push({ text: input.files.length ? '没有可审查文件；排除或阻塞不表示代码审核通过。' : '未选择变更文件，没有执行代码审核。' });
   const unfinished = report.files.some(f => !['completed', 'excluded'].includes(f.status));
-  report.status = signal?.aborted ? 'cancelled' : unfinished || report.limitations.length ? 'partial' : 'completed';
+  report.status = signal?.aborted ? 'cancelled' : unfinished || report.limitations.length || report.stageContinuation?.pending || report.files.some(file => file.synthesisStatus && file.synthesisStatus !== 'completed') ? 'partial' : 'completed';
   if (report.files.some(f => f.status === 'failed') && !report.files.some(f => f.status === 'completed')) report.status = signal?.aborted ? 'cancelled' : 'failed';
   report.coverage = Object.fromEntries(['completed', 'excluded', 'blocked', 'failed', 'cancelled', 'pending'].map(s => [s, report.files.filter(f => f.status === s).length]));
   if (scope) {
@@ -804,7 +841,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   }
   report.regressionCoverage = Object.fromEntries(['introduced', 'preexisting', 'uncertain', 'unassessed'].map(classification => [classification, report.findings.filter(f => (f.verification?.regression?.classification ?? 'unassessed') === classification).length]));
   report.findingGroups = groupDuplicateFindings(report.findings);
-  for (const state of report.files) state.resumeEligible = state.status === 'completed' && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && report.findings.filter(f => f.fileId === state.fileId).every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(state.fileId)).every(item => item.status === 'completed');
+  for (const state of report.files) state.resumeEligible = state.status === 'completed' && !state.continuationPending && (!state.synthesisStatus || state.synthesisStatus === 'completed') && !state.stageFailures?.length && !state.reviewPasses?.some(pass => pass.status !== 'completed') && !state.windowCoverage?.pending?.length && !state.retrievalLimited && report.findings.filter(f => f.fileId === state.fileId).every(f => f.verification?.status === 'completed') && report.interactions.filter(item => item.fileIds?.includes(state.fileId)).every(item => item.status === 'completed');
   await options.onResumeCheckpoint?.(report);
   report.followup = coverageFollowup(report);
   if (scope) report.readerBudget = { ...scope.usage(), ...scope.budget(), ...readerLimits };

package/src/stage-continuation.mjs

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 const KINDS = new Set(['primary', 'verification', 'synthesis', 'interaction']);
-const REASONS = new Set(['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED', 'STAGE_INTERRUPTED', 'STAGE_CANCELLED', 'STAGE_TIMEOUT', 'STAGE_NO_PROGRESS', 'STAGE_ATTEMPTS_EXHAUSTED', 'STAGE_FAILED']);
+const REASONS = new Set(['READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED', 'STAGE_INTERRUPTED', 'STAGE_CANCELLED', 'STAGE_TIMEOUT', 'STAGE_NO_PROGRESS', 'STAGE_ATTEMPTS_EXHAUSTED', 'STAGE_FAILED', 'STAGE_DEPENDENCY_PENDING', 'STAGE_ALLOCATION_WAITING', 'PROJECT_MODEL_CALL_LIMIT', 'RETRIEVAL_ROUND_BUDGET_EXCEEDED', 'RETRIEVAL_FINAL_RESPONSE_REQUIRED']);
 const fail = code => Object.assign(new Error(code), { code });
 const canonical = value => Array.isArray(value) ? value.map(canonical) : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().filter(key => value[key] !== undefined).map(key => [key, canonical(value[key])])) : value;
 const digest = value => createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex');
@@ -15,7 +15,7 @@ export function createStageContinuation(snapshot, options, { completedPrimary =
   const primary = [...completedPrimary].sort(), states = new Map();
   for (const unit of units) {
     if (!unit || typeof unit.id !== 'string' || !unit.id || unit.id.length > 500 || states.has(unit.id) || unit.id.startsWith('primary:') || !KINDS.has(unit.kind) || !Array.isArray(unit.fileIds) || !unit.fileIds.length || new Set(unit.fileIds).size !== unit.fileIds.length || unit.fileIds.some(id => !fileIds.has(id)) || !Array.isArray(unit.dependencies ?? []) || new Set(unit.dependencies ?? []).size !== (unit.dependencies ?? []).length) throw fail('INVALID_STAGE_UNIT');
-    states.set(unit.id, { id: unit.id, kind: unit.kind, fileIds: [...unit.fileIds], dependencies: [...(unit.dependencies ?? [])], status: 'pending', attempts: 0, pendingReason: null, stopped: false });
+    states.set(unit.id, { id: unit.id, kind: unit.kind, fileIds: [...unit.fileIds], dependencies: [...(unit.dependencies ?? [])], status: 'pending', attempts: 0, pendingReason: REASONS.has(unit.pendingReason) ? unit.pendingReason : null, stopped: false });
   }
   const visit = (id, visiting = new Set(), visited = new Set()) => {
     if (visited.has(id)) return;

package/src/verification-loop.mjs

@@ -31,6 +31,8 @@ export async function verificationLoop(model, request, candidates, scope, option
   // permits no retrieval rounds. Do not spend its budget on optional prefetch.
   const initialRetrieved = options.maxRounds === 0 ? [] : verificationSeeds(candidates, scope, {
     signal: request.signal,
+    migrationContext,
+    onMigrationSeeds: options.onMigrationSeeds,
     onReceipt: (id, resolve) => seedReceipts.set(id, resolve),
     fits: seeds => {
       const next = retrievalRequest(verificationRequest, scope, seeds);

package/src/verification-seeds.mjs

@@ -1,4 +1,5 @@
 import { createEvidenceReceipts } from './evidence-receipts.mjs';
+import { migrationVerificationSeeds } from './migration-verification-seeds.mjs';
 
 // Host-only optional prefetch. Only approved catalog identities and actual line
 // coordinates select reads; candidate prose/snippets/receipts never become evidence.
@@ -7,8 +8,9 @@ const MAX_SEED_BYTES = 16 * 1024;
 const optionalFailure = error => ['VERIFICATION_SEED_CAPACITY', 'READER_CALL_BUDGET_EXCEEDED', 'READER_OUTPUT_BUDGET_EXCEEDED'].includes(error?.code);
 const capacityError = () => Object.assign(new Error('Optional verification seed capacity exceeded'), { code: 'VERIFICATION_SEED_CAPACITY' });
 
-export function verificationSeeds(candidates, scope, { signal, fits, onReceipt = () => {} }) {
+export function verificationSeeds(candidates, scope, { signal, fits, onReceipt = () => {}, migrationContext, onMigrationSeeds }) {
   signal?.throwIfAborted();
+  if (migrationContext !== undefined) return migrationVerificationSeeds(migrationContext, scope, { signal, fits, onReceipt, onMigrationSeeds });
   // Without atomic rollback an optional seed could consume the budget and then
   // fail its model-input fit check. Leave those readers on ordinary retrieval.
   if (typeof scope.transaction !== 'function') return [];