@feng0531/dsh-code-review 0.88.0 → 0.90.0

package/src/review.mjs

@@ -1,3 +1,4 @@
+import { approvedRetrievalSnapshot } from './approved-retrieval.mjs';
 import { REVIEW_INSTRUCTIONS, PROJECT_REVIEW_INSTRUCTIONS } from './prompts.mjs';
 import { reviewWholeScope } from './whole-scope-review.mjs';
 import { reviewRounds } from './review-rounds.mjs';
@@ -16,6 +17,7 @@ import { validateSynthesisReads } from './synthesis-evidence.mjs';
 import { hash } from './content.mjs';
 import { coverageFollowup } from './coverage-followup.mjs';
 import { verificationLoop } from './verification-loop.mjs';
+import { runCounterVerification } from './counter-verification.mjs';
 import { inferFileRelations } from './file-relations.mjs';
 import { buildReviewGroups } from './review-groups.mjs';
 import { changeMap } from './change-map.mjs';
@@ -47,7 +49,7 @@ import { buildMigrationContracts } from './migration-contracts.mjs';
 
 export { REVIEW_INSTRUCTIONS };
 export function createReviewReader(snapshot, options = {}) {
-  return configureWireBudget(createRetrievalScope(snapshot, { ...reviewReaderBudget(snapshot, options.readerBudgetPolicy ?? 'fixed'), signal: options.signal, ...(options.optimizeReviewCalls ? { reuseResults: true } : {}) }), { nativeOutputTools: options.nativeOutputTools === true });
+  return configureWireBudget(createRetrievalScope(approvedRetrievalSnapshot(snapshot, options.approvedRetrievalSnapshot), { ...reviewReaderBudget(snapshot, options.readerBudgetPolicy ?? 'fixed'), signal: options.signal, ...(options.optimizeReviewCalls ? { reuseResults: true } : {}) }), { nativeOutputTools: options.nativeOutputTools === true });
 }
 export { PROJECT_REVIEW_INSTRUCTIONS };
 const nonempty = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 8000;
@@ -107,7 +109,7 @@ async function invoke(model, request, timeoutMs, parentSignal) {
 }
 
 export async function reviewSnapshot(snapshot, model, options = {}) {
-  if (options.executionStrategy === 'whole-scope') return reviewWholeScope(snapshot, model, { ...options, instructions: REVIEW_INSTRUCTIONS, validateFindingResponse: validateResponse });
+  if (options.executionStrategy === 'whole-scope') return reviewWholeScope(snapshot, model, { ...options, instructions: options.instructions ?? REVIEW_INSTRUCTIONS, validateFindingResponse: validateResponse });
   if (options.executionStrategy !== undefined && options.executionStrategy !== 'staged') throw new Error('Invalid review execution strategy');
   const startedAt = performance.now();
   const rounds = reviewRounds(options.reviewRounds);
@@ -131,7 +133,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   if(!Number.isSafeInteger(timeoutMs)||timeoutMs<0)throw new Error('Invalid review limit');
   // Clone once: callers cannot change the input while a model call is pending.
   const input = structuredClone(snapshot);
-  const instructions=input.projectScope?PROJECT_REVIEW_INSTRUCTIONS:REVIEW_INSTRUCTIONS;
+  const instructions=options.instructions ?? (input.projectScope?PROJECT_REVIEW_INSTRUCTIONS:REVIEW_INSTRUCTIONS);
   if (!input || !nonempty(input.id) || !['git', 'svn'].includes(input.vcs) || !Array.isArray(input.files) || input.files.length > 200) throw new Error('Invalid review snapshot');
   const identities = new Set(), paths = new Set();
   for (const file of input.files) {
@@ -144,7 +146,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
   for (const key of ['enableEvidenceContext', 'inlineInteractionRisks', 'enableMigrationContracts', 'enableMigrationRegression', 'enableGroupInteractions', 'enableStageContinuation']) if (options[key] !== undefined && typeof options[key] !== 'boolean') throw new Error('Invalid review optimization option');
   const evidenceContext = options.enableEvidenceContext === true ? createEvidenceContext(input.id) : null;
   const readerLimits = reviewReaderBudget(input, options.readerBudgetPolicy ?? 'fixed');
-  const scope = options.enableRetrieval === true ? createRetrievalScope({ ...input, context: input.context ?? [] }, { ...readerLimits, signal, ...(options.optimizeReviewCalls === true ? { reuseResults: true } : {}) }) : null;
+  const scope = options.enableRetrieval === true ? createRetrievalScope({ ...approvedRetrievalSnapshot(input, options.approvedRetrievalSnapshot), context: input.context ?? [] }, { ...readerLimits, signal, ...(options.optimizeReviewCalls === true ? { reuseResults: true } : {}) }) : null;
   const report = { schemaVersion: 1, snapshotId: input.id, vcs: input.vcs, status: 'completed', files: [], findings: [], limitations: [], modelCalls: 0 };
   validateBusinessRequirement(input.businessRequirement);
   if(input.businessRequirement!==undefined)report.businessRequirement={hash:hash(input.businessRequirement),bytes:Buffer.byteLength(input.businessRequirement),status:'untrusted-constraint'};
@@ -612,7 +614,7 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
           for (const finding of generated.findings) finding.verification = { status: 'pending', causality: 'unverified' };
           try {
             activeStage = 'verification';
-            const verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, stageScope('verification:' + file.id), {
+            let verdicts = await verificationLoop(trackedModel, { ...request, onProtocolEvent, reviewPhase: 'verification' }, generated.findings, stageScope('verification:' + file.id), {
               correctProtocol:options.correctProtocol===true,maxRounds:maxRetrievalRounds,maxInputBytes, beforeCall, onBudgetLimited, yieldOnBudget: options.enableStageContinuation === true,
               enableMigrationRegression: options.enableMigrationRegression === true, migrationContracts: report.migrationContracts?.contracts ?? [], migrationSnapshot: input,
               onMigrationSeeds: event => {
@@ -626,7 +628,9 @@ export async function reviewSnapshot(snapshot, model, options = {}) {
               onTruncated: () => { result.limitations.push({ fileId: file.id, text: '复核检索结果达到数量上限' }); },
             });
             request.signal.throwIfAborted();
-            generated.findings.forEach((finding, i) => { finding.verification = { status: 'completed', ...verdicts[i] }; });
+            verdicts = await runCounterVerification(trackedModel, { ...request, onProtocolEvent, reviewPhase:'verification' }, generated.findings, verdicts, stageScope('verification:' + file.id), { enabled:options.enableCounterVerification === true, maxRounds:maxRetrievalRounds,maxInputBytes,beforeCall,onBudgetLimited, isFatalError:error=>checkpointFailed||error?.code==='MODEL_ARTIFACT_FAILED' });
+            request.signal.throwIfAborted();
+            generated.findings.forEach((finding, i) => { finding.verification = { status: verdicts[i].counterVerification?.status === 'incomplete' ? 'incomplete' : 'completed', ...verdicts[i] }; });
             if (verdicts.some(v => v.verdict === 'supported' && v.regression?.classification === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分模型支持候选缺少充分前后对照，不能确认由本次变更引入' });
             if (verdicts.some(v => v.verdict === 'uncertain')) result.limitations.push({ fileId: file.id, text: '部分候选复核仍不确定，不能视为已确认或已排除' });
           } catch (error) {

package/src/service.mjs

@@ -1,4 +1,6 @@
 import { previewValidity } from './preview-validity.mjs';
+import { reviewEffortPolicy } from './review-effort.mjs';
+import { prepareReviewHistory, finishReviewHistory } from './review-history.mjs';
 import { configureWireBudget } from './model-wire-budget.mjs';
 import {REVIEW_RUNTIME} from './runtime-identity.mjs';
 import { buildResumeState, validateResumeState, resumePreview } from './review-resume.mjs';
@@ -56,10 +58,12 @@ function buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcur
   return scopeNotice + (snapshot.history?.vcs==='svn'&&options.autoContext===true?'SVN历史autoContext为精确依赖定位读取固定版本父目录有界清单，包含同目录非匹配名字元数据；仅匹配捕获正文发送模型，不扫描全仓，不用工作树替代历史版本。':'') + (options.oldContextPaths !== undefined ? 'oldContextPaths仅为baseline旧侧正文，无目标侧替代；选中变更复用原old身份，旧侧不能证明新侧行为。' : '') + (snapshot.callerDiscovery ? 'callerScopePaths已授权预览读取限定目录内tracked候选正文，包括不匹配文件；非匹配正文不发送模型，匹配捕获上下文会发送。仅字面引用导航，不是函数调用或完整调用覆盖。' : '') + (enableRiskPlanning ? '执行按plan阈值决定风险假设规划，小变更可跳过独立规划但仍主审并复核；计划不是证据，所有阶段共享原预算。' : '') + `执行会向上述模型提供方发送可审查文件两侧内容、预览列出的显式/自动上下文、所选项目规则全文及预览业务需求文本。模型可在该快照范围内多轮只读检索，不读取范围外文件；候选生成后会进行证据与反证复核，两阶段各最多${maxRetrievalRounds}轮检索；独立文件审查链最多${changesConcurrency}条并发，不设插件内部默认时间或总模型调用次数截止，遵循宿主/用户取消；输入字节和检索轮次保护仍保留；复核不能证明缺陷成立。plan.reviewRounds为独立审查工作量，非模型reasoning effort；后续轮不带首轮风险计划，所有轮共享原超时与预算。plan仅预检初始输入，ready不代表已审查；minimumCalls不含后续检索/复核/动态业务综合；多文件可先进行业务分组，分组失败保留原组并记录限制，动态综合数执行前未知，实际预算可能不足。请先内部核对预览与当前人类授权。用户已明确要求审核且范围、模型和发送目的地一致时直接执行，不重复询问确认；只要求预览或明确要求等待确认时不得执行，超出授权或边界不明确时才询问。宿主权限和快照／身份校验仍须通过。`;
 }
 
-function createSessionReviewService(llm, { capture = captureSnapshot, executionStrategy = 'staged', maxInputBytes = 96 * 1024, now = Date.now, ttlMs = 300000, maxPreviews = 8, allowModelSending = false, enableRiskPlanning = false, skipSmallRiskPlans = true, reviewRounds = 1, enableBusinessGrouping = false, enableAnchorCorrection = false, changesConcurrency = 2, maxRetrievalRounds = 3, riskPlanningMode = 'separate', readerBudgetPolicy = 'fixed', optimizeReviewCalls = false, enablePrimarySeeds = false, focusPrimaryContext = false, enableSearchSeeds = false, nativeOutputTools = false, enableGroupPrimary = false, enableEvidenceContext = false, inlineInteractionRisks = false, enableMigrationContracts = false, enableMigrationRegression = false, enableGroupInteractions = false, enableStageContinuation = false, authorize = async () => false } = {}) {
+function createSessionReviewService(llm, { capture = captureSnapshot, reviewEffort = 'auto', enableCounterVerification = false, hostChildren, wholeScopeConcurrency = 2, executionStrategy = 'staged', maxInputBytes = 96 * 1024, now = Date.now, ttlMs = 300000, maxPreviews = 8, allowModelSending = false, enableRiskPlanning = false, skipSmallRiskPlans = true, reviewRounds = 1, enableBusinessGrouping = false, enableAnchorCorrection = false, changesConcurrency = 2, maxRetrievalRounds = 3, riskPlanningMode = 'separate', readerBudgetPolicy = 'fixed', optimizeReviewCalls = false, enablePrimarySeeds = false, focusPrimaryContext = false, enableSearchSeeds = false, nativeOutputTools = false, enableGroupPrimary = false, enableEvidenceContext = false, inlineInteractionRisks = false, enableMigrationContracts = false, enableMigrationRegression = false, enableGroupInteractions = false, enableStageContinuation = false, authorize = async () => false } = {}) {
   for (const value of [ttlMs, maxPreviews]) if (!Number.isSafeInteger(value) || value < 1) throw new Error('Invalid preview limit');
   if (!Number.isSafeInteger(maxInputBytes) || maxInputBytes < 1 || maxInputBytes > 4 * 1024 * 1024) throw new Error('Invalid configured input capacity');
   if (!['staged', 'whole-scope'].includes(executionStrategy)) throw new Error('Invalid review execution strategy');
+  if (!['auto','quick','standard','deep'].includes(reviewEffort) || typeof enableCounterVerification !== 'boolean') throw new Error('Invalid review effort policy');
+  wholeScopeConcurrency = reviewConcurrency(wholeScopeConcurrency);
   changesConcurrency = reviewConcurrency(changesConcurrency);
   maxRetrievalRounds = reviewRetrievalRounds(maxRetrievalRounds);
   riskPlanningMode = validateRiskPlanningMode(riskPlanningMode);
@@ -67,7 +71,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
   for (const value of [optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, nativeOutputTools, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation]) if (typeof value !== 'boolean') throw new Error('Invalid review optimization option');
   const lifetime = new AbortController();
   const bind = exec => ({ ...exec, signal: exec.signal ? AbortSignal.any([exec.signal, lifetime.signal]) : lifetime.signal });
-  const resumeOptions = (options, route, rounds) => ({ captureOptions: options, route, runtime: REVIEW_RUNTIME, instructionsHash: hash(REVIEW_INSTRUCTIONS), execution: { executionStrategy, maxInputBytes, rounds, enableRiskPlanning, skipSmallRiskPlans, enableBusinessGrouping, enableAnchorCorrection, changesConcurrency, maxRetrievalRounds, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, nativeOutputTools, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation } });
+  const resumeOptions = (options, route, rounds, effortMode, instructions) => ({ captureOptions: options, route, runtime: REVIEW_RUNTIME, instructionsHash: hash(instructions), execution: { reviewEffort:effortMode, enableCounterVerification, executionStrategy, maxInputBytes, wholeScopeConcurrency, rounds, enableRiskPlanning, skipSmallRiskPlans, enableBusinessGrouping, enableAnchorCorrection, changesConcurrency, maxRetrievalRounds, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, nativeOutputTools, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation } });
   const previews = new Map();
   let busy = false;
   function prune() { for (const [id, p] of previews) if (p.expires <= now()) previews.delete(id); }
@@ -76,7 +80,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
       exec = bind(exec);
       exec.signal.throwIfAborted();
       if (busy) throw new Error('Review service busy');
-      if (!args || Object.keys(args).some(k => !['repositoryPath', 'selectedPaths', 'contextPaths', 'rulePaths', 'autoContext', 'commit', 'baseRevision', 'targetRevision','businessRequirement','callerScopePaths','oldContextPaths','reviewRounds','svnRevision','svnBaseRevision','svnTargetRevision','svnAllowNetwork','svnEffectiveMergeinfo','svnBasePath','svnTargetPath','svnReplacementBaseRevision','svnReplacementAllowNetwork','changeScope','resumeFromJobId'].includes(k))) throw new Error('Unknown preview argument');
+      if (!args || Object.keys(args).some(k => !['repositoryPath', 'selectedPaths', 'contextPaths', 'rulePaths', 'autoContext', 'commit', 'baseRevision', 'targetRevision','businessRequirement','callerScopePaths','oldContextPaths','reviewRounds','svnRevision','svnBaseRevision','svnTargetRevision','svnAllowNetwork','svnEffectiveMergeinfo','svnBasePath','svnTargetPath','svnReplacementBaseRevision','svnReplacementAllowNetwork','changeScope','resumeFromJobId','rereviewFromJobId','findingOutcomes','reviewEffort','rereviewScope'].includes(k))) throw new Error('Unknown preview argument');
       if (args.resumeFromJobId !== undefined && (typeof args.resumeFromJobId !== 'string' || !/^[a-f0-9-]{36}$/.test(args.resumeFromJobId))) throw new Error('Invalid resume job id');
       if (args.autoContext !== undefined && typeof args.autoContext !== 'boolean') throw new Error('Invalid autoContext option');
       for (const key of ['selectedPaths', 'contextPaths', 'rulePaths', 'oldContextPaths']) if (args[key] !== undefined && (!Array.isArray(args[key]) || args[key].length > (key === 'rulePaths' ? 4 : key === 'oldContextPaths' ? 20 : 200) || args[key].some(p => typeof p !== 'string'))) throw new Error('Invalid path list');
@@ -84,10 +88,22 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
       if (executionStrategy === 'whole-scope' && (rounds !== 1 || args.resumeFromJobId !== undefined)) throw new Error('Whole-scope requires fresh single-round changes review');
       validateBusinessRequirement(args.businessRequirement);
       if (args.callerScopePaths !== undefined) validateCallerScopes(args.callerScopePaths);
+      const effortMode = args.reviewEffort ?? reviewEffort;
+      if (!['auto','quick','standard','deep'].includes(effortMode)) throw new Error('Invalid review effort mode');
+      if (args.rereviewFromJobId !== undefined && (typeof args.rereviewFromJobId !== 'string' || !/^[a-f0-9-]{36}$/.test(args.rereviewFromJobId) || args.resumeFromJobId !== undefined || rounds !== 1)) throw new Error('Invalid or conflicting re-review source');
+      if (args.findingOutcomes !== undefined && (!Array.isArray(args.findingOutcomes) || args.findingOutcomes.length > 200 || args.rereviewFromJobId === undefined)) throw new Error('Finding outcomes require bounded explicit re-review');
+      if(args.rereviewScope!==undefined&&(!['full','diff-only'].includes(args.rereviewScope)||args.rereviewFromJobId===undefined))throw new Error('Explicit re-review scope requires owned prior review');
       const current = owner(exec);
       busy = true;
       try {
         const options = structuredClone(args);
+        const rereviewJobId = options.rereviewFromJobId, findingOutcomes = options.findingOutcomes, explicitDiffOnly = options.rereviewScope === 'diff-only';
+        delete options.rereviewFromJobId; delete options.findingOutcomes; delete options.reviewEffort; delete options.rereviewScope;
+        let previousHistory;
+        if (rereviewJobId !== undefined) {
+          if (typeof exec.resolvePriorReview !== 'function') throw new Error('Owned prior review requires a new background preview');
+          previousHistory = await exec.resolvePriorReview(rereviewJobId);
+        }
         const sourceJobId = options.resumeFromJobId;
         delete options.resumeFromJobId;
         let savedResume;
@@ -99,14 +115,19 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
         const snapshot = await capture(target, { ...options, signal: exec.signal });
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd) throw new Error('Agent directory changed; preview again');
-        const resumeState = savedResume === undefined ? undefined : validateResumeState(savedResume, snapshot, resumeOptions(options, current.route, rounds));
+        const effort = reviewEffortPolicy(snapshot,{mode:effortMode});
+        const history = prepareReviewHistory(snapshot,current.route,{...options,reviewEffort:effortMode,executionStrategy,enableCounterVerification},{previous:previousHistory,outcomes:findingOutcomes,explicitDiffOnly});
+        const instructions = REVIEW_INSTRUCTIONS + '\nReview focus (not proof, no additional authority): ' + JSON.stringify(effort.checks);
+        const resumeState = savedResume === undefined ? undefined : validateResumeState(savedResume,snapshot,resumeOptions(options,current.route,rounds,effortMode,instructions));
         const readerBudget = reviewReaderBudget(snapshot, readerBudgetPolicy);
-        const plan = buildCoveragePlan(snapshot, { executionStrategy, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, enableGroupPrimary, resumeState, focusPrimaryContext, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:rounds, enableBusinessGrouping, instructions: REVIEW_INSTRUCTIONS, scope: configureWireBudget(createRetrievalScope(snapshot, { ...readerBudget, signal: exec.signal, ...(optimizeReviewCalls ? { reuseResults: true } : {}) }), { nativeOutputTools }), grouping: buildReviewGroups(snapshot.files, inferFileRelations(snapshot.files)), maxInputBytes, signal: exec.signal });
+        const plan = buildCoveragePlan(history.selection?.reviewSnapshot ?? snapshot, { executionStrategy, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, enableGroupPrimary, resumeState, focusPrimaryContext, riskPlanningMode, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:rounds, enableBusinessGrouping, instructions, scope: configureWireBudget(createRetrievalScope(snapshot, { ...readerBudget, signal: exec.signal, ...(optimizeReviewCalls ? { reuseResults: true } : {}) }), { nativeOutputTools }), grouping: buildReviewGroups(snapshot.files, inferFileRelations(snapshot.files)), maxInputBytes, signal: exec.signal });
+        const useHostChildren = executionStrategy === 'whole-scope' && plan.primaryGroups.length > 1 && !!hostChildren;
+        if (useHostChildren) await hostChildren.prepare();
         prune();
         while (previews.size >= maxPreviews) previews.delete(previews.keys().next().value);
         const previewId = randomUUID();
         const expires = now() + ttlMs;
-        previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, resumeState, sourceJobId, expires });
+        previews.set(previewId, { ...current, target, options, rounds, snapshotId: snapshot.id, resumeState, sourceJobId, useHostChildren, effort, instructions, history, rereviewJobId, expires });
         return {
   ...(options.businessRequirement !== undefined
     ? { businessRequirement: { text: options.businessRequirement, hash: hash(options.businessRequirement), bytes: Buffer.byteLength(options.businessRequirement) } }
@@ -116,9 +137,11 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
   validForMs: ttlMs,
   ...(resumeState ? { resume: resumePreview(resumeState, sourceJobId) } : {}),
   plan,
+  reviewEffort: effort,
+  ...(rereviewJobId ? { rereview: { sourceJobId:rereviewJobId,cycle:history.previous.cycle+1,maxCycles:3,incremental:history.incremental,notice:'Historical metadata only; no prior approval, conclusions or receipts are reused. Navigation paths are not coverage.' } } : {}),
   snapshotId: snapshot.id,
   privateArtifacts: { enabled: typeof exec.onModelArtifact === 'function', sourceBearing: true, maxArtifactBytes: 1048576, maxJobBytes: 8388608, maxArtifacts: 4096, notice: 'Background jobs retain bounded untrusted model output outside the reviewed workspace; omissions/truncation explicit. Never included in ordinary status or reused as evidence; explicit consent required to read.' },
-  execution: { executionStrategy, ...(executionStrategy === 'whole-scope' ? { resumeSupported: false, maxInputBytes } : {}), nativeOutputTools, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, fileConcurrency: changesConcurrency, maxRetrievalRounds, ...(optimizeReviewCalls ? { riskPlanningMode, readerBudget: { policy: readerBudgetPolicy, ...readerBudget }, missingContextSeeds: enablePrimarySeeds, focusPrimaryContext, searchContextSeeds: enableSearchSeeds } : {}) },
+  execution: { executionStrategy, counterVerification: enableCounterVerification && effort.counterVerification.eligible, ...(executionStrategy === 'whole-scope' ? { resumeSupported: false, maxInputBytes, batchExecution: useHostChildren ? 'host-subagents' : 'direct', batchConcurrency: useHostChildren ? Math.min(wholeScopeConcurrency, plan.primaryGroups.length) : 1 } : {}), nativeOutputTools, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, fileConcurrency: changesConcurrency, maxRetrievalRounds, ...(optimizeReviewCalls ? { riskPlanningMode, readerBudget: { policy: readerBudgetPolicy, ...readerBudget }, missingContextSeeds: enablePrimarySeeds, focusPrimaryContext, searchContextSeeds: enableSearchSeeds } : {}) },
   repositoryRoot: snapshot.root,
   vcs: snapshot.vcs,
   ...(snapshot.changeScope ? { changeScope: snapshot.changeScope } : options.changeScope !== undefined ? { changeScope: options.changeScope } : {}),
@@ -148,7 +171,7 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
   ...(snapshot.callerDiscovery ? { callerDiscovery: snapshot.callerDiscovery } : {}),
   ...(snapshot.autoContext ? { autoContext: snapshot.autoContext } : {}),
   rules: (snapshot.rules ?? []).map(({ path, hash }) => ({ path, hash })),
-  notice: executionStrategy === 'whole-scope' ? '整体优先主审：批准完整双侧按实际输入字节合批；不执行逐文件风险规划、业务分组或旧专门综合。候选集中独立复核；补读可增加调用，共享读取账本不重置。超大文件明确阻断，多批跨边界未核查保持部分完成；不承诺一次请求或审查通过。不支持旧阶段恢复或多轮。' : buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcurrency, maxRetrievalRounds) + (enableMigrationContracts ? ' 迁移契约仅由批准快照的明确旧/新入口与调用绑定产生，无法解析的语言结构保持未解决，不以相似名称推断迁移。' : '') + (enableMigrationRegression ? ' 显式跨文件旧新比较仅在host契约限定来源和本次独立回执齐备时成立，因果仍未证明。' : '') + (enableGroupInteractions ? ' 组主审可附带交互结果，只有当前代全组编辑实读且host校验通过时替代匹配专门阶段；缺失/非法回退，候选仍独立复核。' : '') + (enableStageContinuation ? ' 未完成阶段可在其他阶段释放额度后有限继续，不重置总账或原超时；已验收主审生成可精确续用，但复核重新读取、新回执，不继承旧证据。' : '') + (enableEvidenceContext ? ' 可将本次实际交付过的批准原行按相关性经当前阶段reader有限重新投递；缓存仍计交付字节，不继承历史读取覆盖或复核回执。' : '') + (inlineInteractionRisks ? ' 预算适配的精确跨文件单元可在交互主审同次返回风险假设，省去独立规划；缺失或无效风险不补发、不代表已完成风险核查。' : '') + (optimizeReviewCalls ? ` 完整正文或覆盖全部精确编辑的单批窗口可将风险问题合并入主审（非独立规划）；仅对批准上下文的确定坐标预取小片段，不代表完整核查。${focusPrimaryContext ? " 主审优先保留主文件全文，仅附带有关联的有界完整上下文；其余批准来源保留目录按需读，不表示不存在或已核查。" : ""}${enableSearchSeeds ? " 可将模型搜索命中的批准原行小片段与搜索结果同轮提供，每阶段最多2次额外读取，共用原预算；不猜测另侧坐标，不增加检索轮次。" : ""}共享检索上限按本次范围计算：${readerBudget.maxCalls}次唯一操作结果生成／${readerBudget.maxOutputBytes}交付字节，所有阶段共用、不逐文件重置；同快照相同请求可复用原始结果，每次交付仍计字节并重新签发复核回执；主审、综合及复核按权重预留最低额度，未用额度释放，额度不足仍如实标记未完成。` : ''),
+  notice: executionStrategy === 'whole-scope' ? '整体优先主审：批准完整双侧按实际输入字节合批；不执行逐文件风险规划、业务分组或旧专门综合。候选集中独立复核；补读可增加调用，共享读取账本不重置。超大文件明确阻断，多批跨边界未核查保持部分完成；不承诺一次请求或审查通过。不支持旧阶段恢复或多轮。' + (useHostChildren ? ` 超限多组使用真实spawn子智能体，最多${wholeScopeConcurrency}组并行，每组保留独立持续上下文，仅批准快照读取工具；逐模型生成尝试共用总账，逻辑LLM输入预算不代表最终HTTP字节。` : '') : buildPreviewNotice(snapshot, options, enableRiskPlanning, changesConcurrency, maxRetrievalRounds) + (enableMigrationContracts ? ' 迁移契约仅由批准快照的明确旧/新入口与调用绑定产生，无法解析的语言结构保持未解决，不以相似名称推断迁移。' : '') + (enableMigrationRegression ? ' 显式跨文件旧新比较仅在host契约限定来源和本次独立回执齐备时成立，因果仍未证明。' : '') + (enableGroupInteractions ? ' 组主审可附带交互结果，只有当前代全组编辑实读且host校验通过时替代匹配专门阶段；缺失/非法回退，候选仍独立复核。' : '') + (enableStageContinuation ? ' 未完成阶段可在其他阶段释放额度后有限继续，不重置总账或原超时；已验收主审生成可精确续用，但复核重新读取、新回执，不继承旧证据。' : '') + (enableEvidenceContext ? ' 可将本次实际交付过的批准原行按相关性经当前阶段reader有限重新投递；缓存仍计交付字节，不继承历史读取覆盖或复核回执。' : '') + (inlineInteractionRisks ? ' 预算适配的精确跨文件单元可在交互主审同次返回风险假设，省去独立规划；缺失或无效风险不补发、不代表已完成风险核查。' : '') + (optimizeReviewCalls ? ` 完整正文或覆盖全部精确编辑的单批窗口可将风险问题合并入主审（非独立规划）；仅对批准上下文的确定坐标预取小片段，不代表完整核查。${focusPrimaryContext ? " 主审优先保留主文件全文，仅附带有关联的有界完整上下文；其余批准来源保留目录按需读，不表示不存在或已核查。" : ""}${enableSearchSeeds ? " 可将模型搜索命中的批准原行小片段与搜索结果同轮提供，每阶段最多2次额外读取，共用原预算；不猜测另侧坐标，不增加检索轮次。" : ""}共享检索上限按本次范围计算：${readerBudget.maxCalls}次唯一操作结果生成／${readerBudget.maxOutputBytes}交付字节，所有阶段共用、不逐文件重置；同快照相同请求可复用原始结果，每次交付仍计字节并重新签发复核回执；主审、综合及复核按权重预留最低额度，未用额度释放，额度不足仍如实标记未完成。` : ''),
 };
       } finally { busy = false; }
     },
@@ -170,14 +193,18 @@ function createSessionReviewService(llm, { capture = captureSnapshot, executionS
         const snapshot = await capture(target, { ...preview.options, signal: exec.signal });
         exec.signal?.throwIfAborted();
         if (snapshot.id !== preview.snapshotId || owner(exec).cwd !== current.cwd) throw new Error('Files changed since preview; preview again');
-        const resumeIdentity = resumeOptions(preview.options, preview.route, preview.rounds);
+        if (preview.useHostChildren && !hostChildren?.capability()) throw new Error('Approved child execution capability changed; preview again');
+        const resumeIdentity = resumeOptions(preview.options, preview.route, preview.rounds, preview.effort.mode, preview.instructions);
         const resumeState = preview.resumeState ? validateResumeState(preview.resumeState, snapshot, resumeIdentity) : undefined;
         if (await authorize({ snapshot, route: preview.route, exec }) !== true) throw new Error('Model sending approval denied or unavailable');
         exec.signal?.throwIfAborted();
         if (owner(exec).cwd !== current.cwd || JSON.stringify(owner(exec).route) !== JSON.stringify(preview.route)) throw new Error('Agent changed during approval');
         await exec.reviewCheckpoint?.({stage:'approved-manifest',snapshotId:snapshot.id,files:snapshot.files.map(f=>({fileId:f.id,path:f.path,status:f.eligibility==='reviewable'?'pending':f.eligibility}))});
-        const report = await reviewSnapshot(snapshot, createDshModel(llm, preview.route,{correctJson:true,useNativeTools:nativeOutputTools}), { executionStrategy, maxInputBytes, signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, nativeOutputTools, enableVerification: true, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection,changesConcurrency,maxRetrievalRounds,correctProtocol:true, onProgress:exec.reviewCheckpoint, resumeState, onModelArtifact: exec.onModelArtifact, onResumeCheckpoint: exec.reviewResumeCheckpoint ? async checkpoint => { await exec.reviewResumeCheckpoint(buildResumeState(snapshot, resumeIdentity, checkpoint)); } : undefined });
+        const report = await reviewSnapshot(preview.history.selection?.reviewSnapshot ?? snapshot, createDshModel(llm, preview.route,{correctJson:true,useNativeTools:nativeOutputTools}), { approvedRetrievalSnapshot: snapshot, instructions: preview.instructions, reviewEffort: preview.effort, enableCounterVerification: enableCounterVerification && preview.effort.counterVerification.eligible, executionStrategy, maxInputBytes, wholeScopeConcurrency, childExecution: preview.useHostChildren ? 'host-subagents' : undefined, createBatchModel: preview.useHostChildren ? args => hostChildren.create({ ...args, parent: exec.agent, route: preview.route, cwd: target }) : undefined, signal: exec.signal, enableRetrieval: true, enableGrouping: true, enableGroupPrimary, enableEvidenceContext, inlineInteractionRisks, enableMigrationContracts, enableMigrationRegression, enableGroupInteractions, enableStageContinuation, nativeOutputTools, enableVerification: true, riskPlanningMode, readerBudgetPolicy, optimizeReviewCalls, enablePrimarySeeds, focusPrimaryContext, enableSearchSeeds, enableRiskPlanning, skipSmallRiskPlans, reviewRounds:preview.rounds, enableBusinessGrouping, enableAnchorCorrection,changesConcurrency,maxRetrievalRounds,correctProtocol:true, onProgress:exec.reviewCheckpoint, resumeState, onModelArtifact: exec.onModelArtifact, onResumeCheckpoint: exec.reviewResumeCheckpoint ? async checkpoint => { await exec.reviewResumeCheckpoint(buildResumeState(snapshot, resumeIdentity, checkpoint)); } : undefined });
+        if (preview.history.selection?.plan.requiredReportStatus === 'partial') { if (report.status==='completed') report.status='partial'; report.limitations.push({text:'增量复审只检查本轮选定主文件；未重审文件仅作批准检索上下文，不代表完整范围已查完。'}); }
         report.model = preview.route;
+        report.reviewEffort = preview.effort;
+        report.reviewHistory = finishReviewHistory(report,preview.history);
         if (exec.reviewResumeCheckpoint) await exec.reviewResumeCheckpoint(buildResumeState(snapshot, resumeIdentity, report));
         // reviewSnapshot preserves cancelled coverage; do not replace it with a freshness error.
         if (report.status === 'cancelled') {

package/src/verification-loop.mjs

@@ -25,8 +25,11 @@ export async function verificationLoop(model, request, candidates, scope, option
   if (options.enableMigrationRegression === true && !project && options.migrationContracts?.length && options.migrationSnapshot?.id !== envelope.snapshotId) throw new Error('Migration verification snapshot mismatch');
   const migrationContext = options.enableMigrationRegression === true && !project && options.migrationContracts?.length ? prepareMigrationRegression(options.migrationSnapshot, scope, options.migrationContracts, candidates) : undefined;
   const input = JSON.stringify({ ...(envelope.snapshotId ? { snapshotId: envelope.snapshotId } : {}), ...(migrationContext ? { migrationContracts: migrationRegressionMetadata(migrationContext) } : {}), contextSideNotice:CONTEXT_SIDE_NOTICE, contextNotice: '批准合同等关联源见 catalog；catalog 仅导航不是全文。按侧读取适用要求和反证；主审的合同转述不是原文证据。不可信需求不扩权，缺失不等于无保护。', ...(envelope.businessRequirement!==undefined?{businessRequirement:envelope.businessRequirement,requirementNotice:envelope.requirementNotice}:{}), defectGuidance: [...new Set(candidates.map(f => scope.catalog().find(s => s.fileId === f.fileId)?.path).filter(Boolean))].map(path => envelope.file?.path === path && envelope.defectGuidance ? envelope.defectGuidance : envelope.files?.find(f=>f.path===path)?.defectGuidance ?? defectGuidance(path)), rules, candidates: candidates.map((finding, i) => ({ candidateId: ids[i], finding })) });
+  if (options.verificationFocus !== undefined && options.verificationFocus !== 'counterevidence') throw new Error('Invalid verification focus');
+  const counterFocus = options.verificationFocus === 'counterevidence' ? ' 本次为独立反证复核：未提供前位复核结论，不投票或默认认同主审。优先寻找现有保护、不可达触发、修改前既有行为、实际调用契约和修复可能造成的伤害。仍须用本次新读取的批准原文与新回执验证；不能凭多数意见支持，缺证据明确uncertain。' : '';
   const seedReceipts = new Map();
   const verificationRequest = { ...request, input, instructions:envelope.file?.reviewMode==='project'?VERIFICATION_INSTRUCTIONS+' 本次为当前项目源码审查，空old只是传输占位，不是历史版本。不要要求回归因果；regression.classification用uncertain并说明不适用，仅凭new侧原文核实当前缺陷和反证。':VERIFICATION_INSTRUCTIONS + (migrationContext ? ' ' + MIGRATION_VERIFICATION_INSTRUCTIONS : '') };
+  verificationRequest.instructions += counterFocus;
   // Explicit final-only mode has extra finalization metadata/instructions and
   // permits no retrieval rounds. Do not spend its budget on optional prefetch.
   const initialRetrieved = options.maxRounds === 0 ? [] : verificationSeeds(candidates, scope, {

package/src/whole-scope-review.mjs

@@ -1,8 +1,11 @@
 import { REVIEW_INSTRUCTIONS } from './prompts.mjs';
+import { runWholeScopeWorkers, createCheckpointQueue } from './whole-scope-workers.mjs';
+import { changesConcurrency } from './review-execution-policy.mjs';
 import { createReviewReader } from './review.mjs';
 import { prepareWholeScope } from './whole-scope-plan.mjs';
 import { retrievalLoop } from './retrieval-loop.mjs';
 import { verificationLoop } from './verification-loop.mjs';
+import { runCounterVerification } from './counter-verification.mjs';
 import { validateGroupPrimary } from './group-primary.mjs';
 import { modelWireBudget } from './model-wire-budget.mjs';
 import { retrievalRounds } from './review-execution-policy.mjs';
@@ -21,6 +24,8 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
   if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 0) throw new Error('Invalid whole-scope timeout');
   if (options.enableAnchorCorrection !== undefined && typeof options.enableAnchorCorrection !== 'boolean') throw new Error('Invalid anchor correction option');
   const maxRounds = retrievalRounds(options.maxRetrievalRounds);
+  const concurrency = changesConcurrency(options.wholeScopeConcurrency ?? 2);
+  if (options.createBatchModel !== undefined && typeof options.createBatchModel !== 'function') throw new Error('Invalid child agent factory');
   const input = structuredClone(snapshot);
   if (!input || !['git', 'svn'].includes(input.vcs) || !Array.isArray(input.files) || input.files.length > 200 || input.projectScope || input.files.some(file => file.reviewMode === 'project')) throw new Error('Whole-scope review requires a changes snapshot');
   const identities = new Set(), paths = new Set();
@@ -41,21 +46,23 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
     interactions: [], rules: (input.rules ?? []).map(({ path, hash }) => ({ path, hash })),
   };
   const stateById = new Map();
-  let reader, checkpointFailed = false;
-  const checkpoint = async () => {
-    if (!options.onResumeCheckpoint) return;
-    try { await options.onResumeCheckpoint(structuredClone(report)); } catch (error) { checkpointFailed = true; throw error; }
+  let reader, checkpointFailed = false, fatalError;
+  const checkpoints = createCheckpointQueue(options.onResumeCheckpoint, error => { checkpointFailed = true; fatalError ??= error; controller.abort(error); });
+  const reportOrder = new Map(input.files.map((file, index) => [file.id, index]));
+  const checkpoint = () => {
+    report.findings.sort((a, b) => reportOrder.get(a.fileId) - reportOrder.get(b.fileId));
+    return checkpoints.enqueue(report);
   };
   const gate = () => {
     signal.throwIfAborted();
     if (report.modelCalls >= maxCalls) throw failure('WHOLE_SCOPE_MODEL_CALL_LIMIT', 'Model call budget exceeded');
     if (options.remainingCalls?.() <= 0) throw failure('PROJECT_MODEL_CALL_LIMIT', 'Shared project model call limit exceeded');
   };
-  const trackedModel = async request => {
+  const trackModel = delegate => async request => {
     gate();
     if (!modelWireBudget(request, maxInputBytes).fits) throw failure('WHOLE_SCOPE_INPUT_BUDGET', 'Actual model wire input budget exceeded');
     report.modelCalls++;
-    const result = await model({ ...request, maxInputBytes,
+    const result = await delegate({ ...request, maxInputBytes,
       onModelArtifact: options.onModelArtifact ? async artifact => {
         try {
           const reference = await options.onModelArtifact({ ...artifact, snapshotId: input.id, phase: request.reviewPhase });
@@ -83,6 +90,7 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
     signal.throwIfAborted();
     return result;
   };
+  const trackedModel = trackModel(model);
   const requestFor = batch => ({ input: batch.payload, instructions: batch.instructions, signal,
     reviewPhase: 'group-primary', nativeOutputTools: options.nativeOutputTools === true,
     onProtocolEvent: options.onProtocolEvent });
@@ -112,12 +120,27 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
     if (plan.batches.length > 1) report.limitations.push({ text: '整体范围按字节分为多个批次；跨 batch 边界关系未核查，不声明整体范围完整覆盖。' });
     report.scopeNotices = [{ text: '整体主审结合当前 batch 完整文件；批准关联源须按需检索，不声明专门 interaction 阶段或全部上下文覆盖。' }];
     const generatedBatches = [];
-    for (const batch of plan.batches) {
-      const stage = { id: batch.id, fileIds: [...batch.fileIds], status: 'pending' };
-      report.orchestration.batches.push(stage);
+    const parallelChildren = plan.batches.length > 1 && typeof options.createBatchModel === 'function';
+    report.orchestration.batchExecution = parallelChildren ? (options.childExecution ?? 'child-factory') : 'direct';
+    report.orchestration.batchConcurrency = parallelChildren ? Math.min(concurrency, plan.batches.length) : 1;
+    const accepted = new Array(plan.batches.length);
+    report.orchestration.batches = plan.batches.map(batch => ({ id: batch.id, fileIds: [...batch.fileIds], status: 'pending' }));
+    const runBatch = async (batch, index) => {
+      const stage = report.orchestration.batches[index];
+      let child;
       try {
         gate();
-        const response = await retrievalLoop(trackedModel, requestFor(batch), reader, loopOptions(stage));
+        if (parallelChildren) {
+          child = await options.createBatchModel({ batchId: batch.id, fileIds: [...batch.fileIds], signal });
+          if (!child || (typeof child.invoke !== 'function' && typeof child.runPrimary !== 'function') || typeof child.dispose !== 'function') throw new Error('Invalid host child model');
+          signal.throwIfAborted();
+        }
+        const batchModel = child ? trackModel(request => child.invoke(request)) : trackedModel;
+        const response = child?.runPrimary ? await child.runPrimary({ request: requestFor(batch), scope: reader, maxRounds, maxInputBytes,
+          reserveModelCall: () => { gate(); report.modelCalls++; },
+          onRetrieved: loopOptions(stage).onRetrieved, onBudgetLimited: loopOptions(stage).onBudgetLimited, onTruncated: loopOptions(stage).onTruncated,
+          onProgress: options.onProgress }) : await retrievalLoop(batchModel, requestFor(batch), reader, loopOptions(stage));
+        if (child?.transport === 'host-subagent') { stage.childId = child.childId; stage.execution = 'host-subagent'; }
         const members = validateGroupPrimary(response, batch, input, options.validateFindingResponse, reader.catalog(), { enableAnchorCorrection: options.enableAnchorCorrection === true, signal });
         signal.throwIfAborted();
         // Validate the entire member set before publishing any member result.
@@ -130,18 +153,23 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
           report.limitations.push(...generated.limitations.map(text => ({ fileId: id, text })));
         }
         stage.status = stage.retrievalLimited ? 'pending' : 'completed';
-        generatedBatches.push(batch);
+        accepted[index] = batch;
         await checkpoint();
       } catch (error) {
         signal.throwIfAborted();
-        if (checkpointFailed || error.code === 'MODEL_ARTIFACT_FAILED') throw error;
+        if (checkpointFailed || error.code === 'MODEL_ARTIFACT_FAILED') { fatalError ??= error; controller.abort(error); throw error; }
         stage.status = isBudget(error) ? 'pending' : 'failed';
         stage.failureCode = error.code ?? 'WHOLE_SCOPE_PRIMARY_FAILED'; stage.reason = error.message;
         for (const id of batch.fileIds) Object.assign(stateById.get(id), { status: stage.status, primaryStatus: stage.status, failureCode: stage.failureCode, reason: error.message });
         report.limitations.push({ text: '整体主审未完成：' + error.message });
-        if (isBudget(error)) break;
+      } finally {
+        if (child) { try { await child.dispose(); } catch (error) { fatalError ??= error; controller.abort(error); throw error; } }
       }
-    }
+    };
+    await runWholeScopeWorkers(plan.batches, runBatch, { concurrency: report.orchestration.batchConcurrency, signal, onFatal: error => { if (!signal.aborted) { fatalError ??= error; controller.abort(error); } } });
+    generatedBatches.push(...accepted.filter(Boolean));
+    const order = new Map(input.files.map((file, index) => [file.id, index]));
+    report.findings.sort((a, b) => order.get(a.fileId) - order.get(b.fileId));
     // One global verification queue, not a per-file chain. Receipt ownership and
     // primary-file regression checks remain entirely in verificationLoop.
     for (const finding of report.findings) finding.verification = { status: 'pending', causality: 'unverified' };
@@ -151,10 +179,12 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
       (report.orchestration.verifications ??= []).push(stage);
       try {
         gate(); // Do not prefetch receipt evidence for a vetoed model call.
-        const verdicts = await verificationLoop(trackedModel, { ...requestFor(generatedBatches[0]), reviewPhase: 'verification' }, candidates, reader, loopOptions(stage));
+        let verdicts = await verificationLoop(trackedModel, { ...requestFor(generatedBatches[0]), reviewPhase: 'verification' }, candidates, reader, loopOptions(stage));
         signal.throwIfAborted();
-        candidates.forEach((finding, i) => { finding.verification = { status: 'completed', ...verdicts[i] }; });
-        stage.status = stage.retrievalLimited ? 'pending' : 'completed';
+        verdicts = await runCounterVerification(trackedModel, { ...requestFor(generatedBatches[0]),reviewPhase:'verification' }, candidates, verdicts, reader, { ...loopOptions(stage),enabled:options.enableCounterVerification===true,isFatalError:error=>checkpointFailed||error?.code==='MODEL_ARTIFACT_FAILED' });
+        signal.throwIfAborted();
+        candidates.forEach((finding, i) => { finding.verification = { status: verdicts[i].counterVerification?.status === 'incomplete' ? 'incomplete' : 'completed', ...verdicts[i] }; });
+        stage.status = stage.retrievalLimited || verdicts.some(v => v.counterVerification?.status === 'incomplete') ? 'pending' : 'completed';
         if (verdicts.some(v => v.verdict === 'uncertain' || v.verdict === 'supported' && !['introduced', 'preexisting'].includes(v.regression?.classification))) report.limitations.push({ text: '部分候选缺少充分复核证据或前后对照，保留不确定，不强行确认支持或本次引入。' });
       } catch (error) {
         signal.throwIfAborted();
@@ -181,9 +211,12 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
     await options.onProgress?.({ stage: 'batch-complete', snapshotId: input.id, files: report.files, findings: report.findings, limitations: report.limitations });
     return report;
   } catch (error) {
+    if (fatalError) throw fatalError;
     if (!signal.aborted || checkpointFailed || error.code === 'MODEL_ARTIFACT_FAILED') throw error;
     if (!report.files.length) report.files = input.files.map(file => ({ fileId: file.id, path: file.path, status: file.eligibility === 'reviewable' ? 'cancelled' : file.eligibility }));
     for (const state of report.files) if (state.status === 'pending') state.status = 'cancelled';
+    const cancelledOrder = new Map(input.files.map((file, index) => [file.id, index]));
+    report.findings.sort((a, b) => cancelledOrder.get(a.fileId) - cancelledOrder.get(b.fileId));
     for (const finding of report.findings) if (finding.verification?.status !== 'completed') finding.verification = { status: 'incomplete', causality: 'unverified' };
     report.status = 'cancelled';
     report.limitations.push({ text: '整体审查已取消或超时；已验收成果保留，其他范围未完成。' });
@@ -193,6 +226,6 @@ export async function reviewWholeScope(snapshot, model, options = {}) {
     await checkpoint();
     return report;
   } finally {
-    clearTimeout(timer);
+    try { await checkpoints.drain(); } catch (error) { throw fatalError ?? error; } finally { clearTimeout(timer); }
   }
 }

package/src/whole-scope-workers.mjs

@@ -0,0 +1,88 @@
+/** Run a bounded set of workers, always joining admitted work before rejecting.
+ * Cancellation rejects with signal.reason after the join; a worker failure takes
+ * precedence, including when onFatal synchronously aborts the outer controller.
+ */
+export async function runWholeScopeWorkers(items, run, { concurrency = 2, signal, onFatal } = {}) {
+  if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > 4) {
+    throw new RangeError('concurrency must be an integer from 1 to 4');
+  }
+  const results = new Array(items.length);
+  let next = 0, failed = false, failure;
+  async function worker() {
+    while (!failed && !signal?.aborted && next < items.length) {
+      const index = next++;
+      try {
+        results[index] = await run(items[index], index);
+      } catch (error) {
+        if (!failed) {
+          failed = true;
+          failure = error;
+          // Invoke before yielding so outer abort reaches other active work.
+          // A throwing notification cannot replace the original worker failure.
+          onFatal?.(error);
+        }
+      }
+    }
+  }
+  await Promise.allSettled(Array.from({ length: Math.min(concurrency, items.length) }, worker));
+  if (failed) throw failure;
+  if (signal?.aborted) throw signal.reason;
+  return results;
+}
+
+/** Serialize immutable checkpoint values. The first failure is permanent.
+ * Internal rejection handlers prevent fire-and-forget enqueue calls from causing
+ * unhandled rejections; callers still receive the original rejecting promise.
+ */
+export function createCheckpointQueue(save, onFatal) {
+  let tail = Promise.resolve(), failed = false, failure;
+  function rejectFirst(error) {
+    if (!failed) {
+      failed = true;
+      failure = error;
+      onFatal?.(error);
+    }
+    throw failure;
+  }
+  function observe(promise) {
+    // Normalize notification exceptions back to the first persistence failure.
+    tail = promise.catch(error => {
+      if (failed) throw failure;
+      return rejectFirst(error);
+    });
+    tail.catch(() => {});
+    return tail;
+  }
+  return {
+    enqueue(value) {
+      if (save == null) return Promise.resolve();
+      if (failed) return observe(Promise.reject(failure));
+      let checkpoint;
+      try {
+        checkpoint = structuredClone(value);
+      } catch (error) {
+        // Retain FIFO even if cloning an enqueued value fails.
+        return observe(tail.then(() => rejectFirst(error)));
+      }
+      return observe(tail.then(async () => {
+        if (failed) throw failure;
+        try {
+          await save(checkpoint);
+        } catch (error) {
+          return rejectFirst(error);
+        }
+      }));
+    },
+    async drain() {
+      // Also join values enqueued while a save is in progress.
+      for (;;) {
+        const pending = tail;
+        await pending.catch(() => {});
+        if (pending === tail) {
+          if (failed) throw failure;
+          return;
+        }
+      }
+    },
+  };
+}