chainlesschain 0.166.138 → 0.166.139

package/README.md

@@ -1,22 +1,38 @@
 # chainlesschain CLI
 
-Publication authorization: the user explicitly permits this release irrespective of the five task results. Complete exact-commit CLI CI and Strict Sandbox remain required before Actions OIDC publication, followed by CLI registry verification and paired IDE releases. Latest model acceptance is 0/5; historical 41/45 is unchanged.
-
 Command-line interface for installing, configuring, and managing [ChainlessChain](https://www.chainlesschain.com), including the coding agent, governed tools, sessions, memory, and IDE integrations.
 
-The .137 OIDC run stopped before CLI upload because an Agent SDK test changed without a version bump. SDK **0.2.17** restores source/provenance alignment; its runtime output is unchanged. Release uses a new immutable .138 tag, with the existing tree/provenance checks retained.
+<!-- release139-candidate:start -->
+
+## CLI 0.166.139 / IDE repair release
+
+This package is CLI **0.166.139**, paired with Open VSX **0.37.175** and JetBrains **0.4.192**, with unchanged upstream SDK **0.2.17** and Kernel **0.1.11**. Production publication uses GitHub Actions OIDC after the exact-source CLI CI and Strict Sandbox matrices pass on every configured platform. Install `npm i -g chainlesschain@0.166.139 --registry https://registry.npmjs.org`, restart the CLI and IDE chat hosts, and check `cc --version` and `cc doctor`. IDE plugins publish after the public CLI package is verified; mobile and PC clients follow verified IDE releases on their separate product version track.
+
+The repair reserves author, fresh independent review and final reporting work within the original total request budget. Partial JavaScript reads recover complete surrounding statements from the same file snapshot within the existing output limit; focused reads do not silently switch to unrelated ranges. This release includes the standalone WebSocket host-model-policy repair.
+
+CLI .138 acceptance remains **2/4**: verify-13 and first-run-darwin-vscode passed; verify-08 and verify-36 failed on author-stage iteration exhaustion despite passing candidate checks. CLI .139 engineering checks do not establish new model-task acceptance or rescore those results. CLI .136 verify-19 remains a separate historical pass; historical **41/45** and .137 **0/5** are unchanged. Review stays enabled, with 20 model turns, 24 physical requests per diagnostic case and the 32768-token planning context. JetBrains uploads may await Marketplace approval; an official pending-review ZIP is distinct from a public listing. Microsoft Marketplace remains deferred.
+
+<!-- release139-candidate:end -->
+
+<!-- release138-current:start -->
+
+## CLI 0.166.138 — previous verified public release
+
+CLI **0.166.138** and upstream Agent SDK **0.2.17** are published through GitHub Actions OIDC. Install `npm i -g chainlesschain@0.166.138 --registry https://registry.npmjs.org`, restart `cc ui` and IDE chat hosts, then run `cc --version` and `cc doctor`. Open VSX **0.37.174** publication succeeded. JetBrains **0.4.191** is approved and publicly listed in Marketplace (update `1209507`); public ZIP payload comparison with the official build remains pending. Both new IDE versions recommend CLI **0.166.138**.
+
+This release preserves recovery when source content was omitted from a model request and retains the original user task across canonical compaction, tool tails and persistent sessions. Only exact source spans selected for a provider count as historical read coverage. Repeated delivery failures stop with an explicit limitation.
 
-## CLI 0.166.138 — prepared candidate, not yet published
+Exact release source `e42ea07b6da7ab2c3eb709002448b32d5fedf535` passed all 75 required CLI CI jobs (one optional PR dry-run skipped) and all 6 Strict Sandbox jobs across the configured Linux, Windows and macOS matrix. The official [OIDC workflow](https://github.com/chainlesschain/chainlesschain/actions/runs/41313099948) independently downloaded the public SDK/CLI, verified immutable package bytes and signed provenance, and installed/started the CLI before IDE release tags were created. SDK 0.2.17 aligns its full source tree with provenance; SDK runtime output is unchanged.
 
-After verified publication, install with `npm i -g chainlesschain@0.166.138 --registry https://registry.npmjs.org`, restart the chat host, and verify `cc --version` / `cc doctor`. The current public installation command remains `npm i -g chainlesschain@0.166.136 --registry https://registry.npmjs.org`. The candidate preserves focused recovery when source content is omitted from a model request. Same-batch reservations remain synchronous; only exact source spans actually selected for the provider become historical coverage. Repeated delivery failures stop with an explicit limitation, and confirmed navigation does not advance or move backward on an unsuccessful read.
+As reviewed on **2026-11-02**, the public .138 four-sample retest accepted **2/4**: first-run VS Code and verify-13 passed. verify-08 and verify-36 passed independent candidate tests but exhausted **20/20** author turns before independent review, so both remain failures. All **80/80** physical requests have complete usage records. Previous .137 **0/5**, historical cumulative **41/45**, and the separate image follow-up **0/1** retain their own scopes; this is not a full 45-task success rate for .138. Accepted samples are skipped in later retests. Engineering checks and publication add no model task acceptance. Kernel stays **0.1.11**; Microsoft Marketplace and PC/mobile are outside this release.
 
-Canonical compaction also retains the original user task and owned resume sources across tool tails and persistent sessions, rejecting task loss, changes or new duplicates before commit. Its 69 focused local regressions pass; fresh same-source generation and independent acceptance have completed at 0/5; the user waived that result as a publication prerequisite.
+[Publication evidence](../../docs/research/cli/evidence/release138-public/README.md) · [Open VSX release](https://github.com/chainlesschain/chainlesschain/actions/runs/41316653600) · [Current model results](../../docs/research/cli/verify01-openai-138/README.md) · [Upgrade guide](https://docs.chainlesschain.com/chainlesschain/cli-ide-update-2026-11-02-138.html).
 
-The recorded CLI .137 candidate round completed at **0/5**; CLI .138 has not started another model cohort. Source projection now preserves proven JavaScript source expressions while retaining strict standalone/decoded JSON and sensitive-field checks under ruleset v9. General coding guidance uses bounded assertions for large binary fixtures. Known remaining limits include late independent-review scheduling, omitted unproven partial source fragments, and incorrect or incomplete model-generated assertions. Two independently valid candidate suites still failed end-to-end task completion; their checks do not count as successful model tasks. [Raw results and publication authorization](../../docs/research/cli/verify01-openai-137/README.md).
+Main also contains the later standalone WebSocket host-model-policy repair (`2e97ce3d79`), awaiting its own fully validated CLI release. The published CLI 0.166.138 remains bound to its verified release source.
 
-Local validation: 109 related regressions pass; restoring the released .136 guard makes seven new controls fail. The prepared pairing is Open VSX **0.37.174** / JetBrains **0.4.190**, both recommending CLI **0.166.138**, released only after the CLI is verified public. Until then the older public IDEs remain compatible. VS Code also preserves provider diagnostics and saved tool identity across reload; no child-package update is required. Full exact-source CLI CI and CLI Strict Sandbox must pass before Actions OIDC publication. Historical model acceptance remains **41/45**; the focused image follow-up remains **0/1** and is not rescored by engineering checks. [Evidence](../../docs/research/cli/verify01-openai-136/read-delivery-repair/README.md).
+<!-- release138-current:end -->
 
-## CLI 0.166.136 — verified public repair
+## CLI 0.166.136 — previous public repair
 
 Install with `npm i -g chainlesschain@0.166.136 --registry https://registry.npmjs.org`, restart the chat host, then run `cc --version` and `cc doctor`. This release repairs full-history session forks and preserves independent plugin/MCP restrictions through background restore. Malformed policy values fail before normalization or customization loading.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chainlesschain",
-  "version": "0.166.138",
+  "version": "0.166.139",
   "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",
   "type": "module",
   "bin": {

package/src/assets/linux-subreaper/linux-arm64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:6395a47a5bd9b038303e94a5e93754258c8480dab64635460f973eb93dc6f4d8",
   "bytes": 778808,
   "linkage": "static",
-  "commit": "e42ea07b6da7ab2c3eb709002448b32d5fedf535"
+  "commit": "eec8b97b6040d19004670bfead0bec1b8a27b71b"
 }

package/src/assets/linux-subreaper/linux-x64/manifest.json

@@ -6,5 +6,5 @@
   "imageDigest": "sha256:f162e55ad3f3f72f8a52e9d7f12b5b8db44506c2ca66a14d7d62d5cd4f12498e",
   "bytes": 934160,
   "linkage": "static",
-  "commit": "e42ea07b6da7ab2c3eb709002448b32d5fedf535"
+  "commit": "eec8b97b6040d19004670bfead0bec1b8a27b71b"
 }

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.139",
+      "cliVersions": ["0.166.139"],
+      "date": "2026-11-02",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.139: complete author work and independent review within one budget (candidate, 2026-11-02)",
+          "body": "- Reserve fresh independent inspection, repair, read-back and final reporting inside the original model-turn limit, including when the author continues calling tools. Unknown usage and insufficient remaining review capacity fail explicitly; last-turn tool calls cannot become a successful terminal result.\n- Recover complete surrounding JavaScript statements from the same file snapshot when a partial page cannot be projected. Preserve the original requested range and actual returned range, the existing JSON/source validation, provider delivery accounting and output metadata headroom.\n- Preserve focused explicit read ranges instead of silently substituting an unrelated unread section. Broad truncated scans retain bounded cursor progress.\n- Pair CLI 0.166.139 with Open VSX 0.37.175 and JetBrains 0.4.192 after complete exact-source release gates and verified upstream publication. SDK 0.2.17 and Kernel 0.1.11 remain unchanged and must pass upstream reuse checks.\n- Retest only verify-08 and verify-36 with the new package set, keeping independent review and the original budget. Prior CLI .138 result remains 2/4; previously accepted samples are not repeated. These engineering repairs do not claim new real-model success."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.138",

package/src/gateways/ws/ws-server.js

@@ -388,6 +388,22 @@ export class ChainlessChainWSServer extends EventEmitter {
       );
     this.resolveEvolutionCompositionFactory =
       options.resolveEvolutionCompositionFactory || null;
+    // Standalone embedders use the same host-owned optional Evolution policy
+    // as cc ui. Explicit policy hooks/factories (including null) still win.
+    if (
+      options.prepareUiModelTurn === undefined &&
+      options.evolutionCompositionFactory === undefined &&
+      options.resolveEvolutionCompositionFactory === undefined
+    ) {
+      this.prepareUiModelTurn = async (context) => {
+        const { prepareConfiguredUiModelTurn } = await import(
+          "../../lib/evolution/optional-ui-model-turn.js"
+        );
+        return prepareConfiguredUiModelTurn(context, {
+          cwd: this.projectRoot,
+        });
+      };
+    }
     this.runtimeAdmissionDependencies =
       captureSkillRuntimeDependencies(options);
     this.skillOutcomeIndex =

package/src/lib/coding-change-review-context.js

@@ -140,6 +140,57 @@ function pendingCalls(messages) {
  * unmarked system messages must already be trusted host instructions.
  * This journal neither replaces durable history nor grants any authority.
  */
+export function changeReviewRequestReserve(limit) {
+  // Inspection, repair, read-back and a terminal account share the original
+  // budget. Tiny runs retain at least one author request, never extra credit.
+  return Number.isFinite(limit) ? Math.min(4, Math.max(0, limit - 1)) : 4;
+}
+
+export function changeReviewBudgetNotice(budget, reviewing) {
+  const available = budget.remaining() + 1;
+  if (reviewing)
+    return available === 1
+      ? " Independent change review: this is the final model request. Give a concise terminal account based on observations already obtained. Report unresolved requirements as incomplete. A tool call now cannot receive another model response and will not count as completion."
+      : " Independent change review is active. Inspect current files, repair concrete requirement gaps, then read back the repair. Reserve the final request for a concise terminal account of results and limitations; further exploration cannot extend this budget.";
+  const reserve = changeReviewRequestReserve(budget.limit);
+  const authorRequests = Math.max(0, available - reserve);
+  return (
+    ` Author allocation: ${authorRequests} requests remain before the ${reserve}-request independent change-review reserve (including this request when positive). Write the deliverable early; author completion is provisional. Review needs fresh inspection and a terminal response and does not receive extra requests. ` +
+    (authorRequests === 0
+      ? "The preferred author allocation is exhausted; further inspection without a delivered change may leave insufficient budget for review."
+      : "The runtime will hand changed files to independent review when the reserve is reached.")
+  );
+}
+
+export function changeReviewBudgetInsufficientError(remaining) {
+  const error = new Error(
+    `Independent change review requires at least two remaining model requests for fresh inspection and a terminal response; only ${remaining} remain. The task has not completed independent review.`,
+  );
+  error.code = "CC_CHANGE_REVIEW_BUDGET_INSUFFICIENT";
+  return error;
+}
+
+export function canReserveChangeReview({
+  enabled,
+  changed,
+  requested,
+  usageKnown,
+  pendingMutations,
+  pendingChildren,
+  remaining,
+  limit,
+}) {
+  return (
+    enabled === true &&
+    changed === true &&
+    !requested &&
+    usageKnown !== false &&
+    pendingMutations === 0 &&
+    pendingChildren === 0 &&
+    remaining <= changeReviewRequestReserve(limit)
+  );
+}
+
 export class CodingChangeReviewContext {
   #initial;
   #journal = [];

package/src/lib/coding-task-guidance.js

@@ -11,7 +11,7 @@ export const CODING_TASK_QUALITY_GUIDANCE = `Coding task quality:
 - Trace rejection before asserting its aftermath: it may precede registration or persistence. Inspect whether state stays unchanged, a failed record exists or an event is emitted. Compare independently recorded identities and provenance; equal text does not prove ownership.
 - Inspect persistence projections before comparing histories. Host notices, lineage and imports may accompany user/assistant messages; verify their provenance separately. Report defects that cannot be repaired within the permitted scope instead of inventing passing behavior.
 - Run focused checks with permitted execution tools. With file tools only, inspect imports, contracts and fixtures and say tests were not run. Read-back or static inspection is not a passing test.
-- Finish requested edits and read-back before the final reply; reserve the last available model request for a concise terminal account. For large files, write a small complete section, await its result, then extend it with a unique edit anchor rather than rewriting the growing file. Report delivery, actual checks and limitations once.`;
+- Finish requested edits and read-back before the final reply; reserve the last available model request for a concise terminal account. If an independent review allocation is announced, finish the author deliverable within the author allocation: the review must inspect current files, repair gaps and report within the same total budget. Do not spend the review allocation on additional author discovery. For large files, write a small complete section, await its result, then extend it with a unique edit anchor rather than rewriting the growing file. Report delivery, actual checks and limitations once.`;
 
 export const HERMETIC_CODING_SYSTEM_PROMPT = `You are a hermetic coding assistant. The exposed file tools are the complete tool surface. Inspect and mutate only the exact paths authorized by the user request. Do not invoke hidden tools, commands, language servers or other execution paths.
 

package/src/lib/read-file-loop-guard.js

@@ -267,11 +267,9 @@ export class ReadFileLoopGuard {
     const covered = entry.spans.some(
       ([start, end]) => start <= span.start && end >= span.end,
     );
-    let targeted =
-      Number(args.offset) > 0 &&
-      Number(args.limit) > 0 &&
-      Number(args.limit) <= 200 &&
-      !page.truncated;
+    const explicitRange =
+      Number(args.offset) > 0 && Number(args.limit) > 0 && !page.truncated;
+    let targeted = explicitRange;
     const coveredPrefix = entry.spans.some(
       ([start, end]) => start <= span.start && end > span.start,
     );
@@ -327,7 +325,7 @@ export class ReadFileLoopGuard {
         if (restoring) page.readRecovery.fileVersion = fileVersion;
       } else {
         const unread = entry.spans[0]?.[0] === 0 ? entry.spans[0][1] : 0;
-        if (unread < span.total) {
+        if (unread < span.total && !explicitRange) {
           const requestedRange = page.range;
           page = continuePage(unread);
           if (page.error || !page.readSpan) return page;
@@ -340,7 +338,12 @@ export class ReadFileLoopGuard {
         } else {
           const confirmedEnd =
             entry.confirmedSpans[0]?.[0] === 0 ? entry.confirmedSpans[0][1] : 0;
-          if (this.visiblePages !== null && confirmedEnd < span.total) {
+          if (
+            this.visiblePages !== null &&
+            !entry.confirmedSpans.some(
+              ([start, end]) => start <= span.start && end >= span.end,
+            )
+          ) {
             return {
               path: filePath,
               fileVersion,
@@ -358,7 +361,7 @@ export class ReadFileLoopGuard {
             hashed: args.hashed === true,
             alreadyRead: true,
             contentOmitted: true,
-            reachedEnd: true,
+            reachedEnd: confirmedEnd >= span.total,
             readProgress: { newContent: false },
             readRecovery: { action: "use-findings" },
             ...(entry.summary?.outline
@@ -366,12 +369,12 @@ export class ReadFileLoopGuard {
               : {}),
             recoveryRead: {
               path: filePath,
-              offset: 1,
+              offset: explicitRange ? page.range.startLine : 1,
               limit: 80,
               ...(args.hashed === true ? { hashed: true } : {}),
               ...(args.raw === true ? { raw: true } : {}),
             },
-            hint: "The unchanged file was read earlier, but historical coverage does not mean its source is visible now. Use any source excerpts actually present in this request. For missing details, use search_files or read_file with a specific offset and limit (at most 80 lines); recoveryRead is a bounded starting range, not permission to restart a full scan. Reading the file is not task completion.",
+            hint: "This requested range was read earlier, but historical coverage does not mean its source is visible now. The runtime has not substituted an unrelated file range. Use source actually present in this request; recover missing details with a focused search or the bounded recoveryRead. Reading the file is not task completion.",
           };
         }
       }

package/src/lib/read-file-page.js

@@ -1,3 +1,5 @@
+import { recoverCompleteSourceRead } from "./source-read-recovery.js";
+
 /** Build a bounded read result with a cursor describing what was actually read. */
 export function buildReadFilePage(
   rendered,
@@ -61,7 +63,7 @@ export function buildReadFilePage(
   const charEnd = truncated
     ? charStart + count
     : lines.slice(0, end).reduce((n, line) => n + line.length + 1, 0);
-  return {
+  const page = {
     path: filePath,
     ...(fileVersion ? { fileVersion } : {}),
     ...(offset || limit || column > 1 || truncated
@@ -96,6 +98,7 @@ export function buildReadFilePage(
     hashed: args.hashed === true,
     content,
   };
+  return recoverCompleteSourceRead(page, rendered, args, maxChars);
 }
 
 /** A bounded navigation index, not a substitute for reading the cited lines. */

package/src/lib/source-read-recovery.js

@@ -0,0 +1,89 @@
+import { parse } from "acorn";
+import { canProjectHostToolExcerpt } from "./tool-result-preview.js";
+
+/**
+ * A cut source container is not safe evidence. Recover its complete top-level
+ * statements from the very same read snapshot, with explicit range metadata.
+ * This does not exempt source from either projection or provider sanitization.
+ */
+export function recoverCompleteSourceRead(page, source, args, maxChars) {
+  if (
+    typeof page?.content !== "string" ||
+    typeof page.fileVersion !== "string" ||
+    !/\.(?:[cm]?js)$/iu.test(page.path || "") ||
+    args.hashed === true ||
+    !page.range ||
+    !page.readSpan ||
+    source.length > 512 * 1024 ||
+    canProjectHostToolExcerpt(page.content, "read_file")
+  )
+    return page;
+
+  let program;
+  let tokens = 0;
+  try {
+    program = parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowReturnOutsideFunction: true,
+      onToken() {
+        if (++tokens > 32768)
+          throw new RangeError("Source recovery token bound");
+      },
+    });
+  } catch {
+    // Malformed or oversized source retains the ordinary omission boundary.
+    return page;
+  }
+  const statements = program.body.filter(
+    (node) => node.start < page.readSpan.end && node.end > page.readSpan.start,
+  );
+  if (!statements.length) return page;
+  const start = Math.min(
+    page.readSpan.start,
+    source.lastIndexOf("\n", statements[0].start - 1) + 1,
+  );
+  const followingNewline = source.indexOf("\n", statements.at(-1).end);
+  const end = Math.max(
+    page.readSpan.end,
+    followingNewline < 0 ? source.length : followingNewline + 1,
+  );
+  const content = source.slice(start, end);
+  if (
+    content === page.content ||
+    !canProjectHostToolExcerpt(content, "read_file")
+  )
+    return page;
+  const startLine = 1 + (source.slice(0, start).match(/\n/gu) || []).length;
+  const endLine =
+    startLine +
+    (content.match(/\n/gu) || []).length -
+    (content.endsWith("\n") ? 1 : 0);
+  const recovered = {
+    ...page,
+    content,
+    range: { startLine, endLine, totalLines: page.range.totalLines },
+    readSpan: { start, end, total: source.length },
+    sourceRecovery: {
+      action: "complete-source-container",
+      fileVersion: page.fileVersion,
+      requestedRange: { ...page.range },
+      requestedSpan: { ...page.readSpan },
+      note: "The requested excerpt cut a source container. These complete surrounding statements come from the same file version; the range and readSpan describe the content actually returned.",
+    },
+  };
+  delete recovered.truncated;
+  delete recovered.size;
+  delete recovered.nextRead;
+  delete recovered.hint;
+  if (end < source.length) {
+    recovered.nextRead = { ...args, offset: endLine + 1, column: 1 };
+    recovered.hint = "Continue with nextRead only if more source is needed.";
+  }
+  // The read guard, host telemetry and delivery envelope still add metadata.
+  // Reuse the ordinary page's headroom: an almost-full recovery would be
+  // projected back to an omission by the final cap before reaching a provider.
+  return JSON.stringify(recovered).length <= Math.max(0, maxChars - 2048)
+    ? recovered
+    : page;
+}

package/src/lib/tool-result-preview.js

@@ -33,7 +33,7 @@ const PREVIEW_HINT =
   "Tool output truncated. Narrow the request: filter/count locally, select fields, search_files, or read_file with offset/limit. Omitted text is not full-output evidence.";
 
 /** Check only host-created excerpts; original uncut tool text still reaches ingress. */
-function completeExcerpt(text, tool) {
+export function canProjectHostToolExcerpt(text, tool) {
   const scan = createEvidenceJsonTextBoundary((message) => new Error(message), {
     ...EVIDENCE_JSON_POLICY,
     sourceLiteralPolicy: "explicit-source-containers-v1",
@@ -239,7 +239,8 @@ export function safeHostToolResultForModel(tool, result) {
   let safe = result;
   for (const field of fields) {
     const text = result[field];
-    if (typeof text !== "string" || completeExcerpt(text, tool)) continue;
+    if (typeof text !== "string" || canProjectHostToolExcerpt(text, tool))
+      continue;
     if (safe === result) safe = { ...result };
     safe[field] =
       tool === "read_file"
@@ -268,7 +269,10 @@ export function boundedCommandOutput(output, max, tool = "run_code") {
       output,
       Math.max(1, Math.floor(max / 2)),
     );
-    if (JSON.stringify(preview).length <= max && completeExcerpt(preview, tool))
+    if (
+      JSON.stringify(preview).length <= max &&
+      canProjectHostToolExcerpt(preview, tool)
+    )
       return preview;
   } else if (!/[{}\[\]"']/u.test(output)) {
     let low = 0;

package/src/runtime/agent-core.js

@@ -77,7 +77,12 @@ import {
   CODING_TASK_QUALITY_GUIDANCE,
   CODING_CHANGE_REVIEW_PROMPT,
 } from "../lib/coding-task-guidance.js";
-import { CodingChangeReviewContext } from "../lib/coding-change-review-context.js";
+import {
+  CodingChangeReviewContext,
+  changeReviewBudgetNotice,
+  changeReviewBudgetInsufficientError,
+  canReserveChangeReview,
+} from "../lib/coding-change-review-context.js";
 import { RemoteReadLoopGuard } from "../lib/remote-read-loop-guard.js";
 import {
   isPrActionRequest,
@@ -15608,6 +15613,37 @@ export async function* agentLoop(messages, options) {
   toolContext.readFileLoopGuard = readFileLoopGuard;
   let lastTaskProgressIntervention = null;
 
+  // Both an author completion and the reserved review window enter the same
+  // phase. Neither path manufactures an author response or adds request budget.
+  const beginChangeReview = (draft = null) => {
+    throwIfAborted(signal);
+    if (budget.remaining() < 2)
+      throw changeReviewBudgetInsufficientError(budget.remaining());
+    if (independentReviewSetupError) throw independentReviewSetupError;
+    changeReviewState.requested = true;
+    const reviewPrompt = markRuntimeOnlySessionMessage({
+      role: "user",
+      content: CODING_CHANGE_REVIEW_PROMPT,
+    });
+    if (draft)
+      appendMessages(
+        markRuntimeOnlySessionMessage({
+          role: "assistant",
+          content: draft.content || "",
+        }),
+      );
+    appendMessages(reviewPrompt);
+    if (independentReviewContext) {
+      independentReviewContext.activate(reviewPrompt);
+      changeReviewState.independentReviewPending = true;
+      readFileLoopGuard = new ReadFileLoopGuard();
+      remoteReadLoopGuard = new RemoteReadLoopGuard();
+      taskProgressTracker = new TaskProgressTracker();
+      toolContext.readFileLoopGuard = readFileLoopGuard;
+      lastTaskProgressIntervention = null;
+    }
+  };
+
   while (budget.hasRemaining()) {
     if (loopMcpCatalog) {
       currentMcpSnapshot = readMcpToolCatalog(loopMcpCatalog);
@@ -15654,6 +15690,24 @@ export async function* agentLoop(messages, options) {
       return;
     }
     readFileLoopGuard.finishBatch();
+    if (
+      canReserveChangeReview({
+        enabled: options.reviewChanges,
+        changed: hasFileContentChanges,
+        requested: changeReviewState.requested,
+        usageKnown: changeReviewState.usageKnown,
+        pendingMutations: pendingSubtreeMutations.size,
+        pendingChildren: backgroundSubAgents.size,
+        remaining: budget.remaining(),
+        limit: budget.limit,
+      })
+    ) {
+      beginChangeReview();
+      yield {
+        type: "iteration-warning",
+        message: "Reviewing changed files against the task before finishing.",
+      };
+    }
     if (remoteReadLoopGuard.stalled && !remoteReadLoopGuard.synthesisRequired) {
       await _awaitBackgroundUsageSettlement(
         backgroundSubAgents,
@@ -16585,7 +16639,10 @@ export async function* agentLoop(messages, options) {
             `Execution budget: this request plus ${furtherRequests} further model requests. ` +
             "For requested changes, reserve requests for implementation, focused validation, and repair or an accurate unfinished-work report. " +
             "Reading or an existing passing baseline does not deliver requested changes. " +
-            "For research or monitoring, use the remaining requests for evidence and the requested answer; do not create files just to show activity.",
+            "For research or monitoring, use the remaining requests for evidence and the requested answer; do not create files just to show activity." +
+            (options.reviewChanges === true
+              ? changeReviewBudgetNotice(budget, changeReviewState.requested)
+              : ""),
         },
       ];
       contextMemoryTrustedSystemIndexes.push(callMessages.length - 1);
@@ -16988,7 +17045,7 @@ export async function* agentLoop(messages, options) {
     }
     throwIfAborted(signal);
     if (
-      independentReviewContext?.active &&
+      options.reviewChanges === true &&
       changeReviewState.usageKnown === false
     ) {
       const error = new Error(
@@ -17247,42 +17304,14 @@ export async function* agentLoop(messages, options) {
         };
         return;
       }
-      // Opt-in review uses the same loop, tools, usage settlement and budget.
-      // Never emit a provisional completion or turn this self-check into an
-      // acceptance verdict. Failed/deferred writes do not arm the review.
+      // Author completion is provisional until the independent review phase.
       if (
         options.reviewChanges === true &&
         hasFileContentChanges &&
         !changeReviewState.requested &&
-        changeReviewState.usageKnown !== false &&
-        budget.hasRemaining()
+        changeReviewState.usageKnown !== false
       ) {
-        throwIfAborted(signal);
-        if (independentReviewSetupError) throw independentReviewSetupError;
-        changeReviewState.requested = true;
-        const reviewPrompt = markRuntimeOnlySessionMessage({
-          role: "user",
-          content: CODING_CHANGE_REVIEW_PROMPT,
-        });
-        appendMessages(
-          markRuntimeOnlySessionMessage({
-            role: "assistant",
-            content: msg.content || "",
-          }),
-          reviewPrompt,
-        );
-        if (independentReviewContext) {
-          independentReviewContext.activate(reviewPrompt);
-          changeReviewState.independentReviewPending = true;
-          // These are phase-local discovery hints, not permission or spend
-          // authorities. Fresh inspection must not inherit author assertions,
-          // old visible file pages, or a pause caused by author exploration.
-          readFileLoopGuard = new ReadFileLoopGuard();
-          remoteReadLoopGuard = new RemoteReadLoopGuard();
-          taskProgressTracker = new TaskProgressTracker();
-          toolContext.readFileLoopGuard = readFileLoopGuard;
-          lastTaskProgressIntervention = null;
-        }
+        beginChangeReview(msg);
         yield {
           type: "iteration-warning",
           message: "Reviewing changed files against the task before finishing.",