iterate-plugin 3.5.5 → 3.5.7

package/dist/tools/transcript.js

@@ -148,7 +148,7 @@ export function registerTranscriptTool(ctx) {
                 description: 'For `capture`: array of applied fixes [{id, file, round, summary, linesAdded, linesRemoved, success}].',
             },
             refReadFiles: { type: 'json', description: 'For `capture`: flat array of all read files across rounds (optional).' },
-            stoppedReason: { type: 'string', description: 'For `capture`: why the run ended — "converged" | "max_rounds_reached" | "aborted_by_validation". When omitted, derived from the convergence trend (trailing 0 = converged, otherwise = max_rounds_reached once a round ran).' },
+            stoppedReason: { type: 'string', description: 'For `capture`: why the run ended — "converged" | "max_rounds_reached" | "aborted_by_validation" | "aborted_by_config" | "schema_invalid" | "no_usable_reviewer_output" | "inconclusive". When omitted, derived from the convergence trend (trailing 0 = converged, otherwise = max_rounds_reached once a round ran).' },
             text: { type: 'string', description: 'For `nudge`: steering text to set (or null to clear).' },
             path: { type: 'string', description: 'Project root directory (default: current working directory).' },
         },
@@ -344,13 +344,24 @@ function rehydrateBuilder(manifest, approval) {
         maxRounds: manifest.maxRounds,
     });
     for (const r of Array.isArray(manifest.rounds) ? manifest.rounds : []) {
+        // A malformed/null round row must be skipped, never a throw (the caller
+        // wraps rehydrate in a fallback, but preserving sibling rows is better).
+        if (!r || typeof r !== 'object')
+            continue;
         builder.roundStart(r.round, manifest.maxRounds);
         for (const t of Array.isArray(r.threads) ? r.threads : []) {
-            builder.reviewerStart(t.dimension || 'review', t.attempt || 1);
-            builder.reviewerMessage((t.messages ?? []).join('\n'));
-            builder.reviewerRead(t.readFiles ?? []);
-            for (const f of t.findings ?? [])
-                builder.reviewerFindings([f]);
+            // restoreThread (not reviewerStart + reviewerMessage(join)) preserves the
+            // message ARRAY boundaries and the thread's own dimension: rehydration
+            // previously collapsed each thread's messages into one string and, once a
+            // round hit the per-round thread cap, silently DROPPED the extra threads
+            // / mis-merged their findings into the previous dimension's thread.
+            builder.restoreThread(r.round, {
+                dimension: t.dimension,
+                attempt: t.attempt,
+                messages: t.messages,
+                readFiles: t.readFiles,
+                findings: t.findings,
+            });
         }
     }
     for (let idx = 0; idx < (manifest.convergence ?? []).length; idx += 1) {

package/dist/transcript.js

@@ -82,7 +82,9 @@ function normalizeFinding(input) {
     const severity = sev === 'critical' || sev === 'high' || sev === 'medium' || sev === 'low'
         ? sev
         : 'low';
-    const line = typeof f.line === 'number' && Number.isFinite(f.line) ? f.line : 0;
+    // Only a non-negative integer is a real line anchor; a fractional/malformed
+    // value (e.g. 3.7 from a bypassed schema) must not leak into the manifest.
+    const line = typeof f.line === 'number' && Number.isInteger(f.line) && f.line >= 0 ? f.line : 0;
     return {
         dimension,
         file,
@@ -219,7 +221,9 @@ export class ReviewTranscriptBuilder {
         const att = typeof attempt === 'number' && Number.isFinite(attempt) ? Math.floor(attempt) : 1;
         this.roundStart(this.round);
         const live = this.rounds[this.round - 1];
-        if (live && this.threadCount(live) < MAX_THREADS_PER_ROUND) {
+        if (!live)
+            return;
+        if (this.threadCount(live) < MAX_THREADS_PER_ROUND) {
             live.threads.push({
                 dimension: dim || 'review',
                 attempt: att > 0 ? att : 1,
@@ -228,6 +232,78 @@ export class ReviewTranscriptBuilder {
                 findings: [],
             });
         }
+        else {
+            // Thread cap reached: route the extra dimension/retry into ONE shared
+            // "other" overflow thread instead of silently dropping it. A dropped
+            // reviewerStart used to leave `currentThread()` pointing at the PREVIOUS
+            // dimension's thread, so its findings were mis-attributed to that
+            // dimension. The overflow thread stays bounded (at most ONE extra thread
+            // per round) while keeping over-cap findings attributable to "other".
+            let overflow = live.threads.find((t) => t.dimension === 'other');
+            if (!overflow) {
+                overflow = {
+                    dimension: 'other',
+                    attempt: att > 0 ? att : 1,
+                    messages: [],
+                    readFiles: [],
+                    findings: [],
+                };
+                live.threads.push(overflow);
+            }
+        }
+        this.touch();
+    }
+    /**
+     * Restore ONE persisted thread during rehydration, preserving the message
+     * ARRAY boundaries (a rehydrated manifest is re-serialized on the next nudge
+     * edit, so collapsed messages would silently rewrite the evidence) and the
+     * thread's own dimension (never merging it into a previous dimension's
+     * thread). Bypasses the live per-round cap — the manifest already enforced
+     * it at capture time — but every restored field is hard-bounded so a hostile
+     * hand-edited manifest can never blow up memory.
+     */
+    restoreThread(round, thread) {
+        const r = typeof round === 'number' && Number.isFinite(round)
+            ? Math.min(Math.floor(round), MAX_ROUNDS)
+            : 1;
+        this.roundStart(r);
+        const live = this.rounds[this.round - 1];
+        if (!live)
+            return;
+        if (!thread || typeof thread !== 'object')
+            return;
+        // Hostile-manifest guard: keep the live hard bound (with headroom for the
+        // single overflow thread) and newest-first truncate beyond it.
+        if (live.threads.length >= MAX_THREADS_PER_ROUND * 2 + 1)
+            return;
+        const dim = typeof thread.dimension === 'string' && thread.dimension.trim()
+            ? thread.dimension.trim()
+            : 'review';
+        const att = typeof thread.attempt === 'number' && Number.isFinite(thread.attempt)
+            ? Math.floor(thread.attempt)
+            : 1;
+        const t = {
+            dimension: dim,
+            attempt: att > 0 ? att : 1,
+            messages: [],
+            readFiles: [],
+            findings: [],
+        };
+        const messages = Array.isArray(thread.messages) ? thread.messages : [];
+        for (const m of messages.slice(0, MAX_MESSAGES_PER_THREAD)) {
+            if (typeof m === 'string' && m.trim())
+                t.messages.push(m);
+        }
+        if (Array.isArray(thread.readFiles)) {
+            t.readFiles.push(...dedupePaths(thread.readFiles));
+        }
+        if (Array.isArray(thread.findings)) {
+            for (const f of thread.findings) {
+                if (normalizeFinding(f))
+                    pushThreadFinding(t, f);
+            }
+        }
+        live.threads.push(t);
         this.touch();
     }
     /** Append narration (assistant text) to the current reviewer thread. */

package/lib/client.js

@@ -1211,6 +1211,26 @@ function trendMax(points) {
   }
   return max;
 }
+function stoppedReasonLabel(reason) {
+  switch (reason) {
+    case "converged":
+      return "\u5DF2\u7ED3\u675F \xB7 \u5DF2\u6536\u655B\uFF08\u65E0\u65B0\u53D1\u73B0\uFF09";
+    case "max_rounds_reached":
+      return "\u5DF2\u7ED3\u675F \xB7 \u8FBE\u5230\u8F6E\u6570\u4E0A\u9650";
+    case "aborted_by_validation":
+      return "\u5DF2\u7ED3\u675F \xB7 \u9A8C\u8BC1\u5931\u8D25\u540E\u56DE\u6EDA\u505C\u6B62";
+    case "aborted_by_config":
+      return "\u5DF2\u7ED3\u675F \xB7 \u9A8C\u8BC1\u547D\u4EE4\u4E0D\u5728\u767D\u540D\u5355\uFF08\u914D\u7F6E\u9700\u4FEE\u590D\uFF09";
+    case "inconclusive":
+      return "\u5DF2\u7ED3\u675F \xB7 \u8F6E\u6B21\u7ED3\u8BBA\u4E0D\u660E\uFF08\u5BA1\u67E5\u8F93\u51FA\u65E0\u6548\uFF09";
+    case "schema_invalid":
+      return "\u5DF2\u7ED3\u675F \xB7 \u5BA1\u67E5\u8F93\u51FA\u8FDE\u7EED schema \u6821\u9A8C\u5931\u8D25";
+    case "no_usable_reviewer_output":
+      return "\u5DF2\u7ED3\u675F \xB7 \u65E0\u53EF\u7528\u5BA1\u67E5\u8F93\u51FA";
+    default:
+      return reason ? `\u5DF2\u7ED3\u675F \xB7 ${reason}` : "\u5DF2\u7ED3\u675F";
+  }
+}
 function buildCompletionSummary(report) {
   const conv = (
     /** @type {Record<string, unknown>} */
@@ -1229,6 +1249,7 @@ var CONFIG_EDIT_FIELDS = [
   { key: "dimensions", label: "\u5BA1\u67E5\u7EF4\u5EA6", hint: '\u6570\u7EC4\uFF0C\u5982 ["correctness","security"]' },
   { key: "max_rounds", label: "\u6700\u5927\u8F6E\u6570", hint: "\u6B63\u6574\u6570" },
   { key: "review.scope", label: "\u5BA1\u67E5\u8303\u56F4", hint: '"full" \u6216 "changed-only"' },
+  { key: "reasoning_effort", label: "\u5BA1\u67E5\u63A8\u7406\u5F3A\u5EA6", hint: '"low" / "medium" / "high"\uFF0C\u7F3A\u7701\u8DDF\u968F\u6A21\u578B\u9ED8\u8BA4' },
   { key: "atomic.max_lines", label: "\u539F\u5B50\u4FEE\u590D\u4E0A\u9650\u884C\u6570", hint: "\u6B63\u6574\u6570" },
   { key: "git.push_per_round", label: "\u6BCF\u8F6E\u63A8\u9001", hint: "true / false" }
 ];
@@ -1724,20 +1745,6 @@ function severityColor(severity) {
 function severityLabel(severity) {
   return SEVERITY_LABEL[coerceSeverity(severity)];
 }
-function stoppedReasonLabel(reason) {
-  switch (reason) {
-    case "converged":
-      return "\u5DF2\u7ED3\u675F \xB7 \u5DF2\u6536\u655B\uFF08\u65E0\u65B0\u53D1\u73B0\uFF09";
-    case "max_rounds_reached":
-      return "\u5DF2\u7ED3\u675F \xB7 \u8FBE\u5230\u8F6E\u6570\u4E0A\u9650";
-    case "aborted_by_validation":
-      return "\u5DF2\u7ED3\u675F \xB7 \u9A8C\u8BC1\u5931\u8D25\u540E\u56DE\u6EDA\u505C\u6B62";
-    case "aborted_by_config":
-      return "\u5DF2\u7ED3\u675F \xB7 \u9A8C\u8BC1\u547D\u4EE4\u4E0D\u5728\u767D\u540D\u5355\uFF08\u914D\u7F6E\u9700\u4FEE\u590D\uFF09";
-    default:
-      return reason ? `\u5DF2\u7ED3\u675F \xB7 ${reason}` : "\u5DF2\u7ED3\u675F";
-  }
-}
 function runStatusText(live, manifest) {
   if (live) return "\u8FD0\u884C\u4E2D";
   const reason = manifest && typeof manifest.stoppedReason === "string" ? manifest.stoppedReason : "";
@@ -1767,6 +1774,7 @@ var slotsSvc = void 0;
 var themeSvc = void 0;
 var storage = null;
 var themeDisposer = null;
+var themeListener = null;
 var themeEnabled = true;
 var roundPulseListeners = [];
 function emitRoundPulse(round, converged) {
@@ -1788,6 +1796,31 @@ function clearThemeSkin() {
     themeDisposer = null;
   }
 }
+function registerThemeListener(ctx) {
+  if (typeof ctx.on !== "function") return;
+  if (themeListener) {
+    try {
+      themeListener();
+    } catch {
+    }
+    themeListener = null;
+  }
+  const off = ctx.on("theme/change", () => {
+    if (themeEnabled) applyThemeSkin();
+  });
+  themeListener = typeof off === "function" ? off : null;
+  if (typeof ctx.effect === "function") {
+    ctx.effect(() => {
+      if (themeListener) {
+        try {
+          themeListener();
+        } catch {
+        }
+        themeListener = null;
+      }
+    });
+  }
+}
 function setThemeEnabled(enabled) {
   themeEnabled = enabled;
   if (storage) storage.set(THEME_STORAGE_KEY, enabled ? "1" : "0");
@@ -3874,18 +3907,21 @@ function apply(ctx) {
   themeEnabled = savedTheme === null ? true : savedTheme === "1";
   if (themeEnabled) applyThemeSkin();
   if (typeof document !== "undefined" && document.createElement && document.head) {
-    const style = document.createElement("style");
-    style.dataset.plugin = PLUGIN_TAG;
-    style.dataset.pluginCss = "iterate-main";
-    style.textContent = ITERATE_CSS;
-    document.head.appendChild(style);
-    if (typeof ctx.effect === "function") {
-      ctx.effect(() => {
-        try {
-          style.remove();
-        } catch {
-        }
-      });
+    if (!document.head.querySelector('style[data-iterate-lock="1"]')) {
+      const style = document.createElement("style");
+      style.dataset.iterateLock = "1";
+      style.dataset.plugin = PLUGIN_TAG;
+      style.dataset.pluginCss = "iterate-main";
+      style.textContent = ITERATE_CSS;
+      document.head.appendChild(style);
+      if (typeof ctx.effect === "function") {
+        ctx.effect(() => {
+          try {
+            style.remove();
+          } catch {
+          }
+        });
+      }
     }
   }
   if (slotsSvc === void 0) {
@@ -3929,11 +3965,7 @@ function apply(ctx) {
       )
     );
   }
-  if (typeof ctx.on === "function") {
-    ctx.on("theme/change", () => {
-      if (themeEnabled) applyThemeSkin();
-    });
-  }
+  registerThemeListener(ctx);
 }
 return module.exports; } });
 

package/lib/parse.js

@@ -1687,6 +1687,33 @@ export function trendMax(points) {
   return max
 }
 
+// ─── Stop reason badges (v3.5.5) ─────────────────────────────────────────────
+//
+// Every value the iterate loop can report as `stoppedReason` — including the
+// schema-retry batch (schema_invalid / no_usable_reviewer_output / inconclusive)
+// — maps to a concrete Chinese label. Unknown values still get a readable
+// default instead of a bare "已结束". Kept in parse.js so both the client
+// observatory badge and Node unit tests share one source of truth.
+
+/**
+ * Chinese badge label for a run's `stoppedReason`, or null/undefined-safe.
+ *
+ * @param {string | null | undefined} reason
+ * @returns {string}
+ */
+export function stoppedReasonLabel(reason) {
+  switch (reason) {
+    case 'converged': return '已结束 · 已收敛（无新发现）'
+    case 'max_rounds_reached': return '已结束 · 达到轮数上限'
+    case 'aborted_by_validation': return '已结束 · 验证失败后回滚停止'
+    case 'aborted_by_config': return '已结束 · 验证命令不在白名单（配置需修复）'
+    case 'inconclusive': return '已结束 · 轮次结论不明（审查输出无效）'
+    case 'schema_invalid': return '已结束 · 审查输出连续 schema 校验失败'
+    case 'no_usable_reviewer_output': return '已结束 · 无可用审查输出'
+    default: return reason ? `已结束 · ${reason}` : '已结束'
+  }
+}
+
 // ─── Completion notification ────────────────────────────────────────────────
 
 /**
@@ -1717,6 +1744,7 @@ export const CONFIG_EDIT_FIELDS = [
   { key: 'dimensions', label: '审查维度', hint: '数组，如 ["correctness","security"]' },
   { key: 'max_rounds', label: '最大轮数', hint: '正整数' },
   { key: 'review.scope', label: '审查范围', hint: '"full" 或 "changed-only"' },
+  { key: 'reasoning_effort', label: '审查推理强度', hint: '"low" / "medium" / "high"，缺省跟随模型默认' },
   { key: 'atomic.max_lines', label: '原子修复上限行数', hint: '正整数' },
   { key: 'git.push_per_round', label: '每轮推送', hint: 'true / false' },
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-plugin",
-  "version": "3.5.5",
+  "version": "3.5.7",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
@@ -39,7 +39,11 @@
         "0.1.5-rc.1": "compatible",
         "0.1.5-rc.2": "compatible",
         "0.1.6-alpha.1": "compatible",
-        "0.1.6-alpha.2": "compatible"
+        "0.1.6-alpha.2": "compatible",
+        "0.1.7-alpha.1": "compatible",
+        "0.1.7-alpha.2": "compatible",
+        "0.1.7-rc.1": "compatible",
+        "0.1.7-rc.2": "compatible"
       }
     },
     "client": {
@@ -76,15 +80,15 @@
     "test:validate": "tsx --test test/validate.test.ts"
   },
   "dependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-tools": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-util-values": "0.1.6-alpha.2",
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-tools": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.7-rc.2",
     "js-yaml": "4.3.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent": "0.1.6-alpha.2",
-    "@deepseek-ai/dsh-jobs": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session": "0.1.6-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-jobs": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.7-rc.2",
     "@types/js-yaml": "4.0.9",
     "@types/node": "22.15.0",
     "@types/react": "19.2.2",

package/src/client/index.ts

@@ -81,6 +81,7 @@ import {
   latestPhase,
   SEVERITY_LABEL,
   SEVERITY_COLOR,
+  stoppedReasonLabel,
 } from '../../lib/parse.js'
 
 // ─── Module contract ─────────────────────────────────────────────────────────
@@ -737,17 +738,6 @@ function severityLabel(severity: string | undefined): string {
   return SEVERITY_LABEL[coerceSeverity(severity)]
 }
 
-/** Human label for WHY a finished run stopped (transcript manifest). */
-function stoppedReasonLabel(reason: string | null | undefined): string {
-  switch (reason) {
-    case 'converged': return '已结束 · 已收敛（无新发现）'
-    case 'max_rounds_reached': return '已结束 · 达到轮数上限'
-    case 'aborted_by_validation': return '已结束 · 验证失败后回滚停止'
-    case 'aborted_by_config': return '已结束 · 验证命令不在白名单（配置需修复）'
-    default: return reason ? `已结束 · ${reason}` : '已结束'
-  }
-}
-
 /** Badge text for the run's live/finished state, annotated with the stop reason. */
 function runStatusText(live: boolean, manifest: ObsManifest | null | undefined): string {
   if (live) return '运行中'
@@ -785,6 +775,7 @@ let slotsSvc: SlotsService | undefined = undefined
 let themeSvc: ThemeService | undefined = undefined
 let storage: ReturnType<typeof createStorage> | null = null
 let themeDisposer: (() => void) | null = null
+let themeListener: (() => void) | null = null
 let themeEnabled = true
 const roundPulseListeners: Array<(payload: { round: number; converged: boolean }) => void> = []
 
@@ -814,6 +805,33 @@ function clearThemeSkin(): void {
   }
 }
 
+/**
+ * Register the theme/change hook exactly once per client lifecycle.
+ * The listener is tracked so a re-`apply()` (hot reload / re-mount) never
+ * stacks a second copy — every new registration first drops the previous
+ * one, and `ctx.effect` pairs it off when the client unmounts.
+ */
+function registerThemeListener(ctx: ClientContext): void {
+  if (typeof ctx.on !== 'function') return
+  if (themeListener) {
+    try { themeListener() } catch { /* noop */ }
+    themeListener = null
+  }
+  const off = ctx.on('theme/change', () => {
+    if (themeEnabled) applyThemeSkin()
+  })
+  // `ctx.on` may return void (no unsubscribe support) — only track a callback.
+  themeListener = typeof off === 'function' ? off : null
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      if (themeListener) {
+        try { themeListener() } catch { /* noop */ }
+        themeListener = null
+      }
+    })
+  }
+}
+
 /** Persist + apply the theme preference. */
 function setThemeEnabled(enabled: boolean): void {
   themeEnabled = enabled
@@ -2826,15 +2844,20 @@ export function apply(ctx: ClientContext): void {
   themeEnabled = savedTheme === null ? true : savedTheme === '1'
   if (themeEnabled) applyThemeSkin()
 
-  // 3. Inject styles (independent of slots / React availability).
+  // 3. Inject styles (independent of slots / React availability). Guarded so a
+  // re-`apply()` never appends a duplicate <style>: the tag is keyed by a
+  // `dataset.iterateLock` marker instead of relying on the CSS content.
   if (typeof document !== 'undefined' && document.createElement && document.head) {
-    const style = document.createElement('style')
-    style.dataset.plugin = PLUGIN_TAG
-    style.dataset.pluginCss = 'iterate-main'
-    style.textContent = ITERATE_CSS
-    document.head.appendChild(style)
-    if (typeof ctx.effect === 'function') {
-      ctx.effect(() => { try { style.remove() } catch { /* noop */ } })
+    if (!document.head.querySelector('style[data-iterate-lock="1"]')) {
+      const style = document.createElement('style')
+      style.dataset.iterateLock = '1'
+      style.dataset.plugin = PLUGIN_TAG
+      style.dataset.pluginCss = 'iterate-main'
+      style.textContent = ITERATE_CSS
+      document.head.appendChild(style)
+      if (typeof ctx.effect === 'function') {
+        ctx.effect(() => { try { style.remove() } catch { /* noop */ } })
+      }
     }
   }
 
@@ -2889,9 +2912,7 @@ export function apply(ctx: ClientContext): void {
   }
 
   // 6: keep theme toggle state consistent across theme/change events.
-  if (typeof ctx.on === 'function') {
-    ctx.on('theme/change', () => {
-      if (themeEnabled) applyThemeSkin()
-    })
-  }
+  // Registered through registerThemeListener so repeated apply() and client
+  // unmounts never leak a second listener.
+  registerThemeListener(ctx)
 }

package/src/config-loader.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve, sep } from 'node:path'
 import yaml from 'js-yaml'
@@ -217,7 +217,25 @@ export function resolveProjectRoot(input?: string, sessionCwd?: string): Project
   if (raw.includes('\0')) {
     return { ok: false, reason: 'Refusing project root containing NUL bytes.' }
   }
-  const root = raw ? resolve(raw) : resolve(effectiveCwd(sessionCwd))
+  const rootLexical = raw ? resolve(raw) : resolve(effectiveCwd(sessionCwd))
+  // Collapse symlinks (documented contract: "collapsing `..` and symlinks") —
+  // a path through a symlinked directory must resolve to its REAL location so
+  // two aliases of the same project share one `.iterate/` state, and tools can
+  // never read outside the resolved root via a link. Only when the path
+  // exists: a not-yet-created target (dirs created through the tools) keeps
+  // the lexical path so the caller can still write into it. The filesystem
+  // root check runs against the NORMALIZED path, so a symlink to `/` is
+  // refused too.
+  let root = rootLexical
+  try {
+    if (existsSync(rootLexical)) {
+      const real = realpathSync(rootLexical)
+      if (real) root = real
+    }
+  } catch {
+    // realpath can throw on a broken link or a permission fence — keep the
+    // lexical path (existing behavior) rather than failing the resolution.
+  }
   if (!root || root === sep) {
     return { ok: false, reason: 'Refusing filesystem root as project root.' }
   }

package/src/config-write.ts

@@ -32,6 +32,9 @@ export const MAX_ATOMIC_MAX_LINES = 10_000
 /** Upper bound on `atomic.max_adjacent_methods`. */
 export const MAX_MAX_ADJACENT_METHODS = 200
 
+/** Upper bound on `reviewer.scope_chunk_size` (files per reviewer task batch). */
+export const MAX_SCOPE_CHUNK_SIZE = 1000
+
 /** Keep at most this many timestamped config backups (older ones are removed). */
 export const MAX_CONFIG_BACKUPS = 5
 
@@ -92,6 +95,35 @@ export function validateConfigUpdates(updates: Record<string, unknown>): string[
       errors.push(`updates.max_rounds must be an integer between 1 and ${MAX_MAX_ROUNDS}`)
     }
   }
+  if ('reasoning_effort' in updates) {
+    if (
+      updates.reasoning_effort !== undefined &&
+      updates.reasoning_effort !== 'low' &&
+      updates.reasoning_effort !== 'medium' &&
+      updates.reasoning_effort !== 'high'
+    ) {
+      errors.push('updates.reasoning_effort must be "low", "medium", or "high"')
+    }
+  }
+  if ('reviewer' in updates) {
+    const rv = updates.reviewer as Record<string, unknown> | undefined
+    if (!rv || typeof rv !== 'object') {
+      errors.push('updates.reviewer must be an object')
+    } else {
+      for (const boolKey of ['output_schema_validation', 'evidence_validation', 'coverage_validation'] as const) {
+        if (rv[boolKey] !== undefined && typeof rv[boolKey] !== 'boolean') {
+          errors.push(`updates.reviewer.${boolKey} must be a boolean`)
+        }
+      }
+      if (
+        rv.scope_chunk_size !== undefined &&
+        (typeof rv.scope_chunk_size !== 'number' || !Number.isInteger(rv.scope_chunk_size) ||
+          rv.scope_chunk_size < 1 || rv.scope_chunk_size > MAX_SCOPE_CHUNK_SIZE)
+      ) {
+        errors.push(`updates.reviewer.scope_chunk_size must be an integer between 1 and ${MAX_SCOPE_CHUNK_SIZE}`)
+      }
+    }
+  }
   if ('review' in updates) {
     const r = updates.review as Record<string, unknown> | undefined
     if (!r || typeof r !== 'object') {

package/src/evidence.ts

@@ -115,7 +115,11 @@ export function verifyLineBounds(
   if (line === undefined || line === null || line === WHOLE_FILE_LINE) {
     return { inBounds: true, lineTotal }
   }
-  if (line < 1) return { inBounds: false, lineTotal }
+  // Only a positive INTEGER is a valid line anchor. A fractional line (e.g.
+  // 3.7 from a bypassed schema) or a negative value is out of bounds — a
+  // fractional line "within" the file would otherwise be accepted and poison
+  // the evidence trail with a location nothing can jump to.
+  if (line < 1 || !Number.isInteger(line)) return { inBounds: false, lineTotal }
   return { inBounds: line <= lineTotal, lineTotal }
 }
 

package/src/meta-review.ts

@@ -233,7 +233,11 @@ export function metaReviewReport(report: ReviewReport): MetaReviewResult {
       : null
   const lastRoundNew =
     lastRecordedRound !== null && lastRecordedRound > 0
-      ? Number(findingsByRound[lastRecordedRound - 1] ?? 0)
+      // Over-cap rounds are FOLDED by aggregateRounds into the final slot, so a
+      // reported round number may exceed the array length — read the SAME
+      // clamped index buildReviewReport/computeConvergence use, or a real
+      // over-cap round would be mis-read as 0 new (flag mismatch).
+      ? Number(findingsByRound[Math.min(lastRecordedRound, findingsByRound.length) - 1] ?? 0)
       : null
   const expectedConverged = lastRoundNew === 0
   if (report.convergence?.converged !== expectedConverged) {