mustflow 2.116.1 → 2.116.3

package/templates/default/locales/en/.mustflow/skills/race-condition-review/references/race-reproduction-memory-model-checklist.md

@@ -0,0 +1,268 @@
+# Race Reproduction and Memory-Model Checklist
+
+Use this reference for intermittent races, native-thread incidents, synchronization primitive
+selection, lock-free structures, or linearizability claims. Keep tool execution inside the selected
+repository's configured command contract.
+
+## Contents
+
+1. [Defect classification](#defect-classification)
+2. [Forbidden outcome and incident capsule](#forbidden-outcome-and-incident-capsule)
+3. [Ownership and backing-storage map](#ownership-and-backing-storage-map)
+4. [Deterministic actor harness](#deterministic-actor-harness)
+5. [Schedule exploration and replay](#schedule-exploration-and-replay)
+6. [Schedule-aware observability](#schedule-aware-observability)
+7. [Primitive selection](#primitive-selection)
+8. [Publication and memory ordering](#publication-and-memory-ordering)
+9. [CAS, ABA, and reclamation](#cas-aba-and-reclamation)
+10. [Linearizability](#linearizability)
+11. [Environment and optimization matrix](#environment-and-optimization-matrix)
+12. [Failure and evidence matrix](#failure-and-evidence-matrix)
+13. [Skill handoffs](#skill-handoffs)
+
+## Defect classification
+
+Do not use one word for every timing failure:
+
+| Class | Mechanical oracle | Evidence boundary |
+| --- | --- | --- |
+| logical race condition | a forbidden business, lifecycle, or ordering outcome | may exist without conflicting unsynchronized memory access |
+| data race | runtime-specific conflicting memory access without the required synchronization | a clean dynamic run covers only the executed path and schedule |
+| lifetime violation | access after release, reuse, close, or reclamation | atomic pointer updates do not prove object lifetime |
+| deadlock | a reachable wait-for cycle with no permitted progress | a hang can instead be starvation, lost notification, or blocked I/O |
+| starvation or livelock | bounded work repeatedly fails to make required progress | final state alone may not show the failure |
+| ordering failure | an event, callback, message, or state transition violates its declared order | timestamps do not establish cross-actor visibility |
+
+A detector can confirm the class it observes. It cannot prove all logical invariants or every
+downstream impact, and passing one detector does not validate unexecuted schedules.
+
+## Forbidden outcome and incident capsule
+
+Turn the symptom into a stable predicate before debugging:
+
+- name the invariant and one result that must not occur;
+- include operation results, not only final counters;
+- distinguish timeout, crash, detector report, invalid history, and assertion failure;
+- preserve the original input before minimizing it;
+- require minimization to retain the same failure key and earliest meaningful checkpoint.
+
+Capture a reproduction capsule:
+
+| Surface | Fields |
+| --- | --- |
+| source and binary | source revision, executable hash, symbols hash, linked-library identity |
+| build | compiler, linker, flags, optimization, assertions, sanitizer or detector configuration |
+| runtime | OS, runtime version, architecture, CPU count, scheduler mode, allocator |
+| test | target, actor count, input, timeout, iteration, oracle version |
+| schedule | deterministic gate sequence, scheduler seed, actual decision trace, forced yields |
+| environment | relevant variables, locale, timezone, affinity, container or VM shape |
+| observation | failure key, earliest checkpoint, actor-local trace, synchronization edges |
+
+Store exact replay evidence through the repository's existing artifact policy. Do not introduce raw
+logs, binaries, or private data into version control merely because the capsule calls for them.
+
+## Ownership and backing-storage map
+
+Map ownership before reading mutex code:
+
+| Object or invariant | Created by | Read by | Written by | Transferred to | Retired by | Protection |
+| --- | --- | --- | --- | --- | --- | --- |
+| one concrete surface | actor or component | actors | actors | handoff rule | lifecycle owner | lock, transaction, message, atomic, or undefined |
+
+Follow actual backing storage rather than variable names:
+
+- aliases, views, slices, iterators, shared buffers, mapped regions, pooled objects, and shallow
+  copies can name the same mutable bytes;
+- `const`, `final`, and read-only interfaces may protect a reference while reachable state changes;
+- getters, caches, counters, lazy fields, hashing, logging, and reference tracking can write;
+- file offsets, sockets, process environment, working directory, signal state, database rows,
+  distributed leases, and provider resources are shared state even outside process memory;
+- lifecycle transitions such as initialize, publish, cancel, close, detach, destroy, and reclaim
+  deserve separate owners and synchronization rules.
+
+Protect the invariant, not each field. Several individually atomic fields can still expose a
+combination that the specification forbids.
+
+## Deterministic actor harness
+
+Prefer the smallest harness that can decide the forbidden outcome:
+
+- keep two or the minimum required actors;
+- keep one shared object or durable record;
+- use an arbiter that observes all actor results and asserts the invariant;
+- start actors from a barrier so setup order does not masquerade as concurrency;
+- place named gates at the meaningful race window;
+- reset every shared surface between schedules;
+- join or cancel every actor before the next case.
+
+Example schedule shape, expressed as evidence rather than executable code:
+
+1. actor A reads generation 7 and pauses;
+2. actor B replaces the object with generation 8 and completes;
+3. actor A resumes its conditional action;
+4. the arbiter rejects any accepted generation-7 effect.
+
+Delay after the shared read, validation, removal, cancellation check, publication flag, or
+compare-and-swap load. A delay at an unrelated function entry burns time without widening the
+critical window.
+
+## Schedule exploration and replay
+
+Use a hierarchy of evidence:
+
+1. force the suspected order with explicit gates;
+2. explore bounded schedules systematically when a model scheduler exists;
+3. perturb synchronization boundaries with recorded randomized decisions;
+4. replay a captured real failure when platform support and policy permit it;
+5. use repeated stress only as supplementary search evidence.
+
+Preserve the actual decision trace in addition to the seed. A seed can produce a different schedule
+when actor counts, timer events, random-call counts, or runtime versions change.
+
+Minimize two dimensions independently:
+
+- input minimization removes unrelated objects, commands, requests, and state transitions;
+- schedule minimization removes actors, context switches, yields, gates, and delay decisions.
+
+Reject a reduction that changes a data race into a timeout, a lifetime failure into an assertion,
+or the earliest violated invariant into a different one.
+
+## Schedule-aware observability
+
+A contended global logger can create synchronization and hide the race it is meant to observe.
+Prefer a bounded per-actor ring buffer with compact events such as:
+
+- actor-local monotonic sequence;
+- actor or task identity;
+- object identity and generation;
+- operation and checkpoint;
+- observed value or result class;
+- synchronization object identity;
+- request, transaction, message, or transition identity.
+
+After failure, construct a happens-before graph from:
+
+- actor-local program order;
+- mutex unlock to the next successful lock;
+- release operation to the acquire that observes it;
+- channel send to the corresponding receive under that channel's contract;
+- task creation, completion, join, and cancellation acknowledgement;
+- queue publication to delivery claim;
+- durable transaction commit to the version read that observes it.
+
+Wall-clock order is supporting metadata. It is not proof that another actor was allowed to observe a
+write.
+
+## Primitive selection
+
+| Need | Suitable direction | Frequent mistake |
+| --- | --- | --- |
+| exclusive ownership of a critical invariant | mutex or single owner | binary semaphore used despite missing owner-bound release |
+| capacity limit | semaphore | assuming permits also protect pool membership or slot identity |
+| wait until a predicate changes | condition plus predicate under one mutex | treating a signal as durable state or waiting outside a loop |
+| deliver a value or transfer ownership | immutable message, deep copy, or enforced move | sending a pointer while the sender keeps mutating it |
+| confirm receiver processing | explicit acknowledgement or result future | treating buffered send completion as processing completion |
+| publish one immutable snapshot | atomic pointer plus valid memory ordering and lifetime | assuming pointer atomicity protects reachable mutation or reclamation |
+| update one scalar | atomic read-modify-write | splitting a multi-field invariant across unrelated atomics |
+| serialize one business key | per-key owner, transaction, or conditional update | one global lock or process-local lock for multi-instance truth |
+
+Give channel close authority to one coordinator when several producers exist. Collect producer
+completion separately, then close once. Explain every shared state's synchronization path as one
+continuous edge; mixing mutex, atomic, and channel access does not connect them automatically.
+
+Keep external effects out of retryable compare-and-swap loops. A failed compare-and-swap may repeat
+the calculation, and its failure ordering still governs any value read on the failed path.
+
+## Publication and memory ordering
+
+For payload publication, identify:
+
+1. ordinary writes that initialize the payload;
+2. the release operation that publishes readiness;
+3. the acquire operation that observes the published value;
+4. the exact value-transfer relationship connecting them;
+5. the lifetime rule keeping the payload valid through the reader's use.
+
+A relaxed atomic is atomic for that object but does not order unrelated payload accesses. Several
+atomics do not combine into one transaction. Check success and failure memory ordering separately
+for compare-and-swap loops, especially when the failed value is dereferenced.
+
+Use small memory-model tests with a few actors and a table of allowed and forbidden outcomes. Do not
+bury publication validation inside a large queue or application integration test.
+
+## CAS, ABA, and reclamation
+
+Audit equality and lifetime separately:
+
+- a pointer address can be reused for a different object;
+- a version or stamp distinguishes reuse only until it wraps;
+- calculate whether the chosen tag width can wrap within the supported update rate and lifetime;
+- force rapid address reuse with a bounded test allocator or pool;
+- keep a reader paused while another actor removes, retires, and attempts to reclaim the object;
+- measure memory backpressure when a slow reader delays reclamation.
+
+For hazard-style protection, require the reader to publish protection and then re-read the source.
+If the source changed, retry before dereference. For epoch or grace-period schemes, prove that no
+retired object is reused before all earlier readers exit, and bound retained memory when a reader
+stalls.
+
+Route general allocation, ownership, and use-after-free analysis through `memory-lifetime-review`.
+Keep this skill focused on the interleaving and synchronization that make reclamation unsafe.
+
+## Linearizability
+
+Final size or final checksum can pass even when intermediate operation results are impossible.
+Capture each operation's invocation, response, input, output, and real-time precedence. Name the
+single instruction, transaction, or durable conditional write where the operation takes effect.
+
+Validate whether the completed history can be ordered against a sequential reference model while
+preserving non-overlapping real-time precedence. If no valid ordering exists, the history is not
+linearizable. If the state space is too large, shrink operations and actors before weakening the
+oracle.
+
+## Environment and optimization matrix
+
+Treat environment as part of the reproduction contract:
+
+- one core versus multiple cores;
+- under-subscription and over-subscription;
+- architecture and memory model;
+- debug, release, assertions, and supported optimization levels;
+- supported compilers and runtime versions;
+- allocator and object-pool configuration;
+- timer source, scheduler, affinity, container, VM, and NUMA shape when material.
+
+One environment passing does not prove other supported environments. Use only configured build,
+test, sanitizer, scheduler, or replay intents; otherwise report the missing lane as manual evidence.
+
+## Failure and evidence matrix
+
+| Scenario | Required observation |
+| --- | --- |
+| two actors read the same precondition | the arbiter rejects double success or proves one atomic winner |
+| close overlaps callback or send | no post-close effect, use, or duplicate close escapes |
+| publication flag is observed | initialized payload visibility follows a valid ordering edge |
+| compare-and-swap retries | external effect occurs only for the winning logical operation |
+| address is removed and reused | stale actor cannot treat the new object as the old identity |
+| slow reader blocks reclamation | object stays live and retained memory remains bounded or alerted |
+| condition notification arrives early | persistent predicate still lets the waiter progress |
+| buffered message send completes | code does not claim receiver processing without acknowledgement |
+| detector run is clean | report only executed-path detector evidence, not universal race safety |
+| random schedule fails | seed plus decision trace replays the same forbidden outcome |
+| minimized schedule passes | reject the reduction and restore the last failure-preserving schedule |
+| final state looks correct | operation history still satisfies the declared sequential model |
+
+## Skill handoffs
+
+- Use `concurrency-invariant-review` for broad ownership, primitive discipline, deadlock, starvation,
+  and multi-resource invariant design.
+- Use `async-timing-boundary-review` when fixed delays, readiness, event-loop turns, rendering, or
+  eventual consistency are the primary problem.
+- Use `structured-concurrency-supervision-review` for parent-child task ownership, join,
+  cancellation propagation, and orphan prevention.
+- Use `memory-lifetime-review` for general use-after-free, retention, native resource, and allocator
+  lifetime analysis.
+- Use `two-phase-transition-integrity-review` for prepare-and-commit authority handoffs with epochs
+  and fencing.
+- Use the relevant database, queue, idempotency, security, or filesystem skill when the race crosses
+  that durable boundary.

package/templates/default/locales/en/.mustflow/skills/routes.toml

@@ -241,6 +241,32 @@ suggests_adjuncts = ["transaction-boundary-integrity-review", "queue-processing-
 positive_terms = ["after-commit", "commit-publish", "dual-write", "outbox", "publish", "reconcile", "reconciliation", "transactional-outbox"]
 negative_terms = ["approval", "budget", "child", "credit", "ledger", "llm", "policy", "supervisor", "tool"]
 
+[routes."two-phase-transition-integrity-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 84
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "migration_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."two-phase-transition-integrity-review".dependencies]
+suggests_adjuncts = ["idempotency-integrity-review", "dual-write-consistency", "execution-ledger-integrity-review"]
+
+[routes."two-phase-transition-integrity-review".contexts]
+positive_terms = ["activate", "admission", "commit", "cutover", "decision", "epoch", "fencing", "generation", "handoff", "in-doubt", "lease", "owner", "prepare", "promote", "protocol", "reconcile", "session", "transition", "unknown-outcome"]
+negative_terms = ["database-2pc-only", "llm", "prompt", "tool-call"]
+
+[routes."session-handoff-integrity-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 86
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "migration_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."session-handoff-integrity-review".dependencies]
+suggests_adjuncts = ["two-phase-transition-integrity-review", "idempotency-integrity-review", "execution-ledger-integrity-review", "dual-write-consistency"]
+
+[routes."session-handoff-integrity-review".contexts]
+positive_terms = ["agent-handoff", "application-ack", "auth-grant", "bidirectional-cursor", "command-ledger", "connection-generation", "conversation-cursor", "drained-redirector", "handoff-envelope", "handoff-reconciler", "handoff-ticket", "make-before-break", "owner-epoch", "quiesce", "resume-ticket", "resume-too-old", "session-handoff", "session-migration", "shadow-target", "split-brain", "stale-writer", "state-hash", "stream-handoff", "target-acceptance", "tombstone", "tool-ledger", "vector-cursor"]
+negative_terms = ["design-handoff", "implementation-plan", "private-agent-files", "read-only-transcript", "restart-summary", "stateless-request"]
+
 [routes."structured-concurrency-supervision-review"]
 category = "general_code"
 route_type = "adjunct"
@@ -502,6 +528,62 @@ route_type = "adjunct"
 priority = 79
 applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "data_change"]
 
+[routes."parser-engineering-review".contexts]
+positive_terms = ["analysis-invalidation", "ast-lowering", "ast-serialization", "ast-verifier", "concrete-syntax-tree", "cst", "error-node", "hir-lowering", "lossless-cst", "missing-token", "node-id", "origin-map", "parser", "persistent-node-id", "rewrite-termination", "source-trivia", "surface-ast", "syntax-rewriter", "syntax-tree", "tree-transformer", "tree-visitor", "trivia-attachment", "wire-schema"]
+negative_terms = ["structured-config-parse-only"]
+
+[routes."name-resolution-integrity-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 82
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."name-resolution-integrity-review".dependencies]
+suggests_adjuncts = ["incident-triage-review", "compiler-engineering-review", "interpreter-engineering-review", "dependency-reality-check", "module-boundary-review", "cache-integrity-review", "observability-debuggability-review"]
+
+[routes."name-resolution-integrity-review".contexts]
+positive_terms = ["argument-dependent-lookup", "authoritative-dns", "bazel-repository-mapping", "class-loader", "cmake-find-package", "conditional-exports", "connection-pool-dns", "container-dns", "delegation", "dns-cache", "dns64", "dnssec", "doh", "edns", "extension-method", "glue-record", "gradle-variant", "happy-eyeballs", "headless-service", "https-record", "import-resolution", "kubernetes-dns", "loader-identity", "macro-hygiene", "module-cache", "module-resolution", "name-resolution", "namespace-package", "ndots", "negative-dns-cache", "nodata", "nss-state-machine", "nxdomain", "package-exports", "peer-dependency-context", "proxy-dns", "recursive-dns", "resolution-trace", "resolver-api", "resolver-path", "scope-shadowing", "search-suffix", "serve-stale", "split-dns", "svcb", "temporal-dead-zone", "ttl-cutover", "two-phase-lookup", "variant-selection"]
+negative_terms = ["dependency-install-only", "dns-record-authoring-only", "domain-registration-only", "linker-symbol-only", "route-matching-only"]
+
+[routes."compiler-engineering-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 81
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "data_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."compiler-engineering-review".dependencies]
+suggests_adjuncts = ["parser-engineering-review", "formal-verification-review", "fuzz-harness-review", "race-condition-review", "memory-lifetime-review", "test-design-guard"]
+
+[routes."compiler-engineering-review".contexts]
+positive_terms = ["abi", "allocation-identity", "analysis-generation", "analysis-invalidation", "analysis-preservation", "archive-extraction", "assembler", "binary-export", "binary-id", "borrow-checker", "build-id", "canonical-form", "capture-analysis", "codegen", "comdat", "compiler", "compiler-testing", "crash-dump", "crash-symbolication", "critical-edge", "data-layout", "dead-code-elimination", "debug-symbol", "diagnostic-span", "differential-testing", "dominance", "dsym", "dwarf", "dynamic-loading", "dynamic-symbol", "effect-system", "elf", "exceptional-edge", "export-allowlist", "fact-provenance", "feature-interaction", "gnu-ld", "hir", "identical-code-folding", "import-library", "interposition", "ir", "ir-layer", "lcssa", "lifetime-epoch", "link-map", "link-order", "linker", "lir", "load-address", "loader-binding", "lowering-legality", "lto", "mach-o", "machine-ir", "mangling", "memoryssa", "metamorphic-testing", "mir", "miscompile", "object-format", "optimization-pass", "ownership-token", "pass-ordering", "pdb", "pe-coff", "phi-node", "plugin-abi", "plugin-loader", "pointer-provenance", "progressive-lowering", "property-testing", "relocation", "return-address", "section-gc", "section-reachability", "sealed-block", "semantic-refinement", "semantic-type", "source-location", "split-dwarf", "ssa", "ssa-destruction", "staged-verifier", "static-link", "storage-type", "strip-symbols", "symbol-server", "symbol-table", "symbol-versioning", "symbol-visibility", "thinlto", "transformation-coverage", "typed-hir", "unwind", "unwind-info", "verifier", "well-defined-program", "wrong-code"]
+negative_terms = ["application-build-only", "application-test-only", "css-compiler", "dependency-install", "template-compiler"]
+
+[routes."interpreter-engineering-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 80
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."interpreter-engineering-review".dependencies]
+suggests_adjuncts = ["parser-engineering-review", "compiler-engineering-review", "error-message-integrity-review", "fuzz-harness-review", "memory-lifetime-review"]
+
+[routes."interpreter-engineering-review".contexts]
+positive_terms = ["ast-interpreter", "bytecode", "closure", "completion-value", "diagnostic-fingerprint", "environment-chain", "ephemeron", "evaluation-order", "garbage-collector", "interpreter", "native-function", "opcode", "operator-dispatch", "resolver", "runtime-value", "sandbox-budget", "semantic-oracle", "upvalue", "virtual-machine", "vm", "write-barrier"]
+negative_terms = ["host-runtime-upgrade", "jvm-runtime-only", "python-runtime-only", "shell-interpreter", "template-renderer-only"]
+
+[routes."formal-verification-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 83
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "docs_change", "package_metadata_change", "release_risk"]
+
+[routes."formal-verification-review".dependencies]
+suggests_adjuncts = ["race-condition-review", "two-phase-transition-integrity-review", "idempotency-integrity-review", "memory-lifetime-review", "compiler-engineering-review"]
+
+[routes."formal-verification-review".contexts]
+positive_terms = ["action-invariant", "alloy", "assumption-manifest", "bounded-model-checking", "cegar", "contract-proof", "dafny", "dpor", "fairness-assumption", "formal-verification", "hoare-logic", "ic3", "inductive-invariant", "invariant-proof", "kani", "lean", "linearizability", "liveness-proof", "model-based-testing", "model-checking", "partial-order-reduction", "proof-assistant", "proof-obligation", "prophecy-variable", "refinement-map", "rocq", "sat-unsat-unknown", "smt", "solver-theory", "state-explosion", "stuttering-refinement", "theorem-prover", "tla-plus", "trace-invariant", "total-correctness", "unsat-core", "vacuous-proof", "weak-memory-model", "weakest-precondition"]
+negative_terms = ["schema-validation-only", "static-type-check-only", "unit-test-only", "validation-library-only"]
+
 [routes."type-state-modeling-review"]
 category = "general_code"
 route_type = "adjunct"
@@ -514,6 +596,52 @@ route_type = "adjunct"
 priority = 77
 applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change"]
 
+[routes."race-condition-review".dependencies]
+suggests_adjuncts = ["concurrency-invariant-review", "memory-lifetime-review", "async-timing-boundary-review"]
+
+[routes."race-condition-review".contexts]
+positive_terms = ["aba", "atomic", "data-race", "happens-before", "interleaving", "linearizability", "lock-free", "race", "reclamation", "schedule", "semaphore", "thread"]
+negative_terms = ["layout", "pricing", "prompt", "translation"]
+
+[routes."input-event-synchronization-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 82
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "ui_change", "security_change", "privacy_change", "data_change", "package_metadata_change", "release_risk"]
+
+[routes."input-event-synchronization-review".dependencies]
+suggests_adjuncts = ["race-condition-review", "input-boundary-validation-review", "performance-measurement-integrity-review"]
+
+[routes."input-event-synchronization-review".contexts]
+positive_terms = ["altgraph", "clipboard-sync", "cloud-gaming", "coalesced-event", "composition-sync", "device-input", "drag", "focus-loss", "gamepad", "ime", "input-ack", "input-epoch", "input-event", "input-jitter", "input-loop", "keyboard", "lost-capture", "mouse", "pointer", "raw-input", "remote-desktop", "remote-input", "remote-kvm", "stuck-key", "surface-epoch", "wheel"]
+negative_terms = ["form-validation", "prompt-input", "request-body", "text-field-only"]
+
+[routes."modal-loop-reentrancy-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 83
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "ui_change", "security_change", "privacy_change", "data_change", "package_metadata_change", "release_risk"]
+
+[routes."modal-loop-reentrancy-review".dependencies]
+suggests_adjuncts = ["ui-dispatch-lifecycle-review", "input-event-synchronization-review"]
+
+[routes."modal-loop-reentrancy-review".contexts]
+positive_terms = ["deferred-delete", "dialog-exec", "dialog-generation", "dispatcher-frame", "message-pump", "modal-depth", "modal-loop", "modal-session", "nested-event-loop", "owner-disable", "process-events", "reentrancy", "run-loop-mode", "sendmessage", "sent-message", "show-dialog", "sync-ui-wait", "try-complete", "ui-deadlock"]
+negative_terms = ["accessibility-only", "css-modal", "database-deadlock", "transaction-lock"]
+
+[routes."ui-dispatch-lifecycle-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 82
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "ui_change", "security_change", "privacy_change", "data_change", "package_metadata_change", "release_risk"]
+
+[routes."ui-dispatch-lifecycle-review".dependencies]
+suggests_adjuncts = ["race-condition-review", "async-timing-boundary-review", "modal-loop-reentrancy-review"]
+
+[routes."ui-dispatch-lifecycle-review".contexts]
+positive_terms = ["begininvoke", "blocking-queued", "bound-model", "delete-later", "dispatchqueue-main", "dispatcher", "event-loop", "gui-freeze", "invoke-required", "mainactor", "native-handle", "object-affinity", "progress-callback", "runlater", "stale-ui-callback", "sync-context", "thread-affinity", "ui-dispatch", "ui-epoch", "ui-queue", "view-lifecycle", "window-closing"]
+negative_terms = ["css-modal", "database-dispatch", "pure-render", "server-queue"]
+
 [routes."async-timing-boundary-review"]
 category = "general_code"
 route_type = "adjunct"
@@ -526,6 +654,10 @@ route_type = "adjunct"
 priority = 76
 applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change"]
 
+[routes."concurrency-invariant-review".contexts]
+positive_terms = ["concurrency", "fencing", "lease", "leased", "owner", "shared", "stale-write", "worker"]
+negative_terms = ["css", "layout", "prompt", "translation"]
+
 [routes."failure-integrity-review"]
 category = "general_code"
 route_type = "adjunct"
@@ -574,6 +706,13 @@ route_type = "adjunct"
 priority = 80
 applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "public_api_change", "performance_change", "security_change", "privacy_change", "data_change", "migration_change", "docs_change", "package_metadata_change", "release_risk"]
 
+[routes."idempotency-integrity-review".dependencies]
+suggests_adjuncts = ["transaction-boundary-integrity-review", "queue-processing-integrity-review", "race-condition-review"]
+
+[routes."idempotency-integrity-review".contexts]
+positive_terms = ["aggregate-version", "dedupe", "duplicate-request", "effect-id", "fencing-token", "generation-token", "idempotency-key", "operation-id", "out-of-order", "response-replay", "sequence-gap", "stale-completion", "stale-write", "unknown-outcome"]
+negative_terms = ["database-2pc-only", "lock-order-only", "pure-read", "query-only"]
+
 [routes."retry-policy-integrity-review"]
 category = "general_code"
 route_type = "adjunct"
@@ -1087,6 +1226,12 @@ route_type = "adjunct"
 priority = 40
 applies_to_reasons = ["test_change", "behavior_change"]
 
+[routes."fuzz-harness-review"]
+category = "tests"
+route_type = "adjunct"
+priority = 82
+applies_to_reasons = ["test_change", "behavior_change", "performance_change", "security_change"]
+
 [routes."test-suite-performance-review"]
 category = "tests"
 route_type = "primary"
@@ -1152,6 +1297,12 @@ route_type = "adjunct"
 priority = 78
 applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "public_api_change", "security_change", "privacy_change", "data_change", "test_change", "docs_change", "package_metadata_change", "release_risk"]
 
+[routes."input-boundary-validation-review"]
+category = "security_privacy"
+route_type = "adjunct"
+priority = 83
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "public_api_change", "security_change", "privacy_change", "data_change", "test_change", "performance_change"]
+
 [routes."security-flow-review"]
 category = "security_privacy"
 route_type = "adjunct"