From 2b4d02c75c7df7c3b9732697e3138e2335a3dad3 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 14:57:14 +0300
Subject: [PATCH 1/7] Refresh models, isolate runners, classify failures

- Add Opus 5.5, Fable 5.1, GPT-6 and deepseek-flash to price tables and
  model lists; patch retired model ids in runner profiles
- Add an OpenAI Responses API provider for GPT-6 in the direct runner;
  custom base URLs (Azure, LiteLLM) keep chat completions
- Pass reasoning effort to DeepSeek and raise its output cap to 128K
- Update the codex runner: effort, per-call usage on resume, and a
  --codex-sandbox flag for containers where bubblewrap can't start
- Isolate CLI runners from the reviewed checkout: claude loads user
  settings only and no MCP servers; opencode runs without project
  config, formatters and LSP, and refuses a checkout that ships
  .opencode/ or opencode.json(c), whose plugins it would execute
- Switch opencode to --auto
- Classify run outcomes (status + reason) for all runners, report them
  with cost in debug bundles, and export reviewer_runs_total and
  reviewer_run_cost_usd_total
- Retry transient provider errors with one shared policy; turn off the
  Anthropic SDK's own retries so attempts don't stack
- Warn the direct runner before its round limit, add grace rounds and
  a maxRounds runner-profile param (--max-rounds)
- Fix direct runner diff refs in GitLab CI (bare branch names)
- Fix cost reporting to include failed runs, the Step 2 retry and
  failed judge attempts
- Fix debug bundle uploads capped at 2MB by the global body limit
- Keep debug artifacts gzip-compressed in memory; clip bundle metadata
- Handle SIGTERM in reviewctl: a cancelled job is not a failure
- Update go-openai to v1.42.1
---
 README.md                                     |  39 +-
 cfg/local.toml.dist                           |   5 +
 cmd/reviewctl/README.md                       |  15 +-
 cmd/reviewctl/main.go                         |  46 +-
 docs/patches/2026-09-23-retired-models.sql    |  32 +
 frontend/src/api/vt.generated.ts              |   4 +-
 .../src/vt/pages/projects/ProjectsPage.vue    |  12 +-
 .../runner-profiles/RunnerProfileFormPage.vue |  50 +-
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 pkg/app/app.go                                |  22 +-
 pkg/app/handlers.go                           |  28 +-
 pkg/app/handlers_test.go                      |  32 +
 pkg/app/metrics.go                            |   2 +
 pkg/db/model_params.go                        |   4 +-
 pkg/debug/handler.go                          | 148 ++-
 pkg/debug/handler_test.go                     | 113 ++-
 pkg/debug/storage.go                          |  81 +-
 pkg/debug/storage_test.go                     |  61 +-
 pkg/debug/templates/bundle.html               |   6 +-
 pkg/debug/templates/list.html                 |  11 +-
 pkg/rest/rest.go                              |  11 +-
 pkg/rest/rest_test.go                         |   6 +-
 pkg/reviewctl/reviewctl.go                    |   3 +-
 pkg/reviewctl/reviewctl_zenrpc.go             |   7 +-
 pkg/reviewer/ctl/config.go                    |  32 +-
 pkg/reviewer/ctl/config_test.go               |   8 +-
 pkg/reviewer/ctl/ctl.go                       |  63 +-
 pkg/reviewer/ctl/ctl_test.go                  | 115 +++
 pkg/reviewer/ctl/env.go                       |  26 +-
 pkg/reviewer/ctl/env_test.go                  |   9 +
 pkg/reviewer/ctl/panel.go                     |  16 +-
 pkg/reviewer/ctl/prompt.go                    |   3 +-
 .../ctl/reviewctlclient/client.generated.go   |   2 +
 pkg/reviewer/ctl/skip_detect_test.go          |   6 +-
 pkg/reviewer/ctl/upload.go                    |  14 +
 pkg/reviewer/ctl/upload_test.go               |   6 +
 pkg/reviewer/direct/errors.go                 | 105 ++
 pkg/reviewer/direct/loop.go                   | 111 ++-
 pkg/reviewer/direct/loop_test.go              | 108 +-
 pkg/reviewer/direct/options.go                |  22 +-
 pkg/reviewer/direct/preload_test.go           |  89 ++
 pkg/reviewer/direct/provider.go               |   8 +-
 pkg/reviewer/direct/provider_anthropic.go     |  33 +-
 .../direct/provider_anthropic_test.go         | 130 +++
 pkg/reviewer/direct/provider_factory.go       | 137 ++-
 pkg/reviewer/direct/provider_factory_test.go  |  57 +-
 pkg/reviewer/direct/provider_openai.go        | 122 +--
 pkg/reviewer/direct/provider_openai_test.go   |  93 +-
 pkg/reviewer/direct/provider_responses.go     | 194 ++++
 .../direct/provider_responses_test.go         | 136 +++
 pkg/reviewer/direct/registry.go               |  23 +-
 pkg/reviewer/direct/retry.go                  |  53 +
 pkg/reviewer/direct/sink.go                   |   2 +
 pkg/reviewer/direct/tools_git.go              |  39 +-
 pkg/reviewer/direct/tools_review.go           |   3 +-
 pkg/reviewer/direct/types.go                  |  36 +-
 pkg/reviewer/project.go                       |  10 +
 pkg/reviewer/run_metrics.go                   |  62 ++
 pkg/reviewer/run_metrics_test.go              |  34 +
 pkg/reviewer/run_outcome.go                   | 122 +++
 pkg/reviewer/run_outcome_test.go              |  70 ++
 pkg/reviewer/runner/claude.go                 |  44 +-
 pkg/reviewer/runner/claude_failure.go         | 133 +++
 pkg/reviewer/runner/claude_failure_test.go    | 129 +++
 pkg/reviewer/runner/claude_test.go            |  23 +-
 pkg/reviewer/runner/codex.go                  | 177 ++--
 pkg/reviewer/runner/codex_test.go             | 107 +-
 pkg/reviewer/runner/direct.go                 |  73 +-
 pkg/reviewer/runner/opencode.go               |  87 +-
 pkg/reviewer/runner/opencode_test.go          |  68 ++
 pkg/vt/runner_profile.go                      |   9 +-
 pkg/vt/runner_profile_model.go                |   5 +-
 pkg/vt/vt_zenrpc.go                           |  27 +-
 .../sashabaranov/go-openai/.codecov.yml       |   8 +
 .../sashabaranov/go-openai/.gitignore         |   4 +-
 .../sashabaranov/go-openai/.golangci.yml      |  29 +-
 .../sashabaranov/go-openai/README.md          | 943 +++---------------
 .../sashabaranov/go-openai/audio.go           |  70 +-
 .../sashabaranov/go-openai/batch.go           |  28 +-
 .../github.com/sashabaranov/go-openai/chat.go |  51 +-
 .../sashabaranov/go-openai/client.go          |   4 +-
 .../sashabaranov/go-openai/completion.go      |  65 +-
 .../sashabaranov/go-openai/config.go          |   7 +-
 .../sashabaranov/go-openai/fine_tunes.go      |   1 +
 .../sashabaranov/go-openai/image.go           |  41 +-
 .../go-openai/internal/form_builder.go        |  19 +-
 .../sashabaranov/go-openai/jsonschema/json.go | 235 -----
 .../go-openai/jsonschema/validate.go          | 140 ---
 .../sashabaranov/go-openai/response.go        | 597 +++++++++++
 .../sashabaranov/go-openai/response_stream.go | 131 +++
 .../sashabaranov/go-openai/stream.go          |   2 +-
 .../sashabaranov/go-openai/stream_reader.go   |  10 +-
 vendor/modules.txt                            |   3 +-
 94 files changed, 4338 insertions(+), 1775 deletions(-)
 create mode 100644 docs/patches/2026-09-23-retired-models.sql
 create mode 100644 pkg/app/handlers_test.go
 create mode 100644 pkg/reviewer/direct/errors.go
 create mode 100644 pkg/reviewer/direct/provider_responses.go
 create mode 100644 pkg/reviewer/direct/provider_responses_test.go
 create mode 100644 pkg/reviewer/direct/retry.go
 create mode 100644 pkg/reviewer/run_metrics.go
 create mode 100644 pkg/reviewer/run_metrics_test.go
 create mode 100644 pkg/reviewer/run_outcome.go
 create mode 100644 pkg/reviewer/run_outcome_test.go
 create mode 100644 pkg/reviewer/runner/claude_failure.go
 create mode 100644 pkg/reviewer/runner/claude_failure_test.go
 delete mode 100644 vendor/github.com/sashabaranov/go-openai/jsonschema/json.go
 delete mode 100644 vendor/github.com/sashabaranov/go-openai/jsonschema/validate.go
 create mode 100644 vendor/github.com/sashabaranov/go-openai/response.go
 create mode 100644 vendor/github.com/sashabaranov/go-openai/response_stream.go

diff --git a/README.md b/README.md
index 2bf1abc..949bccc 100644
--- a/README.md
+++ b/README.md
@@ -106,6 +106,10 @@ PoolSize = 5
 [Sentry]
 DSN         = ""
 Environment = ""
+
+[Debug]               # optional; defaults shown
+Capacity      = 200   # runs kept at /v1/debug/storage/ (metadata)
+FilesCapacity = 20    # newest runs that keep their artifact files
 ```
 
 ## API Endpoints
@@ -152,14 +156,14 @@ reviewctl comment   # Post MR comments for an existing review
 reviewctl version   # Print version
 ```
 
-Key flags: `--key`, `--url`, `--runner` (`claude` | `opencode` | `codex` | `direct`), `--model`, `--session` (prompt cache reuse), `--continue` (resume last session), `--allow-dangerous-permissions` (opencode `--dangerously-skip-permissions`, default `true` for unattended CI). All flags have env variable equivalents for CI. See `reviewctl --help` for details.
+Key flags: `--key`, `--url`, `--runner` (`claude` | `opencode` | `codex` | `direct`), `--model`, `--session` (prompt cache reuse), `--continue` (resume last session), `--allow-dangerous-permissions` (opencode `--auto`; default `true` for unattended CI). All flags have env variable equivalents for CI. See `reviewctl --help` for details.
 
 **Runners:** the runner and its model/effort/provider come from the project's **runner profile** (configured in the admin panel and fetched at run time); CI does not pass them. The `--runner`/`--model`/`--effort`/`--api-*` flags still override the profile for local runs.
 
 - `claude` (default) — Claude Code CLI, full agentic exploration.
-- `opencode` — opencode CLI (any provider configured in opencode, incl. OpenRouter), `--model provider/model`.
-- `codex` — `codex exec` CLI (OpenAI Codex), `--model gpt-5.1-codex`.
-- `direct` — calls the LLM API itself (no CLI) with a narrow review tool set (read/grep/glob/git_diff/ast, plus `http_fetch` scoped to the project's task tracker). Prompt caching + diff preload make it the cheapest and fastest path. Adds `--api-provider` (`deepseek` | `openai-compat` | `anthropic`), `--api-base-url`, `--effort` (`low`..`max`); the API key comes from `REVIEW_API_KEY` (or `ANTHROPIC_API_KEY` / `DEEPSEEK_API_KEY` / `OPENAI_API_KEY`). The `ast_*` navigation tools shell out to the optional [`ast-index`](https://github.com/defendend/Claude-ast-index-search) binary — auto-detected on `PATH` (the generated CI image installs it), with the index rebuilt per run; when absent the tools are simply not offered.
+- `opencode` — opencode CLI (any provider configured in opencode, incl. OpenRouter), `--model provider/model`. Runs on the operator's own opencode config only (project config, formatters and LSP off) and refuses a checkout that ships `.opencode/` or `opencode.json(c)`: opencode would execute their plugins with the job's secrets, and no opencode switch prevents it.
+- `codex` — `codex exec` CLI (OpenAI Codex), `--model gpt-6-sol` by default; `--effort` maps to `model_reasoning_effort`.
+- `direct` — calls the LLM API itself (no CLI) with a narrow review tool set (read/grep/glob/git_diff/ast, plus `http_fetch` scoped to the project's task tracker). Prompt caching + diff preload make it the cheapest and fastest path. Adds `--api-provider` (`deepseek` | `openai` (Responses API) | `openai-compat` | `anthropic`), `--api-base-url`, `--effort` (`low`..`max`); the API key comes from `REVIEW_API_KEY` (or `ANTHROPIC_API_KEY` / `DEEPSEEK_API_KEY` / `OPENAI_API_KEY`). The `ast_*` navigation tools shell out to the optional [`ast-index`](https://github.com/defendend/Claude-ast-index-search) binary — auto-detected on `PATH` (the generated CI image installs it), with the index rebuilt per run; when absent the tools are simply not offered.
 
 **Task tracker access:** the tracker token never appears in the prompt. reviewctl fetches it with the review config and hands it to runners out-of-band: CLI runners get it as the `REVIEW_TRACKER_TOKEN` env var (prompts reference `$REVIEW_TRACKER_TOKEN` in curl instructions), the `direct` runner offers the model an `http_fetch` tool locked to the tracker origin that injects the `Authorization` header itself. A `REVIEW_TRACKER_TOKEN` CI variable overrides the server-stored token. Backward compatible in both directions: a legacy reviewctl (which doesn't export the env var) receives the old-style prompt with the token substituted in, and a new reviewctl against an older server falls back to the same legacy prompt.
 
@@ -219,6 +223,7 @@ When deploying behind a reverse proxy, URLs should be split by access level:
 | `/v1/upload/` | Deprecated upload aliases + debug bundle upload (older CI images) |
 | `/v1/debug/` | Debug bundle viewer — raw runner transcripts and artifacts |
 | `/debug/` | pprof and service metadata |
+| `/metrics` | Prometheus metrics (incl. per-project run outcomes and spend) |
 | `/status` | Healthcheck (DB ping) |
 
 Example nginx configuration:
@@ -237,9 +242,35 @@ location /v1/reviewctl/ { deny all; }
 location /v1/upload/    { deny all; }
 location /v1/debug/     { deny all; }
 location /debug/        { deny all; }
+location /metrics       { deny all; }
 location /status        { deny all; }
 ```
 
+### Monitoring
+
+Besides HTTP and DB-pool metrics, `/metrics` (Prometheus) exposes the outcome of every reviewctl run:
+
+| Metric | Labels | Description |
+|--------|--------|-------------|
+| `reviewer_runs_total` | `project`, `runner`, `status`, `reason` | Runs by outcome: `ok` is counted when the review is uploaded, any other status when reviewctl uploads the run's debug bundle |
+| `reviewer_run_cost_usd_total` | `project`, `runner`, `status` | Dollars spent by runs, failed ones included |
+
+- `status`: `ok` \| `failed` \| `cancelled` (the CI job was cancelled — not a failure) \| `timeout`.
+- `reason` (for `failed`): `billing` (provider credit balance exhausted), `auth`, `rate_limit`, `api_error` (provider 5xx / overload / dropped stream, after retries), `max_rounds`, `truncated`, `not_submitted` (the last three from the `direct` runner), `other`.
+- `project` is the project title (`unknown` for an unknown key); a runner outside `claude`/`opencode`/`codex`/`direct` is `other`.
+
+Alerting examples:
+
+```promql
+# Credit balance exhausted — every review fails until it is topped up
+increase(reviewer_runs_total{reason="billing"}[15m]) > 0
+
+# A project keeps failing (cancelled jobs excluded)
+sum by (project) (increase(reviewer_runs_total{status=~"failed|timeout"}[1h])) >= 3
+```
+
+Counters live in memory and reset on restart (`increase()` handles that). For the details of a run, failed runs upload their artifacts (runner transcript, `review.json`, `R*.md`) to `/v1/debug/storage/`: the list shows status, reason, cost and error of the last 200 runs, the newest 20 keep their files (see `[Debug]`); the buffer is dropped on restart. reviewsrv logs each such upload as `debug bundle stored` — at WARN for `failed`/`timeout`, at INFO for a cancelled job.
+
 ## Development
 
 ```bash
diff --git a/cfg/local.toml.dist b/cfg/local.toml.dist
index cd9a618..e65a5ee 100644
--- a/cfg/local.toml.dist
+++ b/cfg/local.toml.dist
@@ -15,3 +15,8 @@ ApplicationName = "reviewsrv"
 [Sentry]
 DSN         = ""
 Environment = ""
+
+# In-memory ring of recent reviewctl runs at /v1/debug/storage/ (defaults shown).
+[Debug]
+Capacity      = 200 # runs kept (metadata)
+FilesCapacity = 20  # newest runs that keep their artifact files
diff --git a/cmd/reviewctl/README.md b/cmd/reviewctl/README.md
index d20a6da..0128d28 100644
--- a/cmd/reviewctl/README.md
+++ b/cmd/reviewctl/README.md
@@ -19,6 +19,13 @@ passes only the project key, server URL and credentials, so it stays thin. The
 runner flags below are **local overrides**: an explicit flag always wins over the
 profile. Multi-review is profile-driven too (see below).
 
+The reviewed checkout is untrusted, so CLI runners ignore the agent config it
+ships: `claude` loads user settings only and no MCP servers; `opencode` runs
+with project config, formatters and LSP off (`OPENCODE_DISABLE_PROJECT_CONFIG`,
+`OPENCODE_CONFIG_CONTENT`; set either yourself to override) and refuses to start
+when the checkout contains `.opencode/` or `opencode.json(c)`, whose plugins it
+would load regardless.
+
 ## Flags & Environment Variables
 
 Most flags have an environment-variable default for CI.
@@ -43,10 +50,12 @@ Most flags have an environment-variable default for CI.
 |------|-------------|---------|-------------|
 | `--runner` | `$REVIEW_RUNNER` | `claude` | Runner: `claude` \| `opencode` \| `codex` \| `direct` |
 | `--model` | `$REVIEW_MODEL` | *runner default* | Model name |
-| `--effort` | `$REVIEW_EFFORT` | — | Reasoning effort `low`..`max` (honored by the `claude` and `direct` Anthropic runners; others ignore it) |
-| `--api-provider` | `$REVIEW_API_PROVIDER` | `deepseek` | `direct` runner provider: `deepseek` \| `openai-compat` \| `anthropic` |
+| `--effort` | `$REVIEW_EFFORT` | — | Reasoning effort `low`..`max` (honored by the `claude`, `codex` and `direct` runners; opencode and `direct` with `openai-compat` ignore it) |
+| `--api-provider` | `$REVIEW_API_PROVIDER` | `deepseek` | `direct` runner provider: `deepseek` \| `openai` (Responses API) \| `openai-compat` \| `anthropic` |
 | `--api-base-url` | `$REVIEW_API_BASE_URL` | *provider default* | `direct` runner API base URL |
-| `--allow-dangerous-permissions` | `$REVIEW_ALLOW_DANGEROUS_PERMISSIONS` | `true` | Pass `--dangerously-skip-permissions` to opencode (needed for unattended CI) |
+| `--max-rounds` | `$REVIEW_MAX_ROUNDS` | `60` | `direct` runner round budget; the model is warned 10 and 3 rounds before it, then gets up to 5 review-only rounds to deliver |
+| `--allow-dangerous-permissions` | `$REVIEW_ALLOW_DANGEROUS_PERMISSIONS` | `true` | Pass `--auto` to opencode (needed for unattended CI) |
+| `--codex-sandbox` | `$REVIEW_CODEX_SANDBOX` | `workspace-write` | codex `--sandbox` mode; `danger-full-access` inside containers, where codex's bubblewrap sandbox can't start |
 
 ### MR & CI metadata (from GitLab CI)
 
diff --git a/cmd/reviewctl/main.go b/cmd/reviewctl/main.go
index ec0fdab..67f1887 100644
--- a/cmd/reviewctl/main.go
+++ b/cmd/reviewctl/main.go
@@ -1,10 +1,13 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"log/slog"
 	"os"
+	"os/signal"
 	"strings"
+	"syscall"
 	"time"
 
 	"reviewsrv/pkg/reviewer"
@@ -60,12 +63,14 @@ func main() {
 	pf.StringVar(&cfg.SessionID, "session", "", "Claude session ID for --resume (reuses prompt cache)")
 	pf.BoolVar(&cfg.ContinueSession, "continue", false, "continue last Claude session (auto-detect)")
 	pf.BoolVar(&cfg.DebugUpload, "debug-upload", ctl.EnvBool("REVIEW_DEBUG_UPLOAD", false), "always upload artifacts to /v1/upload/debug/ (failures upload regardless)")
-	pf.BoolVar(&cfg.AllowDangerousPermissions, "allow-dangerous-permissions", ctl.EnvBool("REVIEW_ALLOW_DANGEROUS_PERMISSIONS", true), "pass --dangerously-skip-permissions to opencode (default true; required for unattended CI)")
-	pf.StringVar(&cfg.APIProvider, "api-provider", ctl.EnvDefault("REVIEW_API_PROVIDER", "deepseek"), "direct runner provider: deepseek | openai-compat | anthropic (key from ANTHROPIC_API_KEY/DEEPSEEK_API_KEY env)")
+	pf.BoolVar(&cfg.AllowDangerousPermissions, "allow-dangerous-permissions", ctl.EnvBool("REVIEW_ALLOW_DANGEROUS_PERMISSIONS", true), "pass --auto to opencode, auto-approving permission prompts (default true; required for unattended CI)")
+	pf.StringVar(&cfg.CodexSandbox, "codex-sandbox", os.Getenv("REVIEW_CODEX_SANDBOX"), "codex --sandbox mode: workspace-write (default) | read-only | danger-full-access (for containers, where codex's bubblewrap sandbox can't start)")
+	pf.StringVar(&cfg.APIProvider, "api-provider", ctl.EnvDefault("REVIEW_API_PROVIDER", "deepseek"), "direct runner provider: deepseek | openai | openai-compat | anthropic (key from ANTHROPIC_API_KEY/OPENAI_API_KEY/DEEPSEEK_API_KEY env)")
 	pf.StringVar(&cfg.APIBaseURL, "api-base-url", os.Getenv("REVIEW_API_BASE_URL"), "direct runner API base URL (defaults to provider's standard endpoint)")
-	pf.StringVar(&cfg.Effort, "effort", os.Getenv("REVIEW_EFFORT"), "direct runner reasoning effort for Anthropic: low|medium|high|xhigh|max")
-	pf.StringVar(&multiRaw, "multi", os.Getenv("REVIEW_MULTI"), "local multi-review panel: comma-separated runner:model members (e.g. codex:gpt-5.5,opencode:deepseek-v4); bypasses server config, uses ambient credentials")
+	pf.StringVar(&cfg.Effort, "effort", os.Getenv("REVIEW_EFFORT"), "reasoning effort for claude, codex and direct: low|medium|high|xhigh|max")
+	pf.StringVar(&multiRaw, "multi", os.Getenv("REVIEW_MULTI"), "local multi-review panel: comma-separated runner:model members (e.g. codex:gpt-6-sol,opencode:deepseek-v4); bypasses server config, uses ambient credentials")
 	pf.StringVar(&judgeRaw, "judge", os.Getenv("REVIEW_JUDGE"), "multi-review judge runner:model (e.g. claude:opus); with >=2 --multi members, fuses them into one review")
+	pf.IntVar(&cfg.MaxRounds, "max-rounds", ctl.EnvInt("REVIEW_MAX_ROUNDS", 0), "direct runner round budget (0 = default 60); overrides the runner profile")
 	pf.DurationVar(&cfg.Timeout, "timeout", ctl.EnvDuration("REVIEW_TIMEOUT", 30*time.Minute), "per-member/judge run timeout (e.g. 30m, 1h); 0 = no timeout")
 	// --multi/--judge are local debug overrides (ambient creds, bypass the server
 	// panel config). Keep them working but hidden so they don't become a stable CLI
@@ -116,7 +121,13 @@ func main() {
 	}
 
 	rootCmd.AddCommand(reviewCmd, uploadCmd, commentCmd, versionCmd)
-	if err := rootCmd.Execute(); err != nil {
+	// A cancelled CI job sends SIGTERM: cancel the run context instead of dying
+	// mid-flight, so the runner stops and the debug bundle still ships, marked
+	// cancelled rather than failed.
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	err := rootCmd.ExecuteContext(ctx)
+	stop()
+	if err != nil {
 		os.Exit(1)
 	}
 }
@@ -185,6 +196,9 @@ func applyReviewConfig(cmd *cobra.Command, cfg *ctl.Config, log *slog.Logger) er
 	if !fl.Changed("allow-dangerous-permissions") {
 		cfg.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
 	}
+	if cfg.MaxRounds == 0 {
+		cfg.MaxRounds = p.Params.MaxRounds
+	}
 
 	// Task-tracker access: the URL comes from the server config; the CI env var
 	// wins over the server-stored token (same precedence as the API keys). The
@@ -263,11 +277,11 @@ func buildRunner(cfg *ctl.Config, log *slog.Logger) (runner.ReviewRunner, error)
 			Log:                       log,
 		}, nil
 	case runner.RunnerCodex:
-		return &runner.ExecCodexRunner{Model: cfg.Model, Dir: cfg.Dir, SessionID: cfg.SessionID, ContinueSession: cfg.ContinueSession, Token: cfg.Token, TrackerToken: cfg.TrackerToken, Log: log}, nil
+		return &runner.ExecCodexRunner{Model: cfg.Model, Effort: cfg.Effort, Sandbox: cfg.CodexSandbox, Dir: cfg.Dir, SessionID: cfg.SessionID, ContinueSession: cfg.ContinueSession, Token: cfg.Token, TrackerToken: cfg.TrackerToken, Log: log}, nil
 	case runner.RunnerDirect:
 		return buildDirectRunner(cfg, log)
 	default:
-		return nil, fmt.Errorf("unknown --runner %q (supported: %s, %s, %s, %s)", cfg.Runner, runner.RunnerClaude, runner.RunnerOpenCode, runner.RunnerCodex, runner.RunnerDirect)
+		return nil, fmt.Errorf("unknown --runner %q (supported: %s)", cfg.Runner, strings.Join(runner.Names, ", "))
 	}
 }
 
@@ -295,14 +309,16 @@ func buildDirectRunner(cfg *ctl.Config, log *slog.Logger) (runner.ReviewRunner,
 		tracker = &direct.TrackerConfig{URL: cfg.TrackerURL, Token: cfg.TrackerToken}
 	}
 	return &runner.DirectRunner{
-		Provider:  prov,
-		Dir:       cfg.Dir,
-		DiffBase:  cfg.TargetBranch,
-		DiffHead:  cfg.SourceBranch,
-		Effort:    cfg.Effort,
-		CompactAt: direct.DefaultCompactAt(cfg.APIProvider),
-		Tracker:   tracker,
-		Log:       log,
+		Provider:    prov,
+		Dir:         cfg.Dir,
+		DiffBase:    cfg.TargetBranch,
+		DiffHead:    cfg.SourceBranch,
+		DiffBaseSHA: cfg.DiffBaseSHA,
+		Effort:      cfg.Effort,
+		MaxRounds:   cfg.MaxRounds,
+		CompactAt:   direct.DefaultCompactAt(cfg.APIProvider),
+		Tracker:     tracker,
+		Log:         log,
 	}, nil
 }
 
diff --git a/docs/patches/2026-09-23-retired-models.sql b/docs/patches/2026-09-23-retired-models.sql
new file mode 100644
index 0000000..5f629c9
--- /dev/null
+++ b/docs/patches/2026-09-23-retired-models.sql
@@ -0,0 +1,32 @@
+-- Remap runner profiles that point at model ids their providers have retired (as of
+-- 2026-09) to the current replacements. Data only — model/effort are free-form columns,
+-- no DDL needed; profiles on live models are left as chosen. The ids are unambiguous,
+-- so the mapping applies to every runner (prefixed ones only exist under opencode).
+UPDATE "runnerProfiles" p SET "model" = m."new"
+FROM (VALUES
+	-- OpenAI: the gpt-5-codex / gpt-5.1-codex* / gpt-5.2-codex family, shut down 2026-07-23.
+	('gpt-5-codex', 'gpt-6-sol'),
+	('gpt-5.1-codex', 'gpt-6-sol'),
+	('gpt-5.1-codex-max', 'gpt-6-sol'),
+	('gpt-5.1-codex-mini', 'gpt-6-sol'),
+	('gpt-5.2-codex', 'gpt-6-sol'),
+	-- DeepSeek: V4 Flash and the chat/reasoner aliases are retired, served as deepseek-flash.
+	('deepseek-v4-flash', 'deepseek-flash'),
+	('deepseek-chat', 'deepseek-flash'),
+	('deepseek-reasoner', 'deepseek-flash'),
+	('deepseek/deepseek-v4-flash', 'deepseek/deepseek-flash'),
+	-- Anthropic: Opus 4.1 retired 2026-08-05, Opus 4 / Sonnet 4 retired 2026-06-15.
+	('claude-opus-4-1', 'claude-opus-5-5'),
+	('claude-opus-4-1-20250805', 'claude-opus-5-5'),
+	('claude-opus-4-0', 'claude-opus-5-5'),
+	('claude-opus-4-20250514', 'claude-opus-5-5'),
+	('claude-sonnet-4-0', 'claude-sonnet-5'),
+	('claude-sonnet-4-20250514', 'claude-sonnet-5'),
+	('anthropic/claude-opus-4-1', 'anthropic/claude-opus-5-5'),
+	('anthropic/claude-opus-4-1-20250805', 'anthropic/claude-opus-5-5'),
+	('anthropic/claude-opus-4-0', 'anthropic/claude-opus-5-5'),
+	('anthropic/claude-opus-4-20250514', 'anthropic/claude-opus-5-5'),
+	('anthropic/claude-sonnet-4-0', 'anthropic/claude-sonnet-5'),
+	('anthropic/claude-sonnet-4-20250514', 'anthropic/claude-sonnet-5')
+) AS m("old", "new")
+WHERE p."model" = m."old";
diff --git a/frontend/src/api/vt.generated.ts b/frontend/src/api/vt.generated.ts
index d513ae5..46bda41 100644
--- a/frontend/src/api/vt.generated.ts
+++ b/frontend/src/api/vt.generated.ts
@@ -194,7 +194,8 @@ export interface IRunnerProfile {
 }
 
 export interface IRunnerProfileParams {
-  allowDangerousPermissions: boolean
+  allowDangerousPermissions: boolean,
+  maxRounds: number // direct runner round budget; 0 = default
 }
 
 export interface IRunnerProfileSearch {
@@ -683,6 +684,7 @@ export class RunnerProfileParams implements IRunnerProfileParams {
   static entityName = "runnerprofileparams";
 
   allowDangerousPermissions: boolean = false;
+  maxRounds: number = 0;
 }
 
 export class RunnerProfileSearch implements IRunnerProfileSearch {
diff --git a/frontend/src/vt/pages/projects/ProjectsPage.vue b/frontend/src/vt/pages/projects/ProjectsPage.vue
index c744ea6..3370fc5 100644
--- a/frontend/src/vt/pages/projects/ProjectsPage.vue
+++ b/frontend/src/vt/pages/projects/ProjectsPage.vue
@@ -186,13 +186,17 @@ const localRunVisible = ref(false)
 const localRunProject = ref<ProjectSummary | null>(null)
 const localRunCopied = ref(false)
 
-// Base image (Claude Code CLI + settings + HTML template) is built by
-// vmkteam/docker-claude-ci. We layer ast-index (AST navigation for the direct
-// runner) and the latest reviewctl release on top.
+// Base image (Claude Code, Codex and opencode CLIs, Go + gopls, settings, HTML
+// template) is built by vmkteam/docker-claude-ci. We layer ast-index (AST
+// navigation for the direct runner) and the latest reviewctl release on top.
 // Build this, push to your registry, then point the template's `dockerimage` at it.
-const dockerfileContent = `# Claude Code CLI + settings, built by vmkteam/docker-claude-ci.
+const dockerfileContent = `# Claude Code / Codex / opencode CLIs + Go, built by vmkteam/docker-claude-ci.
 FROM vmkteam/claude-ci:latest
 
+# Codex's bubblewrap sandbox can't start in an unprivileged container; the
+# container itself is the sandbox.
+ENV REVIEW_CODEX_SANDBOX=danger-full-access
+
 # ast-index — AST navigation for the direct runner's ast_* tools.
 # Static-pie binary, works on musl/alpine as is; optional (skipped when absent).
 ARG AST_INDEX_VERSION=v3.49.2
diff --git a/frontend/src/vt/pages/runner-profiles/RunnerProfileFormPage.vue b/frontend/src/vt/pages/runner-profiles/RunnerProfileFormPage.vue
index 9e37888..e9a5571 100644
--- a/frontend/src/vt/pages/runner-profiles/RunnerProfileFormPage.vue
+++ b/frontend/src/vt/pages/runner-profiles/RunnerProfileFormPage.vue
@@ -31,7 +31,7 @@
       <FormField label="Effort" :error="fieldError('effort')">
         <VSelect v-model="entity.effort">
           <option :value="''">— default —</option>
-          <option v-for="e in effortOptions" :key="e" :value="e">{{ e }}</option>
+          <option v-for="e in efforts" :key="e" :value="e">{{ e }}</option>
         </VSelect>
         <p v-if="!effortUsed" class="mt-1 text-xs text-fg-subtle">Ignored by this runner/provider.</p>
       </FormField>
@@ -47,13 +47,18 @@
         <FormField label="API Base URL" :error="fieldError('apiBaseURL')">
           <VInput v-model="entity.apiBaseURL" type="text" :placeholder="apiBaseURLPlaceholder" />
         </FormField>
+
+        <FormField label="Max rounds" :error="fieldError('params.maxRounds')">
+          <VInput v-model.number="entity.params.maxRounds" type="number" min="0" max="500" placeholder="60" />
+          <p class="mt-1 text-xs text-fg-subtle">Round budget of the review loop, 10–500. Empty or 0 = default (60).</p>
+        </FormField>
       </template>
 
       <template v-if="entity.runner === 'opencode'">
         <FormField label="Permissions">
           <label class="flex items-center gap-2 text-sm text-fg-secondary">
             <input type="checkbox" v-model="entity.params.allowDangerousPermissions" class="rounded border-edge" />
-            Allow dangerous permissions (--dangerously-skip-permissions)
+            Allow dangerous permissions (--auto)
           </label>
         </FormField>
       </template>
@@ -115,19 +120,20 @@ const efforts = ['low', 'medium', 'high', 'xhigh', 'max']
 const providers = ['anthropic', 'deepseek', 'openai', 'openai-compat']
 
 // Runner-dependent model suggestions for the datalist (free text still allowed).
-// Keep in sync with ResolveDefaults and the price tables in codex.go /
-// provider_factory.go. As of 2026-07.
+// Keep in sync with ResolveDefaults and the price table (PricingFor in
+// pkg/reviewer/direct/provider_factory.go). As of 2026-09.
 const MODEL_SUGGESTIONS: Record<string, string[]> = {
-  claude: ['opus', 'sonnet', 'haiku', 'claude-opus-5', 'claude-sonnet-5', 'claude-fable-5', 'claude-opus-4-8', 'claude-sonnet-4-6', 'claude-haiku-4-5'],
-  codex: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna', 'gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'gpt-5.2-codex', 'gpt-5.1-codex-max', 'gpt-5.1-codex'],
-  opencode: ['anthropic/claude-opus-5', 'anthropic/claude-opus-4-8', 'openai/gpt-5.6-sol', 'openai/gpt-5.5', 'deepseek/deepseek-v4-pro', 'deepseek/deepseek-v4-flash'],
+  claude: ['opus', 'sonnet', 'haiku', 'fable', 'claude-opus-5-5', 'claude-fable-5-1', 'claude-sonnet-5', 'claude-opus-5', 'claude-opus-4-8', 'claude-haiku-4-5'],
+  codex: ['gpt-6-sol', 'gpt-6-astra', 'gpt-6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna', 'gpt-5.5'],
+  opencode: ['anthropic/claude-opus-5-5', 'anthropic/claude-sonnet-5', 'openai/gpt-6-sol', 'openai/gpt-6-astra', 'deepseek/deepseek-v4-pro', 'deepseek/deepseek-flash'],
 }
 // For the direct runner, suggestions depend on the selected API provider.
-// deepseek-chat/reasoner are intentionally omitted — they retire 2026-07-24.
+// Retired DeepSeek names (deepseek-v4-flash, deepseek-chat/reasoner) are omitted —
+// they are served as deepseek-flash.
 const DIRECT_MODEL_SUGGESTIONS: Record<string, string[]> = {
-  anthropic: ['claude-opus-5', 'claude-sonnet-5', 'claude-fable-5', 'claude-opus-4-8', 'claude-sonnet-4-6', 'claude-haiku-4-5'],
-  deepseek: ['deepseek-v4-pro', 'deepseek-v4-flash'],
-  openai: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna', 'gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini'],
+  anthropic: ['claude-opus-5-5', 'claude-fable-5-1', 'claude-sonnet-5', 'claude-opus-5', 'claude-opus-4-8', 'claude-haiku-4-5'],
+  deepseek: ['deepseek-v4-pro', 'deepseek-flash'],
+  openai: ['gpt-6-sol', 'gpt-6-astra', 'gpt-6-luna', 'gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna', 'gpt-5.5'],
   'openai-compat': [],
 }
 // Default API base URL per direct provider, shown as the input placeholder.
@@ -140,7 +146,7 @@ const PROVIDER_BASE_URL: Record<string, string> = {
 
 const { entity, loading, saving, error, fieldError, load, save, remove } = useForm<RunnerProfile>(vtApi.runnerprofile, 'runnerProfile', () => ({
   id: 0, title: '', runner: 'claude', model: '', effort: '', apiProvider: '', apiBaseURL: '',
-  params: { allowDangerousPermissions: false }, isDefault: false, statusId: 1, tokenMasked: '', hasToken: false,
+  params: { allowDangerousPermissions: false, maxRounds: 0 }, isDefault: false, statusId: 1, tokenMasked: '', hasToken: false,
 }))
 
 // Token is write-only: bind a separate input so an untouched field stays "keep".
@@ -161,16 +167,12 @@ const modelPlaceholder = computed(() => {
 
 const apiBaseURLPlaceholder = computed(() => PROVIDER_BASE_URL[entity.apiProvider ?? ''] || 'https://...')
 
-// Effort is honoured by the claude/codex CLIs and, for the direct runner, only by
-// the Anthropic provider; deepseek/openai-compat and opencode ignore it. codex has
-// no "max" level.
-const effortUsed = computed(() => {
-  if (entity.runner === 'claude' || entity.runner === 'codex') return true
-  if (entity.runner === 'direct') return entity.apiProvider === 'anthropic'
-  return false
-})
-const effortOptions = computed(() =>
-  entity.runner === 'codex' ? efforts.filter((e) => e !== 'max') : efforts,
+// Effort is honoured by the claude/codex CLIs and by the direct runner's
+// anthropic/openai/deepseek providers (DeepSeek maps medium/xhigh to high
+// itself); opencode and openai-compat ignore it. Supported levels vary by model
+// (e.g. gpt-5.5 stops at xhigh).
+const effortUsed = computed(
+  () => entity.runner !== 'opencode' && !(entity.runner === 'direct' && entity.apiProvider === 'openai-compat'),
 )
 
 onMounted(() => {
@@ -180,7 +182,9 @@ onMounted(() => {
 async function handleSave() {
   // Empty token input means "keep existing" (update) or "none" (add): omit it.
   entity.token = tokenInput.value ? tokenInput.value : undefined
-  if (!entity.params) entity.params = { allowDangerousPermissions: false }
+  if (!entity.params) entity.params = { allowDangerousPermissions: false, maxRounds: 0 }
+  // A cleared number input yields ""; the API expects an integer (0 = default).
+  entity.params.maxRounds = Number(entity.params.maxRounds) || 0
   if (await save()) router.push('/runner-profiles')
 }
 
diff --git a/go.mod b/go.mod
index 626ba73..fedbd18 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/labstack/echo/v4 v4.15.4
 	github.com/namsral/flag v1.7.4-pre
 	github.com/prometheus/client_golang v1.24.1
-	github.com/sashabaranov/go-openai v1.41.2
+	github.com/sashabaranov/go-openai v1.42.1
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	github.com/vmkteam/appkit v0.1.2
diff --git a/go.sum b/go.sum
index 244fd9d..6198e7a 100644
--- a/go.sum
+++ b/go.sum
@@ -226,8 +226,8 @@ github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIj
 github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
 github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sashabaranov/go-openai v1.41.2 h1:vfPRBZNMpnqu8ELsclWcAvF19lDNgh1t6TVfFFOPiSM=
-github.com/sashabaranov/go-openai v1.41.2/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
+github.com/sashabaranov/go-openai v1.42.1 h1:9nK2UgDVVSIyoEUNDeWqu3Ttj8EqCO6FT8HK0Cv8VEo=
+github.com/sashabaranov/go-openai v1.42.1/go.mod h1:lj5b/K+zjTSFxVLijLSTDZuP7adOgerWeFyZLUhAKRg=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
diff --git a/pkg/app/app.go b/pkg/app/app.go
index 944778f..4ae2f0d 100644
--- a/pkg/app/app.go
+++ b/pkg/app/app.go
@@ -1,12 +1,15 @@
 package app
 
 import (
+	"cmp"
 	"context"
 	"time"
 
 	"reviewsrv/pkg/db"
 	"reviewsrv/pkg/debug"
 	"reviewsrv/pkg/reviewctl"
+	"reviewsrv/pkg/reviewer"
+	"reviewsrv/pkg/reviewer/runner"
 	"reviewsrv/pkg/rpc"
 	"reviewsrv/pkg/vt"
 
@@ -34,11 +37,20 @@ type Config struct {
 		Environment string
 		DSN         string
 	}
+	// Debug sizes the in-memory ring of recent reviewctl runs; zero values
+	// take the defaults below.
+	Debug struct {
+		Capacity      int // runs kept (metadata)
+		FilesCapacity int // newest runs that keep their artifact files
+	}
 }
 
-// debugBufferCapacity caps the in-memory ring of recent reviewctl runs.
-// Sized for a handful of CI failures — bigger values just waste RAM.
-const debugBufferCapacity = 10
+// Defaults for the debug ring: run metadata is small, so keep days of CI
+// failures; artifacts run to megabytes each, so only the newest keep them.
+const (
+	debugBufferCapacity = 200
+	debugFilesCapacity  = 20
+)
 
 type App struct {
 	embedlog.Logger
@@ -53,6 +65,7 @@ type App struct {
 	srv          *zenrpc.Server
 	reviewctlsrv *zenrpc.Server
 	debugStorage *debug.Storage
+	runMetrics   *reviewer.RunMetrics
 }
 
 func New(appName, version string, sl embedlog.Logger, cfg Config, db db.DB, dbc *pg.DB) *App {
@@ -64,7 +77,8 @@ func New(appName, version string, sl embedlog.Logger, cfg Config, db db.DB, dbc
 		dbc:          dbc,
 		echo:         appkit.NewEcho(),
 		Logger:       sl,
-		debugStorage: debug.New(debugBufferCapacity),
+		debugStorage: debug.New(cmp.Or(cfg.Debug.Capacity, debugBufferCapacity), cmp.Or(cfg.Debug.FilesCapacity, debugFilesCapacity)),
+		runMetrics:   reviewer.NewRunMetrics(runner.Names...),
 	}
 
 	// add services
diff --git a/pkg/app/handlers.go b/pkg/app/handlers.go
index 3e9890f..433ca38 100644
--- a/pkg/app/handlers.go
+++ b/pkg/app/handlers.go
@@ -11,6 +11,7 @@ import (
 	"reviewsrv/frontend"
 	"reviewsrv/pkg/debug"
 	"reviewsrv/pkg/rest"
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/slack"
 
 	"github.com/labstack/echo/v4"
@@ -30,13 +31,27 @@ func (a *App) runHTTPServer(ctx context.Context, host string, port int) error {
 	return a.echo.Start(listenAddress)
 }
 
+// debugUploadPath receives debug bundles, whose runner transcripts (opencode
+// NDJSON streams) outgrow the 2MB API body cap; the route has its own 20MB cap.
+const debugUploadPath = "/v1/upload/debug/:projectKey/"
+
+// apiBodyLimit caps request bodies at 2MB, skipping debugUploadPath: a
+// route-level BodyLimit runs after this one, so it can lower the cap but never
+// raise it.
+func apiBodyLimit() echo.MiddlewareFunc {
+	return middleware.BodyLimitWithConfig(middleware.BodyLimitConfig{
+		Limit:   "2M",
+		Skipper: func(c echo.Context) bool { return c.Path() == debugUploadPath },
+	})
+}
+
 // registerHandlers register echo handlers.
 func (a *App) registerHandlers() {
 	a.echo.Use(middleware.CORSWithConfig(middleware.CORSConfig{
 		AllowOrigins: []string{"*"},
 		AllowMethods: []string{echo.GET, echo.PUT, echo.POST, echo.DELETE},
 		AllowHeaders: []string{"Authorization", "Authorization2", "Origin", "X-Requested-With", "Content-Type", "Accept", "Platform", "Version"},
-	}), middleware.BodyLimit("2M"))
+	}), apiBodyLimit())
 
 	lg := middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
 		LogStatus:    true,
@@ -66,7 +81,7 @@ func (a *App) registerHandlers() {
 		},
 	})
 
-	h := rest.NewHandler(a.db, slack.NewNotifier(a.Logger), a.cfg.Server.BaseURL)
+	h := rest.NewHandler(a.db, slack.NewNotifier(a.Logger), a.cfg.Server.BaseURL, a.runMetrics)
 
 	// Internal reviewctl API: config + prompt over JSON-RPC (registered as a
 	// separate zenrpc server in registerReviewctlAPIHandlers), plus review upload.
@@ -80,9 +95,12 @@ func (a *App) registerHandlers() {
 	a.echo.GET("/v1/rpc/review-fix-:id", h.ReviewFixMarkdown, lg)
 	a.echo.GET("/v1/rpc/project-instructions-:id", h.ProjectInstructionsMarkdown, lg)
 
-	dh := debug.NewHandler(a.debugStorage, a.Log())
-	// Per-route 20MB limit overrides the global 2MB cap so opencode NDJSON streams fit.
-	a.echo.POST("/v1/upload/debug/:projectKey/", dh.Upload, lg, middleware.BodyLimit("20M"))
+	pm := reviewer.NewProjectManager(a.db)
+	dh := debug.NewHandler(a.debugStorage, a.Log(), func(ctx context.Context, projectKey string) string {
+		title, _ := pm.TitleByKey(ctx, projectKey)
+		return title
+	}, a.runMetrics)
+	a.echo.POST(debugUploadPath, dh.Upload, lg, middleware.BodyLimit("20M"))
 	a.echo.GET(debug.StoragePathPrefix, dh.List, lg)
 	a.echo.GET(debug.StoragePathPrefix+":id/", dh.Bundle, lg)
 	a.echo.GET(debug.StoragePathPrefix+":id/:filename", dh.File, lg)
diff --git a/pkg/app/handlers_test.go b/pkg/app/handlers_test.go
new file mode 100644
index 0000000..0cab791
--- /dev/null
+++ b/pkg/app/handlers_test.go
@@ -0,0 +1,32 @@
+package app
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAPIBodyLimit(t *testing.T) {
+	e := echo.New()
+	e.Use(apiBodyLimit())
+	ok := func(c echo.Context) error { return c.NoContent(http.StatusOK) }
+	e.POST(debugUploadPath, ok, middleware.BodyLimit("20M"))
+	e.POST("/v1/reviewctl/upload/:projectKey/", ok)
+
+	post := func(path string, size int) int {
+		rec := httptest.NewRecorder()
+		e.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, path, bytes.NewReader(make([]byte, size))))
+		return rec.Code
+	}
+	const mb = 1 << 20
+
+	assert.Equal(t, http.StatusOK, post("/v1/upload/debug/key/", 5*mb), "debug bundles get the 20MB route cap")
+	assert.Equal(t, http.StatusRequestEntityTooLarge, post("/v1/upload/debug/key/", 21*mb))
+	assert.Equal(t, http.StatusOK, post("/v1/reviewctl/upload/key/", mb))
+	assert.Equal(t, http.StatusRequestEntityTooLarge, post("/v1/reviewctl/upload/key/", 3*mb), "other routes keep the 2MB cap")
+}
diff --git a/pkg/app/metrics.go b/pkg/app/metrics.go
index fb85854..3e39d6b 100644
--- a/pkg/app/metrics.go
+++ b/pkg/app/metrics.go
@@ -23,6 +23,8 @@ func (a *App) registerMetrics() {
 	)
 	a.mon.Open()
 
+	a.runMetrics.Register(prometheus.DefaultRegisterer)
+
 	a.echo.Use(appkit.HTTPMetrics(appkit.DefaultServerName))
 	a.echo.Any("/metrics", echo.WrapHandler(promhttp.Handler()))
 }
diff --git a/pkg/db/model_params.go b/pkg/db/model_params.go
index f600d3d..10de686 100644
--- a/pkg/db/model_params.go
+++ b/pkg/db/model_params.go
@@ -58,8 +58,10 @@ type ModelUseStats struct {
 // profile (runnerProfiles.params jsonb). New runner options live here so they
 // need no schema migration.
 type RunnerProfileParams struct {
-	// AllowDangerousPermissions maps to opencode's --dangerously-skip-permissions.
+	// AllowDangerousPermissions maps to opencode's --auto.
 	AllowDangerousPermissions bool `json:"allowDangerousPermissions,omitempty"`
+	// MaxRounds overrides the direct runner's round budget; 0 = its default.
+	MaxRounds int `json:"maxRounds,omitempty"`
 }
 
 // ReviewRunnerProfile is the snapshot of the resolved runner profile used to
diff --git a/pkg/debug/handler.go b/pkg/debug/handler.go
index 0bda430..0b1ed7e 100644
--- a/pkg/debug/handler.go
+++ b/pkg/debug/handler.go
@@ -1,26 +1,39 @@
 package debug
 
 import (
+	"bytes"
 	"compress/gzip"
+	"context"
 	"embed"
 	"errors"
 	"fmt"
 	"html/template"
 	"io"
 	"log/slog"
+	"math"
 	"mime"
 	"mime/multipart"
 	"net/http"
 	"path/filepath"
 	"sort"
+	"strconv"
 	"strings"
+	"unicode/utf8"
+
+	"reviewsrv/pkg/reviewer"
 
 	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 )
 
-// maxFileBytes caps a single decompressed artifact (defends against gzip bombs).
-const maxFileBytes = 32 * 1024 * 1024
+const (
+	// maxFileBytes caps a single decompressed artifact (defends against gzip bombs).
+	maxFileBytes = 32 * 1024 * 1024
+	// maxErrorMsgBytes caps a bundle's error message; real ones are a few KB.
+	maxErrorMsgBytes = 64 * 1024
+	// maxFieldBytes caps the other metadata fields (ids, branches, model).
+	maxFieldBytes = 1024
+)
 
 // StoragePathPrefix is the URL prefix under which bundle pages and files are served.
 // Both clients (templates, reviewctl) and the upload handler reference it.
@@ -37,6 +50,9 @@ const (
 	FieldSourceBranch = "sourceBranch"
 	FieldTargetBranch = "targetBranch"
 	FieldCommitHash   = "commitHash"
+	FieldStatus       = "status"  // reviewer.RunStatus*
+	FieldReason       = "reason"  // reviewer.RunReason*
+	FieldCostUsd      = "costUsd" // spent by the run, incl. a failed one
 )
 
 //go:embed templates/*.html
@@ -44,20 +60,25 @@ var templatesFS embed.FS
 
 // Handler serves debug bundle endpoints over echo.
 type Handler struct {
-	storage *Storage
-	log     *slog.Logger
-	tmpl    *template.Template
+	storage      *Storage
+	log          *slog.Logger
+	tmpl         *template.Template
+	projectTitle func(ctx context.Context, projectKey string) string
+	metrics      *reviewer.RunMetrics
 }
 
-// NewHandler wires templates to the storage. Templates are embedded at compile time.
-func NewHandler(storage *Storage, log *slog.Logger) *Handler {
+// NewHandler wires templates to the storage. Templates are embedded at compile
+// time. projectTitle resolves a project key to its title ("" when unknown) for
+// the pages and the run metrics; metrics counts every uploaded run that did not
+// complete (ok runs are counted on review upload). Either may be nil.
+func NewHandler(storage *Storage, log *slog.Logger, projectTitle func(ctx context.Context, projectKey string) string, metrics *reviewer.RunMetrics) *Handler {
 	tmpl := template.Must(template.New("").Funcs(template.FuncMap{
 		"shortKey":   shortKey,
 		"preview":    preview,
 		"storageURL": func() string { return StoragePathPrefix },
 	}).ParseFS(templatesFS, "templates/*.html"))
 
-	return &Handler{storage: storage, log: log, tmpl: tmpl}
+	return &Handler{storage: storage, log: log, tmpl: tmpl, projectTitle: projectTitle, metrics: metrics}
 }
 
 // Upload accepts a multipart bundle. Each file part is gzip-compressed by the
@@ -73,34 +94,53 @@ func (h *Handler) Upload(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusBadRequest, "parse multipart: "+err.Error())
 	}
 
+	// Metadata outlives the artifacts in the ring, so a client can't park
+	// megabytes in it: fields are clipped.
+	field := func(key string) string { return clip(formValue(form.Value, key), maxFieldBytes) }
 	b := &Bundle{
 		ProjectKey:   projectKey,
-		MRIid:        formValue(form.Value, FieldMRIid),
-		ExternalID:   formValue(form.Value, FieldExternalID),
-		Runner:       formValue(form.Value, FieldRunner),
-		Model:        formValue(form.Value, FieldModel),
-		ErrorMsg:     formValue(form.Value, FieldErrorMsg),
-		SourceBranch: formValue(form.Value, FieldSourceBranch),
-		TargetBranch: formValue(form.Value, FieldTargetBranch),
-		CommitHash:   formValue(form.Value, FieldCommitHash),
-		Files:        make(map[string][]byte, len(form.File)),
+		MRIid:        field(FieldMRIid),
+		ExternalID:   field(FieldExternalID),
+		Runner:       field(FieldRunner),
+		Model:        field(FieldModel),
+		ErrorMsg:     clip(formValue(form.Value, FieldErrorMsg), maxErrorMsgBytes),
+		SourceBranch: field(FieldSourceBranch),
+		TargetBranch: field(FieldTargetBranch),
+		CommitHash:   field(FieldCommitHash),
+		CostUsd:      parseCost(formValue(form.Value, FieldCostUsd)),
+		Files:        make(map[string]File, len(form.File)),
+	}
+	b.Status, b.Reason = reviewer.NormalizeRunOutcome(formValue(form.Value, FieldStatus), formValue(form.Value, FieldReason), b.ErrorMsg != "")
+	ctx := c.Request().Context()
+	if h.projectTitle != nil {
+		b.ProjectTitle = h.projectTitle(ctx, projectKey)
 	}
 
 	for _, headers := range form.File {
 		for _, fh := range headers {
-			data, err := readGzipped(fh)
+			f, err := readArtifact(fh)
 			if err != nil {
 				return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("read %s: %v", fh.Filename, err))
 			}
-			name := strings.TrimSuffix(fh.Filename, ".gz")
-			b.Files[name] = data
+			b.Files[strings.TrimSuffix(fh.Filename, ".gz")] = f
 		}
 	}
 
 	h.storage.Add(b)
-	h.log.InfoContext(c.Request().Context(), "debug bundle stored",
-		"id", b.ID, "projectKey", projectKey, "files", len(b.Files), "hasError", b.ErrorMsg != "",
+	// A failed or timed-out run is what an operator must notice; a cancelled
+	// job or a --debug-upload of a good run is routine.
+	lvl := slog.LevelInfo
+	if b.Status == reviewer.RunStatusFailed || b.Status == reviewer.RunStatusTimeout {
+		lvl = slog.LevelWarn
+	}
+	h.log.Log(ctx, lvl, "debug bundle stored",
+		"id", b.ID, "projectKey", projectKey, "project", b.ProjectTitle, "files", len(b.Files), "hasError", b.ErrorMsg != "",
+		"status", b.Status, "reason", b.Reason, "runner", b.Runner, "model", b.Model, "costUsd", b.CostUsd,
+		"errorMsg", preview(b.ErrorMsg, 300),
 	)
+	if b.Status != reviewer.RunStatusOK {
+		h.metrics.Observe(b.ProjectTitle, b.Runner, b.Status, b.Reason, b.CostUsd)
+	}
 
 	return c.JSON(http.StatusOK, map[string]string{
 		"id":  b.ID,
@@ -126,8 +166,8 @@ func (h *Handler) Bundle(c echo.Context) error {
 		Size int
 	}
 	files := make([]fileEntry, 0, len(b.Files))
-	for name, data := range b.Files {
-		files = append(files, fileEntry{Name: name, Size: len(data)})
+	for name, f := range b.Files {
+		files = append(files, fileEntry{Name: name, Size: f.Size})
 	}
 	sort.Slice(files, func(i, j int) bool { return files[i].Name < files[j].Name })
 
@@ -139,13 +179,19 @@ func (h *Handler) Bundle(c echo.Context) error {
 	return h.renderHTML(c, "bundle.html", data)
 }
 
-// File serves a single artifact inline so the browser can render it.
+// File serves a single artifact inline so the browser can render it,
+// decompressing it on the fly.
 func (h *Handler) File(c echo.Context) error {
-	data, ok := h.storage.GetFile(c.Param("id"), c.Param("filename"))
+	f, ok := h.storage.GetFile(c.Param("id"), c.Param("filename"))
 	if !ok {
 		return echo.NewHTTPError(http.StatusNotFound, "file not found")
 	}
-	return c.Blob(http.StatusOK, contentTypeFor(c.Param("filename")), data)
+	gr, err := gzip.NewReader(bytes.NewReader(f.Gzip))
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, "gzip: "+err.Error())
+	}
+	defer gr.Close()
+	return c.Stream(http.StatusOK, contentTypeFor(c.Param("filename")), gr)
 }
 
 func (h *Handler) renderHTML(c echo.Context, name string, data any) error {
@@ -156,6 +202,15 @@ func (h *Handler) renderHTML(c echo.Context, name string, data any) error {
 	return c.HTML(http.StatusOK, sb.String())
 }
 
+// parseCost reads a client-reported dollar cost; anything unusable is 0.
+func parseCost(s string) float64 {
+	v, err := strconv.ParseFloat(s, 64)
+	if err != nil || v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
+		return 0
+	}
+	return v
+}
+
 func formValue(m map[string][]string, key string) string {
 	if v, ok := m[key]; ok && len(v) > 0 {
 		return v[0]
@@ -163,29 +218,44 @@ func formValue(m map[string][]string, key string) string {
 	return ""
 }
 
-// readGzipped opens the multipart file, gunzips it, and returns the raw bytes.
-// Caps at maxFileBytes to prevent a malicious gzip from exhausting memory.
-func readGzipped(fh *multipart.FileHeader) ([]byte, error) {
+// readArtifact reads a gzip-compressed multipart file and checks that it
+// decompresses within maxFileBytes, so a gzip bomb is rejected at upload. The
+// compressed bytes are kept as they are.
+func readArtifact(fh *multipart.FileHeader) (File, error) {
 	f, err := fh.Open()
 	if err != nil {
-		return nil, fmt.Errorf("open: %w", err)
+		return File{}, fmt.Errorf("open: %w", err)
 	}
 	defer f.Close()
 
-	gr, err := gzip.NewReader(f)
+	raw, err := io.ReadAll(f)
+	if err != nil {
+		return File{}, fmt.Errorf("read: %w", err)
+	}
+	gr, err := gzip.NewReader(bytes.NewReader(raw))
 	if err != nil {
-		return nil, fmt.Errorf("gzip: %w", err)
+		return File{}, fmt.Errorf("gzip: %w", err)
 	}
 	defer gr.Close()
-
-	data, err := io.ReadAll(io.LimitReader(gr, maxFileBytes+1))
+	n, err := io.Copy(io.Discard, io.LimitReader(gr, maxFileBytes+1))
 	if err != nil {
-		return nil, fmt.Errorf("read: %w", err)
+		return File{}, fmt.Errorf("gunzip: %w", err)
+	}
+	if n > maxFileBytes {
+		return File{}, errors.New("artifact exceeds size limit")
+	}
+	return File{Gzip: raw, Size: int(n)}, nil
+}
+
+// clip cuts s to at most n bytes, on a rune boundary.
+func clip(s string, n int) string {
+	if len(s) <= n {
+		return s
 	}
-	if len(data) > maxFileBytes {
-		return nil, errors.New("artifact exceeds size limit")
+	for n > 0 && !utf8.RuneStart(s[n]) {
+		n--
 	}
-	return data, nil
+	return s[:n]
 }
 
 // contentTypeFor picks a browser-friendly Content-Type by extension.
diff --git a/pkg/debug/handler_test.go b/pkg/debug/handler_test.go
index 7149161..9988b0a 100644
--- a/pkg/debug/handler_test.go
+++ b/pkg/debug/handler_test.go
@@ -3,6 +3,7 @@ package debug
 import (
 	"bytes"
 	"compress/gzip"
+	"context"
 	"encoding/json"
 	"io"
 	"log/slog"
@@ -18,8 +19,8 @@ import (
 
 func newTestHandler(t *testing.T) (*Storage, *echo.Echo) {
 	t.Helper()
-	storage := New(5)
-	h := NewHandler(storage, slog.Default())
+	storage := New(5, 5)
+	h := NewHandler(storage, slog.Default(), nil, nil)
 
 	e := echo.New()
 	e.POST("/v1/upload/debug/:projectKey/", h.Upload)
@@ -42,6 +43,26 @@ func gzipBytes(t *testing.T, data []byte) []byte {
 	return buf.Bytes()
 }
 
+// gzFile builds a stored artifact from its content.
+func gzFile(t *testing.T, content string) File {
+	t.Helper()
+	return File{Gzip: gzipBytes(t, []byte(content)), Size: len(content)}
+}
+
+// unzip returns a stored artifact's content.
+func unzip(t *testing.T, f File) string {
+	t.Helper()
+	gr, err := gzip.NewReader(bytes.NewReader(f.Gzip))
+	if err != nil {
+		t.Fatalf("gzip: %v", err)
+	}
+	data, err := io.ReadAll(gr)
+	if err != nil {
+		t.Fatalf("gunzip: %v", err)
+	}
+	return string(data)
+}
+
 func buildMultipart(t *testing.T, fields map[string]string, files map[string][]byte) (*bytes.Buffer, string) {
 	t.Helper()
 	var buf bytes.Buffer
@@ -112,11 +133,11 @@ func TestHandler_UploadStoresBundle(t *testing.T) {
 	if b.MRIid != "42" || b.Runner != "claude" || b.Model != "opus" {
 		t.Errorf("metadata mismatch: %+v", b)
 	}
-	if string(b.Files["review.json"]) != `{"files":[]}` {
-		t.Errorf("review.json content mismatch: %q", b.Files["review.json"])
+	if got := unzip(t, b.Files["review.json"]); got != `{"files":[]}` {
+		t.Errorf("review.json content mismatch: %q", got)
 	}
-	if string(b.Files["claude-output.json"]) != `{"type":"result"}` {
-		t.Errorf("claude-output.json content mismatch: %q", b.Files["claude-output.json"])
+	if f := b.Files["claude-output.json"]; unzip(t, f) != `{"type":"result"}` || f.Size != len(`{"type":"result"}`) {
+		t.Errorf("claude-output.json mismatch: %q (size %d)", unzip(t, f), f.Size)
 	}
 }
 
@@ -165,7 +186,7 @@ func TestHandler_ListAndBundleHTML(t *testing.T) {
 		ErrorMsg:     "boom",
 		SourceBranch: "feat/x",
 		TargetBranch: "master",
-		Files:        map[string][]byte{"review.json": []byte(`{"x":1}`)},
+		Files:        map[string]File{"review.json": gzFile(t, `{"x":1}`)},
 	})
 
 	req := httptest.NewRequest(http.MethodGet, "/v1/debug/storage/", nil)
@@ -200,7 +221,7 @@ func TestHandler_FileServesArtifactWithContentType(t *testing.T) {
 	storage, e := newTestHandler(t)
 	storage.Add(&Bundle{
 		ID:    "xyz",
-		Files: map[string][]byte{"review.json": []byte(`{"ok":true}`)},
+		Files: map[string]File{"review.json": gzFile(t, `{"ok":true}`)},
 	})
 
 	req := httptest.NewRequest(http.MethodGet, "/v1/debug/storage/xyz/review.json", nil)
@@ -228,3 +249,79 @@ func TestHandler_FileNotFound(t *testing.T) {
 		t.Errorf("status = %d, want 404", rec.Code)
 	}
 }
+
+// upload posts a bundle and returns the stored copy.
+func upload(t *testing.T, storage *Storage, e *echo.Echo, projectKey string, fields map[string]string) *Bundle {
+	t.Helper()
+	body, ct := buildMultipart(t, fields, map[string][]byte{"review.json": []byte(`{}`)})
+	req := httptest.NewRequest(http.MethodPost, "/v1/upload/debug/"+projectKey+"/", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	var resp map[string]string
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	return storage.Get(resp["id"])
+}
+
+func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
+	storage := New(5, 5)
+	knownKey := uuid.NewString()
+	h := NewHandler(storage, slog.Default(), func(_ context.Context, key string) string {
+		if key == knownKey {
+			return "demo"
+		}
+		return ""
+	}, nil)
+	e := echo.New()
+	e.POST("/v1/upload/debug/:projectKey/", h.Upload)
+	e.GET("/v1/debug/storage/", h.List)
+
+	b := upload(t, storage, e, knownKey, map[string]string{
+		"runner": "claude", "errorMsg": "run claude: billing_error: Credit balance is too low",
+		"status": "failed", "reason": "billing", "costUsd": "1.5",
+	})
+	if b.Status != "failed" || b.Reason != "billing" || b.CostUsd != 1.5 || b.ProjectTitle != "demo" {
+		t.Errorf("outcome not recorded: %+v", b)
+	}
+
+	// A legacy client sends no status: derived from errorMsg. Garbage is sanitized.
+	b = upload(t, storage, e, uuid.NewString(), map[string]string{"errorMsg": "boom", "reason": "<script>", "costUsd": "NaN"})
+	if b.Status != "failed" || b.Reason != "other" || b.CostUsd != 0 || b.ProjectTitle != "" {
+		t.Errorf("legacy upload not normalized: %+v", b)
+	}
+
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/debug/storage/", nil))
+	page := rec.Body.String()
+	for _, want := range []string{"demo", "billing", "$1.50", `class="st-failed"`} {
+		if !strings.Contains(page, want) {
+			t.Errorf("list page misses %q", want)
+		}
+	}
+}
+
+func TestClip(t *testing.T) {
+	if got := clip("short", 10); got != "short" {
+		t.Errorf("clip(short) = %q", got)
+	}
+	// "ошибка" is 12 bytes, 2 per rune: a cut at 5 must not split a rune.
+	if got := clip("ошибка", 5); got != "ош" {
+		t.Errorf("clip(ошибка, 5) = %q, want %q", got, "ош")
+	}
+}
+
+func TestHandler_UploadClipsMetadata(t *testing.T) {
+	storage, e := newTestHandler(t)
+	b := upload(t, storage, e, uuid.NewString(), map[string]string{
+		FieldErrorMsg: strings.Repeat("e", maxErrorMsgBytes+100),
+		FieldModel:    strings.Repeat("m", maxFieldBytes+100),
+	})
+	if len(b.ErrorMsg) != maxErrorMsgBytes || len(b.Model) != maxFieldBytes {
+		t.Errorf("errorMsg %d bytes, model %d bytes: want %d and %d", len(b.ErrorMsg), len(b.Model), maxErrorMsgBytes, maxFieldBytes)
+	}
+}
diff --git a/pkg/debug/storage.go b/pkg/debug/storage.go
index 6f8b71a..b807f6a 100644
--- a/pkg/debug/storage.go
+++ b/pkg/debug/storage.go
@@ -1,8 +1,9 @@
 // Package debug provides an in-memory ring buffer of recent reviewctl runs.
 // reviewctl uploads artifacts (claude-output.json, opencode-output.jsonl,
 // review.json, R*.md) here when a review fails in CI, where GitLab job
-// artifacts are unavailable. The buffer is intentionally small and ephemeral —
-// restart of reviewsrv drops everything.
+// artifacts are unavailable. Run metadata outlives the artifacts (only the
+// newest bundles keep their files); a restart of reviewsrv drops everything —
+// the reviewer_runs_total metric is the durable record.
 package debug
 
 import (
@@ -13,8 +14,15 @@ import (
 	"github.com/google/uuid"
 )
 
-// Bundle is a single captured run. Files holds raw (un-gzipped) bytes keyed
-// by original filename (e.g. "review.json", "R1.feat-foo.md").
+// File is one artifact, kept gzip-compressed as uploaded: runner transcripts
+// compress 5-15x, so the ring's memory is bounded by the upload cap.
+type File struct {
+	Gzip []byte // compressed content
+	Size int    // decompressed length
+}
+
+// Bundle is a single captured run. Files holds the artifacts keyed by original
+// filename (e.g. "review.json", "R1.feat-foo.md").
 type Bundle struct {
 	ID           string
 	Timestamp    time.Time
@@ -27,25 +35,32 @@ type Bundle struct {
 	TargetBranch string
 	CommitHash   string
 	ErrorMsg     string
-	Files        map[string][]byte
+	Status       string  // reviewer.RunStatus*, normalized on upload
+	Reason       string  // reviewer.RunReason*; empty for an ok run
+	CostUsd      float64 // what the run spent, including a failed one
+	ProjectTitle string  // resolved from ProjectKey; empty for an unknown key
+	Files        map[string]File
+	FilesEvicted bool // artifacts dropped to cap memory; metadata kept
 }
 
 // Storage is a thread-safe ring buffer of Bundle values, newest last.
 type Storage struct {
-	mu       sync.RWMutex
-	capacity int
-	items    []*Bundle
+	mu            sync.RWMutex
+	capacity      int
+	filesCapacity int
+	items         []*Bundle
 }
 
-// New returns a Storage with the given capacity. Once full, Add evicts
-// the oldest bundle. capacity must be positive; non-positive values default to 1.
-func New(capacity int) *Storage {
-	if capacity <= 0 {
-		capacity = 1
-	}
+// New returns a Storage keeping up to capacity bundles, of which only the newest
+// filesCapacity keep their artifact files: metadata is bytes, artifacts are
+// megabytes. Once full, Add evicts the oldest bundle. Non-positive capacity
+// defaults to 1; filesCapacity is clamped to [1, capacity].
+func New(capacity, filesCapacity int) *Storage {
+	capacity = max(capacity, 1)
 	return &Storage{
-		capacity: capacity,
-		items:    make([]*Bundle, 0, capacity),
+		capacity:      capacity,
+		filesCapacity: min(max(filesCapacity, 1), capacity),
+		items:         make([]*Bundle, 0, capacity),
 	}
 }
 
@@ -68,6 +83,28 @@ func (s *Storage) Add(b *Bundle) {
 		s.items = s.items[1:]
 	}
 	s.items = append(s.items, b)
+	s.evictFiles()
+}
+
+// evictFiles drops the artifacts of bundles beyond the newest filesCapacity
+// that still hold files. A stored bundle is shared with concurrent readers, so
+// it is replaced by a trimmed copy rather than mutated. Caller holds s.mu.
+func (s *Storage) evictFiles() {
+	kept := 0
+	for i := len(s.items) - 1; i >= 0; i-- {
+		b := s.items[i]
+		if len(b.Files) == 0 {
+			continue
+		}
+		kept++
+		if kept <= s.filesCapacity {
+			continue
+		}
+		trimmed := *b
+		trimmed.Files = nil
+		trimmed.FilesEvicted = true
+		s.items[i] = &trimmed
+	}
 }
 
 // List returns a snapshot of bundles, newest first.
@@ -95,15 +132,15 @@ func (s *Storage) Get(id string) *Bundle {
 	return nil
 }
 
-// GetFile returns the raw file content from the bundle by ID and filename.
-// The boolean is false when either the bundle or the file is missing.
-func (s *Storage) GetFile(id, filename string) ([]byte, bool) {
+// GetFile returns a file of the bundle by ID and filename. The boolean is
+// false when either the bundle or the file is missing.
+func (s *Storage) GetFile(id, filename string) (File, bool) {
 	b := s.Get(id)
 	if b == nil {
-		return nil, false
+		return File{}, false
 	}
-	data, ok := b.Files[filename]
-	return data, ok
+	f, ok := b.Files[filename]
+	return f, ok
 }
 
 // newID returns a 12-char hex id derived from a UUIDv4. Short enough
diff --git a/pkg/debug/storage_test.go b/pkg/debug/storage_test.go
index f36c4f3..4764083 100644
--- a/pkg/debug/storage_test.go
+++ b/pkg/debug/storage_test.go
@@ -7,7 +7,7 @@ import (
 )
 
 func TestStorage_AddAssignsID(t *testing.T) {
-	s := New(3)
+	s := New(3, 3)
 	b := &Bundle{ProjectKey: "p"}
 	s.Add(b)
 
@@ -20,7 +20,7 @@ func TestStorage_AddAssignsID(t *testing.T) {
 }
 
 func TestStorage_RingEvictsOldest(t *testing.T) {
-	s := New(2)
+	s := New(2, 2)
 	a := &Bundle{ID: "a"}
 	b := &Bundle{ID: "b"}
 	c := &Bundle{ID: "c"}
@@ -41,7 +41,7 @@ func TestStorage_RingEvictsOldest(t *testing.T) {
 }
 
 func TestStorage_ListNewestFirst(t *testing.T) {
-	s := New(3)
+	s := New(3, 3)
 	s.Add(&Bundle{ID: "1"})
 	s.Add(&Bundle{ID: "2"})
 	s.Add(&Bundle{ID: "3"})
@@ -59,15 +59,15 @@ func TestStorage_ListNewestFirst(t *testing.T) {
 }
 
 func TestStorage_GetFile(t *testing.T) {
-	s := New(1)
+	s := New(1, 1)
 	s.Add(&Bundle{
 		ID:    "x",
-		Files: map[string][]byte{"review.json": []byte("{}")},
+		Files: map[string]File{"review.json": {Gzip: []byte("gz"), Size: 2}},
 	})
 
-	data, ok := s.GetFile("x", "review.json")
-	if !ok || string(data) != "{}" {
-		t.Errorf("GetFile = %q, %v", data, ok)
+	f, ok := s.GetFile("x", "review.json")
+	if !ok || f.Size != 2 || string(f.Gzip) != "gz" {
+		t.Errorf("GetFile = %+v, %v", f, ok)
 	}
 
 	if _, ok := s.GetFile("x", "missing.txt"); ok {
@@ -79,7 +79,7 @@ func TestStorage_GetFile(t *testing.T) {
 }
 
 func TestStorage_ConcurrentAddGet(t *testing.T) {
-	s := New(50)
+	s := New(50, 50)
 
 	var wg sync.WaitGroup
 	for i := range 100 {
@@ -104,7 +104,7 @@ func TestStorage_ConcurrentAddGet(t *testing.T) {
 }
 
 func TestStorage_NonPositiveCapacityDefaultsToOne(t *testing.T) {
-	s := New(0)
+	s := New(0, 0)
 	s.Add(&Bundle{ID: "a"})
 	s.Add(&Bundle{ID: "b"})
 
@@ -115,3 +115,44 @@ func TestStorage_NonPositiveCapacityDefaultsToOne(t *testing.T) {
 		t.Error("newest bundle should remain after eviction")
 	}
 }
+
+func TestStorage_EvictsFilesBeyondFilesCapacity(t *testing.T) {
+	s := New(5, 2)
+	for _, id := range []string{"1", "2", "3"} {
+		s.Add(&Bundle{ID: id, Files: map[string]File{"review.json": {Size: 2}}})
+	}
+	old := s.Get("1")
+	if old == nil {
+		t.Fatal("metadata of the oldest bundle must be kept")
+	}
+	if old.Files != nil || !old.FilesEvicted {
+		t.Errorf("oldest bundle must lose its files: files=%v evicted=%v", old.Files, old.FilesEvicted)
+	}
+	if _, ok := s.GetFile("3", "review.json"); !ok {
+		t.Error("newest bundle must keep its files")
+	}
+	if _, ok := s.GetFile("2", "review.json"); !ok {
+		t.Error("second newest bundle must keep its files")
+	}
+}
+
+func TestStorage_EvictionDoesNotMutateSharedBundle(t *testing.T) {
+	s := New(3, 1)
+	first := &Bundle{ID: "1", Files: map[string]File{"a": {Size: 1}}}
+	s.Add(first)
+	s.Add(&Bundle{ID: "2", Files: map[string]File{"a": {Size: 1}}})
+	// A reader holding the old pointer (a page being rendered) keeps a consistent view.
+	if first.Files == nil || first.FilesEvicted {
+		t.Error("eviction must replace the stored bundle, not mutate it")
+	}
+}
+
+func TestNew_ClampsFilesCapacity(t *testing.T) {
+	s := New(2, 10)
+	if s.filesCapacity != 2 {
+		t.Errorf("filesCapacity = %d, want clamped to capacity 2", s.filesCapacity)
+	}
+	if s = New(0, 0); s.capacity != 1 || s.filesCapacity != 1 {
+		t.Errorf("non-positive capacities must default to 1, got %d/%d", s.capacity, s.filesCapacity)
+	}
+}
diff --git a/pkg/debug/templates/bundle.html b/pkg/debug/templates/bundle.html
index ebba0c6..b472764 100644
--- a/pkg/debug/templates/bundle.html
+++ b/pkg/debug/templates/bundle.html
@@ -26,7 +26,9 @@ <h1>Bundle <code>{{.Bundle.ID}}</code></h1>
 
 <dl class="meta">
   <dt>Timestamp</dt>     <dd><code>{{.Bundle.Timestamp.Format "2006-01-02 15:04:05 MST"}}</code></dd>
-  <dt>Project key</dt>   <dd><code>{{.Bundle.ProjectKey}}</code></dd>
+  <dt>Project</dt>       <dd>{{or .Bundle.ProjectTitle "—"}} <code>{{.Bundle.ProjectKey}}</code></dd>
+  <dt>Status</dt>        <dd>{{.Bundle.Status}}{{if .Bundle.Reason}} · {{.Bundle.Reason}}{{end}}</dd>
+  <dt>Cost</dt>          <dd>{{if .Bundle.CostUsd}}<code>${{printf "%.4f" .Bundle.CostUsd}}</code>{{else}}—{{end}}</dd>
   <dt>MR IID</dt>        <dd>{{or .Bundle.MRIid "—"}}</dd>
   <dt>External ID</dt>   <dd>{{or .Bundle.ExternalID "—"}}</dd>
   <dt>Runner</dt>        <dd>{{.Bundle.Runner}}</dd>
@@ -56,6 +58,8 @@ <h2>Artifacts</h2>
   {{end}}
   </tbody>
 </table>
+{{else if .Bundle.FilesEvicted}}
+<p class="empty">Artifacts evicted to cap memory — only the newest bundles keep their files.</p>
 {{else}}
 <p class="empty">No artifacts captured.</p>
 {{end}}
diff --git a/pkg/debug/templates/list.html b/pkg/debug/templates/list.html
index ce9eb17..c628772 100644
--- a/pkg/debug/templates/list.html
+++ b/pkg/debug/templates/list.html
@@ -11,6 +11,9 @@
 th { background: #f6f8fa; font-weight: 600; }
 tr:hover td { background: #fafbfc; }
 .err { color: #b00020; }
+.st-failed, .st-timeout { color: #b00020; font-weight: 600; }
+.st-cancelled { color: #8a6d00; }
+.st-ok { color: #1a7f37; }
 .muted { color: #888; font-size: 0.85em; }
 .empty { color: #888; font-style: italic; padding: 2rem 0; }
 code { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 0.85em; }
@@ -30,6 +33,8 @@ <h1>reviewsrv debug — last {{len .Bundles}} runs</h1>
       <th>Branch</th>
       <th>Runner</th>
       <th>Model</th>
+      <th>Status</th>
+      <th>Cost</th>
       <th>Files</th>
       <th>Error</th>
     </tr>
@@ -38,12 +43,14 @@ <h1>reviewsrv debug — last {{len .Bundles}} runs</h1>
   {{range .Bundles}}
     <tr>
       <td><a href="{{storageURL}}{{.ID}}/"><code>{{.Timestamp.Format "2006-01-02 15:04:05"}}</code></a></td>
-      <td><code>{{shortKey .ProjectKey}}</code></td>
+      <td>{{if .ProjectTitle}}{{.ProjectTitle}}{{else}}<code>{{shortKey .ProjectKey}}</code>{{end}}</td>
       <td>{{or .MRIid .ExternalID}}</td>
       <td><code>{{.SourceBranch}}</code> → <code>{{.TargetBranch}}</code></td>
       <td>{{.Runner}}</td>
       <td><code>{{.Model}}</code></td>
-      <td>{{len .Files}}</td>
+      <td class="st-{{.Status}}">{{.Status}}{{if .Reason}}<br><span class="muted">{{.Reason}}</span>{{end}}</td>
+      <td>{{if .CostUsd}}<code>${{printf "%.2f" .CostUsd}}</code>{{else}}—{{end}}</td>
+      <td>{{if .FilesEvicted}}<span class="muted">evicted</span>{{else}}{{len .Files}}{{end}}</td>
       <td class="err">{{preview .ErrorMsg 80}}</td>
     </tr>
   {{end}}
diff --git a/pkg/rest/rest.go b/pkg/rest/rest.go
index d57dba3..b8b9b8e 100644
--- a/pkg/rest/rest.go
+++ b/pkg/rest/rest.go
@@ -1,6 +1,7 @@
 package rest
 
 import (
+	"cmp"
 	"context"
 	"errors"
 	"fmt"
@@ -21,15 +22,18 @@ type Handler struct {
 	pm       *reviewer.ProjectManager
 	rm       *reviewer.ReviewManager
 	notifier *slack.Notifier
+	metrics  *reviewer.RunMetrics
 	baseURL  string
 }
 
-// NewHandler creates a REST handler with review management and Slack notifications.
-func NewHandler(dbc db.DB, notifier *slack.Notifier, baseURL string) *Handler {
+// NewHandler creates a REST handler with review management and Slack
+// notifications. metrics counts completed runs (nil = off).
+func NewHandler(dbc db.DB, notifier *slack.Notifier, baseURL string, metrics *reviewer.RunMetrics) *Handler {
 	return &Handler{
 		pm:       reviewer.NewProjectManager(dbc),
 		rm:       reviewer.NewReviewManager(dbc),
 		notifier: notifier,
+		metrics:  metrics,
 		baseURL:  baseURL,
 	}
 }
@@ -77,6 +81,9 @@ func (h *Handler) CreateReview(c echo.Context) error {
 	}
 
 	h.notifySlack(project, rv)
+	// A run that got its review uploaded completed; the others arrive as debug bundles.
+	meta := draft.Review
+	h.metrics.Observe(project.Title, cmp.Or(meta.RunnerProfile.Runner, meta.ModelInfo.Runner), reviewer.RunStatusOK, "", meta.ModelInfo.CostUsd)
 
 	return c.String(http.StatusOK, strconv.Itoa(rv.ID))
 }
diff --git a/pkg/rest/rest_test.go b/pkg/rest/rest_test.go
index b88f298..dee7c23 100644
--- a/pkg/rest/rest_test.go
+++ b/pkg/rest/rest_test.go
@@ -22,7 +22,7 @@ import (
 func newTestHandler(t *testing.T) *Handler {
 	t.Helper()
 	dbc, _ := dbtest.Setup(t)
-	return NewHandler(dbc, nil, "http://localhost")
+	return NewHandler(dbc, nil, "http://localhost", nil)
 }
 
 // callInstructionsHandler builds a fresh Echo context with `:id` set to param
@@ -80,7 +80,7 @@ func TestDBProjectInstructionsMarkdown_OK(t *testing.T) {
 
 	// OK path needs the same dbc as the project, so wire NewHandler inline
 	// rather than via newTestHandler.
-	h := NewHandler(dbc, nil, "http://localhost")
+	h := NewHandler(dbc, nil, "http://localhost", nil)
 
 	rec, err := callInstructionsHandler(t, h, strconv.Itoa(pr.ID)+".md")
 	require.NoError(t, err)
@@ -117,7 +117,7 @@ func TestDBProjectInstructionsMarkdown_RendersIgnoredIssues(t *testing.T) {
 	_, err := rm.SetFeedback(t.Context(), ignoredID, db.StatusIgnored)
 	require.NoError(t, err)
 
-	h := NewHandler(dbc, nil, "http://localhost")
+	h := NewHandler(dbc, nil, "http://localhost", nil)
 
 	rec, err := callInstructionsHandler(t, h, strconv.Itoa(pr.ID)+".md")
 	require.NoError(t, err)
diff --git a/pkg/reviewctl/reviewctl.go b/pkg/reviewctl/reviewctl.go
index e97f2c6..4244bea 100644
--- a/pkg/reviewctl/reviewctl.go
+++ b/pkg/reviewctl/reviewctl.go
@@ -29,6 +29,7 @@ func NewService(dbc db.DB) *Service {
 // name would generate DbRunnerProfileParams.
 type RunnerProfileParams struct {
 	AllowDangerousPermissions bool `json:"allowDangerousPermissions"`
+	MaxRounds                 int  `json:"maxRounds"` // direct runner round budget; 0 = default
 }
 
 // Config is the resolved run configuration returned to reviewctl. It carries the
@@ -78,7 +79,7 @@ func newConfig(rp *reviewer.RunnerProfile) *Config {
 		APIProvider:     derefString(rp.APIProvider),
 		APIBaseURL:      derefString(rp.APIBaseURL),
 		Token:           derefString(rp.Token),
-		Params:          RunnerProfileParams{AllowDangerousPermissions: rp.Params.AllowDangerousPermissions},
+		Params:          RunnerProfileParams(rp.Params),
 	}
 }
 
diff --git a/pkg/reviewctl/reviewctl_zenrpc.go b/pkg/reviewctl/reviewctl_zenrpc.go
index 6409efa..a2bcf9b 100644
--- a/pkg/reviewctl/reviewctl_zenrpc.go
+++ b/pkg/reviewctl/reviewctl_zenrpc.go
@@ -1,4 +1,4 @@
-// Code generated by zenrpc v2.3.1; DO NOT EDIT.
+// Code generated by zenrpc v2.3.3; DO NOT EDIT.
 
 package reviewctl
 
@@ -117,6 +117,11 @@ includes the real token. A nil judge means single review via the primary.`,
 									Name: "allowDangerousPermissions",
 									Type: smd.Boolean,
 								},
+								{
+									Name:        "maxRounds",
+									Description: `direct runner round budget; 0 = default`,
+									Type:        smd.Integer,
+								},
 							},
 						},
 						"TrackerConfig": {
diff --git a/pkg/reviewer/ctl/config.go b/pkg/reviewer/ctl/config.go
index aa981a5..20e4d5a 100644
--- a/pkg/reviewer/ctl/config.go
+++ b/pkg/reviewer/ctl/config.go
@@ -3,6 +3,7 @@ package ctl
 import (
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -42,9 +43,10 @@ type Config struct {
 	// Direct-API runner (--runner direct): provider, endpoint and reasoning effort.
 	// The API key is read from the environment (ANTHROPIC_API_KEY / DEEPSEEK_API_KEY),
 	// never a flag.
-	APIProvider string // "deepseek" (default) | "openai-compat" | "anthropic"
+	APIProvider string // "deepseek" (default) | "openai" | "openai-compat" | "anthropic"
 	APIBaseURL  string
 	Effort      string
+	MaxRounds   int // direct runner round budget (--max-rounds / profile); 0 = default
 
 	// Resolved runner profile (fetched from the server over /v1/reviewctl/rpc/).
 	// Token is the optional API-key fallback used only when the matching env var
@@ -61,12 +63,17 @@ type Config struct {
 	TrackerURL   string
 	TrackerToken string
 
-	// AllowDangerousPermissions toggles `--dangerously-skip-permissions` for
+	// AllowDangerousPermissions toggles permission auto-approval (`--auto`) for
 	// runners that support it (currently opencode). Defaults to true to match
 	// previous behaviour — unattended CI runs need it to avoid permission
 	// prompts. Set false for local interactive review on untrusted code.
 	AllowDangerousPermissions bool
 
+	// CodexSandbox overrides codex's --sandbox mode (default workspace-write).
+	// Inside an unprivileged container codex's bubblewrap sandbox cannot start,
+	// so CI images set danger-full-access and the container is the sandbox.
+	CodexSandbox string
+
 	// Multi holds the panel members for a local multi-review run (--multi /
 	// $REVIEW_MULTI). Empty = single review. Each member is a runner+model run in
 	// its own git worktree with ambient credentials; the server-driven panel
@@ -101,7 +108,7 @@ func (c *Config) RunnerProfileSnapshot() db.ReviewRunnerProfile {
 		Effort:          c.Effort,
 		APIProvider:     c.APIProvider,
 		APIBaseURL:      c.APIBaseURL,
-		Params:          db.RunnerProfileParams{AllowDangerousPermissions: c.AllowDangerousPermissions},
+		Params:          db.RunnerProfileParams{AllowDangerousPermissions: c.AllowDangerousPermissions, MaxRounds: c.MaxRounds},
 	}
 }
 
@@ -148,12 +155,13 @@ func (c *Config) ResolveDefaults() {
 	}
 	// Direct runner against Anthropic: pin a concrete model and reasoning effort
 	// so cost/quality stay predictable. Without an explicit effort the Anthropic
-	// API silently defaults to "high", whereas Claude Code uses "xhigh" for
-	// agentic coding — match it so the direct runner isn't a notch weaker out of
-	// the box. DeepSeek/openai-compat ignore effort and require an explicit --model.
+	// API silently defaults to "medium" on Opus 5.5 ("high" on older models),
+	// whereas Claude Code uses "xhigh" for agentic coding — match it so the direct
+	// runner isn't weaker out of the box. Other providers get an effort only when
+	// one is set (openai-compat never) and require an explicit --model.
 	if c.Runner == runner.RunnerDirect && c.APIProvider == "anthropic" { //nolint:goconst // provider id; canonical const lives in pkg/reviewer/direct
 		if c.Model == "" {
-			c.Model = "claude-opus-4-8" //nolint:goconst // pinned model id
+			c.Model = "claude-opus-5-5" //nolint:goconst // pinned model id
 		}
 		if c.Effort == "" {
 			c.Effort = "xhigh" //nolint:goconst // reasoning effort level
@@ -163,7 +171,7 @@ func (c *Config) ResolveDefaults() {
 	// predictable model and the cost is estimated from tokens against the price
 	// table (an empty model leaves cost at 0). Override with --model.
 	if c.Runner == runner.RunnerCodex && c.Model == "" {
-		c.Model = "gpt-5.1-codex"
+		c.Model = "gpt-6-sol"
 	}
 }
 
@@ -178,7 +186,7 @@ type MemberSpec struct {
 }
 
 // ParseMulti parses the --multi value: a comma-separated list of runner:model
-// members, e.g. "codex:gpt-5.5,opencode:openrouter/deepseek/deepseek-v4-pro". Only
+// members, e.g. "codex:gpt-6-sol,opencode:openrouter/deepseek/deepseek-v4-pro". Only
 // the first colon separates runner from model (models may contain slashes); a bare
 // "runner" with no colon uses the runner's default model. Returns nil for an empty
 // string (single review, no panel).
@@ -197,10 +205,8 @@ func ParseMulti(s string) ([]MemberSpec, error) {
 		r, m, _ := strings.Cut(part, ":")
 		r = strings.TrimSpace(r)
 		m = strings.TrimSpace(m)
-		switch r {
-		case runner.RunnerClaude, runner.RunnerOpenCode, runner.RunnerCodex, runner.RunnerDirect:
-		default:
-			return nil, fmt.Errorf("--multi: unknown runner %q in %q (want claude|opencode|codex|direct)", r, part)
+		if !slices.Contains(runner.Names, r) {
+			return nil, fmt.Errorf("--multi: unknown runner %q in %q (want %s)", r, part, strings.Join(runner.Names, "|"))
 		}
 		out = append(out, MemberSpec{Runner: r, Model: m})
 	}
diff --git a/pkg/reviewer/ctl/config_test.go b/pkg/reviewer/ctl/config_test.go
index 33e193f..5219844 100644
--- a/pkg/reviewer/ctl/config_test.go
+++ b/pkg/reviewer/ctl/config_test.go
@@ -50,11 +50,11 @@ func TestConfigResolveDefaults(t *testing.T) {
 		{"claude effort preserved, no default", runner.RunnerClaude, "", "", "high", "opus", "high"},
 		{"opencode empty model stays empty", runner.RunnerOpenCode, "", "", "", "", ""},
 		{"opencode explicit model preserved", runner.RunnerOpenCode, "", "anthropic/claude-opus-4", "", "anthropic/claude-opus-4", ""},
-		{"direct+anthropic pins model and xhigh effort", runner.RunnerDirect, "anthropic", "", "", "claude-opus-4-8", "xhigh"},
-		{"direct+anthropic explicit effort preserved", runner.RunnerDirect, "anthropic", "", "max", "claude-opus-4-8", "max"},
+		{"direct+anthropic pins model and xhigh effort", runner.RunnerDirect, "anthropic", "", "", "claude-opus-5-5", "xhigh"},
+		{"direct+anthropic explicit effort preserved", runner.RunnerDirect, "anthropic", "", "max", "claude-opus-5-5", "max"},
 		{"direct+deepseek leaves model/effort untouched", runner.RunnerDirect, "deepseek", "", "", "", ""},
-		{"codex pins a default model", runner.RunnerCodex, "", "", "", "gpt-5.1-codex", ""},
-		{"codex explicit model preserved", runner.RunnerCodex, "", "gpt-5-codex", "", "gpt-5-codex", ""},
+		{"codex pins a default model", runner.RunnerCodex, "", "", "", "gpt-6-sol", ""},
+		{"codex explicit model preserved", runner.RunnerCodex, "", "gpt-5.5", "", "gpt-5.5", ""},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/reviewer/ctl/ctl.go b/pkg/reviewer/ctl/ctl.go
index 4782d8d..3471a32 100644
--- a/pkg/reviewer/ctl/ctl.go
+++ b/pkg/reviewer/ctl/ctl.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"reviewsrv/pkg/rest"
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/runner"
 )
 
@@ -19,7 +20,7 @@ type Controller struct {
 	prompt *PromptClient
 	upload *UploadClient
 	gitlab *GitLabClient
-	runner runner.ReviewRunner
+	runner *spendTracker
 
 	// runnerFactory builds a runner from a per-member config; used by the panel
 	// path to build one runner per member after creating its worktree.
@@ -37,6 +38,39 @@ func WithRunnerFactory(f RunnerFactory) Option {
 	return func(c *Controller) { c.runnerFactory = f }
 }
 
+// spendTracker wraps a ReviewRunner and adds up what its runs spent — failed
+// ones included, as they are billed too — so a debug bundle reports the whole
+// run, Step 2 retry and all.
+type spendTracker struct {
+	runner.ReviewRunner
+	spent float64
+}
+
+// trackSpend wraps rr; a nil runner stays nil.
+func trackSpend(rr runner.ReviewRunner) *spendTracker {
+	if rr == nil {
+		return nil
+	}
+	return &spendTracker{ReviewRunner: rr}
+}
+
+// Run implements runner.ReviewRunner.
+func (t *spendTracker) Run(ctx context.Context, prompt string) (*runner.ClaudeResult, error) {
+	res, err := t.ReviewRunner.Run(ctx, prompt)
+	if res != nil {
+		t.spent += res.TotalCostUSD
+	}
+	return res, err
+}
+
+// total returns what the runs spent so far; 0 for a nil tracker.
+func (t *spendTracker) total() float64 {
+	if t == nil {
+		return 0
+	}
+	return t.spent
+}
+
 // NewController creates a new Controller from Config.
 func NewController(cfg *Config, rr runner.ReviewRunner, log *slog.Logger, opts ...Option) *Controller {
 	c := &Controller{
@@ -44,7 +78,7 @@ func NewController(cfg *Config, rr runner.ReviewRunner, log *slog.Logger, opts .
 		log:    log,
 		prompt: NewPromptClient(log),
 		upload: NewUploadClient(log),
-		runner: rr,
+		runner: trackSpend(rr),
 	}
 
 	if cfg.HasGitLab() {
@@ -84,7 +118,7 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 		}
 		upCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
 		defer cancel()
-		c.uploadDebugBundle(upCtx, c.cfg, retErr)
+		c.uploadDebugBundle(upCtx, c.cfg, retErr, c.runner.total())
 	}()
 
 	// Wipe a previous run's outputs (R*.md, session logs, review.json) so the
@@ -109,7 +143,7 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 
 	result, err := c.runner.Run(ctx, prompt)
 	if err != nil {
-		return fmt.Errorf("run claude: %w", err)
+		return fmt.Errorf("run %s: %w", c.runner.Name(), err)
 	}
 
 	draft, err := ReadReviewJSON(c.cfg.Dir)
@@ -156,7 +190,7 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 // The empty-bundle short-circuit lives in UploadClient.UploadDebugBundle.
 // cfg is the run whose dir/identity to bundle — the base config for a single
 // review, a member's clone for a panel member.
-func (c *Controller) uploadDebugBundle(ctx context.Context, cfg *Config, runErr error) {
+func (c *Controller) uploadDebugBundle(ctx context.Context, cfg *Config, runErr error, costUsd float64) {
 	files := CollectDebugArtifacts(cfg.Dir)
 
 	meta := DebugMeta{
@@ -167,9 +201,18 @@ func (c *Controller) uploadDebugBundle(ctx context.Context, cfg *Config, runErr
 		SourceBranch: cfg.SourceBranch,
 		TargetBranch: cfg.TargetBranch,
 		CommitHash:   cfg.Commit,
+		CostUsd:      costUsd,
 	}
+	meta.Status, meta.Reason = reviewer.RunOutcome(runErr)
 	if runErr != nil {
 		meta.ErrorMsg = runErr.Error()
+		// A cancelled job is expected, not a failure worth a warning.
+		lvl := slog.LevelWarn
+		if meta.Status == reviewer.RunStatusCancelled {
+			lvl = slog.LevelInfo
+		}
+		c.log.Log(ctx, lvl, "review run did not complete", "status", meta.Status, "reason", meta.Reason,
+			"runner", cfg.Runner, "model", cfg.Model, "costUsd", costUsd, "err", runErr)
 	}
 
 	url, err := c.upload.UploadDebugBundle(ctx, cfg.URL, cfg.Key, meta, files)
@@ -262,10 +305,16 @@ func (c *Controller) Comment(ctx context.Context) error {
 // single review, panel members and the judge so all three populate identically.
 // The enriched draft is persisted back to review.json so the metadata survives a
 // failed upload and a later standalone `reviewctl upload` re-sends it intact.
-func (c *Controller) applyRunResult(ctx context.Context, draft *rest.ReviewDraft, cfg *Config, rr runner.ReviewRunner, result *runner.ClaudeResult) {
+// failed lists earlier attempts of the same run (a retried judge): they were
+// billed too, so their usage is added in.
+func (c *Controller) applyRunResult(ctx context.Context, draft *rest.ReviewDraft, cfg *Config, rr runner.ReviewRunner, result *runner.ClaudeResult, failed ...*runner.ClaudeResult) {
 	draft.Review.ModelInfo = result.ToModelInfo(cfg.Model)
-	draft.Review.ModelInfo.Runner = rr.Name()
 	draft.Review.DurationMs = result.DurationMs
+	for _, f := range failed {
+		draft.Review.ModelInfo.Add(f.ToModelInfo(cfg.Model))
+		draft.Review.DurationMs += f.DurationMs
+	}
+	draft.Review.ModelInfo.Runner = rr.Name()
 	draft.Review.RunnerProfile = cfg.RunnerProfileSnapshot()
 	c.fillMetadata(ctx, draft)
 	if err := WriteReviewJSON(cfg.Dir, draft); err != nil {
diff --git a/pkg/reviewer/ctl/ctl_test.go b/pkg/reviewer/ctl/ctl_test.go
index 8026cc3..53c4f67 100644
--- a/pkg/reviewer/ctl/ctl_test.go
+++ b/pkg/reviewer/ctl/ctl_test.go
@@ -3,6 +3,7 @@ package ctl
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"io"
 	"log/slog"
 	"net/http"
@@ -10,10 +11,12 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 
 	"reviewsrv/pkg/rest"
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/runner"
 
 	"github.com/stretchr/testify/assert"
@@ -208,6 +211,90 @@ func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
 	assert.Contains(t, debugError, "files[0]", "errorMsg must carry verbose validation detail")
 }
 
+// failingRunner fails like a real runner: a tagged error plus the partial result
+// carrying what the run already spent.
+type failingRunner struct {
+	name string
+	cost float64
+	err  error
+}
+
+func (r failingRunner) Run(context.Context, string) (*runner.ClaudeResult, error) {
+	return &runner.ClaudeResult{TotalCostUSD: r.cost, IsError: true}, r.err
+}
+func (r failingRunner) Name() string      { return r.name }
+func (r failingRunner) SetSession(string) {}
+
+func TestController_Review_ReportsFailureOutcome(t *testing.T) {
+	fields := map[string]string{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v1/reviewctl/rpc/" {
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "result": "prompt", "id": 1})
+			return
+		}
+		if strings.HasPrefix(r.URL.Path, "/v1/upload/debug/") {
+			if !assert.NoError(t, r.ParseMultipartForm(32<<20)) {
+				return
+			}
+			for k, v := range r.MultipartForm.Value {
+				fields[k] = v[0]
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"id":"x","url":"/v1/debug/storage/x/"}`))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer srv.Close()
+
+	tests := []struct {
+		name       string
+		runner     failingRunner
+		wantMsg    string
+		wantStatus string
+		wantReason string
+	}{
+		{
+			name:       "billing",
+			runner:     failingRunner{name: runner.RunnerClaude, err: reviewer.WithRunReason(reviewer.RunReasonBilling, errors.New("billing_error: Credit balance is too low (api 400, claude exit status 1)"))},
+			wantMsg:    "run claude: billing_error: Credit balance is too low",
+			wantStatus: reviewer.RunStatusFailed,
+			wantReason: reviewer.RunReasonBilling,
+		},
+		{
+			name:       "direct max rounds keeps the cost",
+			runner:     failingRunner{name: runner.RunnerDirect, cost: 7.9, err: reviewer.WithRunReason(reviewer.RunReasonMaxRounds, errors.New("direct: max rounds reached without submit_review"))},
+			wantMsg:    "run direct: direct: max rounds",
+			wantStatus: reviewer.RunStatusFailed,
+			wantReason: reviewer.RunReasonMaxRounds,
+		},
+		{
+			name:       "cancelled job",
+			runner:     failingRunner{name: runner.RunnerClaude, cost: 0.4, err: reviewer.WithRunReason(reviewer.RunReasonCancelled, errors.New("claude interrupted by a signal: exit status 143"))},
+			wantMsg:    "run claude: claude interrupted",
+			wantStatus: reviewer.RunStatusCancelled,
+			wantReason: reviewer.RunReasonCancelled,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			clear(fields)
+			cfg := &Config{Key: "test-key", URL: srv.URL, Model: "m", Dir: t.TempDir(), Runner: tt.runner.name}
+			err := NewController(cfg, tt.runner, slog.Default()).Review(context.Background())
+			require.Error(t, err)
+			assert.True(t, strings.HasPrefix(fields["errorMsg"], tt.wantMsg), fields["errorMsg"])
+			assert.Equal(t, tt.wantStatus, fields["status"])
+			assert.Equal(t, tt.wantReason, fields["reason"])
+			if tt.runner.cost > 0 {
+				assert.Equal(t, strconv.FormatFloat(tt.runner.cost, 'f', -1, 64), fields["costUsd"])
+			} else {
+				assert.NotContains(t, fields, "costUsd")
+			}
+		})
+	}
+}
+
 func TestController_Comment(t *testing.T) {
 	var commentPosted bool
 
@@ -305,3 +392,31 @@ func TestWriteReviewJSONRoundTrip(t *testing.T) {
 	require.InEpsilon(t, 1.5, got.Review.ModelInfo.CostUsd, 1e-9)
 	require.Equal(t, 4200, got.Review.DurationMs)
 }
+
+func TestSpendTracker(t *testing.T) {
+	var none *spendTracker
+	assert.Zero(t, none.total(), "a nil tracker spent nothing")
+	assert.Nil(t, trackSpend(nil))
+
+	st := trackSpend(failingRunner{name: runner.RunnerClaude, cost: 0.4, err: errors.New("boom")})
+	for range 2 { // e.g. the first run plus a failed Step 2 retry
+		_, err := st.Run(t.Context(), "prompt")
+		require.Error(t, err)
+	}
+	assert.InDelta(t, 0.8, st.total(), 1e-9, "failed runs are billed too")
+	assert.Equal(t, runner.RunnerClaude, st.Name())
+}
+
+func TestApplyRunResultAddsFailedAttempts(t *testing.T) {
+	c := &Controller{cfg: &Config{}, log: slog.Default()}
+	cfg := &Config{Dir: t.TempDir(), Model: "m"}
+	draft := &rest.ReviewDraft{}
+
+	c.applyRunResult(t.Context(), draft, cfg, failingRunner{name: runner.RunnerCodex},
+		&runner.ClaudeResult{TotalCostUSD: 1, DurationMs: 10},
+		&runner.ClaudeResult{TotalCostUSD: 0.5, DurationMs: 5}) // a judge attempt that came back empty
+
+	assert.InDelta(t, 1.5, draft.Review.ModelInfo.CostUsd, 1e-9)
+	assert.Equal(t, 15, draft.Review.DurationMs)
+	assert.Equal(t, runner.RunnerCodex, draft.Review.ModelInfo.Runner)
+}
diff --git a/pkg/reviewer/ctl/env.go b/pkg/reviewer/ctl/env.go
index 03f1b83..678d91f 100644
--- a/pkg/reviewer/ctl/env.go
+++ b/pkg/reviewer/ctl/env.go
@@ -20,29 +20,33 @@ func EnvDefault(key, fallback string) string {
 // or unparseable rather than guessing — bad input is more actionable as a
 // no-op-with-default than a silent flip.
 func EnvBool(key string, fallback bool) bool {
-	v := os.Getenv(key)
-	if v == "" {
-		return fallback
-	}
-	b, err := strconv.ParseBool(v)
-	if err != nil {
-		return fallback
-	}
-	return b
+	return envParse(key, fallback, strconv.ParseBool)
+}
+
+// EnvInt parses an integer env var. Falls back when the var is unset or
+// unparseable.
+func EnvInt(key string, fallback int) int {
+	return envParse(key, fallback, strconv.Atoi)
 }
 
 // EnvDuration parses an env var via time.ParseDuration ("30m", "1h30m"). Falls
 // back when the var is unset or unparseable.
 func EnvDuration(key string, fallback time.Duration) time.Duration {
+	return envParse(key, fallback, time.ParseDuration)
+}
+
+// envParse parses env var key with parse, falling back when the var is unset or
+// unparseable.
+func envParse[T any](key string, fallback T, parse func(string) (T, error)) T {
 	v := os.Getenv(key)
 	if v == "" {
 		return fallback
 	}
-	d, err := time.ParseDuration(v)
+	x, err := parse(v)
 	if err != nil {
 		return fallback
 	}
-	return d
+	return x
 }
 
 // AuthorName extracts the display name from "Name <email>" (CI_COMMIT_AUTHOR
diff --git a/pkg/reviewer/ctl/env_test.go b/pkg/reviewer/ctl/env_test.go
index 704cdd4..f712b45 100644
--- a/pkg/reviewer/ctl/env_test.go
+++ b/pkg/reviewer/ctl/env_test.go
@@ -75,3 +75,12 @@ func TestEnvDefault(t *testing.T) {
 		assert.Equal(t, "actual", EnvDefault("REVIEW_TEST_STR", "fb"))
 	})
 }
+
+func TestEnvInt(t *testing.T) {
+	t.Setenv("REVIEW_TEST_INT", "")
+	assert.Equal(t, 60, EnvInt("REVIEW_TEST_INT", 60))
+	t.Setenv("REVIEW_TEST_INT", "120")
+	assert.Equal(t, 120, EnvInt("REVIEW_TEST_INT", 60))
+	t.Setenv("REVIEW_TEST_INT", "lots")
+	assert.Equal(t, 60, EnvInt("REVIEW_TEST_INT", 60))
+}
diff --git a/pkg/reviewer/ctl/panel.go b/pkg/reviewer/ctl/panel.go
index d920d57..fdce36a 100644
--- a/pkg/reviewer/ctl/panel.go
+++ b/pkg/reviewer/ctl/panel.go
@@ -13,6 +13,7 @@ import (
 
 	"reviewsrv/pkg/rest"
 	"reviewsrv/pkg/reviewer"
+	"reviewsrv/pkg/reviewer/runner"
 )
 
 // panelConcurrency bounds how many members review at once. Panels are small
@@ -231,6 +232,7 @@ func (c *Controller) memberConfig(dir string, m MemberSpec) Config {
 		mc.APIProvider = p.APIProvider
 		mc.APIBaseURL = p.APIBaseURL
 		mc.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
+		mc.MaxRounds = p.Params.MaxRounds
 		mc.RunnerProfileID = p.RunnerProfileID
 		mc.RunnerProfileTitle = p.Title
 	}
@@ -244,6 +246,7 @@ func (c *Controller) memberConfig(dir string, m MemberSpec) Config {
 // worktree, which is otherwise the only place the runner transcript exists.
 func (c *Controller) produceMember(ctx context.Context, dir, label string, m MemberSpec, prompt string) (out *memberOutput, err error) {
 	mc := c.memberConfig(dir, m)
+	var rr *spendTracker
 	defer func() {
 		if err == nil {
 			return
@@ -252,13 +255,14 @@ func (c *Controller) produceMember(ctx context.Context, dir, label string, m Mem
 		// should explain, and by then ctx is already cancelled.
 		upCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
 		defer cancel()
-		c.uploadDebugBundle(upCtx, &mc, err)
+		c.uploadDebugBundle(upCtx, &mc, err, rr.total())
 	}()
 
-	rr, err := c.runnerFactory(&mc)
+	built, err := c.runnerFactory(&mc)
 	if err != nil {
 		return nil, fmt.Errorf("build runner: %w", err)
 	}
+	rr = trackSpend(built)
 	if err = WriteReviewSkeleton(mc.Dir, &mc); err != nil {
 		return nil, fmt.Errorf("write review.json skeleton: %w", err)
 	}
@@ -304,6 +308,7 @@ func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string
 	prompt := SubstituteVariables(fusionPrompt, &jc)
 
 	var lastErr error
+	var failed []*runner.ClaudeResult           // attempts that ran but failed: billed all the same
 	for attempt := 1; attempt <= 2; attempt++ { // initial run + one retry
 		// Wipe the previous attempt's root artifacts; the staged members/ subdirs
 		// are untouched (CleanReviewArtifacts only looks at the dir root).
@@ -319,21 +324,26 @@ func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string
 		cancel()
 		if err != nil {
 			lastErr = err
+			if result != nil {
+				failed = append(failed, result)
+			}
 			c.log.WarnContext(ctx, "judge run failed", "attempt", attempt, "err", err)
 			continue
 		}
 		draft, err := ReadReviewJSON(jc.Dir)
 		if err != nil {
 			lastErr = err
+			failed = append(failed, result)
 			c.log.WarnContext(ctx, "judge review.json invalid", "attempt", attempt, "err", err)
 			continue
 		}
 		if isReviewJSONUnfilled(draft) {
 			lastErr = errors.New("judge produced an empty review")
+			failed = append(failed, result)
 			c.log.WarnContext(ctx, "judge review empty, retrying", "attempt", attempt)
 			continue
 		}
-		c.applyRunResult(ctx, draft, &jc, rr, result)
+		c.applyRunResult(ctx, draft, &jc, rr, result, failed...)
 
 		mdFiles, err := FindMDFiles(jc.Dir)
 		if err != nil {
diff --git a/pkg/reviewer/ctl/prompt.go b/pkg/reviewer/ctl/prompt.go
index 196c343..89499c0 100644
--- a/pkg/reviewer/ctl/prompt.go
+++ b/pkg/reviewer/ctl/prompt.go
@@ -51,6 +51,7 @@ func NewPromptClient(log *slog.Logger) *PromptClient {
 // RunnerProfileParams mirrors the server's params payload.
 type RunnerProfileParams struct {
 	AllowDangerousPermissions bool `json:"allowDangerousPermissions"`
+	MaxRounds                 int  `json:"maxRounds"` // direct runner round budget; 0 = default
 }
 
 // ResolvedProfile is one resolved runner profile from the server (with its real
@@ -109,7 +110,7 @@ func newResolvedProfile(cfg *reviewctlclient.Config) *ResolvedProfile {
 		APIProvider:     cfg.ApiProvider,
 		APIBaseURL:      cfg.ApiBaseURL,
 		Token:           cfg.Token,
-		Params:          RunnerProfileParams{AllowDangerousPermissions: cfg.Params.AllowDangerousPermissions},
+		Params:          RunnerProfileParams(cfg.Params),
 	}
 }
 
diff --git a/pkg/reviewer/ctl/reviewctlclient/client.generated.go b/pkg/reviewer/ctl/reviewctlclient/client.generated.go
index f28f3ff..d110c17 100644
--- a/pkg/reviewer/ctl/reviewctlclient/client.generated.go
+++ b/pkg/reviewer/ctl/reviewctlclient/client.generated.go
@@ -64,6 +64,8 @@ type ReviewSetup struct {
 
 type RunnerProfileParams struct {
 	AllowDangerousPermissions bool `json:"allowDangerousPermissions"`
+	// direct runner round budget; 0 = default
+	MaxRounds int `json:"maxRounds"`
 }
 
 type TrackerConfig struct {
diff --git a/pkg/reviewer/ctl/skip_detect_test.go b/pkg/reviewer/ctl/skip_detect_test.go
index 26d2ff1..3010c90 100644
--- a/pkg/reviewer/ctl/skip_detect_test.go
+++ b/pkg/reviewer/ctl/skip_detect_test.go
@@ -125,7 +125,7 @@ func TestRetryStep2(t *testing.T) {
 		c := &Controller{
 			cfg:    &Config{Dir: t.TempDir()},
 			log:    slog.Default(),
-			runner: stub,
+			runner: trackSpend(stub),
 		}
 		draft, res := c.retryStep2(context.Background(), "")
 		assert.Nil(t, draft)
@@ -149,7 +149,7 @@ func TestRetryStep2(t *testing.T) {
 		c := &Controller{
 			cfg:    &Config{Dir: t.TempDir()},
 			log:    slog.Default(),
-			runner: stub,
+			runner: trackSpend(stub),
 		}
 		draft, res := c.retryStep2(context.Background(), "ses_123")
 		assert.Nil(t, draft)
@@ -173,7 +173,7 @@ func TestRetryStep2(t *testing.T) {
 		c := &Controller{
 			cfg:    &Config{Dir: dir},
 			log:    slog.Default(),
-			runner: stub,
+			runner: trackSpend(stub),
 		}
 		draft, res := c.retryStep2(context.Background(), "ses_abc")
 		require.NotNil(t, draft, "expected non-nil draft after successful retry")
diff --git a/pkg/reviewer/ctl/upload.go b/pkg/reviewer/ctl/upload.go
index bcc0c19..97be1c0 100644
--- a/pkg/reviewer/ctl/upload.go
+++ b/pkg/reviewer/ctl/upload.go
@@ -177,6 +177,9 @@ type DebugMeta struct {
 	SourceBranch string
 	TargetBranch string
 	CommitHash   string
+	Status       string  // reviewer.RunStatus*
+	Reason       string  // reviewer.RunReason*; empty for an ok run
+	CostUsd      float64 // what the run spent, including a failed run
 }
 
 // UploadDebugBundle posts artifacts as a multipart form with each file
@@ -236,6 +239,9 @@ func buildDebugMultipart(meta DebugMeta, files map[string][]byte) (io.Reader, st
 		{debug.FieldSourceBranch, meta.SourceBranch},
 		{debug.FieldTargetBranch, meta.TargetBranch},
 		{debug.FieldCommitHash, meta.CommitHash},
+		{debug.FieldStatus, meta.Status},
+		{debug.FieldReason, meta.Reason},
+		{debug.FieldCostUsd, formatCost(meta.CostUsd)},
 	}
 	for _, f := range fields {
 		if f.value == "" {
@@ -271,6 +277,14 @@ func buildDebugMultipart(meta DebugMeta, files map[string][]byte) (io.Reader, st
 	return &buf, mw.FormDataContentType(), nil
 }
 
+// formatCost renders a dollar cost for a form field; "" (field omitted) for zero.
+func formatCost(usd float64) string {
+	if usd <= 0 {
+		return ""
+	}
+	return strconv.FormatFloat(usd, 'f', -1, 64)
+}
+
 // reviewArtifactFiles are the fixed-name outputs a runner writes into the review
 // directory (the R*.md bodies are matched separately by FindMDFiles). The
 // canonical set lives in the reviewer package, shared with the direct runner's
diff --git a/pkg/reviewer/ctl/upload_test.go b/pkg/reviewer/ctl/upload_test.go
index a67e3ff..14d310e 100644
--- a/pkg/reviewer/ctl/upload_test.go
+++ b/pkg/reviewer/ctl/upload_test.go
@@ -173,6 +173,9 @@ func TestUploadDebugBundle(t *testing.T) {
 		Runner:   "claude",
 		Model:    "opus",
 		ErrorMsg: "validate review.json: invalid reviewType at files[2]: \"\"",
+		Status:   "failed",
+		Reason:   "other",
+		CostUsd:  1.81118025,
 	}, map[string][]byte{
 		"review.json":        []byte(`{"files":[]}`),
 		"claude-output.json": []byte(`{"type":"result"}`),
@@ -184,6 +187,9 @@ func TestUploadDebugBundle(t *testing.T) {
 	assert.Equal(t, "42", gotFields["mrIid"])
 	assert.Equal(t, "claude", gotFields["runner"])
 	assert.Contains(t, gotFields["errorMsg"], "files[2]")
+	assert.Equal(t, "failed", gotFields["status"])
+	assert.Equal(t, "other", gotFields["reason"])
+	assert.Equal(t, "1.81118025", gotFields["costUsd"])
 	assert.JSONEq(t, `{"files":[]}`, string(gotFiles["review.json"]))
 	assert.JSONEq(t, `{"type":"result"}`, string(gotFiles["claude-output.json"]))
 }
diff --git a/pkg/reviewer/direct/errors.go b/pkg/reviewer/direct/errors.go
new file mode 100644
index 0000000..d9b30ce
--- /dev/null
+++ b/pkg/reviewer/direct/errors.go
@@ -0,0 +1,105 @@
+package direct
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+
+	"reviewsrv/pkg/reviewer"
+
+	"github.com/anthropics/anthropic-sdk-go"
+	openai "github.com/sashabaranov/go-openai"
+)
+
+// providerReason maps a failed LLMProvider.Complete (after the provider's own
+// retries) to a reviewer.RunReason*.
+func providerReason(err error) string {
+	var ae *anthropic.Error
+	if errors.As(err, &ae) {
+		return anthropicReason(ae)
+	}
+	var oe *openai.APIError
+	if errors.As(err, &oe) {
+		return openaiReason(oe)
+	}
+	// Not an API error: a transport failure (reset stream, EOF, refused
+	// connection) that outlived the retries.
+	return reviewer.RunReasonAPIError
+}
+
+// anthropicReason classifies an Anthropic API error by its body type, falling
+// back to the HTTP status. Errors inside the SSE stream carry the stream's 200.
+func anthropicReason(e *anthropic.Error) string {
+	if isCreditBalanceError(e.RawJSON()) {
+		return reviewer.RunReasonBilling
+	}
+	switch e.Type() {
+	case anthropic.ErrorTypeBillingError:
+		return reviewer.RunReasonBilling
+	case anthropic.ErrorTypeAuthenticationError, anthropic.ErrorTypePermissionError:
+		return reviewer.RunReasonAuth
+	case anthropic.ErrorTypeRateLimitError:
+		return reviewer.RunReasonRateLimit
+	case anthropic.ErrorTypeOverloadedError, anthropic.ErrorTypeAPIError, anthropic.ErrorTypeTimeoutError:
+		return reviewer.RunReasonAPIError
+	case anthropic.ErrorTypeInvalidRequestError, anthropic.ErrorTypeNotFoundError:
+	}
+	return reviewer.ReasonForHTTPStatus(e.StatusCode)
+}
+
+// isCreditBalanceError catches an exhausted balance reported as a plain
+// invalid_request_error ("Your credit balance is too low ...").
+func isCreditBalanceError(body string) bool {
+	return strings.Contains(strings.ToLower(body), "credit balance")
+}
+
+// openaiReason classifies an OpenAI-protocol API error (OpenAI, DeepSeek, ...).
+func openaiReason(e *openai.APIError) string {
+	if e.Type == "insufficient_quota" || e.Code == "insufficient_quota" {
+		return reviewer.RunReasonBilling
+	}
+	return reviewer.ReasonForHTTPStatus(e.HTTPStatusCode)
+}
+
+// isOpenAITransient reports whether an OpenAI-protocol call is worth retrying:
+// a rate limit or server-side API error, or a network-level request error.
+// Billing (insufficient_quota also comes as a 429) and auth are definitive.
+func isOpenAITransient(err error) bool {
+	var apiErr *openai.APIError
+	if errors.As(err, &apiErr) {
+		r := openaiReason(apiErr)
+		return r == reviewer.RunReasonRateLimit || r == reviewer.RunReasonAPIError
+	}
+	var reqErr *openai.RequestError
+	return errors.As(err, &reqErr)
+}
+
+// isAnthropicTransient reports whether a failed Messages call is worth
+// retrying: anything but a definitive rejection (billing, auth, a bad request).
+// It covers what the SDK would retry on request open (408/409/429/5xx), an
+// error event inside the SSE stream (200 + api_error/overloaded_error) and a
+// reset HTTP/2 stream — a bare transport error, hence retry-by-default.
+func isAnthropicTransient(err error) bool {
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return false
+	}
+	var ae *anthropic.Error
+	if !errors.As(err, &ae) {
+		return true
+	}
+	switch ae.Type() {
+	case anthropic.ErrorTypeRateLimitError, anthropic.ErrorTypeOverloadedError,
+		anthropic.ErrorTypeAPIError, anthropic.ErrorTypeTimeoutError:
+		return !isCreditBalanceError(ae.RawJSON())
+	case anthropic.ErrorTypeInvalidRequestError, anthropic.ErrorTypeAuthenticationError, anthropic.ErrorTypePermissionError,
+		anthropic.ErrorTypeNotFoundError, anthropic.ErrorTypeBillingError:
+		return false
+	}
+	// Unrecognized body: decide by status (200 = an error event mid-stream).
+	switch ae.StatusCode {
+	case http.StatusOK, http.StatusRequestTimeout, http.StatusConflict, http.StatusTooManyRequests:
+		return true
+	}
+	return ae.StatusCode >= http.StatusInternalServerError
+}
diff --git a/pkg/reviewer/direct/loop.go b/pkg/reviewer/direct/loop.go
index 6635e62..f6a397d 100644
--- a/pkg/reviewer/direct/loop.go
+++ b/pkg/reviewer/direct/loop.go
@@ -7,15 +7,19 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"reviewsrv/pkg/reviewer"
 )
 
 // errMaxRounds is returned when the loop exhausts MaxRounds without a submit.
-var errMaxRounds = errors.New("direct: max rounds reached without submit_review")
+var errMaxRounds = reviewer.WithRunReason(reviewer.RunReasonMaxRounds,
+	errors.New("direct: max rounds reached without submit_review"))
 
 // errTruncatedRounds aborts the loop when several rounds in a row are cut by the
 // output-token cap — each such round burns the full max_tokens budget without
 // making progress, so grinding on to MaxRounds only wastes money.
-var errTruncatedRounds = errors.New("direct: consecutive rounds truncated by the output-token limit")
+var errTruncatedRounds = reviewer.WithRunReason(reviewer.RunReasonTruncated,
+	errors.New("direct: consecutive rounds truncated by the output-token limit"))
 
 // maxConsecutiveTruncated is how many truncated rounds in a row abort the run.
 const maxConsecutiveTruncated = 3
@@ -43,15 +47,45 @@ func IsTruncated(stopReason string) bool {
 	return stopReason == stopMaxTokens || stopReason == stopLength
 }
 
-// noteTruncated folds the truncation notice into the last tool result, so the
-// model learns its turn was cut without an extra user message (which would put
-// two consecutive user turns in the history — the Anthropic API rejects that).
-func noteTruncated(results []ToolResult) {
+// Round budget. At budgetWarnAt rounds left the model is told to start
+// delivering the review, at budgetFinalAt to deliver it now. Once MaxRounds is
+// spent, up to graceRounds more rounds run with only the review tools working:
+// a review that is mid-delivery still lands instead of being thrown away with
+// everything it cost.
+const (
+	budgetWarnAt  = 10
+	budgetFinalAt = 3
+	graceRounds   = 5
+)
+
+// budgetDenied is the tool error for a read/search call during the grace rounds.
+const budgetDenied = "round budget spent — only set_group, add_issues and submit_review work now; deliver the review from what you have"
+
+// budgetNotice returns the notice for the given number of rounds left, or "".
+func budgetNotice(left int) string {
+	switch left {
+	case budgetWarnAt:
+		return fmt.Sprintf("NOTE: %d rounds of your round budget are left. Wrap up exploring and start delivering the review: "+
+			"set_group for all five groups and add_issues, then submit_review.", left)
+	case budgetFinalAt:
+		return fmt.Sprintf("NOTE: only %d rounds are left. Stop exploring and deliver the review now with set_group, add_issues "+
+			"and submit_review, batching the calls in the same step.", left)
+	case 0:
+		return fmt.Sprintf("NOTE: the round budget is spent — read and search tools are disabled from now on. Deliver the review "+
+			"from what you have within %d steps: set_group for all five groups, add_issues, then submit_review.", graceRounds)
+	}
+	return ""
+}
+
+// appendNotice folds a harness notice into the last tool result, so the model
+// gets it without an extra user message (which would put two consecutive user
+// turns in the history — the Anthropic API rejects that).
+func appendNotice(results []ToolResult, notice string) {
 	if len(results) == 0 {
 		return
 	}
 	last := &results[len(results)-1]
-	last.Content = strings.TrimSpace(last.Content + "\n\n" + noticeTruncated)
+	last.Content = strings.TrimSpace(last.Content + "\n\n" + notice)
 }
 
 // Result is the outcome of a direct run, mapped to ClaudeResult by the ctl adapter.
@@ -67,7 +101,8 @@ type Result struct {
 
 // Run drives the agent loop: send system + history + tools to the provider, run
 // any requested tools, feed results back, and repeat until the model calls
-// submit_review (success), stops without tools (end_turn), or MaxRounds is hit.
+// submit_review (success), stops without tools (end_turn), or MaxRounds plus the
+// review-only grace rounds are spent.
 func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt string, opts Options) (*Result, error) {
 	if opts.MaxRounds <= 0 {
 		opts.MaxRounds = DefaultOptions().MaxRounds
@@ -93,15 +128,20 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 		return r
 	}
 
-	for round := range opts.MaxRounds {
+	limit := opts.MaxRounds + graceRounds
+	for round := range limit {
 		if err := ctx.Err(); err != nil {
 			return finish(round, "cancelled", reg.Submitted()), err
 		}
+		if round == opts.MaxRounds {
+			reg.restrict(budgetDenied, toolSetGroup, toolAddIssues, toolSubmitReview)
+		}
 		t0 := time.Now()
 		resp, err := p.Complete(ctx, Request{System: system, Messages: msgs, Tools: reg.Defs(), Effort: opts.Effort})
 		apiMs += int(time.Since(t0).Milliseconds())
+		emitRetries(opts.OnEvent, round, resp.Retries)
 		if err != nil {
-			return finish(round, "error", reg.Submitted()), fmt.Errorf("round %d: %w", round, err)
+			return finish(round, "error", reg.Submitted()), reviewer.WithRunReason(providerReason(err), fmt.Errorf("round %d: %w", round, err))
 		}
 		total = sumUsage(total, resp.Usage)
 		emitRound(opts.OnEvent, round, resp)
@@ -136,12 +176,7 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 			return finish(round+1, "end_turn", reg.Submitted()), nil
 		}
 
-		results := dispatchParallel(ctx, reg, resp.ToolCalls)
-		if truncated {
-			noteTruncated(results)
-		}
-		emitToolResults(opts.OnEvent, round, results)
-		msgs = append(msgs, Message{Role: RoleTool, ToolResults: results})
+		msgs = append(msgs, runTools(ctx, reg, opts, round, resp.ToolCalls, truncated))
 
 		if reg.Submitted() {
 			return finish(round+1, "submitted", true), nil
@@ -152,7 +187,40 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 		msgs = maybeCompact(msgs, opts, round)
 	}
 
-	return finish(opts.MaxRounds, "max_rounds", reg.Submitted()), errMaxRounds
+	return finish(limit, "max_rounds", reg.Submitted()), errMaxRounds
+}
+
+// runTools dispatches a round's tool calls and returns the tool message fed back
+// to the model, with any harness notices (truncation, round budget) folded into
+// its last result.
+func runTools(ctx context.Context, reg *Registry, opts Options, round int, calls []ToolCall, truncated bool) Message {
+	results := dispatchParallel(ctx, reg, calls)
+	if truncated {
+		appendNotice(results, noticeTruncated)
+	}
+	if !reg.Submitted() {
+		noteBudget(opts, round, results)
+	}
+	emitToolResults(opts.OnEvent, round, results)
+	return Message{Role: RoleTool, ToolResults: results}
+}
+
+// noteBudget folds the round-budget notice due after this round (if any) into
+// its tool results and records it in the transcript.
+func noteBudget(opts Options, round int, results []ToolResult) {
+	notice := budgetNotice(opts.MaxRounds - (round + 1))
+	if notice == "" {
+		return
+	}
+	appendNotice(results, notice)
+	opts.OnEvent.emit(Event{Round: round, Kind: "notice", Text: notice})
+}
+
+// emitRetries records the transient provider failures retried within a round.
+func emitRetries(s Sink, round int, retries []string) {
+	for _, r := range retries {
+		s.emit(Event{Round: round, Kind: "retry", Text: r})
+	}
 }
 
 // emitToolResults records each tool result in the transcript, clipped to keep
@@ -209,7 +277,7 @@ func makeResult(total Usage, rounds int, stop string, submitted bool, p LLMProvi
 		StopReason: stop,
 		Submitted:  submitted,
 		Model:      p.Model(),
-		CostUsd:    computeCost(total, p.Pricing()),
+		CostUsd:    p.Pricing().Cost(total),
 	}
 }
 
@@ -299,6 +367,13 @@ func compactMessages(msgs []Message, keepTail int) []Message {
 	out := make([]Message, 0, 1+(len(msgs)-cut))
 	out = append(out, msgs[0]) // keepHead == 1
 	out = append(out, msgs[cut:]...)
+	// Drop the provider-native snapshots of the kept assistant turns so they are
+	// rebuilt from Text+ToolCalls: their reasoning is bound to the pre-compaction
+	// history, and Anthropic rejects replayed thinking blocks whose prefix
+	// changed. Turns appended afterwards keep theirs.
+	for i := range out {
+		out[i].Raw = nil
+	}
 	// Place the marker inside the tail, keeping the head byte-identical: mutating
 	// the head changes the first bytes after system+tools and invalidates the
 	// provider prompt cache for the ENTIRE history, while the tail is re-written
diff --git a/pkg/reviewer/direct/loop_test.go b/pkg/reviewer/direct/loop_test.go
index 11c7e46..71e3c61 100644
--- a/pkg/reviewer/direct/loop_test.go
+++ b/pkg/reviewer/direct/loop_test.go
@@ -3,11 +3,15 @@ package direct
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
+	"strconv"
 	"testing"
 
+	"reviewsrv/pkg/reviewer"
+
 	"github.com/stretchr/testify/require"
 )
 
@@ -76,7 +80,7 @@ func TestRunSubmitsReview(t *testing.T) {
 	require.Equal(t, 30, res.Usage.OutputTokens)
 	require.Equal(t, 40, res.Usage.CacheReadTokens)
 	require.Equal(t, "fake-model", res.Model)
-	require.InEpsilon(t, computeCost(Usage{InputTokens: 150, OutputTokens: 30}, prov.Pricing()), res.CostUsd, 1e-9)
+	require.InEpsilon(t, prov.Pricing().Cost(Usage{InputTokens: 150, OutputTokens: 30}), res.CostUsd, 1e-9)
 
 	// review.json written and valid.
 	data, err := os.ReadFile(filepath.Join(dir, "review.json"))
@@ -195,6 +199,20 @@ func TestCompactMessages(t *testing.T) {
 	// The source history must not be mutated (its ToolResults backing is shared).
 	require.NotContains(t, src[36].ToolResults[0].Content, "compacted")
 
+	// Kept assistant turns lose their provider snapshot (signed thinking blocks
+	// bound to the pre-compaction history) and are rebuilt from neutral fields;
+	// the source history keeps it.
+	withRaw := mk(40)
+	for i := range withRaw {
+		if withRaw[i].Role == RoleAssistant {
+			withRaw[i].Raw = "snapshot"
+		}
+	}
+	for _, m := range compactMessages(withRaw, 5) {
+		require.Nil(t, m.Raw)
+	}
+	require.Equal(t, "snapshot", withRaw[39].Raw)
+
 	// Tail without tool results (text-only turns): fall back to the head marker.
 	textOnly := []Message{
 		{Role: RoleUser, Text: "task"},
@@ -250,18 +268,98 @@ func TestRunRespectsContextCancel(t *testing.T) {
 	require.Empty(t, prov.seen, "provider must not be called once ctx is cancelled")
 }
 
+// globRound is a round that only explores (one glob call).
+func globRound(id int) Response {
+	return Response{ToolCalls: []ToolCall{{ID: strconv.Itoa(id), Name: "glob", Args: json.RawMessage(`{"pattern":"**/*.go"}`)}}}
+}
+
+// lastToolResult returns the content of the last tool result the model was sent
+// in request i.
+func lastToolResult(t *testing.T, prov *scriptedProvider, i int) ToolResult {
+	t.Helper()
+	msgs := prov.seen[i].Messages
+	last := msgs[len(msgs)-1]
+	require.Equal(t, RoleTool, last.Role)
+	return last.ToolResults[len(last.ToolResults)-1]
+}
+
 func TestRunMaxRoundsWithoutSubmit(t *testing.T) {
 	dir := t.TempDir()
 	reg := NewReviewRegistry(ReviewToolsConfig{Dir: dir})
-	prov := &scriptedProvider{responses: []Response{
-		{ToolCalls: []ToolCall{{ID: "1", Name: "glob", Args: json.RawMessage(`{"pattern":"**/*.go"}`)}}},
-		{ToolCalls: []ToolCall{{ID: "2", Name: "glob", Args: json.RawMessage(`{"pattern":"**/*.go"}`)}}},
-	}}
+	prov := &scriptedProvider{}
+	for i := range 2 + graceRounds { // the model keeps exploring through the grace rounds
+		prov.responses = append(prov.responses, globRound(i))
+	}
 
 	res, err := Run(context.Background(), prov, reg, "system", "review this", Options{MaxRounds: 2})
 	require.ErrorIs(t, err, errMaxRounds)
+	_, reason := reviewer.RunOutcome(err)
+	require.Equal(t, reviewer.RunReasonMaxRounds, reason)
 	require.False(t, res.Submitted)
 	require.Equal(t, "max_rounds", res.StopReason)
+	require.Equal(t, 2+graceRounds, res.Rounds)
+	// Past MaxRounds, read tools are denied instead of served.
+	denied := lastToolResult(t, prov, 3)
+	require.True(t, denied.IsError)
+	require.Contains(t, denied.Content, budgetDenied)
+}
+
+func TestRunBudgetNoticesAndGraceDelivery(t *testing.T) {
+	const maxRounds = 12
+	dir := t.TempDir()
+	reg := NewReviewRegistry(ReviewToolsConfig{Dir: dir})
+	prov := &scriptedProvider{}
+	for i := range maxRounds {
+		prov.responses = append(prov.responses, globRound(i))
+	}
+	// The review is delivered in the grace rounds, after one denied read.
+	prov.responses = append(prov.responses,
+		globRound(100),
+		Response{ToolCalls: []ToolCall{{ID: "s", Name: toolSubmitReview, Args: validSubmitArgs(t, "high")}}},
+	)
+
+	var notices []Event
+	opts := Options{MaxRounds: maxRounds, OnEvent: func(ev Event) {
+		if ev.Kind == "notice" {
+			notices = append(notices, ev)
+		}
+	}}
+	res, err := Run(context.Background(), prov, reg, "system", "review this", opts)
+	require.NoError(t, err)
+	require.True(t, res.Submitted)
+	require.Equal(t, maxRounds+2, res.Rounds)
+
+	// Notices ride on the last tool result of the round that leaves 10, 3 and 0
+	// rounds — never as an extra user message.
+	require.Len(t, notices, 3)
+	require.Equal(t, []int{maxRounds - budgetWarnAt - 1, maxRounds - budgetFinalAt - 1, maxRounds - 1},
+		[]int{notices[0].Round, notices[1].Round, notices[2].Round})
+	require.Contains(t, lastToolResult(t, prov, maxRounds-budgetWarnAt).Content, "10 rounds of your round budget are left")
+	require.Contains(t, lastToolResult(t, prov, maxRounds-budgetFinalAt).Content, "only 3 rounds are left")
+	require.Contains(t, lastToolResult(t, prov, maxRounds).Content, "read and search tools are disabled")
+
+	denied := lastToolResult(t, prov, maxRounds+1)
+	require.True(t, denied.IsError)
+	require.Contains(t, denied.Content, budgetDenied)
+}
+
+// failingProvider fails every call with err.
+type failingProvider struct{ err error }
+
+func (f failingProvider) Complete(context.Context, Request) (Response, error) {
+	return Response{}, f.err
+}
+func (failingProvider) Model() string    { return "fake-model" }
+func (failingProvider) Pricing() Pricing { return Pricing{} }
+
+func TestRunProviderTransportErrorReason(t *testing.T) {
+	reg := NewReviewRegistry(ReviewToolsConfig{Dir: t.TempDir()})
+	res, err := Run(context.Background(), failingProvider{errors.New("anthropic: stream error: stream ID 41; INTERNAL_ERROR")}, reg, "s", "go", Options{MaxRounds: 5})
+	require.Error(t, err)
+	require.Equal(t, "error", res.StopReason)
+	require.Equal(t, "round 0: anthropic: stream error: stream ID 41; INTERNAL_ERROR", err.Error())
+	_, reason := reviewer.RunOutcome(err)
+	require.Equal(t, reviewer.RunReasonAPIError, reason)
 }
 
 func TestDispatchParallelRecoversPanic(t *testing.T) {
diff --git a/pkg/reviewer/direct/options.go b/pkg/reviewer/direct/options.go
index 34eb446..faba178 100644
--- a/pkg/reviewer/direct/options.go
+++ b/pkg/reviewer/direct/options.go
@@ -2,15 +2,17 @@ package direct
 
 // Options tunes the agent loop.
 type Options struct {
-	// MaxRounds caps how many provider round-trips the loop may make before
-	// giving up — a backstop against a model that never calls submit_review.
+	// MaxRounds caps the provider round-trips with the full tool set — a
+	// backstop against a model that never calls submit_review. The model is
+	// warned as it nears the cap, and up to graceRounds more review-tools-only
+	// rounds follow it so a review mid-delivery still lands.
 	MaxRounds int
 	// CompactAt is the estimated-token threshold above which the middle of the
 	// conversation is pruned. Zero disables compaction.
 	CompactAt int
 	// KeepTail is how many trailing messages compaction preserves verbatim.
 	KeepTail int
-	// Effort is passed to providers that support it (Anthropic output_config.effort).
+	// Effort is the reasoning effort passed to the provider (see Request.Effort).
 	Effort string
 	// OnEvent, if set, receives a transcript event per assistant turn, tool call,
 	// tool result, round and final result. Used to persist the session for later
@@ -18,9 +20,19 @@ type Options struct {
 	OnEvent Sink
 }
 
+// Bounds for a configured MaxRounds: below the minimum a review cannot finish,
+// above the maximum the backstop no longer protects the budget.
+const (
+	MinMaxRounds = 10
+	MaxMaxRounds = 500
+)
+
+// IsValidMaxRounds reports whether n is an acceptable MaxRounds override.
+func IsValidMaxRounds(n int) bool { return n >= MinMaxRounds && n <= MaxMaxRounds }
+
 // DefaultOptions returns sensible loop defaults for a review run. The CompactAt
-// default is sized for ~128k-context models (DeepSeek); large-context providers
-// should raise it via Options.CompactAt — see CompactAtLargeContext.
+// default is conservative (sized for ~128k-context backends); large-context
+// providers should raise it via Options.CompactAt — see CompactAtLargeContext.
 func DefaultOptions() Options {
 	return Options{MaxRounds: 60, CompactAt: 150_000, KeepTail: 12}
 }
diff --git a/pkg/reviewer/direct/preload_test.go b/pkg/reviewer/direct/preload_test.go
index 9630179..1531846 100644
--- a/pkg/reviewer/direct/preload_test.go
+++ b/pkg/reviewer/direct/preload_test.go
@@ -3,6 +3,8 @@ package direct
 import (
 	"context"
 	"os/exec"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -137,3 +139,90 @@ func TestDetectBaseRef(t *testing.T) {
 	gitExec(t, dir, "symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/trunk")
 	require.Equal(t, "origin/trunk", DetectBaseRef(context.Background(), dir))
 }
+
+// ciClone builds the checkout a GitLab MR pipeline sees: an upstream with a
+// "main" integration branch and a "feature-x" MR branch, cloned and detached at
+// the MR commit — remote-tracking refs only, no local branch names.
+func ciClone(t *testing.T) (clone, baseSHA string) {
+	t.Helper()
+	up := t.TempDir()
+	gitExec(t, up, "init", "-q", "-b", "main")
+	gitExec(t, up, "config", "user.email", "t@t")
+	gitExec(t, up, "config", "user.name", "t")
+	write(t, up, "a.go", "package a\n")
+	gitExec(t, up, "add", ".")
+	gitExec(t, up, "commit", "-q", "-m", "init")
+	baseSHA = strings.TrimSpace(gitOut(t, up, "rev-parse", "HEAD"))
+	gitExec(t, up, "checkout", "-q", "-b", "feature-x")
+	write(t, up, "a.go", "package a\n// changed in the MR\n")
+	gitExec(t, up, "commit", "-q", "-am", "change")
+
+	clone = filepath.Join(t.TempDir(), "clone")
+	gitExec(t, up, "clone", "-q", "--no-local", up, clone)
+	gitExec(t, clone, "checkout", "-q", "--detach", "origin/feature-x")
+	gitExec(t, clone, "branch", "-q", "-D", "feature-x")
+	return clone, baseSHA
+}
+
+func gitOut(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	out, err := exec.CommandContext(t.Context(), "git", append([]string{"-C", dir}, args...)...).Output()
+	require.NoError(t, err)
+	return string(out)
+}
+
+func TestResolveDiffRangeInCIClone(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	ctx := context.Background()
+	clone, baseSHA := ciClone(t)
+
+	// The bare branch names don't resolve in the clone — the preload was empty.
+	pc, _ := PreloadContext(ctx, clone, "main", "feature-x")
+	require.Empty(t, pc)
+
+	base, head := ResolveDiffRange(ctx, clone, "", "main", "feature-x")
+	require.Equal(t, "origin/main", base)
+	require.Equal(t, "HEAD", head)
+	pc, preloaded := PreloadContext(ctx, clone, base, head)
+	require.Contains(t, pc, "// changed in the MR")
+	require.Equal(t, []string{"a.go"}, preloaded)
+
+	// The MR diff base SHA wins when it is in the checkout.
+	base, head = ResolveDiffRange(ctx, clone, baseSHA, "main", "feature-x")
+	require.Equal(t, baseSHA, base)
+	require.Equal(t, "HEAD", head)
+
+	// An unknown base SHA (cut off by a shallow clone) falls through.
+	base, _ = ResolveDiffRange(ctx, clone, strings.Repeat("a", 40), "main", "feature-x")
+	require.Equal(t, "origin/main", base)
+}
+
+func TestResolveDiffRangeLocal(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	ctx := context.Background()
+	dir := t.TempDir()
+	gitExec(t, dir, "init", "-q", "-b", "main")
+	gitExec(t, dir, "config", "user.email", "t@t")
+	gitExec(t, dir, "config", "user.name", "t")
+	gitExec(t, dir, "commit", "-q", "--allow-empty", "-m", "init")
+	gitExec(t, dir, "checkout", "-q", "-b", "feature-x")
+
+	// Local branch names resolve as given.
+	base, head := ResolveDiffRange(ctx, dir, "", "main", "feature-x")
+	require.Equal(t, "main", base)
+	require.Equal(t, "feature-x", head)
+
+	// No CI metadata: nothing to resolve, head stays empty (working-tree mode).
+	base, head = ResolveDiffRange(ctx, dir, "", "", "")
+	require.Empty(t, base)
+	require.Empty(t, head)
+
+	// Option-like names are never passed to git.
+	base, head = ResolveDiffRange(ctx, dir, "", "--output=/tmp/x", "--exec=x")
+	require.Empty(t, base)
+	require.Equal(t, "HEAD", head)
+}
diff --git a/pkg/reviewer/direct/provider.go b/pkg/reviewer/direct/provider.go
index 46e5842..966be99 100644
--- a/pkg/reviewer/direct/provider.go
+++ b/pkg/reviewer/direct/provider.go
@@ -12,8 +12,8 @@ type LLMProvider interface {
 	Pricing() Pricing
 }
 
-// Pricing is the per-million-token cost table for one model. DeepSeek values come
-// from config; Claude values are the published rates (see the spec).
+// Pricing is the per-million-token cost table for one model (published rates, see
+// PricingFor).
 type Pricing struct {
 	InputPerMTok      float64
 	OutputPerMTok     float64
@@ -21,8 +21,8 @@ type Pricing struct {
 	CacheWritePerMTok float64
 }
 
-// computeCost returns the USD cost of u under pricing p.
-func computeCost(u Usage, p Pricing) float64 {
+// Cost returns the USD cost of u under pricing p.
+func (p Pricing) Cost(u Usage) float64 {
 	const m = 1_000_000.0
 	return float64(u.InputTokens)/m*p.InputPerMTok +
 		float64(u.OutputTokens)/m*p.OutputPerMTok +
diff --git a/pkg/reviewer/direct/provider_anthropic.go b/pkg/reviewer/direct/provider_anthropic.go
index bd0accb..2a33dab 100644
--- a/pkg/reviewer/direct/provider_anthropic.go
+++ b/pkg/reviewer/direct/provider_anthropic.go
@@ -47,7 +47,9 @@ func NewAnthropicProvider(cfg AnthropicConfig) (LLMProvider, error) {
 	if cfg.Model == "" {
 		return nil, errors.New("anthropic provider: model is required")
 	}
-	opts := []option.RequestOption{option.WithAPIKey(cfg.APIKey)}
+	// withRetry is the only retry layer: the SDK's own retries would stack on
+	// it (up to 12 attempts, each re-sending the whole history).
+	opts := []option.RequestOption{option.WithAPIKey(cfg.APIKey), option.WithMaxRetries(0)}
 	if cfg.BaseURL != "" {
 		opts = append(opts, option.WithBaseURL(cfg.BaseURL))
 	}
@@ -67,7 +69,21 @@ func NewAnthropicProvider(cfg AnthropicConfig) (LLMProvider, error) {
 func (p *anthropicProvider) Model() string    { return p.model }
 func (p *anthropicProvider) Pricing() Pricing { return p.pricing }
 
+// Complete sends one round, retrying transient failures with the same request —
+// a dropped stream mid-review must not throw away the whole run.
 func (p *anthropicProvider) Complete(ctx context.Context, req Request) (Response, error) {
+	params := p.params(req)
+	out, retried, err := withRetry(ctx, anthropicRetry, func() (Response, error) {
+		return p.stream(ctx, params)
+	})
+	if err != nil {
+		return Response{}, err
+	}
+	out.Retries = retried
+	return out, nil
+}
+
+func (p *anthropicProvider) params(req Request) anthropic.MessageNewParams {
 	params := anthropic.MessageNewParams{
 		Model:     p.model,
 		MaxTokens: p.maxTokens,
@@ -88,21 +104,24 @@ func (p *anthropicProvider) Complete(ctx context.Context, req Request) (Response
 	if eff := cmp.Or(req.Effort, p.effort); eff != "" {
 		params.OutputConfig = anthropic.OutputConfigParam{Effort: anthropic.OutputConfigEffort(eff)}
 	}
+	return params
+}
 
-	// Stream the response and accumulate it into a complete message. Streaming
-	// avoids the non-streaming request timeout on heavy rounds (high effort +
-	// adaptive thinking), where a single round can take a minute or more of
-	// output — a non-streamed POST would risk an HTTP read timeout.
+// stream makes one streamed Messages call and converts the accumulated message.
+// Streaming avoids the non-streaming request timeout on heavy rounds (high
+// effort + adaptive thinking), where a single round can take a minute or more
+// of output — a non-streamed POST would risk an HTTP read timeout.
+func (p *anthropicProvider) stream(ctx context.Context, params anthropic.MessageNewParams) (Response, error) {
 	stream := p.client.Messages.NewStreaming(ctx, params)
 	defer stream.Close()
 	var resp anthropic.Message
 	for stream.Next() {
 		if err := resp.Accumulate(stream.Current()); err != nil {
-			return Response{}, fmt.Errorf("anthropic: accumulate: %w", err)
+			return Response{}, fmt.Errorf("accumulate: %w", err)
 		}
 	}
 	if err := stream.Err(); err != nil {
-		return Response{}, fmt.Errorf("anthropic: %w", err)
+		return Response{}, err
 	}
 
 	out := Response{StopReason: string(resp.StopReason)}
diff --git a/pkg/reviewer/direct/provider_anthropic_test.go b/pkg/reviewer/direct/provider_anthropic_test.go
index f362674..0e3fc60 100644
--- a/pkg/reviewer/direct/provider_anthropic_test.go
+++ b/pkg/reviewer/direct/provider_anthropic_test.go
@@ -1,7 +1,18 @@
 package direct
 
 import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
+
+	"reviewsrv/pkg/reviewer"
 
 	"github.com/anthropics/anthropic-sdk-go"
 	"github.com/stretchr/testify/require"
@@ -28,3 +39,122 @@ func TestToAnthropicMessagesRebuildsWithoutRaw(t *testing.T) {
 	require.Len(t, out, 1)
 	require.Equal(t, anthropic.MessageParamRoleAssistant, out[0].Role)
 }
+
+// sseOK is a minimal successful Messages stream answering "hi".
+const sseOK = `event: message_start
+data: {"type":"message_start","message":{"id":"msg_1","type":"message","role":"assistant","model":"m","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":10,"output_tokens":1}}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"hi"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"end_turn","stop_sequence":null},"usage":{"output_tokens":5}}
+
+event: message_stop
+data: {"type":"message_stop"}
+
+`
+
+// sseAPIError is the 200 OK + in-stream error seen in CI.
+const sseAPIError = `event: error
+data: {"type":"error","error":{"details":null,"type":"api_error","message":"Internal server error"}}
+
+`
+
+// anthropicStub serves the scripted responses in order, one per request.
+func anthropicStub(t *testing.T, responses ...func(w http.ResponseWriter)) (LLMProvider, *atomic.Int32) {
+	t.Helper()
+	prev := anthropicRetry.backoff
+	anthropicRetry.backoff = time.Millisecond
+	t.Cleanup(func() { anthropicRetry.backoff = prev })
+
+	var calls atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		i := int(calls.Add(1)) - 1
+		if i >= len(responses) {
+			t.Errorf("unexpected extra request #%d", i+1)
+			w.WriteHeader(http.StatusTeapot)
+			return
+		}
+		responses[i](w)
+	}))
+	t.Cleanup(srv.Close)
+
+	p, err := NewAnthropicProvider(AnthropicConfig{APIKey: "k", BaseURL: srv.URL, Model: "m"})
+	require.NoError(t, err)
+	return p, &calls
+}
+
+func sse(body string) func(w http.ResponseWriter) {
+	return func(w http.ResponseWriter) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, body)
+	}
+}
+
+// jsonError answers with an API error. The SDK's own retries are off, so every
+// request the stub counts is one attempt of the provider's retry loop.
+func jsonError(status int, body string) func(w http.ResponseWriter) {
+	return func(w http.ResponseWriter) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(status)
+		_, _ = io.WriteString(w, body)
+	}
+}
+
+// dropStream starts a stream and kills the connection mid-way, like the reset
+// HTTP/2 stream seen in CI.
+func dropStream(w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "text/event-stream")
+	_, _ = io.WriteString(w, strings.SplitAfter(sseOK, "\n\n")[0])
+	w.(http.Flusher).Flush()
+	panic(http.ErrAbortHandler)
+}
+
+func TestAnthropicCompleteRetriesTransientFailures(t *testing.T) {
+	p, calls := anthropicStub(t,
+		sse(sseAPIError),
+		jsonError(http.StatusInternalServerError, `{"type":"error","error":{"type":"api_error","message":"Internal server error"}}`),
+		dropStream,
+		sse(sseOK),
+	)
+
+	resp, err := p.Complete(t.Context(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.NoError(t, err)
+	require.Equal(t, "hi", resp.Text)
+	require.Equal(t, int32(4), calls.Load())
+	require.Len(t, resp.Retries, 3, "each retried failure is kept for the transcript")
+	require.Contains(t, resp.Retries[0], "api_error")
+}
+
+func TestAnthropicCompleteGivesUpAfterRetryBudget(t *testing.T) {
+	p, calls := anthropicStub(t, sse(sseAPIError), sse(sseAPIError), sse(sseAPIError), sse(sseAPIError))
+
+	_, err := p.Complete(t.Context(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.Error(t, err)
+	require.Equal(t, int32(maxRetries+1), calls.Load())
+	require.Equal(t, reviewer.RunReasonAPIError, providerReason(err))
+}
+
+func TestAnthropicCompleteFailsFastOnBilling(t *testing.T) {
+	p, calls := anthropicStub(t,
+		jsonError(http.StatusBadRequest, `{"type":"error","error":{"type":"invalid_request_error","message":"Your credit balance is too low to access the Anthropic API."}}`),
+	)
+
+	_, err := p.Complete(t.Context(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.Error(t, err)
+	require.Equal(t, int32(1), calls.Load(), "billing must not be retried")
+	require.Equal(t, reviewer.RunReasonBilling, providerReason(err))
+}
+
+func TestIsAnthropicTransient(t *testing.T) {
+	require.True(t, isAnthropicTransient(errors.New("stream error: stream ID 41; INTERNAL_ERROR; received from peer")))
+	require.False(t, isAnthropicTransient(context.Canceled))
+	require.False(t, isAnthropicTransient(fmt.Errorf("post: %w", context.DeadlineExceeded)))
+}
diff --git a/pkg/reviewer/direct/provider_factory.go b/pkg/reviewer/direct/provider_factory.go
index 03c85b6..e789809 100644
--- a/pkg/reviewer/direct/provider_factory.go
+++ b/pkg/reviewer/direct/provider_factory.go
@@ -1,8 +1,11 @@
 package direct
 
 import (
+	"cmp"
 	"fmt"
+	"net/url"
 	"strings"
+	"time"
 )
 
 // Provider ids accepted by NewProvider for the direct runner. ProviderDeepSeek
@@ -36,8 +39,8 @@ func IsValidProvider(name string) bool {
 // DefaultCompactAt returns the history-compaction threshold suited to a
 // provider's context window. Anthropic's 1M-token models defer compaction
 // nearly to the end of a review — compacting mid-run rewrites the whole prompt
-// cache; the 128k-class OpenAI-compatible backends keep the Options default
-// (returned 0 means "use DefaultOptions"). Lives next to NewProvider so
+// cache; other providers keep the conservative Options default (returned 0 means
+// "use DefaultOptions"). Lives next to NewProvider so
 // provider-capability knowledge stays in one place.
 func DefaultCompactAt(provider string) int {
 	if strings.EqualFold(provider, ProviderAnthropic) {
@@ -48,30 +51,38 @@ func DefaultCompactAt(provider string) int {
 
 // ProviderConfig selects and configures an LLM backend.
 type ProviderConfig struct {
-	Provider    string // "deepseek" (default) | "openai" | "anthropic"
+	Provider    string // "deepseek" (default) | "openai" | "openai-compat" | "anthropic"
 	Model       string
 	BaseURL     string
 	APIKey      string
 	Temperature float32
-	Pricing     Pricing // optional override; falls back to pricingFor(Model)
+	Pricing     Pricing // optional override; falls back to PricingFor(Model, now)
 }
 
-// NewProvider builds an LLMProvider from cfg. The native Anthropic provider is
-// added in M1; until then "anthropic" returns an error.
+// NewProvider builds an LLMProvider from cfg.
 func NewProvider(cfg ProviderConfig) (LLMProvider, error) {
 	pricing := cfg.Pricing
 	if pricing == (Pricing{}) {
-		pricing = pricingFor(cfg.Model)
+		// Priced at run start: DeepSeek's peak/off-peak rate is picked once, so a
+		// run straddling a window boundary is billed at its starting rate.
+		pricing = PricingFor(cfg.Model, time.Now())
 	}
-	switch strings.ToLower(cfg.Provider) {
+	oc := OpenAIConfig{APIKey: cfg.APIKey, BaseURL: cfg.BaseURL, Model: cfg.Model, Pricing: pricing, Temperature: cfg.Temperature}
+	provider := strings.ToLower(cfg.Provider)
+	switch provider {
 	case "", ProviderDeepSeek:
-		base := cfg.BaseURL
-		if base == "" {
-			base = "https://api.deepseek.com"
-		}
-		return NewOpenAIProvider(OpenAIConfig{APIKey: cfg.APIKey, BaseURL: base, Model: cfg.Model, Pricing: pricing, Temperature: cfg.Temperature})
+		oc.BaseURL = cmp.Or(oc.BaseURL, "https://api.deepseek.com")
+		oc.MaxTokens, oc.PassEffort = deepseekMaxTokens, true
+		return NewOpenAIProvider(oc)
 	case ProviderOpenAI, ProviderOpenAICompat:
-		return NewOpenAIProvider(OpenAIConfig{APIKey: cfg.APIKey, BaseURL: cfg.BaseURL, Model: cfg.Model, Pricing: pricing, Temperature: cfg.Temperature})
+		// OpenAI itself goes through the Responses API: GPT-6 tool use with
+		// reasoning needs it, and chat completions rejects max_tokens on gpt-5+.
+		// A custom base URL (Azure, LiteLLM and other proxies) may only speak
+		// chat completions, so it keeps that protocol, like openai-compat.
+		if provider == ProviderOpenAI && isOpenAIEndpoint(cfg.BaseURL) {
+			return NewResponsesProvider(oc)
+		}
+		return NewOpenAIProvider(oc)
 	case ProviderAnthropic:
 		// effort flows through Request.Effort (from DirectRunner.Effort).
 		return NewAnthropicProvider(AnthropicConfig{APIKey: cfg.APIKey, BaseURL: cfg.BaseURL, Model: cfg.Model, Pricing: pricing})
@@ -80,31 +91,103 @@ func NewProvider(cfg ProviderConfig) (LLMProvider, error) {
 	}
 }
 
-// pricingFor returns published Claude per-MTok pricing for known model families,
-// or a zero table (cost reported as 0) for anything else, e.g. DeepSeek — set
-// ProviderConfig.Pricing to override.
-func pricingFor(model string) Pricing {
+// isOpenAIEndpoint reports whether baseURL is OpenAI's own API (the default when
+// empty) rather than a proxy that may not implement the Responses API.
+func isOpenAIEndpoint(baseURL string) bool {
+	if baseURL == "" {
+		return true
+	}
+	u, err := url.Parse(baseURL)
+	return err == nil && strings.EqualFold(u.Hostname(), "api.openai.com")
+}
+
+// deepseekMaxTokens is the DeepSeek per-response output cap. Thinking tokens
+// count against max_tokens, and the API's own defaults are 64K in thinking mode
+// and 128K at reasoning_effort "max" — the shared 8K default would cut reasoning.
+const deepseekMaxTokens = 128 * 1024
+
+// openAIPricing lists OpenAI standard-tier rates (USD/MTok, as of 2026-09) by
+// exact model id — a prefix match would price gpt-5.5-pro as gpt-5.5. Models
+// without a cache-write charge bill written tokens as plain input. The
+// long-context surcharge (requests over 272K input tokens) is not modelled.
+var openAIPricing = map[string]Pricing{
+	"gpt-6-astra":   {InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 1, CacheWritePerMTok: 12.5},
+	"gpt-6-sol":     {InputPerMTok: 2, OutputPerMTok: 10, CacheReadPerMTok: 0.2, CacheWritePerMTok: 2.5},
+	"gpt-6-luna":    {InputPerMTok: 0.1, OutputPerMTok: 0.5, CacheReadPerMTok: 0.01, CacheWritePerMTok: 0.125},
+	"gpt-5.6":       {InputPerMTok: 4, OutputPerMTok: 20, CacheReadPerMTok: 0.4, CacheWritePerMTok: 5}, // bare alias routes to Sol
+	"gpt-5.6-sol":   {InputPerMTok: 4, OutputPerMTok: 20, CacheReadPerMTok: 0.4, CacheWritePerMTok: 5}, // promotional, through at least 2026-11-21
+	"gpt-5.6-terra": {InputPerMTok: 2, OutputPerMTok: 12, CacheReadPerMTok: 0.2, CacheWritePerMTok: 2.5},
+	"gpt-5.6-luna":  {InputPerMTok: 0.2, OutputPerMTok: 1.2, CacheReadPerMTok: 0.02, CacheWritePerMTok: 0.25},
+	"gpt-5.5":       {InputPerMTok: 5, OutputPerMTok: 30, CacheReadPerMTok: 0.5, CacheWritePerMTok: 5},
+	"gpt-5.5-pro":   {InputPerMTok: 30, OutputPerMTok: 180, CacheReadPerMTok: 30, CacheWritePerMTok: 30},
+	"gpt-5.4":       {InputPerMTok: 2.5, OutputPerMTok: 15, CacheReadPerMTok: 0.25, CacheWritePerMTok: 2.5},
+	"gpt-5.4-mini":  {InputPerMTok: 0.75, OutputPerMTok: 4.5, CacheReadPerMTok: 0.075, CacheWritePerMTok: 0.75},
+	"gpt-5.4-nano":  {InputPerMTok: 0.2, OutputPerMTok: 1.25, CacheReadPerMTok: 0.02, CacheWritePerMTok: 0.2},
+	"gpt-5.4-pro":   {InputPerMTok: 30, OutputPerMTok: 180, CacheReadPerMTok: 30, CacheWritePerMTok: 30},
+	"gpt-5.3-codex": {InputPerMTok: 1.75, OutputPerMTok: 14, CacheReadPerMTok: 0.175, CacheWritePerMTok: 1.75},
+}
+
+// PricingFor returns published per-MTok pricing (as of 2026-09) for known
+// Claude, OpenAI and DeepSeek models at time at, or a zero table (cost reported
+// as 0) for anything else — set ProviderConfig.Pricing to override. It is also
+// the price table the codex runner estimates its cost from. More specific
+// prefixes must precede their family (claude-opus-5-5 before claude-opus).
+func PricingFor(model string, at time.Time) Pricing {
+	if p, ok := openAIPricing[model]; ok {
+		return p
+	}
 	switch {
+	case strings.HasPrefix(model, "claude-fable-5-1"):
+		// Fable 5 rates except cache reads, which drop to 0.025x input.
+		return Pricing{InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 0.25, CacheWritePerMTok: 12.5}
 	case strings.HasPrefix(model, "claude-fable"):
 		return Pricing{InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 1, CacheWritePerMTok: 12.5}
+	case strings.HasPrefix(model, "claude-opus-5-5"):
+		// Cheaper than Opus 5, with cache reads at 0.05x input.
+		return Pricing{InputPerMTok: 4, OutputPerMTok: 20, CacheReadPerMTok: 0.2, CacheWritePerMTok: 5}
 	case strings.HasPrefix(model, "claude-opus"):
 		return Pricing{InputPerMTok: 5, OutputPerMTok: 25, CacheReadPerMTok: 0.5, CacheWritePerMTok: 6.25}
+	case strings.HasPrefix(model, "claude-sonnet-5"):
+		return Pricing{InputPerMTok: 2, OutputPerMTok: 10, CacheReadPerMTok: 0.2, CacheWritePerMTok: 2.5}
 	case strings.HasPrefix(model, "claude-sonnet"):
 		return Pricing{InputPerMTok: 3, OutputPerMTok: 15, CacheReadPerMTok: 0.3, CacheWritePerMTok: 3.75}
 	case strings.HasPrefix(model, "claude-haiku"):
 		return Pricing{InputPerMTok: 1, OutputPerMTok: 5, CacheReadPerMTok: 0.1, CacheWritePerMTok: 1.25}
 	case strings.HasPrefix(model, "deepseek-v4-pro"):
-		// V4 Pro current (permanently-discounted) rates, USD/MTok. Cache hits are
-		// billed at CacheRead; DeepSeek has no separate cache-write charge (a miss
-		// is just the input price).
-		return Pricing{InputPerMTok: 0.435, OutputPerMTok: 0.87, CacheReadPerMTok: 0.003625, CacheWritePerMTok: 0.435}
-	case strings.HasPrefix(model, "deepseek-v4-flash"):
-		// V4 Flash rates (also the deepseek-chat/reasoner compatibility aliases).
-		return Pricing{InputPerMTok: 0.14, OutputPerMTok: 0.28, CacheReadPerMTok: 0.0028, CacheWritePerMTok: 0.14}
+		// Peak rates, USD/MTok. Cache hits are billed at CacheRead; DeepSeek has
+		// no separate cache-write charge (a miss is just the input price).
+		return deepseekPricing(Pricing{InputPerMTok: 1.32, OutputPerMTok: 3.96, CacheReadPerMTok: 0.044, CacheWritePerMTok: 1.32}, at)
 	case strings.HasPrefix(model, ProviderDeepSeek):
-		// Legacy deepseek-chat/reasoner alias to V4 Flash (deprecating 2026-07-24).
-		return Pricing{InputPerMTok: 0.14, OutputPerMTok: 0.28, CacheReadPerMTok: 0.0028, CacheWritePerMTok: 0.14}
+		// deepseek-flash (V4.1 Flash) peak rates; the retired deepseek-v4-flash
+		// and deepseek-chat/reasoner names are served and billed as Flash.
+		return deepseekPricing(Pricing{InputPerMTok: 0.3, OutputPerMTok: 1.2, CacheReadPerMTok: 0.006, CacheWritePerMTok: 0.3}, at)
 	default:
 		return Pricing{}
 	}
 }
+
+// deepseekPricing returns the peak table during DeepSeek's peak window and half
+// of it otherwise.
+func deepseekPricing(peak Pricing, at time.Time) Pricing {
+	if deepseekPeak(at) {
+		return peak
+	}
+	return Pricing{
+		InputPerMTok:      peak.InputPerMTok / 2,
+		OutputPerMTok:     peak.OutputPerMTok / 2,
+		CacheReadPerMTok:  peak.CacheReadPerMTok / 2,
+		CacheWritePerMTok: peak.CacheWritePerMTok / 2,
+	}
+}
+
+// deepseekPeak reports whether t is in DeepSeek's peak billing window: 01:00–04:00
+// and 06:00–10:00 UTC, Monday to Friday. Chinese public holidays are off-peak
+// too but not modelled, so runs on those days are over-estimated.
+func deepseekPeak(t time.Time) bool {
+	t = t.UTC()
+	if wd := t.Weekday(); wd == time.Saturday || wd == time.Sunday {
+		return false
+	}
+	h := t.Hour()
+	return (h >= 1 && h < 4) || (h >= 6 && h < 10)
+}
diff --git a/pkg/reviewer/direct/provider_factory_test.go b/pkg/reviewer/direct/provider_factory_test.go
index 8b8099d..00c264d 100644
--- a/pkg/reviewer/direct/provider_factory_test.go
+++ b/pkg/reviewer/direct/provider_factory_test.go
@@ -2,26 +2,55 @@ package direct
 
 import (
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 )
 
 func TestPricingFor(t *testing.T) {
-	require.Equal(t, Pricing{InputPerMTok: 5, OutputPerMTok: 25, CacheReadPerMTok: 0.5, CacheWritePerMTok: 6.25}, pricingFor("claude-opus-4-8"))
-	require.Equal(t, Pricing{InputPerMTok: 5, OutputPerMTok: 25, CacheReadPerMTok: 0.5, CacheWritePerMTok: 6.25}, pricingFor("claude-opus-5"))
-	require.Equal(t, Pricing{InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 1, CacheWritePerMTok: 12.5}, pricingFor("claude-fable-5"))
-	require.InEpsilon(t, 3.0, pricingFor("claude-sonnet-4-6").InputPerMTok, 1e-9)
-	require.InEpsilon(t, 3.0, pricingFor("claude-sonnet-5").InputPerMTok, 1e-9)
-	require.InEpsilon(t, 1.0, pricingFor("claude-haiku-4-5").InputPerMTok, 1e-9)
-	require.InEpsilon(t, 0.435, pricingFor("deepseek-v4-pro").InputPerMTok, 1e-9)
-	require.InEpsilon(t, 0.003625, pricingFor("deepseek-v4-pro").CacheReadPerMTok, 1e-9)
-	require.InEpsilon(t, 0.14, pricingFor("deepseek-v4-flash").InputPerMTok, 1e-9)
-	// Legacy deepseek-chat/reasoner aliases now price as V4 Flash.
-	require.InEpsilon(t, 0.14, pricingFor("deepseek-chat").InputPerMTok, 1e-9)
-	require.InEpsilon(t, 0.0028, pricingFor("deepseek-reasoner").CacheReadPerMTok, 1e-9)
+	now := time.Now()
+	require.Equal(t, Pricing{InputPerMTok: 5, OutputPerMTok: 25, CacheReadPerMTok: 0.5, CacheWritePerMTok: 6.25}, PricingFor("claude-opus-4-8", now))
+	require.Equal(t, Pricing{InputPerMTok: 5, OutputPerMTok: 25, CacheReadPerMTok: 0.5, CacheWritePerMTok: 6.25}, PricingFor("claude-opus-5", now))
+	require.Equal(t, Pricing{InputPerMTok: 4, OutputPerMTok: 20, CacheReadPerMTok: 0.2, CacheWritePerMTok: 5}, PricingFor("claude-opus-5-5", now))
+	require.Equal(t, Pricing{InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 1, CacheWritePerMTok: 12.5}, PricingFor("claude-fable-5", now))
+	require.Equal(t, Pricing{InputPerMTok: 10, OutputPerMTok: 50, CacheReadPerMTok: 0.25, CacheWritePerMTok: 12.5}, PricingFor("claude-fable-5-1", now))
+	require.Equal(t, Pricing{InputPerMTok: 2, OutputPerMTok: 10, CacheReadPerMTok: 0.2, CacheWritePerMTok: 2.5}, PricingFor("claude-sonnet-5", now))
+	require.InEpsilon(t, 3.0, PricingFor("claude-sonnet-4-6", now).InputPerMTok, 1e-9)
+	require.InEpsilon(t, 1.0, PricingFor("claude-haiku-4-5", now).InputPerMTok, 1e-9)
+	// OpenAI: exact ids (gpt-5.5-pro must not price as gpt-5.5); no cache-write
+	// charge -> writes bill as input.
+	require.Equal(t, Pricing{InputPerMTok: 2, OutputPerMTok: 10, CacheReadPerMTok: 0.2, CacheWritePerMTok: 2.5}, PricingFor("gpt-6-sol", now))
+	require.InEpsilon(t, 180.0, PricingFor("gpt-5.5-pro", now).OutputPerMTok, 1e-9)
+	require.InEpsilon(t, 5.0, PricingFor("gpt-5.5", now).CacheWritePerMTok, 1e-9)
+	require.Equal(t, Pricing{}, PricingFor("gpt-5-codex", now)) // shut down 2026-07-23
 	// Unknown model -> zero table (cost reported as 0), no panic.
-	require.Equal(t, Pricing{}, pricingFor("gpt-4o"))
-	require.Equal(t, Pricing{}, pricingFor(""))
+	require.Equal(t, Pricing{}, PricingFor("gpt-4o", now))
+	require.Equal(t, Pricing{}, PricingFor("", now))
+}
+
+func TestPricingForDeepSeekPeak(t *testing.T) {
+	peak := time.Date(2026, 9, 23, 7, 30, 0, 0, time.UTC)    // Wednesday 07:30 UTC
+	offPeak := time.Date(2026, 9, 23, 12, 0, 0, 0, time.UTC) // Wednesday 12:00 UTC
+	weekend := time.Date(2026, 9, 26, 7, 30, 0, 0, time.UTC) // Saturday, same hour
+
+	require.Equal(t, Pricing{InputPerMTok: 1.32, OutputPerMTok: 3.96, CacheReadPerMTok: 0.044, CacheWritePerMTok: 1.32}, PricingFor("deepseek-v4-pro", peak))
+	require.InEpsilon(t, 0.66, PricingFor("deepseek-v4-pro", offPeak).InputPerMTok, 1e-9)
+	require.InEpsilon(t, 0.022, PricingFor("deepseek-v4-pro", weekend).CacheReadPerMTok, 1e-9)
+
+	require.Equal(t, Pricing{InputPerMTok: 0.3, OutputPerMTok: 1.2, CacheReadPerMTok: 0.006, CacheWritePerMTok: 0.3}, PricingFor("deepseek-flash", peak))
+	require.InEpsilon(t, 0.6, PricingFor("deepseek-flash", offPeak).OutputPerMTok, 1e-9)
+	// Retired names are served and billed as deepseek-flash.
+	require.Equal(t, PricingFor("deepseek-flash", peak), PricingFor("deepseek-v4-flash", peak))
+	require.Equal(t, PricingFor("deepseek-flash", offPeak), PricingFor("deepseek-chat", offPeak))
+
+	// Window edges: [01:00, 04:00) and [06:00, 10:00) UTC, in any time zone.
+	day := func(h, m int) time.Time { return time.Date(2026, 9, 21, h, m, 0, 0, time.UTC) } // Monday
+	require.False(t, deepseekPeak(day(0, 59)))
+	require.True(t, deepseekPeak(day(1, 0)))
+	require.False(t, deepseekPeak(day(4, 0)))
+	require.True(t, deepseekPeak(day(9, 59)))
+	require.False(t, deepseekPeak(day(10, 0)))
+	require.True(t, deepseekPeak(day(7, 0).In(time.FixedZone("MSK", 3*3600))))
 }
 
 func TestNewProviderUnknownAndAnthropic(t *testing.T) {
diff --git a/pkg/reviewer/direct/provider_openai.go b/pkg/reviewer/direct/provider_openai.go
index 329b876..a5d3b30 100644
--- a/pkg/reviewer/direct/provider_openai.go
+++ b/pkg/reviewer/direct/provider_openai.go
@@ -1,33 +1,30 @@
 package direct
 
 import (
+	"cmp"
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
-	"time"
 
 	openai "github.com/sashabaranov/go-openai"
 )
 
-const (
-	// defaultMaxRetries is the transient-error retry budget when not configured.
-	defaultMaxRetries = 3
-	// defaultMaxTokens caps each response so a long review answer is not silently
-	// truncated by a low provider default.
-	defaultMaxTokens = 8192
-)
+// defaultMaxTokens caps each response so a long review answer is not silently
+// truncated by a low provider default.
+const defaultMaxTokens = 8192
 
-// OpenAIConfig configures an OpenAI-compatible provider (DeepSeek, or any
-// endpoint speaking the OpenAI chat-completions protocol).
+// OpenAIConfig configures an OpenAI-protocol provider: chat completions
+// (DeepSeek, or any OpenAI-compatible endpoint) or the OpenAI Responses API.
 type OpenAIConfig struct {
 	APIKey      string
 	BaseURL     string // e.g. https://api.deepseek.com/v1
 	Model       string
 	Pricing     Pricing
 	Temperature float32
-	MaxRetries  int // transient (429/5xx/network) retry budget; 0 -> defaultMaxRetries
 	MaxTokens   int // per-response output cap; 0 -> defaultMaxTokens
+	// PassEffort sends Request.Effort as reasoning_effort. Only for backends
+	// known to accept it (DeepSeek); arbitrary OpenAI-compatible ones may 400.
+	PassEffort bool
 }
 
 // openaiProvider drives an OpenAI-compatible chat-completions API.
@@ -36,12 +33,30 @@ type openaiProvider struct {
 	model       string
 	pricing     Pricing
 	temperature float32
-	maxRetries  int
 	maxTokens   int
+	passEffort  bool
 }
 
-// NewOpenAIProvider builds a provider for DeepSeek / OpenAI-compatible endpoints.
+// NewOpenAIProvider builds a chat-completions provider for DeepSeek /
+// OpenAI-compatible endpoints.
 func NewOpenAIProvider(cfg OpenAIConfig) (LLMProvider, error) {
+	client, err := newOpenAIClient(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return &openaiProvider{
+		client:      client,
+		model:       cfg.Model,
+		pricing:     cfg.Pricing,
+		temperature: cfg.Temperature,
+		maxTokens:   cmp.Or(cfg.MaxTokens, defaultMaxTokens),
+		passEffort:  cfg.PassEffort,
+	}, nil
+}
+
+// newOpenAIClient validates cfg and builds the go-openai client shared by the
+// chat-completions and Responses providers.
+func newOpenAIClient(cfg OpenAIConfig) (*openai.Client, error) {
 	if cfg.APIKey == "" {
 		return nil, errors.New("openai provider: API key is required")
 	}
@@ -52,22 +67,7 @@ func NewOpenAIProvider(cfg OpenAIConfig) (LLMProvider, error) {
 	if cfg.BaseURL != "" {
 		conf.BaseURL = cfg.BaseURL
 	}
-	maxRetries := cfg.MaxRetries
-	if maxRetries <= 0 {
-		maxRetries = defaultMaxRetries
-	}
-	maxTokens := cfg.MaxTokens
-	if maxTokens <= 0 {
-		maxTokens = defaultMaxTokens
-	}
-	return &openaiProvider{
-		client:      openai.NewClientWithConfig(conf),
-		model:       cfg.Model,
-		pricing:     cfg.Pricing,
-		temperature: cfg.Temperature,
-		maxRetries:  maxRetries,
-		maxTokens:   maxTokens,
-	}, nil
+	return openai.NewClientWithConfig(conf), nil
 }
 
 func (p *openaiProvider) Model() string    { return p.model }
@@ -79,35 +79,28 @@ func (p *openaiProvider) Complete(ctx context.Context, req Request) (Response, e
 		Messages:    toOpenAIMessages(req),
 		Tools:       toOpenAITools(req.Tools),
 		Temperature: p.temperature,
-		MaxTokens:   p.maxTokens,
+		// DeepSeek and most OpenAI-compatible backends only document max_tokens,
+		// not max_completion_tokens.
+		MaxTokens: p.maxTokens, //nolint:staticcheck // see above
+	}
+	if p.passEffort {
+		// Passed through as-is: DeepSeek takes none/low/high/max and maps
+		// minimal→low, medium/xhigh→high itself.
+		creq.ReasoningEffort = req.Effort
 	}
 
-	// Retry transient errors (429 / 5xx / network) with exponential backoff.
-	// A non-transient error (400, auth) fails immediately.
-	var resp openai.ChatCompletionResponse
-	var err error
-	backoff := 500 * time.Millisecond
-	for attempt := 0; ; attempt++ {
-		resp, err = p.client.CreateChatCompletion(ctx, creq)
-		if err == nil {
-			break
-		}
-		if attempt >= p.maxRetries || ctx.Err() != nil || !isTransientErr(err) {
-			return Response{}, fmt.Errorf("openai: %w", err)
-		}
-		select {
-		case <-ctx.Done():
-			return Response{}, ctx.Err()
-		case <-time.After(backoff):
-		}
-		backoff *= 2
+	resp, retried, err := withRetry(ctx, openaiRetry, func() (openai.ChatCompletionResponse, error) {
+		return p.client.CreateChatCompletion(ctx, creq)
+	})
+	if err != nil {
+		return Response{}, err
 	}
 	if len(resp.Choices) == 0 {
 		return Response{}, errors.New("openai: response had no choices")
 	}
 
 	ch := resp.Choices[0]
-	out := Response{Text: ch.Message.Content, StopReason: string(ch.FinishReason)}
+	out := Response{Text: ch.Message.Content, StopReason: string(ch.FinishReason), Retries: retried}
 	for _, tc := range ch.Message.ToolCalls {
 		out.ToolCalls = append(out.ToolCalls, ToolCall{
 			ID:   tc.ID,
@@ -116,21 +109,11 @@ func (p *openaiProvider) Complete(ctx context.Context, req Request) (Response, e
 		})
 	}
 
-	// Split cached prompt tokens out of the input count so cost matches the
-	// Anthropic semantics (InputTokens = uncached remainder).
 	cached := 0
-	if resp.Usage.PromptTokensDetails != nil {
-		cached = resp.Usage.PromptTokensDetails.CachedTokens
-	}
-	input := resp.Usage.PromptTokens - cached
-	if input < 0 {
-		input, cached = resp.Usage.PromptTokens, 0
-	}
-	out.Usage = Usage{
-		InputTokens:     input,
-		OutputTokens:    resp.Usage.CompletionTokens,
-		CacheReadTokens: cached,
+	if d := resp.Usage.PromptTokensDetails; d != nil {
+		cached = d.CachedTokens
 	}
+	out.Usage = SplitInput(resp.Usage.PromptTokens, cached, 0, resp.Usage.CompletionTokens)
 	return out, nil
 }
 
@@ -176,17 +159,6 @@ func toOpenAIMessages(req Request) []openai.ChatCompletionMessage {
 	return msgs
 }
 
-// isTransientErr reports whether err is worth retrying: an HTTP 429 / 5xx
-// response or a network-level request error.
-func isTransientErr(err error) bool {
-	var apiErr *openai.APIError
-	if errors.As(err, &apiErr) {
-		return apiErr.HTTPStatusCode == 429 || apiErr.HTTPStatusCode >= 500
-	}
-	var reqErr *openai.RequestError
-	return errors.As(err, &reqErr)
-}
-
 func toOpenAITools(defs []ToolDef) []openai.Tool {
 	if len(defs) == 0 {
 		return nil
diff --git a/pkg/reviewer/direct/provider_openai_test.go b/pkg/reviewer/direct/provider_openai_test.go
index 0cb08f8..9ba5cb0 100644
--- a/pkg/reviewer/direct/provider_openai_test.go
+++ b/pkg/reviewer/direct/provider_openai_test.go
@@ -1,9 +1,11 @@
 package direct
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"testing"
+	"time"
 
 	openai "github.com/sashabaranov/go-openai"
 	"github.com/stretchr/testify/require"
@@ -38,13 +40,14 @@ func TestToOpenAIMessagesMultipleToolResults(t *testing.T) {
 	require.Equal(t, "b", msgs[4].ToolCallID)
 }
 
-func TestIsTransientErr(t *testing.T) {
-	require.True(t, isTransientErr(&openai.APIError{HTTPStatusCode: 429}))
-	require.True(t, isTransientErr(&openai.APIError{HTTPStatusCode: 503}))
-	require.False(t, isTransientErr(&openai.APIError{HTTPStatusCode: 400}))
-	require.False(t, isTransientErr(&openai.APIError{HTTPStatusCode: 401}))
-	require.True(t, isTransientErr(&openai.RequestError{HTTPStatusCode: 500}))
-	require.False(t, isTransientErr(errors.New("plain error")))
+func TestIsOpenAITransient(t *testing.T) {
+	require.True(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 429}))
+	require.True(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 503}))
+	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 400}))
+	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 401}))
+	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 429, Code: "insufficient_quota"}), "an exhausted quota is billing, not a rate limit")
+	require.True(t, isOpenAITransient(&openai.RequestError{HTTPStatusCode: 500}))
+	require.False(t, isOpenAITransient(errors.New("plain error")))
 }
 
 func TestToOpenAIMessagesSkipsBareAssistant(t *testing.T) {
@@ -62,3 +65,79 @@ func TestToOpenAIMessagesSkipsBareAssistant(t *testing.T) {
 	}
 	require.Len(t, msgs, 2)
 }
+
+func TestOpenAIProviderPassesEffort(t *testing.T) {
+	const reply = `{"choices":[{"message":{"role":"assistant","content":"ok"},"finish_reason":"stop"}],"usage":{"prompt_tokens":10,"completion_tokens":2}}`
+	srv, reqs := fakeAPI(t, "/chat/completions", reply, reply, reply)
+
+	// DeepSeek: the level goes through verbatim (the API maps medium/xhigh to
+	// high itself) and the output cap leaves room for thinking.
+	p, err := NewProvider(ProviderConfig{Provider: ProviderDeepSeek, Model: "deepseek-v4-pro", APIKey: "k", BaseURL: srv.URL})
+	require.NoError(t, err)
+	_, err = p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}, Effort: "xhigh"})
+	require.NoError(t, err)
+	require.Equal(t, "xhigh", (*reqs)[0]["reasoning_effort"])
+	require.InDelta(t, float64(deepseekMaxTokens), (*reqs)[0]["max_tokens"], 0)
+
+	// No effort -> field omitted, backend default applies.
+	_, err = p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.NoError(t, err)
+	require.NotContains(t, (*reqs)[1], "reasoning_effort")
+
+	// openai-compat: an arbitrary backend may reject reasoning_effort, so the
+	// profile's effort is not sent.
+	p, err = NewProvider(ProviderConfig{Provider: ProviderOpenAICompat, Model: "local-model", APIKey: "k", BaseURL: srv.URL})
+	require.NoError(t, err)
+	_, err = p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}, Effort: "high"})
+	require.NoError(t, err)
+	require.NotContains(t, (*reqs)[2], "reasoning_effort")
+}
+
+func TestSplitInput(t *testing.T) {
+	require.Equal(t, Usage{InputTokens: 100, OutputTokens: 5, CacheReadTokens: 600, CacheWriteTokens: 300}, SplitInput(1000, 600, 300, 5))
+	// Counters that overshoot the input total are capped, never negative.
+	require.Equal(t, Usage{CacheReadTokens: 10}, SplitInput(10, 50, 50, 0))
+}
+
+func TestWithRetry(t *testing.T) {
+	prev := openaiRetry.backoff
+	openaiRetry.backoff = time.Millisecond
+	t.Cleanup(func() { openaiRetry.backoff = prev })
+
+	// fails returns an fn that fails with err n times, then succeeds.
+	fails := func(n int, err error) (func() (string, error), *int) {
+		calls := 0
+		return func() (string, error) {
+			calls++
+			if calls <= n {
+				return "", err
+			}
+			return "ok", nil
+		}, &calls
+	}
+	ctx := context.Background()
+
+	fn, calls := fails(1, &openai.APIError{HTTPStatusCode: 503})
+	got, retried, err := withRetry(ctx, openaiRetry, fn)
+	require.NoError(t, err, "a transient error is retried")
+	require.Equal(t, "ok", got)
+	require.Equal(t, 2, *calls)
+	require.Len(t, retried, 1, "the retried failure is kept for the transcript")
+
+	fn, calls = fails(maxRetries+1, &openai.APIError{HTTPStatusCode: 429})
+	_, _, err = withRetry(ctx, openaiRetry, fn)
+	require.ErrorContains(t, err, "openai:", "retries are bounded")
+	require.Equal(t, maxRetries+1, *calls)
+
+	fn, calls = fails(1, &openai.APIError{HTTPStatusCode: 400})
+	_, _, err = withRetry(ctx, openaiRetry, fn)
+	require.Error(t, err, "a client error is not retried")
+	require.Equal(t, 1, *calls)
+
+	cancelled, cancel := context.WithCancel(ctx)
+	cancel()
+	fn, calls = fails(1, &openai.APIError{HTTPStatusCode: 503})
+	_, _, err = withRetry(cancelled, openaiRetry, fn)
+	require.ErrorContains(t, err, "openai:")
+	require.Equal(t, 1, *calls, "no retry after cancellation")
+}
diff --git a/pkg/reviewer/direct/provider_responses.go b/pkg/reviewer/direct/provider_responses.go
new file mode 100644
index 0000000..4505716
--- /dev/null
+++ b/pkg/reviewer/direct/provider_responses.go
@@ -0,0 +1,194 @@
+package direct
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	openai "github.com/sashabaranov/go-openai"
+)
+
+// defaultResponsesMaxTokens caps each response. Reasoning tokens count against
+// max_output_tokens, so it must fit a long reasoning phase plus a large tool
+// payload — the same budget as the Anthropic provider.
+const defaultResponsesMaxTokens = defaultAnthropicMaxTokens
+
+// responsesProvider drives the OpenAI Responses API. GPT-6 needs it for tool
+// use with reasoning (chat completions allows GPT-6 tool calls only on Sol/Luna
+// at effort "none"), and it lets reasoning carry across rounds statelessly:
+// store=false plus encrypted reasoning items replayed verbatim on the next
+// request, the way the Anthropic provider replays signed thinking blocks.
+type responsesProvider struct {
+	client    *openai.Client
+	model     string
+	pricing   Pricing
+	maxTokens int
+}
+
+// NewResponsesProvider builds a provider for the OpenAI Responses API.
+// cfg.Temperature is ignored: reasoning models reject sampling parameters.
+func NewResponsesProvider(cfg OpenAIConfig) (LLMProvider, error) {
+	client, err := newOpenAIClient(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return &responsesProvider{
+		client:    client,
+		model:     cfg.Model,
+		pricing:   cfg.Pricing,
+		maxTokens: cmp.Or(cfg.MaxTokens, defaultResponsesMaxTokens),
+	}, nil
+}
+
+func (p *responsesProvider) Model() string    { return p.model }
+func (p *responsesProvider) Pricing() Pricing { return p.pricing }
+
+func (p *responsesProvider) Complete(ctx context.Context, req Request) (Response, error) {
+	store := false
+	rreq := openai.CreateResponseRequest{
+		Model:           p.model,
+		Instructions:    req.System,
+		Input:           toResponsesInput(req),
+		Tools:           toResponsesTools(req.Tools),
+		MaxOutputTokens: p.maxTokens,
+		Store:           &store,
+		Include:         []openai.ResponseInclude{openai.ResponseIncludeReasoningEncryptedContent},
+	}
+	if req.Effort != "" {
+		rreq.Reasoning = &openai.ResponseReasoning{Effort: req.Effort}
+	}
+
+	resp, retried, err := withRetry(ctx, openaiRetry, func() (openai.CreateResponseResponse, error) {
+		return p.client.CreateResponse(ctx, rreq)
+	})
+	if err != nil {
+		return Response{}, err
+	}
+	if resp.Status == openai.ResponseStatusFailed {
+		if resp.Error != nil {
+			return Response{}, fmt.Errorf("openai: response %s failed: %s: %s", resp.ID, resp.Error.Code, resp.Error.Message)
+		}
+		return Response{}, fmt.Errorf("openai: response %s failed", resp.ID)
+	}
+
+	out, err := parseResponsesOutput(resp.Output)
+	if err != nil {
+		return Response{}, err
+	}
+	out.StopReason = responsesStopReason(resp, len(out.ToolCalls) > 0)
+	out.Retries = retried
+	// A cut-off response can end on a reasoning item with nothing after it,
+	// which the API rejects on replay: rebuild that turn from Text+ToolCalls.
+	if resp.Status != openai.ResponseStatusCompleted {
+		out.Raw = nil
+	}
+	if u := resp.Usage; u != nil {
+		var cached, written int
+		if d := u.InputTokensDetails; d != nil {
+			cached, written = d.CachedTokens, d.CacheWriteTokens
+		}
+		out.Usage = SplitInput(u.InputTokens, cached, written, u.OutputTokens)
+	}
+	return out, nil
+}
+
+// parseResponsesOutput reads the text and function calls out of the response
+// output items and keeps the items themselves (Response.Raw, encoded once) for
+// verbatim replay.
+func parseResponsesOutput(items []any) (Response, error) {
+	var out Response
+	replay := make([]any, 0, len(items))
+	for _, raw := range items {
+		// created_by is output-only provenance the API doesn't accept as input
+		// (the official SDKs' toResponseInputItems drops it too).
+		if m, ok := raw.(map[string]any); ok {
+			delete(m, "created_by")
+		}
+		data, err := json.Marshal(raw)
+		if err != nil {
+			return Response{}, fmt.Errorf("openai: encode output item: %w", err)
+		}
+		var item openai.ResponseOutputItem
+		if err := json.Unmarshal(data, &item); err != nil {
+			return Response{}, fmt.Errorf("openai: decode output item: %w", err)
+		}
+		switch item.Type {
+		case "message":
+			for _, c := range item.Content {
+				if c.Type == "output_text" {
+					out.Text += c.Text
+				}
+			}
+		case "function_call":
+			out.ToolCalls = append(out.ToolCalls, ToolCall{ID: item.CallID, Name: item.Name, Args: json.RawMessage(item.Arguments)})
+		}
+		replay = append(replay, json.RawMessage(data))
+	}
+	if len(replay) > 0 {
+		out.Raw = replay
+	}
+	return out, nil
+}
+
+// responsesStopReason maps a response to the loop's stop-reason vocabulary; a
+// max_output_tokens cut becomes "length" so IsTruncated catches it.
+func responsesStopReason(resp openai.CreateResponseResponse, hasToolCalls bool) string {
+	if resp.Status == openai.ResponseStatusIncomplete && resp.IncompleteDetails != nil {
+		if resp.IncompleteDetails.Reason == "max_output_tokens" {
+			return stopLength
+		}
+		return resp.IncompleteDetails.Reason
+	}
+	if hasToolCalls {
+		return "tool_calls"
+	}
+	return "stop"
+}
+
+// toResponsesInput renders the history as Responses input items. Assistant turns
+// replay their kept output items (incl. encrypted reasoning) when available and
+// are rebuilt from the neutral fields otherwise (e.g. after compaction).
+func toResponsesInput(req Request) []any {
+	var items []any
+	for _, m := range req.Messages {
+		switch m.Role {
+		case RoleSystem:
+			// Delivered via Instructions; nothing to add to the history.
+		case RoleUser:
+			items = append(items, openai.ResponseInputMessage{Role: "user", Content: m.Text})
+		case RoleAssistant:
+			if raw, ok := m.Raw.([]any); ok {
+				items = append(items, raw...)
+				continue
+			}
+			if strings.TrimSpace(m.Text) != "" {
+				items = append(items, openai.ResponseInputMessage{Role: "assistant", Content: m.Text})
+			}
+			for _, tc := range m.ToolCalls {
+				items = append(items, openai.ResponseOutputItem{Type: "function_call", CallID: tc.ID, Name: tc.Name, Arguments: string(tc.Args)})
+			}
+		case RoleTool:
+			for _, tr := range m.ToolResults {
+				items = append(items, openai.ResponseFunctionCallOutput{Type: "function_call_output", CallID: tr.CallID, Output: tr.Content})
+			}
+		}
+	}
+	return items
+}
+
+func toResponsesTools(defs []ToolDef) []openai.ResponseTool {
+	if len(defs) == 0 {
+		return nil
+	}
+	out := make([]openai.ResponseTool, 0, len(defs))
+	for _, d := range defs {
+		out = append(out, openai.NewResponseFunctionTool(openai.FunctionDefinition{
+			Name:        d.Name,
+			Description: d.Description,
+			Parameters:  d.Schema,
+		}))
+	}
+	return out
+}
diff --git a/pkg/reviewer/direct/provider_responses_test.go b/pkg/reviewer/direct/provider_responses_test.go
new file mode 100644
index 0000000..3100e12
--- /dev/null
+++ b/pkg/reviewer/direct/provider_responses_test.go
@@ -0,0 +1,136 @@
+package direct
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// fakeAPI serves canned JSON bodies on path in order and records the decoded
+// request bodies.
+func fakeAPI(t *testing.T, path string, bodies ...string) (*httptest.Server, *[]map[string]any) {
+	t.Helper()
+	var reqs []map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var req map[string]any
+		if r.URL.Path != path || json.NewDecoder(r.Body).Decode(&req) != nil || len(reqs) >= len(bodies) {
+			http.Error(w, "unexpected request", http.StatusBadRequest)
+			return
+		}
+		reqs = append(reqs, req)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, bodies[len(reqs)-1])
+	}))
+	t.Cleanup(srv.Close)
+	return srv, &reqs
+}
+
+func TestResponsesProviderRoundTrip(t *testing.T) {
+	toolTurn := `{"id":"resp_1","object":"response","status":"completed","model":"gpt-6-sol","output":[
+		{"id":"rs_1","type":"reasoning","summary":[],"encrypted_content":"ENC","created_by":"model"},
+		{"id":"fc_1","type":"function_call","status":"completed","call_id":"call_1","name":"grep","arguments":"{\"pattern\":\"x\"}"}
+	],"usage":{"input_tokens":1000,"input_tokens_details":{"cached_tokens":600,"cache_write_tokens":300},"output_tokens":50,"total_tokens":1050}}`
+	textTurn := `{"id":"resp_2","object":"response","status":"completed","model":"gpt-6-sol","output":[
+		{"id":"msg_1","type":"message","role":"assistant","status":"completed","content":[{"type":"output_text","text":"done","annotations":[]}]}
+	],"usage":{"input_tokens":1200,"output_tokens":5,"total_tokens":1205}}`
+	srv, reqs := fakeAPI(t, "/v1/responses", toolTurn, textTurn)
+
+	p, err := NewResponsesProvider(OpenAIConfig{APIKey: "k", BaseURL: srv.URL + "/v1", Model: "gpt-6-sol"})
+	require.NoError(t, err)
+
+	tools := []ToolDef{{Name: "grep", Description: "search", Schema: map[string]any{"type": "object"}}}
+	msgs := make([]Message, 0, 3)
+	msgs = append(msgs, Message{Role: RoleUser, Text: "review"})
+	resp, err := p.Complete(context.Background(), Request{System: "sys", Messages: msgs, Tools: tools, Effort: "high"})
+	require.NoError(t, err)
+	require.Equal(t, "tool_calls", resp.StopReason)
+	require.Equal(t, []ToolCall{{ID: "call_1", Name: "grep", Args: json.RawMessage(`{"pattern":"x"}`)}}, resp.ToolCalls)
+	require.Equal(t, Usage{InputTokens: 100, OutputTokens: 50, CacheReadTokens: 600, CacheWriteTokens: 300}, resp.Usage)
+
+	first := (*reqs)[0]
+	require.Equal(t, "gpt-6-sol", first["model"])
+	require.Equal(t, "sys", first["instructions"])
+	require.Equal(t, false, first["store"])
+	require.Equal(t, map[string]any{"effort": "high"}, first["reasoning"])
+	require.Equal(t, []any{"reasoning.encrypted_content"}, first["include"])
+	require.InDelta(t, float64(defaultResponsesMaxTokens), first["max_output_tokens"], 0)
+	require.Equal(t, []any{map[string]any{"type": "function", "name": "grep", "description": "search", "parameters": map[string]any{"type": "object"}}}, first["tools"])
+	require.Equal(t, []any{map[string]any{"role": "user", "content": "review"}}, first["input"])
+
+	// Next round replays the kept output items verbatim (encrypted reasoning and
+	// ids included, output-only created_by dropped), then the tool output.
+	msgs = append(msgs,
+		Message{Role: RoleAssistant, ToolCalls: resp.ToolCalls, Raw: resp.Raw},
+		Message{Role: RoleTool, ToolResults: []ToolResult{{CallID: "call_1", Name: "grep", Content: "a.go:1"}}},
+	)
+	resp, err = p.Complete(context.Background(), Request{System: "sys", Messages: msgs, Tools: tools})
+	require.NoError(t, err)
+	require.Equal(t, "done", resp.Text)
+	require.Equal(t, "stop", resp.StopReason)
+
+	second := (*reqs)[1]
+	require.NotContains(t, second, "reasoning", "no effort -> model default")
+	input, ok := second["input"].([]any)
+	require.True(t, ok)
+	require.Len(t, input, 4)
+	require.Equal(t, map[string]any{"id": "rs_1", "type": "reasoning", "summary": []any{}, "encrypted_content": "ENC"}, input[1])
+	require.Equal(t, "fc_1", input[2].(map[string]any)["id"])
+	require.Equal(t, map[string]any{"type": "function_call_output", "call_id": "call_1", "output": "a.go:1"}, input[3])
+}
+
+func TestNewProviderOpenAIRouting(t *testing.T) {
+	// OpenAI's own endpoint speaks the Responses API; a custom base URL may be a
+	// proxy that only implements chat completions.
+	for _, base := range []string{"", "https://api.openai.com/v1", "https://API.openai.com/v1/"} {
+		p, err := NewProvider(ProviderConfig{Provider: ProviderOpenAI, Model: "gpt-6-sol", APIKey: "k", BaseURL: base})
+		require.NoError(t, err)
+		require.IsType(t, &responsesProvider{}, p, base)
+		require.InEpsilon(t, 2.0, p.Pricing().InputPerMTok, 1e-9)
+	}
+	for _, base := range []string{"https://my-azure.openai.azure.com/openai/v1", "http://litellm:4000/v1"} {
+		p, err := NewProvider(ProviderConfig{Provider: ProviderOpenAI, Model: "gpt-5.5", APIKey: "k", BaseURL: base})
+		require.NoError(t, err)
+		require.IsType(t, &openaiProvider{}, p, base)
+	}
+}
+
+func TestResponsesProviderRebuildsWithoutRaw(t *testing.T) {
+	// After compaction the loop drops Raw: the turn is rebuilt from neutral fields.
+	items := toResponsesInput(Request{Messages: []Message{
+		{Role: RoleUser, Text: "go"},
+		{Role: RoleAssistant, Text: "looking", ToolCalls: []ToolCall{{ID: "c1", Name: "glob", Args: json.RawMessage(`{"pattern":"*"}`)}}},
+		{Role: RoleTool, ToolResults: []ToolResult{{CallID: "c1", Content: "a.go"}}},
+	}})
+	data, err := json.Marshal(items)
+	require.NoError(t, err)
+	require.JSONEq(t, `[
+		{"role":"user","content":"go"},
+		{"role":"assistant","content":"looking"},
+		{"type":"function_call","call_id":"c1","name":"glob","arguments":"{\"pattern\":\"*\"}"},
+		{"type":"function_call_output","call_id":"c1","output":"a.go"}
+	]`, string(data))
+}
+
+func TestResponsesProviderTruncatedAndFailed(t *testing.T) {
+	srv, _ := fakeAPI(t, "/v1/responses",
+		// Cut off mid-reasoning: only a reasoning item, nothing after it.
+		`{"id":"r1","object":"response","status":"incomplete","incomplete_details":{"reason":"max_output_tokens"},"model":"gpt-6-sol",
+			"output":[{"id":"rs_1","type":"reasoning","summary":[],"encrypted_content":"ENC"}]}`,
+		`{"id":"r2","object":"response","status":"failed","error":{"code":"server_error","message":"boom"},"model":"gpt-6-sol","output":[]}`,
+	)
+	p, err := NewResponsesProvider(OpenAIConfig{APIKey: "k", BaseURL: srv.URL + "/v1", Model: "gpt-6-sol"})
+	require.NoError(t, err)
+
+	resp, err := p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.NoError(t, err)
+	require.True(t, IsTruncated(resp.StopReason))
+	require.Nil(t, resp.Raw, "a lone reasoning item must not be replayed")
+
+	_, err = p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	require.ErrorContains(t, err, "response r2 failed: server_error: boom")
+}
diff --git a/pkg/reviewer/direct/registry.go b/pkg/reviewer/direct/registry.go
index e3443c3..0989073 100644
--- a/pkg/reviewer/direct/registry.go
+++ b/pkg/reviewer/direct/registry.go
@@ -28,6 +28,10 @@ type Registry struct {
 	defs      map[string]ToolDef
 	handlers  map[string]Handler
 	submitted bool
+
+	// allowed, when set, limits Dispatch to these tools; others fail with deniedMsg.
+	allowed   map[string]bool
+	deniedMsg string
 }
 
 // NewRegistry returns an empty registry.
@@ -65,13 +69,30 @@ func (r *Registry) Defs() []ToolDef {
 func (r *Registry) Dispatch(ctx context.Context, name string, args json.RawMessage) (string, error) {
 	r.mu.Lock()
 	h, ok := r.handlers[name]
+	denied := r.allowed != nil && !r.allowed[name]
 	r.mu.Unlock()
-	if !ok {
+	switch {
+	case !ok:
 		return "", fmt.Errorf("unknown tool %q", name)
+	case denied:
+		return "", fmt.Errorf("%s: %s", name, r.deniedMsg)
 	}
 	return h(ctx, args)
 }
 
+// restrict limits Dispatch to the allowed tools; any other call fails with
+// deniedMsg. Defs stay intact: changing the tool list would invalidate the
+// provider prompt cache for the whole conversation.
+func (r *Registry) restrict(deniedMsg string, allowed ...string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.allowed = make(map[string]bool, len(allowed))
+	for _, name := range allowed {
+		r.allowed[name] = true
+	}
+	r.deniedMsg = deniedMsg
+}
+
 // markSubmitted records that submit_review wrote its artifacts successfully.
 func (r *Registry) markSubmitted() {
 	r.mu.Lock()
diff --git a/pkg/reviewer/direct/retry.go b/pkg/reviewer/direct/retry.go
new file mode 100644
index 0000000..2d99a39
--- /dev/null
+++ b/pkg/reviewer/direct/retry.go
@@ -0,0 +1,53 @@
+package direct
+
+import (
+	"context"
+	"fmt"
+	"time"
+)
+
+const (
+	// maxRetries is the transient-error retry budget of a provider call.
+	maxRetries = 3
+	// maxRetryBackoff caps the doubling retry delay.
+	maxRetryBackoff = 60 * time.Second
+)
+
+// retryPolicy is how a provider retries a failed call (see withRetry).
+type retryPolicy struct {
+	name      string        // error prefix
+	backoff   time.Duration // first delay, doubling per attempt up to maxRetryBackoff
+	transient func(error) bool
+}
+
+var (
+	// openaiRetry covers the OpenAI-protocol providers: chat completions and Responses.
+	openaiRetry = retryPolicy{name: "openai", backoff: 500 * time.Millisecond, transient: isOpenAITransient}
+	// anthropicRetry covers failures inside the response stream too, and waits
+	// longer to ride out overload/5xx bursts.
+	anthropicRetry = retryPolicy{name: "anthropic", backoff: 5 * time.Second, transient: isAnthropicTransient}
+)
+
+// withRetry calls fn, retrying transient errors with exponential backoff up to
+// maxRetries times; a definitive error (bad request, auth, billing) fails at
+// once. The retried errors are returned for the transcript.
+func withRetry[T any](ctx context.Context, p retryPolicy, fn func() (T, error)) (T, []string, error) {
+	backoff := p.backoff
+	var retried []string
+	for attempt := 0; ; attempt++ {
+		resp, err := fn()
+		if err == nil {
+			return resp, retried, nil
+		}
+		if attempt >= maxRetries || ctx.Err() != nil || !p.transient(err) {
+			return resp, retried, fmt.Errorf("%s: %w", p.name, err)
+		}
+		retried = append(retried, err.Error())
+		select {
+		case <-ctx.Done():
+			return resp, retried, fmt.Errorf("%s: %w (retrying after: %w)", p.name, ctx.Err(), err)
+		case <-time.After(backoff):
+		}
+		backoff = min(backoff*2, maxRetryBackoff)
+	}
+}
diff --git a/pkg/reviewer/direct/sink.go b/pkg/reviewer/direct/sink.go
index 015ac1e..d9d3324 100644
--- a/pkg/reviewer/direct/sink.go
+++ b/pkg/reviewer/direct/sink.go
@@ -13,6 +13,8 @@ import "encoding/json"
 //   - "tool_call"   — a tool the model requested (Tool, Args)
 //   - "tool_result" — the tool's output, truncated (Tool, Content, IsError)
 //   - "round"       — per-round usage and stop reason (Usage, StopReason)
+//   - "retry"       — a transient provider failure retried within the round (Text)
+//   - "notice"      — a round-budget notice appended to the round's tool results (Text)
 //   - "result"      — final totals (Rounds, Usage, CostUsd, Submitted, Model, StopReason)
 type Event struct {
 	Round      int             `json:"round"`
diff --git a/pkg/reviewer/direct/tools_git.go b/pkg/reviewer/direct/tools_git.go
index 3ad0025..4be2ccc 100644
--- a/pkg/reviewer/direct/tools_git.go
+++ b/pkg/reviewer/direct/tools_git.go
@@ -81,13 +81,50 @@ func DetectBaseRef(ctx context.Context, root string) string {
 		}
 	}
 	for _, ref := range []string{"origin/devel", "origin/main", "origin/master"} {
-		if _, err := runGit(ctx, root, false, "rev-parse", "--verify", "--quiet", ref+"^{commit}"); err == nil {
+		if isCommit(ctx, root, ref) {
 			return ref
 		}
 	}
 	return ""
 }
 
+// ResolveDiffRange turns CI metadata into refs that exist in the checkout. A
+// GitLab CI clone is a detached HEAD without local branches, so the bare branch
+// names (main...feature-x) are "bad revision": the preload silently came out
+// empty and the model had to read every changed file one round at a time.
+//
+// head is source when it resolves locally, else HEAD — the checked-out commit is
+// also what read_file sees; an empty source stays empty (the local "working tree
+// vs base" mode). base is the first candidate that shares history with head
+// (base...head needs a merge base, which a shallow clone can cut off): the MR
+// diff base SHA, origin/<target>, <target>. "" when none does — the caller
+// falls back to DetectBaseRef.
+func ResolveDiffRange(ctx context.Context, root, baseSHA, target, source string) (base, head string) {
+	head = source
+	if source != "" && (!validRef(source) || !isCommit(ctx, root, source)) {
+		head = "HEAD"
+	}
+	var origin string
+	if target != "" && !strings.HasPrefix(target, "origin/") {
+		origin = "origin/" + target
+	}
+	for _, cand := range []string{baseSHA, origin, target} {
+		if cand == "" || !validRef(cand) {
+			continue
+		}
+		if _, err := runGit(ctx, root, false, "merge-base", cand, cmp.Or(head, "HEAD")); err == nil {
+			return cand, head
+		}
+	}
+	return "", head
+}
+
+// isCommit reports whether ref resolves to a commit in the repository.
+func isCommit(ctx context.Context, root, ref string) bool {
+	_, err := runGit(ctx, root, false, "rev-parse", "--verify", "--quiet", ref+"^{commit}")
+	return err == nil
+}
+
 // validPath guards the git_diff path argument: relative, no traversal, not an
 // option. It sits after "--" in argv so option injection is already blocked;
 // this also keeps the diff scoped inside the repository.
diff --git a/pkg/reviewer/direct/tools_review.go b/pkg/reviewer/direct/tools_review.go
index 9631ba7..57a413d 100644
--- a/pkg/reviewer/direct/tools_review.go
+++ b/pkg/reviewer/direct/tools_review.go
@@ -44,6 +44,7 @@ const (
 const (
 	toolSubmitReview = "submit_review"
 	toolAddIssues    = "add_issues"
+	toolSetGroup     = "set_group"
 
 	fSummary     = "summary"
 	fIsAccepted  = "isAccepted"
@@ -124,7 +125,7 @@ func (b *reviewBuilder) snapshot() (map[string]groupData, []rest.ReviewDraftIssu
 // small payload, called once per group.
 func setGroupTool(b *reviewBuilder) (ToolDef, Handler) {
 	def := ToolDef{
-		Name: "set_group",
+		Name: toolSetGroup,
 		Description: "Set one review group: its one-line summary, isAccepted, and full markdown body. " +
 			"Call once per group (architecture, code, security, tests, operability). Small payload — preferred over packing all groups into submit_review.",
 		Schema: objSchema(map[string]any{
diff --git a/pkg/reviewer/direct/types.go b/pkg/reviewer/direct/types.go
index 4beea29..e3fe816 100644
--- a/pkg/reviewer/direct/types.go
+++ b/pkg/reviewer/direct/types.go
@@ -30,10 +30,12 @@ type Message struct {
 	ToolResults []ToolResult
 
 	// Raw is an opaque, provider-native snapshot of an assistant turn used to
-	// replay it verbatim on later requests. The Anthropic provider stores the
-	// SDK MessageParam here so signed thinking blocks survive the round-trip
-	// (rebuilding from Text+ToolCalls alone would drop them). Nil for messages
-	// the loop creates itself; providers that don't set it just reconstruct.
+	// replay it verbatim on later requests, so reasoning survives the round-trip
+	// (Anthropic: SDK MessageParam with signed thinking blocks; OpenAI Responses:
+	// output items with encrypted reasoning). Rebuilding from Text+ToolCalls
+	// alone drops that reasoning. A snapshot is valid only for the history it
+	// was produced in — compaction clears it. Nil for messages the loop creates
+	// itself; providers that don't set it just reconstruct.
 	Raw any
 }
 
@@ -63,8 +65,9 @@ type Usage struct {
 }
 
 // Request is one provider call: stable system prompt + accumulated history + the
-// tool set. Effort is honoured by providers that support it (Anthropic), ignored
-// otherwise.
+// tool set. Effort, when set, is passed to Anthropic (output_config.effort),
+// OpenAI (Responses reasoning effort) and DeepSeek (reasoning_effort); other
+// OpenAI-compatible backends ignore it.
 type Request struct {
 	System   string
 	Messages []Message
@@ -81,8 +84,27 @@ type Response struct {
 
 	// Raw is the provider-native assistant turn (see Message.Raw). The loop
 	// copies it into the assistant Message it appends so the next request can
-	// replay it verbatim, preserving e.g. signed thinking blocks.
+	// replay it verbatim, preserving signed thinking / encrypted reasoning.
 	Raw any
+
+	// Retries holds the errors of transient failures the provider retried
+	// before this response, recorded in the transcript. Their partial usage is
+	// billed by the provider but not counted in Usage.
+	Retries []string
+}
+
+// SplitInput builds a Usage from OpenAI-style counters, where input includes the
+// cached and cache-written tokens, so InputTokens is the uncached remainder —
+// the Anthropic semantics Pricing.Cost expects.
+func SplitInput(input, cached, written, output int) Usage {
+	cached = min(max(cached, 0), input)
+	written = min(max(written, 0), input-cached)
+	return Usage{
+		InputTokens:      input - cached - written,
+		OutputTokens:     output,
+		CacheReadTokens:  cached,
+		CacheWriteTokens: written,
+	}
 }
 
 // sumUsage accumulates token counters across rounds.
diff --git a/pkg/reviewer/project.go b/pkg/reviewer/project.go
index 814072d..52acbf5 100644
--- a/pkg/reviewer/project.go
+++ b/pkg/reviewer/project.go
@@ -41,6 +41,16 @@ func (pm *ProjectManager) GetByKey(ctx context.Context, projectKey string) (*Pro
 	return NewProject(p), err
 }
 
+// TitleByKey returns the title of the project with projectKey, or "" when no
+// project matches. It loads the project row only, without its relations.
+func (pm *ProjectManager) TitleByKey(ctx context.Context, projectKey string) (string, error) {
+	p, err := pm.repo.OneProject(ctx, &db.ProjectSearch{ProjectKey: &projectKey}, db.WithColumns(db.TableColumns))
+	if err != nil || p == nil {
+		return "", err
+	}
+	return p.Title, nil
+}
+
 // resolvePrimaryProfile returns a project's primary runner profile: its pinned
 // profile, or the global default when none is pinned.
 func (pm *ProjectManager) resolvePrimaryProfile(ctx context.Context, p *db.Project) (*db.RunnerProfile, error) {
diff --git a/pkg/reviewer/run_metrics.go b/pkg/reviewer/run_metrics.go
new file mode 100644
index 0000000..62f46a9
--- /dev/null
+++ b/pkg/reviewer/run_metrics.go
@@ -0,0 +1,62 @@
+package reviewer
+
+import "github.com/prometheus/client_golang/prometheus"
+
+// Label values for runs whose project or runner is not known to reviewsrv, so a
+// client can't mint unbounded label values.
+const (
+	metricUnknownProject = "unknown"
+	metricOtherRunner    = "other"
+)
+
+// RunMetrics counts reviewctl runs on reviewsrv by outcome: an ok run when its
+// review is uploaded, any other run when its debug bundle arrives. A nil
+// *RunMetrics is a no-op.
+type RunMetrics struct {
+	runners map[string]bool
+	runs    *prometheus.CounterVec
+	cost    *prometheus.CounterVec
+}
+
+// NewRunMetrics builds the collectors; runners is the closed set of runner
+// names accepted as a label value (anything else is counted as "other").
+func NewRunMetrics(runners ...string) *RunMetrics {
+	m := &RunMetrics{
+		runners: make(map[string]bool, len(runners)),
+		runs: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name: "reviewer_runs_total",
+			Help: "reviewctl runs by project, runner, status (ok|failed|cancelled|timeout) and failure reason.",
+		}, []string{"project", "runner", "status", "reason"}),
+		cost: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name: "reviewer_run_cost_usd_total",
+			Help: "Dollars spent by reviewctl runs, by project, runner and status — incl. failed runs.",
+		}, []string{"project", "runner", "status"}),
+	}
+	for _, r := range runners {
+		m.runners[r] = true
+	}
+	return m
+}
+
+// Register adds the collectors to r.
+func (m *RunMetrics) Register(r prometheus.Registerer) {
+	r.MustRegister(m.runs, m.cost)
+}
+
+// Observe records one run. project is the project title ("" = unknown project);
+// status and reason must already be normalized (NormalizeRunOutcome).
+func (m *RunMetrics) Observe(project, runner, status, reason string, costUsd float64) {
+	if m == nil {
+		return
+	}
+	if project == "" {
+		project = metricUnknownProject
+	}
+	if !m.runners[runner] {
+		runner = metricOtherRunner
+	}
+	m.runs.WithLabelValues(project, runner, status, reason).Inc()
+	if costUsd > 0 {
+		m.cost.WithLabelValues(project, runner, status).Add(costUsd)
+	}
+}
diff --git a/pkg/reviewer/run_metrics_test.go b/pkg/reviewer/run_metrics_test.go
new file mode 100644
index 0000000..e99468c
--- /dev/null
+++ b/pkg/reviewer/run_metrics_test.go
@@ -0,0 +1,34 @@
+package reviewer
+
+import (
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// counterValue reads a counter without the (unvendored) testutil package.
+func counterValue(t *testing.T, c prometheus.Counter) float64 {
+	t.Helper()
+	var m dto.Metric
+	require.NoError(t, c.Write(&m))
+	return m.GetCounter().GetValue()
+}
+
+func TestRunMetricsObserve(t *testing.T) {
+	m := NewRunMetrics("claude", "direct")
+
+	m.Observe("demo", "direct", RunStatusFailed, RunReasonMaxRounds, 7.9)
+	m.Observe("demo", "direct", RunStatusFailed, RunReasonMaxRounds, 10.7)
+	m.Observe("", "rm -rf /", RunStatusFailed, RunReasonOther, 0)
+
+	assert.InDelta(t, 2, counterValue(t, m.runs.WithLabelValues("demo", "direct", RunStatusFailed, RunReasonMaxRounds)), 0)
+	assert.InDelta(t, 18.6, counterValue(t, m.cost.WithLabelValues("demo", "direct", RunStatusFailed)), 1e-9)
+	// Unknown projects and runners collapse into fixed label values.
+	assert.InDelta(t, 1, counterValue(t, m.runs.WithLabelValues(metricUnknownProject, metricOtherRunner, RunStatusFailed, RunReasonOther)), 0)
+
+	var nilMetrics *RunMetrics
+	assert.NotPanics(t, func() { nilMetrics.Observe("p", "claude", RunStatusOK, "", 1) })
+}
diff --git a/pkg/reviewer/run_outcome.go b/pkg/reviewer/run_outcome.go
new file mode 100644
index 0000000..2bf079b
--- /dev/null
+++ b/pkg/reviewer/run_outcome.go
@@ -0,0 +1,122 @@
+package reviewer
+
+import (
+	"context"
+	"errors"
+	"net/http"
+)
+
+// Status of a reviewctl run, reported with its debug bundle. The status and
+// reason sets are closed: reviewsrv turns them into Prometheus labels, so an
+// unknown client value is normalized (NormalizeRunOutcome), never trusted.
+const (
+	RunStatusOK        = "ok"
+	RunStatusFailed    = "failed"
+	RunStatusCancelled = "cancelled" // the CI job was cancelled — not a failure
+	RunStatusTimeout   = "timeout"
+)
+
+// Reasons of a non-ok run. Every reason but cancelled/timeout means RunStatusFailed.
+const (
+	RunReasonBilling      = "billing"       // provider credit balance exhausted
+	RunReasonAuth         = "auth"          // invalid or missing API key
+	RunReasonRateLimit    = "rate_limit"    // provider rate limit (after retries)
+	RunReasonAPIError     = "api_error"     // provider 5xx / overloaded / dropped stream (after retries)
+	RunReasonMaxRounds    = "max_rounds"    // direct: round budget exhausted without submit_review
+	RunReasonTruncated    = "truncated"     // direct: consecutive rounds cut by the output-token cap
+	RunReasonNotSubmitted = "not_submitted" // direct: the model stopped without submit_review
+	RunReasonCancelled    = "cancelled"
+	RunReasonTimeout      = "timeout"
+	RunReasonOther        = "other"
+)
+
+var failureReasons = map[string]bool{
+	RunReasonBilling:      true,
+	RunReasonAuth:         true,
+	RunReasonRateLimit:    true,
+	RunReasonAPIError:     true,
+	RunReasonMaxRounds:    true,
+	RunReasonTruncated:    true,
+	RunReasonNotSubmitted: true,
+	RunReasonOther:        true,
+}
+
+// ReasonForHTTPStatus maps the HTTP status of a failed API call to a
+// RunReason*: the fallback when the error names no more specific kind.
+func ReasonForHTTPStatus(code int) string {
+	switch {
+	case code == http.StatusPaymentRequired:
+		return RunReasonBilling
+	case code == http.StatusUnauthorized, code == http.StatusForbidden:
+		return RunReasonAuth
+	case code == http.StatusTooManyRequests:
+		return RunReasonRateLimit
+	case code >= http.StatusInternalServerError:
+		return RunReasonAPIError
+	}
+	return RunReasonOther
+}
+
+// RunError tags a runner failure with a RunReason* so the controller reports a
+// bounded reason without parsing the message. The message is the wrapped error's.
+type RunError struct {
+	Reason string
+	Err    error
+}
+
+func (e *RunError) Error() string { return e.Err.Error() }
+func (e *RunError) Unwrap() error { return e.Err }
+
+// WithRunReason tags err with a failure reason. A nil err or an empty reason
+// returns err unchanged.
+func WithRunReason(reason string, err error) error {
+	if err == nil || reason == "" {
+		return err
+	}
+	return &RunError{Reason: reason, Err: err}
+}
+
+// RunOutcome classifies the error of a run into a status and a reason. A
+// cancelled or expired context wins over any runner-reported reason: a job
+// cancelled mid-request surfaces as a transport error, not as a cancellation.
+func RunOutcome(err error) (status, reason string) {
+	var re *RunError
+	switch {
+	case err == nil:
+		return RunStatusOK, ""
+	case errors.Is(err, context.DeadlineExceeded):
+		return RunStatusTimeout, RunReasonTimeout
+	case errors.Is(err, context.Canceled):
+		return RunStatusCancelled, RunReasonCancelled
+	case errors.As(err, &re):
+		if re.Reason == RunReasonCancelled {
+			return RunStatusCancelled, RunReasonCancelled
+		}
+		if failureReasons[re.Reason] {
+			return RunStatusFailed, re.Reason
+		}
+	}
+	return RunStatusFailed, RunReasonOther
+}
+
+// NormalizeRunOutcome sanitizes a client-reported status/reason pair. Older
+// reviewctl builds send neither; the status then follows hasError.
+func NormalizeRunOutcome(status, reason string, hasError bool) (string, string) {
+	switch status {
+	case RunStatusOK:
+		return RunStatusOK, ""
+	case RunStatusCancelled:
+		return RunStatusCancelled, RunReasonCancelled
+	case RunStatusTimeout:
+		return RunStatusTimeout, RunReasonTimeout
+	case RunStatusFailed:
+	default:
+		if !hasError {
+			return RunStatusOK, ""
+		}
+	}
+	if !failureReasons[reason] {
+		reason = RunReasonOther
+	}
+	return RunStatusFailed, reason
+}
diff --git a/pkg/reviewer/run_outcome_test.go b/pkg/reviewer/run_outcome_test.go
new file mode 100644
index 0000000..86e2f76
--- /dev/null
+++ b/pkg/reviewer/run_outcome_test.go
@@ -0,0 +1,70 @@
+package reviewer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunOutcome(t *testing.T) {
+	billing := WithRunReason(RunReasonBilling, errors.New("billing_error: Credit balance is too low"))
+	tests := []struct {
+		name       string
+		err        error
+		wantStatus string
+		wantReason string
+	}{
+		{"nil", nil, RunStatusOK, ""},
+		{"plain error", errors.New("boom"), RunStatusFailed, RunReasonOther},
+		{"tagged", fmt.Errorf("run claude: %w", billing), RunStatusFailed, RunReasonBilling},
+		{"unknown tag", WithRunReason("weird", errors.New("x")), RunStatusFailed, RunReasonOther},
+		{"deadline", fmt.Errorf("round 3: %w", context.DeadlineExceeded), RunStatusTimeout, RunReasonTimeout},
+		{"cancelled ctx", fmt.Errorf("run: %w", context.Canceled), RunStatusCancelled, RunReasonCancelled},
+		{"signal tag", WithRunReason(RunReasonCancelled, errors.New("exit status 143")), RunStatusCancelled, RunReasonCancelled},
+		// A cancelled context wins over the reason the runner derived from the
+		// resulting transport error.
+		{"ctx wins over tag", WithRunReason(RunReasonAPIError, fmt.Errorf("stream: %w", context.Canceled)), RunStatusCancelled, RunReasonCancelled},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			status, reason := RunOutcome(tt.err)
+			assert.Equal(t, tt.wantStatus, status)
+			assert.Equal(t, tt.wantReason, reason)
+		})
+	}
+}
+
+func TestWithRunReasonKeepsNil(t *testing.T) {
+	require.NoError(t, WithRunReason(RunReasonBilling, nil))
+	err := errors.New("x")
+	assert.Same(t, err, WithRunReason("", err))
+}
+
+func TestNormalizeRunOutcome(t *testing.T) {
+	tests := []struct {
+		name               string
+		status, reason     string
+		hasError           bool
+		wantStatus, wantRs string
+	}{
+		{"ok drops reason", RunStatusOK, RunReasonBilling, false, RunStatusOK, ""},
+		{"failed keeps known reason", RunStatusFailed, RunReasonMaxRounds, true, RunStatusFailed, RunReasonMaxRounds},
+		{"failed unknown reason", RunStatusFailed, "rm -rf", true, RunStatusFailed, RunReasonOther},
+		{"cancelled", RunStatusCancelled, "", true, RunStatusCancelled, RunReasonCancelled},
+		{"timeout", RunStatusTimeout, "whatever", true, RunStatusTimeout, RunReasonTimeout},
+		{"legacy client with error", "", "", true, RunStatusFailed, RunReasonOther},
+		{"legacy client without error", "", "", false, RunStatusOK, ""},
+		{"garbage status with error", "boom", RunReasonAuth, true, RunStatusFailed, RunReasonAuth},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			status, reason := NormalizeRunOutcome(tt.status, tt.reason, tt.hasError)
+			assert.Equal(t, tt.wantStatus, status)
+			assert.Equal(t, tt.wantRs, reason)
+		})
+	}
+}
diff --git a/pkg/reviewer/runner/claude.go b/pkg/reviewer/runner/claude.go
index e3eb6d1..40374c8 100644
--- a/pkg/reviewer/runner/claude.go
+++ b/pkg/reviewer/runner/claude.go
@@ -36,6 +36,7 @@ type ClaudeResult struct {
 	NumTurns          int                       `json:"num_turns"`
 	SessionID         string                    `json:"session_id"`
 	IsError           bool                      `json:"is_error"`
+	APIErrorStatus    int                       `json:"api_error_status"` // HTTP status of a failed API call; 0 when absent
 	StopReason        string                    `json:"stop_reason"`
 	TerminalReason    string                    `json:"terminal_reason"`
 	PermissionDenials []any                     `json:"permission_denials"`
@@ -151,7 +152,9 @@ func parseResultObject(data []byte) (*ClaudeResult, error) {
 		return nil, fmt.Errorf("unexpected claude output type: %q", cr.Type)
 	}
 
-	if cr.Subtype == "error_max_turns" || cr.Subtype == directSubtypeError {
+	// Failure subtypes are "error" plus a growing error_* family
+	// (error_max_turns, error_during_execution, error_max_budget_usd, ...).
+	if strings.HasPrefix(cr.Subtype, directSubtypeError) {
 		return &cr, fmt.Errorf("claude returned error: %s", cr.Result)
 	}
 
@@ -160,7 +163,7 @@ func parseResultObject(data []byte) (*ClaudeResult, error) {
 
 // ToModelInfo converts ClaudeResult to db.ReviewModelInfo.
 // The fallback model name (CLI -m flag) is replaced by the full model id
-// from modelUsage when available — e.g. "opus" → "claude-opus-4-7".
+// from modelUsage when available — e.g. "opus" → "claude-opus-5-5".
 // The Runner field is left empty; callers set it from the runner that produced cr.
 func (cr *ClaudeResult) ToModelInfo(model string) db.ReviewModelInfo {
 	mi := db.ReviewModelInfo{
@@ -228,12 +231,17 @@ const (
 	RunnerCodex    = "codex"
 )
 
+// Names lists every runner identifier: the closed set a runner name is checked against.
+var Names = []string{RunnerClaude, RunnerOpenCode, RunnerCodex, RunnerDirect}
+
 // ReviewRunner abstracts the review LLM subprocess for testability.
 // Name returns a stable runner identifier (RunnerClaude | RunnerOpenCode) that
 // gets stored alongside model usage in db.ReviewModelInfo.
 //
 // Implementations normalize their CLI output into ClaudeResult — the name
-// stays for backwards compatibility with persisted records.
+// stays for backwards compatibility with persisted records. The usage and cost
+// in a Run's result cover that call only, even when it resumes a session:
+// callers add results across calls (Step 2 retry).
 type ReviewRunner interface {
 	Run(ctx context.Context, prompt string) (*ClaudeResult, error)
 	Name() string
@@ -293,6 +301,12 @@ func (r *ExecClaudeRunner) buildArgs() []string {
 		// as --output-format json, so ParseClaudeResult is unchanged downstream.
 		"--output-format", "stream-json", "--verbose",
 		"--permission-mode", "bypassPermissions",
+		// The working dir is the reviewed MR checkout: its .claude/settings.json
+		// (hooks, env, apiKeyHelper) and .mcp.json are attacker-controlled and
+		// would run with the job's secrets. Load user settings only (managed
+		// policy always applies) and no MCP servers.
+		"--setting-sources", "user",
+		"--strict-mcp-config",
 	}
 
 	if r.Model != "" {
@@ -300,8 +314,7 @@ func (r *ExecClaudeRunner) buildArgs() []string {
 	}
 
 	// Pass reasoning effort only when explicitly set; otherwise the CLI applies
-	// its own default (xhigh on Opus 4.7/4.8). Older claude CLIs that predate
-	// --effort would reject the flag, so opting in keeps them working.
+	// its own per-model default.
 	if r.Effort != "" {
 		args = append(args, "--effort", r.Effort)
 	}
@@ -453,12 +466,10 @@ func (r *ExecClaudeRunner) saveOutput(ctx context.Context, data []byte) {
 }
 
 func (r *ExecClaudeRunner) handleClaudeError(err error, stdout []byte, stderr string) (*ClaudeResult, error) {
-	if len(stdout) > 0 {
-		if cr, parseErr := ParseClaudeResult(stdout); parseErr == nil {
-			return cr, fmt.Errorf("claude exited with error: %w", err)
-		}
-	}
-	return nil, fmt.Errorf("claude exited with error: %w (stderr: %s)", err, truncate(stderr, 500))
+	// An error_* subtype comes back together with a parse error; keep the result
+	// anyway — its cost and usage are what the failed run billed.
+	cr, _ := ParseClaudeResult(stdout)
+	return cr, claudeRunError(err, cr, stdout, stderr)
 }
 
 func truncate(s string, maxLen int) string {
@@ -556,6 +567,17 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	log.InfoContext(ctx, "running "+binary, "dir", dir, "promptLen", len(prompt), "args", args)
 
 	out.err = cmd.Run()
+	// Killed by the context (runnerTimeout, the caller's deadline or a cancelled
+	// job): keep the cause in the chain so a timeout/cancel is not reported as a
+	// crash ("signal: killed").
+	if out.err != nil && ctx.Err() != nil {
+		out.err = fmt.Errorf("%w: %w", ctx.Err(), out.err)
+	}
+	// Stopped by SIGTERM/SIGINT from outside (a cancelled CI job reaches the
+	// runner before, or instead of, reviewctl itself): not a runner failure.
+	if isInterrupted(out.err) {
+		out.err = reviewer.WithRunReason(reviewer.RunReasonCancelled, out.err)
+	}
 	if lw != nil {
 		lw.flush() // emit a trailing line without a newline
 	}
diff --git a/pkg/reviewer/runner/claude_failure.go b/pkg/reviewer/runner/claude_failure.go
new file mode 100644
index 0000000..be6d392
--- /dev/null
+++ b/pkg/reviewer/runner/claude_failure.go
@@ -0,0 +1,133 @@
+package runner
+
+import (
+	"bytes"
+	"cmp"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"syscall"
+
+	"reviewsrv/pkg/reviewer"
+)
+
+// Claude Code error kinds: the top-level "error" of the synthetic assistant
+// event it emits for a failed API call (SDKAssistantMessageError).
+const (
+	claudeErrBilling   = "billing_error"
+	claudeErrAuth      = "authentication_failed"
+	claudeErrRateLimit = "rate_limit"
+	claudeErrServer    = "server_error"
+	claudeErrUnknown   = "unknown"
+)
+
+// claudeAPIErrorPrefix starts the result text of an API failure that Claude Code
+// could not classify (kind "unknown"), e.g. "API Error: Internal server error".
+const claudeAPIErrorPrefix = "API Error"
+
+// claudeRunError builds the error of a claude run that exited non-zero. The exit
+// status alone ("exit status 1") says nothing, so the API failure reported inside
+// the stream-json output — the last assistant "error" kind and the final result
+// (is_error, result text, api_error_status) — leads the message and picks the
+// RunReason. A SIGTERM/SIGINT exit is a cancelled CI job, not a failure; runExec
+// has already tagged it.
+func claudeRunError(err error, cr *ClaudeResult, stdout []byte, stderr string) error {
+	if isInterrupted(err) {
+		return fmt.Errorf("claude interrupted by a signal: %w", err)
+	}
+
+	kind, text := lastAssistantError(stdout)
+	status := 0
+	if cr != nil && cr.IsError {
+		text = cmp.Or(strings.TrimSpace(cr.Result), text)
+		status = cr.APIErrorStatus
+	}
+	if kind == "" && text == "" {
+		return fmt.Errorf("claude exited with error: %w (stderr: %s)", err, truncate(stderr, 500))
+	}
+
+	msg := text
+	if kind != "" && kind != claudeErrUnknown {
+		msg = kind + ": " + text
+	}
+	api := ""
+	if status > 0 {
+		api = fmt.Sprintf("api %d, ", status)
+	}
+	return reviewer.WithRunReason(claudeReason(kind, status, text), fmt.Errorf("%s (%sclaude %w)", msg, api, err))
+}
+
+// claudeReason maps a Claude Code error kind (falling back to the HTTP status and
+// the result text) to a RunReason.
+func claudeReason(kind string, status int, text string) string {
+	switch kind {
+	case claudeErrBilling:
+		return reviewer.RunReasonBilling
+	case claudeErrAuth:
+		return reviewer.RunReasonAuth
+	case claudeErrRateLimit:
+		return reviewer.RunReasonRateLimit
+	case claudeErrServer:
+		return reviewer.RunReasonAPIError
+	}
+	if r := reviewer.ReasonForHTTPStatus(status); r != reviewer.RunReasonOther {
+		return r
+	}
+	if strings.HasPrefix(text, claudeAPIErrorPrefix) {
+		return reviewer.RunReasonAPIError
+	}
+	return reviewer.RunReasonOther
+}
+
+// lastAssistantError returns the error kind and text of the last assistant event
+// carrying a top-level "error" in a stream-json output, or empty strings.
+func lastAssistantError(stdout []byte) (kind, text string) {
+	for line := range bytes.SplitSeq(stdout, []byte("\n")) {
+		line = bytes.TrimSpace(line)
+		// Cheap pre-filter: most lines are tool traffic without an error field.
+		if len(line) == 0 || line[0] != '{' || !bytes.Contains(line, []byte(`"error"`)) {
+			continue
+		}
+		var ev struct {
+			Type    string `json:"type"`
+			Error   string `json:"error"`
+			Message struct {
+				Content []struct {
+					Type string `json:"type"`
+					Text string `json:"text"`
+				} `json:"content"`
+			} `json:"message"`
+		}
+		if json.Unmarshal(line, &ev) != nil || ev.Type != "assistant" || ev.Error == "" {
+			continue
+		}
+		var sb strings.Builder
+		for _, c := range ev.Message.Content {
+			if c.Type == "text" {
+				sb.WriteString(c.Text)
+			}
+		}
+		kind, text = ev.Error, strings.TrimSpace(sb.String())
+	}
+	return kind, text
+}
+
+// isInterrupted reports whether a subprocess was stopped by SIGTERM/SIGINT —
+// killed outright ("signal: terminated") or exiting 128+signo after handling it
+// (143/130), as Claude Code does. In CI that is a cancelled job.
+func isInterrupted(err error) bool {
+	var ee *exec.ExitError
+	if !errors.As(err, &ee) {
+		return false
+	}
+	if ws, ok := ee.Sys().(syscall.WaitStatus); ok && ws.Signaled() {
+		return ws.Signal() == syscall.SIGTERM || ws.Signal() == syscall.SIGINT
+	}
+	switch ee.ExitCode() {
+	case 128 + int(syscall.SIGTERM), 128 + int(syscall.SIGINT):
+		return true
+	}
+	return false
+}
diff --git a/pkg/reviewer/runner/claude_failure_test.go b/pkg/reviewer/runner/claude_failure_test.go
new file mode 100644
index 0000000..5bf01f1
--- /dev/null
+++ b/pkg/reviewer/runner/claude_failure_test.go
@@ -0,0 +1,129 @@
+package runner
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"reviewsrv/pkg/reviewer"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Trimmed from real CI run outputs: the
+// synthetic assistant event Claude Code emits for a failed API call, then the
+// is_error result.
+const (
+	claudeBillingStream = `{"type":"system","subtype":"init","session_id":"s1","model":"claude-opus-4-8"}
+{"type":"assistant","message":{"model":"<synthetic>","role":"assistant","content":[{"type":"text","text":"Credit balance is too low"}]},"session_id":"s1","error":"billing_error"}
+{"type":"result","subtype":"success","is_error":true,"api_error_status":400,"duration_ms":943,"num_turns":1,"result":"Credit balance is too low","session_id":"s1","total_cost_usd":0,"usage":{}}
+`
+	claudeServerErrorStream = `{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"Read","input":{"file_path":"a.go"}}]},"session_id":"s2"}
+{"type":"assistant","message":{"model":"<synthetic>","role":"assistant","content":[{"type":"text","text":"API Error: Internal server error"}]},"session_id":"s2","error":"unknown"}
+{"type":"result","subtype":"success","is_error":true,"api_error_status":null,"num_turns":29,"result":"API Error: Internal server error","session_id":"s2","total_cost_usd":1.81118025,"usage":{}}
+`
+)
+
+// exitErr runs a shell that exits with code, yielding a real *exec.ExitError.
+func exitErr(t *testing.T, script string) error {
+	t.Helper()
+	err := exec.CommandContext(t.Context(), "sh", "-c", script).Run()
+	require.Error(t, err)
+	return err
+}
+
+func TestHandleClaudeErrorBilling(t *testing.T) {
+	r := &ExecClaudeRunner{}
+	cr, err := r.handleClaudeError(exitErr(t, "exit 1"), []byte(claudeBillingStream), "")
+	require.NotNil(t, cr)
+	require.Error(t, err)
+	// The cause leads the message: the debug list shows only its first 80 chars.
+	assert.True(t, strings.HasPrefix(err.Error(), "billing_error: Credit balance is too low (api 400, claude exit status 1)"), err.Error())
+	status, reason := reviewer.RunOutcome(err)
+	assert.Equal(t, reviewer.RunStatusFailed, status)
+	assert.Equal(t, reviewer.RunReasonBilling, reason)
+}
+
+func TestHandleClaudeErrorServerError(t *testing.T) {
+	r := &ExecClaudeRunner{}
+	cr, err := r.handleClaudeError(exitErr(t, "exit 1"), []byte(claudeServerErrorStream), "")
+	require.NotNil(t, cr)
+	assert.InDelta(t, 1.81118025, cr.TotalCostUSD, 1e-9, "the failed run's cost must survive for the debug bundle")
+	assert.Equal(t, "API Error: Internal server error (claude exit status 1)", err.Error())
+	_, reason := reviewer.RunOutcome(err)
+	assert.Equal(t, reviewer.RunReasonAPIError, reason)
+}
+
+func TestHandleClaudeErrorKeepsErrorSubtypeResult(t *testing.T) {
+	// error_* subtypes parse with an error; the result (and its cost) is kept.
+	stream := `{"type":"result","subtype":"error_max_turns","is_error":true,"result":"","total_cost_usd":2.5,"usage":{}}`
+	r := &ExecClaudeRunner{}
+	cr, err := r.handleClaudeError(exitErr(t, "exit 1"), []byte(stream), "boom")
+	require.NotNil(t, cr)
+	assert.InDelta(t, 2.5, cr.TotalCostUSD, 1e-9)
+	assert.Contains(t, err.Error(), "claude exited with error: exit status 1 (stderr: boom)")
+}
+
+func TestHandleClaudeErrorNoOutput(t *testing.T) {
+	r := &ExecClaudeRunner{}
+	cr, err := r.handleClaudeError(exitErr(t, "exit 1"), nil, "segfault")
+	assert.Nil(t, cr)
+	assert.Equal(t, "claude exited with error: exit status 1 (stderr: segfault)", err.Error())
+	_, reason := reviewer.RunOutcome(err)
+	assert.Equal(t, reviewer.RunReasonOther, reason)
+}
+
+func TestHandleClaudeErrorInterrupted(t *testing.T) {
+	r := &ExecClaudeRunner{}
+	// A cancelled CI job: Claude Code handles SIGTERM and exits 143, mid-run;
+	// runExec tags such an exit as cancelled.
+	exit := reviewer.WithRunReason(reviewer.RunReasonCancelled, exitErr(t, "exit 143"))
+	_, err := r.handleClaudeError(exit, []byte(`{"type":"system","subtype":"thinking_tokens"}`), "")
+	status, _ := reviewer.RunOutcome(err)
+	assert.Equal(t, reviewer.RunStatusCancelled, status)
+	assert.Contains(t, err.Error(), "interrupted")
+}
+
+func TestIsInterrupted(t *testing.T) {
+	assert.True(t, isInterrupted(exitErr(t, "exit 143")))
+	assert.True(t, isInterrupted(exitErr(t, "exit 130")))
+	assert.True(t, isInterrupted(exitErr(t, "kill -TERM $$")))
+	assert.False(t, isInterrupted(exitErr(t, "kill -KILL $$")), "SIGKILL is our own timeout kill, not a job cancel")
+	assert.False(t, isInterrupted(exitErr(t, "exit 1")))
+	assert.False(t, isInterrupted(errors.New("boom")))
+	assert.False(t, isInterrupted(nil))
+}
+
+func TestRunExecTagsContextCause(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	out := runExec(ctx, slog.New(slog.DiscardHandler), "sleep", t.TempDir(), []string{"5"}, "", nil, nil)
+	require.Error(t, out.err)
+	status, _ := reviewer.RunOutcome(out.err)
+	assert.Equal(t, reviewer.RunStatusCancelled, status)
+}
+
+func TestClaudeReason(t *testing.T) {
+	tests := []struct {
+		kind   string
+		status int
+		text   string
+		want   string
+	}{
+		{claudeErrBilling, 400, "Credit balance is too low", reviewer.RunReasonBilling},
+		{claudeErrAuth, 0, "", reviewer.RunReasonAuth},
+		{claudeErrUnknown, 401, "", reviewer.RunReasonAuth},
+		{claudeErrRateLimit, 0, "", reviewer.RunReasonRateLimit},
+		{claudeErrServer, 0, "", reviewer.RunReasonAPIError},
+		{claudeErrUnknown, 529, "", reviewer.RunReasonAPIError},
+		{claudeErrUnknown, 0, "API Error: Internal server error", reviewer.RunReasonAPIError},
+		{"invalid_request", 400, "prompt is too long", reviewer.RunReasonOther},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, claudeReason(tt.kind, tt.status, tt.text), "%s/%d/%s", tt.kind, tt.status, tt.text)
+	}
+}
diff --git a/pkg/reviewer/runner/claude_test.go b/pkg/reviewer/runner/claude_test.go
index 177074c..57a537f 100644
--- a/pkg/reviewer/runner/claude_test.go
+++ b/pkg/reviewer/runner/claude_test.go
@@ -52,6 +52,16 @@ func TestParseClaudeResult_Error(t *testing.T) {
 	assert.Equal(t, "error_max_turns", cr.Subtype)
 }
 
+func TestParseClaudeResult_ErrorSubtypes(t *testing.T) {
+	for _, subtype := range []string{"error", "error_during_execution", "error_max_budget_usd"} {
+		cr, err := ParseClaudeResult([]byte(`{"type":"result","subtype":"` + subtype + `","result":"boom"}`))
+		require.Error(t, err, subtype)
+		require.NotNil(t, cr, subtype)
+	}
+	_, err := ParseClaudeResult([]byte(`{"type":"result","subtype":"success","result":"ok"}`))
+	require.NoError(t, err)
+}
+
 func TestParseClaudeResult_InvalidJSON(t *testing.T) {
 	_, err := ParseClaudeResult([]byte("not json"))
 	require.Error(t, err)
@@ -186,6 +196,7 @@ func TestExecClaudeRunnerBuildArgs(t *testing.T) {
 		assert.Equal(t, []string{
 			"--print", "--output-format", "stream-json", "--verbose",
 			"--permission-mode", "bypassPermissions",
+			"--setting-sources", "user", "--strict-mcp-config",
 			"-p", "-",
 		}, args)
 	})
@@ -224,21 +235,23 @@ func TestExecClaudeRunnerBuildArgs(t *testing.T) {
 }
 
 func TestExecOpenCodeRunnerBuildArgs(t *testing.T) {
-	t.Run("default omits dangerous flag", func(t *testing.T) {
+	t.Run("default omits auto-approve flag", func(t *testing.T) {
 		r := &ExecOpenCodeRunner{}
-		assert.NotContains(t, r.buildArgs(), "--dangerously-skip-permissions")
+		assert.NotContains(t, r.buildArgs(), "--auto")
 	})
 
 	t.Run("dangerous permissions enabled", func(t *testing.T) {
 		r := &ExecOpenCodeRunner{AllowDangerousPermissions: true}
-		assert.Contains(t, r.buildArgs(), "--dangerously-skip-permissions")
+		args := r.buildArgs()
+		assert.Contains(t, args, "--auto")
+		assert.NotContains(t, args, "--dangerously-skip-permissions")
 	})
 
 	t.Run("with model", func(t *testing.T) {
-		r := &ExecOpenCodeRunner{Model: "anthropic/claude-opus-4-7"}
+		r := &ExecOpenCodeRunner{Model: "anthropic/claude-opus-5-5"}
 		args := r.buildArgs()
 		assert.Contains(t, args, "-m")
-		assert.Contains(t, args, "anthropic/claude-opus-4-7")
+		assert.Contains(t, args, "anthropic/claude-opus-5-5")
 	})
 
 	t.Run("continue beats session", func(t *testing.T) {
diff --git a/pkg/reviewer/runner/codex.go b/pkg/reviewer/runner/codex.go
index c5ba4f7..160e7c9 100644
--- a/pkg/reviewer/runner/codex.go
+++ b/pkg/reviewer/runner/codex.go
@@ -3,6 +3,7 @@ package runner
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"context"
 	"encoding/json"
 	"errors"
@@ -11,6 +12,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
+
+	"reviewsrv/pkg/reviewer/direct"
 )
 
 // Compile-time assertion that ExecCodexRunner satisfies ReviewRunner.
@@ -21,14 +25,20 @@ var _ ReviewRunner = (*ExecCodexRunner)(nil)
 // codex emits a JSONL event stream (`--json`): thread.started (session id),
 // item.started/command_execution (tool calls), item.completed/agent_message
 // (final text), turn.completed (token usage). codex does NOT report a dollar
-// cost, so it is estimated from tokens (see codexEstimateCostUSD). Note codex
+// cost, so it is estimated from tokens (see toClaudeResult). Note codex
 // input_tokens already include cached tokens — we split them out to match the
 // rest of the pipeline (InputTokens = fresh, CacheReadInputTokens = cached).
 //
 // The reviewer must write review.json + R*.md into the workspace, so codex runs
 // with the workspace-write sandbox (writes to the working dir, network disabled).
 type ExecCodexRunner struct {
-	Model           string
+	Model string
+	// Effort sets model_reasoning_effort; empty keeps the model's own default.
+	// Supported levels vary by model and codex does not validate them.
+	Effort string
+	// Sandbox overrides the sandbox mode (default codexSandbox). Use
+	// danger-full-access inside containers, where bubblewrap cannot start.
+	Sandbox         string
 	Dir             string
 	SessionID       string // if set, resumes the thread via `exec resume <id>`
 	ContinueSession bool   // codex has no auto-continue; kept for interface symmetry
@@ -36,10 +46,15 @@ type ExecCodexRunner struct {
 	// OPENAI_API_KEY when that env var is not already set (env wins).
 	Token string
 	// TrackerToken is injected as REVIEW_TRACKER_TOKEN (env wins; see
-	// ExecClaudeRunner). Codex's sandbox blocks network today, so it only
-	// matters if that changes.
+	// ExecClaudeRunner). The default workspace-write sandbox blocks network, so it
+	// only matters with a Sandbox that allows it (danger-full-access).
 	TrackerToken string
 	Log          *slog.Logger
+
+	// lastThreadID/lastUsage remember the previous run's cumulative usage so a
+	// resumed run of the same thread is billed for its own tokens only.
+	lastThreadID string
+	lastUsage    codexUsage
 }
 
 // Name implements ReviewRunner.
@@ -62,19 +77,20 @@ const codexExecCmd = "exec"
 // thread (round-2 follow-up); `exec resume` rejects --sandbox/--color, so the
 // sandbox is set via `-c sandbox_mode=...` there.
 func (r *ExecCodexRunner) buildArgs() []string {
+	sandbox := cmp.Or(r.Sandbox, codexSandbox)
 	var args []string
 	if r.SessionID != "" {
 		args = []string{
 			codexExecCmd, "resume", r.SessionID,
 			"--json",
 			"--skip-git-repo-check",
-			"-c", fmt.Sprintf("sandbox_mode=%q", codexSandbox),
+			"-c", fmt.Sprintf("sandbox_mode=%q", sandbox),
 		}
 	} else {
 		args = []string{
 			codexExecCmd,
 			"--json",
-			"--sandbox", codexSandbox,
+			"--sandbox", sandbox,
 			"--skip-git-repo-check",
 			"--color", "never",
 		}
@@ -82,6 +98,9 @@ func (r *ExecCodexRunner) buildArgs() []string {
 	if r.Model != "" {
 		args = append(args, "-m", r.Model)
 	}
+	if r.Effort != "" {
+		args = append(args, "-c", fmt.Sprintf("model_reasoning_effort=%q", r.Effort))
+	}
 	return append(args, "-") // prompt is read from stdin
 }
 
@@ -102,7 +121,7 @@ func (r *ExecCodexRunner) Run(ctx context.Context, prompt string) (*ClaudeResult
 		return nil, errors.New("codex produced empty output")
 	}
 
-	cr := ParseCodexResult(out.stdout.Bytes(), r.Model)
+	cr := r.result(parseCodexStream(out.stdout.Bytes()))
 	// codex can report a structured failure with a zero exit code; conversely a
 	// non-zero exit without a structured error is still a failure.
 	if out.err != nil {
@@ -117,6 +136,22 @@ func (r *ExecCodexRunner) Run(ctx context.Context, prompt string) (*ClaudeResult
 	return cr, nil
 }
 
+// result converts a parsed stream into this run's ClaudeResult. codex reports the
+// thread's cumulative usage, so resuming the thread of the previous run (the
+// Step 2 retry) subtracts that run's totals instead of billing them twice. A
+// thread resumed from another process (--session) has no baseline and still
+// reports the thread total.
+func (r *ExecCodexRunner) result(agg *codexAggregate) *ClaudeResult {
+	var base codexUsage
+	if r.SessionID == r.lastThreadID {
+		base = r.lastUsage
+	}
+	if agg.sessionID != "" {
+		r.lastThreadID, r.lastUsage = agg.sessionID, agg.usage
+	}
+	return agg.toClaudeResult(r.Model, base)
+}
+
 // logEvent surfaces a significant codex stream event to the runner log: tool
 // commands as they start, per-turn token usage, and structured failures. Invoked
 // per stdout line while codex streams.
@@ -179,16 +214,31 @@ func (r *ExecCodexRunner) saveOutput(ctx context.Context, data []byte) {
 	}
 }
 
+// codexUsage is codex token usage as reported by turn.completed: the thread's
+// cumulative total_token_usage, so after `exec resume` it includes every earlier
+// run of the thread. input includes the cached and cacheWrite tokens.
+type codexUsage struct {
+	input, cached, cacheWrite, output int
+}
+
+// since returns the usage accrued after base (a previous total of the thread).
+func (u codexUsage) since(base codexUsage) codexUsage {
+	return codexUsage{
+		input:      max(u.input-base.input, 0),
+		cached:     max(u.cached-base.cached, 0),
+		cacheWrite: max(u.cacheWrite-base.cacheWrite, 0),
+		output:     max(u.output-base.output, 0),
+	}
+}
+
 // codexAggregate accumulates state while scanning the codex `--json` stream.
 type codexAggregate struct {
-	text       strings.Builder
-	sessionID  string
-	turns      int
-	inputTotal int // includes cached
-	cached     int
-	output     int
-	isError    bool
-	errMsg     string
+	text      strings.Builder
+	sessionID string
+	turns     int
+	usage     codexUsage
+	isError   bool
+	errMsg    string
 }
 
 // applyLine folds one JSONL event into the aggregate.
@@ -222,16 +272,25 @@ func (a *codexAggregate) applyLine(line []byte) {
 	case "turn.completed":
 		var ev struct {
 			Usage struct {
-				InputTokens       int `json:"input_tokens"`
-				CachedInputTokens int `json:"cached_input_tokens"`
-				OutputTokens      int `json:"output_tokens"`
+				InputTokens           int `json:"input_tokens"`
+				CachedInputTokens     int `json:"cached_input_tokens"`
+				CacheWriteInputTokens int `json:"cache_write_input_tokens"`
+				OutputTokens          int `json:"output_tokens"`
 			} `json:"usage"`
 		}
 		if json.Unmarshal(line, &ev) == nil {
 			a.turns++
-			a.inputTotal += ev.Usage.InputTokens
-			a.cached += ev.Usage.CachedInputTokens
-			a.output += ev.Usage.OutputTokens
+			// Cumulative for the thread, so the last event wins.
+			a.usage = codexUsage{
+				input:      ev.Usage.InputTokens,
+				cached:     ev.Usage.CachedInputTokens,
+				cacheWrite: ev.Usage.CacheWriteInputTokens,
+				output:     ev.Usage.OutputTokens,
+			}
+			// codex also emits transient `error` events ("Reconnecting... 2/5")
+			// before a successful retry; a completed turn means it recovered.
+			a.isError = false
+			a.errMsg = ""
 		}
 	case "error":
 		var ev struct {
@@ -254,14 +313,13 @@ func (a *codexAggregate) applyLine(line []byte) {
 	}
 }
 
-func (a *codexAggregate) toClaudeResult(fallbackModel string) *ClaudeResult {
-	// codex input_tokens include cached; split so InputTokens is the fresh count.
-	cached := a.cached
-	if cached > a.inputTotal {
-		cached = a.inputTotal
-	}
-	freshInput := a.inputTotal - cached
-	cost := codexEstimateCostUSD(fallbackModel, freshInput, a.output, cached)
+// toClaudeResult bills the usage accrued since base (zero for a fresh thread).
+func (a *codexAggregate) toClaudeResult(fallbackModel string, base codexUsage) *ClaudeResult {
+	d := a.usage.since(base)
+	// codex input_tokens include cache reads and writes; codex reports no cost,
+	// so it is estimated from the shared price table (unknown models cost 0).
+	u := direct.SplitInput(d.input, d.cached, d.cacheWrite, d.output)
+	cost := direct.PricingFor(strings.TrimSpace(fallbackModel), time.Now()).Cost(u)
 
 	stop, subtype := "end_turn", directSubtypeSuccess
 	if a.isError {
@@ -277,31 +335,19 @@ func (a *codexAggregate) toClaudeResult(fallbackModel string) *ClaudeResult {
 		SessionID:    a.sessionID,
 		IsError:      a.isError,
 		StopReason:   stop,
-		Usage: ClaudeUsage{
-			InputTokens:          freshInput,
-			OutputTokens:         a.output,
-			CacheReadInputTokens: cached,
-		},
+		Usage:        claudeUsage(u),
 	}
 	if a.errMsg != "" && cr.Result == "" {
 		cr.Result = a.errMsg
 	}
 	if fallbackModel != "" {
-		cr.ModelUsage = map[string]ClaudeModelUse{
-			fallbackModel: {
-				InputTokens:          freshInput,
-				OutputTokens:         a.output,
-				CacheReadInputTokens: cached,
-				CostUSD:              cost,
-			},
-		}
+		cr.ModelUsage = map[string]ClaudeModelUse{fallbackModel: modelUse(u, cost)}
 	}
 	return cr
 }
 
-// ParseCodexResult aggregates the codex `--json` event stream into a ClaudeResult.
-// The fallback model names the run for cost estimation (codex reports no cost).
-func ParseCodexResult(data []byte, fallbackModel string) *ClaudeResult {
+// parseCodexStream folds the codex `--json` event stream into an aggregate.
+func parseCodexStream(data []byte) *codexAggregate {
 	var agg codexAggregate
 	sc := bufio.NewScanner(bytes.NewReader(data))
 	// Events can be large (long text chunks). Bump the buffer to 4 MiB to be safe.
@@ -313,44 +359,5 @@ func ParseCodexResult(data []byte, fallbackModel string) *ClaudeResult {
 		}
 		agg.applyLine(line)
 	}
-	return agg.toClaudeResult(fallbackModel)
-}
-
-// codexTokenPrice is the USD-per-MTok rate for a codex/OpenAI model. cached input
-// is a subset of input (the caller passes fresh and cached separately).
-type codexTokenPrice struct {
-	input, cachedInput, output float64
-}
-
-// codexModelPrices mirrors published OpenAI/codex token rates
-// (USD per 1M tokens). Unknown models estimate to 0 (cost reported as 0).
-var codexModelPrices = map[string]codexTokenPrice{
-	"codex-default":     {1.75, 0.175, 14.00},
-	"gpt-5.3-codex":     {1.75, 0.175, 14.00},
-	"gpt-5.2-codex":     {1.75, 0.175, 14.00},
-	"gpt-5.1-codex-max": {1.25, 0.125, 10.00},
-	"gpt-5.1-codex":     {1.25, 0.125, 10.00},
-	"gpt-5-codex":       {1.25, 0.125, 10.00},
-	"gpt-5.6":           {5.00, 0.50, 30.00}, // bare alias routes to Sol
-	"gpt-5.6-sol":       {5.00, 0.50, 30.00},
-	"gpt-5.6-terra":     {2.50, 0.25, 15.00},
-	"gpt-5.6-luna":      {1.00, 0.10, 6.00},
-	"gpt-5.5":           {5.00, 0.50, 30.00},
-	"gpt-5.5-pro":       {30.00, 30.00, 180.00},
-	"gpt-5.4":           {2.50, 0.25, 15.00},
-	"gpt-5.4-mini":      {0.75, 0.075, 4.50},
-	"gpt-5.4-nano":      {0.20, 0.02, 1.25},
-	"gpt-5.4-pro":       {30.00, 30.00, 180.00},
-}
-
-// codexEstimateCostUSD estimates a codex run's cost from tokens. freshInput must
-// exclude cached tokens (cached is billed at the lower cachedInput rate).
-func codexEstimateCostUSD(model string, freshInput, output, cached int) float64 {
-	p, ok := codexModelPrices[strings.TrimSpace(model)]
-	if !ok {
-		return 0
-	}
-	return (float64(freshInput)*p.input +
-		float64(cached)*p.cachedInput +
-		float64(output)*p.output) / 1_000_000
+	return &agg
 }
diff --git a/pkg/reviewer/runner/codex_test.go b/pkg/reviewer/runner/codex_test.go
index 3a89328..5210781 100644
--- a/pkg/reviewer/runner/codex_test.go
+++ b/pkg/reviewer/runner/codex_test.go
@@ -1,18 +1,24 @@
 package runner
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
+// parseCodexResult folds a codex `--json` stream of a fresh (non-resumed) run.
+func parseCodexResult(data []byte, model string) *ClaudeResult {
+	return parseCodexStream(data).toClaudeResult(model, codexUsage{})
+}
+
 func TestParseCodexResult(t *testing.T) {
 	stream := `{"type":"thread.started","thread_id":"th_abc"}
 {"type":"item.started","item":{"type":"command_execution","command":"git diff"}}
 {"type":"item.completed","item":{"type":"agent_message","text":"done"}}
 {"type":"turn.completed","usage":{"input_tokens":1000,"cached_input_tokens":200,"output_tokens":50}}
 `
-	cr := ParseCodexResult([]byte(stream), "gpt-5-codex")
+	cr := parseCodexResult([]byte(stream), "gpt-6-sol")
 	require.Equal(t, "th_abc", cr.SessionID)
 	require.Equal(t, "done", cr.Result)
 	require.Equal(t, 1, cr.NumTurns)
@@ -20,33 +26,74 @@ func TestParseCodexResult(t *testing.T) {
 	require.Equal(t, 200, cr.Usage.CacheReadInputTokens)
 	require.Equal(t, 50, cr.Usage.OutputTokens)
 	require.False(t, cr.IsError)
-	// (800*1.25 + 200*0.125 + 50*10) / 1e6
-	require.InDelta(t, 0.001525, cr.TotalCostUSD, 1e-9)
-	require.Contains(t, cr.ModelUsage, "gpt-5-codex")
+	// (800*2 + 200*0.2 + 50*10) / 1e6
+	require.InDelta(t, 0.00214, cr.TotalCostUSD, 1e-9)
+	require.Contains(t, cr.ModelUsage, "gpt-6-sol")
 }
 
 func TestParseCodexResultError(t *testing.T) {
 	stream := `{"type":"thread.started","thread_id":"th_x"}
 {"type":"turn.failed","error":{"message":"sandbox denied"}}
 `
-	cr := ParseCodexResult([]byte(stream), "")
+	cr := parseCodexResult([]byte(stream), "")
 	require.True(t, cr.IsError)
 	require.Equal(t, "error", cr.Subtype)
 	require.Equal(t, "sandbox denied", cr.Result)
 }
 
+func TestParseCodexResultTransientError(t *testing.T) {
+	t.Run("reconnect followed by a completed turn is not an error", func(t *testing.T) {
+		stream := `{"type":"thread.started","thread_id":"th_r"}
+{"type":"error","message":"Reconnecting... 2/5 (stream disconnected before completion)"}
+{"type":"item.completed","item":{"type":"agent_message","text":"done"}}
+{"type":"turn.completed","usage":{"input_tokens":100,"cached_input_tokens":0,"output_tokens":10}}
+`
+		cr := parseCodexResult([]byte(stream), "gpt-6-sol")
+		require.False(t, cr.IsError)
+		require.Equal(t, "done", cr.Result)
+	})
+
+	t.Run("error after the last completed turn stays an error", func(t *testing.T) {
+		stream := `{"type":"turn.completed","usage":{"input_tokens":100,"cached_input_tokens":0,"output_tokens":10}}
+{"type":"error","message":"stream disconnected: retries exhausted"}
+`
+		cr := parseCodexResult([]byte(stream), "gpt-6-sol")
+		require.True(t, cr.IsError)
+		require.Equal(t, "stream disconnected: retries exhausted", cr.Result)
+	})
+}
+
 func TestExecCodexRunnerBuildArgs(t *testing.T) {
 	t.Run("fresh run", func(t *testing.T) {
-		r := &ExecCodexRunner{Model: "gpt-5-codex"}
+		r := &ExecCodexRunner{Model: "gpt-6-sol"}
 		args := r.buildArgs()
 		require.Equal(t, "exec", args[0])
 		require.Contains(t, args, "--json")
 		require.Contains(t, args, "--sandbox")
 		require.Contains(t, args, "workspace-write")
 		require.Contains(t, args, "-m")
-		require.Contains(t, args, "gpt-5-codex")
+		require.Contains(t, args, "gpt-6-sol")
 		require.Equal(t, "-", args[len(args)-1])
 		require.NotContains(t, args, "resume")
+		require.NotContains(t, strings.Join(args, " "), "model_reasoning_effort") // model default
+	})
+
+	t.Run("sandbox override for containers", func(t *testing.T) {
+		args := (&ExecCodexRunner{Sandbox: "danger-full-access"}).buildArgs()
+		require.Contains(t, args, "danger-full-access")
+		require.NotContains(t, args, "workspace-write")
+
+		args = (&ExecCodexRunner{SessionID: "th_1", Sandbox: "danger-full-access"}).buildArgs()
+		require.Contains(t, args, `sandbox_mode="danger-full-access"`)
+	})
+
+	t.Run("effort is passed as a config override", func(t *testing.T) {
+		args := (&ExecCodexRunner{Effort: "high"}).buildArgs()
+		require.Contains(t, args, `model_reasoning_effort="high"`)
+		require.Equal(t, "-", args[len(args)-1])
+
+		args = (&ExecCodexRunner{SessionID: "th_1", Effort: "xhigh"}).buildArgs()
+		require.Contains(t, args, `model_reasoning_effort="xhigh"`)
 	})
 
 	t.Run("resume session", func(t *testing.T) {
@@ -59,10 +106,48 @@ func TestExecCodexRunnerBuildArgs(t *testing.T) {
 	})
 }
 
-func TestCodexEstimateCostUSD(t *testing.T) {
-	require.InDelta(t, 0.001525, codexEstimateCostUSD("gpt-5-codex", 800, 50, 200), 1e-9)
-	require.InDelta(t, 0.0028, codexEstimateCostUSD("gpt-5.6-terra", 800, 50, 200), 1e-9)
-	require.Zero(t, codexEstimateCostUSD("unknown-model", 1000, 100, 0))
+func TestParseCodexResultUnknownModelCostsZero(t *testing.T) {
+	stream := `{"type":"turn.completed","usage":{"input_tokens":1000,"cached_input_tokens":0,"output_tokens":100}}
+`
+	require.Zero(t, parseCodexResult([]byte(stream), "gpt-5-codex").TotalCostUSD) // shut down 2026-07-23
+	require.Zero(t, parseCodexResult([]byte(stream), "unknown-model").TotalCostUSD)
+}
+
+func TestParseCodexResultCacheWrite(t *testing.T) {
+	stream := `{"type":"turn.completed","usage":{"input_tokens":1000,"cached_input_tokens":200,"cache_write_input_tokens":300,"output_tokens":50,"reasoning_output_tokens":0}}
+`
+	cr := parseCodexResult([]byte(stream), "gpt-6-sol")
+	require.Equal(t, 500, cr.Usage.InputTokens) // 1000 - 200 cached - 300 written
+	require.Equal(t, 200, cr.Usage.CacheReadInputTokens)
+	require.Equal(t, 300, cr.Usage.CacheCreationInputTokens)
+	// (500*2 + 200*0.2 + 300*2.5 + 50*10) / 1e6
+	require.InDelta(t, 0.00229, cr.TotalCostUSD, 1e-9)
+}
+
+// Real codex 0.156 numbers: turn.completed reports the thread's cumulative
+// usage, so the resumed run (Step 2 retry) must bill only its own delta.
+func TestExecCodexRunnerResumeBillsDelta(t *testing.T) {
+	first := `{"type":"thread.started","thread_id":"th_1"}
+{"type":"turn.completed","usage":{"input_tokens":42992,"cached_input_tokens":37504,"cache_write_input_tokens":0,"output_tokens":208,"reasoning_output_tokens":12}}
+`
+	resumed := `{"type":"thread.started","thread_id":"th_1"}
+{"type":"turn.completed","usage":{"input_tokens":57532,"cached_input_tokens":44544,"cache_write_input_tokens":0,"output_tokens":214,"reasoning_output_tokens":12}}
+`
+	r := &ExecCodexRunner{Model: "gpt-6-sol"}
+	cr := r.result(parseCodexStream([]byte(first)))
+	require.Equal(t, 42992-37504, cr.Usage.InputTokens)
+	require.Equal(t, 208, cr.Usage.OutputTokens)
+
+	r.SetSession("th_1")
+	cr = r.result(parseCodexStream([]byte(resumed)))
+	require.Equal(t, 14540-7040, cr.Usage.InputTokens)
+	require.Equal(t, 7040, cr.Usage.CacheReadInputTokens)
+	require.Equal(t, 6, cr.Usage.OutputTokens)
+
+	// A different thread (or one resumed from another process) has no baseline.
+	r = &ExecCodexRunner{Model: "gpt-6-sol", SessionID: "th_other"}
+	cr = r.result(parseCodexStream([]byte(resumed)))
+	require.Equal(t, 214, cr.Usage.OutputTokens)
 }
 
 func TestExecCodexRunnerName(t *testing.T) {
diff --git a/pkg/reviewer/runner/direct.go b/pkg/reviewer/runner/direct.go
index c098484..1290acd 100644
--- a/pkg/reviewer/runner/direct.go
+++ b/pkg/reviewer/runner/direct.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"time"
 
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/direct"
 )
 
@@ -32,9 +33,14 @@ var _ ReviewRunner = (*DirectRunner)(nil)
 type DirectRunner struct {
 	Provider direct.LLMProvider
 	Dir      string
-	DiffBase string // git_diff default base (target branch)
-	DiffHead string // git_diff default head (source branch)
-	Effort   string
+	DiffBase string // target branch (CI_MERGE_REQUEST_TARGET_BRANCH_NAME)
+	DiffHead string // source branch (CI_MERGE_REQUEST_SOURCE_BRANCH_NAME)
+	// DiffBaseSHA is the MR diff base (CI_MERGE_REQUEST_DIFF_BASE_SHA), the
+	// preferred base: branch names often don't resolve in a CI clone.
+	DiffBaseSHA string
+	Effort      string
+	// MaxRounds overrides the loop's round budget; zero keeps the direct default.
+	MaxRounds int
 	// CompactAt overrides the loop's compaction threshold (estimated tokens);
 	// zero keeps the direct package default. Set to direct.CompactAtLargeContext
 	// for 1M-context providers so mid-run compaction (a full cache re-write)
@@ -60,26 +66,36 @@ func (r *DirectRunner) Run(ctx context.Context, prompt string) (*ClaudeResult, e
 	ctx, cancel := context.WithTimeout(ctx, runnerTimeout)
 	defer cancel()
 
+	// CI branch names rarely resolve in a CI clone; map them onto refs that do.
 	// Local runs carry no CI branch metadata; without a base the preload and the
 	// git_diff defaults degrade to "working tree vs HEAD" — an empty diff on a
 	// committed branch, and the model reviews the wrong thing. Detect the
 	// integration branch from git instead.
-	diffBase := r.DiffBase
+	diffBase, diffHead := direct.ResolveDiffRange(ctx, r.Dir, r.DiffBaseSHA, r.DiffBase, r.DiffHead)
 	if diffBase == "" {
 		if diffBase = direct.DetectBaseRef(ctx, r.Dir); diffBase != "" && r.Log != nil {
-			r.Log.InfoContext(ctx, "diff base not configured, detected from git", "base", diffBase)
+			r.Log.InfoContext(ctx, "diff base not resolved from CI metadata, detected from git", "base", diffBase, "target", r.DiffBase)
 		}
 	}
 
 	// Pre-load the diff and the full content of changed files into the kickoff so
 	// the model reviews from them instead of fanning out one read_file per turn.
 	// The pre-loaded paths seed read-dedup so the model isn't re-served them.
-	preloadBlock, preloadedPaths := direct.PreloadContext(ctx, r.Dir, diffBase, r.DiffHead)
+	preloadBlock, preloadedPaths := direct.PreloadContext(ctx, r.Dir, diffBase, diffHead)
+	if r.Log != nil {
+		if preloadBlock == "" {
+			// Without the preload a review takes several times the rounds and cost.
+			r.Log.WarnContext(ctx, "direct: diff preload is empty — the model will read every file itself",
+				"base", diffBase, "head", diffHead, "target", r.DiffBase, "source", r.DiffHead, "baseSha", r.DiffBaseSHA)
+		} else {
+			r.Log.InfoContext(ctx, "direct: diff preloaded", "base", diffBase, "head", diffHead, "files", len(preloadedPaths), "bytes", len(preloadBlock))
+		}
+	}
 
 	reg := direct.NewReviewRegistry(direct.ReviewToolsConfig{
 		Dir:            r.Dir,
 		DiffBase:       diffBase,
-		DiffHead:       r.DiffHead,
+		DiffHead:       diffHead,
 		PreloadedPaths: preloadedPaths,
 		Tracker:        r.Tracker,
 	})
@@ -94,6 +110,9 @@ func (r *DirectRunner) Run(ctx context.Context, prompt string) (*ClaudeResult, e
 
 	opts := direct.DefaultOptions()
 	opts.Effort = r.Effort
+	if r.MaxRounds > 0 {
+		opts.MaxRounds = r.MaxRounds
+	}
 	if r.CompactAt > 0 {
 		opts.CompactAt = r.CompactAt
 	}
@@ -133,7 +152,7 @@ func (r *DirectRunner) Run(ctx context.Context, prompt string) (*ClaudeResult, e
 		if r.Log != nil {
 			r.Log.ErrorContext(ctx, "direct: review not submitted", "stopReason", res.StopReason, "rounds", res.Rounds)
 		}
-		return cr, fmt.Errorf("direct: review not submitted (stop=%s)", res.StopReason)
+		return cr, reviewer.WithRunReason(reviewer.RunReasonNotSubmitted, fmt.Errorf("direct: review not submitted (stop=%s)", res.StopReason))
 	}
 	return cr, nil
 }
@@ -228,20 +247,28 @@ func directToClaudeResult(res *direct.Result) *ClaudeResult {
 		NumTurns:     res.Rounds,
 		StopReason:   res.StopReason,
 		IsError:      !res.Submitted,
-		Usage: ClaudeUsage{
-			InputTokens:              res.Usage.InputTokens,
-			OutputTokens:             res.Usage.OutputTokens,
-			CacheReadInputTokens:     res.Usage.CacheReadTokens,
-			CacheCreationInputTokens: res.Usage.CacheWriteTokens,
-		},
-		ModelUsage: map[string]ClaudeModelUse{
-			res.Model: {
-				InputTokens:              res.Usage.InputTokens,
-				OutputTokens:             res.Usage.OutputTokens,
-				CacheReadInputTokens:     res.Usage.CacheReadTokens,
-				CacheCreationInputTokens: res.Usage.CacheWriteTokens,
-				CostUSD:                  res.CostUsd,
-			},
-		},
+		Usage:        claudeUsage(res.Usage),
+		ModelUsage:   map[string]ClaudeModelUse{res.Model: modelUse(res.Usage, res.CostUsd)},
+	}
+}
+
+// claudeUsage maps direct token usage onto the ClaudeResult usage shape.
+func claudeUsage(u direct.Usage) ClaudeUsage {
+	return ClaudeUsage{
+		InputTokens:              u.InputTokens,
+		OutputTokens:             u.OutputTokens,
+		CacheReadInputTokens:     u.CacheReadTokens,
+		CacheCreationInputTokens: u.CacheWriteTokens,
+	}
+}
+
+// modelUse maps direct token usage and its cost onto a ClaudeResult.ModelUsage entry.
+func modelUse(u direct.Usage, cost float64) ClaudeModelUse {
+	return ClaudeModelUse{
+		InputTokens:              u.InputTokens,
+		OutputTokens:             u.OutputTokens,
+		CacheReadInputTokens:     u.CacheReadTokens,
+		CacheCreationInputTokens: u.CacheWriteTokens,
+		CostUSD:                  cost,
 	}
 }
diff --git a/pkg/reviewer/runner/opencode.go b/pkg/reviewer/runner/opencode.go
index c0e15c9..0b4bd48 100644
--- a/pkg/reviewer/runner/opencode.go
+++ b/pkg/reviewer/runner/opencode.go
@@ -19,6 +19,13 @@ import (
 // far below the overall runner budget.
 const exportTimeout = 60 * time.Second
 
+// opencodeProjectConfig lists the entries opencode loads from the working dir
+// and its ancestors up to the git root. In a reviewed MR checkout they are
+// attacker-controlled and execute code with the job's secrets: .opencode/
+// holds plugin/*.ts and a package.json that opencode npm-installs,
+// opencode.json(c) declares plugins, MCP commands, formatters and LSP servers.
+var opencodeProjectConfig = []string{".opencode", "opencode.json", "opencode.jsonc"}
+
 // ExecOpenCodeRunner runs the real opencode CLI subprocess.
 // Implements ReviewRunner so the rest of the controller stays runner-agnostic.
 //
@@ -30,9 +37,9 @@ type ExecOpenCodeRunner struct {
 	Dir             string
 	SessionID       string // if set, uses -s to continue a specific session
 	ContinueSession bool   // if true, uses -c to continue the last session
-	// AllowDangerousPermissions toggles `--dangerously-skip-permissions`, which
-	// disables interactive permission prompts. Required for unattended CI runs
-	// but should stay off when the reviewer config trusts the working tree less.
+	// AllowDangerousPermissions toggles `--auto`, which auto-approves every
+	// permission not explicitly denied. Required for unattended CI runs but should
+	// stay off when the reviewer config trusts the working tree less.
 	AllowDangerousPermissions bool
 	// TrackerToken is injected as REVIEW_TRACKER_TOKEN (env wins; see ExecClaudeRunner).
 	TrackerToken string
@@ -64,7 +71,7 @@ func (r *ExecOpenCodeRunner) buildArgs() []string {
 	}
 
 	if r.AllowDangerousPermissions {
-		args = append(args, "--dangerously-skip-permissions")
+		args = append(args, "--auto")
 	}
 
 	if r.Model != "" {
@@ -82,11 +89,24 @@ func (r *ExecOpenCodeRunner) buildArgs() []string {
 
 // Run executes `opencode run --format json` and parses the streamed events.
 func (r *ExecOpenCodeRunner) Run(ctx context.Context, prompt string) (*ClaudeResult, error) {
+	// OPENCODE_DISABLE_PROJECT_CONFIG only covers the legacy config loader: the
+	// session still boots the v2 one, which imports .opencode/plugin/*.ts and
+	// opencode.json plugins regardless of that flag or --pure (verified on
+	// 1.18.32). Nothing turns it off, so refuse a checkout that ships them.
+	cfgPath, err := findOpenCodeProjectConfig(r.Dir)
+	if err != nil {
+		return nil, fmt.Errorf("check opencode project config: %w", err)
+	}
+	if cfgPath != "" {
+		return nil, fmt.Errorf("refusing to run opencode: the checkout ships %s, and opencode would execute its plugins and commands with this job's secrets; review this repository with the claude or codex runner", cfgPath)
+	}
+
 	args := r.buildArgs()
 	// opencode reads its own stored provider credentials, so no API token is
 	// injected — only the tracker token the prompt references.
+	env := append(credEnv(envTrackerToken, r.TrackerToken), opencodeIsolationEnv()...)
 	// Surface significant events (tool calls, per-step usage) live as opencode streams.
-	out := runExec(ctx, r.Log, RunnerOpenCode, r.Dir, args, prompt, credEnv(envTrackerToken, r.TrackerToken), func(line []byte) { r.logEvent(ctx, line) })
+	out := runExec(ctx, r.Log, RunnerOpenCode, r.Dir, args, prompt, env, func(line []byte) { r.logEvent(ctx, line) })
 
 	r.saveOutput(ctx, out.stdout.Bytes())
 
@@ -172,14 +192,14 @@ func (r *ExecOpenCodeRunner) logEvent(ctx context.Context, line []byte) {
 	}
 }
 
-// resolveSessionModel enriches cr.ModelUsage when streaming events did not expose
-// the model — opencode v1.4.x omits it. Falls back to `opencode export <sessionID>`,
-// which reliably returns messages[*].info.model.
+// resolveSessionModel enriches cr.ModelUsage when neither -m nor the stream named
+// the model — opencode's step_finish events carry none. Falls back to
+// `opencode export <sessionID>`, which reliably returns messages[*].info.model.
 func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *ClaudeResult) {
 	if len(cr.ModelUsage) > 0 || cr.SessionID == "" {
 		return
 	}
-	name := fetchOpenCodeSessionModel(ctx, cr.SessionID)
+	name := fetchOpenCodeSessionModel(ctx, r.Dir, cr.SessionID)
 	if name == "" {
 		r.Log.WarnContext(ctx, "opencode session model not resolved", "sessionId", cr.SessionID)
 		return
@@ -199,7 +219,7 @@ func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *Claude
 // fetchOpenCodeSessionModel queries `opencode export <sessionID>` to extract
 // the model used in the session. Returns "" on any failure — caller must
 // treat the result as optional (it's a best-effort enrichment).
-func fetchOpenCodeSessionModel(ctx context.Context, sessionID string) string {
+func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string) string {
 	if sessionID == "" {
 		return ""
 	}
@@ -209,6 +229,12 @@ func fetchOpenCodeSessionModel(ctx context.Context, sessionID string) string {
 	// opencode's internal 128 KiB cap and arrive truncated, breaking json.Unmarshal.
 	// We only need messages[*].info.model, which --sanitize preserves.
 	cmd := exec.CommandContext(exportCtx, "opencode", "export", "--sanitize", sessionID)
+	// export boots an instance in its working dir and loads that project's
+	// plugins, so run it in the dir Run vetted, under the same isolation.
+	cmd.Dir = dir
+	if env := opencodeIsolationEnv(); len(env) > 0 {
+		cmd.Env = append(os.Environ(), env...)
+	}
 	out, err := cmd.Output()
 	if err != nil {
 		return ""
@@ -242,6 +268,47 @@ func fetchOpenCodeSessionModel(ctx context.Context, sessionID string) string {
 	return ""
 }
 
+// opencodeIsolationEnv keeps opencode on the operator's own config. Project
+// config (the legacy loader, plus AGENTS.md auto-loading) is off. Formatters
+// and LSP servers are off too, even if the operator's config enables them:
+// prettier and eslint run the repo's JS configs, rust-analyzer its build.rs.
+// Each var is only a default, like credEnv: the operator's env wins.
+func opencodeIsolationEnv() []string {
+	return append(credEnv("OPENCODE_DISABLE_PROJECT_CONFIG", "1"),
+		credEnv("OPENCODE_CONFIG_CONTENT", `{"formatter":false,"lsp":false}`)...)
+}
+
+// findOpenCodeProjectConfig returns the first opencodeProjectConfig entry found
+// in dir or its ancestors up to the enclosing git root (where opencode stops
+// looking), or "" if there is none.
+func findOpenCodeProjectConfig(dir string) (string, error) {
+	cur, err := filepath.Abs(dir)
+	if err != nil {
+		return "", err
+	}
+	for {
+		for _, name := range opencodeProjectConfig {
+			if p := filepath.Join(cur, name); pathExists(p) {
+				return p, nil
+			}
+		}
+		// .git is a dir in a clone and a file in a linked worktree.
+		if pathExists(filepath.Join(cur, ".git")) {
+			return "", nil
+		}
+		parent := filepath.Dir(cur)
+		if parent == cur {
+			return "", nil
+		}
+		cur = parent
+	}
+}
+
+func pathExists(p string) bool {
+	_, err := os.Lstat(p)
+	return err == nil
+}
+
 func (r *ExecOpenCodeRunner) logResult(ctx context.Context, cr *ClaudeResult) {
 	r.Log.InfoContext(ctx, "opencode result parsed",
 		"cost", cr.TotalCostUSD,
diff --git a/pkg/reviewer/runner/opencode_test.go b/pkg/reviewer/runner/opencode_test.go
index 6298f9d..78898f4 100644
--- a/pkg/reviewer/runner/opencode_test.go
+++ b/pkg/reviewer/runner/opencode_test.go
@@ -1,6 +1,9 @@
 package runner
 
 import (
+	"log/slog"
+	"os"
+	"path/filepath"
 	"slices"
 	"testing"
 
@@ -91,3 +94,68 @@ func TestOpenCodeBuildArgsPinsDir(t *testing.T) {
 	r = &ExecOpenCodeRunner{}
 	assert.NotContains(t, r.buildArgs(), "--dir", "no dir configured → no flag")
 }
+
+func TestFindOpenCodeProjectConfig(t *testing.T) {
+	// outer/.opencode sits above the git root: opencode stops before it.
+	outer := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(outer, ".opencode"), 0o755))
+	repo := filepath.Join(outer, "repo")
+	sub := filepath.Join(repo, "pkg")
+	require.NoError(t, os.MkdirAll(filepath.Join(repo, ".git"), 0o755))
+	require.NoError(t, os.MkdirAll(sub, 0o755))
+
+	t.Run("clean checkout", func(t *testing.T) {
+		p, err := findOpenCodeProjectConfig(sub)
+		require.NoError(t, err)
+		assert.Empty(t, p)
+	})
+
+	for _, name := range opencodeProjectConfig {
+		t.Run(name, func(t *testing.T) {
+			p := filepath.Join(repo, name)
+			if name == ".opencode" {
+				require.NoError(t, os.Mkdir(p, 0o755))
+			} else {
+				require.NoError(t, os.WriteFile(p, []byte("{}"), 0o644))
+			}
+			t.Cleanup(func() { _ = os.RemoveAll(p) })
+
+			got, err := findOpenCodeProjectConfig(sub)
+			require.NoError(t, err)
+			assert.Equal(t, p, got, "found from a subdir up to the git root")
+		})
+	}
+
+	t.Run("linked worktree root", func(t *testing.T) {
+		wt := filepath.Join(outer, "wt")
+		require.NoError(t, os.Mkdir(wt, 0o755))
+		require.NoError(t, os.WriteFile(filepath.Join(wt, ".git"), []byte("gitdir: /x/.git/worktrees/wt\n"), 0o644))
+
+		p, err := findOpenCodeProjectConfig(wt)
+		require.NoError(t, err)
+		assert.Empty(t, p, "a .git file ends the walk like a .git dir")
+	})
+}
+
+func TestExecOpenCodeRunnerRefusesProjectConfig(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".opencode", "plugin"), 0o755))
+
+	r := &ExecOpenCodeRunner{Dir: dir, Log: slog.New(slog.DiscardHandler)}
+	cr, err := r.Run(t.Context(), "review")
+	require.ErrorContains(t, err, "refusing to run opencode")
+	assert.Nil(t, cr)
+}
+
+func TestOpenCodeIsolationEnv(t *testing.T) {
+	t.Setenv("OPENCODE_DISABLE_PROJECT_CONFIG", "")
+	t.Setenv("OPENCODE_CONFIG_CONTENT", "")
+	assert.Equal(t, []string{
+		"OPENCODE_DISABLE_PROJECT_CONFIG=1",
+		`OPENCODE_CONFIG_CONTENT={"formatter":false,"lsp":false}`,
+	}, opencodeIsolationEnv())
+
+	t.Setenv("OPENCODE_CONFIG_CONTENT", `{"share":"disabled"}`)
+	assert.Equal(t, []string{"OPENCODE_DISABLE_PROJECT_CONFIG=1"}, opencodeIsolationEnv(), "the operator's env wins")
+}
diff --git a/pkg/vt/runner_profile.go b/pkg/vt/runner_profile.go
index 1dfaa53..d6f4b4b 100644
--- a/pkg/vt/runner_profile.go
+++ b/pkg/vt/runner_profile.go
@@ -2,6 +2,7 @@ package vt
 
 import (
 	"context"
+	"slices"
 
 	"reviewsrv/pkg/db"
 	"reviewsrv/pkg/reviewer/direct"
@@ -13,10 +14,9 @@ import (
 
 // Allowed enum values for a runner profile, validated here so the admin can't save
 // an unusable profile. Runners and providers reuse the canonical sources of truth
-// (runner.Runner* constants and direct.IsValidProvider); efforts have no shared
+// (runner.Names and direct.IsValidProvider); efforts have no shared
 // constant and stay in sync with the runner's effort handling by hand.
 var (
-	validRunners = map[string]bool{runner.RunnerClaude: true, runner.RunnerOpenCode: true, runner.RunnerCodex: true, runner.RunnerDirect: true}
 	//nolint:goconst // "max" here is an effort level, not the FieldErrorMax error code
 	validEfforts = map[string]bool{"low": true, "medium": true, "high": true, "xhigh": true, "max": true}
 )
@@ -215,7 +215,7 @@ func (s RunnerProfileService) isValid(ctx context.Context, runnerProfile RunnerP
 	}
 
 	// custom validation starts here
-	if runnerProfile.Runner != "" && !validRunners[runnerProfile.Runner] {
+	if runnerProfile.Runner != "" && !slices.Contains(runner.Names, runnerProfile.Runner) {
 		v.Append("runner", FieldErrorIncorrect)
 	}
 	if runnerProfile.APIProvider != nil && *runnerProfile.APIProvider != "" && !direct.IsValidProvider(*runnerProfile.APIProvider) {
@@ -224,6 +224,9 @@ func (s RunnerProfileService) isValid(ctx context.Context, runnerProfile RunnerP
 	if runnerProfile.Effort != nil && *runnerProfile.Effort != "" && !validEfforts[*runnerProfile.Effort] {
 		v.Append("effort", FieldErrorIncorrect)
 	}
+	if n := runnerProfile.Params.MaxRounds; n != 0 && !direct.IsValidMaxRounds(n) {
+		v.Append("params.maxRounds", FieldErrorIncorrect)
+	}
 
 	return v
 }
diff --git a/pkg/vt/runner_profile_model.go b/pkg/vt/runner_profile_model.go
index 84fb056..a48988b 100644
--- a/pkg/vt/runner_profile_model.go
+++ b/pkg/vt/runner_profile_model.go
@@ -28,14 +28,15 @@ type RunnerProfile struct {
 // produces invalid TS).
 type RunnerProfileParams struct {
 	AllowDangerousPermissions bool `json:"allowDangerousPermissions"`
+	MaxRounds                 int  `json:"maxRounds"` // direct runner round budget; 0 = default
 }
 
 func NewRunnerProfileParams(in db.RunnerProfileParams) RunnerProfileParams {
-	return RunnerProfileParams{AllowDangerousPermissions: in.AllowDangerousPermissions}
+	return RunnerProfileParams(in)
 }
 
 func (p RunnerProfileParams) ToDB() db.RunnerProfileParams {
-	return db.RunnerProfileParams{AllowDangerousPermissions: p.AllowDangerousPermissions}
+	return db.RunnerProfileParams(p)
 }
 
 func (rp *RunnerProfile) ToDB() *db.RunnerProfile {
diff --git a/pkg/vt/vt_zenrpc.go b/pkg/vt/vt_zenrpc.go
index c2b552d..1b3e7ea 100644
--- a/pkg/vt/vt_zenrpc.go
+++ b/pkg/vt/vt_zenrpc.go
@@ -1,4 +1,4 @@
-// Code generated by zenrpc v2.3.1; DO NOT EDIT.
+// Code generated by zenrpc v2.3.3; DO NOT EDIT.
 
 package vt
 
@@ -4746,6 +4746,11 @@ func (RunnerProfileService) SMD() smd.ServiceInfo {
 									Name: "allowDangerousPermissions",
 									Type: smd.Boolean,
 								},
+								{
+									Name:        "maxRounds",
+									Description: `direct runner round budget; 0 = default`,
+									Type:        smd.Integer,
+								},
 							},
 						},
 						"Status": {
@@ -4857,6 +4862,11 @@ func (RunnerProfileService) SMD() smd.ServiceInfo {
 										Name: "allowDangerousPermissions",
 										Type: smd.Boolean,
 									},
+									{
+										Name:        "maxRounds",
+										Description: `direct runner round budget; 0 = default`,
+										Type:        smd.Integer,
+									},
 								},
 							},
 							"Status": {
@@ -4961,6 +4971,11 @@ func (RunnerProfileService) SMD() smd.ServiceInfo {
 									Name: "allowDangerousPermissions",
 									Type: smd.Boolean,
 								},
+								{
+									Name:        "maxRounds",
+									Description: `direct runner round budget; 0 = default`,
+									Type:        smd.Integer,
+								},
 							},
 						},
 						"Status": {
@@ -5071,6 +5086,11 @@ func (RunnerProfileService) SMD() smd.ServiceInfo {
 										Name: "allowDangerousPermissions",
 										Type: smd.Boolean,
 									},
+									{
+										Name:        "maxRounds",
+										Description: `direct runner round budget; 0 = default`,
+										Type:        smd.Integer,
+									},
 								},
 							},
 							"Status": {
@@ -5208,6 +5228,11 @@ func (RunnerProfileService) SMD() smd.ServiceInfo {
 										Name: "allowDangerousPermissions",
 										Type: smd.Boolean,
 									},
+									{
+										Name:        "maxRounds",
+										Description: `direct runner round budget; 0 = default`,
+										Type:        smd.Integer,
+									},
 								},
 							},
 							"Status": {
diff --git a/vendor/github.com/sashabaranov/go-openai/.codecov.yml b/vendor/github.com/sashabaranov/go-openai/.codecov.yml
index 8177366..bcb1e66 100644
--- a/vendor/github.com/sashabaranov/go-openai/.codecov.yml
+++ b/vendor/github.com/sashabaranov/go-openai/.codecov.yml
@@ -2,3 +2,11 @@ coverage:
   ignore:
     - "examples/**"
     - "internal/test/**"
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 2%
+    patch:
+      default:
+        target: 80%
diff --git a/vendor/github.com/sashabaranov/go-openai/.gitignore b/vendor/github.com/sashabaranov/go-openai/.gitignore
index b0ac160..aa5f341 100644
--- a/vendor/github.com/sashabaranov/go-openai/.gitignore
+++ b/vendor/github.com/sashabaranov/go-openai/.gitignore
@@ -19,4 +19,6 @@
 .idea
 
 # Generated by tests
-test.mp3
\ No newline at end of file
+test.mp3
+
+.env
diff --git a/vendor/github.com/sashabaranov/go-openai/.golangci.yml b/vendor/github.com/sashabaranov/go-openai/.golangci.yml
index 6391ad7..cd9036f 100644
--- a/vendor/github.com/sashabaranov/go-openai/.golangci.yml
+++ b/vendor/github.com/sashabaranov/go-openai/.golangci.yml
@@ -22,7 +22,7 @@ linters:
     - gocyclo
     - godot
     - gomoddirectives
-    - gomodguard
+    - gomodguard_v2
     - goprintffuncname
     - gosec
     - govet
@@ -66,21 +66,20 @@ linters:
           paramsOnly: false
         underef:
           skipRecvDeref: false
-    gomodguard:
+    gomodguard_v2:
       blocked:
-        modules:
-          - github.com/golang/protobuf:
-              recommendations:
-                - google.golang.org/protobuf
-              reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
-          - github.com/satori/go.uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: satori's package is not maintained
-          - github.com/gofrs/uuid:
-              recommendations:
-                - github.com/google/uuid
-              reason: 'see recommendation from dev-infra team: https://confluence.gtforge.com/x/gQI6Aw'
+        - module: github.com/golang/protobuf
+          recommendations:
+            - google.golang.org/protobuf
+          reason: see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
+        - module: github.com/satori/go.uuid
+          recommendations:
+            - github.com/google/uuid
+          reason: satori's package is not maintained
+        - module: github.com/gofrs/uuid
+          recommendations:
+            - github.com/google/uuid
+          reason: 'see recommendation from dev-infra team: https://confluence.gtforge.com/x/gQI6Aw'
     govet:
       disable:
         - fieldalignment
diff --git a/vendor/github.com/sashabaranov/go-openai/README.md b/vendor/github.com/sashabaranov/go-openai/README.md
index 77b85e5..52af0a0 100644
--- a/vendor/github.com/sashabaranov/go-openai/README.md
+++ b/vendor/github.com/sashabaranov/go-openai/README.md
@@ -1,913 +1,216 @@
 # Go OpenAI
+
 [![Go Reference](https://pkg.go.dev/badge/github.com/sashabaranov/go-openai.svg)](https://pkg.go.dev/github.com/sashabaranov/go-openai)
 [![Go Report Card](https://goreportcard.com/badge/github.com/sashabaranov/go-openai)](https://goreportcard.com/report/github.com/sashabaranov/go-openai)
 [![codecov](https://codecov.io/gh/sashabaranov/go-openai/branch/master/graph/badge.svg?token=bCbIfHLIsW)](https://codecov.io/gh/sashabaranov/go-openai)
 
-This library provides unofficial Go clients for [OpenAI API](https://platform.openai.com/). We support: 
+An unofficial Go client for the [OpenAI API](https://developers.openai.com/api/docs/overview).
+
+For new text-generation, reasoning, tool-calling, and multi-turn integrations,
+start with the [Responses API](https://developers.openai.com/api/docs/guides/migrate-to-responses).
+Chat Completions remains available for existing integrations.
 
-* ChatGPT 4o, o1
-* GPT-3, GPT-4
-* DALL·E 2, DALL·E 3, GPT Image 1
-* Whisper
+The client also covers embeddings, images, audio, moderation, files, fine-tuning,
+batches, vector stores, and legacy Assistants API surfaces.
 
 ## Installation
 
-```
+```sh
 go get github.com/sashabaranov/go-openai
 ```
-Currently, go-openai requires Go version 1.18 or greater.
-
-
-## Usage
-
-### ChatGPT example usage:
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-	openai "github.com/sashabaranov/go-openai"
-)
 
-func main() {
-	client := openai.NewClient("your token")
-	resp, err := client.CreateChatCompletion(
-		context.Background(),
-		openai.ChatCompletionRequest{
-			Model: openai.GPT3Dot5Turbo,
-			Messages: []openai.ChatCompletionMessage{
-				{
-					Role:    openai.ChatMessageRoleUser,
-					Content: "Hello!",
-				},
-			},
-		},
-	)
+Go OpenAI requires Go 1.18 or later.
 
-	if err != nil {
-		fmt.Printf("ChatCompletion error: %v\n", err)
-		return
-	}
+## Quick start: Responses API
 
-	fmt.Println(resp.Choices[0].Message.Content)
-}
+Set an [OpenAI API key](https://platform.openai.com/api-keys) in your environment:
 
+```sh
+export OPENAI_API_KEY="<your key>"
 ```
 
-### Getting an OpenAI API Key:
-
-1. Visit the OpenAI website at [https://platform.openai.com/account/api-keys](https://platform.openai.com/account/api-keys).
-2. If you don't have an account, click on "Sign Up" to create one. If you do, click "Log In".
-3. Once logged in, navigate to your API key management page.
-4. Click on "Create new secret key".
-5. Enter a name for your new key, then click "Create secret key".
-6. Your new API key will be displayed. Use this key to interact with the OpenAI API.
-
-**Note:** Your API key is sensitive information. Do not share it with anyone.
-
-### Other examples:
-
-<details>
-<summary>ChatGPT streaming completion</summary>
+Then create a response and read its generated text:
 
 ```go
 package main
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"io"
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	req := openai.ChatCompletionRequest{
-		Model:     openai.GPT3Dot5Turbo,
-		MaxTokens: 20,
-		Messages: []openai.ChatCompletionMessage{
-			{
-				Role:    openai.ChatMessageRoleUser,
-				Content: "Lorem ipsum",
-			},
-		},
-		Stream: true,
-	}
-	stream, err := c.CreateChatCompletionStream(ctx, req)
-	if err != nil {
-		fmt.Printf("ChatCompletionStream error: %v\n", err)
-		return
-	}
-	defer stream.Close()
-
-	fmt.Printf("Stream response: ")
-	for {
-		response, err := stream.Recv()
-		if errors.Is(err, io.EOF) {
-			fmt.Println("\nStream finished")
-			return
-		}
-
-		if err != nil {
-			fmt.Printf("\nStream error: %v\n", err)
-			return
-		}
-
-		fmt.Printf(response.Choices[0].Delta.Content)
-	}
-}
-```
-</details>
-
-<details>
-<summary>GPT-3 completion</summary>
-
-```go
-package main
+	"log"
+	"os"
 
-import (
-	"context"
-	"fmt"
 	openai "github.com/sashabaranov/go-openai"
 )
 
 func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	req := openai.CompletionRequest{
-		Model:     openai.GPT3Babbage002,
-		MaxTokens: 5,
-		Prompt:    "Lorem ipsum",
-	}
-	resp, err := c.CreateCompletion(ctx, req)
-	if err != nil {
-		fmt.Printf("Completion error: %v\n", err)
-		return
-	}
-	fmt.Println(resp.Choices[0].Text)
-}
-```
-</details>
-
-<details>
-<summary>GPT-3 streaming completion</summary>
-
-```go
-package main
+	client := openai.NewClient(os.Getenv("OPENAI_API_KEY"))
 
-import (
-	"errors"
-	"context"
-	"fmt"
-	"io"
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	req := openai.CompletionRequest{
-		Model:     openai.GPT3Babbage002,
-		MaxTokens: 5,
-		Prompt:    "Lorem ipsum",
-		Stream:    true,
-	}
-	stream, err := c.CreateCompletionStream(ctx, req)
+	response, err := client.CreateResponse(context.Background(), openai.CreateResponseRequest{
+		Model:        openai.GPT5Dot6Sol,
+		Instructions: "You are a concise technical explainer.",
+		Input:        "Why is the sky blue?",
+	})
 	if err != nil {
-		fmt.Printf("CompletionStream error: %v\n", err)
-		return
+		log.Fatal(err)
 	}
-	defer stream.Close()
-
-	for {
-		response, err := stream.Recv()
-		if errors.Is(err, io.EOF) {
-			fmt.Println("Stream finished")
-			return
-		}
 
-		if err != nil {
-			fmt.Printf("Stream error: %v\n", err)
-			return
-		}
-
-
-		fmt.Printf("Stream response: %v\n", response)
-	}
+	fmt.Println(response.GetOutputText())
 }
 ```
-</details>
 
-<details>
-<summary>Audio Speech-To-Text</summary>
+`Input` can be a string or a slice of typed input items. For reasoning, tools,
+multimodal output, or custom processing, inspect `response.Output` instead of
+using the `GetOutputText` convenience method.
 
-```go
-package main
+### Continue a conversation
 
-import (
-	"context"
-	"fmt"
-
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	req := openai.AudioRequest{
-		Model:    openai.Whisper1,
-		FilePath: "recording.mp3",
-	}
-	resp, err := c.CreateTranscription(ctx, req)
-	if err != nil {
-		fmt.Printf("Transcription error: %v\n", err)
-		return
-	}
-	fmt.Println(resp.Text)
-}
-```
-</details>
-
-<details>
-<summary>Audio Captions</summary>
+Use `PreviousResponseID` when OpenAI should carry the earlier response context.
+Resend `Instructions` on each call when they should continue to apply.
 
 ```go
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	openai "github.com/sashabaranov/go-openai"
-)
+store := true
 
-func main() {
-	c := openai.NewClient(os.Getenv("OPENAI_KEY"))
-
-	req := openai.AudioRequest{
-		Model:    openai.Whisper1,
-		FilePath: os.Args[1],
-		Format:   openai.AudioResponseFormatSRT,
-	}
-	resp, err := c.CreateTranscription(context.Background(), req)
-	if err != nil {
-		fmt.Printf("Transcription error: %v\n", err)
-		return
-	}
-	f, err := os.Create(os.Args[1] + ".srt")
-	if err != nil {
-		fmt.Printf("Could not open file: %v\n", err)
-		return
-	}
-	defer f.Close()
-	if _, err := f.WriteString(resp.Text); err != nil {
-		fmt.Printf("Error writing to file: %v\n", err)
-		return
-	}
+first, err := client.CreateResponse(ctx, openai.CreateResponseRequest{
+	Model:        openai.GPT5Dot6Sol,
+	Instructions: "Answer as a travel guide.",
+	Input:        "What should I see in Lisbon?",
+	Store:        &store,
+})
+if err != nil {
+	return err
 }
-```
-</details>
-
-<details>
-<summary>DALL-E 2 image generation</summary>
-
-```go
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"fmt"
-	openai "github.com/sashabaranov/go-openai"
-	"image/png"
-	"os"
-)
-
-func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	// Sample image by link
-	reqUrl := openai.ImageRequest{
-		Prompt:         "Parrot on a skateboard performs a trick, cartoon style, natural light, high detail",
-		Size:           openai.CreateImageSize256x256,
-		ResponseFormat: openai.CreateImageResponseFormatURL,
-		N:              1,
-	}
 
-	respUrl, err := c.CreateImage(ctx, reqUrl)
-	if err != nil {
-		fmt.Printf("Image creation error: %v\n", err)
-		return
-	}
-	fmt.Println(respUrl.Data[0].URL)
-
-	// Example image as base64
-	reqBase64 := openai.ImageRequest{
-		Prompt:         "Portrait of a humanoid parrot in a classic costume, high detail, realistic light, unreal engine",
-		Size:           openai.CreateImageSize256x256,
-		ResponseFormat: openai.CreateImageResponseFormatB64JSON,
-		N:              1,
-	}
-
-	respBase64, err := c.CreateImage(ctx, reqBase64)
-	if err != nil {
-		fmt.Printf("Image creation error: %v\n", err)
-		return
-	}
-
-	imgBytes, err := base64.StdEncoding.DecodeString(respBase64.Data[0].B64JSON)
-	if err != nil {
-		fmt.Printf("Base64 decode error: %v\n", err)
-		return
-	}
-
-	r := bytes.NewReader(imgBytes)
-	imgData, err := png.Decode(r)
-	if err != nil {
-		fmt.Printf("PNG decode error: %v\n", err)
-		return
-	}
-
-	file, err := os.Create("example.png")
-	if err != nil {
-		fmt.Printf("File creation error: %v\n", err)
-		return
-	}
-	defer file.Close()
-
-	if err := png.Encode(file, imgData); err != nil {
-		fmt.Printf("PNG encode error: %v\n", err)
-		return
-	}
-
-	fmt.Println("The image was saved as example.png")
+second, err := client.CreateResponse(ctx, openai.CreateResponseRequest{
+	Model:              openai.GPT5Dot6Sol,
+	Instructions:       "Answer as a travel guide.",
+	Input:              "Which one is best on a rainy day?",
+	PreviousResponseID: first.ID,
+	Store:              &store,
+})
+if err != nil {
+	return err
 }
 
+fmt.Println(second.GetOutputText())
 ```
-</details>
 
-<details>
-<summary>GPT Image 1 image generation</summary>
+### Stream output
 
 ```go
-package main
-
-import (
-	"context"
-	"encoding/base64"
-	"fmt"
-	"os"
-
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	c := openai.NewClient("your token")
-	ctx := context.Background()
-
-	req := openai.ImageRequest{
-		Prompt:            "Parrot on a skateboard performing a trick. Large bold text \"SKATE MASTER\" banner at the bottom of the image. Cartoon style, natural light, high detail, 1:1 aspect ratio.",
-		Background:        openai.CreateImageBackgroundOpaque,
-		Model:             openai.CreateImageModelGptImage1,
-		Size:              openai.CreateImageSize1024x1024,
-		N:                 1,
-		Quality:           openai.CreateImageQualityLow,
-		OutputCompression: 100,
-		OutputFormat:      openai.CreateImageOutputFormatJPEG,
-		// Moderation: 		 openai.CreateImageModerationLow,
-		// User: 					 "",
-	}
+stream, err := client.CreateResponseStream(ctx, openai.CreateResponseRequest{
+	Model: openai.GPT5Dot6Sol,
+	Input: "Write a short story about a curious gopher.",
+})
+if err != nil {
+	return err
+}
+defer stream.Close()
 
-	resp, err := c.CreateImage(ctx, req)
-	if err != nil {
-		fmt.Printf("Image creation Image generation with GPT Image 1error: %v\n", err)
-		return
+for {
+	event, err := stream.Recv()
+	if errors.Is(err, io.EOF) {
+		break
 	}
-
-	fmt.Println("Image Base64:", resp.Data[0].B64JSON)
-
-	// Decode the base64 data
-	imgBytes, err := base64.StdEncoding.DecodeString(resp.Data[0].B64JSON)
 	if err != nil {
-		fmt.Printf("Base64 decode error: %v\n", err)
-		return
+		return err
 	}
-
-	// Write image to file
-	outputPath := "generated_image.jpg"
-	err = os.WriteFile(outputPath, imgBytes, 0644)
-	if err != nil {
-		fmt.Printf("Failed to write image file: %v\n", err)
-		return
+	if event.Type == openai.ResponseStreamEventOutputTextDelta {
+		fmt.Print(event.Delta)
 	}
-
-	fmt.Printf("The image was saved as %s\n", outputPath)
 }
 ```
-</details>
-
-<details>
-<summary>Configuring proxy</summary>
-
-```go
-config := openai.DefaultConfig("token")
-proxyUrl, err := url.Parse("http://localhost:{port}")
-if err != nil {
-	panic(err)
-}
-transport := &http.Transport{
-	Proxy: http.ProxyURL(proxyUrl),
-}
-config.HTTPClient = &http.Client{
-	Transport: transport,
-}
 
-c := openai.NewClientWithConfig(config)
-```
+## Choosing a model
 
-See also: https://pkg.go.dev/github.com/sashabaranov/go-openai#ClientConfig
-</details>
+The current GPT-5.6 family exposes separate capability, balance, and efficiency
+tiers. Pick the tier that matches the workload instead of using the flagship for
+every request.
 
-<details>
-<summary>ChatGPT support context</summary>
+| Constant | Model ID | Typical use |
+| --- | --- | --- |
+| `GPT5Dot6Sol` | `gpt-5.6-sol` | Complex reasoning and coding |
+| `GPT5Dot6Terra` | `gpt-5.6-terra` | Balance of intelligence and cost |
+| `GPT5Dot6Luna` | `gpt-5.6-luna` | Cost-sensitive, high-volume work |
+| `GPT5Dot6` | `gpt-5.6` | Family alias that currently routes to Sol |
 
-```go
-package main
+See the [OpenAI model catalog](https://developers.openai.com/api/docs/models) for
+capabilities and availability. Model IDs are accepted as strings, so you can use
+a model before a named constant is added to this package.
 
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"strings"
+## Chat Completions
 
-	"github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	client := openai.NewClient("your token")
-	messages := make([]openai.ChatCompletionMessage, 0)
-	reader := bufio.NewReader(os.Stdin)
-	fmt.Println("Conversation")
-	fmt.Println("---------------------")
-
-	for {
-		fmt.Print("-> ")
-		text, _ := reader.ReadString('\n')
-		// convert CRLF to LF
-		text = strings.Replace(text, "\n", "", -1)
-		messages = append(messages, openai.ChatCompletionMessage{
-			Role:    openai.ChatMessageRoleUser,
-			Content: text,
-		})
-
-		resp, err := client.CreateChatCompletion(
-			context.Background(),
-			openai.ChatCompletionRequest{
-				Model:    openai.GPT3Dot5Turbo,
-				Messages: messages,
-			},
-		)
-
-		if err != nil {
-			fmt.Printf("ChatCompletion error: %v\n", err)
-			continue
-		}
-
-		content := resp.Choices[0].Message.Content
-		messages = append(messages, openai.ChatCompletionMessage{
-			Role:    openai.ChatMessageRoleAssistant,
-			Content: content,
-		})
-		fmt.Println(content)
-	}
-}
-```
-</details>
-
-<details>
-<summary>Azure OpenAI ChatGPT</summary>
+Chat Completions remains supported for existing integrations:
 
 ```go
-package main
-
-import (
-	"context"
-	"fmt"
-
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	config := openai.DefaultAzureConfig("your Azure OpenAI Key", "https://your Azure OpenAI Endpoint")
-	// If you use a deployment name different from the model name, you can customize the AzureModelMapperFunc function
-	// config.AzureModelMapperFunc = func(model string) string {
-	// 	azureModelMapping := map[string]string{
-	// 		"gpt-3.5-turbo": "your gpt-3.5-turbo deployment name",
-	// 	}
-	// 	return azureModelMapping[model]
-	// }
-
-	client := openai.NewClientWithConfig(config)
-	resp, err := client.CreateChatCompletion(
-		context.Background(),
-		openai.ChatCompletionRequest{
-			Model: openai.GPT3Dot5Turbo,
-			Messages: []openai.ChatCompletionMessage{
-				{
-					Role:    openai.ChatMessageRoleUser,
-					Content: "Hello Azure OpenAI!",
-				},
-			},
+response, err := client.CreateChatCompletion(ctx, openai.ChatCompletionRequest{
+	Model: openai.GPT4oMini,
+	Messages: []openai.ChatCompletionMessage{
+		{
+			Role:    openai.ChatMessageRoleUser,
+			Content: "Hello!",
 		},
-	)
-	if err != nil {
-		fmt.Printf("ChatCompletion error: %v\n", err)
-		return
-	}
-
-	fmt.Println(resp.Choices[0].Message.Content)
-}
-
-```
-</details>
-
-<details>
-<summary>Embedding Semantic Similarity</summary>
-
-```go
-package main
-
-import (
-	"context"
-	"log"
-	openai "github.com/sashabaranov/go-openai"
-
-)
-
-func main() {
-	client := openai.NewClient("your-token")
-
-	// Create an EmbeddingRequest for the user query
-	queryReq := openai.EmbeddingRequest{
-		Input: []string{"How many chucks would a woodchuck chuck"},
-		Model: openai.AdaEmbeddingV2,
-	}
-
-	// Create an embedding for the user query
-	queryResponse, err := client.CreateEmbeddings(context.Background(), queryReq)
-	if err != nil {
-		log.Fatal("Error creating query embedding:", err)
-	}
-
-	// Create an EmbeddingRequest for the target text
-	targetReq := openai.EmbeddingRequest{
-		Input: []string{"How many chucks would a woodchuck chuck if the woodchuck could chuck wood"},
-		Model: openai.AdaEmbeddingV2,
-	}
-
-	// Create an embedding for the target text
-	targetResponse, err := client.CreateEmbeddings(context.Background(), targetReq)
-	if err != nil {
-		log.Fatal("Error creating target embedding:", err)
-	}
-
-	// Now that we have the embeddings for the user query and the target text, we
-	// can calculate their similarity.
-	queryEmbedding := queryResponse.Data[0]
-	targetEmbedding := targetResponse.Data[0]
-
-	similarity, err := queryEmbedding.DotProduct(&targetEmbedding)
-	if err != nil {
-		log.Fatal("Error calculating dot product:", err)
-	}
-
-	log.Printf("The similarity score between the query and the target is %f", similarity)
+	},
+})
+if err != nil {
+	return err
 }
 
+fmt.Println(response.Choices[0].Message.Content)
 ```
-</details>
-
-<details>
-<summary>Azure OpenAI Embeddings</summary>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
 
-	openai "github.com/sashabaranov/go-openai"
-)
-
-func main() {
-
-	config := openai.DefaultAzureConfig("your Azure OpenAI Key", "https://your Azure OpenAI Endpoint")
-	config.APIVersion = "2023-05-15" // optional update to latest API version
-
-	//If you use a deployment name different from the model name, you can customize the AzureModelMapperFunc function
-	//config.AzureModelMapperFunc = func(model string) string {
-	//    azureModelMapping := map[string]string{
-	//        "gpt-3.5-turbo":"your gpt-3.5-turbo deployment name",
-	//    }
-	//    return azureModelMapping[model]
-	//}
-
-	input := "Text to vectorize"
-
-	client := openai.NewClientWithConfig(config)
-	resp, err := client.CreateEmbeddings(
-		context.Background(),
-		openai.EmbeddingRequest{
-			Input: []string{input},
-			Model: openai.AdaEmbeddingV2,
-		})
-
-	if err != nil {
-		fmt.Printf("CreateEmbeddings error: %v\n", err)
-		return
-	}
-
-	vectors := resp.Data[0].Embedding // []float32 with 1536 dimensions
+For a new integration, prefer Responses unless you specifically need the Chat
+Completions request or response shape.
 
-	fmt.Println(vectors[:10], "...", vectors[len(vectors)-10:])
-}
-```
-</details>
-
-<details>
-<summary>JSON Schema for function calling</summary>
-
-It is now possible for chat completion to choose to call a function for more information ([see developer docs here](https://platform.openai.com/docs/guides/gpt/function-calling)).
-
-In order to describe the type of functions that can be called, a JSON schema must be provided. Many JSON schema libraries exist and are more advanced than what we can offer in this library, however we have included a simple `jsonschema` package for those who want to use this feature without formatting their own JSON schema payload.
-
-The developer documents give this JSON schema definition as an example:
-
-```json
-{
-  "name":"get_current_weather",
-  "description":"Get the current weather in a given location",
-  "parameters":{
-    "type":"object",
-    "properties":{
-        "location":{
-          "type":"string",
-          "description":"The city and state, e.g. San Francisco, CA"
-        },
-        "unit":{
-          "type":"string",
-          "enum":[
-              "celsius",
-              "fahrenheit"
-          ]
-        }
-    },
-    "required":[
-        "location"
-    ]
-  }
-}
-```
+## Configuration
 
-Using the `jsonschema` package, this schema could be created using structs as such:
+Use `DefaultConfig` to customize the HTTP client, base URL, organization, or
+headers before constructing a client:
 
 ```go
-FunctionDefinition{
-  Name: "get_current_weather",
-  Parameters: jsonschema.Definition{
-    Type: jsonschema.Object,
-    Properties: map[string]jsonschema.Definition{
-      "location": {
-        Type: jsonschema.String,
-        Description: "The city and state, e.g. San Francisco, CA",
-      },
-      "unit": {
-        Type: jsonschema.String,
-        Enum: []string{"celsius", "fahrenheit"},
-      },
-    },
-    Required: []string{"location"},
-  },
-}
+config := openai.DefaultConfig(os.Getenv("OPENAI_API_KEY"))
+config.BaseURL = "https://your-compatible-endpoint.example/v1"
+client := openai.NewClientWithConfig(config)
 ```
 
-The `Parameters` field of a `FunctionDefinition` can accept either of the above styles, or even a nested struct from another library (as long as it can be marshalled into JSON).
-</details>
-
-<details>
-<summary>Error handling</summary>
+For Azure OpenAI, start with `DefaultAzureConfig` and configure the deployment
+mapping or API version required by your Azure resource.
 
-Open-AI maintains clear documentation on how to [handle API errors](https://platform.openai.com/docs/guides/error-codes/api-errors)
+## Error handling
 
-example:
-```
-e := &openai.APIError{}
-if errors.As(err, &e) {
-  switch e.HTTPStatusCode {
-    case 401:
-      // invalid auth or key (do not retry)
-    case 429:
-      // rate limiting or engine overload (wait and retry) 
-    case 500:
-      // openai server error (retry)
-    default:
-      // unhandled
-  }
-}
-
-```
-</details>
-
-<details>
-<summary>Fine Tune Model</summary>
+API failures can be inspected with `errors.As`:
 
 ```go
-package main
-
-import (
-	"context"
-	"fmt"
-	"github.com/sashabaranov/go-openai"
-)
-
-func main() {
-	client := openai.NewClient("your token")
-	ctx := context.Background()
-
-	// create a .jsonl file with your training data for conversational model
-	// {"prompt": "<prompt text>", "completion": "<ideal generated text>"}
-	// {"prompt": "<prompt text>", "completion": "<ideal generated text>"}
-	// {"prompt": "<prompt text>", "completion": "<ideal generated text>"}
-
-	// chat models are trained using the following file format:
-	// {"messages": [{"role": "system", "content": "Marv is a factual chatbot that is also sarcastic."}, {"role": "user", "content": "What's the capital of France?"}, {"role": "assistant", "content": "Paris, as if everyone doesn't know that already."}]}
-	// {"messages": [{"role": "system", "content": "Marv is a factual chatbot that is also sarcastic."}, {"role": "user", "content": "Who wrote 'Romeo and Juliet'?"}, {"role": "assistant", "content": "Oh, just some guy named William Shakespeare. Ever heard of him?"}]}
-	// {"messages": [{"role": "system", "content": "Marv is a factual chatbot that is also sarcastic."}, {"role": "user", "content": "How far is the Moon from Earth?"}, {"role": "assistant", "content": "Around 384,400 kilometers. Give or take a few, like that really matters."}]}
-
-	// you can use openai cli tool to validate the data
-	// For more info - https://platform.openai.com/docs/guides/fine-tuning
-
-	file, err := client.CreateFile(ctx, openai.FileRequest{
-		FilePath: "training_prepared.jsonl",
-		Purpose:  "fine-tune",
-	})
-	if err != nil {
-		fmt.Printf("Upload JSONL file error: %v\n", err)
-		return
-	}
-
-	// create a fine tuning job
-	// Streams events until the job is done (this often takes minutes, but can take hours if there are many jobs in the queue or your dataset is large)
-	// use below get method to know the status of your model
-	fineTuningJob, err := client.CreateFineTuningJob(ctx, openai.FineTuningJobRequest{
-		TrainingFile: file.ID,
-		Model:        "davinci-002", // gpt-3.5-turbo-0613, babbage-002.
-	})
-	if err != nil {
-		fmt.Printf("Creating new fine tune model error: %v\n", err)
-		return
-	}
-
-	fineTuningJob, err = client.RetrieveFineTuningJob(ctx, fineTuningJob.ID)
-	if err != nil {
-		fmt.Printf("Getting fine tune model error: %v\n", err)
-		return
-	}
-	fmt.Println(fineTuningJob.FineTunedModel)
-
-	// once the status of fineTuningJob is `succeeded`, you can use your fine tune model in Completion Request or Chat Completion Request
-
-	// resp, err := client.CreateCompletion(ctx, openai.CompletionRequest{
-	//	 Model:  fineTuningJob.FineTunedModel,
-	//	 Prompt: "your prompt",
-	// })
-	// if err != nil {
-	//	 fmt.Printf("Create completion error %v\n", err)
-	//	 return
-	// }
-	//
-	// fmt.Println(resp.Choices[0].Text)
+var apiError *openai.APIError
+if errors.As(err, &apiError) {
+	fmt.Printf("OpenAI error: status=%d code=%v message=%s\n",
+		apiError.HTTPStatusCode, apiError.Code, apiError.Message)
 }
 ```
-</details>
 
-<details>
-<summary>Structured Outputs</summary>
+## Examples
 
-```go
-package main
+Runnable examples live in [`examples/`](examples):
 
-import (
-	"context"
-	"fmt"
-	"log"
+- [Responses API with multi-turn state](examples/responses)
+- [Chat Completions](examples/completion)
+- [Chat Completions with a function tool](examples/completion-with-tool)
+- [Image generation](examples/images)
+- [Speech to text](examples/voice-to-text)
 
-	"github.com/sashabaranov/go-openai"
-	"github.com/sashabaranov/go-openai/jsonschema"
-)
+To run one:
 
-func main() {
-	client := openai.NewClient("your token")
-	ctx := context.Background()
-
-	type Result struct {
-		Steps []struct {
-			Explanation string `json:"explanation"`
-			Output      string `json:"output"`
-		} `json:"steps"`
-		FinalAnswer string `json:"final_answer"`
-	}
-	var result Result
-	schema, err := jsonschema.GenerateSchemaForType(result)
-	if err != nil {
-		log.Fatalf("GenerateSchemaForType error: %v", err)
-	}
-	resp, err := client.CreateChatCompletion(ctx, openai.ChatCompletionRequest{
-		Model: openai.GPT4oMini,
-		Messages: []openai.ChatCompletionMessage{
-			{
-				Role:    openai.ChatMessageRoleSystem,
-				Content: "You are a helpful math tutor. Guide the user through the solution step by step.",
-			},
-			{
-				Role:    openai.ChatMessageRoleUser,
-				Content: "how can I solve 8x + 7 = -23",
-			},
-		},
-		ResponseFormat: &openai.ChatCompletionResponseFormat{
-			Type: openai.ChatCompletionResponseFormatTypeJSONSchema,
-			JSONSchema: &openai.ChatCompletionResponseFormatJSONSchema{
-				Name:   "math_reasoning",
-				Schema: schema,
-				Strict: true,
-			},
-		},
-	})
-	if err != nil {
-		log.Fatalf("CreateChatCompletion error: %v", err)
-	}
-	err = schema.Unmarshal(resp.Choices[0].Message.Content, &result)
-	if err != nil {
-		log.Fatalf("Unmarshal schema error: %v", err)
-	}
-	fmt.Println(result)
-}
+```sh
+go run ./examples/responses
 ```
-</details>
-See the `examples/` folder for more.
-
-## Frequently Asked Questions
-
-### Why don't we get the same answer when specifying a temperature field of 0 and asking the same question?
-
-Even when specifying a temperature field of 0, it doesn't guarantee that you'll always get the same response. Several factors come into play.
-
-1. Go OpenAI Behavior: When you specify a temperature field of 0 in Go OpenAI, the omitempty tag causes that field to be removed from the request. Consequently, the OpenAI API applies the default value of 1.
-2. Token Count for Input/Output: If there's a large number of tokens in the input and output, setting the temperature to 0 can still result in non-deterministic behavior. In particular, when using around 32k tokens, the likelihood of non-deterministic behavior becomes highest even with a temperature of 0.
-
-Due to the factors mentioned above, different answers may be returned even for the same question.
-
-**Workarounds:**
-1. As of November 2023, use [the new `seed` parameter](https://platform.openai.com/docs/guides/text-generation/reproducible-outputs) in conjunction with the `system_fingerprint` response field, alongside Temperature management.
-2. Try using `math.SmallestNonzeroFloat32`: By specifying `math.SmallestNonzeroFloat32` in the temperature field instead of 0, you can mimic the behavior of setting it to 0.
-3. Limiting Token Count: By limiting the number of tokens in the input and output and especially avoiding large requests close to 32k tokens, you can reduce the risk of non-deterministic behavior.
-
-By adopting these strategies, you can expect more consistent results.
-
-**Related Issues:**  
-[omitempty option of request struct will generate incorrect request when parameter is 0.](https://github.com/sashabaranov/go-openai/issues/9)
-
-### Does Go OpenAI provide a method to count tokens?
-
-No, Go OpenAI does not offer a feature to count tokens, and there are no plans to provide such a feature in the future. However, if there's a way to implement a token counting feature with zero dependencies, it might be possible to merge that feature into Go OpenAI. Otherwise, it would be more appropriate to implement it in a dedicated library or repository.
-
-For counting tokens, you might find the following links helpful:  
-- [Counting Tokens For Chat API Calls](https://github.com/pkoukk/tiktoken-go#counting-tokens-for-chat-api-calls)
-- [How to count tokens with tiktoken](https://github.com/openai/openai-cookbook/blob/main/examples/How_to_count_tokens_with_tiktoken.ipynb)
-
-**Related Issues:**  
-[Is it possible to join the implementation of GPT3 Tokenizer](https://github.com/sashabaranov/go-openai/issues/62)
 
 ## Contributing
 
-By following [Contributing Guidelines](https://github.com/sashabaranov/go-openai/blob/master/CONTRIBUTING.md), we hope to ensure that your contributions are made smoothly and efficiently.
+See the [contributing guidelines](CONTRIBUTING.md) before opening a pull request.
 
 ## Thank you
 
-We want to take a moment to express our deepest gratitude to the [contributors](https://github.com/sashabaranov/go-openai/graphs/contributors) and sponsors of this project:
-- [Carson Kahn](https://carsonkahn.com) of [Spindle AI](https://spindleai.com)
-
-To all of you: thank you. You've helped us achieve more than we ever imagined possible. Can't wait to see where we go next, together!
+Thank you to all of the project's
+[contributors](https://github.com/sashabaranov/go-openai/graphs/contributors)
+and sponsors, including [Carson Kahn](https://carsonkahn.com) of
+[Spindle AI](https://spindleai.com).
diff --git a/vendor/github.com/sashabaranov/go-openai/audio.go b/vendor/github.com/sashabaranov/go-openai/audio.go
index f321f93..0f2cce9 100644
--- a/vendor/github.com/sashabaranov/go-openai/audio.go
+++ b/vendor/github.com/sashabaranov/go-openai/audio.go
@@ -3,6 +3,7 @@ package openai
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
@@ -11,9 +12,13 @@ import (
 	utils "github.com/sashabaranov/go-openai/internal"
 )
 
-// Whisper Defines the models provided by OpenAI to use when processing audio with OpenAI.
+// Audio transcription models provided by OpenAI.
 const (
-	Whisper1 = "whisper-1"
+	Whisper1               = "whisper-1"
+	GPT4oTranscribe        = "gpt-4o-transcribe"
+	GPT4oMiniTranscribe    = "gpt-4o-mini-transcribe"
+	GPT4oTranscribeDiarize = "gpt-4o-transcribe-diarize"
+	GPTTranscribe          = "gpt-transcribe"
 )
 
 // Response formats; Whisper uses AudioResponseFormatJSON by default.
@@ -34,6 +39,16 @@ const (
 	TranscriptionTimestampGranularitySegment TranscriptionTimestampGranularity = "segment"
 )
 
+// TranscriptionChunkingStrategy configures server-side VAD chunking for transcription.
+// Assign it to AudioRequest.ChunkingStrategy when you need explicit control; pass the
+// string "auto" instead to let the server pick the boundaries.
+type TranscriptionChunkingStrategy struct {
+	Type              string  `json:"type"` // "server_vad"
+	PrefixPaddingMs   int     `json:"prefix_padding_ms,omitempty"`
+	SilenceDurationMs int     `json:"silence_duration_ms,omitempty"`
+	Threshold         float64 `json:"threshold,omitempty"`
+}
+
 // AudioRequest represents a request structure for audio API.
 type AudioRequest struct {
 	Model string
@@ -49,6 +64,11 @@ type AudioRequest struct {
 	Language               string // Only for transcription.
 	Format                 AudioResponseFormat
 	TimestampGranularities []TranscriptionTimestampGranularity // Only for transcription.
+
+	// ChunkingStrategy controls how the audio is split before processing. Diarization models
+	// such as gpt-4o-transcribe-diarize require it on longer audio, otherwise the API rejects
+	// the request. Pass the string "auto" or a TranscriptionChunkingStrategy. Only for transcription.
+	ChunkingStrategy any
 }
 
 // AudioResponse represents a response structure for audio API.
@@ -196,19 +216,51 @@ func audioMultipartForm(request AudioRequest, b utils.FormBuilder) error {
 		}
 	}
 
-	if len(request.TimestampGranularities) > 0 {
-		for _, tg := range request.TimestampGranularities {
-			err = b.WriteField("timestamp_granularities[]", string(tg))
-			if err != nil {
-				return fmt.Errorf("writing timestamp_granularities[]: %w", err)
-			}
-		}
+	// Create form fields for the timestamp granularities (if provided)
+	if err = writeTimestampGranularities(request.TimestampGranularities, b); err != nil {
+		return err
+	}
+
+	// Create a form field for the chunking strategy (if provided)
+	if err = writeChunkingStrategy(request.ChunkingStrategy, b); err != nil {
+		return err
 	}
 
 	// Close the multipart writer
 	return b.Close()
 }
 
+func writeTimestampGranularities(granularities []TranscriptionTimestampGranularity, b utils.FormBuilder) error {
+	for _, tg := range granularities {
+		if err := b.WriteField("timestamp_granularities[]", string(tg)); err != nil {
+			return fmt.Errorf("writing timestamp_granularities[]: %w", err)
+		}
+	}
+	return nil
+}
+
+// writeChunkingStrategy serializes ChunkingStrategy into the multipart form. A plain string
+// such as "auto" is sent verbatim; anything else is JSON-encoded (e.g. server_vad config).
+func writeChunkingStrategy(strategy any, b utils.FormBuilder) error {
+	if strategy == nil {
+		return nil
+	}
+
+	value, ok := strategy.(string)
+	if !ok {
+		data, err := json.Marshal(strategy)
+		if err != nil {
+			return fmt.Errorf("marshaling chunking_strategy: %w", err)
+		}
+		value = string(data)
+	}
+
+	if err := b.WriteField("chunking_strategy", value); err != nil {
+		return fmt.Errorf("writing chunking_strategy: %w", err)
+	}
+	return nil
+}
+
 // createFileField creates the "file" form field from either an existing file or by using the reader.
 func createFileField(request AudioRequest, b utils.FormBuilder) error {
 	if request.Reader != nil {
diff --git a/vendor/github.com/sashabaranov/go-openai/batch.go b/vendor/github.com/sashabaranov/go-openai/batch.go
index 3c1a9d0..53e66d4 100644
--- a/vendor/github.com/sashabaranov/go-openai/batch.go
+++ b/vendor/github.com/sashabaranov/go-openai/batch.go
@@ -17,6 +17,7 @@ const (
 	BatchEndpointChatCompletions BatchEndpoint = "/v1/chat/completions"
 	BatchEndpointCompletions     BatchEndpoint = "/v1/completions"
 	BatchEndpointEmbeddings      BatchEndpoint = "/v1/embeddings"
+	BatchEndpointResponses       BatchEndpoint = "/v1/responses"
 )
 
 type BatchLineItem interface {
@@ -54,6 +55,18 @@ type BatchEmbeddingRequest struct {
 	URL      BatchEndpoint    `json:"url"`
 }
 
+type BatchResponseRequest struct {
+	CustomID string                `json:"custom_id"`
+	Body     CreateResponseRequest `json:"body"`
+	Method   string                `json:"method"`
+	URL      BatchEndpoint         `json:"url"`
+}
+
+func (r BatchResponseRequest) MarshalBatchLineItem() []byte {
+	marshal, _ := json.Marshal(r)
+	return marshal
+}
+
 func (r BatchEmbeddingRequest) MarshalBatchLineItem() []byte {
 	marshal, _ := json.Marshal(r)
 	return marshal
@@ -146,7 +159,7 @@ func (r *UploadBatchFileRequest) AddChatCompletion(customerID string, body ChatC
 	r.Lines = append(r.Lines, BatchChatCompletionRequest{
 		CustomID: customerID,
 		Body:     body,
-		Method:   "POST",
+		Method:   http.MethodPost,
 		URL:      BatchEndpointChatCompletions,
 	})
 }
@@ -155,7 +168,7 @@ func (r *UploadBatchFileRequest) AddCompletion(customerID string, body Completio
 	r.Lines = append(r.Lines, BatchCompletionRequest{
 		CustomID: customerID,
 		Body:     body,
-		Method:   "POST",
+		Method:   http.MethodPost,
 		URL:      BatchEndpointCompletions,
 	})
 }
@@ -164,11 +177,20 @@ func (r *UploadBatchFileRequest) AddEmbedding(customerID string, body EmbeddingR
 	r.Lines = append(r.Lines, BatchEmbeddingRequest{
 		CustomID: customerID,
 		Body:     body,
-		Method:   "POST",
+		Method:   http.MethodPost,
 		URL:      BatchEndpointEmbeddings,
 	})
 }
 
+func (r *UploadBatchFileRequest) AddResponse(customerID string, body CreateResponseRequest) {
+	r.Lines = append(r.Lines, BatchResponseRequest{
+		CustomID: customerID,
+		Body:     body,
+		Method:   http.MethodPost,
+		URL:      BatchEndpointResponses,
+	})
+}
+
 // UploadBatchFile — upload batch file.
 func (c *Client) UploadBatchFile(ctx context.Context, request UploadBatchFileRequest) (File, error) {
 	if request.FileName == "" {
diff --git a/vendor/github.com/sashabaranov/go-openai/chat.go b/vendor/github.com/sashabaranov/go-openai/chat.go
index 0aa0187..b3e5a27 100644
--- a/vendor/github.com/sashabaranov/go-openai/chat.go
+++ b/vendor/github.com/sashabaranov/go-openai/chat.go
@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
-
-	"github.com/sashabaranov/go-openai/jsonschema"
 )
 
 // Chat message role defined by the OpenAI API.
@@ -237,13 +235,16 @@ func (r *ChatCompletionResponseFormatJSONSchema) UnmarshalJSON(data []byte) erro
 	r.Name = raw.Name
 	r.Description = raw.Description
 	r.Strict = raw.Strict
+	r.Schema = nil
 	if len(raw.Schema) > 0 && string(raw.Schema) != "null" {
-		var d jsonschema.Definition
-		err := json.Unmarshal(raw.Schema, &d)
-		if err != nil {
+		// Keep the schema verbatim. Decoding into jsonschema.Definition silently
+		// drops any keyword it doesn't model (anyOf, title, $schema, ...), which
+		// corrupts the schema on round-trip. RawMessage still implements Marshaler.
+		var obj map[string]json.RawMessage
+		if err := json.Unmarshal(raw.Schema, &obj); err != nil {
 			return err
 		}
-		r.Schema = &d
+		r.Schema = raw.Schema
 	}
 	return nil
 }
@@ -265,6 +266,7 @@ type ChatCompletionRequest struct {
 	Messages []ChatCompletionMessage `json:"messages"`
 	// MaxTokens The maximum number of tokens that can be generated in the chat completion.
 	// This value can be used to control costs for text generated via API.
+	//
 	// Deprecated: use MaxCompletionTokens. Not compatible with o1-series models.
 	// refs: https://platform.openai.com/docs/api-reference/chat/create#chat-create-max_tokens
 	MaxTokens int `json:"max_tokens,omitempty"`
@@ -274,7 +276,7 @@ type ChatCompletionRequest struct {
 	Temperature         float32                       `json:"temperature,omitempty"`
 	TopP                float32                       `json:"top_p,omitempty"`
 	N                   int                           `json:"n,omitempty"`
-	Stream              bool                          `json:"stream,omitempty"`
+	Stream              bool                          `json:"stream"`
 	Stop                []string                      `json:"stop,omitempty"`
 	PresencePenalty     float32                       `json:"presence_penalty,omitempty"`
 	ResponseFormat      *ChatCompletionResponseFormat `json:"response_format,omitempty"`
@@ -346,12 +348,45 @@ type StreamOptions struct {
 type ToolType string
 
 const (
-	ToolTypeFunction ToolType = "function"
+	ToolTypeFunction           ToolType = "function"
+	ToolTypeWebSearch          ToolType = "web_search"
+	ToolTypeWebSearchPreview   ToolType = "web_search_preview"
+	ToolTypeFileSearch         ToolType = "file_search"
+	ToolTypeComputer           ToolType = "computer"
+	ToolTypeComputerUsePreview ToolType = "computer_use_preview"
+	ToolTypeComputerUse        ToolType = "computer_use"
+	ToolTypeCodeInterpreter    ToolType = "code_interpreter"
+	ToolTypeImageGeneration    ToolType = "image_generation"
+	ToolTypeMCP                ToolType = "mcp"
+	ToolTypeCustom             ToolType = "custom"
+	ToolTypeLocalShell         ToolType = "local_shell"
+	ToolTypeShell              ToolType = "shell"
+	ToolTypeApplyPatch         ToolType = "apply_patch"
+	ToolTypeToolSearch         ToolType = "tool_search"
 )
 
 type Tool struct {
 	Type     ToolType            `json:"type"`
 	Function *FunctionDefinition `json:"function,omitempty"`
+	// Parameters contains Responses API tool properties that are serialized next to type.
+	// For example: {"search_context_size": "low"} for a web search tool.
+	Parameters map[string]any `json:"-"`
+}
+
+// MarshalJSON preserves the nested Chat Completions function format while also
+// supporting the inline properties used by built-in and function tools in the Responses API.
+func (t Tool) MarshalJSON() ([]byte, error) {
+	tool := map[string]any{"type": t.Type}
+	if t.Function != nil {
+		tool["function"] = t.Function
+	}
+	for key, value := range t.Parameters {
+		if key == "type" || key == "function" {
+			return nil, errors.New("tool parameters cannot override type or function")
+		}
+		tool[key] = value
+	}
+	return json.Marshal(tool)
 }
 
 type ToolChoice struct {
diff --git a/vendor/github.com/sashabaranov/go-openai/client.go b/vendor/github.com/sashabaranov/go-openai/client.go
index 413b8db..dc0f73c 100644
--- a/vendor/github.com/sashabaranov/go-openai/client.go
+++ b/vendor/github.com/sashabaranov/go-openai/client.go
@@ -257,9 +257,9 @@ func withModel(model string) fullURLOption {
 }
 
 var azureDeploymentsEndpoints = []string{
-	"/completions",
+	completionsSuffix,
 	"/embeddings",
-	"/chat/completions",
+	chatCompletionsSuffix,
 	"/audio/transcriptions",
 	"/audio/translations",
 	"/audio/speech",
diff --git a/vendor/github.com/sashabaranov/go-openai/completion.go b/vendor/github.com/sashabaranov/go-openai/completion.go
index 27d69f5..e322d1b 100644
--- a/vendor/github.com/sashabaranov/go-openai/completion.go
+++ b/vendor/github.com/sashabaranov/go-openai/completion.go
@@ -5,10 +5,9 @@ import (
 	"net/http"
 )
 
-// GPT3 Defines the models provided by OpenAI to use when generating
-// completions from OpenAI.
-// GPT3 Models are designed for text-based tasks. For code-specific
-// tasks, please refer to the Codex series of models.
+const completionsSuffix = "/completions"
+
+// Text generation and reasoning models provided by OpenAI.
 const (
 	O1Mini                  = "o1-mini"
 	O1Mini20240912          = "o1-mini-2024-09-12"
@@ -20,8 +19,11 @@ const (
 	O320250416              = "o3-2025-04-16"
 	O3Mini                  = "o3-mini"
 	O3Mini20250131          = "o3-mini-2025-01-31"
+	O3Pro                   = "o3-pro"
+	O3DeepResearch          = "o3-deep-research"
 	O4Mini                  = "o4-mini"
 	O4Mini20250416          = "o4-mini-2025-04-16"
+	O4MiniDeepResearch      = "o4-mini-deep-research"
 	GPT432K0613             = "gpt-4-32k-0613"
 	GPT432K0314             = "gpt-4-32k-0314"
 	GPT432K                 = "gpt-4-32k"
@@ -52,7 +54,30 @@ const (
 	GPT5                    = "gpt-5"
 	GPT5Mini                = "gpt-5-mini"
 	GPT5Nano                = "gpt-5-nano"
+	GPT5Pro                 = "gpt-5-pro"
 	GPT5ChatLatest          = "gpt-5-chat-latest"
+	GPT5Codex               = "gpt-5-codex"
+	GPT5Dot1                = "gpt-5.1"
+	GPT5Dot1ChatLatest      = "gpt-5.1-chat-latest"
+	GPT5Dot1Codex           = "gpt-5.1-codex"
+	GPT5Dot1CodexMini       = "gpt-5.1-codex-mini"
+	GPT5Dot1CodexMax        = "gpt-5.1-codex-max"
+	GPT5Dot2                = "gpt-5.2"
+	GPT5Dot2ChatLatest      = "gpt-5.2-chat-latest"
+	GPT5Dot2Pro             = "gpt-5.2-pro"
+	GPT5Dot2Codex           = "gpt-5.2-codex"
+	GPT5Dot3ChatLatest      = "gpt-5.3-chat-latest"
+	GPT5Dot3Codex           = "gpt-5.3-codex"
+	GPT5Dot4                = "gpt-5.4"
+	GPT5Dot4Mini            = "gpt-5.4-mini"
+	GPT5Dot4Nano            = "gpt-5.4-nano"
+	GPT5Dot4Pro             = "gpt-5.4-pro"
+	GPT5Dot5                = "gpt-5.5"
+	GPT5Dot5Pro             = "gpt-5.5-pro"
+	GPT5Dot6                = "gpt-5.6"
+	GPT5Dot6Sol             = "gpt-5.6-sol"
+	GPT5Dot6Terra           = "gpt-5.6-terra"
+	GPT5Dot6Luna            = "gpt-5.6-luna"
 	GPT3Dot5Turbo0125       = "gpt-3.5-turbo-0125"
 	GPT3Dot5Turbo1106       = "gpt-3.5-turbo-1106"
 	GPT3Dot5Turbo0613       = "gpt-3.5-turbo-0613"
@@ -100,15 +125,18 @@ const (
 )
 
 var disabledModelsForEndpoints = map[string]map[string]bool{
-	"/completions": {
+	completionsSuffix: {
 		O1Mini:                  true,
 		O1Mini20240912:          true,
 		O1Preview:               true,
 		O1Preview20240912:       true,
 		O3Mini:                  true,
 		O3Mini20250131:          true,
+		O3Pro:                   true,
+		O3DeepResearch:          true,
 		O4Mini:                  true,
 		O4Mini20250416:          true,
+		O4MiniDeepResearch:      true,
 		O3:                      true,
 		O320250416:              true,
 		GPT3Dot5Turbo:           true,
@@ -149,7 +177,30 @@ var disabledModelsForEndpoints = map[string]map[string]bool{
 		GPT5:                    true,
 		GPT5Mini:                true,
 		GPT5Nano:                true,
+		GPT5Pro:                 true,
 		GPT5ChatLatest:          true,
+		GPT5Codex:               true,
+		GPT5Dot1:                true,
+		GPT5Dot1ChatLatest:      true,
+		GPT5Dot1Codex:           true,
+		GPT5Dot1CodexMini:       true,
+		GPT5Dot1CodexMax:        true,
+		GPT5Dot2:                true,
+		GPT5Dot2ChatLatest:      true,
+		GPT5Dot2Pro:             true,
+		GPT5Dot2Codex:           true,
+		GPT5Dot3ChatLatest:      true,
+		GPT5Dot3Codex:           true,
+		GPT5Dot4:                true,
+		GPT5Dot4Mini:            true,
+		GPT5Dot4Nano:            true,
+		GPT5Dot4Pro:             true,
+		GPT5Dot5:                true,
+		GPT5Dot5Pro:             true,
+		GPT5Dot6:                true,
+		GPT5Dot6Sol:             true,
+		GPT5Dot6Terra:           true,
+		GPT5Dot6Luna:            true,
 	},
 	chatCompletionsSuffix: {
 		CodexCodeDavinci002:     true,
@@ -218,7 +269,7 @@ type CompletionRequest struct {
 	PresencePenalty float32           `json:"presence_penalty,omitempty"`
 	Seed            *int              `json:"seed,omitempty"`
 	Stop            []string          `json:"stop,omitempty"`
-	Stream          bool              `json:"stream,omitempty"`
+	Stream          bool              `json:"stream"`
 	Suffix          string            `json:"suffix,omitempty"`
 	Temperature     float32           `json:"temperature,omitempty"`
 	TopP            float32           `json:"top_p,omitempty"`
@@ -269,7 +320,7 @@ func (c *Client) CreateCompletion(
 		return
 	}
 
-	urlSuffix := "/completions"
+	urlSuffix := completionsSuffix
 	if !checkEndpointSupportsModel(urlSuffix, request.Model) {
 		err = ErrCompletionUnsupportedModel
 		return
diff --git a/vendor/github.com/sashabaranov/go-openai/config.go b/vendor/github.com/sashabaranov/go-openai/config.go
index 4788ba6..4b8cfb6 100644
--- a/vendor/github.com/sashabaranov/go-openai/config.go
+++ b/vendor/github.com/sashabaranov/go-openai/config.go
@@ -3,6 +3,7 @@ package openai
 import (
 	"net/http"
 	"regexp"
+	"strings"
 )
 
 const (
@@ -70,7 +71,11 @@ func DefaultAzureConfig(apiKey, baseURL string) ClientConfig {
 		APIType:    APITypeAzure,
 		APIVersion: "2023-05-15",
 		AzureModelMapperFunc: func(model string) string {
-			return regexp.MustCompile(`[.:]`).ReplaceAllString(model, "")
+			// only 3.5 models have the "." stripped in their names
+			if strings.Contains(model, "3.5") {
+				return regexp.MustCompile(`[.:]`).ReplaceAllString(model, "")
+			}
+			return strings.ReplaceAll(model, ":", "")
 		},
 
 		HTTPClient: &http.Client{},
diff --git a/vendor/github.com/sashabaranov/go-openai/fine_tunes.go b/vendor/github.com/sashabaranov/go-openai/fine_tunes.go
index 74b47bf..b3d76fa 100644
--- a/vendor/github.com/sashabaranov/go-openai/fine_tunes.go
+++ b/vendor/github.com/sashabaranov/go-openai/fine_tunes.go
@@ -111,6 +111,7 @@ func (c *Client) CreateFineTune(ctx context.Context, request FineTuneRequest) (r
 }
 
 // CancelFineTune cancel a fine-tune job.
+//
 // Deprecated: On August 22nd, 2023, OpenAI announced the deprecation of the /v1/fine-tunes API.
 // This API will be officially deprecated on January 4th, 2024.
 // OpenAI recommends to migrate to the new fine tuning API implemented in fine_tuning_job.go.
diff --git a/vendor/github.com/sashabaranov/go-openai/image.go b/vendor/github.com/sashabaranov/go-openai/image.go
index 84b9daf..76a8430 100644
--- a/vendor/github.com/sashabaranov/go-openai/image.go
+++ b/vendor/github.com/sashabaranov/go-openai/image.go
@@ -18,7 +18,7 @@ const (
 	CreateImageSize1792x1024 = "1792x1024"
 	CreateImageSize1024x1792 = "1024x1792"
 
-	// gpt-image-1 supported only.
+	// GPT Image models only.
 	CreateImageSize1536x1024 = "1536x1024" // Landscape
 	CreateImageSize1024x1536 = "1024x1536" // Portrait
 )
@@ -30,16 +30,20 @@ const (
 )
 
 const (
-	CreateImageModelDallE2    = "dall-e-2"
-	CreateImageModelDallE3    = "dall-e-3"
-	CreateImageModelGptImage1 = "gpt-image-1"
+	CreateImageModelDallE2             = "dall-e-2"
+	CreateImageModelDallE3             = "dall-e-3"
+	CreateImageModelGptImage1          = "gpt-image-1"
+	CreateImageModelGptImage1Mini      = "gpt-image-1-mini"
+	CreateImageModelGptImage1Dot5      = "gpt-image-1.5"
+	CreateImageModelGptImage2          = "gpt-image-2"
+	CreateImageModelChatGPTImageLatest = "chatgpt-image-latest"
 )
 
 const (
 	CreateImageQualityHD       = "hd"
 	CreateImageQualityStandard = "standard"
 
-	// gpt-image-1 only.
+	// GPT Image models only.
 	CreateImageQualityHigh   = "high"
 	CreateImageQualityMedium = "medium"
 	CreateImageQualityLow    = "low"
@@ -52,18 +56,18 @@ const (
 )
 
 const (
-	// gpt-image-1 only.
+	// GPT Image models only.
 	CreateImageBackgroundTransparent = "transparent"
 	CreateImageBackgroundOpaque      = "opaque"
 )
 
 const (
-	// gpt-image-1 only.
+	// GPT Image models only.
 	CreateImageModerationLow = "low"
 )
 
 const (
-	// gpt-image-1 only.
+	// GPT Image models only.
 	CreateImageOutputFormatPNG  = "png"
 	CreateImageOutputFormatJPEG = "jpeg"
 	CreateImageOutputFormatWEBP = "webp"
@@ -195,6 +199,27 @@ func (c *Client) CreateEditImage(ctx context.Context, request ImageEditRequest)
 		return
 	}
 
+	if request.Model != "" {
+		err = builder.WriteField("model", request.Model)
+		if err != nil {
+			return
+		}
+	}
+
+	if request.Quality != "" {
+		err = builder.WriteField("quality", request.Quality)
+		if err != nil {
+			return
+		}
+	}
+
+	if request.User != "" {
+		err = builder.WriteField("user", request.User)
+		if err != nil {
+			return
+		}
+	}
+
 	err = builder.WriteField("n", strconv.Itoa(request.N))
 	if err != nil {
 		return
diff --git a/vendor/github.com/sashabaranov/go-openai/internal/form_builder.go b/vendor/github.com/sashabaranov/go-openai/internal/form_builder.go
index a17e820..2ad5374 100644
--- a/vendor/github.com/sashabaranov/go-openai/internal/form_builder.go
+++ b/vendor/github.com/sashabaranov/go-openai/internal/form_builder.go
@@ -3,6 +3,7 @@ package openai
 import (
 	"fmt"
 	"io"
+	"mime"
 	"mime/multipart"
 	"net/textproto"
 	"os"
@@ -50,6 +51,19 @@ func (fb *DefaultFormBuilder) CreateFormFileReader(fieldname string, r io.Reader
 	if f, ok := r.(interface{ ContentType() string }); ok {
 		contentType = f.ContentType()
 	}
+	// The OpenAI API rejects the file part when Content-Type is
+	// missing, so when the reader doesn't supply one and we can't
+	// derive it from the filename extension, fall back to the same
+	// default the stdlib's multipart.Writer.CreateFormFile uses.
+	// See #1010.
+	if contentType == "" {
+		if ext := filepath.Ext(filename); ext != "" {
+			contentType = mime.TypeByExtension(ext)
+		}
+		if contentType == "" {
+			contentType = "application/octet-stream"
+		}
+	}
 
 	h := make(textproto.MIMEHeader)
 	h.Set(
@@ -60,10 +74,7 @@ func (fb *DefaultFormBuilder) CreateFormFileReader(fieldname string, r io.Reader
 			escapeQuotes(filepath.Base(filename)),
 		),
 	)
-	// content type is optional, but it can be set
-	if contentType != "" {
-		h.Set("Content-Type", contentType)
-	}
+	h.Set("Content-Type", contentType)
 
 	fieldWriter, err := fb.writer.CreatePart(h)
 	if err != nil {
diff --git a/vendor/github.com/sashabaranov/go-openai/jsonschema/json.go b/vendor/github.com/sashabaranov/go-openai/jsonschema/json.go
deleted file mode 100644
index 75e3b51..0000000
--- a/vendor/github.com/sashabaranov/go-openai/jsonschema/json.go
+++ /dev/null
@@ -1,235 +0,0 @@
-// Package jsonschema provides very simple functionality for representing a JSON schema as a
-// (nested) struct. This struct can be used with the chat completion "function call" feature.
-// For more complicated schemas, it is recommended to use a dedicated JSON schema library
-// and/or pass in the schema in []byte format.
-package jsonschema
-
-import (
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-)
-
-type DataType string
-
-const (
-	Object  DataType = "object"
-	Number  DataType = "number"
-	Integer DataType = "integer"
-	String  DataType = "string"
-	Array   DataType = "array"
-	Null    DataType = "null"
-	Boolean DataType = "boolean"
-)
-
-// Definition is a struct for describing a JSON Schema.
-// It is fairly limited, and you may have better luck using a third-party library.
-type Definition struct {
-	// Type specifies the data type of the schema.
-	Type DataType `json:"type,omitempty"`
-	// Description is the description of the schema.
-	Description string `json:"description,omitempty"`
-	// Enum is used to restrict a value to a fixed set of values. It must be an array with at least
-	// one element, where each element is unique. You will probably only use this with strings.
-	Enum []string `json:"enum,omitempty"`
-	// Properties describes the properties of an object, if the schema type is Object.
-	Properties map[string]Definition `json:"properties,omitempty"`
-	// Required specifies which properties are required, if the schema type is Object.
-	Required []string `json:"required,omitempty"`
-	// Items specifies which data type an array contains, if the schema type is Array.
-	Items *Definition `json:"items,omitempty"`
-	// AdditionalProperties is used to control the handling of properties in an object
-	// that are not explicitly defined in the properties section of the schema. example:
-	// additionalProperties: true
-	// additionalProperties: false
-	// additionalProperties: jsonschema.Definition{Type: jsonschema.String}
-	AdditionalProperties any `json:"additionalProperties,omitempty"`
-	// Whether the schema is nullable or not.
-	Nullable bool `json:"nullable,omitempty"`
-
-	// Ref Reference to a definition in $defs or external schema.
-	Ref string `json:"$ref,omitempty"`
-	// Defs A map of reusable schema definitions.
-	Defs map[string]Definition `json:"$defs,omitempty"`
-}
-
-func (d *Definition) MarshalJSON() ([]byte, error) {
-	if d.Properties == nil {
-		d.Properties = make(map[string]Definition)
-	}
-	type Alias Definition
-	return json.Marshal(struct {
-		Alias
-	}{
-		Alias: (Alias)(*d),
-	})
-}
-
-func (d *Definition) Unmarshal(content string, v any) error {
-	return VerifySchemaAndUnmarshal(*d, []byte(content), v)
-}
-
-func GenerateSchemaForType(v any) (*Definition, error) {
-	var defs = make(map[string]Definition)
-	def, err := reflectSchema(reflect.TypeOf(v), defs)
-	if err != nil {
-		return nil, err
-	}
-	// If the schema has a root $ref, resolve it by:
-	// 1. Extracting the key from the $ref.
-	// 2. Detaching the referenced definition from $defs.
-	// 3. Checking for self-references in the detached definition.
-	//    - If a self-reference is found, restore the original $defs structure.
-	// 4. Flattening the referenced definition into the root schema.
-	// 5. Clearing the $ref field in the root schema.
-	if def.Ref != "" {
-		origRef := def.Ref
-		key := strings.TrimPrefix(origRef, "#/$defs/")
-		if root, ok := defs[key]; ok {
-			delete(defs, key)
-			root.Defs = defs
-			if containsRef(root, origRef) {
-				root.Defs = nil
-				defs[key] = root
-			}
-			*def = root
-		}
-		def.Ref = ""
-	}
-	def.Defs = defs
-	return def, nil
-}
-
-func reflectSchema(t reflect.Type, defs map[string]Definition) (*Definition, error) {
-	var d Definition
-	switch t.Kind() {
-	case reflect.String:
-		d.Type = String
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
-		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		d.Type = Integer
-	case reflect.Float32, reflect.Float64:
-		d.Type = Number
-	case reflect.Bool:
-		d.Type = Boolean
-	case reflect.Slice, reflect.Array:
-		d.Type = Array
-		items, err := reflectSchema(t.Elem(), defs)
-		if err != nil {
-			return nil, err
-		}
-		d.Items = items
-	case reflect.Struct:
-		if t.Name() != "" {
-			if _, ok := defs[t.Name()]; !ok {
-				defs[t.Name()] = Definition{}
-				object, err := reflectSchemaObject(t, defs)
-				if err != nil {
-					return nil, err
-				}
-				defs[t.Name()] = *object
-			}
-			return &Definition{Ref: "#/$defs/" + t.Name()}, nil
-		}
-		d.Type = Object
-		d.AdditionalProperties = false
-		object, err := reflectSchemaObject(t, defs)
-		if err != nil {
-			return nil, err
-		}
-		d = *object
-	case reflect.Ptr:
-		definition, err := reflectSchema(t.Elem(), defs)
-		if err != nil {
-			return nil, err
-		}
-		d = *definition
-	case reflect.Invalid, reflect.Uintptr, reflect.Complex64, reflect.Complex128,
-		reflect.Chan, reflect.Func, reflect.Interface, reflect.Map,
-		reflect.UnsafePointer:
-		return nil, fmt.Errorf("unsupported type: %s", t.Kind().String())
-	default:
-	}
-	return &d, nil
-}
-
-func reflectSchemaObject(t reflect.Type, defs map[string]Definition) (*Definition, error) {
-	var d = Definition{
-		Type:                 Object,
-		AdditionalProperties: false,
-	}
-	properties := make(map[string]Definition)
-	var requiredFields []string
-	for i := 0; i < t.NumField(); i++ {
-		field := t.Field(i)
-		if !field.IsExported() {
-			continue
-		}
-		jsonTag := field.Tag.Get("json")
-		var required = true
-		switch {
-		case jsonTag == "-":
-			continue
-		case jsonTag == "":
-			jsonTag = field.Name
-		case strings.HasSuffix(jsonTag, ",omitempty"):
-			jsonTag = strings.TrimSuffix(jsonTag, ",omitempty")
-			required = false
-		}
-
-		item, err := reflectSchema(field.Type, defs)
-		if err != nil {
-			return nil, err
-		}
-		description := field.Tag.Get("description")
-		if description != "" {
-			item.Description = description
-		}
-		enum := field.Tag.Get("enum")
-		if enum != "" {
-			item.Enum = strings.Split(enum, ",")
-		}
-
-		if n := field.Tag.Get("nullable"); n != "" {
-			nullable, _ := strconv.ParseBool(n)
-			item.Nullable = nullable
-		}
-
-		properties[jsonTag] = *item
-
-		if s := field.Tag.Get("required"); s != "" {
-			required, _ = strconv.ParseBool(s)
-		}
-		if required {
-			requiredFields = append(requiredFields, jsonTag)
-		}
-	}
-	d.Required = requiredFields
-	d.Properties = properties
-	return &d, nil
-}
-
-func containsRef(def Definition, targetRef string) bool {
-	if def.Ref == targetRef {
-		return true
-	}
-
-	for _, d := range def.Defs {
-		if containsRef(d, targetRef) {
-			return true
-		}
-	}
-
-	for _, prop := range def.Properties {
-		if containsRef(prop, targetRef) {
-			return true
-		}
-	}
-
-	if def.Items != nil && containsRef(*def.Items, targetRef) {
-		return true
-	}
-	return false
-}
diff --git a/vendor/github.com/sashabaranov/go-openai/jsonschema/validate.go b/vendor/github.com/sashabaranov/go-openai/jsonschema/validate.go
deleted file mode 100644
index 1bd2f80..0000000
--- a/vendor/github.com/sashabaranov/go-openai/jsonschema/validate.go
+++ /dev/null
@@ -1,140 +0,0 @@
-package jsonschema
-
-import (
-	"encoding/json"
-	"errors"
-)
-
-func CollectDefs(def Definition) map[string]Definition {
-	result := make(map[string]Definition)
-	collectDefsRecursive(def, result, "#")
-	return result
-}
-
-func collectDefsRecursive(def Definition, result map[string]Definition, prefix string) {
-	for k, v := range def.Defs {
-		path := prefix + "/$defs/" + k
-		result[path] = v
-		collectDefsRecursive(v, result, path)
-	}
-	for k, sub := range def.Properties {
-		collectDefsRecursive(sub, result, prefix+"/properties/"+k)
-	}
-	if def.Items != nil {
-		collectDefsRecursive(*def.Items, result, prefix)
-	}
-}
-
-func VerifySchemaAndUnmarshal(schema Definition, content []byte, v any) error {
-	var data any
-	err := json.Unmarshal(content, &data)
-	if err != nil {
-		return err
-	}
-	if !Validate(schema, data, WithDefs(CollectDefs(schema))) {
-		return errors.New("data validation failed against the provided schema")
-	}
-	return json.Unmarshal(content, &v)
-}
-
-type validateArgs struct {
-	Defs map[string]Definition
-}
-
-type ValidateOption func(*validateArgs)
-
-func WithDefs(defs map[string]Definition) ValidateOption {
-	return func(option *validateArgs) {
-		option.Defs = defs
-	}
-}
-
-func Validate(schema Definition, data any, opts ...ValidateOption) bool {
-	args := validateArgs{}
-	for _, opt := range opts {
-		opt(&args)
-	}
-	if len(opts) == 0 {
-		args.Defs = CollectDefs(schema)
-	}
-	switch schema.Type {
-	case Object:
-		return validateObject(schema, data, args.Defs)
-	case Array:
-		return validateArray(schema, data, args.Defs)
-	case String:
-		v, ok := data.(string)
-		if ok && len(schema.Enum) > 0 {
-			return contains(schema.Enum, v)
-		}
-		return ok
-	case Number: // float64 and int
-		_, ok := data.(float64)
-		if !ok {
-			_, ok = data.(int)
-		}
-		return ok
-	case Boolean:
-		_, ok := data.(bool)
-		return ok
-	case Integer:
-		// Golang unmarshals all numbers as float64, so we need to check if the float64 is an integer
-		if num, ok := data.(float64); ok {
-			return num == float64(int64(num))
-		}
-		_, ok := data.(int)
-		return ok
-	case Null:
-		return data == nil
-	default:
-		if schema.Ref != "" && args.Defs != nil {
-			if v, ok := args.Defs[schema.Ref]; ok {
-				return Validate(v, data, WithDefs(args.Defs))
-			}
-		}
-		return false
-	}
-}
-
-func validateObject(schema Definition, data any, defs map[string]Definition) bool {
-	dataMap, ok := data.(map[string]any)
-	if !ok {
-		return false
-	}
-	for _, field := range schema.Required {
-		if _, exists := dataMap[field]; !exists {
-			return false
-		}
-	}
-	for key, valueSchema := range schema.Properties {
-		value, exists := dataMap[key]
-		if exists && !Validate(valueSchema, value, WithDefs(defs)) {
-			return false
-		} else if !exists && contains(schema.Required, key) {
-			return false
-		}
-	}
-	return true
-}
-
-func validateArray(schema Definition, data any, defs map[string]Definition) bool {
-	dataArray, ok := data.([]any)
-	if !ok {
-		return false
-	}
-	for _, item := range dataArray {
-		if !Validate(*schema.Items, item, WithDefs(defs)) {
-			return false
-		}
-	}
-	return true
-}
-
-func contains[S ~[]E, E comparable](s S, v E) bool {
-	for i := range s {
-		if v == s[i] {
-			return true
-		}
-	}
-	return false
-}
diff --git a/vendor/github.com/sashabaranov/go-openai/response.go b/vendor/github.com/sashabaranov/go-openai/response.go
new file mode 100644
index 0000000..54d3216
--- /dev/null
+++ b/vendor/github.com/sashabaranov/go-openai/response.go
@@ -0,0 +1,597 @@
+package openai
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+const responsesSuffix = "/responses"
+
+var ErrResponseStreamNotSupported = errors.New(
+	"streaming is not supported with this method, please use CreateResponseStream",
+)
+
+// ResponseInclude identifies optional data to include in a response.
+type ResponseInclude string
+
+const (
+	ResponseIncludeFileSearchCallResults      ResponseInclude = "file_search_call.results"
+	ResponseIncludeWebSearchCallResults       ResponseInclude = "web_search_call.results"
+	ResponseIncludeWebSearchCallActionSources ResponseInclude = "web_search_call.action.sources"
+	ResponseIncludeInputImageURL              ResponseInclude = "message.input_image.image_url"
+	ResponseIncludeComputerCallOutputImageURL ResponseInclude = "computer_call_output.output.image_url"
+	ResponseIncludeCodeInterpreterCallOutputs ResponseInclude = "code_interpreter_call.outputs"
+	ResponseIncludeReasoningEncryptedContent  ResponseInclude = "reasoning.encrypted_content"
+	ResponseIncludeMessageOutputTextLogprobs  ResponseInclude = "message.output_text.logprobs"
+)
+
+// ResponseStatus is the lifecycle status of a response.
+type ResponseStatus string
+
+const (
+	ResponseStatusQueued     ResponseStatus = "queued"
+	ResponseStatusInProgress ResponseStatus = "in_progress"
+	ResponseStatusCompleted  ResponseStatus = "completed"
+	ResponseStatusFailed     ResponseStatus = "failed"
+	ResponseStatusIncomplete ResponseStatus = "incomplete"
+	ResponseStatusCancelling ResponseStatus = "cancelling"
+	ResponseStatusCancelled  ResponseStatus = "cancelled"
+)
+
+// ResponseTruncation controls how input that exceeds the context window is handled.
+type ResponseTruncation string
+
+const (
+	ResponseTruncationAuto     ResponseTruncation = "auto"
+	ResponseTruncationDisabled ResponseTruncation = "disabled"
+)
+
+// ResponseTool is an alias for Tool. Responses API tool-specific properties can
+// be supplied through Tool.Parameters.
+type ResponseTool = Tool
+
+// NewResponseFunctionTool converts a function definition to the inline function
+// tool representation expected by the Responses API.
+func NewResponseFunctionTool(function FunctionDefinition) ResponseTool {
+	parameters := map[string]any{
+		"name":       function.Name,
+		"parameters": function.Parameters,
+	}
+	if function.Description != "" {
+		parameters["description"] = function.Description
+	}
+	if function.Strict {
+		parameters["strict"] = true
+	}
+	return ResponseTool{Type: ToolTypeFunction, Parameters: parameters}
+}
+
+// ResponseReasoning represents reasoning configuration for the Responses API.
+type ResponseReasoning struct {
+	Effort          string `json:"effort,omitempty"`
+	GenerateSummary string `json:"generate_summary,omitempty"`
+	Summary         string `json:"summary,omitempty"`
+	Context         string `json:"context,omitempty"`
+	Mode            string `json:"mode,omitempty"`
+}
+
+// ResponseStreamOptions controls Responses API streaming behavior.
+type ResponseStreamOptions struct {
+	IncludeObfuscation *bool `json:"include_obfuscation,omitempty"`
+}
+
+// ResponseTextConfig controls plain-text or structured response output.
+type ResponseTextConfig struct {
+	Format    *ResponseTextFormat `json:"format,omitempty"`
+	Verbosity string              `json:"verbosity,omitempty"`
+}
+
+// ResponseTextFormat describes the requested output format.
+type ResponseTextFormat struct {
+	Type        string `json:"type"`
+	Name        string `json:"name,omitempty"`
+	Description string `json:"description,omitempty"`
+	Schema      any    `json:"schema,omitempty"`
+	Strict      bool   `json:"strict,omitempty"`
+}
+
+// ResponsePrompt references a reusable prompt template.
+type ResponsePrompt struct {
+	ID        string         `json:"id"`
+	Variables map[string]any `json:"variables,omitempty"`
+	Version   string         `json:"version,omitempty"`
+}
+
+// ResponsePromptCacheOptions controls prompt cache creation.
+type ResponsePromptCacheOptions struct {
+	Mode string `json:"mode,omitempty"`
+	TTL  string `json:"ttl,omitempty"`
+}
+
+// ResponsePromptCacheBreakpoint marks the end of a reusable prompt prefix.
+type ResponsePromptCacheBreakpoint struct {
+	Mode string `json:"mode"`
+}
+
+// CreateResponseRequest represents a request to the Responses API. Input may be
+// a string or a slice of response input items.
+type CreateResponseRequest struct {
+	Background           bool                        `json:"background,omitempty"`
+	ContextManagement    []any                       `json:"context_management,omitempty"`
+	Conversation         any                         `json:"conversation,omitempty"`
+	Include              []ResponseInclude           `json:"include,omitempty"`
+	Input                any                         `json:"input"`
+	Instructions         string                      `json:"instructions,omitempty"`
+	MaxOutputTokens      int                         `json:"max_output_tokens,omitempty"`
+	MaxToolCalls         int                         `json:"max_tool_calls,omitempty"`
+	Metadata             map[string]any              `json:"metadata,omitempty"`
+	Model                string                      `json:"model,omitempty"`
+	Moderation           any                         `json:"moderation,omitempty"`
+	ParallelToolCalls    *bool                       `json:"parallel_tool_calls,omitempty"`
+	PreviousResponseID   string                      `json:"previous_response_id,omitempty"`
+	Prompt               *ResponsePrompt             `json:"prompt,omitempty"`
+	PromptCacheKey       string                      `json:"prompt_cache_key,omitempty"`
+	PromptCacheOptions   *ResponsePromptCacheOptions `json:"prompt_cache_options,omitempty"`
+	PromptCacheRetention string                      `json:"prompt_cache_retention,omitempty"`
+	Reasoning            *ResponseReasoning          `json:"reasoning,omitempty"`
+	SafetyIdentifier     string                      `json:"safety_identifier,omitempty"`
+	ServiceTier          string                      `json:"service_tier,omitempty"`
+	Store                *bool                       `json:"store,omitempty"`
+	Stream               bool                        `json:"stream,omitempty"`
+	StreamOptions        *ResponseStreamOptions      `json:"stream_options,omitempty"`
+	Temperature          *float32                    `json:"temperature,omitempty"`
+	Text                 *ResponseTextConfig         `json:"text,omitempty"`
+	ToolChoice           any                         `json:"tool_choice,omitempty"`
+	Tools                []ResponseTool              `json:"tools,omitempty"`
+	TopLogprobs          int                         `json:"top_logprobs,omitempty"`
+	TopP                 *float32                    `json:"top_p,omitempty"`
+	Truncation           ResponseTruncation          `json:"truncation,omitempty"`
+	User                 string                      `json:"user,omitempty"`
+	ExtraBody            map[string]any              `json:"-"`
+}
+
+// MarshalJSON merges ExtraBody into the request payload. ExtraBody values take
+// precedence over fields represented directly by CreateResponseRequest.
+func (r CreateResponseRequest) MarshalJSON() ([]byte, error) {
+	type requestAlias CreateResponseRequest
+	base, err := json.Marshal(requestAlias(r))
+	if err != nil || len(r.ExtraBody) == 0 {
+		return base, err
+	}
+
+	var body map[string]any
+	if err = json.Unmarshal(base, &body); err != nil {
+		return nil, err
+	}
+	for key, value := range r.ExtraBody {
+		body[key] = value
+	}
+	return json.Marshal(body)
+}
+
+// ResponseInputMessage is a message supplied as structured input.
+type ResponseInputMessage struct {
+	Type    string `json:"type,omitempty"`
+	Role    string `json:"role"`
+	Content any    `json:"content"`
+	Status  string `json:"status,omitempty"`
+	Phase   string `json:"phase,omitempty"`
+}
+
+// ResponseInputText is a text content part in a structured input message.
+type ResponseInputText struct {
+	Type                  string                         `json:"type"`
+	Text                  string                         `json:"text"`
+	PromptCacheBreakpoint *ResponsePromptCacheBreakpoint `json:"prompt_cache_breakpoint,omitempty"`
+}
+
+// ResponseInputImage is an image content part in a structured input message.
+type ResponseInputImage struct {
+	Type                  string                         `json:"type"`
+	Detail                string                         `json:"detail,omitempty"`
+	FileID                string                         `json:"file_id,omitempty"`
+	ImageURL              string                         `json:"image_url,omitempty"`
+	PromptCacheBreakpoint *ResponsePromptCacheBreakpoint `json:"prompt_cache_breakpoint,omitempty"`
+}
+
+// ResponseInputFile is a file content part in a structured input message.
+type ResponseInputFile struct {
+	Type                  string                         `json:"type"`
+	FileData              string                         `json:"file_data,omitempty"`
+	FileID                string                         `json:"file_id,omitempty"`
+	FileURL               string                         `json:"file_url,omitempty"`
+	Filename              string                         `json:"filename,omitempty"`
+	Detail                string                         `json:"detail,omitempty"`
+	PromptCacheBreakpoint *ResponsePromptCacheBreakpoint `json:"prompt_cache_breakpoint,omitempty"`
+}
+
+// ResponseFunctionCallOutput supplies the result of a prior function call.
+type ResponseFunctionCallOutput struct {
+	Type   string `json:"type"`
+	CallID string `json:"call_id"`
+	Output any    `json:"output"`
+	Status string `json:"status,omitempty"`
+}
+
+// ResponseError is an error embedded in an otherwise successful Responses API request.
+type ResponseError struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+// ResponseIncompleteDetails explains why a response did not complete.
+type ResponseIncompleteDetails struct {
+	Reason string `json:"reason,omitempty"`
+}
+
+// ResponseConversation identifies the conversation associated with a response.
+type ResponseConversation struct {
+	ID string `json:"id"`
+}
+
+// ResponseUsage reports token use for a response.
+type ResponseUsage struct {
+	InputTokens         int                          `json:"input_tokens"`
+	InputTokensDetails  *ResponseInputTokensDetails  `json:"input_tokens_details,omitempty"`
+	OutputTokens        int                          `json:"output_tokens"`
+	OutputTokensDetails *ResponseOutputTokensDetails `json:"output_tokens_details,omitempty"`
+	TotalTokens         int                          `json:"total_tokens"`
+}
+
+// ResponseInputTokensDetails is the input-token usage breakdown.
+type ResponseInputTokensDetails struct {
+	CachedTokens     int `json:"cached_tokens"`
+	CacheWriteTokens int `json:"cache_write_tokens"`
+}
+
+// ResponseOutputTokensDetails is the output-token usage breakdown.
+type ResponseOutputTokensDetails struct {
+	ReasoningTokens int `json:"reasoning_tokens"`
+}
+
+// ResponseAnnotation describes a citation or file annotation in output text.
+type ResponseAnnotation struct {
+	Type       string `json:"type"`
+	FileID     string `json:"file_id,omitempty"`
+	Filename   string `json:"filename,omitempty"`
+	Index      int    `json:"index,omitempty"`
+	StartIndex int    `json:"start_index,omitempty"`
+	EndIndex   int    `json:"end_index,omitempty"`
+	URL        string `json:"url,omitempty"`
+	Title      string `json:"title,omitempty"`
+}
+
+// ResponseLogprob contains token log-probability information.
+type ResponseLogprob struct {
+	Token       string            `json:"token"`
+	Bytes       []int64           `json:"bytes,omitempty"`
+	Logprob     float64           `json:"logprob"`
+	TopLogprobs []ResponseLogprob `json:"top_logprobs,omitempty"`
+}
+
+// ResponseOutputContent is a text or refusal content part in an output message.
+type ResponseOutputContent struct {
+	Type        string               `json:"type"`
+	Text        string               `json:"text,omitempty"`
+	Refusal     string               `json:"refusal,omitempty"`
+	Annotations []ResponseAnnotation `json:"annotations,omitempty"`
+	Logprobs    []ResponseLogprob    `json:"logprobs,omitempty"`
+}
+
+// ResponseSummaryPart is a reasoning summary content part.
+type ResponseSummaryPart struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+// ResponseOutputItem contains the common fields shared by response output item variants.
+// The top-level Output field remains []any so new variants can be consumed without a library release.
+type ResponseOutputItem struct {
+	ID        string                  `json:"id,omitempty"`
+	Type      string                  `json:"type"`
+	Status    string                  `json:"status,omitempty"`
+	Role      string                  `json:"role,omitempty"`
+	Content   []ResponseOutputContent `json:"content,omitempty"`
+	CallID    string                  `json:"call_id,omitempty"`
+	Name      string                  `json:"name,omitempty"`
+	Arguments string                  `json:"arguments,omitempty"`
+	Summary   []ResponseSummaryPart   `json:"summary,omitempty"`
+	Action    any                     `json:"action,omitempty"`
+	Results   any                     `json:"results,omitempty"`
+	Output    any                     `json:"output,omitempty"`
+}
+
+// CreateResponseResponse represents a response returned by the Responses API.
+type CreateResponseResponse struct {
+	ID                   string                      `json:"id"`
+	Object               string                      `json:"object"`
+	Created              int64                       `json:"created_at"`
+	CompletedAt          *int64                      `json:"completed_at,omitempty"`
+	Status               ResponseStatus              `json:"status,omitempty"`
+	Error                *ResponseError              `json:"error,omitempty"`
+	IncompleteDetails    *ResponseIncompleteDetails  `json:"incomplete_details,omitempty"`
+	Instructions         any                         `json:"instructions,omitempty"`
+	MaxOutputTokens      *int                        `json:"max_output_tokens,omitempty"`
+	MaxToolCalls         *int                        `json:"max_tool_calls,omitempty"`
+	Metadata             map[string]any              `json:"metadata,omitempty"`
+	Model                string                      `json:"model"`
+	Moderation           any                         `json:"moderation,omitempty"`
+	Output               []any                       `json:"output"`
+	OutputText           string                      `json:"output_text,omitempty"`
+	ParallelToolCalls    bool                        `json:"parallel_tool_calls,omitempty"`
+	PreviousResponseID   string                      `json:"previous_response_id,omitempty"`
+	Reasoning            *ResponseReasoning          `json:"reasoning,omitempty"`
+	ServiceTier          string                      `json:"service_tier,omitempty"`
+	Store                bool                        `json:"store,omitempty"`
+	Temperature          *float32                    `json:"temperature,omitempty"`
+	Text                 *ResponseTextConfig         `json:"text,omitempty"`
+	ToolChoice           any                         `json:"tool_choice,omitempty"`
+	Tools                []any                       `json:"tools,omitempty"`
+	TopLogprobs          int                         `json:"top_logprobs,omitempty"`
+	TopP                 *float32                    `json:"top_p,omitempty"`
+	Truncation           ResponseTruncation          `json:"truncation,omitempty"`
+	Usage                *ResponseUsage              `json:"usage,omitempty"`
+	Background           *bool                       `json:"background,omitempty"`
+	Conversation         *ResponseConversation       `json:"conversation,omitempty"`
+	Prompt               *ResponsePrompt             `json:"prompt,omitempty"`
+	PromptCacheKey       string                      `json:"prompt_cache_key,omitempty"`
+	PromptCacheOptions   *ResponsePromptCacheOptions `json:"prompt_cache_options,omitempty"`
+	PromptCacheRetention string                      `json:"prompt_cache_retention,omitempty"`
+	SafetyIdentifier     string                      `json:"safety_identifier,omitempty"`
+	User                 string                      `json:"user,omitempty"`
+
+	httpHeader
+}
+
+// GetOutputText returns the aggregated text output. It uses the API's output_text
+// convenience field when present and otherwise extracts output_text content parts.
+func (r CreateResponseResponse) GetOutputText() string {
+	if r.OutputText != "" {
+		return r.OutputText
+	}
+
+	var output strings.Builder
+	for _, rawItem := range r.Output {
+		data, err := json.Marshal(rawItem)
+		if err != nil {
+			continue
+		}
+		var item ResponseOutputItem
+		if err = json.Unmarshal(data, &item); err != nil {
+			continue
+		}
+		for _, content := range item.Content {
+			if content.Type == "output_text" {
+				output.WriteString(content.Text)
+			}
+		}
+	}
+	return output.String()
+}
+
+// RetrieveResponseOptions controls optional data returned by RetrieveResponse.
+type RetrieveResponseOptions struct {
+	Include            []ResponseInclude
+	IncludeObfuscation *bool
+	StartingAfter      *int
+}
+
+// ResponseInputItemsListOptions controls pagination for ListResponseInputItems.
+type ResponseInputItemsListOptions struct {
+	After   string
+	Include []ResponseInclude
+	Limit   int
+	Order   string
+}
+
+// ResponseInputItemsList contains the input items for a response.
+type ResponseInputItemsList struct {
+	Object  string `json:"object"`
+	Data    []any  `json:"data"`
+	FirstID string `json:"first_id"`
+	LastID  string `json:"last_id"`
+	HasMore bool   `json:"has_more"`
+
+	httpHeader
+}
+
+// ResponseDeleteResponse is returned after deleting a stored response.
+type ResponseDeleteResponse struct {
+	ID      string `json:"id"`
+	Object  string `json:"object"`
+	Deleted bool   `json:"deleted"`
+
+	httpHeader
+}
+
+// DeleteResponseResponse is kept as a descriptive alias for ResponseDeleteResponse.
+type DeleteResponseResponse = ResponseDeleteResponse
+
+// ResponseInputTokensResponse reports the token count for response input.
+type ResponseInputTokensResponse struct {
+	Object      string `json:"object"`
+	InputTokens int    `json:"input_tokens"`
+
+	httpHeader
+}
+
+// ResponseInputTokensRequest contains the response input whose tokens should be counted.
+type ResponseInputTokensRequest = CreateResponseRequest
+
+// ResponseCompaction is a compacted response context.
+type ResponseCompaction struct {
+	ID        string         `json:"id"`
+	Object    string         `json:"object"`
+	CreatedAt int64          `json:"created_at"`
+	Output    []any          `json:"output"`
+	Usage     *ResponseUsage `json:"usage,omitempty"`
+
+	httpHeader
+}
+
+// CompactResponseRequest contains the response context to compact.
+type CompactResponseRequest = CreateResponseRequest
+
+// CreateResponse creates a non-streaming model response.
+func (c *Client) CreateResponse(
+	ctx context.Context,
+	request CreateResponseRequest,
+) (response CreateResponseResponse, err error) {
+	if request.Stream {
+		return response, ErrResponseStreamNotSupported
+	}
+
+	req, err := c.newRequest(ctx, http.MethodPost, c.fullURL(responsesSuffix), withBody(request))
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// RetrieveResponse gets a stored response by ID.
+func (c *Client) RetrieveResponse(
+	ctx context.Context,
+	responseID string,
+	options ...RetrieveResponseOptions,
+) (response CreateResponseResponse, err error) {
+	values := url.Values{}
+	if len(options) > 0 {
+		for _, include := range options[0].Include {
+			values.Add("include", string(include))
+		}
+		if options[0].IncludeObfuscation != nil {
+			values.Set("include_obfuscation", strconv.FormatBool(*options[0].IncludeObfuscation))
+		}
+		if options[0].StartingAfter != nil {
+			values.Set("starting_after", strconv.Itoa(*options[0].StartingAfter))
+		}
+	}
+
+	urlSuffix := responseResourceSuffix(responseID, "", values)
+	req, err := c.newRequest(ctx, http.MethodGet, c.fullURL(urlSuffix))
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// GetResponse is an alias for RetrieveResponse.
+func (c *Client) GetResponse(
+	ctx context.Context,
+	responseID string,
+	options ...RetrieveResponseOptions,
+) (CreateResponseResponse, error) {
+	return c.RetrieveResponse(ctx, responseID, options...)
+}
+
+// DeleteResponse deletes a stored response.
+func (c *Client) DeleteResponse(ctx context.Context, responseID string) (response ResponseDeleteResponse, err error) {
+	urlSuffix := responseResourceSuffix(responseID, "", nil)
+	req, err := c.newRequest(ctx, http.MethodDelete, c.fullURL(urlSuffix))
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// CancelResponse cancels a background response.
+func (c *Client) CancelResponse(ctx context.Context, responseID string) (response CreateResponseResponse, err error) {
+	urlSuffix := responseResourceSuffix(responseID, "cancel", nil)
+	req, err := c.newRequest(ctx, http.MethodPost, c.fullURL(urlSuffix))
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// ListResponseInputItems lists the input items for a response.
+func (c *Client) ListResponseInputItems(
+	ctx context.Context,
+	responseID string,
+	options ...ResponseInputItemsListOptions,
+) (response ResponseInputItemsList, err error) {
+	values := url.Values{}
+	if len(options) > 0 {
+		if options[0].After != "" {
+			values.Set("after", options[0].After)
+		}
+		for _, include := range options[0].Include {
+			values.Add("include", string(include))
+		}
+		if options[0].Limit != 0 {
+			values.Set("limit", strconv.Itoa(options[0].Limit))
+		}
+		if options[0].Order != "" {
+			values.Set("order", options[0].Order)
+		}
+	}
+
+	urlSuffix := responseResourceSuffix(responseID, "input_items", values)
+	req, err := c.newRequest(ctx, http.MethodGet, c.fullURL(urlSuffix))
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// CountResponseInputTokens returns the number of input tokens a request would use.
+func (c *Client) CountResponseInputTokens(
+	ctx context.Context,
+	request ResponseInputTokensRequest,
+) (response ResponseInputTokensResponse, err error) {
+	request.Stream = false
+	request.StreamOptions = nil
+	req, err := c.newRequest(
+		ctx,
+		http.MethodPost,
+		c.fullURL(responsesSuffix+"/input_tokens"),
+		withBody(request),
+	)
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+// CompactResponse compacts a response context for use in a later request.
+func (c *Client) CompactResponse(
+	ctx context.Context,
+	request CompactResponseRequest,
+) (response ResponseCompaction, err error) {
+	request.Stream = false
+	request.StreamOptions = nil
+	req, err := c.newRequest(
+		ctx,
+		http.MethodPost,
+		c.fullURL(responsesSuffix+"/compact"),
+		withBody(request),
+	)
+	if err != nil {
+		return response, err
+	}
+	err = c.sendRequest(req, &response)
+	return response, err
+}
+
+func responseResourceSuffix(responseID, action string, values url.Values) string {
+	suffix := fmt.Sprintf("%s/%s", responsesSuffix, url.PathEscape(responseID))
+	if action != "" {
+		suffix += "/" + action
+	}
+	if len(values) != 0 {
+		suffix += "?" + values.Encode()
+	}
+	return suffix
+}
diff --git a/vendor/github.com/sashabaranov/go-openai/response_stream.go b/vendor/github.com/sashabaranov/go-openai/response_stream.go
new file mode 100644
index 0000000..c06558b
--- /dev/null
+++ b/vendor/github.com/sashabaranov/go-openai/response_stream.go
@@ -0,0 +1,131 @@
+package openai
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+)
+
+// ResponseStreamEventType identifies an event emitted while a response is generated.
+type ResponseStreamEventType string
+
+const (
+	ResponseStreamEventCreated                     ResponseStreamEventType = "response.created"
+	ResponseStreamEventQueued                      ResponseStreamEventType = "response.queued"
+	ResponseStreamEventInProgress                  ResponseStreamEventType = "response.in_progress"
+	ResponseStreamEventCompleted                   ResponseStreamEventType = "response.completed"
+	ResponseStreamEventFailed                      ResponseStreamEventType = "response.failed"
+	ResponseStreamEventIncomplete                  ResponseStreamEventType = "response.incomplete"
+	ResponseStreamEventOutputItemAdded             ResponseStreamEventType = "response.output_item.added"
+	ResponseStreamEventOutputItemDone              ResponseStreamEventType = "response.output_item.done"
+	ResponseStreamEventContentPartAdded            ResponseStreamEventType = "response.content_part.added"
+	ResponseStreamEventContentPartDone             ResponseStreamEventType = "response.content_part.done"
+	ResponseStreamEventOutputTextDelta             ResponseStreamEventType = "response.output_text.delta"
+	ResponseStreamEventOutputTextDone              ResponseStreamEventType = "response.output_text.done"
+	ResponseStreamEventOutputTextAnnotationAdded   ResponseStreamEventType = "response.output_text.annotation.added"
+	ResponseStreamEventRefusalDelta                ResponseStreamEventType = "response.refusal.delta"
+	ResponseStreamEventRefusalDone                 ResponseStreamEventType = "response.refusal.done"
+	ResponseStreamEventFunctionArgumentsDelta      ResponseStreamEventType = "response.function_call_arguments.delta"
+	ResponseStreamEventFunctionArgumentsDone       ResponseStreamEventType = "response.function_call_arguments.done"
+	ResponseStreamEventReasoningSummaryTextDelta   ResponseStreamEventType = "response.reasoning_summary_text.delta"
+	ResponseStreamEventReasoningSummaryTextDone    ResponseStreamEventType = "response.reasoning_summary_text.done"
+	ResponseStreamEventReasoningSummaryPartAdded   ResponseStreamEventType = "response.reasoning_summary_part.added"
+	ResponseStreamEventReasoningSummaryPartDone    ResponseStreamEventType = "response.reasoning_summary_part.done"
+	ResponseStreamEventReasoningTextDelta          ResponseStreamEventType = "response.reasoning_text.delta"
+	ResponseStreamEventReasoningTextDone           ResponseStreamEventType = "response.reasoning_text.done"
+	ResponseStreamEventAudioDelta                  ResponseStreamEventType = "response.audio.delta"
+	ResponseStreamEventAudioDone                   ResponseStreamEventType = "response.audio.done"
+	ResponseStreamEventAudioTranscriptDelta        ResponseStreamEventType = "response.audio.transcript.delta"
+	ResponseStreamEventAudioTranscriptDone         ResponseStreamEventType = "response.audio.transcript.done"
+	ResponseStreamEventWebSearchInProgress         ResponseStreamEventType = "response.web_search_call.in_progress"
+	ResponseStreamEventWebSearchSearching          ResponseStreamEventType = "response.web_search_call.searching"
+	ResponseStreamEventWebSearchCompleted          ResponseStreamEventType = "response.web_search_call.completed"
+	ResponseStreamEventFileSearchInProgress        ResponseStreamEventType = "response.file_search_call.in_progress"
+	ResponseStreamEventFileSearchSearching         ResponseStreamEventType = "response.file_search_call.searching"
+	ResponseStreamEventFileSearchCompleted         ResponseStreamEventType = "response.file_search_call.completed"
+	ResponseStreamEventCodeInterpreterInProgress   ResponseStreamEventType = "response.code_interpreter_call.in_progress"
+	ResponseStreamEventCodeInterpreterInterpreting ResponseStreamEventType = "response.code_interpreter_call.interpreting"
+	ResponseStreamEventCodeInterpreterCompleted    ResponseStreamEventType = "response.code_interpreter_call.completed"
+	ResponseStreamEventCodeInterpreterCodeDelta    ResponseStreamEventType = "response.code_interpreter_call_code.delta"
+	ResponseStreamEventCodeInterpreterCodeDone     ResponseStreamEventType = "response.code_interpreter_call_code.done"
+	ResponseStreamEventCustomToolInputDelta        ResponseStreamEventType = "response.custom_tool_call_input.delta"
+	ResponseStreamEventCustomToolInputDone         ResponseStreamEventType = "response.custom_tool_call_input.done"
+	ResponseStreamEventImageGenerationInProgress   ResponseStreamEventType = "response.image_generation_call.in_progress"
+	ResponseStreamEventImageGenerationGenerating   ResponseStreamEventType = "response.image_generation_call.generating"
+	ResponseStreamEventImageGenerationCompleted    ResponseStreamEventType = "response.image_generation_call.completed"
+	ResponseStreamEventImageGenerationPartialImage ResponseStreamEventType = "response.image_generation_call.partial_image"
+	ResponseStreamEventMCPCallInProgress           ResponseStreamEventType = "response.mcp_call.in_progress"
+	ResponseStreamEventMCPCallCompleted            ResponseStreamEventType = "response.mcp_call.completed"
+	ResponseStreamEventMCPCallFailed               ResponseStreamEventType = "response.mcp_call.failed"
+	ResponseStreamEventMCPCallArgumentsDelta       ResponseStreamEventType = "response.mcp_call_arguments.delta"
+	ResponseStreamEventMCPCallArgumentsDone        ResponseStreamEventType = "response.mcp_call_arguments.done"
+	ResponseStreamEventMCPListToolsInProgress      ResponseStreamEventType = "response.mcp_list_tools.in_progress"
+	ResponseStreamEventMCPListToolsCompleted       ResponseStreamEventType = "response.mcp_list_tools.completed"
+	ResponseStreamEventMCPListToolsFailed          ResponseStreamEventType = "response.mcp_list_tools.failed"
+	ResponseStreamEventError                       ResponseStreamEventType = "error"
+)
+
+// ResponseStreamEvent contains the common fields across Responses API SSE event variants.
+type ResponseStreamEvent struct {
+	Type              ResponseStreamEventType `json:"type"`
+	SequenceNumber    int                     `json:"sequence_number,omitempty"`
+	Response          *CreateResponseResponse `json:"response,omitempty"`
+	Item              *ResponseOutputItem     `json:"item,omitempty"`
+	Part              *ResponseOutputContent  `json:"part,omitempty"`
+	Annotation        *ResponseAnnotation     `json:"annotation,omitempty"`
+	ItemID            string                  `json:"item_id,omitempty"`
+	OutputIndex       int                     `json:"output_index,omitempty"`
+	ContentIndex      int                     `json:"content_index,omitempty"`
+	SummaryIndex      int                     `json:"summary_index,omitempty"`
+	Delta             string                  `json:"delta,omitempty"`
+	Text              string                  `json:"text,omitempty"`
+	Arguments         string                  `json:"arguments,omitempty"`
+	PartialImageB64   string                  `json:"partial_image_b64,omitempty"`
+	PartialImageIndex int                     `json:"partial_image_index,omitempty"`
+	Logprobs          []ResponseLogprob       `json:"logprobs,omitempty"`
+	Code              string                  `json:"code,omitempty"`
+	Message           string                  `json:"message,omitempty"`
+	Param             any                     `json:"param,omitempty"`
+	Error             *ResponseError          `json:"error,omitempty"`
+	Obfuscation       string                  `json:"obfuscation,omitempty"`
+	Raw               json.RawMessage         `json:"-"`
+}
+
+// UnmarshalJSON decodes known event fields and retains the complete event for
+// forward compatibility with event variants added by the API.
+func (e *ResponseStreamEvent) UnmarshalJSON(data []byte) error {
+	type eventAlias ResponseStreamEvent
+	if err := json.Unmarshal(data, (*eventAlias)(e)); err != nil {
+		return err
+	}
+	e.Raw = append(e.Raw[:0], data...)
+	return nil
+}
+
+// ResponseStream reads server-sent events from a streaming Responses API request.
+type ResponseStream struct {
+	*streamReader[ResponseStreamEvent]
+}
+
+// CreateResponseStream creates a response and streams its generation events.
+func (c *Client) CreateResponseStream(
+	ctx context.Context,
+	request CreateResponseRequest,
+) (stream *ResponseStream, err error) {
+	request.Stream = true
+	req, err := c.newRequest(
+		ctx,
+		http.MethodPost,
+		c.fullURL(responsesSuffix),
+		withBody(request),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	reader, err := sendRequestStream[ResponseStreamEvent](c, req)
+	if err != nil {
+		return nil, err
+	}
+	return &ResponseStream{streamReader: reader}, nil
+}
diff --git a/vendor/github.com/sashabaranov/go-openai/stream.go b/vendor/github.com/sashabaranov/go-openai/stream.go
index a61c7c9..84a8373 100644
--- a/vendor/github.com/sashabaranov/go-openai/stream.go
+++ b/vendor/github.com/sashabaranov/go-openai/stream.go
@@ -22,7 +22,7 @@ func (c *Client) CreateCompletionStream(
 	ctx context.Context,
 	request CompletionRequest,
 ) (stream *CompletionStream, err error) {
-	urlSuffix := "/completions"
+	urlSuffix := completionsSuffix
 	if !checkEndpointSupportsModel(urlSuffix, request.Model) {
 		err = ErrCompletionUnsupportedModel
 		return
diff --git a/vendor/github.com/sashabaranov/go-openai/stream_reader.go b/vendor/github.com/sashabaranov/go-openai/stream_reader.go
index 6faefe0..bab2510 100644
--- a/vendor/github.com/sashabaranov/go-openai/stream_reader.go
+++ b/vendor/github.com/sashabaranov/go-openai/stream_reader.go
@@ -17,7 +17,7 @@ var (
 )
 
 type streamable interface {
-	ChatCompletionStreamResponse | CompletionResponse
+	ChatCompletionStreamResponse | CompletionResponse | ResponseStreamEvent
 }
 
 type streamReader[T streamable] struct {
@@ -64,7 +64,13 @@ func (stream *streamReader[T]) processLines() ([]byte, error) {
 		rawLine, readErr := stream.reader.ReadBytes('\n')
 		if readErr != nil || hasErrorPrefix {
 			respErr := stream.unmarshalError()
-			if respErr != nil {
+			// respErr.Error can be nil even when respErr itself isn't:
+			// any payload that round-trips through unmarshaler.Unmarshal
+			// (an empty object, an aborted partial frame after context
+			// cancellation, etc.) ends up as a non-nil *ErrorResponse with
+			// a nil Error field. Wrapping that produced the famously
+			// useless "error, <nil>" message in #1060.
+			if respErr != nil && respErr.Error != nil {
 				return nil, fmt.Errorf("error, %w", respErr.Error)
 			}
 			return nil, readErr
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c8731b6..3aa3ca9 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -192,11 +192,10 @@ github.com/prometheus/common/model
 github.com/prometheus/procfs
 github.com/prometheus/procfs/internal/fs
 github.com/prometheus/procfs/internal/util
-# github.com/sashabaranov/go-openai v1.41.2
+# github.com/sashabaranov/go-openai v1.42.1
 ## explicit; go 1.18
 github.com/sashabaranov/go-openai
 github.com/sashabaranov/go-openai/internal
-github.com/sashabaranov/go-openai/jsonschema
 # github.com/spf13/cobra v1.10.2
 ## explicit; go 1.15
 github.com/spf13/cobra

From cf6131a829fa18d040202c4c27b22ccae2937b14 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 15:51:05 +0300
Subject: [PATCH 2/7] Upgrade frontend to Vite 8 and vue-router 5

- Update vite 6.4 -> 8.3 and @vitejs/plugin-vue 5 -> 6; switch the vt
  build config to rolldownOptions
- Update vue-router 4 -> 5, vue-tsc 2 -> 3 and typescript 5.7 -> 6.0;
  pin typescript with ~ since TS 7 breaks vue-tsc (./lib/tsc is gone)
- Update markdown-it 14 -> 15 and drop @types/markdown-it: import
  StateCore/Token from the package root, deep lib/* imports are removed
- markdown-it 15 stops fuzzy-linking bare names, so README.md or
  setup.py in review text no longer become bogus http:// links
- Load highlight.js/lib/common instead of every language: main chunk
  drops 1.21 MB -> 447 KB; alias postgresql fences to sql
- Drop the unused selectEl ref in FillExampleSelect found by vue-tsc 3
- Bump vue, tailwindcss, mermaid 11.17, highlight.js and ufo minors,
  clearing all 12 npm audit advisories
- Keep mermaid on 11.x: 12.0 adds 2 MB to the embedded bundle and a
  lodash-es advisory via chevrotain
- Move to Node 24 (.nvmrc, Docker) and declare engines node >=22.12
- Add a Frontend workflow: npm ci, build:all, audit of runtime deps
---
 .github/workflows/frontend.yml                |   38 +
 Dockerfile                                    |    2 +-
 frontend/.nvmrc                               |    2 +-
 frontend/package-lock.json                    | 2784 ++++++++---------
 frontend/package.json                         |   28 +-
 frontend/src/components/MarkdownContent.vue   |   13 +-
 .../src/vt/components/FillExampleSelect.vue   |    5 +-
 frontend/vite.config.vt.ts                    |    2 +-
 8 files changed, 1398 insertions(+), 1476 deletions(-)
 create mode 100644 .github/workflows/frontend.yml

diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
new file mode 100644
index 0000000..af1721d
--- /dev/null
+++ b/.github/workflows/frontend.yml
@@ -0,0 +1,38 @@
+name: Frontend
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: frontend/.nvmrc
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build:all
+
+      # Runtime deps only: they ship inside the embedded bundle. Dev-server
+      # advisories (vite, rolldown) don't reach production.
+      - name: Audit
+        run: npm audit --omit=dev --audit-level=high
diff --git a/Dockerfile b/Dockerfile
index 7c37496..b8ebb04 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build frontend
-FROM node:20-alpine AS frontend
+FROM node:24-alpine AS frontend
 WORKDIR /frontend
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci
diff --git a/frontend/.nvmrc b/frontend/.nvmrc
index 209e3ef..a45fd52 100644
--- a/frontend/.nvmrc
+++ b/frontend/.nvmrc
@@ -1 +1 @@
-20
+24
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 759b17d..30656f7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -9,22 +9,24 @@
       "version": "0.0.3",
       "dependencies": {
         "@headlessui/vue": "^1.7.23",
-        "highlight.js": "^11.11.1",
-        "markdown-it": "^14.1.0",
-        "mermaid": "^11.14.0",
+        "highlight.js": "^11.12.0",
+        "markdown-it": "^15.0.2",
+        "mermaid": "^11.17.2",
         "ofetch": "^1.5.1",
-        "ufo": "^1.6.3",
-        "vue": "^3.5.13",
-        "vue-router": "^4.5.0"
+        "ufo": "^1.6.4",
+        "vue": "^3.5.43",
+        "vue-router": "^5.3.1"
       },
       "devDependencies": {
-        "@tailwindcss/vite": "^4.1.3",
-        "@types/markdown-it": "^14.1.2",
-        "@vitejs/plugin-vue": "^5.2.1",
-        "tailwindcss": "^4.1.3",
-        "typescript": "~5.7.2",
-        "vite": "^6.3.2",
-        "vue-tsc": "^2.2.8"
+        "@tailwindcss/vite": "^4.3.3",
+        "@vitejs/plugin-vue": "^6.0.9",
+        "tailwindcss": "^4.3.3",
+        "typescript": "~6.0.3",
+        "vite": "^8.3.1",
+        "vue-tsc": "^3.3.11"
+      },
+      "engines": {
+        "node": ">=22.12"
       }
     },
     "node_modules/@antfu/install-pkg": {
@@ -41,30 +43,30 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "version": "7.29.9",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz",
+      "integrity": "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -74,13 +76,13 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -92,336 +94,417 @@
       "integrity": "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==",
       "license": "MIT"
     },
-    "node_modules/@chevrotain/cst-dts-gen": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-12.0.0.tgz",
-      "integrity": "sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg==",
-      "license": "Apache-2.0",
+    "node_modules/@chevrotain/types": {
+      "version": "11.1.2",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.1.2.tgz",
+      "integrity": "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/@headlessui/vue": {
+      "version": "1.7.23",
+      "resolved": "https://registry.npmjs.org/@headlessui/vue/-/vue-1.7.23.tgz",
+      "integrity": "sha512-JzdCNqurrtuu0YW6QaDtR2PIYCKPUWq28csDyMvN4zmGccmE7lz40Is6hc3LA4HFeCI7sekZ/PQMTNmn9I/4Wg==",
+      "license": "MIT",
       "dependencies": {
-        "@chevrotain/gast": "12.0.0",
-        "@chevrotain/types": "12.0.0"
+        "@tanstack/vue-virtual": "^3.0.0-beta.60"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "vue": "^3.2.0"
       }
     },
-    "node_modules/@chevrotain/gast": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-12.0.0.tgz",
-      "integrity": "sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ==",
-      "license": "Apache-2.0",
+    "node_modules/@iconify/types": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
+      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
+      "license": "MIT"
+    },
+    "node_modules/@iconify/utils": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.0.tgz",
+      "integrity": "sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw==",
+      "license": "MIT",
       "dependencies": {
-        "@chevrotain/types": "12.0.0"
+        "@antfu/install-pkg": "^1.1.0",
+        "@iconify/types": "^2.0.0",
+        "mlly": "^1.8.0"
       }
     },
-    "node_modules/@chevrotain/regexp-to-ast": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-12.0.0.tgz",
-      "integrity": "sha512-p+EW9MaJwgaHguhoqwOtx/FwuGr+DnNn857sXWOi/mClXIkPGl3rn7hGNWvo31HA3vyeQxjqe+H36yZJwYU8cA==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/@chevrotain/types": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-12.0.0.tgz",
-      "integrity": "sha512-S+04vjFQKeuYw0/eW3U52LkAHQsB1ASxsPGsLPUyQgrZ2iNNibQrsidruDzjEX2JYfespXMG0eZmXlhA6z7nWA==",
-      "license": "Apache-2.0"
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@chevrotain/utils": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-12.0.0.tgz",
-      "integrity": "sha512-lB59uJoaGIfOOL9knQqQRfhl9g7x8/wqFkp13zTdkRu1huG9kg6IJs1O8hqj9rs6h7orGxHJUKb+mX3rPbWGhA==",
-      "license": "Apache-2.0"
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">=6.0.0"
       }
     },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@mermaid-js/parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz",
+      "integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==",
+      "license": "MIT",
+      "dependencies": {
+        "@chevrotain/types": "~11.1.2"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.151.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.151.0.tgz",
+      "integrity": "sha512-J1yXrIlNDZVzE3ada310xeAw7nH8yCAyLPuUIsjKatFPmfn5bS1oW+cM+QsGOtVWd5nhSpbwZWx/rue+r5Z+PA==",
+      "devOptional": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/oxc-project"
       }
     },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+    "node_modules/@rolldown/binding-android-arm-eabi": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.10.tgz",
+      "integrity": "sha512-bp9svZb+QurZeh+8H4BhrZkifEB0YBNvTVzNSJnJQkj4NrRwmQoDUCGP0vSN7PbvLeM7l1tK6GXL8mrTiH2myg==",
       "cpu": [
-        "arm64"
+        "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.10.tgz",
+      "integrity": "sha512-wm6Dld3RXUAZ/gRWKyUy+4W1B5CB5UeFaOzsSWJWEdxZXHH8rCYiZ5dGe6oJmhsunAPWzL7FZV+VtvmN5Ye2eA==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.10.tgz",
+      "integrity": "sha512-UbEfXq/AqGNgRTV3ik+X/iR6mUxu2QdYAadwRxJWquUGnW6gDqdP1FtLtFXRow7RJx0ssRwi80XAPr4r+4DtsA==",
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.10.tgz",
+      "integrity": "sha512-7f5h17q5KZVx/ji1vb8OTq31ch1O2I7K8NPIr44GkyWTApXMIsmhWqZfgpOH10xeauqghDAvGlZktasCkcF6Eg==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.10.tgz",
+      "integrity": "sha512-ynOk/eEYhC6ZB2xCGvKrEOwE58oBy9LnrAqtkrDF9Fz1VTaNdGZTsV0VarJdhPwb+sOJTGjCLwcuyRJZ1dnMcQ==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "freebsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.10.tgz",
+      "integrity": "sha512-ERrAs185meZZhGan7a4l3RiiJK1ArSDlHdST++uvSxe+FDbR4TwUPahT/cbZJvaG6fIpDpF78surN+tX708Y4Q==",
       "cpu": [
-        "x64"
+        "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "freebsd"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.10.tgz",
+      "integrity": "sha512-KN7OHKD0J3jy1UzBwZWPxpwhODf9IARUIJcrH+yLYKOcmegZ8luEUM38lDP1bDVj40yP6PsSzCqOJF76vljFnQ==",
       "cpu": [
-        "arm"
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.10.tgz",
+      "integrity": "sha512-8l9wP8O+wa8zD6iw6egSfzVtu7oZVfH3hlUsMM4MwbLMhxleqeoXbZzjddyK3YyNlwLhqznq3tF7PkNJ8T/V2w==",
       "cpu": [
         "arm64"
       ],
-      "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.10.tgz",
+      "integrity": "sha512-SeXNKeQzA5kLhz/J0CH6ZP0/HJ3v1xm/0YbiYpE0kK7emfRC2OIGGIaE14xzkISEGv2aYuUSpiLiU5Gbq+OI0A==",
       "cpu": [
-        "ia32"
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.10.tgz",
+      "integrity": "sha512-mtht0nR+y8/hart4175Ll15w7lY8dg7CtQ+j2FDNTsDRspOWTK/2V3l0aj9sIj7XmvqxT8Yli/wq22e7feTTWg==",
       "cpu": [
-        "loong64"
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.10.tgz",
+      "integrity": "sha512-FSM94nGd55NYo48usCyM/nHfUKRnqc9+b0vJNuKV0oCCpIp/OGims7rO1Nv/DkFkt0S/s2rxsJ2kkS8J3HcpeA==",
       "cpu": [
-        "mips64el"
+        "x64"
+      ],
+      "libc": [
+        "glibc"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.10.tgz",
+      "integrity": "sha512-C3YxNB16myRLs7o+B+6PnQ6jBsdIS4+AE4Ah8glVGhDpEv9AOvxhZ/1duAb4B0UGczEK/lBbccksd8VI+p6zfw==",
       "cpu": [
-        "ppc64"
+        "x64"
+      ],
+      "libc": [
+        "musl"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.10.tgz",
+      "integrity": "sha512-571TlE/F1eeTjjdjYAMMMPs1Mfv3MtX6s3+ZKVU6HiUjZ5Njc6c/qzNy/8K3zALTZnaw3JQVYrHxvNfjm43KAg==",
       "cpu": [
-        "riscv64"
+        "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "openharmony"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.10.tgz",
+      "integrity": "sha512-QXW+ZWaiqs2c7Fi++D/SsW07LTPcUrncxcskJGfGNBoaLik1IU6fJymz4HsqwEO0u5Iq11yTO0B/mc4cPk7jrQ==",
       "cpu": [
-        "s390x"
+        "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "win32"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.10.tgz",
+      "integrity": "sha512-5FQFGgah17YeMtG1Yd5a+rMxQpTksyNXxRtKz06FVTaQw3RKYUJQbUoKk0/5jrXBpDo+7makNP7UHA2LQyH64A==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "win32"
       ],
       "engines": {
-        "node": ">=18"
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
       }
     },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
       "cpu": [
         "arm64"
       ],
@@ -429,50 +512,50 @@
       "license": "MIT",
       "optional": true,
       "os": [
-        "netbsd"
+        "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "netbsd"
+        "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "openbsd"
+        "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
       "cpu": [
         "x64"
       ],
@@ -480,764 +563,143 @@
       "license": "MIT",
       "optional": true,
       "os": [
-        "openbsd"
+        "freebsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
       "cpu": [
-        "arm64"
+        "arm"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "openharmony"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "sunos"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "win32"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
       "cpu": [
-        "ia32"
+        "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "win32"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "win32"
+        "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 20"
       }
     },
-    "node_modules/@headlessui/vue": {
-      "version": "1.7.23",
-      "resolved": "https://registry.npmjs.org/@headlessui/vue/-/vue-1.7.23.tgz",
-      "integrity": "sha512-JzdCNqurrtuu0YW6QaDtR2PIYCKPUWq28csDyMvN4zmGccmE7lz40Is6hc3LA4HFeCI7sekZ/PQMTNmn9I/4Wg==",
-      "license": "MIT",
-      "dependencies": {
-        "@tanstack/vue-virtual": "^3.0.0-beta.60"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "vue": "^3.2.0"
-      }
-    },
-    "node_modules/@iconify/types": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
-      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
-      "license": "MIT"
-    },
-    "node_modules/@iconify/utils": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.0.tgz",
-      "integrity": "sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw==",
-      "license": "MIT",
-      "dependencies": {
-        "@antfu/install-pkg": "^1.1.0",
-        "@iconify/types": "^2.0.0",
-        "mlly": "^1.8.0"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "node_modules/@mermaid-js/parser": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.0.tgz",
-      "integrity": "sha512-gxK9ZX2+Fex5zu8LhRQoMeMPEHbc73UKZ0FQ54YrQtUxE1VVhMwzeNtKRPAu5aXks4FasbMe4xB4bWrmq6Jlxw==",
-      "license": "MIT",
-      "dependencies": {
-        "langium": "^4.0.0"
-      }
-    },
-    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
-      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
-      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
-      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
-      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
-      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
-      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
-      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
-      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
-      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
-      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
-      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
-      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
-      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
-      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
-      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
-      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.57.1.tgz",
-      "integrity": "sha512-HFps0JeGtuOR2convgRRkHCekD7j+gdAuXM+/i6kGzQtFhlCtQkpwtNzkNj6QhCDp7DRJ7+qC/1Vg2jt5iSOFw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
-      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
-      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
-      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
-      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
-      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@tailwindcss/node": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.1.18.tgz",
-      "integrity": "sha512-DoR7U1P7iYhw16qJ49fgXUlry1t4CpXeErJHnQ44JgTSKMaZUdf17cfn5mHchfJ4KRBZRFA/Coo+MUF5+gOaCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/remapping": "^2.3.4",
-        "enhanced-resolve": "^5.18.3",
-        "jiti": "^2.6.1",
-        "lightningcss": "1.30.2",
-        "magic-string": "^0.30.21",
-        "source-map-js": "^1.2.1",
-        "tailwindcss": "4.1.18"
-      }
-    },
-    "node_modules/@tailwindcss/oxide": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.1.18.tgz",
-      "integrity": "sha512-EgCR5tTS5bUSKQgzeMClT6iCY3ToqE1y+ZB0AKldj809QXk1Y+3jB0upOYZrn9aGIzPtUsP7sX4QQ4XtjBB95A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      },
-      "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.1.18",
-        "@tailwindcss/oxide-darwin-arm64": "4.1.18",
-        "@tailwindcss/oxide-darwin-x64": "4.1.18",
-        "@tailwindcss/oxide-freebsd-x64": "4.1.18",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.1.18",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.1.18",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.1.18",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.1.18",
-        "@tailwindcss/oxide-linux-x64-musl": "4.1.18",
-        "@tailwindcss/oxide-wasm32-wasi": "4.1.18",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.1.18",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.1.18"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.1.18.tgz",
-      "integrity": "sha512-dJHz7+Ugr9U/diKJA0W6N/6/cjI+ZTAoxPf9Iz9BFRF2GzEX8IvXxFIi/dZBloVJX/MZGvRuFA9rqwdiIEZQ0Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.1.18.tgz",
-      "integrity": "sha512-Gc2q4Qhs660bhjyBSKgq6BYvwDz4G+BuyJ5H1xfhmDR3D8HnHCmT/BSkvSL0vQLy/nkMLY20PQ2OoYMO15Jd0A==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.1.18.tgz",
-      "integrity": "sha512-FL5oxr2xQsFrc3X9o1fjHKBYBMD1QZNyc1Xzw/h5Qu4XnEBi3dZn96HcHm41c/euGV+GRiXFfh2hUCyKi/e+yw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.1.18.tgz",
-      "integrity": "sha512-Fj+RHgu5bDodmV1dM9yAxlfJwkkWvLiRjbhuO2LEtwtlYlBgiAT4x/j5wQr1tC3SANAgD+0YcmWVrj8R9trVMA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.1.18.tgz",
-      "integrity": "sha512-Fp+Wzk/Ws4dZn+LV2Nqx3IilnhH51YZoRaYHQsVq3RQvEl+71VGKFpkfHrLM/Li+kt5c0DJe/bHXK1eHgDmdiA==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.1.18.tgz",
-      "integrity": "sha512-S0n3jboLysNbh55Vrt7pk9wgpyTTPD0fdQeh7wQfMqLPM/Hrxi+dVsLsPrycQjGKEQk85Kgbx+6+QnYNiHalnw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.1.18.tgz",
-      "integrity": "sha512-1px92582HkPQlaaCkdRcio71p8bc8i/ap5807tPRDK/uw953cauQBT8c5tVGkOwrHMfc2Yh6UuxaH4vtTjGvHg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.1.18.tgz",
-      "integrity": "sha512-v3gyT0ivkfBLoZGF9LyHmts0Isc8jHZyVcbzio6Wpzifg/+5ZJpDiRiUhDLkcr7f/r38SWNe7ucxmGW3j3Kb/g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.1.18.tgz",
-      "integrity": "sha512-bhJ2y2OQNlcRwwgOAGMY0xTFStt4/wyU6pvI6LSuZpRgKQwxTec0/3Scu91O8ir7qCR3AuepQKLU/kX99FouqQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.1.18.tgz",
-      "integrity": "sha512-LffYTvPjODiP6PT16oNeUQJzNVyJl1cjIebq/rWWBF+3eDst5JGEFSc5cWxyRCJ0Mxl+KyIkqRxk1XPEs9x8TA==",
-      "bundleDependencies": [
-        "@napi-rs/wasm-runtime",
-        "@emnapi/core",
-        "@emnapi/runtime",
-        "@tybys/wasm-util",
-        "@emnapi/wasi-threads",
-        "tslib"
-      ],
-      "cpu": [
-        "wasm32"
-      ],
-      "dev": true,
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1",
-        "@emnapi/wasi-threads": "^1.1.0",
-        "@napi-rs/wasm-runtime": "^1.1.0",
-        "@tybys/wasm-util": "^0.10.1",
-        "tslib": "^2.4.0"
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.18.tgz",
-      "integrity": "sha512-HjSA7mr9HmC8fu6bdsZvZ+dhjyGCLdotjVOgLA2vEqxEBZaQo9YTX4kwgEvPCpRh8o4uWc4J/wEoFzhEmjvPbA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
       "cpu": [
         "arm64"
       ],
@@ -1248,13 +710,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.1.18.tgz",
-      "integrity": "sha512-bJWbyYpUlqamC8dpR7pfjA0I7vdF6t5VpUGMWRkXVE3AXgIZjYUYAK7II1GNaxR8J1SSrSrppRar8G++JekE3Q==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
       "cpu": [
         "x64"
       ],
@@ -1265,22 +727,22 @@
         "win32"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/vite": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.1.18.tgz",
-      "integrity": "sha512-jVA+/UpKL1vRLg6Hkao5jldawNmRo7mQYrZtNHMIVpLfLhDml5nMRUo/8MwoX2vNXvnaXNNMedrMfMugAVX1nA==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tailwindcss/node": "4.1.18",
-        "@tailwindcss/oxide": "4.1.18",
-        "tailwindcss": "4.1.18"
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
       },
       "peerDependencies": {
-        "vite": "^5.2.0 || ^6 || ^7"
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
       }
     },
     "node_modules/@tanstack/virtual-core": {
@@ -1562,44 +1024,12 @@
         "@types/d3-selection": "*"
       }
     },
-    "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/geojson": {
       "version": "7946.0.16",
       "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
       "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
       "license": "MIT"
     },
-    "node_modules/@types/linkify-it": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-5.0.0.tgz",
-      "integrity": "sha512-sVDA58zAw4eWAffKOaQH5/5j3XeayukzDk+ewSsnv3p4yJEZHCCzMDiZM8e0OUrRvmpGZ85jf4yDHkHsgBNr9Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/markdown-it": {
-      "version": "14.1.2",
-      "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-14.1.2.tgz",
-      "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/linkify-it": "^5",
-        "@types/mdurl": "^2"
-      }
-    },
-    "node_modules/@types/mdurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-2.0.0.tgz",
-      "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
@@ -1618,56 +1048,86 @@
       }
     },
     "node_modules/@vitejs/plugin-vue": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-5.2.4.tgz",
-      "integrity": "sha512-7Yx/SXSOcQq5HiiV3orevHUFn+pmMB4cgbEkDYgnkUWb0WfeQ/wa2yFv6D5ICiCQOVpjA7vYDXrC7AGO8yjDHA==",
+      "version": "6.0.9",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-vue/-/plugin-vue-6.0.9.tgz",
+      "integrity": "sha512-rD/MORlhaZMlXWW0rEn4FB4wMinWC0z/D7Ye160S5+Rs1mC8ZDAdcDp4SjKfUhG5t8q1ktcPVw4xuTkPRlzrSA==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "@rolldown/pluginutils": "^1.0.1"
+      },
       "engines": {
-        "node": "^18.0.0 || >=20.0.0"
+        "node": "^20.19.0 || >=22.12.0"
       },
       "peerDependencies": {
-        "vite": "^5.0.0 || ^6.0.0",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0",
         "vue": "^3.2.25"
       }
     },
     "node_modules/@volar/language-core": {
-      "version": "2.4.15",
-      "resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.15.tgz",
-      "integrity": "sha512-3VHw+QZU0ZG9IuQmzT68IyN4hZNd9GchGPhbD9+pa8CVv7rnoOZwo7T8weIbrRmihqy3ATpdfXFnqRrfPVK6CA==",
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.28.tgz",
+      "integrity": "sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@volar/source-map": "2.4.15"
+        "@volar/source-map": "2.4.28"
       }
     },
     "node_modules/@volar/source-map": {
-      "version": "2.4.15",
-      "resolved": "https://registry.npmjs.org/@volar/source-map/-/source-map-2.4.15.tgz",
-      "integrity": "sha512-CPbMWlUN6hVZJYGcU/GSoHu4EnCHiLaXI9n8c9la6RaI9W5JHX+NqG+GSQcB0JdC2FIBLdZJwGsfKyBB71VlTg==",
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/source-map/-/source-map-2.4.28.tgz",
+      "integrity": "sha512-yX2BDBqJkRXfKw8my8VarTyjv48QwxdJtvRgUpNE5erCsgEUdI2DsLbpa+rOQVAJYshY99szEcRDmyHbF10ggQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@volar/typescript": {
-      "version": "2.4.15",
-      "resolved": "https://registry.npmjs.org/@volar/typescript/-/typescript-2.4.15.tgz",
-      "integrity": "sha512-2aZ8i0cqPGjXb4BhkMsPYDkkuc2ZQ6yOpqwAuNwUoncELqoy5fRgOQtLR9gB0g902iS0NAkvpIzs27geVyVdPg==",
+      "version": "2.4.28",
+      "resolved": "https://registry.npmjs.org/@volar/typescript/-/typescript-2.4.28.tgz",
+      "integrity": "sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@volar/language-core": "2.4.15",
+        "@volar/language-core": "2.4.28",
         "path-browserify": "^1.0.1",
         "vscode-uri": "^3.0.8"
       }
     },
+    "node_modules/@vue-macros/common": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/@vue-macros/common/-/common-3.1.4.tgz",
+      "integrity": "sha512-/5Fv+6DgIcM9ajY05ZmKBv+LMX1M9A0X+IUwDRVdt67ciw8OV9bvG2r34p3RiEadlsQybjhKPRKNXDC8Bp23cw==",
+      "license": "MIT",
+      "dependencies": {
+        "@vue/compiler-sfc": "^3.5.22",
+        "ast-kit": "^2.1.2",
+        "local-pkg": "^1.1.2",
+        "magic-string-ast": "^1.0.2",
+        "unplugin-utils": "^0.3.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/vue-macros"
+      },
+      "peerDependencies": {
+        "vue": "^2.7.0 || ^3.2.25"
+      },
+      "peerDependenciesMeta": {
+        "vue": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@vue/compiler-core": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.28.tgz",
-      "integrity": "sha512-kviccYxTgoE8n6OCw96BNdYlBg2GOWfBuOW4Vqwrt7mSKWKwFVvI8egdTltqRgITGPsTFYtKYfxIG8ptX2PJHQ==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.43.tgz",
+      "integrity": "sha512-zdiLhnbe1QQqgDT8xZMpNmyqZ3qlI+/Q/FHQco57Kwl/b05HhCzN6eVGN9QU9rbga4CrS0H5SYY8VGHZCt/1Hg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@vue/shared": "3.5.28",
+        "@babel/parser": "^7.29.8",
+        "@vue/shared": "3.5.43",
         "entities": "^7.0.1",
         "estree-walker": "^2.0.2",
         "source-map-js": "^1.2.1"
@@ -1686,132 +1146,131 @@
       }
     },
     "node_modules/@vue/compiler-dom": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.28.tgz",
-      "integrity": "sha512-/1ZepxAb159jKR1btkefDP+J2xuWL5V3WtleRmxaT+K2Aqiek/Ab/+Ebrw2pPj0sdHO8ViAyyJWfhXXOP/+LQA==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.5.43.tgz",
+      "integrity": "sha512-PEZoAk3NQmsn/ejMzSOCyTYqwGqczrWm70PuhBKjjv1+TCoQAaO/zOqNwjV+honlNstT5ILxtc+8r8UUfj+iEQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-core": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-core": "3.5.43",
+        "@vue/shared": "3.5.43"
       }
     },
     "node_modules/@vue/compiler-sfc": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.28.tgz",
-      "integrity": "sha512-6TnKMiNkd6u6VeVDhZn/07KhEZuBSn43Wd2No5zaP5s3xm8IqFTHBj84HJah4UepSUJTro5SoqqlOY22FKY96g==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.5.43.tgz",
+      "integrity": "sha512-FCbrG3XNCRl+js3huuKx4IVHBLTvMkJhVepjbxSPu1gn4yWLaYtGNQdjJGZaMytXB6qb76qQDDmDSLy/vkmleQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@vue/compiler-core": "3.5.28",
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/compiler-ssr": "3.5.28",
-        "@vue/shared": "3.5.28",
+        "@babel/parser": "^7.29.8",
+        "@vue/compiler-core": "3.5.43",
+        "@vue/compiler-dom": "3.5.43",
+        "@vue/compiler-ssr": "3.5.43",
+        "@vue/shared": "3.5.43",
         "estree-walker": "^2.0.2",
         "magic-string": "^0.30.21",
-        "postcss": "^8.5.6",
+        "postcss": "^8.5.28",
         "source-map-js": "^1.2.1"
       }
     },
     "node_modules/@vue/compiler-ssr": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.28.tgz",
-      "integrity": "sha512-JCq//9w1qmC6UGLWJX7RXzrGpKkroubey/ZFqTpvEIDJEKGgntuDMqkuWiZvzTzTA5h2qZvFBFHY7fAAa9475g==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.5.43.tgz",
+      "integrity": "sha512-GF62orf7KiJX9RqrHNGrYBudsQGD0OhJ5nDs90O8UiDuS40+YMYomiXu6w6EuvtXuRDc3MSNis3EaaSKAVSWpg==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-dom": "3.5.43",
+        "@vue/shared": "3.5.43"
       }
     },
-    "node_modules/@vue/compiler-vue2": {
-      "version": "2.7.16",
-      "resolved": "https://registry.npmjs.org/@vue/compiler-vue2/-/compiler-vue2-2.7.16.tgz",
-      "integrity": "sha512-qYC3Psj9S/mfu9uVi5WvNZIzq+xnXMhOwbTFKKDD7b1lhpnn71jXSFdTQ+WsIEk0ONCd7VV2IMm7ONl6tbQ86A==",
-      "dev": true,
+    "node_modules/@vue/devtools-api": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-8.2.1.tgz",
+      "integrity": "sha512-6u4vXBlIBAC1wMplIZgpyPn7uh/s4Bf6F5bMzvLv+EdJ0aHs/+4B7Ygv864EStQSjRbsRzTko/kUG1A1IejQ3A==",
       "license": "MIT",
       "dependencies": {
-        "de-indent": "^1.0.2",
-        "he": "^1.2.0"
+        "@vue/devtools-kit": "^8.2.1"
       }
     },
-    "node_modules/@vue/devtools-api": {
-      "version": "6.6.4",
-      "resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.6.4.tgz",
-      "integrity": "sha512-sGhTPMuXqZ1rVOk32RylztWkfXTRhuS7vgAKv0zjqk8gbsHkJ7xfFf+jbySxt7tWObEJwyKaHMikV/WGDiQm8g==",
+    "node_modules/@vue/devtools-kit": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-kit/-/devtools-kit-8.2.1.tgz",
+      "integrity": "sha512-FIGIuq3AWReEpbAHY/cRGeHDfI0qOb8OCQ3YjbEAX04uaxIDbGc9rhkbVcG7rnfHPXE3RsU5KrWOu9V/okd8AQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@vue/devtools-shared": "^8.2.1",
+        "birpc": "^2.6.1",
+        "hookable": "^5.5.3",
+        "perfect-debounce": "^2.0.0"
+      }
+    },
+    "node_modules/@vue/devtools-shared": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-shared/-/devtools-shared-8.2.1.tgz",
+      "integrity": "sha512-Fkac7lUdGReh6pVOi3AYPRGe82LQqRmAfThW7RRligOAP0ZA/Z1z9XLHDM9dv34pV2HRc79DK8uKPeG2fLnA/g==",
       "license": "MIT"
     },
     "node_modules/@vue/language-core": {
-      "version": "2.2.12",
-      "resolved": "https://registry.npmjs.org/@vue/language-core/-/language-core-2.2.12.tgz",
-      "integrity": "sha512-IsGljWbKGU1MZpBPN+BvPAdr55YPkj2nB/TBNGNC32Vy2qLG25DYu/NBN2vNtZqdRbTRjaoYrahLrToim2NanA==",
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/@vue/language-core/-/language-core-3.3.11.tgz",
+      "integrity": "sha512-QJmpliwAVpC/OxubIByPAhNzsQPRc8/gxlN2qnVzVfIMjMDz/9RnXRFoetjz5yEgXVXyp4LqhXq3V53PjmNzFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@volar/language-core": "2.4.15",
+        "@volar/language-core": "2.4.28",
         "@vue/compiler-dom": "^3.5.0",
-        "@vue/compiler-vue2": "^2.7.16",
         "@vue/shared": "^3.5.0",
-        "alien-signals": "^1.0.3",
-        "minimatch": "^9.0.3",
+        "alien-signals": "^3.2.1",
         "muggle-string": "^0.4.1",
-        "path-browserify": "^1.0.1"
-      },
-      "peerDependencies": {
-        "typescript": "*"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+        "path-browserify": "^1.0.1",
+        "picomatch": "^4.0.4"
       }
     },
     "node_modules/@vue/reactivity": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.28.tgz",
-      "integrity": "sha512-gr5hEsxvn+RNyu9/9o1WtdYdwDjg5FgjUSBEkZWqgTKlo/fvwZ2+8W6AfKsc9YN2k/+iHYdS9vZYAhpi10kNaw==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.43.tgz",
+      "integrity": "sha512-G/c9GyOZNI2jVaaS6OX1EF1SSFSv7H0ERqNTl4+DTFMlZmB5eVAB53aLQNam/7NL2NPtaDD7RdVrzf8uJzMuOA==",
       "license": "MIT",
       "dependencies": {
-        "@vue/shared": "3.5.28"
+        "@vue/shared": "3.5.43"
       }
     },
     "node_modules/@vue/runtime-core": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.28.tgz",
-      "integrity": "sha512-POVHTdbgnrBBIpnbYU4y7pOMNlPn2QVxVzkvEA2pEgvzbelQq4ZOUxbp2oiyo+BOtiYlm8Q44wShHJoBvDPAjQ==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.5.43.tgz",
+      "integrity": "sha512-hU6U6VnVhBGQDpvlnnDlIB8ZGJBiOcgk2lh/0InltHiz3D8oSkluvuvY+do1G2H3+udeKFsmaBlgVYP7gXQzEw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/reactivity": "3.5.43",
+        "@vue/shared": "3.5.43"
       }
     },
     "node_modules/@vue/runtime-dom": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.28.tgz",
-      "integrity": "sha512-4SXxSF8SXYMuhAIkT+eBRqOkWEfPu6nhccrzrkioA6l0boiq7sp18HCOov9qWJA5HML61kW8p/cB4MmBiG9dSA==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.5.43.tgz",
+      "integrity": "sha512-Bb2Jc0YjjJdMt1SJmb9b2L/IWd3I8lIT9x9eS/xvvP9CiVgna0ffua74xKRmt4/uSJ+0r4iN8ex1jrqkhQGWQw==",
       "license": "MIT",
       "dependencies": {
-        "@vue/reactivity": "3.5.28",
-        "@vue/runtime-core": "3.5.28",
-        "@vue/shared": "3.5.28",
+        "@vue/reactivity": "3.5.43",
+        "@vue/runtime-core": "3.5.43",
+        "@vue/shared": "3.5.43",
         "csstype": "^3.2.3"
       }
     },
     "node_modules/@vue/server-renderer": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.28.tgz",
-      "integrity": "sha512-pf+5ECKGj8fX95bNincbzJ6yp6nyzuLDhYZCeFxUNp8EBrQpPpQaLX3nNCp49+UbgbPun3CeVE+5CXVV1Xydfg==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.5.43.tgz",
+      "integrity": "sha512-l2Ygjv9NehV94PSBxNWsAHC0j/eIIKbn92mBuWXAPGLnn6HfJ6MH5ubsd+Nk0YoZ5FRuxWI1P2VSoh+dbPQhCQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-ssr": "3.5.28",
-        "@vue/shared": "3.5.28"
-      },
-      "peerDependencies": {
-        "vue": "3.5.28"
+        "@vue/compiler-ssr": "3.5.43",
+        "@vue/runtime-dom": "3.5.43",
+        "@vue/shared": "3.5.43"
       }
     },
     "node_modules/@vue/shared": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.28.tgz",
-      "integrity": "sha512-cfWa1fCGBxrvaHRhvV3Is0MgmrbSCxYTXCSCau2I0a1Xw1N1pHAvkWCiXPRAqjvToILvguNyEwjevUqAuBQWvQ==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.5.43.tgz",
+      "integrity": "sha512-uksS7YGMR5NZyr4JNq0Rp+QyLns0ueaz20KwzIPW9R0LH1Vnt4E+XUM29PNseEbf1www2gOuhuDi5AKOIXag9Q==",
       "license": "MIT"
     },
     "node_modules/acorn": {
@@ -1827,61 +1286,83 @@
       }
     },
     "node_modules/alien-signals": {
-      "version": "1.0.13",
-      "resolved": "https://registry.npmjs.org/alien-signals/-/alien-signals-1.0.13.tgz",
-      "integrity": "sha512-OGj9yyTnJEttvzhTUWuscOvtqxq5vrhF7vL9oS0xJ2mK0ItPYP1/y+vCFebfxoEyAz0++1AIwJ5CMr+Fk3nDmg==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/alien-signals/-/alien-signals-3.2.1.tgz",
+      "integrity": "sha512-I8FjmltrfnDFoZedi5CG8DghVYNhzb/Ijluz7tCSJH0xpd0484Kowhbb1XDYOxfJpU1p5wnM2X54dA+IfGyD1g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "license": "Python-2.0"
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.2.tgz",
+      "integrity": "sha512-mFdDM6WqWKraGLsVb+C9CahPnzTXOefAOLq3jYcca2YZ8bEWpr++Tzj+zSaKW9+X9L5uSxcm1AZ3Y6aZJ09OhQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "PSF-2.0"
     },
-    "node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
-      "dev": true,
+    "node_modules/ast-kit": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/ast-kit/-/ast-kit-2.2.0.tgz",
+      "integrity": "sha512-m1Q/RaVOnTp9JxPX+F+Zn7IcLYMzM8kZofDImfsKZd8MbR+ikdOzTeztStWqfrqIxZnYWryyI9ePm3NGjnZgGw==",
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "@babel/parser": "^7.28.5",
+        "pathe": "^2.0.3"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
       }
     },
-    "node_modules/chevrotain": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-12.0.0.tgz",
-      "integrity": "sha512-csJvb+6kEiQaqo1woTdSAuOWdN0WTLIydkKrBnS+V5gZz0oqBrp4kQ35519QgK6TpBThiG3V1vNSHlIkv4AglQ==",
-      "license": "Apache-2.0",
+    "node_modules/ast-walker-scope": {
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/ast-walker-scope/-/ast-walker-scope-0.9.0.tgz",
+      "integrity": "sha512-IJdzo2vLiElBxKzwS36VsCue/62d6IdWjnPB2v3nuPKeWGynp6FF/CYoLa5i/3jXH/z97ZDdsXz6abpgM6w07A==",
+      "license": "MIT",
       "dependencies": {
-        "@chevrotain/cst-dts-gen": "12.0.0",
-        "@chevrotain/gast": "12.0.0",
-        "@chevrotain/regexp-to-ast": "12.0.0",
-        "@chevrotain/types": "12.0.0",
-        "@chevrotain/utils": "12.0.0"
+        "@babel/parser": "^7.29.2",
+        "@babel/types": "^7.29.0",
+        "ast-kit": "^2.2.0"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
       }
     },
-    "node_modules/chevrotain-allstar": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/chevrotain-allstar/-/chevrotain-allstar-0.4.1.tgz",
-      "integrity": "sha512-PvVJm3oGqrveUVW2Vt/eZGeiAIsJszYweUcYwcskg9e+IubNYKKD+rHHem7A6XVO22eDAL+inxNIGAzZ/VIWlA==",
+    "node_modules/birpc": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/birpc/-/birpc-2.9.0.tgz",
+      "integrity": "sha512-KrayHS5pBi69Xi9JmvoqrIgYGDkD6mcSe/i6YKi3w5kekCLzrX4+nawcXqrj2tIp50Kw/mT/s3p+GVK0A0sKxw==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/chokidar": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
+      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
       "license": "MIT",
       "dependencies": {
-        "lodash-es": "^4.17.21"
+        "readdirp": "^5.0.0"
       },
-      "peerDependencies": {
-        "chevrotain": "^12.0.0"
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/commander": {
@@ -1915,9 +1396,9 @@
       "license": "MIT"
     },
     "node_modules/cytoscape": {
-      "version": "3.33.2",
-      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.2.tgz",
-      "integrity": "sha512-sj4HXd3DokGhzZAdjDejGvTPLqlt84vNFN8m7bGsOzDY5DyVcxIb2ejIXat2Iy7HxWhdT/N1oKyheJ5YdpsGuw==",
+      "version": "3.34.3",
+      "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.34.3.tgz",
+      "integrity": "sha512-yfYGhRcGAntq6YBD583j4n0Eg3jIxvWmZtz/5uz9UYkeIStSlMxuUja+ec5j3iBD8nv1rwaOAYMW09tBdkSeaQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10"
@@ -2414,16 +1895,9 @@
       }
     },
     "node_modules/dayjs": {
-      "version": "1.11.20",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.20.tgz",
-      "integrity": "sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==",
-      "license": "MIT"
-    },
-    "node_modules/de-indent": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/de-indent/-/de-indent-1.0.2.tgz",
-      "integrity": "sha512-e/1zu3xH5MQryN2zdVaF0OrdNLUbvWxzMbi+iNA6Bky7l1RoP8a2fIbRocyHclXt/arDrrR6lL3TqFD9pMQTsg==",
-      "dev": true,
+      "version": "1.11.23",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.23.tgz",
+      "integrity": "sha512-QDTCU0M0MxR3hQfnlDJfwekQiaanm1ubOD231u73WBckQ/fsamwRLiE2GBz6D3a/xF1NgfiDLJjXBa1hYOYTtQ==",
       "license": "MIT"
     },
     "node_modules/delaunator": {
@@ -2445,88 +1919,58 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/dompurify": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz",
-      "integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==",
+      "version": "3.4.16",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
+      "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.19.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz",
-      "integrity": "sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==",
+      "version": "5.25.1",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.25.1.tgz",
+      "integrity": "sha512-nGXts5znJzmWPu+mIE9izCOzdg63oJca2mDzGWWTth7sr4aCToKcoyFVBQwN75Ij5Pf6p510EwkTqViTRzDV+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.0"
+        "tapable": "^2.3.3"
       },
       "engines": {
         "node": ">=10.13.0"
       }
     },
     "node_modules/entities": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
-      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz",
+      "integrity": "sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==",
       "license": "BSD-2-Clause",
       "engines": {
-        "node": ">=0.12"
+        "node": ">=20.19.0"
       },
       "funding": {
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
-    "node_modules/esbuild": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
-      "dev": true,
-      "hasInstallScript": true,
+    "node_modules/es-toolkit": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.52.0.tgz",
+      "integrity": "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==",
       "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.25.12",
-        "@esbuild/android-arm": "0.25.12",
-        "@esbuild/android-arm64": "0.25.12",
-        "@esbuild/android-x64": "0.25.12",
-        "@esbuild/darwin-arm64": "0.25.12",
-        "@esbuild/darwin-x64": "0.25.12",
-        "@esbuild/freebsd-arm64": "0.25.12",
-        "@esbuild/freebsd-x64": "0.25.12",
-        "@esbuild/linux-arm": "0.25.12",
-        "@esbuild/linux-arm64": "0.25.12",
-        "@esbuild/linux-ia32": "0.25.12",
-        "@esbuild/linux-loong64": "0.25.12",
-        "@esbuild/linux-mips64el": "0.25.12",
-        "@esbuild/linux-ppc64": "0.25.12",
-        "@esbuild/linux-riscv64": "0.25.12",
-        "@esbuild/linux-s390x": "0.25.12",
-        "@esbuild/linux-x64": "0.25.12",
-        "@esbuild/netbsd-arm64": "0.25.12",
-        "@esbuild/netbsd-x64": "0.25.12",
-        "@esbuild/openbsd-arm64": "0.25.12",
-        "@esbuild/openbsd-x64": "0.25.12",
-        "@esbuild/openharmony-arm64": "0.25.12",
-        "@esbuild/sunos-x64": "0.25.12",
-        "@esbuild/win32-arm64": "0.25.12",
-        "@esbuild/win32-ia32": "0.25.12",
-        "@esbuild/win32-x64": "0.25.12"
-      }
+      "workspaces": [
+        "docs",
+        "benchmarks",
+        "tests/types",
+        "tests/browser-compat"
+      ]
     },
     "node_modules/estree-walker": {
       "version": "2.0.2",
@@ -2534,11 +1978,25 @@
       "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
       "license": "MIT"
     },
+    "node_modules/exsolve": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.1.tgz",
+      "integrity": "sha512-9U/jZUgjnSGyntRr6y5Muu1MJcwFl6kPu7k8qLF0IMNfLqvw0NZ4nnVDq0RVoZ0RvCyumib4Ez3KYrVfilrw+g==",
+      "license": "MIT"
+    },
+    "node_modules/fastdom": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz",
+      "integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==",
+      "license": "MIT",
+      "dependencies": {
+        "strictdom": "^1.0.1"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
       "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12.0.0"
@@ -2556,7 +2014,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -2580,25 +2037,21 @@
       "integrity": "sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==",
       "license": "MIT"
     },
-    "node_modules/he": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
-      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "he": "bin/he"
-      }
-    },
     "node_modules/highlight.js": {
-      "version": "11.11.1",
-      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-11.11.1.tgz",
-      "integrity": "sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==",
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-11.12.0.tgz",
+      "integrity": "sha512-nbfWpyRMcMrPMmDwJB+dhX/eiaPKtc2RB+0QZskqJ3WjRA/FDS0e9hZrx8EC/lbEv8gXy98FcDbNa/dspAaJMg==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=12.0.0"
       }
     },
+    "node_modules/hookable": {
+      "version": "5.5.3",
+      "resolved": "https://registry.npmjs.org/hookable/-/hookable-5.5.3.tgz",
+      "integrity": "sha512-Yc+BQe8SvoXH1643Qez1zqLRmbA5rCL+sSmk6TVos0LWVfNIB7PGncdlId77WzLGSIB5KaWgTaNTs2lNVEI6VQ==",
+      "license": "MIT"
+    },
     "node_modules/iconv-lite": {
       "version": "0.6.3",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
@@ -2621,19 +2074,19 @@
       }
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
-      "dev": true,
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
       }
     },
     "node_modules/katex": {
-      "version": "0.16.45",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.45.tgz",
-      "integrity": "sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==",
+      "version": "0.16.47",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
+      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
       "funding": [
         "https://opencollective.com/katex",
         "https://github.com/sponsors/katex"
@@ -2660,24 +2113,6 @@
       "resolved": "https://registry.npmjs.org/khroma/-/khroma-2.1.0.tgz",
       "integrity": "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="
     },
-    "node_modules/langium": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/langium/-/langium-4.2.2.tgz",
-      "integrity": "sha512-JUshTRAfHI4/MF9dH2WupvjSXyn8JBuUEWazB8ZVJUtXutT0doDlAv1XKbZ1Pb5sMexa8FF4CFBc0iiul7gbUQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@chevrotain/regexp-to-ast": "~12.0.0",
-        "chevrotain": "~12.0.0",
-        "chevrotain-allstar": "~0.4.1",
-        "vscode-languageserver": "~9.0.1",
-        "vscode-languageserver-textdocument": "~1.0.11",
-        "vscode-uri": "~3.1.0"
-      },
-      "engines": {
-        "node": ">=20.10.0",
-        "npm": ">=10.2.3"
-      }
-    },
     "node_modules/layout-base": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/layout-base/-/layout-base-1.0.2.tgz",
@@ -2685,9 +2120,9 @@
       "license": "MIT"
     },
     "node_modules/lightningcss": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.30.2.tgz",
-      "integrity": "sha512-utfs7Pr5uJyyvDETitgsaqSyjCb2qNRAtuqUeWIAKztsOYdcACf2KtARYXg2pSvhkt+9NfoaNY7fxjl6nuMjIQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
@@ -2701,23 +2136,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.30.2",
-        "lightningcss-darwin-arm64": "1.30.2",
-        "lightningcss-darwin-x64": "1.30.2",
-        "lightningcss-freebsd-x64": "1.30.2",
-        "lightningcss-linux-arm-gnueabihf": "1.30.2",
-        "lightningcss-linux-arm64-gnu": "1.30.2",
-        "lightningcss-linux-arm64-musl": "1.30.2",
-        "lightningcss-linux-x64-gnu": "1.30.2",
-        "lightningcss-linux-x64-musl": "1.30.2",
-        "lightningcss-win32-arm64-msvc": "1.30.2",
-        "lightningcss-win32-x64-msvc": "1.30.2"
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.30.2.tgz",
-      "integrity": "sha512-BH9sEdOCahSgmkVhBLeU7Hc9DWeZ1Eb6wNS6Da8igvUwAe0sqROHddIlvU06q3WyXVEOYDZ6ykBZQnjTbmo4+A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
       "cpu": [
         "arm64"
       ],
@@ -2736,9 +2171,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.30.2.tgz",
-      "integrity": "sha512-ylTcDJBN3Hp21TdhRT5zBOIi73P6/W0qwvlFEk22fkdXchtNTOU4Qc37SkzV+EKYxLouZ6M4LG9NfZ1qkhhBWA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
       "cpu": [
         "arm64"
       ],
@@ -2757,9 +2192,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.30.2.tgz",
-      "integrity": "sha512-oBZgKchomuDYxr7ilwLcyms6BCyLn0z8J0+ZZmfpjwg9fRVZIR5/GMXd7r9RH94iDhld3UmSjBM6nXWM2TfZTQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
       "cpu": [
         "x64"
       ],
@@ -2778,9 +2213,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.30.2.tgz",
-      "integrity": "sha512-c2bH6xTrf4BDpK8MoGG4Bd6zAMZDAXS569UxCAGcA7IKbHNMlhGQ89eRmvpIUGfKWNVdbhSbkQaWhEoMGmGslA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
       "cpu": [
         "x64"
       ],
@@ -2799,9 +2234,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.30.2.tgz",
-      "integrity": "sha512-eVdpxh4wYcm0PofJIZVuYuLiqBIakQ9uFZmipf6LF/HRj5Bgm0eb3qL/mr1smyXIS1twwOxNWndd8z0E374hiA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
       "cpu": [
         "arm"
       ],
@@ -2820,13 +2255,16 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.30.2.tgz",
-      "integrity": "sha512-UK65WJAbwIJbiBFXpxrbTNArtfuznvxAJw4Q2ZGlU8kPeDIWEX1dg3rn2veBVUylA2Ezg89ktszWbaQnxD/e3A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2841,13 +2279,16 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.30.2.tgz",
-      "integrity": "sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2862,13 +2303,16 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.30.2.tgz",
-      "integrity": "sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2883,13 +2327,16 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.30.2.tgz",
-      "integrity": "sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2904,9 +2351,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.30.2.tgz",
-      "integrity": "sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
       "cpu": [
         "arm64"
       ],
@@ -2925,9 +2372,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.30.2.tgz",
-      "integrity": "sha512-5g1yc73p+iAkid5phb4oVFMB45417DkRevRbt/El/gKXJk4jid+vPFF/AXbxn05Aky8PapwzZrdJShv5C0avjw==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
       "cpu": [
         "x64"
       ],
@@ -2946,12 +2393,56 @@
       }
     },
     "node_modules/linkify-it": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
-      "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-6.1.0.tgz",
+      "integrity": "sha512-wJ/TwpSDTLepCrQoYWYIExIKg5Zchex2Nn5yk2mFnB+6PtdkHtyLx742md9csRjjOnGkKIS/RrbY7l8D6gT9Vw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/markdown-it"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "uc.micro": "^3.0.0"
+      }
+    },
+    "node_modules/local-pkg": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-1.2.1.tgz",
+      "integrity": "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==",
+      "license": "MIT",
+      "dependencies": {
+        "mlly": "^1.7.4",
+        "pkg-types": "^2.3.0",
+        "quansync": "^0.2.11"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/local-pkg/node_modules/confbox": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.3.1.tgz",
+      "integrity": "sha512-cKUSoKa8YxFZZSmraVi7onONx3amu77ngK3kGpsYHDH7drPwCRkQE1RYMPlLRrMtnciRj274XNRxcHxnKmDSnA==",
+      "license": "MIT"
+    },
+    "node_modules/local-pkg/node_modules/pkg-types": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.3.tgz",
+      "integrity": "sha512-j/lCFdcppV0JxWpCEITdbDltBxPP6cHT+yNJ6Go2OgoSA9518X847X9z0p6LtA4Nc16+eQzCZjRrWanTGvHJ5w==",
       "license": "MIT",
       "dependencies": {
-        "uc.micro": "^2.0.0"
+        "confbox": "^0.3.1",
+        "exsolve": "^1.1.1",
+        "pathe": "^2.0.3"
       }
     },
     "node_modules/lodash-es": {
@@ -2969,18 +2460,43 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/magic-string-ast": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/magic-string-ast/-/magic-string-ast-1.0.3.tgz",
+      "integrity": "sha512-CvkkH1i81zl7mmb94DsRiFeG9V2fR2JeuK8yDgS8oiZSFa++wWLEgZ5ufEOyLHbvSbD1gTRKv9NdX69Rnvr9JA==",
+      "license": "MIT",
+      "dependencies": {
+        "magic-string": "^0.30.19"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/markdown-it": {
-      "version": "14.1.1",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
-      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
+      "version": "15.0.2",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-15.0.2.tgz",
+      "integrity": "sha512-q4IGxMv56jCqT4OCRCADBoDP3LO4MhmTXjFbphHPXs4g3j9Xg5RDnxqN8IF/3vIWEU+VCnUq+7JUg/cfy2E6Qw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/markdown-it"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
-        "argparse": "^2.0.1",
-        "entities": "^4.4.0",
-        "linkify-it": "^5.0.0",
-        "mdurl": "^2.0.0",
+        "argparse": "^3.0.0",
+        "entities": "^8.0.0",
+        "linkify-it": "^6.0.0",
+        "mdurl": "^2.1.0",
         "punycode.js": "^2.3.1",
-        "uc.micro": "^2.1.0"
+        "uc.micro": "^3.0.0"
       },
       "bin": {
         "markdown-it": "bin/markdown-it.mjs"
@@ -2999,54 +2515,39 @@
       }
     },
     "node_modules/mdurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
-      "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.1.0.tgz",
+      "integrity": "sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==",
       "license": "MIT"
     },
     "node_modules/mermaid": {
-      "version": "11.14.0",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.14.0.tgz",
-      "integrity": "sha512-GSGloRsBs+JINmmhl0JDwjpuezCsHB4WGI4NASHxL3fHo3o/BRXTxhDLKnln8/Q0lRFRyDdEjmk1/d5Sn1Xz8g==",
+      "version": "11.17.2",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.2.tgz",
+      "integrity": "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==",
       "license": "MIT",
       "dependencies": {
-        "@braintree/sanitize-url": "^7.1.1",
+        "@braintree/sanitize-url": "^7.1.2",
         "@iconify/utils": "^3.0.2",
-        "@mermaid-js/parser": "^1.1.0",
+        "@mermaid-js/parser": "^1.2.1",
         "@types/d3": "^7.4.3",
         "@upsetjs/venn.js": "^2.0.0",
-        "cytoscape": "^3.33.1",
+        "cytoscape": "^3.34.0",
         "cytoscape-cose-bilkent": "^4.1.0",
         "cytoscape-fcose": "^2.2.0",
         "d3": "^7.9.0",
         "d3-sankey": "^0.12.3",
         "dagre-d3-es": "7.0.14",
-        "dayjs": "^1.11.19",
-        "dompurify": "^3.3.1",
-        "katex": "^0.16.25",
+        "dayjs": "^1.11.21",
+        "dompurify": "^3.3.3",
+        "es-toolkit": "^1.45.1",
+        "fastdom": "1.0.12",
+        "katex": "^0.16.47",
         "khroma": "^2.1.0",
-        "lodash-es": "^4.17.23",
         "marked": "^16.3.0",
         "roughjs": "^4.6.6",
         "stylis": "^4.3.6",
         "ts-dedent": "^2.2.0",
-        "uuid": "^11.1.0"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0"
       }
     },
     "node_modules/mlly": {
@@ -3065,13 +2566,12 @@
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/muggle-string/-/muggle-string-0.4.1.tgz",
       "integrity": "sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
       "funding": [
         {
           "type": "github",
@@ -3092,6 +2592,12 @@
       "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
       "license": "MIT"
     },
+    "node_modules/nostics": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/nostics/-/nostics-1.3.0.tgz",
+      "integrity": "sha512-wzRsrJwNlFbqIRQt8aCeL2WE8USip/uuvGSOZV1D02CxX8ABTMbw8IywKjH7yWHETMXbWJI4OBpihg9rmz2Vyg==",
+      "license": "MIT"
+    },
     "node_modules/ofetch": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/ofetch/-/ofetch-1.5.1.tgz",
@@ -3128,6 +2634,12 @@
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
       "license": "MIT"
     },
+    "node_modules/perfect-debounce": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz",
+      "integrity": "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==",
+      "license": "MIT"
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -3135,10 +2647,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
-      "dev": true,
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -3175,9 +2686,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.28",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
+      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
       "funding": [
         {
           "type": "opencollective",
@@ -3194,7 +2705,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.18",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -3211,55 +2722,73 @@
         "node": ">=6"
       }
     },
+    "node_modules/quansync": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
+      "integrity": "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/antfu"
+        },
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/sxzz"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/readdirp": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.1.1.tgz",
+      "integrity": "sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/robust-predicates": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
       "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
       "license": "Unlicense"
     },
-    "node_modules/rollup": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
-      "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
-      "dev": true,
+    "node_modules/rolldown": {
+      "version": "1.2.10",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.10.tgz",
+      "integrity": "sha512-OxkA08pSryMK7B3XiFA09B4OJ1xJMPgIYCBMY2xchzpqgBGsV1o0DetPAE+Sl3N3L4oCPiEzmHVSOj7iR04Zog==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.8"
+        "@oxc-project/types": "=0.151.0",
+        "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
-        "rollup": "dist/bin/rollup"
+        "rolldown": "bin/cli.mjs"
       },
       "engines": {
-        "node": ">=18.0.0",
-        "npm": ">=8.0.0"
+        "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.57.1",
-        "@rollup/rollup-android-arm64": "4.57.1",
-        "@rollup/rollup-darwin-arm64": "4.57.1",
-        "@rollup/rollup-darwin-x64": "4.57.1",
-        "@rollup/rollup-freebsd-arm64": "4.57.1",
-        "@rollup/rollup-freebsd-x64": "4.57.1",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
-        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
-        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
-        "@rollup/rollup-linux-arm64-musl": "4.57.1",
-        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
-        "@rollup/rollup-linux-loong64-musl": "4.57.1",
-        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
-        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
-        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
-        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
-        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-musl": "4.57.1",
-        "@rollup/rollup-openbsd-x64": "4.57.1",
-        "@rollup/rollup-openharmony-arm64": "4.57.1",
-        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
-        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
-        "@rollup/rollup-win32-x64-gnu": "4.57.1",
-        "@rollup/rollup-win32-x64-msvc": "4.57.1",
-        "fsevents": "~2.3.2"
+        "@rolldown/binding-android-arm-eabi": "1.2.10",
+        "@rolldown/binding-android-arm64": "1.2.10",
+        "@rolldown/binding-darwin-arm64": "1.2.10",
+        "@rolldown/binding-darwin-x64": "1.2.10",
+        "@rolldown/binding-freebsd-x64": "1.2.10",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.10",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.10",
+        "@rolldown/binding-linux-arm64-musl": "1.2.10",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.10",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.10",
+        "@rolldown/binding-linux-x64-gnu": "1.2.10",
+        "@rolldown/binding-linux-x64-musl": "1.2.10",
+        "@rolldown/binding-openharmony-arm64": "1.2.10",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.10",
+        "@rolldown/binding-win32-x64-msvc": "1.2.10"
       }
     },
     "node_modules/roughjs": {
@@ -3286,6 +2815,12 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/scule": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/scule/-/scule-1.3.0.tgz",
+      "integrity": "sha512-6FtHJEvt+pVMIB9IBY+IcCJ6Z5f1iQnytgyfKMhDKgmzYG+TeH/wx1y3l27rshSbLiSanrR9ffZDrEsmjlQF2g==",
+      "license": "MIT"
+    },
     "node_modules/source-map-js": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
@@ -3295,6 +2830,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/strictdom": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz",
+      "integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==",
+      "license": "MIT"
+    },
     "node_modules/stylis": {
       "version": "4.3.6",
       "resolved": "https://registry.npmjs.org/stylis/-/stylis-4.3.6.tgz",
@@ -3302,16 +2843,16 @@
       "license": "MIT"
     },
     "node_modules/tailwindcss": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.18.tgz",
-      "integrity": "sha512-4+Z+0yiYyEtUVCScyfHCxOYP06L5Ne+JiHhY2IjR2KWMIWhJOYZKLSGZaP5HkZ8+bY0cxfzwDE5uOmzFXyIwxw==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tapable": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
-      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3331,90 +2872,162 @@
         "node": ">=18"
       }
     },
-    "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
-      "dev": true,
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/ts-dedent": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.2.0.tgz",
+      "integrity": "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.10"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/uc.micro": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-3.0.0.tgz",
+      "integrity": "sha512-U3PppEkleoTnIfi8BozMx3yju3qc/L6SwqWo2Sw+54PX+PX0q9I+r1Um5HCmqD7n9VDX5/v3vQH/AjA6deDdtw==",
+      "license": "MIT"
+    },
+    "node_modules/ufo": {
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
+      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
+      "license": "MIT"
+    },
+    "node_modules/unplugin": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-3.4.0.tgz",
+      "integrity": "sha512-9skdIFlCsPdFV7wUfZxNsFInlW+7nJmGu2gkTu0OUhF56aXGsHab9x52/QhdJ4lC7ZDPWTxbiC4ANqVlsuaW3w==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "picomatch": "^4.0.7",
+        "webpack-virtual-modules": "^0.6.2"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "@farmfe/core": "*",
+        "@rsbuild/core": "*",
+        "@rspack/core": "*",
+        "bun-types-no-globals": "*",
+        "esbuild": "*",
+        "rolldown": "*",
+        "rollup": "*",
+        "unloader": "*",
+        "vite": "*",
+        "webpack": "*"
+      },
+      "peerDependenciesMeta": {
+        "@farmfe/core": {
+          "optional": true
+        },
+        "@rsbuild/core": {
+          "optional": true
+        },
+        "@rspack/core": {
+          "optional": true
+        },
+        "bun-types-no-globals": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "rolldown": {
+          "optional": true
+        },
+        "rollup": {
+          "optional": true
+        },
+        "unloader": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        },
+        "webpack": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/unplugin-utils": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/unplugin-utils/-/unplugin-utils-0.3.2.tgz",
+      "integrity": "sha512-xVToRh2CTmLk2HnEG7ac4rl1MJTT3RFkpS8B++/SnB0kXvuaavD+n3m/vrzyWQOdJNSZQACnbz01pnppbwV5BA==",
       "license": "MIT",
       "dependencies": {
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.4"
       },
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">=20.19.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/SuperchupuDev"
-      }
-    },
-    "node_modules/ts-dedent": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.2.0.tgz",
-      "integrity": "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.10"
+        "url": "https://github.com/sponsors/sxzz"
       }
     },
-    "node_modules/typescript": {
-      "version": "5.7.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.7.3.tgz",
-      "integrity": "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==",
-      "devOptional": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/uc.micro": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
-      "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==",
-      "license": "MIT"
-    },
-    "node_modules/ufo": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.3.tgz",
-      "integrity": "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==",
-      "license": "MIT"
-    },
     "node_modules/uuid": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "version": "14.0.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
+      "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/esm/bin/uuid"
+        "uuid": "dist-node/bin/uuid"
       }
     },
     "node_modules/vite": {
-      "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.1.tgz",
-      "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
-      "dev": true,
+      "version": "8.3.1",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.1.tgz",
+      "integrity": "sha512-/bvH9E9tmCXRGp2uXY3WbOldqpTwFkbha/8ANaEQ6VkxhH60KyqLwgZq6lG2y+4uT55x9+9eUHMpQ7uGnOCKjA==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.25.0",
-        "fdir": "^6.4.4",
-        "picomatch": "^4.0.2",
-        "postcss": "^8.5.3",
-        "rollup": "^4.34.9",
-        "tinyglobby": "^0.2.13"
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.7",
+        "postcss": "^8.5.28",
+        "rolldown": "~1.2.9",
+        "tinyglobby": "^0.2.17"
       },
       "bin": {
         "vite": "bin/vite.js"
       },
       "engines": {
-        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+        "node": "^20.19.0 || >=22.12.0"
       },
       "funding": {
         "url": "https://github.com/vitejs/vite?sponsor=1"
@@ -3423,14 +3036,15 @@
         "fsevents": "~2.3.3"
       },
       "peerDependencies": {
-        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.7.1",
+        "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
-        "less": "*",
-        "lightningcss": "^1.21.0",
-        "sass": "*",
-        "sass-embedded": "*",
-        "stylus": "*",
-        "sugarss": "*",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
         "terser": "^5.16.0",
         "tsx": "^4.8.1",
         "yaml": "^2.4.2"
@@ -3439,13 +3053,16 @@
         "@types/node": {
           "optional": true
         },
-        "jiti": {
+        "@vitejs/devtools": {
           "optional": true
         },
-        "less": {
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
           "optional": true
         },
-        "lightningcss": {
+        "less": {
           "optional": true
         },
         "sass": {
@@ -3471,66 +3088,286 @@
         }
       }
     },
-    "node_modules/vscode-jsonrpc": {
-      "version": "8.2.0",
-      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.0.tgz",
-      "integrity": "sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==",
-      "license": "MIT",
+    "node_modules/vite/node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "devOptional": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/vscode-languageserver": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/vscode-languageserver/-/vscode-languageserver-9.0.1.tgz",
-      "integrity": "sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==",
-      "license": "MIT",
-      "dependencies": {
-        "vscode-languageserver-protocol": "3.17.5"
+    "node_modules/vite/node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
       },
-      "bin": {
-        "installServerIntoExtension": "bin/installServerIntoExtension"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/vscode-languageserver-protocol": {
-      "version": "3.17.5",
-      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.5.tgz",
-      "integrity": "sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==",
-      "license": "MIT",
-      "dependencies": {
-        "vscode-jsonrpc": "8.2.0",
-        "vscode-languageserver-types": "3.17.5"
+    "node_modules/vite/node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/vscode-languageserver-textdocument": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.12.tgz",
-      "integrity": "sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==",
-      "license": "MIT"
+    "node_modules/vite/node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
     },
-    "node_modules/vscode-languageserver-types": {
-      "version": "3.17.5",
-      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.5.tgz",
-      "integrity": "sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==",
-      "license": "MIT"
+    "node_modules/vite/node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
     },
     "node_modules/vscode-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.1.0.tgz",
-      "integrity": "sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.2.0.tgz",
+      "integrity": "sha512-m2gXo3bn0G1kT9InzMf07fTbqMbGtyckj3bH5ktLO+1Ssv+yiATZ4dhwaQv9UZWxJh6E9IFGnQyjgWVDWVBDrg==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/vue": {
-      "version": "3.5.28",
-      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.28.tgz",
-      "integrity": "sha512-BRdrNfeoccSoIZeIhyPBfvWSLFP4q8J3u8Ju8Ug5vu3LdD+yTM13Sg4sKtljxozbnuMu1NB1X5HBHRYUzFocKg==",
+      "version": "3.5.43",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.43.tgz",
+      "integrity": "sha512-o5qZoksdnjIKvW1srZ3ab7pcDNYAerBjRe54D0LBLfRdCYFrSgBHVXokMas35czQc0//lmx4/tuY4ZNQ+Rf2Ng==",
       "license": "MIT",
       "dependencies": {
-        "@vue/compiler-dom": "3.5.28",
-        "@vue/compiler-sfc": "3.5.28",
-        "@vue/runtime-dom": "3.5.28",
-        "@vue/server-renderer": "3.5.28",
-        "@vue/shared": "3.5.28"
+        "@vue/compiler-dom": "3.5.43",
+        "@vue/compiler-sfc": "3.5.43",
+        "@vue/runtime-dom": "3.5.43",
+        "@vue/server-renderer": "3.5.43",
+        "@vue/shared": "3.5.43"
       },
       "peerDependencies": {
         "typescript": "*"
@@ -3542,29 +3379,68 @@
       }
     },
     "node_modules/vue-router": {
-      "version": "4.6.4",
-      "resolved": "https://registry.npmjs.org/vue-router/-/vue-router-4.6.4.tgz",
-      "integrity": "sha512-Hz9q5sa33Yhduglwz6g9skT8OBPii+4bFn88w6J+J4MfEo4KRRpmiNG/hHHkdbRFlLBOqxN8y8gf2Fb0MTUgVg==",
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/vue-router/-/vue-router-5.3.1.tgz",
+      "integrity": "sha512-GDBZzgmILxA/kFnkFbJjQZdZ2QQbngnIMMuoUcjhZIfH1RGMaPjPwX5ASnV38qamuA9uhO0RDjSBHTDNG2uXyQ==",
       "license": "MIT",
       "dependencies": {
-        "@vue/devtools-api": "^6.6.4"
+        "@vue-macros/common": "^3.1.3",
+        "@vue/devtools-api": "^8.1.5",
+        "ast-walker-scope": "^0.9.0",
+        "chokidar": "^5.0.0",
+        "confbox": "^0.2.4",
+        "local-pkg": "^1.2.1",
+        "magic-string": "^0.30.21",
+        "mlly": "^1.8.2",
+        "muggle-string": "^0.4.1",
+        "nostics": "^1.1.4",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.5",
+        "scule": "^1.3.0",
+        "tinyglobby": "^0.2.17",
+        "unplugin": "^3.3.0",
+        "unplugin-utils": "^0.3.2"
       },
       "funding": {
         "url": "https://github.com/sponsors/posva"
       },
       "peerDependencies": {
-        "vue": "^3.5.0"
+        "@pinia/colada": ">=0.21.2",
+        "@vue/compiler-sfc": "^3.5.34 || ^4.0.0",
+        "pinia": "^3.0.4 || ^4.0.2",
+        "vite": "^7.3.0 || ^8.0.0",
+        "vue": "^3.5.34 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@pinia/colada": {
+          "optional": true
+        },
+        "@vue/compiler-sfc": {
+          "optional": true
+        },
+        "pinia": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
       }
     },
+    "node_modules/vue-router/node_modules/confbox": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
+      "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
+      "license": "MIT"
+    },
     "node_modules/vue-tsc": {
-      "version": "2.2.12",
-      "resolved": "https://registry.npmjs.org/vue-tsc/-/vue-tsc-2.2.12.tgz",
-      "integrity": "sha512-P7OP77b2h/Pmk+lZdJ0YWs+5tJ6J2+uOQPo7tlBnY44QqQSPYvS0qVT4wqDJgwrZaLe47etJLLQRFia71GYITw==",
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/vue-tsc/-/vue-tsc-3.3.11.tgz",
+      "integrity": "sha512-gOb0B9rtU2+f1dszwPqSH5kAieIF9ReeLhD3kSRNHv5WZZUQz/JdVXW0RTdqhNTMlQkqKzrTTviqKr/4FYZraQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@volar/typescript": "2.4.15",
-        "@vue/language-core": "2.2.12"
+        "@volar/typescript": "2.4.28",
+        "@vue/language-core": "3.3.11"
       },
       "bin": {
         "vue-tsc": "bin/vue-tsc.js"
@@ -3572,6 +3448,12 @@
       "peerDependencies": {
         "typescript": ">=5.0.0"
       }
+    },
+    "node_modules/webpack-virtual-modules": {
+      "version": "0.6.2",
+      "resolved": "https://registry.npmjs.org/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz",
+      "integrity": "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==",
+      "license": "MIT"
     }
   }
 }
diff --git a/frontend/package.json b/frontend/package.json
index 6510a57..20bae5b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -3,6 +3,9 @@
   "private": true,
   "version": "0.0.3",
   "type": "module",
+  "engines": {
+    "node": ">=22.12"
+  },
   "scripts": {
     "dev": "vite",
     "dev:vt": "vite --config vite.config.vt.ts",
@@ -13,21 +16,20 @@
   },
   "dependencies": {
     "@headlessui/vue": "^1.7.23",
-    "highlight.js": "^11.11.1",
-    "markdown-it": "^14.1.0",
-    "mermaid": "^11.14.0",
+    "highlight.js": "^11.12.0",
+    "markdown-it": "^15.0.2",
+    "mermaid": "^11.17.2",
     "ofetch": "^1.5.1",
-    "ufo": "^1.6.3",
-    "vue": "^3.5.13",
-    "vue-router": "^4.5.0"
+    "ufo": "^1.6.4",
+    "vue": "^3.5.43",
+    "vue-router": "^5.3.1"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.1.3",
-    "@types/markdown-it": "^14.1.2",
-    "@vitejs/plugin-vue": "^5.2.1",
-    "tailwindcss": "^4.1.3",
-    "typescript": "~5.7.2",
-    "vite": "^6.3.2",
-    "vue-tsc": "^2.2.8"
+    "@tailwindcss/vite": "^4.3.3",
+    "@vitejs/plugin-vue": "^6.0.9",
+    "tailwindcss": "^4.3.3",
+    "typescript": "~6.0.3",
+    "vite": "^8.3.1",
+    "vue-tsc": "^3.3.11"
   }
 }
diff --git a/frontend/src/components/MarkdownContent.vue b/frontend/src/components/MarkdownContent.vue
index e36c37c..da44866 100644
--- a/frontend/src/components/MarkdownContent.vue
+++ b/frontend/src/components/MarkdownContent.vue
@@ -4,10 +4,10 @@
 
 <script setup lang="ts">
 import { computed, ref, watch, nextTick, onMounted } from 'vue'
-import MarkdownIt from 'markdown-it'
-import type StateCore from 'markdown-it/lib/rules_core/state_core.mjs'
-import type Token from 'markdown-it/lib/token.mjs'
-import hljs from 'highlight.js'
+import MarkdownIt, { type StateCore, type Token } from 'markdown-it'
+// lib/common (~36 languages) instead of the full ~190-language bundle; unknown
+// fences fall back to escaped plain text in the highlight() callback below.
+import hljs from 'highlight.js/lib/common'
 import 'highlight.js/styles/github.css'
 import { buildTaskURL, getTaskPattern } from '../composables/useTaskLink'
 import { StatusValid, StatusFalsePositive, StatusIgnored } from '../constants/status'
@@ -93,7 +93,10 @@ async function renderMermaid() {
   }
 }
 
-const md: MarkdownIt = new MarkdownIt({
+// pgsql is not in lib/common; plain sql highlighting is close enough.
+hljs.registerAliases(['postgresql', 'postgres'], { languageName: 'sql' })
+
+const md = new MarkdownIt({
   html: false,
   linkify: true,
   highlight(str: string, lang: string): string {
diff --git a/frontend/src/vt/components/FillExampleSelect.vue b/frontend/src/vt/components/FillExampleSelect.vue
index 749af00..0c31e46 100644
--- a/frontend/src/vt/components/FillExampleSelect.vue
+++ b/frontend/src/vt/components/FillExampleSelect.vue
@@ -1,16 +1,13 @@
 <template>
-  <select ref="selectEl" @change="onChange" class="app-select px-4 py-2 text-sm font-medium text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700 rounded-lg hover:bg-amber-50 dark:hover:bg-amber-950 transition-colors bg-surface cursor-pointer">
+  <select @change="onChange" class="app-select px-4 py-2 text-sm font-medium text-amber-700 dark:text-amber-300 border border-amber-300 dark:border-amber-700 rounded-lg hover:bg-amber-50 dark:hover:bg-amber-950 transition-colors bg-surface cursor-pointer">
     <option value="" disabled selected>Fill Example</option>
     <option v-for="(_, key) in presets" :key="key" :value="key">{{ key }}</option>
   </select>
 </template>
 
 <script setup lang="ts">
-import { ref } from 'vue'
-
 defineProps<{ presets: Record<string, any> }>()
 const emit = defineEmits<{ select: [key: string] }>()
-const selectEl = ref<HTMLSelectElement>()
 
 function onChange(event: Event) {
   const select = event.target as HTMLSelectElement
diff --git a/frontend/vite.config.vt.ts b/frontend/vite.config.vt.ts
index b02c273..eb295bd 100644
--- a/frontend/vite.config.vt.ts
+++ b/frontend/vite.config.vt.ts
@@ -8,7 +8,7 @@ export default defineConfig({
   build: {
     outDir: 'dist-vt',
     emptyOutDir: true,
-    rollupOptions: {
+    rolldownOptions: {
       input: 'vt.html',
     },
   },

From 0495810d6175db35a9938e35c637003d8731ea87 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 15:51:51 +0300
Subject: [PATCH 3/7] Mark prometheus/client_model as a direct dep

- pkg/reviewer/run_metrics_test.go imports client_model directly, so
  go mod tidy moves it out of the indirect block
- go.sum and vendor are unchanged
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index fedbd18..efd8977 100644
--- a/go.mod
+++ b/go.mod
@@ -16,6 +16,7 @@ require (
 	github.com/labstack/echo/v4 v4.15.4
 	github.com/namsral/flag v1.7.4-pre
 	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_model v0.6.2
 	github.com/sashabaranov/go-openai v1.42.1
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
@@ -57,7 +58,6 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect

From dde0ede7037a348848c20d3d15c95c511fbd4c66 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 16:06:34 +0300
Subject: [PATCH 4/7] Fix issues found by a live panel review

- Ship a debug bundle when the judge fails; tag empty member and judge
  reviews as not_submitted
- Fail a single review whose review.json stays unfilled after the
  Step 2 retry instead of uploading the skeleton
- Retry and classify Responses API replies with status failed
- Report provider retries as they happen (Request.OnRetry) and log them
- Record every run of a runner for review cost, usage and duration,
  failed attempts and the Step 2 retry included; ship debug bundles
  from one place, honoring --debug-upload for panel members and judge
- Reject debug uploads for unknown projects before reading the body,
  clip metadata fields, and keep implausible costs out of the metrics
- End grace rounds after two rounds of refused tool calls
- Validate --max-rounds against the runner-profile bounds
- Turn off Claude Code auto-memory in review runs; force formatter and
  LSP off inside an operator's OPENCODE_CONFIG_CONTENT
- Record the codex run duration; time CLI subprocesses in runExec
- Log panel members, member labels, direct rounds, notices, resolved
  model ids and run cost
- Clip strings on rune boundaries with one shared helper
- Apply go fix (any, strings.SplitSeq, wg.Go, new(v))
---
 cmd/reviewctl/README.md                       |  10 +-
 cmd/reviewctl/main.go                         |   9 +-
 pkg/app/handlers.go                           |   6 +-
 pkg/db/db.go                                  |   2 +-
 pkg/db/filter.go                              |   8 +-
 pkg/db/filter_json.go                         |   4 +-
 pkg/db/logger.go                              |   4 +-
 pkg/db/model_params.go                        |   2 +-
 pkg/db/options.go                             |   2 +-
 pkg/debug/handler.go                          |  69 ++++-----
 pkg/debug/handler_test.go                     |  96 +++++++++++--
 pkg/debug/storage_test.go                     |   6 +-
 pkg/reviewctl/reviewctl_test.go               |  22 +--
 pkg/reviewer/clip.go                          |  14 ++
 pkg/reviewer/clip_test.go                     |  20 +++
 pkg/reviewer/collection.go                    |   4 +-
 pkg/reviewer/ctl/config.go                    |  15 +-
 pkg/reviewer/ctl/config_test.go               |   4 +
 pkg/reviewer/ctl/ctl.go                       | 135 +++++++++++-------
 pkg/reviewer/ctl/ctl_test.go                  |  95 +++++++-----
 pkg/reviewer/ctl/panel.go                     |  77 +++++-----
 pkg/reviewer/ctl/panel_test.go                |  51 ++++---
 pkg/reviewer/ctl/recovery.go                  |  38 ++---
 pkg/reviewer/ctl/skip_detect_test.go          |  12 +-
 pkg/reviewer/ctl/upload.go                    |   2 +-
 pkg/reviewer/direct/errors.go                 |  72 +++++++++-
 pkg/reviewer/direct/loop.go                   |  68 +++++----
 pkg/reviewer/direct/loop_test.go              |  25 +++-
 pkg/reviewer/direct/options.go                |   5 +-
 pkg/reviewer/direct/provider_anthropic.go     |   7 +-
 .../direct/provider_anthropic_test.go         |  10 +-
 pkg/reviewer/direct/provider_openai.go        |   4 +-
 pkg/reviewer/direct/provider_openai_test.go   |  11 +-
 pkg/reviewer/direct/provider_responses.go     |  17 ++-
 .../direct/provider_responses_test.go         |  34 ++++-
 pkg/reviewer/direct/registry.go               |  16 ++-
 pkg/reviewer/direct/retry.go                  |  15 +-
 pkg/reviewer/direct/sink.go                   |   1 +
 pkg/reviewer/direct/tools_fs.go               |   7 +-
 pkg/reviewer/direct/types.go                  |  10 +-
 pkg/reviewer/direct/util.go                   |   9 +-
 pkg/reviewer/fixmd_test.go                    |  10 +-
 pkg/reviewer/init_test.go                     |   4 +-
 pkg/reviewer/instructions_md_test.go          |   2 +-
 pkg/reviewer/project_test.go                  |  18 +--
 pkg/reviewer/run_metrics.go                   |   7 +-
 pkg/reviewer/run_metrics_test.go              |   3 +-
 pkg/reviewer/runner/claude.go                 |  34 +++--
 pkg/reviewer/runner/codex.go                  |  15 +-
 pkg/reviewer/runner/direct.go                 |  18 ++-
 pkg/reviewer/runner/env_test.go               |   8 ++
 pkg/reviewer/runner/opencode.go               |  28 +++-
 pkg/reviewer/runner/opencode_test.go          |  10 +-
 pkg/vt/runner_profile.go                      |   2 +-
 pkg/vt/runner_profile_test.go                 |  12 ++
 pkg/vt/validator.go                           |   2 +-
 56 files changed, 795 insertions(+), 396 deletions(-)
 create mode 100644 pkg/reviewer/clip.go
 create mode 100644 pkg/reviewer/clip_test.go

diff --git a/cmd/reviewctl/README.md b/cmd/reviewctl/README.md
index 0128d28..7585683 100644
--- a/cmd/reviewctl/README.md
+++ b/cmd/reviewctl/README.md
@@ -20,11 +20,11 @@ runner flags below are **local overrides**: an explicit flag always wins over th
 profile. Multi-review is profile-driven too (see below).
 
 The reviewed checkout is untrusted, so CLI runners ignore the agent config it
-ships: `claude` loads user settings only and no MCP servers; `opencode` runs
-with project config, formatters and LSP off (`OPENCODE_DISABLE_PROJECT_CONFIG`,
-`OPENCODE_CONFIG_CONTENT`; set either yourself to override) and refuses to start
-when the checkout contains `.opencode/` or `opencode.json(c)`, whose plugins it
-would load regardless.
+ships: `claude` loads user settings only, no MCP servers and no auto-memory;
+`opencode` runs with project config off (`OPENCODE_DISABLE_PROJECT_CONFIG`) and
+formatters and LSP off (merged into your `OPENCODE_CONFIG_CONTENT`, if set), and
+refuses to start when the checkout contains `.opencode/` or `opencode.json(c)`,
+whose plugins it would load regardless.
 
 ## Flags & Environment Variables
 
diff --git a/cmd/reviewctl/main.go b/cmd/reviewctl/main.go
index 67f1887..e8ec1c5 100644
--- a/cmd/reviewctl/main.go
+++ b/cmd/reviewctl/main.go
@@ -165,7 +165,10 @@ func runReview(cmd *cobra.Command, cfg *ctl.Config, multiRaw, judgeRaw string, l
 		}
 	}
 
-	factory := func(mc *ctl.Config) (runner.ReviewRunner, error) { return buildRunner(mc, log) }
+	factory := func(mc *ctl.Config) (runner.ReviewRunner, error) {
+		// Members run concurrently: tag each one's runner log lines.
+		return buildRunner(mc, log.With("member", mc.Label))
+	}
 	return ctl.NewController(cfg, rr, log, ctl.WithRunnerFactory(factory)).Review(cmd.Context())
 }
 
@@ -222,10 +225,10 @@ func applyReviewConfig(cmd *cobra.Command, cfg *ctl.Config, log *slog.Logger) er
 	if cfg.Runner == runner.RunnerDirect {
 		provider = cfg.APIProvider
 	}
+	// The panel members and judge are logged when the panel starts.
 	log.InfoContext(cmd.Context(), "applied runner profile",
 		"profileId", p.RunnerProfileID, "title", p.Title,
-		"runner", cfg.Runner, "model", cfg.Model, "effort", cfg.Effort,
-		"provider", provider, "panelMembers", len(cfg.Multi), "judging", cfg.Judge != nil)
+		"runner", cfg.Runner, "model", cfg.Model, "effort", cfg.Effort, "provider", provider)
 	return nil
 }
 
diff --git a/pkg/app/handlers.go b/pkg/app/handlers.go
index 433ca38..f1e86ba 100644
--- a/pkg/app/handlers.go
+++ b/pkg/app/handlers.go
@@ -95,11 +95,7 @@ func (a *App) registerHandlers() {
 	a.echo.GET("/v1/rpc/review-fix-:id", h.ReviewFixMarkdown, lg)
 	a.echo.GET("/v1/rpc/project-instructions-:id", h.ProjectInstructionsMarkdown, lg)
 
-	pm := reviewer.NewProjectManager(a.db)
-	dh := debug.NewHandler(a.debugStorage, a.Log(), func(ctx context.Context, projectKey string) string {
-		title, _ := pm.TitleByKey(ctx, projectKey)
-		return title
-	}, a.runMetrics)
+	dh := debug.NewHandler(a.debugStorage, a.Log(), reviewer.NewProjectManager(a.db).TitleByKey, a.runMetrics)
 	a.echo.POST(debugUploadPath, dh.Upload, lg, middleware.BodyLimit("20M"))
 	a.echo.GET(debug.StoragePathPrefix, dh.List, lg)
 	a.echo.GET(debug.StoragePathPrefix+":id/", dh.Bundle, lg)
diff --git a/pkg/db/db.go b/pkg/db/db.go
index 72818b6..3b22a53 100644
--- a/pkg/db/db.go
+++ b/pkg/db/db.go
@@ -67,7 +67,7 @@ func (db *DB) RunInLock(ctx context.Context, lockName string, fns ...func(*pg.Tx
 }
 
 // buildQuery applies all functions to orm query.
-func buildQuery(ctx context.Context, db orm.DB, model interface{}, search Searcher, filters []Filter, pager Pager, ops ...OpFunc) *orm.Query {
+func buildQuery(ctx context.Context, db orm.DB, model any, search Searcher, filters []Filter, pager Pager, ops ...OpFunc) *orm.Query {
 	q := db.ModelContext(ctx, model)
 	for _, filter := range filters {
 		filter.Apply(q)
diff --git a/pkg/db/filter.go b/pkg/db/filter.go
index d0d7e85..f64d5b5 100644
--- a/pkg/db/filter.go
+++ b/pkg/db/filter.go
@@ -63,10 +63,10 @@ const TablePrefix = "t"
 const TableColumns = "t.*"
 
 type Filter struct {
-	Field      string      `json:"field"`             // search field
-	Value      interface{} `json:"value,omitempty"`   // search value
-	SearchType int         `json:"type,omitempty"`    // search type. see db/filter.go
-	Exclude    bool        `json:"exclude,omitempty"` // is this filter should exclude
+	Field      string `json:"field"`             // search field
+	Value      any    `json:"value,omitempty"`   // search value
+	SearchType int    `json:"type,omitempty"`    // search type. see db/filter.go
+	Exclude    bool   `json:"exclude,omitempty"` // is this filter should exclude
 }
 
 // String prints filter as sql string
diff --git a/pkg/db/filter_json.go b/pkg/db/filter_json.go
index 3d331bb..39798f3 100644
--- a/pkg/db/filter_json.go
+++ b/pkg/db/filter_json.go
@@ -59,7 +59,7 @@ func (f Filter) jsonField(field string) jsonField {
 }
 
 // jsonValue convert json field value to []string
-func (f Filter) jsonValue(value interface{}) []string {
+func (f Filter) jsonValue(value any) []string {
 	var res []string
 
 	switch v := value.(type) {
@@ -120,7 +120,7 @@ func (f Filter) jsonValue(value interface{}) []string {
 }
 
 // jsonArrayValue convert json field value to string
-func (f Filter) jsonArrayValue(value interface{}) string {
+func (f Filter) jsonArrayValue(value any) string {
 	switch v := value.(type) {
 	case bool:
 		return strconv.FormatBool(v)
diff --git a/pkg/db/logger.go b/pkg/db/logger.go
index 5efa6ee..201d431 100644
--- a/pkg/db/logger.go
+++ b/pkg/db/logger.go
@@ -21,13 +21,13 @@ func NewQueryLogger(logger embedlog.Logger) QueryLogger {
 }
 
 // Printf used for pg.SetLogger
-func (s QueryLogger) Printf(_ context.Context, format string, args ...interface{}) {
+func (s QueryLogger) Printf(_ context.Context, format string, args ...any) {
 	s.Logger.With(slog.String("lib", "pg")).Errorf(format, args...)
 }
 
 func (ql QueryLogger) BeforeQuery(ctx context.Context, event *pg.QueryEvent) (context.Context, error) {
 	if event.Stash == nil {
-		event.Stash = make(map[interface{}]interface{})
+		event.Stash = make(map[any]any)
 	}
 
 	event.Stash["startedAt"] = time.Now()
diff --git a/pkg/db/model_params.go b/pkg/db/model_params.go
index 10de686..8f173e0 100644
--- a/pkg/db/model_params.go
+++ b/pkg/db/model_params.go
@@ -76,7 +76,7 @@ type ReviewRunnerProfile struct {
 	Effort          string              `json:"effort,omitempty"`
 	APIProvider     string              `json:"apiProvider,omitempty"`
 	APIBaseURL      string              `json:"apiBaseURL,omitempty"`
-	Params          RunnerProfileParams `json:"params,omitempty"`
+	Params          RunnerProfileParams `json:"params"`
 }
 
 // Add accumulates numeric counters and Models map entries from o into m.
diff --git a/pkg/db/options.go b/pkg/db/options.go
index 8be8caa..507eb83 100644
--- a/pkg/db/options.go
+++ b/pkg/db/options.go
@@ -133,7 +133,7 @@ func WithJoinedIDs(ids []int, tableAlias, column string) OpFunc {
 }
 
 // OnConflict adds ON CONFLICT statement to update query
-func OnConflict(s string, params ...interface{}) OpFunc {
+func OnConflict(s string, params ...any) OpFunc {
 	return func(query *orm.Query) {
 		query.OnConflict(s, params...)
 	}
diff --git a/pkg/debug/handler.go b/pkg/debug/handler.go
index 0b1ed7e..4fdf391 100644
--- a/pkg/debug/handler.go
+++ b/pkg/debug/handler.go
@@ -18,7 +18,6 @@ import (
 	"sort"
 	"strconv"
 	"strings"
-	"unicode/utf8"
 
 	"reviewsrv/pkg/reviewer"
 
@@ -63,15 +62,16 @@ type Handler struct {
 	storage      *Storage
 	log          *slog.Logger
 	tmpl         *template.Template
-	projectTitle func(ctx context.Context, projectKey string) string
+	projectTitle func(ctx context.Context, projectKey string) (string, error)
 	metrics      *reviewer.RunMetrics
 }
 
 // NewHandler wires templates to the storage. Templates are embedded at compile
-// time. projectTitle resolves a project key to its title ("" when unknown) for
-// the pages and the run metrics; metrics counts every uploaded run that did not
-// complete (ok runs are counted on review upload). Either may be nil.
-func NewHandler(storage *Storage, log *slog.Logger, projectTitle func(ctx context.Context, projectKey string) string, metrics *reviewer.RunMetrics) *Handler {
+// time. projectTitle resolves an upload's project key to its title ("" for no
+// project, which is refused) for the pages and the run metrics; metrics counts
+// every uploaded run that did not complete (ok runs are counted on review
+// upload). Either may be nil.
+func NewHandler(storage *Storage, log *slog.Logger, projectTitle func(ctx context.Context, projectKey string) (string, error), metrics *reviewer.RunMetrics) *Handler {
 	tmpl := template.Must(template.New("").Funcs(template.FuncMap{
 		"shortKey":   shortKey,
 		"preview":    preview,
@@ -88,6 +88,21 @@ func (h *Handler) Upload(c echo.Context) error {
 	if _, err := uuid.Parse(projectKey); err != nil {
 		return echo.NewHTTPError(http.StatusBadRequest, "invalid project key")
 	}
+	ctx := c.Request().Context()
+	var projectTitle string
+	if h.projectTitle != nil {
+		// Before the body is read: the route is unauthenticated, and a key that
+		// matches no project could only fill the ring and the metrics with noise.
+		// A failed lookup proves nothing, so that bundle is kept, untitled.
+		title, err := h.projectTitle(ctx, projectKey)
+		switch {
+		case err != nil:
+			h.log.ErrorContext(ctx, "debug upload: resolve project", "projectKey", projectKey, "err", err)
+		case title == "":
+			return echo.NewHTTPError(http.StatusNotFound, "unknown project")
+		}
+		projectTitle = title
+	}
 
 	form, err := c.MultipartForm()
 	if err != nil {
@@ -96,25 +111,25 @@ func (h *Handler) Upload(c echo.Context) error {
 
 	// Metadata outlives the artifacts in the ring, so a client can't park
 	// megabytes in it: fields are clipped.
-	field := func(key string) string { return clip(formValue(form.Value, key), maxFieldBytes) }
+	field := func(key string, n int) string {
+		// Clone: a clipped substring would pin the whole posted value.
+		return strings.Clone(reviewer.ClipUTF8(formValue(form.Value, key), n))
+	}
 	b := &Bundle{
 		ProjectKey:   projectKey,
-		MRIid:        field(FieldMRIid),
-		ExternalID:   field(FieldExternalID),
-		Runner:       field(FieldRunner),
-		Model:        field(FieldModel),
-		ErrorMsg:     clip(formValue(form.Value, FieldErrorMsg), maxErrorMsgBytes),
-		SourceBranch: field(FieldSourceBranch),
-		TargetBranch: field(FieldTargetBranch),
-		CommitHash:   field(FieldCommitHash),
+		ProjectTitle: projectTitle,
+		MRIid:        field(FieldMRIid, maxFieldBytes),
+		ExternalID:   field(FieldExternalID, maxFieldBytes),
+		Runner:       field(FieldRunner, maxFieldBytes),
+		Model:        field(FieldModel, maxFieldBytes),
+		ErrorMsg:     field(FieldErrorMsg, maxErrorMsgBytes),
+		SourceBranch: field(FieldSourceBranch, maxFieldBytes),
+		TargetBranch: field(FieldTargetBranch, maxFieldBytes),
+		CommitHash:   field(FieldCommitHash, maxFieldBytes),
 		CostUsd:      parseCost(formValue(form.Value, FieldCostUsd)),
 		Files:        make(map[string]File, len(form.File)),
 	}
 	b.Status, b.Reason = reviewer.NormalizeRunOutcome(formValue(form.Value, FieldStatus), formValue(form.Value, FieldReason), b.ErrorMsg != "")
-	ctx := c.Request().Context()
-	if h.projectTitle != nil {
-		b.ProjectTitle = h.projectTitle(ctx, projectKey)
-	}
 
 	for _, headers := range form.File {
 		for _, fh := range headers {
@@ -247,17 +262,6 @@ func readArtifact(fh *multipart.FileHeader) (File, error) {
 	return File{Gzip: raw, Size: int(n)}, nil
 }
 
-// clip cuts s to at most n bytes, on a rune boundary.
-func clip(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	for n > 0 && !utf8.RuneStart(s[n]) {
-		n--
-	}
-	return s[:n]
-}
-
 // contentTypeFor picks a browser-friendly Content-Type by extension.
 // Markdown and JSONL render best as text/plain so the browser shows them inline
 // rather than offering a download or rendering as raw markdown.
@@ -280,10 +284,11 @@ func shortKey(s string) string {
 	return s[:8]
 }
 
-// preview truncates a string to n runes for the index error column.
+// preview truncates a string to n bytes, on a rune boundary, for the index
+// error column and the log.
 func preview(s string, n int) string {
 	if len(s) <= n {
 		return s
 	}
-	return s[:n] + "…"
+	return reviewer.ClipUTF8(s, n) + "…"
 }
diff --git a/pkg/debug/handler_test.go b/pkg/debug/handler_test.go
index 9988b0a..2e59523 100644
--- a/pkg/debug/handler_test.go
+++ b/pkg/debug/handler_test.go
@@ -7,14 +7,18 @@ import (
 	"encoding/json"
 	"io"
 	"log/slog"
+	"maps"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 
+	"reviewsrv/pkg/reviewer"
+
 	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
+	"github.com/prometheus/client_golang/prometheus"
 )
 
 func newTestHandler(t *testing.T) (*Storage, *echo.Echo) {
@@ -271,12 +275,15 @@ func upload(t *testing.T, storage *Storage, e *echo.Echo, projectKey string, fie
 func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
 	storage := New(5, 5)
 	knownKey := uuid.NewString()
-	h := NewHandler(storage, slog.Default(), func(_ context.Context, key string) string {
-		if key == knownKey {
-			return "demo"
+	metrics := reviewer.NewRunMetrics("claude")
+	reg := prometheus.NewRegistry()
+	metrics.Register(reg)
+	h := NewHandler(storage, slog.Default(), func(_ context.Context, key string) (string, error) {
+		if key != knownKey {
+			return "", nil // no such project
 		}
-		return ""
-	}, nil)
+		return "demo", nil
+	}, metrics)
 	e := echo.New()
 	e.POST("/v1/upload/debug/:projectKey/", h.Upload)
 	e.GET("/v1/debug/storage/", h.List)
@@ -289,13 +296,45 @@ func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
 		t.Errorf("outcome not recorded: %+v", b)
 	}
 
-	// A legacy client sends no status: derived from errorMsg. Garbage is sanitized.
-	b = upload(t, storage, e, uuid.NewString(), map[string]string{"errorMsg": "boom", "reason": "<script>", "costUsd": "NaN"})
-	if b.Status != "failed" || b.Reason != "other" || b.CostUsd != 0 || b.ProjectTitle != "" {
+	// A legacy client sends no status: derived from errorMsg. Garbage is
+	// sanitized; an implausible cost stays out of the cost counter.
+	b = upload(t, storage, e, knownKey, map[string]string{"errorMsg": "boom", "reason": "<script>", "costUsd": "5000"})
+	if b.Status != "failed" || b.Reason != "other" {
 		t.Errorf("legacy upload not normalized: %+v", b)
 	}
+	// An ok run is counted on review upload, not here.
+	upload(t, storage, e, knownKey, map[string]string{"runner": "claude", "status": "ok", "costUsd": "2"})
 
+	// A key that matches no project is refused.
+	body, ct := buildMultipart(t, map[string]string{"errorMsg": "x", "costUsd": "999"}, nil)
+	req := httptest.NewRequest(http.MethodPost, "/v1/upload/debug/"+uuid.NewString()+"/", body)
+	req.Header.Set("Content-Type", ct)
 	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("unknown project: status %d, want 404", rec.Code)
+	}
+
+	type labels = map[string]string
+	for _, c := range []struct {
+		metric string
+		labels labels
+		want   float64
+	}{
+		{"reviewer_runs_total", labels{"project": "demo", "runner": "claude", "status": "failed", "reason": "billing"}, 1},
+		{"reviewer_runs_total", labels{"project": "demo", "runner": "other", "status": "failed", "reason": "other"}, 1},
+		{"reviewer_run_cost_usd_total", labels{"project": "demo", "runner": "claude", "status": "failed"}, 1.5},
+		{"reviewer_run_cost_usd_total", labels{"project": "demo", "runner": "other", "status": "failed"}, 0},
+	} {
+		if got := counterValue(t, reg, c.metric, c.labels); got != c.want {
+			t.Errorf("%s%v = %v, want %v", c.metric, c.labels, got, c.want)
+		}
+	}
+	if n := seriesCount(t, reg, "reviewer_runs_total"); n != 2 {
+		t.Errorf("reviewer_runs_total has %d series, want 2 (ok bundles and unknown projects not counted)", n)
+	}
+
+	rec = httptest.NewRecorder()
 	e.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/debug/storage/", nil))
 	page := rec.Body.String()
 	for _, want := range []string{"demo", "billing", "$1.50", `class="st-failed"`} {
@@ -305,14 +344,43 @@ func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
 	}
 }
 
-func TestClip(t *testing.T) {
-	if got := clip("short", 10); got != "short" {
-		t.Errorf("clip(short) = %q", got)
+// counterValue returns the counter of metric with exactly these labels; 0 when absent.
+func counterValue(t *testing.T, reg *prometheus.Registry, metric string, labels map[string]string) float64 {
+	t.Helper()
+	mfs, err := reg.Gather()
+	if err != nil {
+		t.Fatalf("gather: %v", err)
+	}
+	for _, mf := range mfs {
+		if mf.GetName() != metric {
+			continue
+		}
+		for _, m := range mf.GetMetric() {
+			got := map[string]string{}
+			for _, l := range m.GetLabel() {
+				got[l.GetName()] = l.GetValue()
+			}
+			if maps.Equal(got, labels) {
+				return m.GetCounter().GetValue()
+			}
+		}
+	}
+	return 0
+}
+
+// seriesCount returns how many label combinations metric has.
+func seriesCount(t *testing.T, reg *prometheus.Registry, metric string) int {
+	t.Helper()
+	mfs, err := reg.Gather()
+	if err != nil {
+		t.Fatalf("gather: %v", err)
 	}
-	// "ошибка" is 12 bytes, 2 per rune: a cut at 5 must not split a rune.
-	if got := clip("ошибка", 5); got != "ош" {
-		t.Errorf("clip(ошибка, 5) = %q, want %q", got, "ош")
+	for _, mf := range mfs {
+		if mf.GetName() == metric {
+			return len(mf.GetMetric())
+		}
 	}
+	return 0
 }
 
 func TestHandler_UploadClipsMetadata(t *testing.T) {
diff --git a/pkg/debug/storage_test.go b/pkg/debug/storage_test.go
index 4764083..b6667c9 100644
--- a/pkg/debug/storage_test.go
+++ b/pkg/debug/storage_test.go
@@ -90,11 +90,9 @@ func TestStorage_ConcurrentAddGet(t *testing.T) {
 		}(i)
 	}
 	for range 100 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			_ = s.List()
-		}()
+		})
 	}
 	wg.Wait()
 
diff --git a/pkg/reviewctl/reviewctl_test.go b/pkg/reviewctl/reviewctl_test.go
index 1c0418d..1d0e9c5 100644
--- a/pkg/reviewctl/reviewctl_test.go
+++ b/pkg/reviewctl/reviewctl_test.go
@@ -14,7 +14,7 @@ import (
 
 func mkProfile(t *testing.T, dbc db.DB, title, runner string) *db.RunnerProfile {
 	rp, _ := dbtest.RunnerProfile(t, dbc, &db.RunnerProfile{
-		Title: title, Runner: runner, Token: reviewer.Ptr("tok-" + title), StatusID: db.StatusEnabled,
+		Title: title, Runner: runner, Token: new("tok-" + title), StatusID: db.StatusEnabled,
 	})
 	t.Cleanup(func() {
 		_, _ = dbc.ModelContext(context.Background(), &db.RunnerProfile{ID: rp.ID}).WherePK().Delete()
@@ -32,9 +32,9 @@ func TestDBService_ReviewConfig(t *testing.T) {
 		judge := mkProfile(t, dbc, "judge", "claude")
 
 		pr, cl := dbtest.Project(t, dbc, &db.Project{
-			RunnerProfileID:      reviewer.Ptr(primary.ID),
+			RunnerProfileID:      new(primary.ID),
 			RunnerProfileIDs:     db.ProjectRunnerProfileIDs{member.ID},
-			JudgeRunnerProfileID: reviewer.Ptr(judge.ID),
+			JudgeRunnerProfileID: new(judge.ID),
 			StatusID:             db.StatusEnabled,
 		}, dbtest.WithProjectRelations, dbtest.WithFakeProject)
 		t.Cleanup(cl)
@@ -56,15 +56,15 @@ func TestDBService_ReviewConfig(t *testing.T) {
 		tt, clTT := dbtest.TaskTracker(t, dbc, &db.TaskTracker{
 			Title:       "YT",
 			URL:         "https://youtrack.example.com",
-			AuthToken:   reviewer.Ptr("perm:secret"),
+			AuthToken:   new("perm:secret"),
 			FetchPrompt: "GET {{URL}}/api/issues/<ID>",
 			StatusID:    db.StatusEnabled,
 		})
 		t.Cleanup(clTT)
 
 		pr, cl := dbtest.Project(t, dbc, &db.Project{
-			RunnerProfileID: reviewer.Ptr(primary.ID),
-			TaskTrackerID:   reviewer.Ptr(tt.ID),
+			RunnerProfileID: new(primary.ID),
+			TaskTrackerID:   new(tt.ID),
 			StatusID:        db.StatusEnabled,
 		}, dbtest.WithProjectRelations, dbtest.WithFakeProject)
 		t.Cleanup(cl)
@@ -88,8 +88,8 @@ func TestDBService_ReviewConfig(t *testing.T) {
 		t.Cleanup(clTT)
 
 		pr, cl := dbtest.Project(t, dbc, &db.Project{
-			RunnerProfileID: reviewer.Ptr(primary.ID),
-			TaskTrackerID:   reviewer.Ptr(tt.ID),
+			RunnerProfileID: new(primary.ID),
+			TaskTrackerID:   new(tt.ID),
 			StatusID:        db.StatusEnabled,
 		}, dbtest.WithProjectRelations, dbtest.WithFakeProject)
 		t.Cleanup(cl)
@@ -115,7 +115,7 @@ func TestDBService_Prompt(t *testing.T) {
 	tt, clTT := dbtest.TaskTracker(t, dbc, &db.TaskTracker{
 		Title:       "YT",
 		URL:         "https://yt.example.com",
-		AuthToken:   reviewer.Ptr("perm:legacy-secret"),
+		AuthToken:   new("perm:legacy-secret"),
 		FetchPrompt: "curl -H 'Authorization: Bearer {{TOKEN}}' {{URL}}/api",
 		StatusID:    db.StatusEnabled,
 	})
@@ -123,7 +123,7 @@ func TestDBService_Prompt(t *testing.T) {
 
 	pr, cl := dbtest.Project(t, dbc, &db.Project{
 		PromptID:      prompt.ID,
-		TaskTrackerID: reviewer.Ptr(tt.ID),
+		TaskTrackerID: new(tt.ID),
 		StatusID:      db.StatusEnabled,
 	}, dbtest.WithProjectRelations, dbtest.WithFakeProject)
 	t.Cleanup(cl)
@@ -136,7 +136,7 @@ func TestDBService_Prompt(t *testing.T) {
 	})
 
 	t.Run("tokenEnv client gets the env reference, not the secret", func(t *testing.T) {
-		got, err := svc.Prompt(t.Context(), pr.ProjectKey, reviewer.Ptr(true))
+		got, err := svc.Prompt(t.Context(), pr.ProjectKey, new(true))
 		require.NoError(t, err)
 		assert.NotContains(t, got, "perm:legacy-secret")
 		assert.Contains(t, got, "$REVIEW_TRACKER_TOKEN")
diff --git a/pkg/reviewer/clip.go b/pkg/reviewer/clip.go
new file mode 100644
index 0000000..c0bbe60
--- /dev/null
+++ b/pkg/reviewer/clip.go
@@ -0,0 +1,14 @@
+package reviewer
+
+import "unicode/utf8"
+
+// ClipUTF8 cuts s to at most n bytes without splitting a rune.
+func ClipUTF8(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	for n > 0 && !utf8.RuneStart(s[n]) {
+		n--
+	}
+	return s[:n]
+}
diff --git a/pkg/reviewer/clip_test.go b/pkg/reviewer/clip_test.go
new file mode 100644
index 0000000..806a1a0
--- /dev/null
+++ b/pkg/reviewer/clip_test.go
@@ -0,0 +1,20 @@
+package reviewer
+
+import "testing"
+
+func TestClipUTF8(t *testing.T) {
+	for _, tt := range []struct {
+		s    string
+		n    int
+		want string
+	}{
+		{"short", 10, "short"},
+		{"exact", 5, "exact"},
+		{"ошибка", 5, "ош"}, // 2 bytes per rune: a cut at 5 must not split one
+		{"ошибка", 0, ""},
+	} {
+		if got := ClipUTF8(tt.s, tt.n); got != tt.want {
+			t.Errorf("ClipUTF8(%q, %d) = %q, want %q", tt.s, tt.n, got, tt.want)
+		}
+	}
+}
diff --git a/pkg/reviewer/collection.go b/pkg/reviewer/collection.go
index 08e5f04..ec0e171 100644
--- a/pkg/reviewer/collection.go
+++ b/pkg/reviewer/collection.go
@@ -26,6 +26,8 @@ func Map[T, M any](a []T, f func(T) M) []M {
 }
 
 // Ptr is a generic to create pointer from value
+//
+//go:fix inline
 func Ptr[T any](v T) *T {
-	return &v
+	return new(v)
 }
diff --git a/pkg/reviewer/ctl/config.go b/pkg/reviewer/ctl/config.go
index 20e4d5a..8f6ac7d 100644
--- a/pkg/reviewer/ctl/config.go
+++ b/pkg/reviewer/ctl/config.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"reviewsrv/pkg/db"
+	"reviewsrv/pkg/reviewer/direct"
 	"reviewsrv/pkg/reviewer/runner"
 )
 
@@ -55,6 +56,10 @@ type Config struct {
 	RunnerProfileID    int
 	RunnerProfileTitle string
 
+	// Label names a panel member ("claude-opus-5") or "judge" in the runner's
+	// log lines; empty for a single review.
+	Label string
+
 	// Task-tracker access (fetched with the review config; $REVIEW_TRACKER_TOKEN
 	// takes priority over the server token). The direct runner scopes its
 	// http_fetch tool to TrackerURL; CLI runners get the token exported as
@@ -124,6 +129,11 @@ func (c *Config) Validate(cmd string) error {
 	if cmd == "comment" && c.ReviewID == 0 { //nolint:goconst // CLI subcommand name
 		return errors.New("--review-id is required for comment subcommand")
 	}
+	// Same bounds as a runner profile (validated on save in the admin panel).
+	if !direct.IsValidMaxRounds(c.MaxRounds) {
+		return fmt.Errorf("--max-rounds / $REVIEW_MAX_ROUNDS must be within %d..%d (0 = default), got %d",
+			direct.MinMaxRounds, direct.MaxMaxRounds, c.MaxRounds)
+	}
 
 	return nil
 }
@@ -185,6 +195,9 @@ type MemberSpec struct {
 	Profile *ResolvedProfile
 }
 
+// String returns "runner:model" for log lines.
+func (m MemberSpec) String() string { return m.Runner + ":" + m.Model }
+
 // ParseMulti parses the --multi value: a comma-separated list of runner:model
 // members, e.g. "codex:gpt-6-sol,opencode:openrouter/deepseek/deepseek-v4-pro". Only
 // the first colon separates runner from model (models may contain slashes); a bare
@@ -197,7 +210,7 @@ func ParseMulti(s string) ([]MemberSpec, error) {
 	}
 
 	var out []MemberSpec
-	for _, part := range strings.Split(s, ",") {
+	for part := range strings.SplitSeq(s, ",") {
 		part = strings.TrimSpace(part)
 		if part == "" {
 			continue
diff --git a/pkg/reviewer/ctl/config_test.go b/pkg/reviewer/ctl/config_test.go
index 5219844..7da456c 100644
--- a/pkg/reviewer/ctl/config_test.go
+++ b/pkg/reviewer/ctl/config_test.go
@@ -21,6 +21,10 @@ func TestConfigValidate(t *testing.T) {
 		{"valid upload", Config{Key: "k", URL: "http://x"}, "upload", false},
 		{"comment no id", Config{Key: "k", URL: "http://x"}, "comment", true},
 		{"comment with id", Config{Key: "k", URL: "http://x", ReviewID: 1}, "comment", false},
+		{"max rounds default", Config{Key: "k", URL: "http://x", MaxRounds: 0}, "review", false},
+		{"max rounds in bounds", Config{Key: "k", URL: "http://x", MaxRounds: 120}, "review", false},
+		{"max rounds too low", Config{Key: "k", URL: "http://x", MaxRounds: 3}, "review", true},
+		{"max rounds too high", Config{Key: "k", URL: "http://x", MaxRounds: 10000}, "review", true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/reviewer/ctl/ctl.go b/pkg/reviewer/ctl/ctl.go
index 3471a32..a0fd7b3 100644
--- a/pkg/reviewer/ctl/ctl.go
+++ b/pkg/reviewer/ctl/ctl.go
@@ -2,12 +2,15 @@ package ctl
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os/exec"
 	"strings"
+	"sync"
 	"time"
 
+	"reviewsrv/pkg/db"
 	"reviewsrv/pkg/rest"
 	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/runner"
@@ -25,6 +28,11 @@ type Controller struct {
 	// runnerFactory builds a runner from a per-member config; used by the panel
 	// path to build one runner per member after creating its worktree.
 	runnerFactory RunnerFactory
+
+	// spent adds up a panel's runs — members and judge, failed ones included —
+	// for the closing log line. Members run concurrently, hence the mutex.
+	spentMu sync.Mutex
+	spent   float64
 }
 
 // RunnerFactory builds a runner from a (per-member) config.
@@ -38,12 +46,12 @@ func WithRunnerFactory(f RunnerFactory) Option {
 	return func(c *Controller) { c.runnerFactory = f }
 }
 
-// spendTracker wraps a ReviewRunner and adds up what its runs spent — failed
-// ones included, as they are billed too — so a debug bundle reports the whole
-// run, Step 2 retry and all.
+// spendTracker wraps a ReviewRunner and keeps the result of each of its runs —
+// failed ones included, as they are billed too — so the review record and the
+// debug bundle cover the whole run: a Step 2 retry, a retried judge.
 type spendTracker struct {
 	runner.ReviewRunner
-	spent float64
+	results []*runner.ClaudeResult
 }
 
 // trackSpend wraps rr; a nil runner stays nil.
@@ -58,7 +66,7 @@ func trackSpend(rr runner.ReviewRunner) *spendTracker {
 func (t *spendTracker) Run(ctx context.Context, prompt string) (*runner.ClaudeResult, error) {
 	res, err := t.ReviewRunner.Run(ctx, prompt)
 	if res != nil {
-		t.spent += res.TotalCostUSD
+		t.results = append(t.results, res)
 	}
 	return res, err
 }
@@ -68,7 +76,28 @@ func (t *spendTracker) total() float64 {
 	if t == nil {
 		return 0
 	}
-	return t.spent
+	var usd float64
+	for _, r := range t.results {
+		usd += r.TotalCostUSD
+	}
+	return usd
+}
+
+// usage merges the model usage and durations of every run.
+func (t *spendTracker) usage(model string) (db.ReviewModelInfo, int) {
+	var (
+		mi  db.ReviewModelInfo
+		dur int
+	)
+	for i, r := range t.results {
+		if i == 0 {
+			mi = r.ToModelInfo(model)
+		} else {
+			mi.Add(r.ToModelInfo(model))
+		}
+		dur += r.DurationMs
+	}
+	return mi, dur
 }
 
 // NewController creates a new Controller from Config.
@@ -92,34 +121,31 @@ func NewController(cfg *Config, rr runner.ReviewRunner, log *slog.Logger, opts .
 	return c
 }
 
+func (c *Controller) addSpent(usd float64) {
+	c.spentMu.Lock()
+	c.spent += usd
+	c.spentMu.Unlock()
+}
+
+func (c *Controller) spentTotal() float64 {
+	c.spentMu.Lock()
+	defer c.spentMu.Unlock()
+	return c.spent
+}
+
 // Review runs the full review flow: fetch prompt → Claude → parse → upload → comment → HTML.
 func (c *Controller) Review(ctx context.Context) (retErr error) {
 	start := time.Now()
-	c.log.InfoContext(ctx, "starting review", "projectKey", c.cfg.Key, "model", c.cfg.Model)
-
 	// Multi-review: a configured panel fans out to one member review per runner,
-	// each in its own git worktree. No judge/fusion yet — members are the output.
+	// each in its own git worktree, then a judge fuses them.
 	if len(c.cfg.Multi) > 0 {
 		return c.reviewPanel(ctx, start)
 	}
+	c.log.InfoContext(ctx, "starting review", "projectKey", c.cfg.Key, "runner", c.cfg.Runner, "model", c.cfg.Model)
 
-	// Set when the runner skipped Step 2; forces a debug-bundle upload so
-	// the silent skip can be post-mortemed even on otherwise-clean runs.
-	var skipDetected bool
 	retried := false
 
-	// Publish artifacts to the debug ring buffer when something failed, when
-	// --debug-upload was passed, or when we caught a Step-2 skip (so the
-	// jsonl/MDs are kept for analysis). Detached context survives ctx
-	// cancellation so a killed CI job still has a chance to ship its bundle.
-	defer func() {
-		if retErr == nil && !c.cfg.DebugUpload && !skipDetected {
-			return
-		}
-		upCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
-		defer cancel()
-		c.uploadDebugBundle(upCtx, c.cfg, retErr, c.runner.total())
-	}()
+	defer func() { c.settleRun(ctx, c.cfg, c.runner, retErr) }()
 
 	// Wipe a previous run's outputs (R*.md, session logs, review.json) so the
 	// runner reviews a clean tree — otherwise its glob/grep/read tools surface
@@ -152,20 +178,18 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 		return fmt.Errorf("read review: %w", err)
 	}
 
-	c.applyRunResult(ctx, draft, c.cfg, c.runner, result)
+	c.applyRunResult(ctx, draft, c.cfg, c.runner)
 
 	if isReviewJSONUnfilled(draft) {
-		skipDetected = true
 		retried = true
-		if d2 := c.runStep2Recovery(ctx, draft, result); d2 != nil {
-			draft = d2
-			skipDetected = false
-			// applyRunResult persisted the pre-recovery draft; keep review.json in
-			// sync with what is actually uploaded.
-			if werr := WriteReviewJSON(c.cfg.Dir, draft); werr != nil {
-				c.log.WarnContext(ctx, "persist recovered review.json", "err", werr)
-			}
+		d2 := c.runStep2Recovery(ctx, draft, result)
+		if d2 == nil {
+			// Like an empty panel member: an untouched skeleton is no review, so
+			// the run fails (and ships its debug bundle) instead of uploading it.
+			return reviewer.WithRunReason(reviewer.RunReasonNotSubmitted,
+				errors.New("empty review: the runner left review.json unfilled, and the Step 2 retry did not fill it"))
 		}
+		draft = d2
 	}
 
 	mdFiles, err := FindMDFiles(c.cfg.Dir)
@@ -181,10 +205,28 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 	c.postComments(ctx, draft, reviewID)
 	c.generateHTML(draft, mdFiles)
 
-	c.log.InfoContext(ctx, "review completed", "reviewId", reviewID, "duration", time.Since(start).Round(time.Second), "retried", retried)
+	c.log.InfoContext(ctx, "review completed", "reviewId", reviewID, "duration", time.Since(start).Round(time.Second),
+		"retried", retried, "costUsd", c.runner.total())
 	return nil
 }
 
+// settleRun closes one runner's run: its spend joins the panel total, and a
+// failed run — or any run under --debug-upload — ships its artifacts to the
+// debug ring before a panel worktree goes. The upload gets a detached context:
+// a cancelled or timed-out run is precisely what the bundle should explain.
+func (c *Controller) settleRun(ctx context.Context, cfg *Config, rr *spendTracker, runErr error) {
+	c.addSpent(rr.total())
+	if runErr == nil && !cfg.DebugUpload {
+		return
+	}
+	upCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), debugUploadTimeout)
+	defer cancel()
+	c.uploadDebugBundle(upCtx, cfg, runErr, rr.total())
+}
+
+// debugUploadTimeout bounds shipping a debug bundle.
+const debugUploadTimeout = 30 * time.Second
+
 // uploadDebugBundle publishes on-disk artifacts so a failed CI run can be
 // inspected via /v1/debug/storage/. Best-effort — never returns an error.
 // The empty-bundle short-circuit lives in UploadClient.UploadDebugBundle.
@@ -300,20 +342,15 @@ func (c *Controller) Comment(ctx context.Context) error {
 	return nil
 }
 
-// applyRunResult records the run's model/runner/timing metadata and the resolved
-// profile snapshot on a freshly-read draft, then fills MR metadata. Shared by the
-// single review, panel members and the judge so all three populate identically.
-// The enriched draft is persisted back to review.json so the metadata survives a
-// failed upload and a later standalone `reviewctl upload` re-sends it intact.
-// failed lists earlier attempts of the same run (a retried judge): they were
-// billed too, so their usage is added in.
-func (c *Controller) applyRunResult(ctx context.Context, draft *rest.ReviewDraft, cfg *Config, rr runner.ReviewRunner, result *runner.ClaudeResult, failed ...*runner.ClaudeResult) {
-	draft.Review.ModelInfo = result.ToModelInfo(cfg.Model)
-	draft.Review.DurationMs = result.DurationMs
-	for _, f := range failed {
-		draft.Review.ModelInfo.Add(f.ToModelInfo(cfg.Model))
-		draft.Review.DurationMs += f.DurationMs
-	}
+// applyRunResult records the run's model/runner/timing metadata — every run
+// of rr so far, failed ones included — and the resolved profile snapshot on a
+// freshly-read draft, then fills MR metadata. Shared by the single review
+// (again after a Step 2 retry), panel members and the judge so all populate
+// identically. The enriched draft is persisted back to review.json so the
+// metadata survives a failed upload and a later standalone `reviewctl upload`
+// re-sends it intact.
+func (c *Controller) applyRunResult(ctx context.Context, draft *rest.ReviewDraft, cfg *Config, rr *spendTracker) {
+	draft.Review.ModelInfo, draft.Review.DurationMs = rr.usage(cfg.Model)
 	draft.Review.ModelInfo.Runner = rr.Name()
 	draft.Review.RunnerProfile = cfg.RunnerProfileSnapshot()
 	c.fillMetadata(ctx, draft)
diff --git a/pkg/reviewer/ctl/ctl_test.go b/pkg/reviewer/ctl/ctl_test.go
index 53c4f67..9220bac 100644
--- a/pkg/reviewer/ctl/ctl_test.go
+++ b/pkg/reviewer/ctl/ctl_test.go
@@ -151,7 +151,13 @@ func TestController_Review(t *testing.T) {
 		TargetBranch: "master",
 	}
 
-	runner := &testClaudeRunner{fixturePath: "testdata/claude_result.json"}
+	runner := &testClaudeRunner{fixturePath: "testdata/claude_result.json", beforeRun: func() error {
+		return editReviewJSON(tmpDir, func(d *rest.ReviewDraft) {
+			for i := range d.Files {
+				d.Files[i].Summary = "reviewed"
+			}
+		})
+	}}
 	c := NewController(cfg, runner, slog.Default())
 
 	err := c.Review(context.Background())
@@ -161,25 +167,34 @@ func TestController_Review(t *testing.T) {
 	assert.True(t, uploadedReview, "review was not uploaded")
 }
 
-func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
-	var debugUploaded bool
-	var debugError string
+// editReviewJSON edits the on-disk review.json in place, as a runner fills the
+// skeleton.
+func editReviewJSON(dir string, edit func(*rest.ReviewDraft)) error {
+	draft, err := ReadReviewJSON(dir)
+	if err != nil {
+		return err
+	}
+	edit(draft)
+	return WriteReviewJSON(dir, draft)
+}
 
+// newDebugCaptureServer serves the prompt RPC and records the form fields of
+// the debug bundle upload; nothing else is expected.
+func newDebugCaptureServer(t *testing.T) (*httptest.Server, map[string]string) {
+	t.Helper()
+	fields := map[string]string{}
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		path := r.URL.Path
-		if path == "/v1/reviewctl/rpc/" && r.Method == http.MethodPost {
+		if r.URL.Path == "/v1/reviewctl/rpc/" {
 			w.Header().Set("Content-Type", "application/json")
 			_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "result": "prompt", "id": 1})
 			return
 		}
-		if strings.HasPrefix(path, "/v1/upload/debug/") && r.Method == http.MethodPost {
+		if strings.HasPrefix(r.URL.Path, "/v1/upload/debug/") {
 			if !assert.NoError(t, r.ParseMultipartForm(32<<20)) {
-				w.WriteHeader(http.StatusBadRequest)
 				return
 			}
-			debugUploaded = true
-			if v := r.MultipartForm.Value["errorMsg"]; len(v) > 0 {
-				debugError = v[0]
+			for k, v := range r.MultipartForm.Value {
+				fields[k] = v[0]
 			}
 			w.Header().Set("Content-Type", "application/json")
 			_, _ = w.Write([]byte(`{"id":"x","url":"/v1/debug/storage/x/"}`))
@@ -187,7 +202,26 @@ func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
-	defer srv.Close()
+	t.Cleanup(srv.Close)
+	return srv, fields
+}
+
+func TestController_Review_FailsOnUnfilledReview(t *testing.T) {
+	srv, fields := newDebugCaptureServer(t)
+	cfg := &Config{Key: "test-key", URL: srv.URL, Model: "opus", Dir: t.TempDir(), Runner: runner.RunnerClaude}
+	// The runner never touches review.json, neither on the run nor on the Step 2 retry.
+	rr := &testClaudeRunner{fixturePath: "testdata/claude_result.json"}
+
+	err := NewController(cfg, rr, slog.Default()).Review(context.Background())
+	require.ErrorContains(t, err, "empty review")
+	assert.NotEmpty(t, rr.sessionID, "the Step 2 retry resumed the session")
+	assert.Equal(t, reviewer.RunStatusFailed, fields["status"])
+	assert.Equal(t, reviewer.RunReasonNotSubmitted, fields["reason"])
+	assert.Equal(t, "4.175053", fields["costUsd"], "both runs are billed")
+}
+
+func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
+	srv, fields := newDebugCaptureServer(t)
 
 	// Simulate Claude overwriting the skeleton with an invalid review.json
 	// — reproduces the CI failure where the model picks empty reviewType.
@@ -207,8 +241,8 @@ func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
 	err := c.Review(context.Background())
 	require.Error(t, err, "Review must fail on invalid review.json")
 	assert.Contains(t, err.Error(), "invalid reviewType")
-	assert.True(t, debugUploaded, "debug bundle must be uploaded on failure")
-	assert.Contains(t, debugError, "files[0]", "errorMsg must carry verbose validation detail")
+	assert.Contains(t, fields, "errorMsg", "debug bundle must be uploaded on failure")
+	assert.Contains(t, fields["errorMsg"], "files[0]", "errorMsg must carry verbose validation detail")
 }
 
 // failingRunner fails like a real runner: a tagged error plus the partial result
@@ -226,27 +260,7 @@ func (r failingRunner) Name() string      { return r.name }
 func (r failingRunner) SetSession(string) {}
 
 func TestController_Review_ReportsFailureOutcome(t *testing.T) {
-	fields := map[string]string{}
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/v1/reviewctl/rpc/" {
-			w.Header().Set("Content-Type", "application/json")
-			_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "result": "prompt", "id": 1})
-			return
-		}
-		if strings.HasPrefix(r.URL.Path, "/v1/upload/debug/") {
-			if !assert.NoError(t, r.ParseMultipartForm(32<<20)) {
-				return
-			}
-			for k, v := range r.MultipartForm.Value {
-				fields[k] = v[0]
-			}
-			w.Header().Set("Content-Type", "application/json")
-			_, _ = w.Write([]byte(`{"id":"x","url":"/v1/debug/storage/x/"}`))
-			return
-		}
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer srv.Close()
+	srv, fields := newDebugCaptureServer(t)
 
 	tests := []struct {
 		name       string
@@ -407,14 +421,17 @@ func TestSpendTracker(t *testing.T) {
 	assert.Equal(t, runner.RunnerClaude, st.Name())
 }
 
-func TestApplyRunResultAddsFailedAttempts(t *testing.T) {
+func TestApplyRunResultRecordsEveryRun(t *testing.T) {
 	c := &Controller{cfg: &Config{}, log: slog.Default()}
 	cfg := &Config{Dir: t.TempDir(), Model: "m"}
 	draft := &rest.ReviewDraft{}
+	// A judge attempt that came back empty, then the one that delivered.
+	rr := &spendTracker{ReviewRunner: failingRunner{name: runner.RunnerCodex}, results: []*runner.ClaudeResult{
+		{TotalCostUSD: 0.5, DurationMs: 5},
+		{TotalCostUSD: 1, DurationMs: 10},
+	}}
 
-	c.applyRunResult(t.Context(), draft, cfg, failingRunner{name: runner.RunnerCodex},
-		&runner.ClaudeResult{TotalCostUSD: 1, DurationMs: 10},
-		&runner.ClaudeResult{TotalCostUSD: 0.5, DurationMs: 5}) // a judge attempt that came back empty
+	c.applyRunResult(t.Context(), draft, cfg, rr)
 
 	assert.InDelta(t, 1.5, draft.Review.ModelInfo.CostUsd, 1e-9)
 	assert.Equal(t, 15, draft.Review.DurationMs)
diff --git a/pkg/reviewer/ctl/panel.go b/pkg/reviewer/ctl/panel.go
index fdce36a..e8ccda2 100644
--- a/pkg/reviewer/ctl/panel.go
+++ b/pkg/reviewer/ctl/panel.go
@@ -13,7 +13,6 @@ import (
 
 	"reviewsrv/pkg/rest"
 	"reviewsrv/pkg/reviewer"
-	"reviewsrv/pkg/reviewer/runner"
 )
 
 // panelConcurrency bounds how many members review at once. Panels are small
@@ -40,6 +39,16 @@ func (c *Controller) reviewPanel(ctx context.Context, start time.Time) error {
 	if c.runnerFactory == nil {
 		return errors.New("panel review requires a runner factory")
 	}
+	// Strings, not MemberSpec values: a spec carries its profile's token.
+	members := make([]string, len(c.cfg.Multi))
+	for i, m := range c.cfg.Multi {
+		members[i] = m.String()
+	}
+	judge := ""
+	if c.cfg.Judge != nil {
+		judge = c.cfg.Judge.String()
+	}
+	c.log.InfoContext(ctx, "starting panel review", "projectKey", c.cfg.Key, "members", members, "judge", judge)
 
 	prompt, err := c.prompt.FetchPrompt(ctx, c.cfg.URL, c.cfg.Key)
 	if err != nil {
@@ -87,7 +96,8 @@ func (c *Controller) reviewPanel(ctx context.Context, start time.Time) error {
 	}
 
 	c.log.InfoContext(ctx, "panel completed",
-		"members", len(outputs), "primaryReviewId", primaryID, "duration", time.Since(start).Round(time.Second))
+		"members", len(outputs), "primaryReviewId", primaryID, "duration", time.Since(start).Round(time.Second),
+		"costUsd", c.spentTotal())
 	return nil
 }
 
@@ -110,9 +120,7 @@ func (c *Controller) runMembers(ctx context.Context, dirs, labels []string, prom
 	sem := make(chan struct{}, panelConcurrency)
 	var wg sync.WaitGroup
 	for i, m := range c.cfg.Multi {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			sem <- struct{}{}
 			defer func() { <-sem }()
 
@@ -120,18 +128,19 @@ func (c *Controller) runMembers(ctx context.Context, dirs, labels []string, prom
 			defer cancel()
 			out, err := c.produceMember(mctx, dirs[i], labels[i], m, prompt)
 			results[i] = result{out: out, err: err}
-		}()
+		})
 	}
 	wg.Wait()
 
 	var outputs []*memberOutput
 	for i := range results {
 		if results[i].err != nil {
-			c.log.ErrorContext(ctx, "panel member failed", "label", labels[i], "err", results[i].err)
+			c.log.ErrorContext(ctx, "panel member failed", "member", labels[i], "err", results[i].err)
 			continue
 		}
 		outputs = append(outputs, results[i].out)
-		c.log.InfoContext(ctx, "panel member reviewed", "label", labels[i], "issues", len(results[i].out.draft.Issues))
+		c.log.InfoContext(ctx, "panel member reviewed", "member", labels[i], "issues", len(results[i].out.draft.Issues),
+			"costUsd", results[i].out.draft.Review.ModelInfo.CostUsd)
 	}
 	return outputs
 }
@@ -164,7 +173,7 @@ func (c *Controller) finishPanel(ctx context.Context, base, commit string, outpu
 			if err != nil {
 				return 0, err
 			}
-			c.log.InfoContext(ctx, "panel member uploaded", "label", o.label, "reviewId", id)
+			c.log.InfoContext(ctx, "panel member uploaded", "member", o.label, "reviewId", id)
 			lastID = id
 		}
 		return lastID, nil
@@ -246,17 +255,9 @@ func (c *Controller) memberConfig(dir string, m MemberSpec) Config {
 // worktree, which is otherwise the only place the runner transcript exists.
 func (c *Controller) produceMember(ctx context.Context, dir, label string, m MemberSpec, prompt string) (out *memberOutput, err error) {
 	mc := c.memberConfig(dir, m)
+	mc.Label = label
 	var rr *spendTracker
-	defer func() {
-		if err == nil {
-			return
-		}
-		// Detached context: a member timeout is precisely a failure this bundle
-		// should explain, and by then ctx is already cancelled.
-		upCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
-		defer cancel()
-		c.uploadDebugBundle(upCtx, &mc, err, rr.total())
-	}()
+	defer func() { c.settleRun(ctx, &mc, rr, err) }()
 
 	built, err := c.runnerFactory(&mc)
 	if err != nil {
@@ -267,8 +268,7 @@ func (c *Controller) produceMember(ctx context.Context, dir, label string, m Mem
 		return nil, fmt.Errorf("write review.json skeleton: %w", err)
 	}
 
-	result, err := rr.Run(ctx, prompt)
-	if err != nil {
+	if _, err = rr.Run(ctx, prompt); err != nil {
 		return nil, fmt.Errorf("run %s: %w", mc.Runner, err)
 	}
 
@@ -276,12 +276,13 @@ func (c *Controller) produceMember(ctx context.Context, dir, label string, m Mem
 	if err != nil {
 		return nil, fmt.Errorf("read review: %w", err)
 	}
-	c.applyRunResult(ctx, draft, &mc, rr, result)
+	c.applyRunResult(ctx, draft, &mc, rr)
 	// A skeleton passes Validate, so an "exit 0, review.json untouched" run
 	// would otherwise sail into the panel as a legitimate zero-findings member
 	// and dilute the fusion.
 	if isReviewJSONUnfilled(draft) {
-		return nil, errors.New("empty review: runner finished without filling review.json (no issues, no group summaries)")
+		return nil, reviewer.WithRunReason(reviewer.RunReasonNotSubmitted,
+			errors.New("empty review: runner finished without filling review.json (no issues, no group summaries)"))
 	}
 
 	mdFiles, err := FindMDFiles(mc.Dir)
@@ -294,21 +295,25 @@ func (c *Controller) produceMember(ctx context.Context, dir, label string, m Mem
 // runJudge stages each member's outputs into members/<label>/ inside the judge
 // worktree, then runs the judge with the fusion prompt (one retry) and returns
 // the fused draft + R*.md.
-func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string, outputs []*memberOutput) (*memberOutput, error) {
-	if err := stageMembers(judgeDir, outputs); err != nil {
-		return nil, fmt.Errorf("stage members: %w", err)
-	}
-
+func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string, outputs []*memberOutput) (_ *memberOutput, err error) {
 	jc := c.memberConfig(judgeDir, *c.cfg.Judge)
+	jc.Label = "judge"
+	var rr *spendTracker
+	// The panel survives a failed judge (the primary member is promoted), but
+	// the judge's run and spend must not vanish with its worktree.
+	defer func() { c.settleRun(ctx, &jc, rr, err) }()
 
-	rr, err := c.runnerFactory(&jc)
+	if err = stageMembers(judgeDir, outputs); err != nil {
+		return nil, fmt.Errorf("stage members: %w", err)
+	}
+	built, err := c.runnerFactory(&jc)
 	if err != nil {
 		return nil, fmt.Errorf("build judge runner: %w", err)
 	}
+	rr = trackSpend(built)
 	prompt := SubstituteVariables(fusionPrompt, &jc)
 
 	var lastErr error
-	var failed []*runner.ClaudeResult           // attempts that ran but failed: billed all the same
 	for attempt := 1; attempt <= 2; attempt++ { // initial run + one retry
 		// Wipe the previous attempt's root artifacts; the staged members/ subdirs
 		// are untouched (CleanReviewArtifacts only looks at the dir root).
@@ -320,30 +325,26 @@ func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string
 		}
 
 		rctx, cancel := withTimeout(ctx, c.cfg.Timeout)
-		result, err := rr.Run(rctx, prompt)
+		_, err := rr.Run(rctx, prompt)
 		cancel()
 		if err != nil {
 			lastErr = err
-			if result != nil {
-				failed = append(failed, result)
-			}
 			c.log.WarnContext(ctx, "judge run failed", "attempt", attempt, "err", err)
 			continue
 		}
 		draft, err := ReadReviewJSON(jc.Dir)
 		if err != nil {
 			lastErr = err
-			failed = append(failed, result)
 			c.log.WarnContext(ctx, "judge review.json invalid", "attempt", attempt, "err", err)
 			continue
 		}
 		if isReviewJSONUnfilled(draft) {
-			lastErr = errors.New("judge produced an empty review")
-			failed = append(failed, result)
+			lastErr = reviewer.WithRunReason(reviewer.RunReasonNotSubmitted, errors.New("judge produced an empty review"))
 			c.log.WarnContext(ctx, "judge review empty, retrying", "attempt", attempt)
 			continue
 		}
-		c.applyRunResult(ctx, draft, &jc, rr, result, failed...)
+		// Every attempt so far is in the record: the failed ones were billed too.
+		c.applyRunResult(ctx, draft, &jc, rr)
 
 		mdFiles, err := FindMDFiles(jc.Dir)
 		if err != nil {
diff --git a/pkg/reviewer/ctl/panel_test.go b/pkg/reviewer/ctl/panel_test.go
index 111bfdd..e3ae870 100644
--- a/pkg/reviewer/ctl/panel_test.go
+++ b/pkg/reviewer/ctl/panel_test.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"reviewsrv/pkg/rest"
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/runner"
 
 	"github.com/stretchr/testify/assert"
@@ -35,14 +36,9 @@ func (f *fakeRunner) Run(context.Context, string) (*runner.ClaudeResult, error)
 		return nil, f.err
 	}
 	if f.dir != "" {
-		draft, err := ReadReviewJSON(f.dir)
-		if err != nil {
-			return nil, err
-		}
-		draft.Issues = append(draft.Issues, rest.ReviewDraftIssue{
-			LocalID: "C1", Severity: "low", Title: "t", FileType: "code",
-		})
-		if err := WriteReviewJSON(f.dir, draft); err != nil {
+		if err := editReviewJSON(f.dir, func(d *rest.ReviewDraft) {
+			d.Issues = append(d.Issues, rest.ReviewDraftIssue{LocalID: "C1", Severity: "low", Title: "t", FileType: "code"})
+		}); err != nil {
 			return nil, err
 		}
 	}
@@ -161,15 +157,10 @@ func (j *judgeRunner) Run(context.Context, string) (*runner.ClaudeResult, error)
 	if j.runs == 1 {
 		return &runner.ClaudeResult{}, nil
 	}
-	draft, err := ReadReviewJSON(j.dir)
-	if err != nil {
-		return nil, err
-	}
-	draft.Issues = append(draft.Issues, rest.ReviewDraftIssue{LocalID: "F1", Severity: "low", Title: "fused", FileType: "code"})
-	if err := WriteReviewJSON(j.dir, draft); err != nil {
-		return nil, err
-	}
-	return &runner.ClaudeResult{}, nil
+	err := editReviewJSON(j.dir, func(d *rest.ReviewDraft) {
+		d.Issues = append(d.Issues, rest.ReviewDraftIssue{LocalID: "F1", Severity: "low", Title: "fused", FileType: "code"})
+	})
+	return &runner.ClaudeResult{}, err
 }
 func (j *judgeRunner) Name() string      { return runner.RunnerClaude }
 func (j *judgeRunner) SetSession(string) {}
@@ -225,13 +216,17 @@ func TestMemberConfigInheritsTracker(t *testing.T) {
 		TrackerToken: "tracker-tok",
 	}, nil, slog.Default())
 
-	mc := c.memberConfig("/tmp/wt", MemberSpec{Runner: "codex", Model: "m", Profile: &ResolvedProfile{Token: "profile-tok"}})
+	mc := c.memberConfig("/tmp/wt", MemberSpec{Runner: "codex", Model: "m", Profile: &ResolvedProfile{
+		Token: "profile-tok", Params: RunnerProfileParams{MaxRounds: 120, AllowDangerousPermissions: true},
+	}})
 
 	// Tracker access is project-wide: the profile overlay must not touch it.
 	assert.Equal(t, "https://yt.example.com", mc.TrackerURL)
 	assert.Equal(t, "tracker-tok", mc.TrackerToken)
 	assert.Equal(t, "profile-tok", mc.Token, "profile credentials still overlaid")
 	assert.Equal(t, "codex", mc.Runner)
+	assert.Equal(t, 120, mc.MaxRounds, "the member's own profile params apply")
+	assert.True(t, mc.AllowDangerousPermissions)
 }
 
 func TestMemberLabel(t *testing.T) {
@@ -259,3 +254,23 @@ func TestSourceLabels(t *testing.T) {
 		"claude",
 	}, got)
 }
+
+func TestRunJudge_FailureShipsDebugBundle(t *testing.T) {
+	srv, fields := newDebugCaptureServer(t)
+	mdir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(mdir, "review.json"), []byte(`{"issues":[]}`), 0o600))
+	outputs := []*memberOutput{{label: "opus", dir: mdir}}
+
+	// Both attempts leave the skeleton untouched, each billed $0.5.
+	c := NewController(&Config{Key: "k", URL: srv.URL, Judge: &MemberSpec{Runner: runner.RunnerClaude, Model: "opus"}}, nil, slog.Default())
+	c.runnerFactory = func(*Config) (runner.ReviewRunner, error) {
+		return failingRunner{name: runner.RunnerClaude, cost: 0.5}, nil
+	}
+
+	_, err := c.runJudge(t.Context(), t.TempDir(), "fuse the members", outputs)
+	require.ErrorContains(t, err, "judge produced an empty review")
+	assert.Equal(t, reviewer.RunStatusFailed, fields["status"])
+	assert.Equal(t, reviewer.RunReasonNotSubmitted, fields["reason"])
+	assert.Equal(t, "1", fields["costUsd"], "both judge attempts are billed")
+	assert.Equal(t, runner.RunnerClaude, fields["runner"])
+}
diff --git a/pkg/reviewer/ctl/recovery.go b/pkg/reviewer/ctl/recovery.go
index 3e5199a..749cdff 100644
--- a/pkg/reviewer/ctl/recovery.go
+++ b/pkg/reviewer/ctl/recovery.go
@@ -27,23 +27,17 @@ func isReviewJSONUnfilled(draft *rest.ReviewDraft) bool {
 }
 
 // runStep2Recovery wraps the retry path: logs the skip, invokes retryStep2,
-// merges metrics from both passes, and returns the recovered draft (or nil
-// if retry didn't help, so caller keeps the original skeleton).
+// records both passes on the recovered draft, and returns it (or nil if the
+// retry didn't help, which fails the run).
 func (c *Controller) runStep2Recovery(ctx context.Context, draft *rest.ReviewDraft, first *runner.ClaudeResult) *rest.ReviewDraft {
-	c.log.WarnContext(ctx, "review.json appears unfilled (skeleton uploaded as-is) — attempting Step 2 retry with session continuation", "files", len(draft.Files), "issues", len(draft.Issues), "sessionId", first.SessionID)
+	c.log.WarnContext(ctx, "review.json appears unfilled — attempting Step 2 retry with session continuation", "files", len(draft.Files), "issues", len(draft.Issues), "sessionId", first.SessionID)
 
-	d2, retryRes := c.retryStep2(ctx, first.SessionID)
+	d2 := c.retryStep2(ctx, first.SessionID)
 	if d2 == nil {
 		return nil
 	}
-
-	d2.Review.ModelInfo = draft.Review.ModelInfo
-	d2.Review.DurationMs = draft.Review.DurationMs
-	if retryRes != nil {
-		d2.Review.ModelInfo.Add(retryRes.ToModelInfo(c.cfg.Model))
-		d2.Review.DurationMs += retryRes.DurationMs
-	}
-	c.fillMetadata(ctx, d2)
+	// The tracker holds both passes, so the record covers the retry too.
+	c.applyRunResult(ctx, d2, c.cfg, c.runner)
 
 	if isReviewJSONUnfilled(d2) {
 		c.log.WarnContext(ctx, "Step 2 retry did not fill review.json")
@@ -55,30 +49,28 @@ func (c *Controller) runStep2Recovery(ctx context.Context, draft *rest.ReviewDra
 
 // retryStep2 invokes the runner a second time with a focused "fill review.json"
 // prompt, resuming the previous session so the cached original prompt isn't
-// re-billed. Returns the re-read draft and the runner result for metric
-// aggregation; nil draft signals "retry could not happen or runner failed"
-// and the caller stays with the original skeleton draft.
-func (c *Controller) retryStep2(ctx context.Context, lastSessionID string) (*rest.ReviewDraft, *runner.ClaudeResult) {
+// re-billed. Returns the re-read draft; nil signals "retry could not happen or
+// runner failed".
+func (c *Controller) retryStep2(ctx context.Context, lastSessionID string) *rest.ReviewDraft {
 	if lastSessionID == "" {
 		c.log.WarnContext(ctx, "Step 2 retry skipped: no sessionId from previous run")
-		return nil, nil
+		return nil
 	}
 	if c.runner == nil {
-		return nil, nil
+		return nil
 	}
 
 	c.runner.SetSession(lastSessionID)
 
-	res, err := c.runner.Run(ctx, reviewer.PromptStep2Retry)
-	if err != nil {
+	if _, err := c.runner.Run(ctx, reviewer.PromptStep2Retry); err != nil {
 		c.log.WarnContext(ctx, "Step 2 retry runner failed", "err", err)
-		return nil, nil
+		return nil
 	}
 
 	draft, err := ReadReviewJSON(c.cfg.Dir)
 	if err != nil {
 		c.log.WarnContext(ctx, "Step 2 retry: review.json still unparseable", "err", err)
-		return nil, nil
+		return nil
 	}
-	return draft, res
+	return draft
 }
diff --git a/pkg/reviewer/ctl/skip_detect_test.go b/pkg/reviewer/ctl/skip_detect_test.go
index 3010c90..dd52ee5 100644
--- a/pkg/reviewer/ctl/skip_detect_test.go
+++ b/pkg/reviewer/ctl/skip_detect_test.go
@@ -127,9 +127,8 @@ func TestRetryStep2(t *testing.T) {
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft, res := c.retryStep2(context.Background(), "")
+		draft := c.retryStep2(context.Background(), "")
 		assert.Nil(t, draft)
-		assert.Nil(t, res)
 		assert.False(t, stub.runCalled, "runner.Run must not be called when sessionId empty")
 		assert.Empty(t, stub.sessionSet, "SetSession must not be called when sessionId empty")
 	})
@@ -139,9 +138,8 @@ func TestRetryStep2(t *testing.T) {
 			cfg: &Config{Dir: t.TempDir()},
 			log: slog.Default(),
 		}
-		draft, res := c.retryStep2(context.Background(), "ses_123")
+		draft := c.retryStep2(context.Background(), "ses_123")
 		assert.Nil(t, draft)
-		assert.Nil(t, res)
 	})
 
 	t.Run("runner error returns nil draft", func(t *testing.T) {
@@ -151,9 +149,8 @@ func TestRetryStep2(t *testing.T) {
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft, res := c.retryStep2(context.Background(), "ses_123")
+		draft := c.retryStep2(context.Background(), "ses_123")
 		assert.Nil(t, draft)
-		assert.Nil(t, res)
 		assert.Equal(t, "ses_123", stub.sessionSet, "SetSession must be called before Run")
 	})
 
@@ -175,9 +172,8 @@ func TestRetryStep2(t *testing.T) {
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft, res := c.retryStep2(context.Background(), "ses_abc")
+		draft := c.retryStep2(context.Background(), "ses_abc")
 		require.NotNil(t, draft, "expected non-nil draft after successful retry")
-		require.NotNil(t, res, "expected non-nil ClaudeResult for metric aggregation")
 		assert.Equal(t, "ses_abc", stub.sessionSet)
 		require.Len(t, draft.Files, 1)
 		assert.Equal(t, "filled by retry", draft.Files[0].Summary)
diff --git a/pkg/reviewer/ctl/upload.go b/pkg/reviewer/ctl/upload.go
index 97be1c0..bcc0e84 100644
--- a/pkg/reviewer/ctl/upload.go
+++ b/pkg/reviewer/ctl/upload.go
@@ -107,7 +107,7 @@ func (c *UploadClient) UploadFile(ctx context.Context, serverURL, projectKey str
 		return fmt.Errorf("upload file %s: HTTP %d: %s", reviewType, resp.StatusCode, string(respBody))
 	}
 
-	c.log.InfoContext(ctx, "uploaded file", "reviewType", reviewType)
+	c.log.InfoContext(ctx, "uploaded file", "reviewId", reviewID, "reviewType", reviewType)
 
 	return nil
 }
diff --git a/pkg/reviewer/direct/errors.go b/pkg/reviewer/direct/errors.go
index d9b30ce..ba86f88 100644
--- a/pkg/reviewer/direct/errors.go
+++ b/pkg/reviewer/direct/errors.go
@@ -1,8 +1,10 @@
 package direct
 
 import (
+	"cmp"
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -23,6 +25,10 @@ func providerReason(err error) string {
 	if errors.As(err, &oe) {
 		return openaiReason(oe)
 	}
+	var rf *responseFailedError
+	if errors.As(err, &rf) {
+		return rf.reason()
+	}
 	// Not an API error: a transport failure (reset stream, EOF, refused
 	// connection) that outlived the retries.
 	return reviewer.RunReasonAPIError
@@ -54,27 +60,79 @@ func isCreditBalanceError(body string) bool {
 	return strings.Contains(strings.ToLower(body), "credit balance")
 }
 
-// openaiReason classifies an OpenAI-protocol API error (OpenAI, DeepSeek, ...).
+// openaiReason classifies an OpenAI-protocol API error (OpenAI, DeepSeek, ...)
+// by its code or type, falling back to the HTTP status.
 func openaiReason(e *openai.APIError) string {
-	if e.Type == "insufficient_quota" || e.Code == "insufficient_quota" {
+	code, _ := e.Code.(string)
+	return cmp.Or(openaiCodeReason(code), openaiCodeReason(e.Type), reviewer.ReasonForHTTPStatus(e.HTTPStatusCode))
+}
+
+// openaiCodeReason maps an OpenAI error code (or type) to a reviewer.RunReason*,
+// or "" when it names no known cause.
+func openaiCodeReason(code string) string {
+	switch code {
+	case "insufficient_quota":
 		return reviewer.RunReasonBilling
+	case "rate_limit_exceeded":
+		return reviewer.RunReasonRateLimit
+	case "server_error":
+		return reviewer.RunReasonAPIError
+	}
+	return ""
+}
+
+// responseFailedError is a Responses API reply that came back with status
+// "failed": HTTP 200, the failure in its body.
+type responseFailedError struct {
+	id, code, message string
+}
+
+func newResponseFailedError(r openai.CreateResponseResponse) *responseFailedError {
+	e := &responseFailedError{id: r.ID}
+	if r.Error != nil {
+		e.code, e.message = r.Error.Code, r.Error.Message
 	}
-	return reviewer.ReasonForHTTPStatus(e.HTTPStatusCode)
+	return e
+}
+
+func (e *responseFailedError) Error() string {
+	if e.code == "" {
+		return fmt.Sprintf("response %s failed", e.id)
+	}
+	return fmt.Sprintf("response %s failed: %s: %s", e.id, e.code, e.message)
+}
+
+// reason maps the failure code to a reviewer.RunReason*; a failure without a
+// code is taken for a server error.
+func (e *responseFailedError) reason() string {
+	if e.code == "" {
+		return reviewer.RunReasonAPIError
+	}
+	return cmp.Or(openaiCodeReason(e.code), reviewer.RunReasonOther)
 }
 
 // isOpenAITransient reports whether an OpenAI-protocol call is worth retrying:
-// a rate limit or server-side API error, or a network-level request error.
-// Billing (insufficient_quota also comes as a 429) and auth are definitive.
+// a rate limit or server-side API error — as an HTTP status or inside a failed
+// Responses reply — or a network-level request error. Billing
+// (insufficient_quota also comes as a 429) and auth are definitive.
 func isOpenAITransient(err error) bool {
 	var apiErr *openai.APIError
 	if errors.As(err, &apiErr) {
-		r := openaiReason(apiErr)
-		return r == reviewer.RunReasonRateLimit || r == reviewer.RunReasonAPIError
+		return isTransientReason(openaiReason(apiErr))
+	}
+	var rf *responseFailedError
+	if errors.As(err, &rf) {
+		return isTransientReason(rf.reason())
 	}
 	var reqErr *openai.RequestError
 	return errors.As(err, &reqErr)
 }
 
+// isTransientReason reports whether a failure of that reason may pass on retry.
+func isTransientReason(reason string) bool {
+	return reason == reviewer.RunReasonRateLimit || reason == reviewer.RunReasonAPIError
+}
+
 // isAnthropicTransient reports whether a failed Messages call is worth
 // retrying: anything but a definitive rejection (billing, auth, a bad request).
 // It covers what the SDK would retry on request open (408/409/429/5xx), an
diff --git a/pkg/reviewer/direct/loop.go b/pkg/reviewer/direct/loop.go
index f6a397d..aeeb9ce 100644
--- a/pkg/reviewer/direct/loop.go
+++ b/pkg/reviewer/direct/loop.go
@@ -56,6 +56,10 @@ const (
 	budgetWarnAt  = 10
 	budgetFinalAt = 3
 	graceRounds   = 5
+	// maxDeniedRounds grace rounds in a row made only of refused calls end the
+	// run: the model is not delivering the review, and each such round re-sends
+	// the whole history.
+	maxDeniedRounds = 2
 )
 
 // budgetDenied is the tool error for a read/search call during the grace rounds.
@@ -109,10 +113,13 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 	}
 
 	msgs := []Message{{Role: RoleUser, Text: userPrompt}}
-	var total Usage
-	var apiMs int // cumulative provider Complete time (vs total wall-clock)
-	nudged := false
-	truncatedRounds := 0 // consecutive rounds cut by the output-token cap
+	var (
+		total           Usage
+		apiMs           int // cumulative provider Complete time (vs total wall-clock)
+		nudged          bool
+		truncatedRounds int // consecutive rounds cut by the output-token cap
+		deniedRounds    int // consecutive grace rounds whose every call was refused
+	)
 
 	// Record the kickoff input (system contract + user task with the preloaded
 	// diff/files) so the transcript is a full input/output log, not just the
@@ -136,15 +143,13 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 		if round == opts.MaxRounds {
 			reg.restrict(budgetDenied, toolSetGroup, toolAddIssues, toolSubmitReview)
 		}
-		t0 := time.Now()
-		resp, err := p.Complete(ctx, Request{System: system, Messages: msgs, Tools: reg.Defs(), Effort: opts.Effort})
-		apiMs += int(time.Since(t0).Milliseconds())
-		emitRetries(opts.OnEvent, round, resp.Retries)
+		resp, roundMs, err := completeRound(ctx, p, Request{System: system, Messages: msgs, Tools: reg.Defs(), Effort: opts.Effort}, opts.OnEvent, round)
+		apiMs += roundMs
 		if err != nil {
 			return finish(round, "error", reg.Submitted()), reviewer.WithRunReason(providerReason(err), fmt.Errorf("round %d: %w", round, err))
 		}
 		total = sumUsage(total, resp.Usage)
-		emitRound(opts.OnEvent, round, resp)
+		emitRound(opts.OnEvent, round, resp, roundMs)
 		msgs = append(msgs, Message{Role: RoleAssistant, Text: resp.Text, ToolCalls: resp.ToolCalls, Raw: resp.Raw})
 
 		// A truncated round burned the whole max_tokens budget (thinking + partial
@@ -153,7 +158,7 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 		// abort happens AFTER dispatching whatever tool calls did arrive, so a
 		// submit_review or issue batch that survived the cut is not thrown away.
 		truncated := IsTruncated(resp.StopReason)
-		truncatedRounds = countTruncated(truncatedRounds, truncated)
+		truncatedRounds = consecutive(truncatedRounds, truncated)
 		abort := truncatedRounds >= maxConsecutiveTruncated
 
 		if len(resp.ToolCalls) == 0 {
@@ -176,7 +181,8 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 			return finish(round+1, "end_turn", reg.Submitted()), nil
 		}
 
-		msgs = append(msgs, runTools(ctx, reg, opts, round, resp.ToolCalls, truncated))
+		toolMsg, allDenied := runTools(ctx, reg, opts, round, resp.ToolCalls, truncated)
+		msgs = append(msgs, toolMsg)
 
 		if reg.Submitted() {
 			return finish(round+1, "submitted", true), nil
@@ -184,6 +190,10 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 		if abort {
 			return finish(round+1, "error", false), fmt.Errorf("round %d: %w", round, errTruncatedRounds)
 		}
+		deniedRounds = consecutive(deniedRounds, allDenied)
+		if deniedRounds >= maxDeniedRounds {
+			return finish(round+1, "max_rounds", false), errMaxRounds
+		}
 		msgs = maybeCompact(msgs, opts, round)
 	}
 
@@ -192,9 +202,11 @@ func Run(ctx context.Context, p LLMProvider, reg *Registry, system, userPrompt s
 
 // runTools dispatches a round's tool calls and returns the tool message fed back
 // to the model, with any harness notices (truncation, round budget) folded into
-// its last result.
-func runTools(ctx context.Context, reg *Registry, opts Options, round int, calls []ToolCall, truncated bool) Message {
+// its last result, and whether the round budget refused every call.
+func runTools(ctx context.Context, reg *Registry, opts Options, round int, calls []ToolCall, truncated bool) (Message, bool) {
+	denied0 := reg.deniedCalls()
 	results := dispatchParallel(ctx, reg, calls)
+	allDenied := reg.deniedCalls()-denied0 == len(calls)
 	if truncated {
 		appendNotice(results, noticeTruncated)
 	}
@@ -202,7 +214,7 @@ func runTools(ctx context.Context, reg *Registry, opts Options, round int, calls
 		noteBudget(opts, round, results)
 	}
 	emitToolResults(opts.OnEvent, round, results)
-	return Message{Role: RoleTool, ToolResults: results}
+	return Message{Role: RoleTool, ToolResults: results}, allDenied
 }
 
 // noteBudget folds the round-budget notice due after this round (if any) into
@@ -216,13 +228,6 @@ func noteBudget(opts Options, round int, results []ToolResult) {
 	opts.OnEvent.emit(Event{Round: round, Kind: "notice", Text: notice})
 }
 
-// emitRetries records the transient provider failures retried within a round.
-func emitRetries(s Sink, round int, retries []string) {
-	for _, r := range retries {
-		s.emit(Event{Round: round, Kind: "retry", Text: r})
-	}
-}
-
 // emitToolResults records each tool result in the transcript, clipped to keep
 // the log readable.
 func emitToolResults(s Sink, round int, results []ToolResult) {
@@ -231,15 +236,24 @@ func emitToolResults(s Sink, round int, results []ToolResult) {
 	}
 }
 
-// countTruncated advances the consecutive-truncated-rounds counter: any whole
-// (non-truncated) round resets it.
-func countTruncated(prev int, truncated bool) int {
-	if !truncated {
+// consecutive advances a run-of-rounds counter (truncated rounds, fully refused
+// rounds): a round without the condition resets it.
+func consecutive(prev int, hit bool) int {
+	if !hit {
 		return 0
 	}
 	return prev + 1
 }
 
+// completeRound sends one round to the provider, recording each retry as it
+// happens (a failed round's too), and returns its duration.
+func completeRound(ctx context.Context, p LLMProvider, req Request, s Sink, round int) (Response, int, error) {
+	req.OnRetry = func(err error) { s.emit(Event{Round: round, Kind: "retry", Text: err.Error()}) }
+	t0 := time.Now()
+	resp, err := p.Complete(ctx, req)
+	return resp, int(time.Since(t0).Milliseconds()), err
+}
+
 // maybeCompact prunes the history once it crosses the compaction threshold,
 // recording a transcript event: compaction rewrites the provider prompt cache,
 // so a sudden cost jump must be traceable to its round.
@@ -256,7 +270,7 @@ func maybeCompact(msgs []Message, opts Options, round int) []Message {
 }
 
 // emitRound records the model's text, requested tool calls and per-round usage.
-func emitRound(s Sink, round int, resp Response) {
+func emitRound(s Sink, round int, resp Response, durationMs int) {
 	if s == nil {
 		return
 	}
@@ -267,7 +281,7 @@ func emitRound(s Sink, round int, resp Response) {
 		s.emit(Event{Round: round, Kind: "tool_call", Tool: tc.Name, Args: tc.Args})
 	}
 	u := resp.Usage
-	s.emit(Event{Round: round, Kind: "round", Usage: &u, StopReason: resp.StopReason})
+	s.emit(Event{Round: round, Kind: "round", Usage: &u, StopReason: resp.StopReason, DurationMs: durationMs})
 }
 
 func makeResult(total Usage, rounds int, stop string, submitted bool, p LLMProvider) *Result {
diff --git a/pkg/reviewer/direct/loop_test.go b/pkg/reviewer/direct/loop_test.go
index 71e3c61..e083186 100644
--- a/pkg/reviewer/direct/loop_test.go
+++ b/pkg/reviewer/direct/loop_test.go
@@ -287,7 +287,7 @@ func TestRunMaxRoundsWithoutSubmit(t *testing.T) {
 	dir := t.TempDir()
 	reg := NewReviewRegistry(ReviewToolsConfig{Dir: dir})
 	prov := &scriptedProvider{}
-	for i := range 2 + graceRounds { // the model keeps exploring through the grace rounds
+	for i := range 2 + graceRounds { // the model keeps exploring past its budget
 		prov.responses = append(prov.responses, globRound(i))
 	}
 
@@ -297,7 +297,7 @@ func TestRunMaxRoundsWithoutSubmit(t *testing.T) {
 	require.Equal(t, reviewer.RunReasonMaxRounds, reason)
 	require.False(t, res.Submitted)
 	require.Equal(t, "max_rounds", res.StopReason)
-	require.Equal(t, 2+graceRounds, res.Rounds)
+	require.Equal(t, 2+maxDeniedRounds, res.Rounds, "grace rounds of refused calls only end the run early")
 	// Past MaxRounds, read tools are denied instead of served.
 	denied := lastToolResult(t, prov, 3)
 	require.True(t, denied.IsError)
@@ -445,3 +445,24 @@ func TestIsTruncated(t *testing.T) {
 	require.False(t, IsTruncated("end_turn"))
 	require.False(t, IsTruncated(""))
 }
+
+// retriedFailProvider fails after retrying, reporting the retried errors.
+type retriedFailProvider struct{ failingProvider }
+
+func (retriedFailProvider) Complete(_ context.Context, req Request) (Response, error) {
+	req.OnRetry(errors.New("overloaded"))
+	req.OnRetry(errors.New("reset stream"))
+	return Response{}, errors.New("anthropic: api_error")
+}
+
+func TestRunKeepsRetriesOfFailedRound(t *testing.T) {
+	var retries []string
+	opts := Options{MaxRounds: 5, OnEvent: func(ev Event) {
+		if ev.Kind == "retry" {
+			retries = append(retries, ev.Text)
+		}
+	}}
+	_, err := Run(context.Background(), retriedFailProvider{}, NewReviewRegistry(ReviewToolsConfig{Dir: t.TempDir()}), "s", "go", opts)
+	require.Error(t, err)
+	require.Equal(t, []string{"overloaded", "reset stream"}, retries, "the retries before a final failure reach the transcript")
+}
diff --git a/pkg/reviewer/direct/options.go b/pkg/reviewer/direct/options.go
index faba178..535c745 100644
--- a/pkg/reviewer/direct/options.go
+++ b/pkg/reviewer/direct/options.go
@@ -27,8 +27,9 @@ const (
 	MaxMaxRounds = 500
 )
 
-// IsValidMaxRounds reports whether n is an acceptable MaxRounds override.
-func IsValidMaxRounds(n int) bool { return n >= MinMaxRounds && n <= MaxMaxRounds }
+// IsValidMaxRounds reports whether n is an acceptable configured MaxRounds:
+// 0 (the default) or within the bounds.
+func IsValidMaxRounds(n int) bool { return n == 0 || n >= MinMaxRounds && n <= MaxMaxRounds }
 
 // DefaultOptions returns sensible loop defaults for a review run. The CompactAt
 // default is conservative (sized for ~128k-context backends); large-context
diff --git a/pkg/reviewer/direct/provider_anthropic.go b/pkg/reviewer/direct/provider_anthropic.go
index 2a33dab..adbe3c9 100644
--- a/pkg/reviewer/direct/provider_anthropic.go
+++ b/pkg/reviewer/direct/provider_anthropic.go
@@ -73,14 +73,9 @@ func (p *anthropicProvider) Pricing() Pricing { return p.pricing }
 // a dropped stream mid-review must not throw away the whole run.
 func (p *anthropicProvider) Complete(ctx context.Context, req Request) (Response, error) {
 	params := p.params(req)
-	out, retried, err := withRetry(ctx, anthropicRetry, func() (Response, error) {
+	return withRetry(ctx, anthropicRetry, req.OnRetry, func() (Response, error) {
 		return p.stream(ctx, params)
 	})
-	if err != nil {
-		return Response{}, err
-	}
-	out.Retries = retried
-	return out, nil
 }
 
 func (p *anthropicProvider) params(req Request) anthropic.MessageNewParams {
diff --git a/pkg/reviewer/direct/provider_anthropic_test.go b/pkg/reviewer/direct/provider_anthropic_test.go
index 0e3fc60..b4e3f89 100644
--- a/pkg/reviewer/direct/provider_anthropic_test.go
+++ b/pkg/reviewer/direct/provider_anthropic_test.go
@@ -125,12 +125,16 @@ func TestAnthropicCompleteRetriesTransientFailures(t *testing.T) {
 		sse(sseOK),
 	)
 
-	resp, err := p.Complete(t.Context(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	var retries []string
+	resp, err := p.Complete(t.Context(), Request{
+		Messages: []Message{{Role: RoleUser, Text: "go"}},
+		OnRetry:  func(err error) { retries = append(retries, err.Error()) },
+	})
 	require.NoError(t, err)
 	require.Equal(t, "hi", resp.Text)
 	require.Equal(t, int32(4), calls.Load())
-	require.Len(t, resp.Retries, 3, "each retried failure is kept for the transcript")
-	require.Contains(t, resp.Retries[0], "api_error")
+	require.Len(t, retries, 3, "each retried failure is reported")
+	require.Contains(t, retries[0], "api_error")
 }
 
 func TestAnthropicCompleteGivesUpAfterRetryBudget(t *testing.T) {
diff --git a/pkg/reviewer/direct/provider_openai.go b/pkg/reviewer/direct/provider_openai.go
index a5d3b30..9a8c243 100644
--- a/pkg/reviewer/direct/provider_openai.go
+++ b/pkg/reviewer/direct/provider_openai.go
@@ -89,7 +89,7 @@ func (p *openaiProvider) Complete(ctx context.Context, req Request) (Response, e
 		creq.ReasoningEffort = req.Effort
 	}
 
-	resp, retried, err := withRetry(ctx, openaiRetry, func() (openai.ChatCompletionResponse, error) {
+	resp, err := withRetry(ctx, openaiRetry, req.OnRetry, func() (openai.ChatCompletionResponse, error) {
 		return p.client.CreateChatCompletion(ctx, creq)
 	})
 	if err != nil {
@@ -100,7 +100,7 @@ func (p *openaiProvider) Complete(ctx context.Context, req Request) (Response, e
 	}
 
 	ch := resp.Choices[0]
-	out := Response{Text: ch.Message.Content, StopReason: string(ch.FinishReason), Retries: retried}
+	out := Response{Text: ch.Message.Content, StopReason: string(ch.FinishReason)}
 	for _, tc := range ch.Message.ToolCalls {
 		out.ToolCalls = append(out.ToolCalls, ToolCall{
 			ID:   tc.ID,
diff --git a/pkg/reviewer/direct/provider_openai_test.go b/pkg/reviewer/direct/provider_openai_test.go
index 9ba5cb0..4e87f8f 100644
--- a/pkg/reviewer/direct/provider_openai_test.go
+++ b/pkg/reviewer/direct/provider_openai_test.go
@@ -118,26 +118,27 @@ func TestWithRetry(t *testing.T) {
 	ctx := context.Background()
 
 	fn, calls := fails(1, &openai.APIError{HTTPStatusCode: 503})
-	got, retried, err := withRetry(ctx, openaiRetry, fn)
+	var retried []string
+	got, err := withRetry(ctx, openaiRetry, func(err error) { retried = append(retried, err.Error()) }, fn)
 	require.NoError(t, err, "a transient error is retried")
 	require.Equal(t, "ok", got)
 	require.Equal(t, 2, *calls)
-	require.Len(t, retried, 1, "the retried failure is kept for the transcript")
+	require.Len(t, retried, 1, "the retried failure is reported")
 
 	fn, calls = fails(maxRetries+1, &openai.APIError{HTTPStatusCode: 429})
-	_, _, err = withRetry(ctx, openaiRetry, fn)
+	_, err = withRetry(ctx, openaiRetry, nil, fn)
 	require.ErrorContains(t, err, "openai:", "retries are bounded")
 	require.Equal(t, maxRetries+1, *calls)
 
 	fn, calls = fails(1, &openai.APIError{HTTPStatusCode: 400})
-	_, _, err = withRetry(ctx, openaiRetry, fn)
+	_, err = withRetry(ctx, openaiRetry, nil, fn)
 	require.Error(t, err, "a client error is not retried")
 	require.Equal(t, 1, *calls)
 
 	cancelled, cancel := context.WithCancel(ctx)
 	cancel()
 	fn, calls = fails(1, &openai.APIError{HTTPStatusCode: 503})
-	_, _, err = withRetry(cancelled, openaiRetry, fn)
+	_, err = withRetry(cancelled, openaiRetry, nil, fn)
 	require.ErrorContains(t, err, "openai:")
 	require.Equal(t, 1, *calls, "no retry after cancellation")
 }
diff --git a/pkg/reviewer/direct/provider_responses.go b/pkg/reviewer/direct/provider_responses.go
index 4505716..c768139 100644
--- a/pkg/reviewer/direct/provider_responses.go
+++ b/pkg/reviewer/direct/provider_responses.go
@@ -60,25 +60,24 @@ func (p *responsesProvider) Complete(ctx context.Context, req Request) (Response
 		rreq.Reasoning = &openai.ResponseReasoning{Effort: req.Effort}
 	}
 
-	resp, retried, err := withRetry(ctx, openaiRetry, func() (openai.CreateResponseResponse, error) {
-		return p.client.CreateResponse(ctx, rreq)
+	resp, err := withRetry(ctx, openaiRetry, req.OnRetry, func() (openai.CreateResponseResponse, error) {
+		resp, err := p.client.CreateResponse(ctx, rreq)
+		if err == nil && resp.Status == openai.ResponseStatusFailed {
+			// HTTP 200 with the failure in the body: classify and retry it like
+			// an API error.
+			err = newResponseFailedError(resp)
+		}
+		return resp, err
 	})
 	if err != nil {
 		return Response{}, err
 	}
-	if resp.Status == openai.ResponseStatusFailed {
-		if resp.Error != nil {
-			return Response{}, fmt.Errorf("openai: response %s failed: %s: %s", resp.ID, resp.Error.Code, resp.Error.Message)
-		}
-		return Response{}, fmt.Errorf("openai: response %s failed", resp.ID)
-	}
 
 	out, err := parseResponsesOutput(resp.Output)
 	if err != nil {
 		return Response{}, err
 	}
 	out.StopReason = responsesStopReason(resp, len(out.ToolCalls) > 0)
-	out.Retries = retried
 	// A cut-off response can end on a reasoning item with nothing after it,
 	// which the API rejects on replay: rebuild that turn from Text+ToolCalls.
 	if resp.Status != openai.ResponseStatusCompleted {
diff --git a/pkg/reviewer/direct/provider_responses_test.go b/pkg/reviewer/direct/provider_responses_test.go
index 3100e12..679ffd3 100644
--- a/pkg/reviewer/direct/provider_responses_test.go
+++ b/pkg/reviewer/direct/provider_responses_test.go
@@ -7,6 +7,9 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
+
+	"reviewsrv/pkg/reviewer"
 
 	"github.com/stretchr/testify/require"
 )
@@ -117,20 +120,45 @@ func TestResponsesProviderRebuildsWithoutRaw(t *testing.T) {
 }
 
 func TestResponsesProviderTruncatedAndFailed(t *testing.T) {
+	prev := openaiRetry.backoff
+	openaiRetry.backoff = time.Millisecond
+	t.Cleanup(func() { openaiRetry.backoff = prev })
+
+	completed := `{"id":"r3","object":"response","status":"completed","model":"gpt-6-sol","output":[
+		{"id":"msg_1","type":"message","role":"assistant","status":"completed","content":[{"type":"output_text","text":"done","annotations":[]}]}
+	],"usage":{"input_tokens":10,"output_tokens":1,"total_tokens":11}}`
 	srv, _ := fakeAPI(t, "/v1/responses",
 		// Cut off mid-reasoning: only a reasoning item, nothing after it.
 		`{"id":"r1","object":"response","status":"incomplete","incomplete_details":{"reason":"max_output_tokens"},"model":"gpt-6-sol",
 			"output":[{"id":"rs_1","type":"reasoning","summary":[],"encrypted_content":"ENC"}]}`,
+		// A failed reply with a server error is retried like an HTTP 5xx.
 		`{"id":"r2","object":"response","status":"failed","error":{"code":"server_error","message":"boom"},"model":"gpt-6-sol","output":[]}`,
+		completed,
+		// A definitive failure is not retried.
+		`{"id":"r4","object":"response","status":"failed","error":{"code":"invalid_prompt","message":"flagged"},"model":"gpt-6-sol","output":[]}`,
 	)
 	p, err := NewResponsesProvider(OpenAIConfig{APIKey: "k", BaseURL: srv.URL + "/v1", Model: "gpt-6-sol"})
 	require.NoError(t, err)
+	var retries []string
+	req := Request{
+		Messages: []Message{{Role: RoleUser, Text: "go"}},
+		OnRetry:  func(err error) { retries = append(retries, err.Error()) },
+	}
 
-	resp, err := p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
+	resp, err := p.Complete(context.Background(), req)
 	require.NoError(t, err)
 	require.True(t, IsTruncated(resp.StopReason))
 	require.Nil(t, resp.Raw, "a lone reasoning item must not be replayed")
 
-	_, err = p.Complete(context.Background(), Request{Messages: []Message{{Role: RoleUser, Text: "go"}}})
-	require.ErrorContains(t, err, "response r2 failed: server_error: boom")
+	resp, err = p.Complete(context.Background(), req)
+	require.NoError(t, err)
+	require.Equal(t, "done", resp.Text)
+	require.Len(t, retries, 1)
+	require.Contains(t, retries[0], "response r2 failed: server_error: boom")
+
+	retries = nil
+	_, err = p.Complete(context.Background(), req)
+	require.ErrorContains(t, err, "response r4 failed: invalid_prompt: flagged")
+	require.Empty(t, retries)
+	require.Equal(t, reviewer.RunReasonOther, providerReason(err))
 }
diff --git a/pkg/reviewer/direct/registry.go b/pkg/reviewer/direct/registry.go
index 0989073..58b1eb6 100644
--- a/pkg/reviewer/direct/registry.go
+++ b/pkg/reviewer/direct/registry.go
@@ -32,6 +32,7 @@ type Registry struct {
 	// allowed, when set, limits Dispatch to these tools; others fail with deniedMsg.
 	allowed   map[string]bool
 	deniedMsg string
+	denied    int // calls refused by the restriction so far
 }
 
 // NewRegistry returns an empty registry.
@@ -69,17 +70,28 @@ func (r *Registry) Defs() []ToolDef {
 func (r *Registry) Dispatch(ctx context.Context, name string, args json.RawMessage) (string, error) {
 	r.mu.Lock()
 	h, ok := r.handlers[name]
-	denied := r.allowed != nil && !r.allowed[name]
+	denied := ok && r.allowed != nil && !r.allowed[name]
+	deniedMsg := r.deniedMsg
+	if denied {
+		r.denied++
+	}
 	r.mu.Unlock()
 	switch {
 	case !ok:
 		return "", fmt.Errorf("unknown tool %q", name)
 	case denied:
-		return "", fmt.Errorf("%s: %s", name, r.deniedMsg)
+		return "", fmt.Errorf("%s: %s", name, deniedMsg)
 	}
 	return h(ctx, args)
 }
 
+// deniedCalls returns how many calls the restriction has refused so far.
+func (r *Registry) deniedCalls() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.denied
+}
+
 // restrict limits Dispatch to the allowed tools; any other call fails with
 // deniedMsg. Defs stay intact: changing the tool list would invalidate the
 // provider prompt cache for the whole conversation.
diff --git a/pkg/reviewer/direct/retry.go b/pkg/reviewer/direct/retry.go
index 2d99a39..0ec7ccb 100644
--- a/pkg/reviewer/direct/retry.go
+++ b/pkg/reviewer/direct/retry.go
@@ -30,22 +30,23 @@ var (
 
 // withRetry calls fn, retrying transient errors with exponential backoff up to
 // maxRetries times; a definitive error (bad request, auth, billing) fails at
-// once. The retried errors are returned for the transcript.
-func withRetry[T any](ctx context.Context, p retryPolicy, fn func() (T, error)) (T, []string, error) {
+// once. onRetry, when set, hears of each retried error before the wait.
+func withRetry[T any](ctx context.Context, p retryPolicy, onRetry func(error), fn func() (T, error)) (T, error) {
 	backoff := p.backoff
-	var retried []string
 	for attempt := 0; ; attempt++ {
 		resp, err := fn()
 		if err == nil {
-			return resp, retried, nil
+			return resp, nil
 		}
 		if attempt >= maxRetries || ctx.Err() != nil || !p.transient(err) {
-			return resp, retried, fmt.Errorf("%s: %w", p.name, err)
+			return resp, fmt.Errorf("%s: %w", p.name, err)
+		}
+		if onRetry != nil {
+			onRetry(err)
 		}
-		retried = append(retried, err.Error())
 		select {
 		case <-ctx.Done():
-			return resp, retried, fmt.Errorf("%s: %w (retrying after: %w)", p.name, ctx.Err(), err)
+			return resp, fmt.Errorf("%s: %w (retrying after: %w)", p.name, ctx.Err(), err)
 		case <-time.After(backoff):
 		}
 		backoff = min(backoff*2, maxRetryBackoff)
diff --git a/pkg/reviewer/direct/sink.go b/pkg/reviewer/direct/sink.go
index d9d3324..27561e7 100644
--- a/pkg/reviewer/direct/sink.go
+++ b/pkg/reviewer/direct/sink.go
@@ -30,6 +30,7 @@ type Event struct {
 	CostUsd    float64         `json:"costUsd,omitempty"`
 	Submitted  bool            `json:"submitted,omitempty"`
 	Model      string          `json:"model,omitempty"`
+	DurationMs int             `json:"durationMs,omitempty"` // a round's provider call
 }
 
 // Sink receives transcript events. A nil Sink is a no-op.
diff --git a/pkg/reviewer/direct/tools_fs.go b/pkg/reviewer/direct/tools_fs.go
index bc9491a..1a86a3c 100644
--- a/pkg/reviewer/direct/tools_fs.go
+++ b/pkg/reviewer/direct/tools_fs.go
@@ -13,7 +13,6 @@ import (
 	"sort"
 	"strings"
 	"sync"
-	"unicode/utf8"
 
 	"reviewsrv/pkg/reviewer"
 )
@@ -445,11 +444,7 @@ func grepLines(rel string, data []byte, re *regexp.Regexp, out *[]string) error
 		if re.MatchString(line) {
 			text := strings.TrimSpace(line)
 			if len(text) > grepLineClip {
-				n := grepLineClip
-				for n > 0 && !utf8.RuneStart(text[n]) { // don't split a rune mid-sequence
-					n--
-				}
-				text = text[:n] + "…"
+				text = reviewer.ClipUTF8(text, grepLineClip) + "…"
 			}
 			*out = append(*out, fmt.Sprintf("%s:%d:%s", rel, i+1, text))
 			if len(*out) >= maxGrepMatches {
diff --git a/pkg/reviewer/direct/types.go b/pkg/reviewer/direct/types.go
index e3fe816..49f2f55 100644
--- a/pkg/reviewer/direct/types.go
+++ b/pkg/reviewer/direct/types.go
@@ -73,6 +73,11 @@ type Request struct {
 	Messages []Message
 	Tools    []ToolDef
 	Effort   string
+
+	// OnRetry, when set, is told of each transient failure the provider retries,
+	// as it happens. The failed attempts' partial usage is billed by the
+	// provider but not counted in Response.Usage.
+	OnRetry func(err error)
 }
 
 // Response is the model's reply for one round.
@@ -86,11 +91,6 @@ type Response struct {
 	// copies it into the assistant Message it appends so the next request can
 	// replay it verbatim, preserving signed thinking / encrypted reasoning.
 	Raw any
-
-	// Retries holds the errors of transient failures the provider retried
-	// before this response, recorded in the transcript. Their partial usage is
-	// billed by the provider but not counted in Usage.
-	Retries []string
 }
 
 // SplitInput builds a Usage from OpenAI-style counters, where input includes the
diff --git a/pkg/reviewer/direct/util.go b/pkg/reviewer/direct/util.go
index 1c327a5..eaf2406 100644
--- a/pkg/reviewer/direct/util.go
+++ b/pkg/reviewer/direct/util.go
@@ -1,6 +1,10 @@
 package direct
 
-import "fmt"
+import (
+	"fmt"
+
+	"reviewsrv/pkg/reviewer"
+)
 
 const defaultClip = 100_000
 
@@ -30,7 +34,8 @@ func clipN(s string, n int) string {
 	if len(s) <= n {
 		return s
 	}
-	return s[:n] + fmt.Sprintf("\n... [truncated %d bytes]", len(s)-n)
+	c := reviewer.ClipUTF8(s, n)
+	return c + fmt.Sprintf("\n... [truncated %d bytes]", len(s)-len(c))
 }
 
 // objSchema builds a JSON Schema object with the given properties and required
diff --git a/pkg/reviewer/fixmd_test.go b/pkg/reviewer/fixmd_test.go
index 430ba53..adbce19 100644
--- a/pkg/reviewer/fixmd_test.go
+++ b/pkg/reviewer/fixmd_test.go
@@ -10,8 +10,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func strPtr(s string) *string { return &s }
-
 func TestBuildFixMarkdown_HappyPath(t *testing.T) {
 	rv := &Review{Review: db.Review{
 		Title:        "MR 42",
@@ -29,11 +27,11 @@ func TestBuildFixMarkdown_HappyPath(t *testing.T) {
 			File:         "pkg/foo.go",
 			Lines:        "10-20",
 			IssueType:    "error-handling",
-			LocalID:      strPtr("C1"),
+			LocalID:      new("C1"),
 			Description:  "do the thing",
 			Content:      "some content",
-			SuggestedFix: strPtr("apply fix"),
-			Comment:      strPtr("user agrees"),
+			SuggestedFix: new("apply fix"),
+			Comment:      new("user agrees"),
 			ReviewFile:   &db.ReviewFile{ReviewType: "code"},
 		},
 	}}
@@ -159,7 +157,7 @@ func TestBuildFixMarkdown_SkipsWhitespaceOnlyComment(t *testing.T) {
 			Severity: "low",
 			Title:    "x",
 			File:     "x.go",
-			Comment:  strPtr("   \n\t  "),
+			Comment:  new("   \n\t  "),
 		},
 	}}
 
diff --git a/pkg/reviewer/init_test.go b/pkg/reviewer/init_test.go
index 97e315c..d053343 100644
--- a/pkg/reviewer/init_test.go
+++ b/pkg/reviewer/init_test.go
@@ -28,7 +28,7 @@ func TestDBLoad(t *testing.T) {
 
 	t1, _ := test.TaskTracker(t, dbc, &db.TaskTracker{
 		Title:     "Ютека YouTrack",
-		AuthToken: Ptr("xxx"),
+		AuthToken: new("xxx"),
 		FetchPrompt: `Как получить текст задачи? Номер задачи есть в коммите. Пример номера PLF-731. Как получить по нему информацию.
 curl -X GET "https://youtrack/api/issues/PLF-731?fields=\$type,id,summary,description,comments" -H 'Accept: application/json' -H 'Authorization: Bearer {{TOKEN}}' -H 'Cache-Control: no-cache' -H 'Content-Type: application/json'
 Ты можешь получить до 10 связанных задач (родительских или в тексте, если нужно больше контекста) по API.`,
@@ -43,7 +43,7 @@ curl -X GET "https://youtrack/api/issues/PLF-731?fields=\$type,id,summary,descri
 		Language:      "go",
 		ProjectKey:    "93b90214-3b5d-4fa6-b497-f064ff7bf8a9",
 		PromptID:      p1.ID,
-		TaskTrackerID: Ptr(t1.ID),
+		TaskTrackerID: new(t1.ID),
 		StatusID:      db.StatusEnabled,
 	})
 
diff --git a/pkg/reviewer/instructions_md_test.go b/pkg/reviewer/instructions_md_test.go
index f203d7e..8ec8c3f 100644
--- a/pkg/reviewer/instructions_md_test.go
+++ b/pkg/reviewer/instructions_md_test.go
@@ -33,7 +33,7 @@ func TestBuildInstructionsMarkdown_HappyPath(t *testing.T) {
 			File:        "pkg/bar.go",
 			Lines:       "42",
 			Description: "use snake_case",
-			Comment:     strPtr("project style"),
+			Comment:     new("project style"),
 			ReviewFile:  &db.ReviewFile{ReviewType: ReviewTypeCode},
 		}},
 		{Issue: db.Issue{
diff --git a/pkg/reviewer/project_test.go b/pkg/reviewer/project_test.go
index 855bca6..0b91199 100644
--- a/pkg/reviewer/project_test.go
+++ b/pkg/reviewer/project_test.go
@@ -88,7 +88,7 @@ func TestDBProjectManager_ReviewProfiles(t *testing.T) {
 	// goes away earlier — subtest cleanups run before this outer-test cleanup.
 	mk := func(title, rn string, status int) *db.RunnerProfile {
 		rp, _ := test.RunnerProfile(t, dbc, &db.RunnerProfile{
-			Title: title, Runner: rn, Token: Ptr("tok-" + title), StatusID: status,
+			Title: title, Runner: rn, Token: new("tok-" + title), StatusID: status,
 		})
 		t.Cleanup(func() {
 			_, _ = dbc.ModelContext(context.Background(), &db.RunnerProfile{ID: rp.ID}).WherePK().Delete()
@@ -103,9 +103,9 @@ func TestDBProjectManager_ReviewProfiles(t *testing.T) {
 		judge := mk("judge", "claude", db.StatusEnabled)
 
 		pr, cl := test.Project(t, dbc, &db.Project{
-			RunnerProfileID:      Ptr(primary.ID),
+			RunnerProfileID:      new(primary.ID),
 			RunnerProfileIDs:     db.ProjectRunnerProfileIDs{m1.ID, m2.ID},
-			JudgeRunnerProfileID: Ptr(judge.ID),
+			JudgeRunnerProfileID: new(judge.ID),
 			StatusID:             db.StatusEnabled,
 		}, test.WithProjectRelations, test.WithFakeProject)
 		t.Cleanup(cl)
@@ -126,7 +126,7 @@ func TestDBProjectManager_ReviewProfiles(t *testing.T) {
 	t.Run("no judge → judge nil, no panel (single review)", func(t *testing.T) {
 		primary := mk("primarySingle", "claude", db.StatusEnabled)
 		pr, cl := test.Project(t, dbc, &db.Project{
-			RunnerProfileID: Ptr(primary.ID),
+			RunnerProfileID: new(primary.ID),
 			StatusID:        db.StatusEnabled,
 		}, test.WithProjectRelations, test.WithFakeProject)
 		t.Cleanup(cl)
@@ -145,7 +145,7 @@ func TestDBProjectManager_ReviewProfiles(t *testing.T) {
 		disabled := mk("disabled", "claude", db.StatusDisabled)
 
 		pr, cl := test.Project(t, dbc, &db.Project{
-			RunnerProfileID:  Ptr(primary.ID),
+			RunnerProfileID:  new(primary.ID),
 			RunnerProfileIDs: db.ProjectRunnerProfileIDs{disabled.ID, live.ID},
 			StatusID:         db.StatusEnabled,
 		}, test.WithProjectRelations, test.WithFakeProject)
@@ -207,7 +207,7 @@ func TestDBProjectManager_Prompt(t *testing.T) {
 
 		tt, clTT := test.TaskTracker(t, dbc, &db.TaskTracker{
 			Title:       "TestTracker",
-			AuthToken:   Ptr("secret-token-123"),
+			AuthToken:   new("secret-token-123"),
 			FetchPrompt: "curl -H 'Bearer {{TOKEN}}' https://api/issues",
 			StatusID:    db.StatusEnabled,
 		})
@@ -215,7 +215,7 @@ func TestDBProjectManager_Prompt(t *testing.T) {
 
 		pr, clPr := test.Project(t, dbc, &db.Project{
 			PromptID:      prompt.ID,
-			TaskTrackerID: Ptr(tt.ID),
+			TaskTrackerID: new(tt.ID),
 			StatusID:      db.StatusEnabled,
 		}, test.WithProjectRelations, test.WithFakeProject)
 		t.Cleanup(clPr)
@@ -249,7 +249,7 @@ func TestDBProjectManager_Prompt(t *testing.T) {
 		tt, clTT := test.TaskTracker(t, dbc, &db.TaskTracker{
 			Title:       "URLTracker",
 			URL:         "https://youtrack.example.com",
-			AuthToken:   Ptr("token-456"),
+			AuthToken:   new("token-456"),
 			FetchPrompt: "curl -X GET \"{{URL}}/api/issues/PLF-731\" -H 'Authorization: Bearer {{TOKEN}}'",
 			StatusID:    db.StatusEnabled,
 		})
@@ -257,7 +257,7 @@ func TestDBProjectManager_Prompt(t *testing.T) {
 
 		pr, clPr := test.Project(t, dbc, &db.Project{
 			PromptID:      prompt.ID,
-			TaskTrackerID: Ptr(tt.ID),
+			TaskTrackerID: new(tt.ID),
 			StatusID:      db.StatusEnabled,
 		}, test.WithProjectRelations, test.WithFakeProject)
 		t.Cleanup(clPr)
diff --git a/pkg/reviewer/run_metrics.go b/pkg/reviewer/run_metrics.go
index 62f46a9..55080a7 100644
--- a/pkg/reviewer/run_metrics.go
+++ b/pkg/reviewer/run_metrics.go
@@ -9,6 +9,11 @@ const (
 	metricOtherRunner    = "other"
 )
 
+// maxRunCostUsd bounds a plausible run cost (a 500-round Opus run stays well
+// below it): a higher client-reported value is not added to the cost counter,
+// which only ever grows.
+const maxRunCostUsd = 1000
+
 // RunMetrics counts reviewctl runs on reviewsrv by outcome: an ok run when its
 // review is uploaded, any other run when its debug bundle arrives. A nil
 // *RunMetrics is a no-op.
@@ -56,7 +61,7 @@ func (m *RunMetrics) Observe(project, runner, status, reason string, costUsd flo
 		runner = metricOtherRunner
 	}
 	m.runs.WithLabelValues(project, runner, status, reason).Inc()
-	if costUsd > 0 {
+	if costUsd > 0 && costUsd <= maxRunCostUsd {
 		m.cost.WithLabelValues(project, runner, status).Add(costUsd)
 	}
 }
diff --git a/pkg/reviewer/run_metrics_test.go b/pkg/reviewer/run_metrics_test.go
index e99468c..ee9c02d 100644
--- a/pkg/reviewer/run_metrics_test.go
+++ b/pkg/reviewer/run_metrics_test.go
@@ -23,8 +23,9 @@ func TestRunMetricsObserve(t *testing.T) {
 	m.Observe("demo", "direct", RunStatusFailed, RunReasonMaxRounds, 7.9)
 	m.Observe("demo", "direct", RunStatusFailed, RunReasonMaxRounds, 10.7)
 	m.Observe("", "rm -rf /", RunStatusFailed, RunReasonOther, 0)
+	m.Observe("demo", "direct", RunStatusFailed, RunReasonMaxRounds, 1e9) // implausible: counted, cost dropped
 
-	assert.InDelta(t, 2, counterValue(t, m.runs.WithLabelValues("demo", "direct", RunStatusFailed, RunReasonMaxRounds)), 0)
+	assert.InDelta(t, 3, counterValue(t, m.runs.WithLabelValues("demo", "direct", RunStatusFailed, RunReasonMaxRounds)), 0)
 	assert.InDelta(t, 18.6, counterValue(t, m.cost.WithLabelValues("demo", "direct", RunStatusFailed)), 1e-9)
 	// Unknown projects and runners collapse into fixed label values.
 	assert.InDelta(t, 1, counterValue(t, m.runs.WithLabelValues(metricUnknownProject, metricOtherRunner, RunStatusFailed, RunReasonOther)), 0)
diff --git a/pkg/reviewer/runner/claude.go b/pkg/reviewer/runner/claude.go
index 40374c8..5a3a2b7 100644
--- a/pkg/reviewer/runner/claude.go
+++ b/pkg/reviewer/runner/claude.go
@@ -8,9 +8,11 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"maps"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -329,11 +331,20 @@ func (r *ExecClaudeRunner) buildArgs() []string {
 	return args
 }
 
+// claudeIsolationEnv keeps the developer's auto-memory out of a review: Claude
+// Code loads it per project, and a panel worktree resolves to the main repo, so
+// a local review would read (and could quote) personal notes that CI never has.
+// --setting-sources does not cover it. The operator's env wins, as in credEnv.
+func claudeIsolationEnv() []string {
+	return credEnv("CLAUDE_CODE_DISABLE_AUTO_MEMORY", "1")
+}
+
 // Run executes claude --print --output-format stream-json and parses the result.
 func (r *ExecClaudeRunner) Run(ctx context.Context, prompt string) (*ClaudeResult, error) {
 	args := r.buildArgs()
 	// Surface tool calls live as claude streams its NDJSON events.
 	env := append(credEnv(envAnthropicAPIKey, r.Token), credEnv(envTrackerToken, r.TrackerToken)...)
+	env = append(env, claudeIsolationEnv()...)
 	out := runExec(ctx, r.Log, RunnerClaude, r.Dir, args, prompt, env, func(line []byte) { r.logEvent(ctx, line) })
 
 	r.saveOutput(ctx, out.stdout.Bytes())
@@ -434,7 +445,8 @@ func (r *ExecClaudeRunner) logResult(ctx context.Context, cr *ClaudeResult) {
 		"cacheCreate5m", cr.Usage.CacheCreation.Ephemeral5mInputTokens,
 		"webFetch", cr.Usage.ServerToolUse.WebFetchRequests,
 		"webSearch", cr.Usage.ServerToolUse.WebSearchRequests,
-		"models", len(cr.ModelUsage),
+		// The resolved ids: a CLI alias (-m opus) says nothing about the model.
+		"models", strings.Join(slices.Sorted(maps.Keys(cr.ModelUsage)), ","),
 		"stopReason", cr.StopReason,
 	)
 
@@ -472,17 +484,19 @@ func (r *ExecClaudeRunner) handleClaudeError(err error, stdout []byte, stderr st
 	return cr, claudeRunError(err, cr, stdout, stderr)
 }
 
+// truncate cuts s to at most maxLen bytes, on a rune boundary, and marks the cut.
 func truncate(s string, maxLen int) string {
 	if len(s) <= maxLen {
 		return s
 	}
-	return s[:maxLen] + "..."
+	return reviewer.ClipUTF8(s, maxLen) + "..."
 }
 
 type runOutput struct {
-	stdout bytes.Buffer
-	stderr bytes.Buffer
-	err    error
+	stdout  bytes.Buffer
+	stderr  bytes.Buffer
+	err     error
+	elapsed time.Duration // wall-clock time of the subprocess
 }
 
 // lineWriter is an io.Writer that splits the bytes written to it on '\n' and
@@ -548,8 +562,9 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	cmd := exec.CommandContext(ctx, binary, args...)
 	cmd.Dir = dir
 	cmd.Stdin = strings.NewReader(prompt)
-	// credEnv only injects a var absent from the ambient env, so there is never a
-	// duplicate key to resolve here; nil extraEnv leaves cmd.Env nil = inherit.
+	// extraEnv comes last: for a key also in the ambient env (a merged
+	// OPENCODE_CONFIG_CONTENT) os/exec keeps the last value. nil extraEnv leaves
+	// cmd.Env nil = inherit.
 	if len(extraEnv) > 0 {
 		cmd.Env = append(os.Environ(), extraEnv...)
 	}
@@ -566,7 +581,9 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 
 	log.InfoContext(ctx, "running "+binary, "dir", dir, "promptLen", len(prompt), "args", args)
 
+	start := time.Now()
 	out.err = cmd.Run()
+	out.elapsed = time.Since(start)
 	// Killed by the context (runnerTimeout, the caller's deadline or a cancelled
 	// job): keep the cause in the chain so a timeout/cancel is not reported as a
 	// crash ("signal: killed").
@@ -582,7 +599,8 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 		lw.flush() // emit a trailing line without a newline
 	}
 
-	log.InfoContext(ctx, binary+" finished", "exitErr", out.err, "stdoutLen", out.stdout.Len(), "stderrLen", out.stderr.Len())
+	log.InfoContext(ctx, binary+" finished", "duration", out.elapsed.Round(time.Second), "exitErr", out.err,
+		"stdoutLen", out.stdout.Len(), "stderrLen", out.stderr.Len())
 
 	if log.Enabled(ctx, slog.LevelDebug) {
 		if out.stderr.Len() > 0 {
diff --git a/pkg/reviewer/runner/codex.go b/pkg/reviewer/runner/codex.go
index 160e7c9..67461c1 100644
--- a/pkg/reviewer/runner/codex.go
+++ b/pkg/reviewer/runner/codex.go
@@ -122,6 +122,8 @@ func (r *ExecCodexRunner) Run(ctx context.Context, prompt string) (*ClaudeResult
 	}
 
 	cr := r.result(parseCodexStream(out.stdout.Bytes()))
+	// codex events report no duration: take the subprocess wall-clock time.
+	cr.DurationMs = int(out.elapsed.Milliseconds())
 	// codex can report a structured failure with a zero exit code; conversely a
 	// non-zero exit without a structured error is still a failure.
 	if out.err != nil {
@@ -180,12 +182,17 @@ func (r *ExecCodexRunner) logEvent(ctx context.Context, line []byte) {
 	case "turn.completed":
 		var ev struct {
 			Usage struct {
-				InputTokens  int `json:"input_tokens"`
-				OutputTokens int `json:"output_tokens"`
+				InputTokens       int `json:"input_tokens"`
+				CachedInputTokens int `json:"cached_input_tokens"`
+				OutputTokens      int `json:"output_tokens"`
 			} `json:"usage"`
 		}
 		if json.Unmarshal(line, &ev) == nil {
-			r.Log.InfoContext(ctx, "codex turn", "inputTokens", ev.Usage.InputTokens, "outputTokens", ev.Usage.OutputTokens)
+			// codex's input_tokens include the cached ones: split them like the
+			// result line does (inputTokens = fresh).
+			u := ev.Usage
+			r.Log.InfoContext(ctx, "codex turn", "inputTokens", max(u.InputTokens-u.CachedInputTokens, 0),
+				"outputTokens", u.OutputTokens, "cacheRead", u.CachedInputTokens)
 		}
 	case "error", "turn.failed":
 		r.Log.WarnContext(ctx, "codex stream error", "event", truncate(string(line), 300))
@@ -194,6 +201,8 @@ func (r *ExecCodexRunner) logEvent(ctx context.Context, line []byte) {
 
 func (r *ExecCodexRunner) logResult(ctx context.Context, cr *ClaudeResult) {
 	r.Log.InfoContext(ctx, "codex result parsed",
+		"model", r.Model,
+		"duration", (time.Duration(cr.DurationMs) * time.Millisecond).Round(time.Second),
 		"cost", cr.TotalCostUSD,
 		"turns", cr.NumTurns,
 		"inputTokens", cr.Usage.InputTokens,
diff --git a/pkg/reviewer/runner/direct.go b/pkg/reviewer/runner/direct.go
index 1290acd..aa23e8b 100644
--- a/pkg/reviewer/runner/direct.go
+++ b/pkg/reviewer/runner/direct.go
@@ -184,9 +184,10 @@ func (r *DirectRunner) attachSessionLog(ctx context.Context, opts *direct.Option
 	return closeFn
 }
 
-// logEvent surfaces a significant direct-loop event to the runner log (tool calls
-// live, tool errors at warn, per-round token usage at debug). The full transcript
-// still goes to direct-output.jsonl.
+// logEvent surfaces a significant direct-loop event to the runner log: tool
+// calls and per-round timing and usage live, harness notices, and tool errors
+// and provider retries at warn. The full transcript still goes to
+// direct-output.jsonl.
 func (r *DirectRunner) logEvent(ctx context.Context, ev direct.Event) {
 	if r.Log == nil {
 		return
@@ -209,10 +210,19 @@ func (r *DirectRunner) logEvent(ctx context.Context, ev direct.Event) {
 			r.Log.WarnContext(ctx, "direct output truncated by token limit", "round", ev.Round, "stopReason", ev.StopReason)
 		}
 		if ev.Usage != nil {
-			r.Log.DebugContext(ctx, "direct round", "round", ev.Round,
+			// At info: a heavy round (long thinking) otherwise leaves minutes of
+			// silence in the CI log.
+			r.Log.InfoContext(ctx, "direct round", "round", ev.Round,
+				"duration", (time.Duration(ev.DurationMs) * time.Millisecond).Round(100*time.Millisecond),
 				"inputTokens", ev.Usage.InputTokens, "outputTokens", ev.Usage.OutputTokens,
 				"cacheRead", ev.Usage.CacheReadTokens, "cacheWrite", ev.Usage.CacheWriteTokens)
 		}
+	case "retry":
+		r.Log.WarnContext(ctx, "direct provider call retried", "round", ev.Round, "err", truncate(ev.Text, 300))
+	case "notice":
+		r.Log.InfoContext(ctx, "direct notice", "round", ev.Round, "notice", truncate(ev.Text, 200))
+	case "compact":
+		r.Log.InfoContext(ctx, "direct history compacted", "round", ev.Round, "detail", ev.Text)
 	}
 }
 
diff --git a/pkg/reviewer/runner/env_test.go b/pkg/reviewer/runner/env_test.go
index f2f5521..8370603 100644
--- a/pkg/reviewer/runner/env_test.go
+++ b/pkg/reviewer/runner/env_test.go
@@ -24,3 +24,11 @@ func TestCredEnv(t *testing.T) {
 		assert.Nil(t, credEnv(v, "tok"), "an already-set env var is not overridden")
 	})
 }
+
+func TestClaudeIsolationEnv(t *testing.T) {
+	t.Setenv("CLAUDE_CODE_DISABLE_AUTO_MEMORY", "")
+	assert.Equal(t, []string{"CLAUDE_CODE_DISABLE_AUTO_MEMORY=1"}, claudeIsolationEnv())
+
+	t.Setenv("CLAUDE_CODE_DISABLE_AUTO_MEMORY", "0")
+	assert.Nil(t, claudeIsolationEnv(), "the operator's env wins")
+}
diff --git a/pkg/reviewer/runner/opencode.go b/pkg/reviewer/runner/opencode.go
index 0b4bd48..67bc282 100644
--- a/pkg/reviewer/runner/opencode.go
+++ b/pkg/reviewer/runner/opencode.go
@@ -269,13 +269,29 @@ func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string) strin
 }
 
 // opencodeIsolationEnv keeps opencode on the operator's own config. Project
-// config (the legacy loader, plus AGENTS.md auto-loading) is off. Formatters
-// and LSP servers are off too, even if the operator's config enables them:
-// prettier and eslint run the repo's JS configs, rust-analyzer its build.rs.
-// Each var is only a default, like credEnv: the operator's env wins.
+// config (the legacy loader, plus AGENTS.md auto-loading) is off unless the
+// operator's env says otherwise. Formatters and LSP servers are forced off even
+// then — prettier and eslint run the repo's JS configs, rust-analyzer its
+// build.rs — by merging into the operator's inline config.
 func opencodeIsolationEnv() []string {
-	return append(credEnv("OPENCODE_DISABLE_PROJECT_CONFIG", "1"),
-		credEnv("OPENCODE_CONFIG_CONTENT", `{"formatter":false,"lsp":false}`)...)
+	env := credEnv("OPENCODE_DISABLE_PROJECT_CONFIG", "1")
+	if content, ok := opencodeConfigContent(os.Getenv("OPENCODE_CONFIG_CONTENT")); ok {
+		env = append(env, "OPENCODE_CONFIG_CONTENT="+content)
+	}
+	return env
+}
+
+// opencodeConfigContent returns the operator's inline opencode config with
+// formatters and LSP off. A value that is not a JSON object (JSONC with
+// comments) cannot be merged and is left alone: ok is false.
+func opencodeConfigContent(operator string) (string, bool) {
+	cfg := map[string]any{}
+	if operator != "" && json.Unmarshal([]byte(operator), &cfg) != nil {
+		return "", false
+	}
+	cfg["formatter"], cfg["lsp"] = false, false
+	b, err := json.Marshal(cfg)
+	return string(b), err == nil
 }
 
 // findOpenCodeProjectConfig returns the first opencodeProjectConfig entry found
diff --git a/pkg/reviewer/runner/opencode_test.go b/pkg/reviewer/runner/opencode_test.go
index 78898f4..d024b0b 100644
--- a/pkg/reviewer/runner/opencode_test.go
+++ b/pkg/reviewer/runner/opencode_test.go
@@ -156,6 +156,12 @@ func TestOpenCodeIsolationEnv(t *testing.T) {
 		`OPENCODE_CONFIG_CONTENT={"formatter":false,"lsp":false}`,
 	}, opencodeIsolationEnv())
 
-	t.Setenv("OPENCODE_CONFIG_CONTENT", `{"share":"disabled"}`)
-	assert.Equal(t, []string{"OPENCODE_DISABLE_PROJECT_CONFIG=1"}, opencodeIsolationEnv(), "the operator's env wins")
+	t.Setenv("OPENCODE_DISABLE_PROJECT_CONFIG", "0")
+	t.Setenv("OPENCODE_CONFIG_CONTENT", `{"share":"disabled","lsp":true}`)
+	assert.Equal(t, []string{
+		`OPENCODE_CONFIG_CONTENT={"formatter":false,"lsp":false,"share":"disabled"}`,
+	}, opencodeIsolationEnv(), "the operator's config is kept, formatter and lsp forced off")
+
+	t.Setenv("OPENCODE_CONFIG_CONTENT", "{ // jsonc\n}")
+	assert.Empty(t, opencodeIsolationEnv(), "an unparsable operator config is left alone")
 }
diff --git a/pkg/vt/runner_profile.go b/pkg/vt/runner_profile.go
index d6f4b4b..baab39a 100644
--- a/pkg/vt/runner_profile.go
+++ b/pkg/vt/runner_profile.go
@@ -224,7 +224,7 @@ func (s RunnerProfileService) isValid(ctx context.Context, runnerProfile RunnerP
 	if runnerProfile.Effort != nil && *runnerProfile.Effort != "" && !validEfforts[*runnerProfile.Effort] {
 		v.Append("effort", FieldErrorIncorrect)
 	}
-	if n := runnerProfile.Params.MaxRounds; n != 0 && !direct.IsValidMaxRounds(n) {
+	if !direct.IsValidMaxRounds(runnerProfile.Params.MaxRounds) {
 		v.Append("params.maxRounds", FieldErrorIncorrect)
 	}
 
diff --git a/pkg/vt/runner_profile_test.go b/pkg/vt/runner_profile_test.go
index fc4f64d..f3d73e8 100644
--- a/pkg/vt/runner_profile_test.go
+++ b/pkg/vt/runner_profile_test.go
@@ -5,6 +5,7 @@ import (
 
 	"reviewsrv/pkg/db"
 	"reviewsrv/pkg/db/test"
+	"reviewsrv/pkg/reviewer/direct"
 	"reviewsrv/pkg/reviewer/runner"
 
 	"github.com/stretchr/testify/assert"
@@ -110,4 +111,15 @@ func TestDB_RunnerProfileService(t *testing.T) {
 		ok := add(RunnerProfile{Title: "rp-openai", Runner: runner.RunnerDirect, APIProvider: sp("openai")})
 		assert.NotZero(t, ok.ID)
 	})
+
+	t.Run("params.maxRounds bounds match direct.IsValidMaxRounds", func(t *testing.T) {
+		for _, n := range []int{direct.MinMaxRounds - 1, direct.MaxMaxRounds + 1} {
+			_, err := srv.Add(ctx, RunnerProfile{Title: "rp-rounds", Runner: runner.RunnerDirect, Params: RunnerProfileParams{MaxRounds: n}, StatusID: db.StatusEnabled})
+			require.Error(t, err, "maxRounds %d must be rejected", n)
+		}
+		for _, n := range []int{0, direct.MinMaxRounds, direct.MaxMaxRounds} {
+			ok := add(RunnerProfile{Title: "rp-rounds", Runner: runner.RunnerDirect, Params: RunnerProfileParams{MaxRounds: n}})
+			assert.Equal(t, n, ok.Params.MaxRounds, "0 = the default")
+		}
+	})
 }
diff --git a/pkg/vt/validator.go b/pkg/vt/validator.go
index 1f562e4..f27cb11 100644
--- a/pkg/vt/validator.go
+++ b/pkg/vt/validator.go
@@ -158,7 +158,7 @@ func (v *Validator) Error() error {
 	return nil
 }
 
-func (v *Validator) CheckBasic(ctx context.Context, item interface{}) {
+func (v *Validator) CheckBasic(ctx context.Context, item any) {
 	v.SetInternalError(nil)
 	err := validate.StructCtx(ctx, item)
 	if err == nil {

From 4ee3d58ea257b3850e32399ed8f71556e579e543 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 18:34:10 +0300
Subject: [PATCH 5/7] Harden subprocess env and classify CLI failures

- Strip reviewctl and GitLab CI secrets from the env of runner CLIs
  and git, and run git on the checkout without hooks or fsmonitor
- Classify codex/opencode failures from their error text (billing,
  auth, rate limit); billing wording now wins over the HTTP status
- Retry OpenAI transport errors, classify undecodable error bodies
  by HTTP status
- Fix double-counted run metrics when the review was created before
  an md upload failed: the debug bundle now carries the review id
- Ship a debug bundle for a panel's own failure under the "panel"
  runner label
- Apply the profile's maxRounds unless --max-rounds or
  REVIEW_MAX_ROUNDS is set; let a second signal end reviewctl
- Serve debug artifacts only as JSON or sandboxed plain text, mask
  the project key in logs and errors, 503 on a failed project lookup
- Warn when OPENCODE_CONFIG_CONTENT can't be merged
- Skip gateway profiles (own apiBaseURL) in the retired-models patch
- Update reviewctl docs for stream-json and the RPC config flow
---
 .gitignore                                    |  1 +
 README.md                                     |  2 +-
 cmd/reviewctl/README.md                       |  2 +-
 cmd/reviewctl/main.go                         | 69 +++++++------
 cmd/reviewctl/main_test.go                    | 43 ++++++++
 docs/llm/reviewctl.md                         | 25 ++---
 docs/patches/2026-09-23-retired-models.sql    |  7 +-
 pkg/app/app.go                                |  3 +-
 pkg/debug/handler.go                          | 60 ++++++++----
 pkg/debug/handler_test.go                     | 81 ++++++++++++++--
 pkg/debug/storage.go                          |  1 +
 pkg/debug/templates/bundle.html               |  3 +-
 pkg/rest/rest_test.go                         | 61 ++++++++++++
 pkg/reviewer/ctl/ctl.go                       | 18 ++--
 pkg/reviewer/ctl/ctl_test.go                  | 97 +++++++++++++++----
 pkg/reviewer/ctl/panel.go                     | 55 +++++++----
 pkg/reviewer/ctl/panel_test.go                | 66 ++++++++++++-
 pkg/reviewer/ctl/upload.go                    | 27 +++++-
 pkg/reviewer/ctl/upload_test.go               |  7 ++
 pkg/reviewer/direct/errors.go                 | 80 ++++++++-------
 .../direct/provider_anthropic_test.go         |  4 -
 pkg/reviewer/direct/provider_openai_test.go   | 26 ++++-
 pkg/reviewer/direct/tools_git.go              |  5 +-
 pkg/reviewer/project.go                       |  8 ++
 pkg/reviewer/run_metrics.go                   |  4 +
 pkg/reviewer/run_outcome.go                   | 60 +++++++++++-
 pkg/reviewer/run_outcome_test.go              | 30 ++++++
 pkg/reviewer/runner/claude.go                 | 17 ++--
 pkg/reviewer/runner/claude_failure.go         | 20 +++-
 pkg/reviewer/runner/claude_failure_test.go    |  2 +
 pkg/reviewer/runner/cli_failure_test.go       | 69 +++++++++++++
 pkg/reviewer/runner/codex.go                  | 17 +++-
 pkg/reviewer/runner/env_test.go               | 13 +++
 pkg/reviewer/runner/opencode.go               | 45 ++++++---
 pkg/reviewer/runner/opencode_test.go          | 16 ++-
 pkg/reviewer/subprocess.go                    | 39 ++++++++
 pkg/reviewer/subprocess_test.go               | 28 ++++++
 37 files changed, 902 insertions(+), 209 deletions(-)
 create mode 100644 pkg/reviewer/runner/cli_failure_test.go
 create mode 100644 pkg/reviewer/subprocess.go
 create mode 100644 pkg/reviewer/subprocess_test.go

diff --git a/.gitignore b/.gitignore
index 8fb0eae..b162def 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ tsconfig.tsbuildinfo
 docs/patches/pgmigrator.toml
 frontend/dist/
 frontend/dist-vt/
+/reviewctl
 
 # local-only planning docs (kept on disk, never committed)
 docs/llm/DirectAPIRunner.md
diff --git a/README.md b/README.md
index 949bccc..cb027ec 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ GitLab CI (merge request)
 
 - Go 1.26+
 - PostgreSQL
-- Node.js 20+ (for frontend build)
+- Node.js 22.12+ (for frontend build; `frontend/.nvmrc` pins 24)
 
 ## Quick Start
 
diff --git a/cmd/reviewctl/README.md b/cmd/reviewctl/README.md
index 7585683..1334dec 100644
--- a/cmd/reviewctl/README.md
+++ b/cmd/reviewctl/README.md
@@ -53,7 +53,7 @@ Most flags have an environment-variable default for CI.
 | `--effort` | `$REVIEW_EFFORT` | — | Reasoning effort `low`..`max` (honored by the `claude`, `codex` and `direct` runners; opencode and `direct` with `openai-compat` ignore it) |
 | `--api-provider` | `$REVIEW_API_PROVIDER` | `deepseek` | `direct` runner provider: `deepseek` \| `openai` (Responses API) \| `openai-compat` \| `anthropic` |
 | `--api-base-url` | `$REVIEW_API_BASE_URL` | *provider default* | `direct` runner API base URL |
-| `--max-rounds` | `$REVIEW_MAX_ROUNDS` | `60` | `direct` runner round budget; the model is warned 10 and 3 rounds before it, then gets up to 5 review-only rounds to deliver |
+| `--max-rounds` | `$REVIEW_MAX_ROUNDS` | `60` | `direct` runner round budget (10–500); the flag or env var overrides the profile's `maxRounds`. The model is warned 10 and 3 rounds before it, then gets up to 5 review-only rounds to deliver |
 | `--allow-dangerous-permissions` | `$REVIEW_ALLOW_DANGEROUS_PERMISSIONS` | `true` | Pass `--auto` to opencode (needed for unattended CI) |
 | `--codex-sandbox` | `$REVIEW_CODEX_SANDBOX` | `workspace-write` | codex `--sandbox` mode; `danger-full-access` inside containers, where codex's bubblewrap sandbox can't start |
 
diff --git a/cmd/reviewctl/main.go b/cmd/reviewctl/main.go
index e8ec1c5..d6714bc 100644
--- a/cmd/reviewctl/main.go
+++ b/cmd/reviewctl/main.go
@@ -38,7 +38,7 @@ func main() {
 	}
 
 	pf := rootCmd.PersistentFlags()
-	pf.StringVar(&cfg.Key, "key", os.Getenv("PROJECT_KEY"), "project key (UUID)")
+	pf.StringVar(&cfg.Key, "key", os.Getenv(reviewer.EnvProjectKey), "project key (UUID)")
 	pf.StringVar(&cfg.URL, "url", os.Getenv("REVIEWSRV_URL"), "reviewsrv server URL (used for API calls from CI)")
 	pf.StringVar(&cfg.PublicURL, "public-url", os.Getenv("REVIEWSRV_PUBLIC_URL"), "browser-facing base URL for links in MR comments (defaults to --url)")
 	pf.StringVar(&cfg.Runner, "runner", ctl.EnvDefault("REVIEW_RUNNER", runner.RunnerClaude), "runner: claude | opencode | codex | direct (direct = no CLI, calls the API directly)")
@@ -46,7 +46,7 @@ func main() {
 	pf.StringVar(&cfg.Dir, "dir", ctl.EnvDefault("REVIEW_DIR", "."), "working directory with review files")
 	pf.BoolVar(&cfg.Verbose, "verbose", ctl.EnvBool("REVIEW_VERBOSE", false), "verbose output")
 	pf.StringVar(&cfg.GitLabURL, "gitlab-url", os.Getenv("CI_API_V4_URL"), "GitLab API URL")
-	pf.StringVar(&cfg.GitLabToken, "gitlab-token", os.Getenv("REVIEWER_GITLAB_TOKEN"), "GitLab API token")
+	pf.StringVar(&cfg.GitLabToken, "gitlab-token", os.Getenv(reviewer.EnvGitLabToken), "GitLab API token")
 	pf.StringVar(&cfg.MRIID, "mr-iid", os.Getenv("CI_MERGE_REQUEST_IID"), "MR IID")
 	pf.StringVar(&cfg.ProjectID, "project-id", os.Getenv("CI_PROJECT_ID"), "GitLab project ID")
 	pf.StringVar(&cfg.SourceBranch, "source-branch", os.Getenv("CI_MERGE_REQUEST_SOURCE_BRANCH_NAME"), "source branch")
@@ -70,7 +70,7 @@ func main() {
 	pf.StringVar(&cfg.Effort, "effort", os.Getenv("REVIEW_EFFORT"), "reasoning effort for claude, codex and direct: low|medium|high|xhigh|max")
 	pf.StringVar(&multiRaw, "multi", os.Getenv("REVIEW_MULTI"), "local multi-review panel: comma-separated runner:model members (e.g. codex:gpt-6-sol,opencode:deepseek-v4); bypasses server config, uses ambient credentials")
 	pf.StringVar(&judgeRaw, "judge", os.Getenv("REVIEW_JUDGE"), "multi-review judge runner:model (e.g. claude:opus); with >=2 --multi members, fuses them into one review")
-	pf.IntVar(&cfg.MaxRounds, "max-rounds", ctl.EnvInt("REVIEW_MAX_ROUNDS", 0), "direct runner round budget (0 = default 60); overrides the runner profile")
+	pf.IntVar(&cfg.MaxRounds, "max-rounds", ctl.EnvInt(envMaxRounds, 0), "direct runner round budget (0 = default 60); overrides the runner profile")
 	pf.DurationVar(&cfg.Timeout, "timeout", ctl.EnvDuration("REVIEW_TIMEOUT", 30*time.Minute), "per-member/judge run timeout (e.g. 30m, 1h); 0 = no timeout")
 	// --multi/--judge are local debug overrides (ambient creds, bypass the server
 	// panel config). Keep them working but hidden so they don't become a stable CLI
@@ -125,6 +125,9 @@ func main() {
 	// mid-flight, so the runner stops and the debug bundle still ships, marked
 	// cancelled rather than failed.
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	// After the first signal, restore the default handling: a second Ctrl+C or
+	// SIGTERM ends reviewctl even while it still ships bundles and cleans up.
+	context.AfterFunc(ctx, stop)
 	err := rootCmd.ExecuteContext(ctx)
 	stop()
 	if err != nil {
@@ -185,23 +188,7 @@ func applyReviewConfig(cmd *cobra.Command, cfg *ctl.Config, log *slog.Logger) er
 	}
 
 	p := rc.Primary // never nil: the server returns ErrNoRunnerProfile otherwise
-	fl := cmd.Flags()
-	cfg.RunnerProfileID = p.RunnerProfileID
-	cfg.RunnerProfileTitle = p.Title
-	cfg.Token = p.Token
-	// Server profile fills each runner field only when the user didn't pass the
-	// flag and the server has a value — explicit flags always win over the profile.
-	serverDefault(fl.Changed, "runner", p.Runner, &cfg.Runner)
-	serverDefault(fl.Changed, "model", p.Model, &cfg.Model)
-	serverDefault(fl.Changed, "effort", p.Effort, &cfg.Effort)
-	serverDefault(fl.Changed, "api-provider", p.APIProvider, &cfg.APIProvider)
-	serverDefault(fl.Changed, "api-base-url", p.APIBaseURL, &cfg.APIBaseURL)
-	if !fl.Changed("allow-dangerous-permissions") {
-		cfg.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
-	}
-	if cfg.MaxRounds == 0 {
-		cfg.MaxRounds = p.Params.MaxRounds
-	}
+	applyProfile(explicitFlags(cmd.Flags().Changed), cfg, p)
 
 	// Task-tracker access: the URL comes from the server config; the CI env var
 	// wins over the server-stored token (same precedence as the API keys). The
@@ -228,15 +215,42 @@ func applyReviewConfig(cmd *cobra.Command, cfg *ctl.Config, log *slog.Logger) er
 	// The panel members and judge are logged when the panel starts.
 	log.InfoContext(cmd.Context(), "applied runner profile",
 		"profileId", p.RunnerProfileID, "title", p.Title,
-		"runner", cfg.Runner, "model", cfg.Model, "effort", cfg.Effort, "provider", provider)
+		"runner", cfg.Runner, "model", cfg.Model, "effort", cfg.Effort, "provider", provider, "maxRounds", cfg.MaxRounds)
 	return nil
 }
 
-// serverDefault applies a server profile string field to *dst when the user left
-// the flag at its default (changed reports false) and the server has a non-empty
-// value, so an explicit flag always wins over the profile.
-func serverDefault(changed func(string) bool, flag, serverVal string, dst *string) {
-	if !changed(flag) && serverVal != "" {
+// explicitFlags reports a flag as passed when the user gave it on the command
+// line — or, for --max-rounds, which CI sets through REVIEW_MAX_ROUNDS, in the
+// environment. Other runner settings come from the profile in CI.
+func explicitFlags(changed func(string) bool) func(string) bool {
+	return func(name string) bool {
+		return changed(name) || name == "max-rounds" && os.Getenv(envMaxRounds) != ""
+	}
+}
+
+// applyProfile fills cfg from the project's primary runner profile. A profile
+// value fills a field only when the user didn't pass its flag (changed) and the
+// profile has one — explicit flags always win, even an explicit zero.
+func applyProfile(changed func(string) bool, cfg *ctl.Config, p *ctl.ResolvedProfile) {
+	cfg.RunnerProfileID = p.RunnerProfileID
+	cfg.RunnerProfileTitle = p.Title
+	cfg.Token = p.Token
+	serverDefault(changed, "runner", p.Runner, &cfg.Runner)
+	serverDefault(changed, "model", p.Model, &cfg.Model)
+	serverDefault(changed, "effort", p.Effort, &cfg.Effort)
+	serverDefault(changed, "api-provider", p.APIProvider, &cfg.APIProvider)
+	serverDefault(changed, "api-base-url", p.APIBaseURL, &cfg.APIBaseURL)
+	if !changed("allow-dangerous-permissions") {
+		cfg.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
+	}
+	serverDefault(changed, "max-rounds", p.Params.MaxRounds, &cfg.MaxRounds)
+}
+
+// serverDefault sets *dst to a profile value unless the flag was passed or the
+// profile leaves it unset (zero).
+func serverDefault[T comparable](changed func(string) bool, flag string, serverVal T, dst *T) {
+	var zero T
+	if !changed(flag) && serverVal != zero {
 		*dst = serverVal
 	}
 }
@@ -329,7 +343,8 @@ func buildDirectRunner(cfg *ctl.Config, log *slog.Logger) (runner.ReviewRunner,
 // token override (CI variable wins over the server-stored tracker token; the
 // name aliases the canonical reviewer const referenced by assembled prompts).
 const (
-	envReviewAPIKey    = "REVIEW_API_KEY"
+	envReviewAPIKey    = reviewer.EnvAPIKey
+	envMaxRounds       = "REVIEW_MAX_ROUNDS"
 	envAnthropicAPIKey = "ANTHROPIC_API_KEY"
 	envOpenAIAPIKey    = "OPENAI_API_KEY"
 	envDeepSeekAPIKey  = "DEEPSEEK_API_KEY"
diff --git a/cmd/reviewctl/main_test.go b/cmd/reviewctl/main_test.go
index 69ef6d3..22a5620 100644
--- a/cmd/reviewctl/main_test.go
+++ b/cmd/reviewctl/main_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"slices"
 	"testing"
 
 	"reviewsrv/pkg/reviewer/ctl"
@@ -64,3 +65,45 @@ func TestDirectAPIKey(t *testing.T) {
 		require.Equal(t, "ds", directAPIKey("deepseek"))
 	})
 }
+
+func TestApplyProfile(t *testing.T) {
+	p := &ctl.ResolvedProfile{Runner: "direct", Model: "claude-opus-5-5", RunnerProfileID: 5, Title: "direct",
+		Params: ctl.RunnerProfileParams{MaxRounds: 120, AllowDangerousPermissions: true}}
+	passed := func(flags ...string) func(string) bool {
+		return func(name string) bool { return slices.Contains(flags, name) }
+	}
+
+	cfg := &ctl.Config{Runner: "claude", MaxRounds: 0}
+	applyProfile(passed(), cfg, p)
+	assert.Equal(t, "direct", cfg.Runner)
+	assert.Equal(t, 120, cfg.MaxRounds, "the profile's budget applies without the flag")
+	assert.True(t, cfg.AllowDangerousPermissions)
+
+	cfg = &ctl.Config{Runner: "codex", MaxRounds: 0}
+	applyProfile(passed("runner", "max-rounds"), cfg, p)
+	assert.Equal(t, "codex", cfg.Runner, "an explicit flag wins")
+	assert.Zero(t, cfg.MaxRounds, "an explicit --max-rounds 0 (the default) wins too")
+
+	cfg = &ctl.Config{MaxRounds: 200}
+	applyProfile(passed("max-rounds"), cfg, &ctl.ResolvedProfile{})
+	assert.Equal(t, 200, cfg.MaxRounds)
+	applyProfile(passed(), cfg, &ctl.ResolvedProfile{})
+	assert.Equal(t, 200, cfg.MaxRounds, "a profile without a budget leaves the value alone")
+
+	full := &ctl.ResolvedProfile{Runner: "direct", Model: "m", Effort: "high", APIProvider: "anthropic", APIBaseURL: "https://proxy",
+		Params: ctl.RunnerProfileParams{AllowDangerousPermissions: false}}
+	cfg = &ctl.Config{Model: "flag-model", AllowDangerousPermissions: true}
+	applyProfile(passed("model", "allow-dangerous-permissions"), cfg, full)
+	assert.Equal(t, ctl.Config{Runner: "direct", Model: "flag-model", Effort: "high", APIProvider: "anthropic",
+		APIBaseURL: "https://proxy", AllowDangerousPermissions: true}, *cfg, "string fields and a passed bool flag")
+}
+
+func TestExplicitFlagsCountsMaxRoundsEnv(t *testing.T) {
+	none := func(string) bool { return false }
+	t.Setenv(envMaxRounds, "")
+	assert.False(t, explicitFlags(none)("max-rounds"))
+
+	t.Setenv(envMaxRounds, "200") // how CI sets the budget
+	assert.True(t, explicitFlags(none)("max-rounds"))
+	assert.False(t, explicitFlags(none)("model"), "other runner settings come from the profile in CI")
+}
diff --git a/docs/llm/reviewctl.md b/docs/llm/reviewctl.md
index e0bda87..7e1751e 100644
--- a/docs/llm/reviewctl.md
+++ b/docs/llm/reviewctl.md
@@ -14,14 +14,14 @@
 ```
 GitLab CI Job / Local
   └── reviewctl review
-        ├── 1. GET /v1/prompt/{projectKey}/     → prompt text
-        ├── 2. claude --print --output-format json --model opus -p "$prompt"
-        │       → stdout: ClaudeResult JSON (cost, usage, result)
+        ├── 1. POST /v1/reviewctl/rpc/  ReviewConfig + Prompt → профиль раннера, текст промпта
+        ├── 2. runner (claude / opencode / codex / direct) по профилю раннера
+        │       → ClaudeResult (cost, usage, result)
         │       → files: review.json, R1.md, R2.md, R3.md, R4.md, R5.md
         ├── 3. Parse review.json → ReviewDraft
         │       Merge ClaudeResult cost → ReviewDraft.ModelInfo
-        ├── 4. POST /v1/upload/{projectKey}/    → reviewId
-        │       POST /v1/upload/{projectKey}/{reviewId}/{type}/  × N files
+        ├── 4. POST /v1/reviewctl/upload/{projectKey}/    → reviewId
+        │       POST /v1/reviewctl/upload/{projectKey}/{reviewId}/{type}/  × N files
         ├── 5. GitLab MR comments:
         │       - Cleanup old inline discussions (без ответов)
         │       - POST summary note (история прогресса)
@@ -78,13 +78,16 @@ reviewctl version   — версия бинарника
 
 ```bash
 claude --print \
-  --output-format json \
-  --model $MODEL \
+  --output-format stream-json --verbose \
   --permission-mode bypassPermissions \
-  -p "$PROMPT"
+  --setting-sources user --strict-mcp-config \
+  --model $MODEL [--effort $EFFORT] \
+  -p -            # промпт на stdin
 ```
 
-**Важно:** флаг `--verbose` НЕ используется — он заставляет Claude CLI выводить все сообщения как JSON array, что при большом review может превысить буфер (448KB) и обрезать вывод.
+- `stream-json --verbose` — поток NDJSON-событий: раннер логирует вызовы инструментов по ходу, итоговый `result` тот же, что у `--output-format json`.
+- `--setting-sources user --strict-mcp-config` и env `CLAUDE_CODE_DISABLE_AUTO_MEMORY=1` — проверяемый checkout недоверенный: его `.claude/settings.json` (хуки), `.mcp.json` и автопамять разработчика не загружаются.
+- Дочерние процессы на checkout (раннеры, git) получают окружение без секретов CI (`REVIEWER_GITLAB_TOKEN`, `PROJECT_KEY`, `CI_JOB_TOKEN`, …), а git reviewctl запускает без хуков и fsmonitor (`-c core.hooksPath=/dev/null -c core.fsmonitor=false`). Это дополнительный слой, а не граница: агент под тем же uid может прочитать `/proc/<pid>/environ` reviewctl; граница — отдельный uid или PID namespace. Ключ API — из env или токена профиля раннера (`ANTHROPIC_API_KEY`).
 
 ### Session caching
 
@@ -93,9 +96,7 @@ claude --print \
 
 ### Парсинг вывода
 
-`ParseClaudeResult` поддерживает:
-- Одиночный JSON-объект (нормальный режим без `--verbose`)
-- JSON array (от `--resume` / `--verbose`) — потоковый декодер (`json.Decoder`), толерантен к обрезанным массивам
+`ParseClaudeResult` поддерживает поток NDJSON (`stream-json`), одиночный JSON-объект и JSON array — потоковый декодер (`json.Decoder`), толерантен к обрезанному выводу. Ненулевой выход раннера разбирается `claudeRunError`: причина сбоя (billing, auth, rate_limit, api_error) берётся из события ошибки в потоке.
 
 ---
 
diff --git a/docs/patches/2026-09-23-retired-models.sql b/docs/patches/2026-09-23-retired-models.sql
index 5f629c9..116d3f0 100644
--- a/docs/patches/2026-09-23-retired-models.sql
+++ b/docs/patches/2026-09-23-retired-models.sql
@@ -1,7 +1,9 @@
 -- Remap runner profiles that point at model ids their providers have retired (as of
 -- 2026-09) to the current replacements. Data only — model/effort are free-form columns,
 -- no DDL needed; profiles on live models are left as chosen. The ids are unambiguous,
--- so the mapping applies to every runner (prefixed ones only exist under opencode).
+-- so the mapping applies to every runner (prefixed ones only exist under opencode) —
+-- except profiles with their own apiBaseURL: behind a gateway (LiteLLM, Azure) the
+-- model is the gateway's alias, which may well still exist.
 UPDATE "runnerProfiles" p SET "model" = m."new"
 FROM (VALUES
 	-- OpenAI: the gpt-5-codex / gpt-5.1-codex* / gpt-5.2-codex family, shut down 2026-07-23.
@@ -29,4 +31,5 @@ FROM (VALUES
 	('anthropic/claude-sonnet-4-0', 'anthropic/claude-sonnet-5'),
 	('anthropic/claude-sonnet-4-20250514', 'anthropic/claude-sonnet-5')
 ) AS m("old", "new")
-WHERE p."model" = m."old";
+WHERE p."model" = m."old"
+	AND coalesce(p."apiBaseURL", '') = '';
diff --git a/pkg/app/app.go b/pkg/app/app.go
index 4ae2f0d..b7f6426 100644
--- a/pkg/app/app.go
+++ b/pkg/app/app.go
@@ -3,6 +3,7 @@ package app
 import (
 	"cmp"
 	"context"
+	"slices"
 	"time"
 
 	"reviewsrv/pkg/db"
@@ -78,7 +79,7 @@ func New(appName, version string, sl embedlog.Logger, cfg Config, db db.DB, dbc
 		echo:         appkit.NewEcho(),
 		Logger:       sl,
 		debugStorage: debug.New(cmp.Or(cfg.Debug.Capacity, debugBufferCapacity), cmp.Or(cfg.Debug.FilesCapacity, debugFilesCapacity)),
-		runMetrics:   reviewer.NewRunMetrics(runner.Names...),
+		runMetrics:   reviewer.NewRunMetrics(slices.Concat(runner.Names, []string{reviewer.PanelRunner})...),
 	}
 
 	// add services
diff --git a/pkg/debug/handler.go b/pkg/debug/handler.go
index 4fdf391..ee4b6b0 100644
--- a/pkg/debug/handler.go
+++ b/pkg/debug/handler.go
@@ -11,7 +11,6 @@ import (
 	"io"
 	"log/slog"
 	"math"
-	"mime"
 	"mime/multipart"
 	"net/http"
 	"path/filepath"
@@ -49,9 +48,10 @@ const (
 	FieldSourceBranch = "sourceBranch"
 	FieldTargetBranch = "targetBranch"
 	FieldCommitHash   = "commitHash"
-	FieldStatus       = "status"  // reviewer.RunStatus*
-	FieldReason       = "reason"  // reviewer.RunReason*
-	FieldCostUsd      = "costUsd" // spent by the run, incl. a failed one
+	FieldStatus       = "status"   // reviewer.RunStatus*
+	FieldReason       = "reason"   // reviewer.RunReason*
+	FieldCostUsd      = "costUsd"  // spent by the run, incl. a failed one
+	FieldReviewID     = "reviewId" // set when the run's review was created before it failed
 )
 
 //go:embed templates/*.html
@@ -93,11 +93,11 @@ func (h *Handler) Upload(c echo.Context) error {
 	if h.projectTitle != nil {
 		// Before the body is read: the route is unauthenticated, and a key that
 		// matches no project could only fill the ring and the metrics with noise.
-		// A failed lookup proves nothing, so that bundle is kept, untitled.
 		title, err := h.projectTitle(ctx, projectKey)
 		switch {
 		case err != nil:
-			h.log.ErrorContext(ctx, "debug upload: resolve project", "projectKey", projectKey, "err", err)
+			h.log.ErrorContext(ctx, "debug upload: resolve project", "projectKey", shortKey(projectKey), "err", err)
+			return echo.NewHTTPError(http.StatusServiceUnavailable, "resolve project")
 		case title == "":
 			return echo.NewHTTPError(http.StatusNotFound, "unknown project")
 		}
@@ -122,11 +122,14 @@ func (h *Handler) Upload(c echo.Context) error {
 		ExternalID:   field(FieldExternalID, maxFieldBytes),
 		Runner:       field(FieldRunner, maxFieldBytes),
 		Model:        field(FieldModel, maxFieldBytes),
-		ErrorMsg:     field(FieldErrorMsg, maxErrorMsgBytes),
+		// The key authorizes project config (runner-profile and tracker
+		// tokens): an upload URL quoted in an error must not reveal it.
+		ErrorMsg:     strings.ReplaceAll(field(FieldErrorMsg, maxErrorMsgBytes), projectKey, shortKey(projectKey)+"…"),
 		SourceBranch: field(FieldSourceBranch, maxFieldBytes),
 		TargetBranch: field(FieldTargetBranch, maxFieldBytes),
 		CommitHash:   field(FieldCommitHash, maxFieldBytes),
 		CostUsd:      parseCost(formValue(form.Value, FieldCostUsd)),
+		ReviewID:     reviewIDField(formValue(form.Value, FieldReviewID)),
 		Files:        make(map[string]File, len(form.File)),
 	}
 	b.Status, b.Reason = reviewer.NormalizeRunOutcome(formValue(form.Value, FieldStatus), formValue(form.Value, FieldReason), b.ErrorMsg != "")
@@ -148,12 +151,15 @@ func (h *Handler) Upload(c echo.Context) error {
 	if b.Status == reviewer.RunStatusFailed || b.Status == reviewer.RunStatusTimeout {
 		lvl = slog.LevelWarn
 	}
+	// A run whose review was created already counted as ok (with its cost)
+	// on that upload: counting its later failure too would double both.
+	counted := b.Status != reviewer.RunStatusOK && b.ReviewID == ""
 	h.log.Log(ctx, lvl, "debug bundle stored",
-		"id", b.ID, "projectKey", projectKey, "project", b.ProjectTitle, "files", len(b.Files), "hasError", b.ErrorMsg != "",
+		"id", b.ID, "projectKey", shortKey(projectKey), "project", b.ProjectTitle, "files", len(b.Files), "hasError", b.ErrorMsg != "",
 		"status", b.Status, "reason", b.Reason, "runner", b.Runner, "model", b.Model, "costUsd", b.CostUsd,
-		"errorMsg", preview(b.ErrorMsg, 300),
+		"reviewId", b.ReviewID, "countedInMetrics", counted, "errorMsg", preview(b.ErrorMsg, 300),
 	)
-	if b.Status != reviewer.RunStatusOK {
+	if counted {
 		h.metrics.Observe(b.ProjectTitle, b.Runner, b.Status, b.Reason, b.CostUsd)
 	}
 
@@ -194,8 +200,8 @@ func (h *Handler) Bundle(c echo.Context) error {
 	return h.renderHTML(c, "bundle.html", data)
 }
 
-// File serves a single artifact inline so the browser can render it,
-// decompressing it on the fly.
+// File serves a single artifact inline, as JSON or plain text in a sandbox
+// (see contentTypeFor), decompressing it on the fly.
 func (h *Handler) File(c echo.Context) error {
 	f, ok := h.storage.GetFile(c.Param("id"), c.Param("filename"))
 	if !ok {
@@ -206,6 +212,11 @@ func (h *Handler) File(c echo.Context) error {
 		return echo.NewHTTPError(http.StatusInternalServerError, "gzip: "+err.Error())
 	}
 	defer gr.Close()
+	// Belt and braces for uploaded content: no sniffing into a renderable type,
+	// and no scripts even if a browser renders it anyway.
+	hdr := c.Response().Header()
+	hdr.Set("X-Content-Type-Options", "nosniff")
+	hdr.Set("Content-Security-Policy", "sandbox")
 	return c.Stream(http.StatusOK, contentTypeFor(c.Param("filename")), gr)
 }
 
@@ -217,6 +228,16 @@ func (h *Handler) renderHTML(c echo.Context, name string, data any) error {
 	return c.HTML(http.StatusOK, sb.String())
 }
 
+// reviewIDField keeps a client-reported review id only when it is one, so a
+// garbage value can't switch off the run metrics.
+func reviewIDField(s string) string {
+	id, err := strconv.Atoi(s)
+	if err != nil || id <= 0 {
+		return ""
+	}
+	return strconv.Itoa(id)
+}
+
 // parseCost reads a client-reported dollar cost; anything unusable is 0.
 func parseCost(s string) float64 {
 	v, err := strconv.ParseFloat(s, 64)
@@ -262,16 +283,13 @@ func readArtifact(fh *multipart.FileHeader) (File, error) {
 	return File{Gzip: raw, Size: int(n)}, nil
 }
 
-// contentTypeFor picks a browser-friendly Content-Type by extension.
-// Markdown and JSONL render best as text/plain so the browser shows them inline
-// rather than offering a download or rendering as raw markdown.
+// contentTypeFor picks the Content-Type an artifact is served with: JSON as
+// such, anything else as plain text. The name comes from the uploader, and the
+// debug pages share an origin with the admin panel, so no type that a browser
+// would render as a document (html, svg) is ever derived from it.
 func contentTypeFor(name string) string {
-	switch strings.ToLower(filepath.Ext(name)) {
-	case ".md", ".jsonl", ".log":
-		return "text/plain; charset=utf-8"
-	}
-	if ct := mime.TypeByExtension(filepath.Ext(name)); ct != "" {
-		return ct
+	if strings.EqualFold(filepath.Ext(name), ".json") {
+		return "application/json"
 	}
 	return "text/plain; charset=utf-8"
 }
diff --git a/pkg/debug/handler_test.go b/pkg/debug/handler_test.go
index 2e59523..adf5ae2 100644
--- a/pkg/debug/handler_test.go
+++ b/pkg/debug/handler_test.go
@@ -5,6 +5,7 @@ import (
 	"compress/gzip"
 	"context"
 	"encoding/json"
+	"errors"
 	"io"
 	"log/slog"
 	"maps"
@@ -22,9 +23,15 @@ import (
 )
 
 func newTestHandler(t *testing.T) (*Storage, *echo.Echo) {
+	t.Helper()
+	return newTestHandlerWith(t, nil, nil)
+}
+
+// newTestHandlerWith builds the handler with a project lookup and run metrics.
+func newTestHandlerWith(t *testing.T, lookup func(context.Context, string) (string, error), metrics *reviewer.RunMetrics) (*Storage, *echo.Echo) {
 	t.Helper()
 	storage := New(5, 5)
-	h := NewHandler(storage, slog.Default(), nil, nil)
+	h := NewHandler(storage, slog.Default(), lookup, metrics)
 
 	e := echo.New()
 	e.POST("/v1/upload/debug/:projectKey/", h.Upload)
@@ -244,6 +251,61 @@ func TestHandler_FileServesArtifactWithContentType(t *testing.T) {
 	}
 }
 
+func TestHandler_FileNeverServesARenderableType(t *testing.T) {
+	storage, e := newTestHandler(t)
+	storage.Add(&Bundle{ID: "xss", Files: map[string]File{
+		"x.html": gzFile(t, "<script>alert(1)</script>"),
+		"x.svg":  gzFile(t, `<svg onload="alert(1)"/>`),
+	}})
+
+	for _, name := range []string{"x.html", "x.svg"} {
+		rec := httptest.NewRecorder()
+		e.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/debug/storage/xss/"+name, nil))
+		if got := rec.Header().Get("Content-Type"); got != "text/plain; charset=utf-8" {
+			t.Errorf("%s: Content-Type = %q, want text/plain", name, got)
+		}
+		if rec.Header().Get("X-Content-Type-Options") != "nosniff" || rec.Header().Get("Content-Security-Policy") != "sandbox" {
+			t.Errorf("%s: missing nosniff/sandbox headers: %v", name, rec.Header())
+		}
+	}
+}
+
+func TestHandler_UploadRefusedWhenProjectLookupFails(t *testing.T) {
+	_, e := newTestHandlerWith(t, func(context.Context, string) (string, error) {
+		return "", errors.New("db down")
+	}, nil)
+
+	body, ct := buildMultipart(t, map[string]string{"errorMsg": "boom"}, nil)
+	req := httptest.NewRequest(http.MethodPost, "/v1/upload/debug/"+uuid.NewString()+"/", body)
+	req.Header.Set("Content-Type", ct)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Errorf("status = %d, want 503: an unverified key is not accepted", rec.Code)
+	}
+}
+
+func TestHandler_UploadHidesProjectKey(t *testing.T) {
+	storage, e := newTestHandler(t)
+	key := uuid.NewString()
+	b := upload(t, storage, e, key, map[string]string{
+		"errorMsg": `upload: Post "https://reviewer/v1/reviewctl/upload/` + key + `/": EOF`,
+		"reviewId": "+42",
+	})
+	if strings.Contains(b.ErrorMsg, key) {
+		t.Errorf("errorMsg reveals the project key: %q", b.ErrorMsg)
+	}
+	if b.ReviewID != "42" {
+		t.Errorf("reviewId = %q, want the canonical 42", b.ReviewID)
+	}
+
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/debug/storage/"+b.ID+"/", nil))
+	if strings.Contains(rec.Body.String(), key) {
+		t.Error("the bundle page reveals the project key")
+	}
+}
+
 func TestHandler_FileNotFound(t *testing.T) {
 	_, e := newTestHandler(t)
 	req := httptest.NewRequest(http.MethodGet, "/v1/debug/storage/missing/review.json", nil)
@@ -273,20 +335,16 @@ func upload(t *testing.T, storage *Storage, e *echo.Echo, projectKey string, fie
 }
 
 func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
-	storage := New(5, 5)
 	knownKey := uuid.NewString()
 	metrics := reviewer.NewRunMetrics("claude")
 	reg := prometheus.NewRegistry()
 	metrics.Register(reg)
-	h := NewHandler(storage, slog.Default(), func(_ context.Context, key string) (string, error) {
+	storage, e := newTestHandlerWith(t, func(_ context.Context, key string) (string, error) {
 		if key != knownKey {
 			return "", nil // no such project
 		}
 		return "demo", nil
 	}, metrics)
-	e := echo.New()
-	e.POST("/v1/upload/debug/:projectKey/", h.Upload)
-	e.GET("/v1/debug/storage/", h.List)
 
 	b := upload(t, storage, e, knownKey, map[string]string{
 		"runner": "claude", "errorMsg": "run claude: billing_error: Credit balance is too low",
@@ -302,8 +360,15 @@ func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
 	if b.Status != "failed" || b.Reason != "other" {
 		t.Errorf("legacy upload not normalized: %+v", b)
 	}
-	// An ok run is counted on review upload, not here.
+	// An ok run is counted on review upload, not here — and so is a run whose
+	// review was created before it failed.
 	upload(t, storage, e, knownKey, map[string]string{"runner": "claude", "status": "ok", "costUsd": "2"})
+	b = upload(t, storage, e, knownKey, map[string]string{"runner": "claude", "status": "failed", "reason": "other", "costUsd": "3", "reviewId": "80"})
+	if b.ReviewID != "80" {
+		t.Errorf("reviewId not stored: %+v", b)
+	}
+	// A garbage reviewId can't switch the metrics off: this one is counted.
+	upload(t, storage, e, knownKey, map[string]string{"runner": "claude", "status": "failed", "reason": "billing", "reviewId": "x"})
 
 	// A key that matches no project is refused.
 	body, ct := buildMultipart(t, map[string]string{"errorMsg": "x", "costUsd": "999"}, nil)
@@ -321,7 +386,7 @@ func TestHandler_UploadRecordsRunOutcome(t *testing.T) {
 		labels labels
 		want   float64
 	}{
-		{"reviewer_runs_total", labels{"project": "demo", "runner": "claude", "status": "failed", "reason": "billing"}, 1},
+		{"reviewer_runs_total", labels{"project": "demo", "runner": "claude", "status": "failed", "reason": "billing"}, 2},
 		{"reviewer_runs_total", labels{"project": "demo", "runner": "other", "status": "failed", "reason": "other"}, 1},
 		{"reviewer_run_cost_usd_total", labels{"project": "demo", "runner": "claude", "status": "failed"}, 1.5},
 		{"reviewer_run_cost_usd_total", labels{"project": "demo", "runner": "other", "status": "failed"}, 0},
diff --git a/pkg/debug/storage.go b/pkg/debug/storage.go
index b807f6a..28548f8 100644
--- a/pkg/debug/storage.go
+++ b/pkg/debug/storage.go
@@ -38,6 +38,7 @@ type Bundle struct {
 	Status       string  // reviewer.RunStatus*, normalized on upload
 	Reason       string  // reviewer.RunReason*; empty for an ok run
 	CostUsd      float64 // what the run spent, including a failed one
+	ReviewID     string  // the review created before the run failed, if any
 	ProjectTitle string  // resolved from ProjectKey; empty for an unknown key
 	Files        map[string]File
 	FilesEvicted bool // artifacts dropped to cap memory; metadata kept
diff --git a/pkg/debug/templates/bundle.html b/pkg/debug/templates/bundle.html
index b472764..7478890 100644
--- a/pkg/debug/templates/bundle.html
+++ b/pkg/debug/templates/bundle.html
@@ -26,9 +26,10 @@ <h1>Bundle <code>{{.Bundle.ID}}</code></h1>
 
 <dl class="meta">
   <dt>Timestamp</dt>     <dd><code>{{.Bundle.Timestamp.Format "2006-01-02 15:04:05 MST"}}</code></dd>
-  <dt>Project</dt>       <dd>{{or .Bundle.ProjectTitle "—"}} <code>{{.Bundle.ProjectKey}}</code></dd>
+  <dt>Project</dt>       <dd>{{or .Bundle.ProjectTitle "—"}} <code>{{shortKey .Bundle.ProjectKey}}</code></dd>
   <dt>Status</dt>        <dd>{{.Bundle.Status}}{{if .Bundle.Reason}} · {{.Bundle.Reason}}{{end}}</dd>
   <dt>Cost</dt>          <dd>{{if .Bundle.CostUsd}}<code>${{printf "%.4f" .Bundle.CostUsd}}</code>{{else}}—{{end}}</dd>
+  {{if .Bundle.ReviewID}}<dt>Review</dt>        <dd><code>#{{.Bundle.ReviewID}}</code> created before the failure</dd>{{end}}
   <dt>MR IID</dt>        <dd>{{or .Bundle.MRIid "—"}}</dd>
   <dt>External ID</dt>   <dd>{{or .Bundle.ExternalID "—"}}</dd>
   <dt>Runner</dt>        <dd>{{.Bundle.Runner}}</dd>
diff --git a/pkg/rest/rest_test.go b/pkg/rest/rest_test.go
index dee7c23..c16e791 100644
--- a/pkg/rest/rest_test.go
+++ b/pkg/rest/rest_test.go
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 	"reviewsrv/pkg/reviewer"
 
 	"github.com/labstack/echo/v4"
+	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -169,3 +171,62 @@ func cleanupReview(t *testing.T, dbc db.DB, rv *reviewer.Review) {
 		t.Logf("cleanup review %d: %v", rv.ID, err)
 	}
 }
+
+func TestDBCreateReviewCountsOkRun(t *testing.T) {
+	dbc, _ := dbtest.Setup(t)
+	pr, prCl := dbtest.Project(t, dbc, nil, dbtest.WithProjectRelations, dbtest.WithFakeProject)
+	t.Cleanup(prCl)
+	metrics := reviewer.NewRunMetrics("claude")
+	reg := prometheus.NewRegistry()
+	metrics.Register(reg)
+	h := NewHandler(dbc, nil, "http://localhost", metrics)
+
+	body := `{"review":{"title":"t","commitHash":"abc","sourceBranch":"f","targetBranch":"master","author":"dev",
+		"createdAt":"2026-09-24T12:00:00Z","modelInfo":{"model":"opus","costUsd":1.25},"runnerProfile":{"runner":"claude"}},
+		"files":[{"reviewType":"code","summary":"ok","isAccepted":true}],"issues":[]}`
+	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+	req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
+	rec := httptest.NewRecorder()
+	c := echo.New().NewContext(req, rec)
+	c.SetParamNames("projectKey")
+	c.SetParamValues(pr.ProjectKey)
+
+	require.NoError(t, h.CreateReview(c))
+	id, err := strconv.Atoi(rec.Body.String())
+	require.NoError(t, err)
+	t.Cleanup(func() { // hard delete: the project's cleanup needs the rows gone
+		ctx := context.Background()
+		_, _ = dbc.ModelContext(ctx, (*db.ReviewFile)(nil)).Where(`"reviewId" = ?`, id).Delete()
+		_, _ = dbc.ModelContext(ctx, &db.Review{ID: id}).WherePK().Delete()
+	})
+
+	// The profile's runner labels the run; the uploaded review is its ok outcome.
+	runs, cost := okRunCounters(t, reg, pr.Title, "claude")
+	assert.InDelta(t, 1, runs, 0)
+	assert.InDelta(t, 1.25, cost, 1e-9)
+}
+
+// okRunCounters reads the ok-run and cost counters of project and runner.
+func okRunCounters(t *testing.T, reg *prometheus.Registry, project, runner string) (runs, cost float64) {
+	t.Helper()
+	mfs, err := reg.Gather()
+	require.NoError(t, err)
+	for _, mf := range mfs {
+		for _, m := range mf.GetMetric() {
+			l := map[string]string{}
+			for _, lp := range m.GetLabel() {
+				l[lp.GetName()] = lp.GetValue()
+			}
+			if l["project"] != project || l["runner"] != runner || l["status"] != reviewer.RunStatusOK {
+				continue
+			}
+			switch mf.GetName() {
+			case "reviewer_runs_total":
+				runs = m.GetCounter().GetValue()
+			case "reviewer_run_cost_usd_total":
+				cost = m.GetCounter().GetValue()
+			}
+		}
+	}
+	return runs, cost
+}
diff --git a/pkg/reviewer/ctl/ctl.go b/pkg/reviewer/ctl/ctl.go
index a0fd7b3..6208c5d 100644
--- a/pkg/reviewer/ctl/ctl.go
+++ b/pkg/reviewer/ctl/ctl.go
@@ -121,12 +121,6 @@ func NewController(cfg *Config, rr runner.ReviewRunner, log *slog.Logger, opts .
 	return c
 }
 
-func (c *Controller) addSpent(usd float64) {
-	c.spentMu.Lock()
-	c.spent += usd
-	c.spentMu.Unlock()
-}
-
 func (c *Controller) spentTotal() float64 {
 	c.spentMu.Lock()
 	defer c.spentMu.Unlock()
@@ -215,7 +209,9 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 // debug ring before a panel worktree goes. The upload gets a detached context:
 // a cancelled or timed-out run is precisely what the bundle should explain.
 func (c *Controller) settleRun(ctx context.Context, cfg *Config, rr *spendTracker, runErr error) {
-	c.addSpent(rr.total())
+	c.spentMu.Lock()
+	c.spent += rr.total()
+	c.spentMu.Unlock()
 	if runErr == nil && !cfg.DebugUpload {
 		return
 	}
@@ -246,6 +242,10 @@ func (c *Controller) uploadDebugBundle(ctx context.Context, cfg *Config, runErr
 		CostUsd:      costUsd,
 	}
 	meta.Status, meta.Reason = reviewer.RunOutcome(runErr)
+	var created *reviewCreatedError
+	if errors.As(runErr, &created) {
+		meta.ReviewID = created.reviewID
+	}
 	if runErr != nil {
 		meta.ErrorMsg = runErr.Error()
 		// A cancelled job is expected, not a failure worth a warning.
@@ -395,7 +395,9 @@ func (c *Controller) fillMetadata(ctx context.Context, draft *rest.ReviewDraft)
 // gitMeta returns the trimmed output of a git command in dir, or "" on any
 // error — callers treat the value as optional metadata.
 func gitMeta(ctx context.Context, dir string, args ...string) string {
-	out, err := exec.CommandContext(ctx, "git", append([]string{"-C", dir}, args...)...).Output()
+	cmd := exec.CommandContext(ctx, "git", reviewer.GitArgs(append([]string{"-C", dir}, args...)...)...)
+	cmd.Env = reviewer.ChildEnv()
+	out, err := cmd.Output()
 	if err != nil {
 		return ""
 	}
diff --git a/pkg/reviewer/ctl/ctl_test.go b/pkg/reviewer/ctl/ctl_test.go
index 9220bac..583fa9c 100644
--- a/pkg/reviewer/ctl/ctl_test.go
+++ b/pkg/reviewer/ctl/ctl_test.go
@@ -13,6 +13,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 
 	"reviewsrv/pkg/rest"
@@ -178,11 +179,31 @@ func editReviewJSON(dir string, edit func(*rest.ReviewDraft)) error {
 	return WriteReviewJSON(dir, draft)
 }
 
-// newDebugCaptureServer serves the prompt RPC and records the form fields of
-// the debug bundle upload; nothing else is expected.
-func newDebugCaptureServer(t *testing.T) (*httptest.Server, map[string]string) {
+// debugCapture records the debug bundle uploads a test server received.
+type debugCapture struct {
+	mu      sync.Mutex
+	last    map[string]string // form fields of the latest bundle
+	bundles int
+}
+
+func (d *debugCapture) field(name string) string {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.last[name]
+}
+
+func (d *debugCapture) count() int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.bundles
+}
+
+// newDebugCaptureServer serves the prompt RPC and records the debug bundle
+// uploads (concurrent ones too: panel members); other requests go to other
+// (404 when nil).
+func newDebugCaptureServer(t *testing.T, other http.HandlerFunc) (*httptest.Server, *debugCapture) {
 	t.Helper()
-	fields := map[string]string{}
+	dc := &debugCapture{}
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/v1/reviewctl/rpc/" {
 			w.Header().Set("Content-Type", "application/json")
@@ -193,21 +214,57 @@ func newDebugCaptureServer(t *testing.T) (*httptest.Server, map[string]string) {
 			if !assert.NoError(t, r.ParseMultipartForm(32<<20)) {
 				return
 			}
+			fields := make(map[string]string, len(r.MultipartForm.Value))
 			for k, v := range r.MultipartForm.Value {
 				fields[k] = v[0]
 			}
+			dc.mu.Lock()
+			dc.last, dc.bundles = fields, dc.bundles+1
+			dc.mu.Unlock()
 			w.Header().Set("Content-Type", "application/json")
 			_, _ = w.Write([]byte(`{"id":"x","url":"/v1/debug/storage/x/"}`))
 			return
 		}
+		if other != nil {
+			other(w, r)
+			return
+		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	t.Cleanup(srv.Close)
-	return srv, fields
+	return srv, dc
+}
+
+func TestController_Review_PartialUploadNamesTheReview(t *testing.T) {
+	// The review is created, then an R*.md upload fails.
+	srv, dc := newDebugCaptureServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/v1/reviewctl/upload/test-key/" { // the review itself; its files fail
+			_, _ = w.Write([]byte("42"))
+			return
+		}
+		w.WriteHeader(http.StatusInternalServerError)
+	})
+	dir := setupTestDir(t)
+	cfg := &Config{Key: "test-key", URL: srv.URL, Model: "opus", Dir: dir, Runner: runner.RunnerClaude}
+	rr := &testClaudeRunner{fixturePath: "testdata/claude_result.json", beforeRun: func() error {
+		if err := os.WriteFile(filepath.Join(dir, "R1.architecture.md"), []byte("# Architecture"), 0o644); err != nil {
+			return err
+		}
+		return editReviewJSON(dir, func(d *rest.ReviewDraft) {
+			for i := range d.Files {
+				d.Files[i].Summary = "reviewed"
+			}
+		})
+	}}
+
+	err := NewController(cfg, rr, slog.Default()).Review(context.Background())
+	require.ErrorContains(t, err, "upload")
+	assert.Equal(t, reviewer.RunStatusFailed, dc.field("status"))
+	assert.Equal(t, "42", dc.field("reviewId"), "the server counted this run when the review was created")
 }
 
 func TestController_Review_FailsOnUnfilledReview(t *testing.T) {
-	srv, fields := newDebugCaptureServer(t)
+	srv, dc := newDebugCaptureServer(t, nil)
 	cfg := &Config{Key: "test-key", URL: srv.URL, Model: "opus", Dir: t.TempDir(), Runner: runner.RunnerClaude}
 	// The runner never touches review.json, neither on the run nor on the Step 2 retry.
 	rr := &testClaudeRunner{fixturePath: "testdata/claude_result.json"}
@@ -215,13 +272,13 @@ func TestController_Review_FailsOnUnfilledReview(t *testing.T) {
 	err := NewController(cfg, rr, slog.Default()).Review(context.Background())
 	require.ErrorContains(t, err, "empty review")
 	assert.NotEmpty(t, rr.sessionID, "the Step 2 retry resumed the session")
-	assert.Equal(t, reviewer.RunStatusFailed, fields["status"])
-	assert.Equal(t, reviewer.RunReasonNotSubmitted, fields["reason"])
-	assert.Equal(t, "4.175053", fields["costUsd"], "both runs are billed")
+	assert.Equal(t, reviewer.RunStatusFailed, dc.field("status"))
+	assert.Equal(t, reviewer.RunReasonNotSubmitted, dc.field("reason"))
+	assert.Equal(t, "4.175053", dc.field("costUsd"), "both runs are billed")
 }
 
 func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
-	srv, fields := newDebugCaptureServer(t)
+	srv, dc := newDebugCaptureServer(t, nil)
 
 	// Simulate Claude overwriting the skeleton with an invalid review.json
 	// — reproduces the CI failure where the model picks empty reviewType.
@@ -241,8 +298,8 @@ func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
 	err := c.Review(context.Background())
 	require.Error(t, err, "Review must fail on invalid review.json")
 	assert.Contains(t, err.Error(), "invalid reviewType")
-	assert.Contains(t, fields, "errorMsg", "debug bundle must be uploaded on failure")
-	assert.Contains(t, fields["errorMsg"], "files[0]", "errorMsg must carry verbose validation detail")
+	assert.Equal(t, 1, dc.count(), "debug bundle must be uploaded on failure")
+	assert.Contains(t, dc.field("errorMsg"), "files[0]", "errorMsg must carry verbose validation detail")
 }
 
 // failingRunner fails like a real runner: a tagged error plus the partial result
@@ -260,7 +317,7 @@ func (r failingRunner) Name() string      { return r.name }
 func (r failingRunner) SetSession(string) {}
 
 func TestController_Review_ReportsFailureOutcome(t *testing.T) {
-	srv, fields := newDebugCaptureServer(t)
+	srv, dc := newDebugCaptureServer(t, nil)
 
 	tests := []struct {
 		name       string
@@ -293,17 +350,19 @@ func TestController_Review_ReportsFailureOutcome(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			clear(fields)
+			dc.mu.Lock()
+			dc.last = nil
+			dc.mu.Unlock()
 			cfg := &Config{Key: "test-key", URL: srv.URL, Model: "m", Dir: t.TempDir(), Runner: tt.runner.name}
 			err := NewController(cfg, tt.runner, slog.Default()).Review(context.Background())
 			require.Error(t, err)
-			assert.True(t, strings.HasPrefix(fields["errorMsg"], tt.wantMsg), fields["errorMsg"])
-			assert.Equal(t, tt.wantStatus, fields["status"])
-			assert.Equal(t, tt.wantReason, fields["reason"])
+			assert.True(t, strings.HasPrefix(dc.field("errorMsg"), tt.wantMsg), dc.field("errorMsg"))
+			assert.Equal(t, tt.wantStatus, dc.field("status"))
+			assert.Equal(t, tt.wantReason, dc.field("reason"))
 			if tt.runner.cost > 0 {
-				assert.Equal(t, strconv.FormatFloat(tt.runner.cost, 'f', -1, 64), fields["costUsd"])
+				assert.Equal(t, strconv.FormatFloat(tt.runner.cost, 'f', -1, 64), dc.field("costUsd"))
 			} else {
-				assert.NotContains(t, fields, "costUsd")
+				assert.Empty(t, dc.field("costUsd"))
 			}
 		})
 	}
diff --git a/pkg/reviewer/ctl/panel.go b/pkg/reviewer/ctl/panel.go
index e8ccda2..5eb7db8 100644
--- a/pkg/reviewer/ctl/panel.go
+++ b/pkg/reviewer/ctl/panel.go
@@ -29,13 +29,17 @@ type memberOutput struct {
 	mdFiles map[string]string // reviewType → R*.md path in dir
 }
 
+// errAllMembersFailed ends a panel whose members all failed, each of which has
+// shipped its own debug bundle.
+var errAllMembersFailed = errors.New("panel: every member failed to produce a review")
+
 // reviewPanel fans out the --multi panel into per-member git worktrees, then —
 // when a judge is configured and ≥2 members succeed — runs the judge over the
 // members' outputs to produce one fused review. Members and the judge share the
 // project prompt and MR metadata; only runner/model/working dir differ. Members
 // run concurrently (bounded by panelConcurrency), and per-member failures are
 // tolerated as long as one member produces a review.
-func (c *Controller) reviewPanel(ctx context.Context, start time.Time) error {
+func (c *Controller) reviewPanel(ctx context.Context, start time.Time) (err error) {
 	if c.runnerFactory == nil {
 		return errors.New("panel review requires a runner factory")
 	}
@@ -44,6 +48,17 @@ func (c *Controller) reviewPanel(ctx context.Context, start time.Time) error {
 	for i, m := range c.cfg.Multi {
 		members[i] = m.String()
 	}
+	// A failure of the panel itself (prompt fetch, worktree, upload) ships a
+	// bundle and counts in the metrics under the "panel" runner — metadata
+	// only, as the panel writes nothing to the base checkout, and without cost:
+	// the runs report their own. When every member failed, each already has.
+	defer func() {
+		if err != nil && !errors.Is(err, errAllMembersFailed) {
+			pc := *c.cfg
+			pc.Dir, pc.Runner, pc.Model = "", reviewer.PanelRunner, strings.Join(members, " ")
+			c.settleRun(ctx, &pc, nil, err)
+		}
+	}()
 	judge := ""
 	if c.cfg.Judge != nil {
 		judge = c.cfg.Judge.String()
@@ -87,7 +102,7 @@ func (c *Controller) reviewPanel(ctx context.Context, start time.Time) error {
 
 	outputs := c.runMembers(ctx, dirs, labels, prompt)
 	if len(outputs) == 0 {
-		return errors.New("panel: every member failed to produce a review")
+		return errAllMembersFailed
 	}
 
 	primaryID, err := c.finishPanel(ctx, base, commit, outputs)
@@ -317,25 +332,25 @@ func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string
 	for attempt := 1; attempt <= 2; attempt++ { // initial run + one retry
 		// Wipe the previous attempt's root artifacts; the staged members/ subdirs
 		// are untouched (CleanReviewArtifacts only looks at the dir root).
-		if err = CleanReviewArtifacts(judgeDir); err != nil {
-			c.log.WarnContext(ctx, "clean judge artifacts", "err", err)
+		if cerr := CleanReviewArtifacts(judgeDir); cerr != nil {
+			c.log.WarnContext(ctx, "clean judge artifacts", "err", cerr)
 		}
-		if err = WriteReviewSkeleton(judgeDir, &jc); err != nil {
-			return nil, fmt.Errorf("write judge skeleton: %w", err)
+		if werr := WriteReviewSkeleton(judgeDir, &jc); werr != nil {
+			return nil, fmt.Errorf("write judge skeleton: %w", werr)
 		}
 
 		rctx, cancel := withTimeout(ctx, c.cfg.Timeout)
-		_, err := rr.Run(rctx, prompt)
+		_, runErr := rr.Run(rctx, prompt)
 		cancel()
-		if err != nil {
-			lastErr = err
-			c.log.WarnContext(ctx, "judge run failed", "attempt", attempt, "err", err)
+		if runErr != nil {
+			lastErr = runErr
+			c.log.WarnContext(ctx, "judge run failed", "attempt", attempt, "err", runErr)
 			continue
 		}
-		draft, err := ReadReviewJSON(jc.Dir)
-		if err != nil {
-			lastErr = err
-			c.log.WarnContext(ctx, "judge review.json invalid", "attempt", attempt, "err", err)
+		draft, readErr := ReadReviewJSON(jc.Dir)
+		if readErr != nil {
+			lastErr = readErr
+			c.log.WarnContext(ctx, "judge review.json invalid", "attempt", attempt, "err", readErr)
 			continue
 		}
 		if isReviewJSONUnfilled(draft) {
@@ -346,9 +361,9 @@ func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string
 		// Every attempt so far is in the record: the failed ones were billed too.
 		c.applyRunResult(ctx, draft, &jc, rr)
 
-		mdFiles, err := FindMDFiles(jc.Dir)
-		if err != nil {
-			return nil, fmt.Errorf("find judge md files: %w", err)
+		mdFiles, findErr := FindMDFiles(jc.Dir)
+		if findErr != nil {
+			return nil, fmt.Errorf("find judge md files: %w", findErr)
 		}
 		return &memberOutput{label: "judge", dir: judgeDir, draft: draft, mdFiles: mdFiles}, nil
 	}
@@ -428,7 +443,8 @@ func (c *Controller) panelCommit() string {
 // gitWorktreeAdd creates a detached worktree at dir checked out to commit, run
 // from the working repo so git finds it.
 func (c *Controller) gitWorktreeAdd(ctx context.Context, dir, commit string) error {
-	cmd := exec.CommandContext(ctx, "git", "worktree", "add", "--detach", dir, commit)
+	cmd := exec.CommandContext(ctx, "git", reviewer.GitArgs("worktree", "add", "--detach", dir, commit)...)
+	cmd.Env = reviewer.ChildEnv()
 	cmd.Dir = c.cfg.Dir
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
@@ -439,7 +455,8 @@ func (c *Controller) gitWorktreeAdd(ctx context.Context, dir, commit string) err
 // gitWorktreeRemove tears down a worktree. Best-effort; uses a detached context
 // so cleanup still runs when the review context was cancelled.
 func (c *Controller) gitWorktreeRemove(ctx context.Context, dir string) {
-	cmd := exec.CommandContext(context.WithoutCancel(ctx), "git", "worktree", "remove", "--force", dir)
+	cmd := exec.CommandContext(context.WithoutCancel(ctx), "git", reviewer.GitArgs("worktree", "remove", "--force", dir)...)
+	cmd.Env = reviewer.ChildEnv()
 	cmd.Dir = c.cfg.Dir
 	if out, err := cmd.CombinedOutput(); err != nil {
 		c.log.WarnContext(ctx, "worktree remove", "dir", dir, "err", err, "out", strings.TrimSpace(string(out)))
diff --git a/pkg/reviewer/ctl/panel_test.go b/pkg/reviewer/ctl/panel_test.go
index e3ae870..08e9718 100644
--- a/pkg/reviewer/ctl/panel_test.go
+++ b/pkg/reviewer/ctl/panel_test.go
@@ -104,6 +104,25 @@ func TestGitWorktreeAddRemove(t *testing.T) {
 	assert.NoDirExists(t, wt, "worktree dir must be gone after remove")
 }
 
+func TestGitWorktreeAddIgnoresPlantedHooks(t *testing.T) {
+	repo := t.TempDir()
+	runGit(t, repo, "init", "-q")
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "file.txt"), []byte("hi"), 0o600))
+	runGit(t, repo, "add", ".")
+	runGit(t, repo, "-c", "user.email=t@example.com", "-c", "user.name=t", "commit", "-q", "-m", "init")
+	// What an agent with write access to the checkout could plant: a hook in the
+	// .git that every panel worktree shares.
+	marker := filepath.Join(t.TempDir(), "hook-ran")
+	hook := filepath.Join(repo, ".git", "hooks", "post-checkout")
+	require.NoError(t, os.WriteFile(hook, []byte("#!/bin/sh\ntouch "+marker+"\n"), 0o755))
+
+	c := &Controller{cfg: &Config{Dir: repo}, log: slog.Default()}
+	wt := filepath.Join(t.TempDir(), "wt-judge")
+	require.NoError(t, c.gitWorktreeAdd(t.Context(), wt, "HEAD"))
+	t.Cleanup(func() { c.gitWorktreeRemove(context.Background(), wt) })
+	assert.NoFileExists(t, marker, "reviewctl must not run hooks from the checkout")
+}
+
 func TestRunMembers_ToleratesFailures(t *testing.T) {
 	// Failed members must ship their artifacts as a debug bundle BEFORE panel
 	// cleanup wipes the worktree (its only copy) — count the uploads.
@@ -256,7 +275,7 @@ func TestSourceLabels(t *testing.T) {
 }
 
 func TestRunJudge_FailureShipsDebugBundle(t *testing.T) {
-	srv, fields := newDebugCaptureServer(t)
+	srv, dc := newDebugCaptureServer(t, nil)
 	mdir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(mdir, "review.json"), []byte(`{"issues":[]}`), 0o600))
 	outputs := []*memberOutput{{label: "opus", dir: mdir}}
@@ -269,8 +288,45 @@ func TestRunJudge_FailureShipsDebugBundle(t *testing.T) {
 
 	_, err := c.runJudge(t.Context(), t.TempDir(), "fuse the members", outputs)
 	require.ErrorContains(t, err, "judge produced an empty review")
-	assert.Equal(t, reviewer.RunStatusFailed, fields["status"])
-	assert.Equal(t, reviewer.RunReasonNotSubmitted, fields["reason"])
-	assert.Equal(t, "1", fields["costUsd"], "both judge attempts are billed")
-	assert.Equal(t, runner.RunnerClaude, fields["runner"])
+	assert.Equal(t, reviewer.RunStatusFailed, dc.field("status"))
+	assert.Equal(t, reviewer.RunReasonNotSubmitted, dc.field("reason"))
+	assert.Equal(t, "1", dc.field("costUsd"), "both judge attempts are billed")
+	assert.Equal(t, runner.RunnerClaude, dc.field("runner"))
+}
+
+func TestReviewPanel_ShipsPanelLevelFailure(t *testing.T) {
+	srv, dc := newDebugCaptureServer(t, nil)
+	// A checkout that doesn't exist: no worktree, so no member ever runs — the
+	// panel itself must report the failure.
+	cfg := &Config{Key: "k", URL: srv.URL, Dir: filepath.Join(t.TempDir(), "missing"), Commit: "abc123",
+		Runner: runner.RunnerClaude, Multi: []MemberSpec{{Runner: runner.RunnerClaude, Model: "opus"}}}
+	c := NewController(cfg, nil, slog.Default(), WithRunnerFactory(func(*Config) (runner.ReviewRunner, error) {
+		return failingRunner{name: runner.RunnerClaude}, nil
+	}))
+
+	err := c.Review(t.Context())
+	require.ErrorContains(t, err, "worktree add")
+	assert.Equal(t, 1, dc.count())
+	assert.Equal(t, reviewer.RunStatusFailed, dc.field("status"))
+	assert.Equal(t, reviewer.PanelRunner, dc.field("runner"), "not the primary profile's runner")
+	assert.Equal(t, "claude:opus", dc.field("model"))
+	assert.Contains(t, dc.field("errorMsg"), "worktree add")
+}
+
+func TestReviewPanel_AllMembersFailedReportsEachOnce(t *testing.T) {
+	srv, dc := newDebugCaptureServer(t, nil)
+	repo := t.TempDir()
+	runGit(t, repo, "init", "-q")
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "file.txt"), []byte("hi"), 0o600))
+	runGit(t, repo, "add", ".")
+	runGit(t, repo, "-c", "user.email=t@example.com", "-c", "user.name=t", "commit", "-q", "-m", "init")
+	cfg := &Config{Key: "k", URL: srv.URL, Dir: repo, Commit: "HEAD", Runner: runner.RunnerClaude,
+		Multi: []MemberSpec{{Runner: runner.RunnerClaude, Model: "a"}, {Runner: runner.RunnerCodex, Model: "b"}}}
+	c := NewController(cfg, nil, slog.Default(), WithRunnerFactory(func(mc *Config) (runner.ReviewRunner, error) {
+		return failingRunner{name: mc.Runner, err: errors.New("boom")}, nil
+	}))
+
+	err := c.Review(t.Context())
+	require.ErrorIs(t, err, errAllMembersFailed)
+	assert.Equal(t, 2, dc.count(), "one bundle per failed member, none for the panel on top")
 }
diff --git a/pkg/reviewer/ctl/upload.go b/pkg/reviewer/ctl/upload.go
index bcc0e84..854a5f7 100644
--- a/pkg/reviewer/ctl/upload.go
+++ b/pkg/reviewer/ctl/upload.go
@@ -122,16 +122,26 @@ func (c *UploadClient) UploadAll(ctx context.Context, serverURL, projectKey stri
 	for reviewType, filePath := range mdFiles {
 		content, err := os.ReadFile(filePath)
 		if err != nil {
-			return reviewID, fmt.Errorf("read %s: %w", filePath, err)
+			return reviewID, &reviewCreatedError{reviewID: reviewID, err: fmt.Errorf("read %s: %w", filePath, err)}
 		}
 		if err := c.UploadFile(ctx, serverURL, projectKey, reviewID, reviewType, content); err != nil {
-			return reviewID, err
+			return reviewID, &reviewCreatedError{reviewID: reviewID, err: err}
 		}
 	}
 
 	return reviewID, nil
 }
 
+// reviewCreatedError is a failure after the review itself was created, which
+// already counted the run as ok on the server; its debug bundle says so.
+type reviewCreatedError struct {
+	reviewID int
+	err      error
+}
+
+func (e *reviewCreatedError) Error() string { return e.err.Error() }
+func (e *reviewCreatedError) Unwrap() error { return e.err }
+
 // ReadReviewJSON reads and validates review.json from the given directory.
 // On validation failure, also returns the parsed draft so the caller can
 // surface diagnostic detail without re-reading the file.
@@ -180,6 +190,7 @@ type DebugMeta struct {
 	Status       string  // reviewer.RunStatus*
 	Reason       string  // reviewer.RunReason*; empty for an ok run
 	CostUsd      float64 // what the run spent, including a failed run
+	ReviewID     int     // the review created before the run failed, if any
 }
 
 // UploadDebugBundle posts artifacts as a multipart form with each file
@@ -242,6 +253,7 @@ func buildDebugMultipart(meta DebugMeta, files map[string][]byte) (io.Reader, st
 		{debug.FieldStatus, meta.Status},
 		{debug.FieldReason, meta.Reason},
 		{debug.FieldCostUsd, formatCost(meta.CostUsd)},
+		{debug.FieldReviewID, formatID(meta.ReviewID)},
 	}
 	for _, f := range fields {
 		if f.value == "" {
@@ -285,6 +297,14 @@ func formatCost(usd float64) string {
 	return strconv.FormatFloat(usd, 'f', -1, 64)
 }
 
+// formatID renders an optional id for a form field; "" when unset.
+func formatID(id int) string {
+	if id <= 0 {
+		return ""
+	}
+	return strconv.Itoa(id)
+}
+
 // reviewArtifactFiles are the fixed-name outputs a runner writes into the review
 // directory (the R*.md bodies are matched separately by FindMDFiles). The
 // canonical set lives in the reviewer package, shared with the direct runner's
@@ -294,6 +314,9 @@ var reviewArtifactFiles = reviewer.ReviewArtifactFiles
 // CollectDebugArtifacts reads the artifacts that reviewctl writes during a run.
 // Missing files are silently skipped — the caller wants whatever is on disk.
 func CollectDebugArtifacts(dir string) map[string][]byte {
+	if dir == "" { // a run with no working dir of its own, e.g. a failed panel
+		return nil
+	}
 	out := make(map[string][]byte, len(reviewArtifactFiles)+len(reviewTypeByPrefix))
 
 	for _, name := range reviewArtifactFiles {
diff --git a/pkg/reviewer/ctl/upload_test.go b/pkg/reviewer/ctl/upload_test.go
index 14d310e..4b80d92 100644
--- a/pkg/reviewer/ctl/upload_test.go
+++ b/pkg/reviewer/ctl/upload_test.go
@@ -298,3 +298,10 @@ func TestCleanReviewArtifacts(t *testing.T) {
 	// Idempotent: clean again on an already-clean dir is a no-op, no error.
 	require.NoError(t, CleanReviewArtifacts(dir))
 }
+
+func TestCollectDebugArtifactsWithoutDir(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "review.json"), []byte("{}"), 0o600))
+	t.Chdir(dir)
+	assert.Nil(t, CollectDebugArtifacts(""), "no dir means no artifacts, not the current one")
+}
diff --git a/pkg/reviewer/direct/errors.go b/pkg/reviewer/direct/errors.go
index ba86f88..37835ac 100644
--- a/pkg/reviewer/direct/errors.go
+++ b/pkg/reviewer/direct/errors.go
@@ -2,11 +2,12 @@ package direct
 
 import (
 	"cmp"
-	"context"
 	"errors"
 	"fmt"
+	"io"
+	"net"
 	"net/http"
-	"strings"
+	"net/url"
 
 	"reviewsrv/pkg/reviewer"
 
@@ -17,19 +18,24 @@ import (
 // providerReason maps a failed LLMProvider.Complete (after the provider's own
 // retries) to a reviewer.RunReason*.
 func providerReason(err error) string {
-	var ae *anthropic.Error
-	if errors.As(err, &ae) {
+	var (
+		ae     *anthropic.Error
+		apiErr *openai.APIError
+		reqErr *openai.RequestError
+		rf     *responseFailedError
+	)
+	switch {
+	case errors.As(err, &ae):
 		return anthropicReason(ae)
-	}
-	var oe *openai.APIError
-	if errors.As(err, &oe) {
-		return openaiReason(oe)
-	}
-	var rf *responseFailedError
-	if errors.As(err, &rf) {
+	case errors.As(err, &apiErr):
+		return openaiReason(apiErr)
+	case errors.As(err, &reqErr):
+		// An error body go-openai could not decode (a proxy's HTML page).
+		return reviewer.ReasonForHTTPStatus(reqErr.HTTPStatusCode)
+	case errors.As(err, &rf):
 		return rf.reason()
 	}
-	// Not an API error: a transport failure (reset stream, EOF, refused
+	// No API answer: a transport failure (reset stream, EOF, refused
 	// connection) that outlived the retries.
 	return reviewer.RunReasonAPIError
 }
@@ -37,7 +43,7 @@ func providerReason(err error) string {
 // anthropicReason classifies an Anthropic API error by its body type, falling
 // back to the HTTP status. Errors inside the SSE stream carry the stream's 200.
 func anthropicReason(e *anthropic.Error) string {
-	if isCreditBalanceError(e.RawJSON()) {
+	if reviewer.IsBillingMessage(e.RawJSON()) {
 		return reviewer.RunReasonBilling
 	}
 	switch e.Type() {
@@ -54,12 +60,6 @@ func anthropicReason(e *anthropic.Error) string {
 	return reviewer.ReasonForHTTPStatus(e.StatusCode)
 }
 
-// isCreditBalanceError catches an exhausted balance reported as a plain
-// invalid_request_error ("Your credit balance is too low ...").
-func isCreditBalanceError(body string) bool {
-	return strings.Contains(strings.ToLower(body), "credit balance")
-}
-
 // openaiReason classifies an OpenAI-protocol API error (OpenAI, DeepSeek, ...)
 // by its code or type, falling back to the HTTP status.
 func openaiReason(e *openai.APIError) string {
@@ -112,20 +112,33 @@ func (e *responseFailedError) reason() string {
 }
 
 // isOpenAITransient reports whether an OpenAI-protocol call is worth retrying:
-// a rate limit or server-side API error — as an HTTP status or inside a failed
-// Responses reply — or a network-level request error. Billing
-// (insufficient_quota also comes as a 429) and auth are definitive.
+// a rate limit or server-side error — by HTTP status or inside a failed
+// Responses reply — or a transport failure with no answer (go-openai returns it
+// bare, e.g. a *url.Error). Billing (insufficient_quota also comes as a 429),
+// auth and bad requests are definitive, and so is anything else: go-openai's
+// own request validation fails the same way every time. A cancelled context is
+// withRetry's call.
 func isOpenAITransient(err error) bool {
-	var apiErr *openai.APIError
-	if errors.As(err, &apiErr) {
-		return isTransientReason(openaiReason(apiErr))
+	var (
+		apiErr *openai.APIError
+		reqErr *openai.RequestError
+		rf     *responseFailedError
+	)
+	if errors.As(err, &apiErr) || errors.As(err, &reqErr) || errors.As(err, &rf) {
+		return isTransientReason(providerReason(err))
 	}
-	var rf *responseFailedError
-	if errors.As(err, &rf) {
-		return isTransientReason(rf.reason())
-	}
-	var reqErr *openai.RequestError
-	return errors.As(err, &reqErr)
+	return isTransportError(err)
+}
+
+// isTransportError reports a failure with no HTTP answer: a reset, refused or
+// timed-out connection, or a body cut short.
+func isTransportError(err error) bool {
+	var (
+		urlErr *url.Error
+		netErr net.Error
+	)
+	return errors.As(err, &urlErr) || errors.As(err, &netErr) ||
+		errors.Is(err, io.ErrUnexpectedEOF) || errors.Is(err, io.EOF)
 }
 
 // isTransientReason reports whether a failure of that reason may pass on retry.
@@ -139,9 +152,6 @@ func isTransientReason(reason string) bool {
 // error event inside the SSE stream (200 + api_error/overloaded_error) and a
 // reset HTTP/2 stream — a bare transport error, hence retry-by-default.
 func isAnthropicTransient(err error) bool {
-	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
-		return false
-	}
 	var ae *anthropic.Error
 	if !errors.As(err, &ae) {
 		return true
@@ -149,7 +159,7 @@ func isAnthropicTransient(err error) bool {
 	switch ae.Type() {
 	case anthropic.ErrorTypeRateLimitError, anthropic.ErrorTypeOverloadedError,
 		anthropic.ErrorTypeAPIError, anthropic.ErrorTypeTimeoutError:
-		return !isCreditBalanceError(ae.RawJSON())
+		return !reviewer.IsBillingMessage(ae.RawJSON())
 	case anthropic.ErrorTypeInvalidRequestError, anthropic.ErrorTypeAuthenticationError, anthropic.ErrorTypePermissionError,
 		anthropic.ErrorTypeNotFoundError, anthropic.ErrorTypeBillingError:
 		return false
diff --git a/pkg/reviewer/direct/provider_anthropic_test.go b/pkg/reviewer/direct/provider_anthropic_test.go
index b4e3f89..62ecd13 100644
--- a/pkg/reviewer/direct/provider_anthropic_test.go
+++ b/pkg/reviewer/direct/provider_anthropic_test.go
@@ -1,9 +1,7 @@
 package direct
 
 import (
-	"context"
 	"errors"
-	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -159,6 +157,4 @@ func TestAnthropicCompleteFailsFastOnBilling(t *testing.T) {
 
 func TestIsAnthropicTransient(t *testing.T) {
 	require.True(t, isAnthropicTransient(errors.New("stream error: stream ID 41; INTERNAL_ERROR; received from peer")))
-	require.False(t, isAnthropicTransient(context.Canceled))
-	require.False(t, isAnthropicTransient(fmt.Errorf("post: %w", context.DeadlineExceeded)))
 }
diff --git a/pkg/reviewer/direct/provider_openai_test.go b/pkg/reviewer/direct/provider_openai_test.go
index 4e87f8f..7120b40 100644
--- a/pkg/reviewer/direct/provider_openai_test.go
+++ b/pkg/reviewer/direct/provider_openai_test.go
@@ -3,10 +3,13 @@ package direct
 import (
 	"context"
 	"encoding/json"
-	"errors"
+	"io"
+	"net/url"
 	"testing"
 	"time"
 
+	"reviewsrv/pkg/reviewer"
+
 	openai "github.com/sashabaranov/go-openai"
 	"github.com/stretchr/testify/require"
 )
@@ -46,8 +49,25 @@ func TestIsOpenAITransient(t *testing.T) {
 	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 400}))
 	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 401}))
 	require.False(t, isOpenAITransient(&openai.APIError{HTTPStatusCode: 429, Code: "insufficient_quota"}), "an exhausted quota is billing, not a rate limit")
-	require.True(t, isOpenAITransient(&openai.RequestError{HTTPStatusCode: 500}))
-	require.False(t, isOpenAITransient(errors.New("plain error")))
+
+	// An error body go-openai can't decode (a proxy's HTML page) keeps its status.
+	require.True(t, isOpenAITransient(&openai.RequestError{HTTPStatusCode: 502}))
+	require.False(t, isOpenAITransient(&openai.RequestError{HTTPStatusCode: 401}))
+	require.False(t, isOpenAITransient(&openai.RequestError{HTTPStatusCode: 402}))
+
+	// No HTTP answer at all: go-openai returns the transport error as is.
+	require.True(t, isOpenAITransient(&url.Error{Op: "Post", URL: "https://api.openai.com/v1/responses", Err: io.ErrUnexpectedEOF}))
+	require.True(t, isOpenAITransient(io.ErrUnexpectedEOF))
+	// Anything else — e.g. go-openai rejecting the request before sending it —
+	// fails the same way on every attempt.
+	require.False(t, isOpenAITransient(openai.ErrReasoningModelMaxTokensDeprecated))
+}
+
+func TestProviderReasonOpenAIShapes(t *testing.T) {
+	require.Equal(t, reviewer.RunReasonBilling, providerReason(&openai.RequestError{HTTPStatusCode: 402}))
+	require.Equal(t, reviewer.RunReasonAuth, providerReason(&openai.RequestError{HTTPStatusCode: 401}))
+	require.Equal(t, reviewer.RunReasonBilling, providerReason(&openai.APIError{HTTPStatusCode: 429, Code: "insufficient_quota"}))
+	require.Equal(t, reviewer.RunReasonAPIError, providerReason(&url.Error{Op: "Post", URL: "x", Err: io.ErrUnexpectedEOF}))
 }
 
 func TestToOpenAIMessagesSkipsBareAssistant(t *testing.T) {
diff --git a/pkg/reviewer/direct/tools_git.go b/pkg/reviewer/direct/tools_git.go
index 4be2ccc..466d684 100644
--- a/pkg/reviewer/direct/tools_git.go
+++ b/pkg/reviewer/direct/tools_git.go
@@ -257,8 +257,9 @@ func gitDiff(ctx context.Context, root, base, head, path string) (string, error)
 // runGit runs git -C root with the given args. When allowExit1 is set, an exit
 // code of 1 (git diff "differences found") is treated as success.
 func runGit(ctx context.Context, root string, allowExit1 bool, args ...string) (string, error) {
-	full := append([]string{"-C", root}, args...)
-	out, err := exec.CommandContext(ctx, "git", full...).Output()
+	cmd := exec.CommandContext(ctx, "git", reviewer.GitArgs(append([]string{"-C", root}, args...)...)...)
+	cmd.Env = reviewer.ChildEnv()
+	out, err := cmd.Output()
 	if err == nil {
 		return string(out), nil
 	}
diff --git a/pkg/reviewer/project.go b/pkg/reviewer/project.go
index 52acbf5..6456cd6 100644
--- a/pkg/reviewer/project.go
+++ b/pkg/reviewer/project.go
@@ -14,6 +14,14 @@ import (
 // cmd/reviewctl alias it so the prompt reference and the injected env can't drift.
 const EnvTrackerToken = "REVIEW_TRACKER_TOKEN"
 
+// reviewctl's own secrets from the CI env: canonical names, which cmd/reviewctl
+// reads and pkg/reviewer/runner keeps out of the agents' env.
+const (
+	EnvProjectKey  = "PROJECT_KEY"
+	EnvGitLabToken = "REVIEWER_GITLAB_TOKEN"
+	EnvAPIKey      = "REVIEW_API_KEY" // the direct runner's provider-agnostic key
+)
+
 type ProjectManager struct {
 	repo       db.ProjectRepo
 	reviewRepo db.ReviewRepo
diff --git a/pkg/reviewer/run_metrics.go b/pkg/reviewer/run_metrics.go
index 55080a7..3724afc 100644
--- a/pkg/reviewer/run_metrics.go
+++ b/pkg/reviewer/run_metrics.go
@@ -9,6 +9,10 @@ const (
 	metricOtherRunner    = "other"
 )
 
+// PanelRunner is the runner label of a multi-review panel's own failure (prompt
+// fetch, worktree, upload), outside any member or judge run.
+const PanelRunner = "panel"
+
 // maxRunCostUsd bounds a plausible run cost (a 500-round Opus run stays well
 // below it): a higher client-reported value is not added to the cost counter,
 // which only ever grows.
diff --git a/pkg/reviewer/run_outcome.go b/pkg/reviewer/run_outcome.go
index 2bf079b..5ec03aa 100644
--- a/pkg/reviewer/run_outcome.go
+++ b/pkg/reviewer/run_outcome.go
@@ -4,6 +4,9 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
 )
 
 // Status of a reviewctl run, reported with its debug bundle. The status and
@@ -57,6 +60,54 @@ func ReasonForHTTPStatus(code int) string {
 	return RunReasonOther
 }
 
+// httpStatusRe finds an HTTP status in CLI error text: "unexpected status 401",
+// "last status: 429", "statusCode: 429", "HTTP 502".
+var httpStatusRe = regexp.MustCompile(`\b(?:status(?:\s*code)?|http)[\s:=]*([45]\d\d)\b`) // on lowercased text
+
+// ReasonFromMessage guesses a RunReason* from a CLI's error text (codex and
+// opencode report API failures only as text), or "" when nothing matches.
+// Billing wording goes first: an exhausted quota often comes as a 429.
+func ReasonFromMessage(msg string) string {
+	if IsBillingMessage(msg) {
+		return RunReasonBilling
+	}
+	m := strings.ToLower(msg)
+	if sm := httpStatusRe.FindStringSubmatch(m); sm != nil {
+		code, _ := strconv.Atoi(sm[1])
+		if r := ReasonForHTTPStatus(code); r != RunReasonOther {
+			return r
+		}
+	}
+	switch {
+	case containsAny(m, "unauthorized", "invalid api key", "invalid_api_key", "authentication"):
+		return RunReasonAuth
+	case containsAny(m, "rate limit", "rate_limit", "too many requests"):
+		return RunReasonRateLimit
+	case containsAny(m, "overloaded", "internal server error", "server_error", "service unavailable", "bad gateway"):
+		return RunReasonAPIError
+	}
+	return ""
+}
+
+// IsBillingMessage reports whether an error text says the account is out of
+// credit or quota ("Your credit balance is too low", insufficient_quota, a
+// plan's usage limit). Deliberately narrow: a per-minute "Quota exceeded ...
+// check your plan and billing details" is a rate limit, not billing.
+func IsBillingMessage(msg string) bool {
+	return containsAny(strings.ToLower(msg), "insufficient_quota", "credit balance", "usage limit")
+}
+
+// containsAny reports whether s contains any of subs (whole substrings, unlike
+// strings.ContainsAny).
+func containsAny(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if strings.Contains(s, sub) {
+			return true
+		}
+	}
+	return false
+}
+
 // RunError tags a runner failure with a RunReason* so the controller reports a
 // bounded reason without parsing the message. The message is the wrapped error's.
 type RunError struct {
@@ -67,10 +118,13 @@ type RunError struct {
 func (e *RunError) Error() string { return e.Err.Error() }
 func (e *RunError) Unwrap() error { return e.Err }
 
-// WithRunReason tags err with a failure reason. A nil err or an empty reason
-// returns err unchanged.
+// WithRunReason tags err with a failure reason. A nil err, an empty reason or
+// an err already tagged (the tag closest to the cause wins — e.g. runExec's
+// cancelled over a reason guessed from the runner's output) returns err
+// unchanged.
 func WithRunReason(reason string, err error) error {
-	if err == nil || reason == "" {
+	var tagged *RunError
+	if err == nil || reason == "" || errors.As(err, &tagged) {
 		return err
 	}
 	return &RunError{Reason: reason, Err: err}
diff --git a/pkg/reviewer/run_outcome_test.go b/pkg/reviewer/run_outcome_test.go
index 86e2f76..a3256b1 100644
--- a/pkg/reviewer/run_outcome_test.go
+++ b/pkg/reviewer/run_outcome_test.go
@@ -68,3 +68,33 @@ func TestNormalizeRunOutcome(t *testing.T) {
 		})
 	}
 }
+
+func TestReasonFromMessage(t *testing.T) {
+	for _, tt := range []struct{ msg, want string }{
+		{"unexpected status 401 Unauthorized: Incorrect API key provided", RunReasonAuth},
+		{"exceeded retry limit, last status: 429 Too Many Requests", RunReasonRateLimit},
+		{"You've hit your usage limit. Upgrade to Pro", RunReasonBilling},
+		{"status 429: insufficient_quota", RunReasonBilling},
+		{"HTTP 502 Bad Gateway", RunReasonAPIError},
+		{"stream disconnected: model is overloaded", RunReasonAPIError},
+		{"unexpected status 400 Bad Request: invalid tool schema", ""},
+		{"APICallError: statusCode: 429", RunReasonRateLimit},
+		{"Quota exceeded for quota metric per minute; check your plan and billing details. status 429", RunReasonRateLimit},
+		{"401 Unauthorized", RunReasonAuth},
+		{"Rate limit reached for requests", RunReasonRateLimit},
+		{"HTTP 404 Not Found", ""},
+		{"fetch https://example.com/v1/models failed", ""},
+		{"panic: runtime error", ""},
+	} {
+		assert.Equal(t, tt.want, ReasonFromMessage(tt.msg), tt.msg)
+	}
+}
+
+func TestWithRunReasonKeepsExistingTag(t *testing.T) {
+	cancelled := WithRunReason(RunReasonCancelled, errors.New("signal: terminated"))
+	// A reason guessed from the runner's output must not mask runExec's tag.
+	err := WithRunReason(RunReasonBilling, fmt.Errorf("usage limit (codex %w)", cancelled))
+	status, reason := RunOutcome(err)
+	assert.Equal(t, RunStatusCancelled, status)
+	assert.Equal(t, RunReasonCancelled, reason)
+}
diff --git a/pkg/reviewer/runner/claude.go b/pkg/reviewer/runner/claude.go
index 5a3a2b7..b1e4be6 100644
--- a/pkg/reviewer/runner/claude.go
+++ b/pkg/reviewer/runner/claude.go
@@ -528,11 +528,6 @@ func (w *lineWriter) flush() {
 	}
 }
 
-// runExec spawns the runner CLI under the shared runnerTimeout and captures
-// stdout/stderr. Centralising I/O wiring keeps the per-runner Run() bodies
-// focused on argv and result parsing. When onLine is non-nil it receives each
-// stdout line as it streams, so a runner can surface significant events live
-// (e.g. tool calls from a JSONL agent stream) instead of only after completion.
 // Credential env var names CLI runners read their API key from, plus the
 // task-tracker token. envTrackerToken aliases the canonical reviewer const so
 // the $REVIEW_TRACKER_TOKEN reference in assembled prompts and the env injected
@@ -555,6 +550,11 @@ func credEnv(varName, token string) []string {
 	return []string{varName + "=" + token}
 }
 
+// runExec spawns the runner CLI under the shared runnerTimeout and captures
+// stdout/stderr. Centralising I/O wiring keeps the per-runner Run() bodies
+// focused on argv and result parsing. When onLine is non-nil it receives each
+// stdout line as it streams, so a runner can surface significant events live
+// (e.g. tool calls from a JSONL agent stream) instead of only after completion.
 func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []string, prompt string, extraEnv []string, onLine func([]byte)) *runOutput {
 	ctx, cancel := context.WithTimeout(ctx, runnerTimeout)
 	defer cancel()
@@ -562,12 +562,7 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	cmd := exec.CommandContext(ctx, binary, args...)
 	cmd.Dir = dir
 	cmd.Stdin = strings.NewReader(prompt)
-	// extraEnv comes last: for a key also in the ambient env (a merged
-	// OPENCODE_CONFIG_CONTENT) os/exec keeps the last value. nil extraEnv leaves
-	// cmd.Env nil = inherit.
-	if len(extraEnv) > 0 {
-		cmd.Env = append(os.Environ(), extraEnv...)
-	}
+	cmd.Env = reviewer.ChildEnv(extraEnv...)
 
 	out := &runOutput{}
 	var lw *lineWriter
diff --git a/pkg/reviewer/runner/claude_failure.go b/pkg/reviewer/runner/claude_failure.go
index be6d392..46df4cb 100644
--- a/pkg/reviewer/runner/claude_failure.go
+++ b/pkg/reviewer/runner/claude_failure.go
@@ -62,9 +62,11 @@ func claudeRunError(err error, cr *ClaudeResult, stdout []byte, stderr string) e
 // claudeReason maps a Claude Code error kind (falling back to the HTTP status and
 // the result text) to a RunReason.
 func claudeReason(kind string, status int, text string) string {
-	switch kind {
-	case claudeErrBilling:
+	if kind == claudeErrBilling || reviewer.IsBillingMessage(text) {
+		// Before the status: an exhausted balance can come as a 400 or a 429.
 		return reviewer.RunReasonBilling
+	}
+	switch kind {
 	case claudeErrAuth:
 		return reviewer.RunReasonAuth
 	case claudeErrRateLimit:
@@ -75,6 +77,9 @@ func claudeReason(kind string, status int, text string) string {
 	if r := reviewer.ReasonForHTTPStatus(status); r != reviewer.RunReasonOther {
 		return r
 	}
+	if r := reviewer.ReasonFromMessage(text); r != "" {
+		return r
+	}
 	if strings.HasPrefix(text, claudeAPIErrorPrefix) {
 		return reviewer.RunReasonAPIError
 	}
@@ -114,6 +119,17 @@ func lastAssistantError(stdout []byte) (kind, text string) {
 	return kind, text
 }
 
+// errTail is the end of a CLI's error output, where its final error sits: the
+// lines before it (stack traces, the checkout's paths) would only mislead
+// ReasonFromMessage.
+func errTail(s string) string {
+	const n = 2000
+	if len(s) <= n {
+		return s
+	}
+	return s[len(s)-n:]
+}
+
 // isInterrupted reports whether a subprocess was stopped by SIGTERM/SIGINT —
 // killed outright ("signal: terminated") or exiting 128+signo after handling it
 // (143/130), as Claude Code does. In CI that is a cancelled job.
diff --git a/pkg/reviewer/runner/claude_failure_test.go b/pkg/reviewer/runner/claude_failure_test.go
index 5bf01f1..05ee616 100644
--- a/pkg/reviewer/runner/claude_failure_test.go
+++ b/pkg/reviewer/runner/claude_failure_test.go
@@ -121,6 +121,8 @@ func TestClaudeReason(t *testing.T) {
 		{claudeErrServer, 0, "", reviewer.RunReasonAPIError},
 		{claudeErrUnknown, 529, "", reviewer.RunReasonAPIError},
 		{claudeErrUnknown, 0, "API Error: Internal server error", reviewer.RunReasonAPIError},
+		{claudeErrUnknown, 0, "API Error: Connection error.", reviewer.RunReasonAPIError},
+		{claudeErrUnknown, 429, "Your credit balance is too low", reviewer.RunReasonBilling},
 		{"invalid_request", 400, "prompt is too long", reviewer.RunReasonOther},
 	}
 	for _, tt := range tests {
diff --git a/pkg/reviewer/runner/cli_failure_test.go b/pkg/reviewer/runner/cli_failure_test.go
new file mode 100644
index 0000000..af68644
--- /dev/null
+++ b/pkg/reviewer/runner/cli_failure_test.go
@@ -0,0 +1,69 @@
+package runner
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"reviewsrv/pkg/reviewer"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeCLI puts an executable sh script called name first on PATH.
+func fakeCLI(t *testing.T, name, script string) {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte("#!/bin/sh\n"+script+"\n"), 0o755))
+	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
+}
+
+func TestExecCodexRunnerTagsAPIFailure(t *testing.T) {
+	for _, tt := range []struct{ name, script, want string }{
+		{"billing from the error event",
+			`echo '{"type":"turn.failed","error":{"message":"You exceeded your current quota: insufficient_quota"}}'; exit 1`,
+			reviewer.RunReasonBilling},
+		{"auth from stderr when nothing streamed",
+			`echo 'unexpected status 401 Unauthorized' >&2; exit 1`,
+			reviewer.RunReasonAuth},
+		{"a cancelled job stays cancelled",
+			`echo '{"type":"turn.failed","error":{"message":"insufficient_quota"}}'; exit 143`,
+			reviewer.RunReasonCancelled},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeCLI(t, "codex", tt.script)
+			r := &ExecCodexRunner{Dir: t.TempDir(), Log: slog.New(slog.DiscardHandler)}
+			_, err := r.Run(t.Context(), "review")
+			require.Error(t, err)
+			_, reason := reviewer.RunOutcome(err)
+			assert.Equal(t, tt.want, reason)
+		})
+	}
+}
+
+func TestExecOpenCodeRunnerTagsAPIFailure(t *testing.T) {
+	for _, tt := range []struct {
+		name, script, want string
+		partial            bool
+	}{
+		{"auth from stderr", `echo 'Error: 401 Unauthorized' >&2; exit 1`, reviewer.RunReasonAuth, false},
+		{"rate limit after some steps",
+			`echo '{"type":"step_finish","sessionID":"s","part":{"reason":"tool-calls","tokens":{"input":1,"output":1}}}'
+echo 'AI_APICallError: statusCode: 429' >&2; exit 1`,
+			reviewer.RunReasonRateLimit, true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			fakeCLI(t, "opencode", tt.script)
+			dir := t.TempDir()
+			require.NoError(t, os.Mkdir(filepath.Join(dir, ".git"), 0o755))
+			r := &ExecOpenCodeRunner{Dir: dir, Log: slog.New(slog.DiscardHandler)}
+			cr, err := r.Run(t.Context(), "review")
+			require.Error(t, err)
+			assert.Equal(t, tt.partial, cr != nil, "a parsed partial result is kept")
+			_, reason := reviewer.RunOutcome(err)
+			assert.Equal(t, tt.want, reason)
+		})
+	}
+}
diff --git a/pkg/reviewer/runner/codex.go b/pkg/reviewer/runner/codex.go
index 67461c1..829b728 100644
--- a/pkg/reviewer/runner/codex.go
+++ b/pkg/reviewer/runner/codex.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/direct"
 )
 
@@ -116,12 +117,15 @@ func (r *ExecCodexRunner) Run(ctx context.Context, prompt string) (*ClaudeResult
 	if out.stdout.Len() == 0 {
 		r.Log.WarnContext(ctx, "codex produced empty stdout", "stderr", truncate(out.stderr.String(), 2000))
 		if out.err != nil {
-			return nil, fmt.Errorf("codex exited with error: %w (stderr: %s)", out.err, truncate(out.stderr.String(), 500))
+			stderr := out.stderr.String()
+			return nil, reviewer.WithRunReason(reviewer.ReasonFromMessage(errTail(stderr)),
+				fmt.Errorf("codex exited with error: %w (stderr: %s)", out.err, truncate(stderr, 500)))
 		}
 		return nil, errors.New("codex produced empty output")
 	}
 
-	cr := r.result(parseCodexStream(out.stdout.Bytes()))
+	agg := parseCodexStream(out.stdout.Bytes())
+	cr := r.result(agg)
 	// codex events report no duration: take the subprocess wall-clock time.
 	cr.DurationMs = int(out.elapsed.Milliseconds())
 	// codex can report a structured failure with a zero exit code; conversely a
@@ -133,7 +137,14 @@ func (r *ExecCodexRunner) Run(ctx context.Context, prompt string) (*ClaudeResult
 
 	if out.err != nil {
 		r.Log.WarnContext(ctx, "codex error", "stderr", truncate(out.stderr.String(), 2000))
-		return cr, fmt.Errorf("codex exited with error: %w", out.err)
+		if agg.errMsg == "" {
+			return cr, fmt.Errorf("codex exited with error: %w", out.err)
+		}
+		// codex reports an API failure only as text: lead with it, and read the
+		// run's reason off it so a billing or auth failure is alertable (a
+		// cancelled tag from runExec stays).
+		return cr, reviewer.WithRunReason(reviewer.ReasonFromMessage(agg.errMsg),
+			fmt.Errorf("%s (codex %w)", agg.errMsg, out.err))
 	}
 	return cr, nil
 }
diff --git a/pkg/reviewer/runner/env_test.go b/pkg/reviewer/runner/env_test.go
index 8370603..619756d 100644
--- a/pkg/reviewer/runner/env_test.go
+++ b/pkg/reviewer/runner/env_test.go
@@ -1,9 +1,11 @@
 package runner
 
 import (
+	"log/slog"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCredEnv(t *testing.T) {
@@ -32,3 +34,14 @@ func TestClaudeIsolationEnv(t *testing.T) {
 	t.Setenv("CLAUDE_CODE_DISABLE_AUTO_MEMORY", "0")
 	assert.Nil(t, claudeIsolationEnv(), "the operator's env wins")
 }
+
+func TestRunExecScrubsCISecrets(t *testing.T) {
+	t.Setenv("REVIEWER_GITLAB_TOKEN", "glpat-secret")
+	t.Setenv("ANTHROPIC_API_KEY", "sk-ambient")
+	out := runExec(t.Context(), slog.New(slog.DiscardHandler), "sh", t.TempDir(),
+		[]string{"-c", `echo "gitlab=${REVIEWER_GITLAB_TOKEN-unset} key=$ANTHROPIC_API_KEY tracker=$REVIEW_TRACKER_TOKEN"`},
+		"", []string{"REVIEW_TRACKER_TOKEN=tracker", "ANTHROPIC_API_KEY=sk-extra"}, nil)
+	require.NoError(t, out.err)
+	assert.Equal(t, "gitlab=unset key=sk-extra tracker=tracker\n", out.stdout.String(),
+		"CI secrets are dropped; an extra var wins over the ambient one")
+}
diff --git a/pkg/reviewer/runner/opencode.go b/pkg/reviewer/runner/opencode.go
index 67bc282..95d9192 100644
--- a/pkg/reviewer/runner/opencode.go
+++ b/pkg/reviewer/runner/opencode.go
@@ -13,6 +13,8 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
+
+	"reviewsrv/pkg/reviewer"
 )
 
 // exportTimeout caps `opencode export` — it should return in seconds,
@@ -101,27 +103,37 @@ func (r *ExecOpenCodeRunner) Run(ctx context.Context, prompt string) (*ClaudeRes
 		return nil, fmt.Errorf("refusing to run opencode: the checkout ships %s, and opencode would execute its plugins and commands with this job's secrets; review this repository with the claude or codex runner", cfgPath)
 	}
 
+	isolation, merged := opencodeIsolationEnv()
+	if !merged {
+		r.Log.WarnContext(ctx, "OPENCODE_CONFIG_CONTENT is not a JSON object (JSONC?): formatters and LSP are not forced off, whatever it enables runs on the checkout")
+	}
+
 	args := r.buildArgs()
 	// opencode reads its own stored provider credentials, so no API token is
 	// injected — only the tracker token the prompt references.
-	env := append(credEnv(envTrackerToken, r.TrackerToken), opencodeIsolationEnv()...)
+	env := append(credEnv(envTrackerToken, r.TrackerToken), isolation...)
 	// Surface significant events (tool calls, per-step usage) live as opencode streams.
 	out := runExec(ctx, r.Log, RunnerOpenCode, r.Dir, args, prompt, env, func(line []byte) { r.logEvent(ctx, line) })
 
 	r.saveOutput(ctx, out.stdout.Bytes())
 
 	if out.err != nil {
+		stderr := out.stderr.String()
 		r.Log.WarnContext(ctx, "opencode error",
-			"stderr", truncate(out.stderr.String(), 2000),
+			"stderr", truncate(stderr, 2000),
 			"stdout", truncate(out.stdout.String(), 2000),
 		)
 		// Try to parse whatever arrived before the error — matches Claude runner behaviour.
+		// opencode reports an API failure only as text on stderr (a cancelled
+		// tag from runExec stays).
+		runErr := reviewer.WithRunReason(reviewer.ReasonFromMessage(errTail(stderr)),
+			fmt.Errorf("opencode exited with error: %w (stderr: %s)", out.err, truncate(stderr, 500)))
 		if out.stdout.Len() > 0 {
 			if cr, parseErr := ParseOpenCodeResult(out.stdout.Bytes(), r.Model); parseErr == nil {
-				return cr, fmt.Errorf("opencode exited with error: %w", out.err)
+				return cr, runErr
 			}
 		}
-		return nil, fmt.Errorf("opencode exited with error: %w (stderr: %s)", out.err, truncate(out.stderr.String(), 500))
+		return nil, runErr
 	}
 
 	if out.stdout.Len() == 0 {
@@ -139,7 +151,7 @@ func (r *ExecOpenCodeRunner) Run(ctx context.Context, prompt string) (*ClaudeRes
 		return nil, parseErr
 	}
 
-	r.resolveSessionModel(ctx, cr)
+	r.resolveSessionModel(ctx, cr, isolation)
 	r.logResult(ctx, cr)
 
 	return cr, nil
@@ -195,11 +207,11 @@ func (r *ExecOpenCodeRunner) logEvent(ctx context.Context, line []byte) {
 // resolveSessionModel enriches cr.ModelUsage when neither -m nor the stream named
 // the model — opencode's step_finish events carry none. Falls back to
 // `opencode export <sessionID>`, which reliably returns messages[*].info.model.
-func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *ClaudeResult) {
+func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *ClaudeResult, isolation []string) {
 	if len(cr.ModelUsage) > 0 || cr.SessionID == "" {
 		return
 	}
-	name := fetchOpenCodeSessionModel(ctx, r.Dir, cr.SessionID)
+	name := fetchOpenCodeSessionModel(ctx, r.Dir, cr.SessionID, isolation)
 	if name == "" {
 		r.Log.WarnContext(ctx, "opencode session model not resolved", "sessionId", cr.SessionID)
 		return
@@ -219,7 +231,7 @@ func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *Claude
 // fetchOpenCodeSessionModel queries `opencode export <sessionID>` to extract
 // the model used in the session. Returns "" on any failure — caller must
 // treat the result as optional (it's a best-effort enrichment).
-func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string) string {
+func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string, isolation []string) string {
 	if sessionID == "" {
 		return ""
 	}
@@ -232,9 +244,7 @@ func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string) strin
 	// export boots an instance in its working dir and loads that project's
 	// plugins, so run it in the dir Run vetted, under the same isolation.
 	cmd.Dir = dir
-	if env := opencodeIsolationEnv(); len(env) > 0 {
-		cmd.Env = append(os.Environ(), env...)
-	}
+	cmd.Env = reviewer.ChildEnv(isolation...)
 	out, err := cmd.Output()
 	if err != nil {
 		return ""
@@ -272,13 +282,15 @@ func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string) strin
 // config (the legacy loader, plus AGENTS.md auto-loading) is off unless the
 // operator's env says otherwise. Formatters and LSP servers are forced off even
 // then — prettier and eslint run the repo's JS configs, rust-analyzer its
-// build.rs — by merging into the operator's inline config.
-func opencodeIsolationEnv() []string {
+// build.rs — by merging into the operator's inline config; merged is false when
+// that config can't be merged (see opencodeConfigContent).
+func opencodeIsolationEnv() ([]string, bool) {
 	env := credEnv("OPENCODE_DISABLE_PROJECT_CONFIG", "1")
-	if content, ok := opencodeConfigContent(os.Getenv("OPENCODE_CONFIG_CONTENT")); ok {
+	content, merged := opencodeConfigContent(os.Getenv("OPENCODE_CONFIG_CONTENT"))
+	if merged {
 		env = append(env, "OPENCODE_CONFIG_CONTENT="+content)
 	}
-	return env
+	return env, merged
 }
 
 // opencodeConfigContent returns the operator's inline opencode config with
@@ -286,7 +298,8 @@ func opencodeIsolationEnv() []string {
 // comments) cannot be merged and is left alone: ok is false.
 func opencodeConfigContent(operator string) (string, bool) {
 	cfg := map[string]any{}
-	if operator != "" && json.Unmarshal([]byte(operator), &cfg) != nil {
+	// "null" decodes into a nil map: not an object either.
+	if operator != "" && (json.Unmarshal([]byte(operator), &cfg) != nil || cfg == nil) {
 		return "", false
 	}
 	cfg["formatter"], cfg["lsp"] = false, false
diff --git a/pkg/reviewer/runner/opencode_test.go b/pkg/reviewer/runner/opencode_test.go
index d024b0b..274c0ac 100644
--- a/pkg/reviewer/runner/opencode_test.go
+++ b/pkg/reviewer/runner/opencode_test.go
@@ -151,17 +151,27 @@ func TestExecOpenCodeRunnerRefusesProjectConfig(t *testing.T) {
 func TestOpenCodeIsolationEnv(t *testing.T) {
 	t.Setenv("OPENCODE_DISABLE_PROJECT_CONFIG", "")
 	t.Setenv("OPENCODE_CONFIG_CONTENT", "")
+	env, merged := opencodeIsolationEnv()
+	assert.True(t, merged)
 	assert.Equal(t, []string{
 		"OPENCODE_DISABLE_PROJECT_CONFIG=1",
 		`OPENCODE_CONFIG_CONTENT={"formatter":false,"lsp":false}`,
-	}, opencodeIsolationEnv())
+	}, env)
 
 	t.Setenv("OPENCODE_DISABLE_PROJECT_CONFIG", "0")
 	t.Setenv("OPENCODE_CONFIG_CONTENT", `{"share":"disabled","lsp":true}`)
+	env, merged = opencodeIsolationEnv()
+	assert.True(t, merged)
 	assert.Equal(t, []string{
 		`OPENCODE_CONFIG_CONTENT={"formatter":false,"lsp":false,"share":"disabled"}`,
-	}, opencodeIsolationEnv(), "the operator's config is kept, formatter and lsp forced off")
+	}, env, "the operator's config is kept, formatter and lsp forced off")
 
 	t.Setenv("OPENCODE_CONFIG_CONTENT", "{ // jsonc\n}")
-	assert.Empty(t, opencodeIsolationEnv(), "an unparsable operator config is left alone")
+	env, merged = opencodeIsolationEnv()
+	assert.False(t, merged)
+	assert.Empty(t, env, "an unparsable operator config is left alone")
+
+	t.Setenv("OPENCODE_CONFIG_CONTENT", "null")
+	_, merged = opencodeIsolationEnv()
+	assert.False(t, merged, "null is not an object either")
 }
diff --git a/pkg/reviewer/subprocess.go b/pkg/reviewer/subprocess.go
new file mode 100644
index 0000000..1b75d31
--- /dev/null
+++ b/pkg/reviewer/subprocess.go
@@ -0,0 +1,39 @@
+package reviewer
+
+import (
+	"os"
+	"slices"
+	"strings"
+)
+
+// ciSecretEnv lists variables no subprocess on the checkout needs but a
+// prompt-injected agent could exfiltrate: reviewctl's own credentials and
+// GitLab's job secrets. LLM provider keys stay — the runner CLIs read them.
+// Secrets under names the operator picks (CI/CD variables, id_tokens) are not
+// covered, and the job token also sits in the checkout's git remote URL.
+var ciSecretEnv = []string{
+	EnvGitLabToken, EnvProjectKey, EnvAPIKey,
+	"CI_JOB_TOKEN", "CI_REPOSITORY_URL",
+	"CI_REGISTRY_PASSWORD", "CI_DEPLOY_PASSWORD", "CI_DEPENDENCY_PROXY_PASSWORD",
+}
+
+// ChildEnv is the environment of a subprocess reviewctl starts on the untrusted
+// checkout — a runner CLI, git: the ambient one without ciSecretEnv, plus extra.
+// extra comes last, and for a key also in the ambient env (a merged
+// OPENCODE_CONFIG_CONTENT) os/exec keeps the last value. Defense in depth, not a
+// boundary: a process under the same uid can still read reviewctl's own
+// /proc/<pid>/environ; only a separate uid or PID namespace closes that.
+func ChildEnv(extra ...string) []string {
+	env := slices.DeleteFunc(os.Environ(), func(kv string) bool {
+		name, _, _ := strings.Cut(kv, "=")
+		return slices.Contains(ciSecretEnv, name)
+	})
+	return append(env, extra...)
+}
+
+// GitArgs prefixes the arguments of a git command reviewctl runs on the
+// checkout: an agent can write hooks and an fsmonitor command into its .git
+// (shared by every panel worktree), which git would otherwise execute.
+func GitArgs(args ...string) []string {
+	return append([]string{"-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false"}, args...)
+}
diff --git a/pkg/reviewer/subprocess_test.go b/pkg/reviewer/subprocess_test.go
new file mode 100644
index 0000000..d81f4a7
--- /dev/null
+++ b/pkg/reviewer/subprocess_test.go
@@ -0,0 +1,28 @@
+package reviewer
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestChildEnv(t *testing.T) {
+	t.Setenv(EnvGitLabToken, "glpat-secret")
+	t.Setenv(EnvProjectKey, "key")
+	t.Setenv(EnvAPIKey, "sk-review")
+	t.Setenv("CI_JOB_TOKEN", "job-secret")
+	t.Setenv("ANTHROPIC_API_KEY", "sk-ant")
+
+	vars := map[string]string{}
+	for _, kv := range ChildEnv("REVIEW_TRACKER_TOKEN=tracker") {
+		name, value, _ := strings.Cut(kv, "=")
+		vars[name] = value
+	}
+	for _, name := range []string{EnvGitLabToken, EnvProjectKey, EnvAPIKey, "CI_JOB_TOKEN"} {
+		assert.NotContains(t, vars, name)
+	}
+	assert.Equal(t, "sk-ant", vars["ANTHROPIC_API_KEY"], "provider keys stay: the CLIs read them")
+	assert.Equal(t, "tracker", vars["REVIEW_TRACKER_TOKEN"])
+	assert.Contains(t, vars, "PATH")
+}

From 454cbf6808153ae16ffd5827b82b9ae2562bfe86 Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 18:51:14 +0300
Subject: [PATCH 6/7] Bump golangci-lint to v2.13.2

- Pin v2.13.2 in the lint workflow and Makefile: CI's v2.12.2
  flagged goconst repeats and the //go:fix directive that the
  local v2.13.2 passes cleanly
---
 .github/workflows/golangci-lint.yml | 2 +-
 Makefile                            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 32ee706..4ca7a81 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -25,4 +25,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.12.2
+          version: v2.13.2
diff --git a/Makefile b/Makefile
index b64be0b..6abfe5c 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ ifeq ($(RACE),1)
 	GOFLAGS+=-race
 endif
 
-LINT_VERSION := v2.12.2
+LINT_VERSION := v2.13.2
 
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 

From cf720d1014cf38c0f4c838b4062ab106e127248b Mon Sep 17 00:00:00 2001
From: Sergey Bykov <sergeyfast@gmail.com>
Date: Thu, 24 Sep 2026 20:56:54 +0300
Subject: [PATCH 7/7] Fix panel metrics, key leaks and CLI shutdown

- Upload every member when the judge fails or can't start, so each
  completed run is counted; report a judge that never started
- Keep --max-rounds / REVIEW_MAX_ROUNDS over panel member and judge
  profiles
- Mask the project key in the access log, RPC param logs, Sentry
  events, reviewctl logs and upload transport errors
- Keep a failed Step 2 retry's own reason (cancelled, timeout,
  billing) instead of reporting not_submitted
- Run runner CLIs in their own process group: SIGTERM it on cancel,
  kill leftovers after exit, bound pipe waits with WaitDelay; handle
  SIGHUP in reviewctl
- Skip Slack notifications for member reviews
- Test the decompressed artifact size limit at its boundary
---
 cmd/reviewctl/main.go                      |   7 +-
 cmd/reviewctl/main_test.go                 |   1 +
 cmd/reviewsrv/main.go                      |   1 +
 pkg/app/handlers.go                        |  30 +++--
 pkg/app/handlers_test.go                   |  15 +++
 pkg/app/sentry.go                          |  22 ++++
 pkg/app/sentry_test.go                     |  22 ++++
 pkg/debug/handler.go                       |  19 +--
 pkg/debug/handler_test.go                  |  30 +++++
 pkg/rest/rest.go                           |   4 +-
 pkg/rest/rest_test.go                      |  17 +++
 pkg/reviewctl/server.go                    |  26 +++-
 pkg/reviewctl/server_test.go               |  37 ++++++
 pkg/reviewer/ctl/config.go                 |   3 +
 pkg/reviewer/ctl/ctl.go                    |  11 +-
 pkg/reviewer/ctl/ctl_test.go               |  31 +++++
 pkg/reviewer/ctl/panel.go                  |  61 ++++++++--
 pkg/reviewer/ctl/panel_test.go             | 131 +++++++++++++++++++++
 pkg/reviewer/ctl/prompt.go                 |   7 +-
 pkg/reviewer/ctl/recovery.go               |  50 ++++----
 pkg/reviewer/ctl/skip_detect_test.go       |  21 ++--
 pkg/reviewer/ctl/upload.go                 |  30 +++--
 pkg/reviewer/ctl/upload_test.go            |  20 ++++
 pkg/reviewer/project.go                    |  30 +++++
 pkg/reviewer/project_test.go               |   9 ++
 pkg/reviewer/runner/claude.go              |   8 +-
 pkg/reviewer/runner/claude_failure_test.go |  32 +++++
 pkg/reviewer/runner/cli_failure_test.go    |  11 ++
 pkg/reviewer/runner/opencode.go            |   7 +-
 pkg/reviewer/runner/procgroup.go           |  39 ++++++
 pkg/reviewer/runner/procgroup_other.go     |  14 +++
 pkg/reviewer/runner/procgroup_unix.go      |  36 ++++++
 pkg/reviewer/runner/procgroup_unix_test.go |  33 ++++++
 33 files changed, 716 insertions(+), 99 deletions(-)
 create mode 100644 pkg/app/sentry.go
 create mode 100644 pkg/app/sentry_test.go
 create mode 100644 pkg/reviewctl/server_test.go
 create mode 100644 pkg/reviewer/runner/procgroup.go
 create mode 100644 pkg/reviewer/runner/procgroup_other.go
 create mode 100644 pkg/reviewer/runner/procgroup_unix.go
 create mode 100644 pkg/reviewer/runner/procgroup_unix_test.go

diff --git a/cmd/reviewctl/main.go b/cmd/reviewctl/main.go
index d6714bc..f73d171 100644
--- a/cmd/reviewctl/main.go
+++ b/cmd/reviewctl/main.go
@@ -123,8 +123,10 @@ func main() {
 	rootCmd.AddCommand(reviewCmd, uploadCmd, commentCmd, versionCmd)
 	// A cancelled CI job sends SIGTERM: cancel the run context instead of dying
 	// mid-flight, so the runner stops and the debug bundle still ships, marked
-	// cancelled rather than failed.
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	// cancelled rather than failed. The runner CLIs sit in process groups of
+	// their own, beyond the terminal's signals: a closed terminal (SIGHUP) must
+	// stop them the same way.
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)
 	// After the first signal, restore the default handling: a second Ctrl+C or
 	// SIGTERM ends reviewctl even while it still ships bundles and cleans up.
 	context.AfterFunc(ctx, stop)
@@ -243,6 +245,7 @@ func applyProfile(changed func(string) bool, cfg *ctl.Config, p *ctl.ResolvedPro
 	if !changed("allow-dangerous-permissions") {
 		cfg.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
 	}
+	cfg.MaxRoundsSet = changed("max-rounds")
 	serverDefault(changed, "max-rounds", p.Params.MaxRounds, &cfg.MaxRounds)
 }
 
diff --git a/cmd/reviewctl/main_test.go b/cmd/reviewctl/main_test.go
index 22a5620..18315d5 100644
--- a/cmd/reviewctl/main_test.go
+++ b/cmd/reviewctl/main_test.go
@@ -83,6 +83,7 @@ func TestApplyProfile(t *testing.T) {
 	applyProfile(passed("runner", "max-rounds"), cfg, p)
 	assert.Equal(t, "codex", cfg.Runner, "an explicit flag wins")
 	assert.Zero(t, cfg.MaxRounds, "an explicit --max-rounds 0 (the default) wins too")
+	assert.True(t, cfg.MaxRoundsSet, "and overrides the panel members' profiles")
 
 	cfg = &ctl.Config{MaxRounds: 200}
 	applyProfile(passed("max-rounds"), cfg, &ctl.ResolvedProfile{})
diff --git a/cmd/reviewsrv/main.go b/cmd/reviewsrv/main.go
index d36c11e..cc6b5ef 100644
--- a/cmd/reviewsrv/main.go
+++ b/cmd/reviewsrv/main.go
@@ -70,6 +70,7 @@ func main() {
 			Dsn:         cfg.Sentry.DSN,
 			Environment: cfg.Sentry.Environment,
 			Release:     version,
+			BeforeSend:  app.MaskSentryKeys,
 		}))
 	}
 
diff --git a/pkg/app/handlers.go b/pkg/app/handlers.go
index f1e86ba..5916f32 100644
--- a/pkg/app/handlers.go
+++ b/pkg/app/handlers.go
@@ -45,15 +45,9 @@ func apiBodyLimit() echo.MiddlewareFunc {
 	})
 }
 
-// registerHandlers register echo handlers.
-func (a *App) registerHandlers() {
-	a.echo.Use(middleware.CORSWithConfig(middleware.CORSConfig{
-		AllowOrigins: []string{"*"},
-		AllowMethods: []string{echo.GET, echo.PUT, echo.POST, echo.DELETE},
-		AllowHeaders: []string{"Authorization", "Authorization2", "Origin", "X-Requested-With", "Content-Type", "Accept", "Platform", "Version"},
-	}), apiBodyLimit())
-
-	lg := middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
+// requestLogger logs every request of the routes it is attached to.
+func requestLogger(log *slog.Logger) echo.MiddlewareFunc {
+	return middleware.RequestLoggerWithConfig(middleware.RequestLoggerConfig{
 		LogStatus:    true,
 		LogURI:       true,
 		LogError:     true,
@@ -65,7 +59,8 @@ func (a *App) registerHandlers() {
 		LogValuesFunc: func(c echo.Context, v middleware.RequestLoggerValues) error {
 			attrs := []slog.Attr{
 				slog.String("ip", v.RemoteIP),
-				slog.String("uri", v.URI),
+				// The upload routes carry the project key.
+				slog.String("uri", reviewer.MaskKey(v.URI, c.Param("projectKey"))),
 				slog.Int("status", v.Status),
 				slog.String("userAgent", v.UserAgent),
 				slog.String("duration", v.Latency.String()),
@@ -73,13 +68,24 @@ func (a *App) registerHandlers() {
 			}
 
 			if v.Error == nil {
-				a.Log().LogAttrs(context.Background(), slog.LevelInfo, "http request", attrs...)
+				log.LogAttrs(context.Background(), slog.LevelInfo, "http request", attrs...)
 			} else {
-				a.Log().LogAttrs(context.Background(), slog.LevelError, "http request error", append(attrs, slog.String("err", v.Error.Error()))...)
+				log.LogAttrs(context.Background(), slog.LevelError, "http request error", append(attrs, slog.String("err", v.Error.Error()))...)
 			}
 			return nil
 		},
 	})
+}
+
+// registerHandlers register echo handlers.
+func (a *App) registerHandlers() {
+	a.echo.Use(middleware.CORSWithConfig(middleware.CORSConfig{
+		AllowOrigins: []string{"*"},
+		AllowMethods: []string{echo.GET, echo.PUT, echo.POST, echo.DELETE},
+		AllowHeaders: []string{"Authorization", "Authorization2", "Origin", "X-Requested-With", "Content-Type", "Accept", "Platform", "Version"},
+	}), apiBodyLimit())
+
+	lg := requestLogger(a.Log())
 
 	h := rest.NewHandler(a.db, slack.NewNotifier(a.Logger), a.cfg.Server.BaseURL, a.runMetrics)
 
diff --git a/pkg/app/handlers_test.go b/pkg/app/handlers_test.go
index 0cab791..71baa3c 100644
--- a/pkg/app/handlers_test.go
+++ b/pkg/app/handlers_test.go
@@ -2,6 +2,7 @@ package app
 
 import (
 	"bytes"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -30,3 +31,17 @@ func TestAPIBodyLimit(t *testing.T) {
 	assert.Equal(t, http.StatusOK, post("/v1/reviewctl/upload/key/", mb))
 	assert.Equal(t, http.StatusRequestEntityTooLarge, post("/v1/reviewctl/upload/key/", 3*mb), "other routes keep the 2MB cap")
 }
+
+func TestRequestLoggerMasksProjectKey(t *testing.T) {
+	var buf bytes.Buffer
+	e := echo.New()
+	e.POST("/v1/reviewctl/upload/:projectKey/", func(c echo.Context) error {
+		return echo.NewHTTPError(http.StatusBadRequest, "bad draft")
+	}, requestLogger(slog.New(slog.NewTextHandler(&buf, nil))))
+
+	const key = "11111111-2222-3333-4444-555555555555"
+	e.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/reviewctl/upload/"+key+"/", nil))
+
+	assert.NotContains(t, buf.String(), key)
+	assert.Contains(t, buf.String(), "/v1/reviewctl/upload/11111111…/")
+}
diff --git a/pkg/app/sentry.go b/pkg/app/sentry.go
new file mode 100644
index 0000000..e27f38d
--- /dev/null
+++ b/pkg/app/sentry.go
@@ -0,0 +1,22 @@
+package app
+
+import (
+	"encoding/json"
+
+	"reviewsrv/pkg/reviewer"
+
+	"github.com/getsentry/sentry-go"
+)
+
+// MaskSentryKeys is a sentry BeforeSend hook that keeps project keys out of
+// events: zenrpc attaches each call's raw params, the echo integration the
+// request URL, and both can carry a key.
+func MaskSentryKeys(e *sentry.Event, _ *sentry.EventHint) *sentry.Event {
+	if p, ok := e.Extra["params"].(json.RawMessage); ok {
+		e.Extra["params"] = json.RawMessage(reviewer.MaskKeys(string(p)))
+	}
+	if e.Request != nil {
+		e.Request.URL = reviewer.MaskKeys(e.Request.URL)
+	}
+	return e
+}
diff --git a/pkg/app/sentry_test.go b/pkg/app/sentry_test.go
new file mode 100644
index 0000000..256e022
--- /dev/null
+++ b/pkg/app/sentry_test.go
@@ -0,0 +1,22 @@
+package app
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/getsentry/sentry-go"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMaskSentryKeys(t *testing.T) {
+	const key = "11111111-2222-3333-4444-555555555555"
+	e := MaskSentryKeys(&sentry.Event{
+		Extra:   map[string]any{"params": json.RawMessage(`{"projectKey":"` + key + `"}`), "ip": "10.0.0.1"},
+		Request: &sentry.Request{URL: "https://srv/v1/reviewctl/upload/" + key + "/"},
+	}, nil)
+
+	assert.JSONEq(t, `{"projectKey":"11111111…"}`, string(e.Extra["params"].(json.RawMessage)))
+	assert.Equal(t, "https://srv/v1/reviewctl/upload/11111111…/", e.Request.URL)
+	assert.Equal(t, "10.0.0.1", e.Extra["ip"])
+	assert.NotNil(t, MaskSentryKeys(&sentry.Event{}, nil), "an event without params or request")
+}
diff --git a/pkg/debug/handler.go b/pkg/debug/handler.go
index ee4b6b0..479a265 100644
--- a/pkg/debug/handler.go
+++ b/pkg/debug/handler.go
@@ -73,7 +73,7 @@ type Handler struct {
 // upload). Either may be nil.
 func NewHandler(storage *Storage, log *slog.Logger, projectTitle func(ctx context.Context, projectKey string) (string, error), metrics *reviewer.RunMetrics) *Handler {
 	tmpl := template.Must(template.New("").Funcs(template.FuncMap{
-		"shortKey":   shortKey,
+		"shortKey":   reviewer.ShortKey,
 		"preview":    preview,
 		"storageURL": func() string { return StoragePathPrefix },
 	}).ParseFS(templatesFS, "templates/*.html"))
@@ -96,7 +96,7 @@ func (h *Handler) Upload(c echo.Context) error {
 		title, err := h.projectTitle(ctx, projectKey)
 		switch {
 		case err != nil:
-			h.log.ErrorContext(ctx, "debug upload: resolve project", "projectKey", shortKey(projectKey), "err", err)
+			h.log.ErrorContext(ctx, "debug upload: resolve project", "projectKey", reviewer.ShortKey(projectKey), "err", err)
 			return echo.NewHTTPError(http.StatusServiceUnavailable, "resolve project")
 		case title == "":
 			return echo.NewHTTPError(http.StatusNotFound, "unknown project")
@@ -122,9 +122,8 @@ func (h *Handler) Upload(c echo.Context) error {
 		ExternalID:   field(FieldExternalID, maxFieldBytes),
 		Runner:       field(FieldRunner, maxFieldBytes),
 		Model:        field(FieldModel, maxFieldBytes),
-		// The key authorizes project config (runner-profile and tracker
-		// tokens): an upload URL quoted in an error must not reveal it.
-		ErrorMsg:     strings.ReplaceAll(field(FieldErrorMsg, maxErrorMsgBytes), projectKey, shortKey(projectKey)+"…"),
+		// An upload URL quoted in an error must not reveal the key.
+		ErrorMsg:     reviewer.MaskKey(field(FieldErrorMsg, maxErrorMsgBytes), projectKey),
 		SourceBranch: field(FieldSourceBranch, maxFieldBytes),
 		TargetBranch: field(FieldTargetBranch, maxFieldBytes),
 		CommitHash:   field(FieldCommitHash, maxFieldBytes),
@@ -155,7 +154,7 @@ func (h *Handler) Upload(c echo.Context) error {
 	// on that upload: counting its later failure too would double both.
 	counted := b.Status != reviewer.RunStatusOK && b.ReviewID == ""
 	h.log.Log(ctx, lvl, "debug bundle stored",
-		"id", b.ID, "projectKey", shortKey(projectKey), "project", b.ProjectTitle, "files", len(b.Files), "hasError", b.ErrorMsg != "",
+		"id", b.ID, "projectKey", reviewer.ShortKey(projectKey), "project", b.ProjectTitle, "files", len(b.Files), "hasError", b.ErrorMsg != "",
 		"status", b.Status, "reason", b.Reason, "runner", b.Runner, "model", b.Model, "costUsd", b.CostUsd,
 		"reviewId", b.ReviewID, "countedInMetrics", counted, "errorMsg", preview(b.ErrorMsg, 300),
 	)
@@ -294,14 +293,6 @@ func contentTypeFor(name string) string {
 	return "text/plain; charset=utf-8"
 }
 
-// shortKey returns the first 8 chars of a UUID for compact display.
-func shortKey(s string) string {
-	if len(s) <= 8 {
-		return s
-	}
-	return s[:8]
-}
-
 // preview truncates a string to n bytes, on a rune boundary, for the index
 // error column and the log.
 func preview(s string, n int) string {
diff --git a/pkg/debug/handler_test.go b/pkg/debug/handler_test.go
index adf5ae2..2aa69f7 100644
--- a/pkg/debug/handler_test.go
+++ b/pkg/debug/handler_test.go
@@ -186,6 +186,36 @@ func TestHandler_UploadRejectsMalformedGzip(t *testing.T) {
 	}
 }
 
+// The decompressed size is checked once, at upload: File streams a stored
+// artifact without a limit of its own.
+func TestHandler_UploadLimitsDecompressedSize(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		size    int
+		want    int
+		bundles int
+	}{
+		{"at the limit", maxFileBytes, http.StatusOK, 1},
+		{"over the limit", maxFileBytes + 1, http.StatusBadRequest, 0},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			storage, e := newTestHandler(t)
+			body, ct := buildMultipart(t, nil, map[string][]byte{"runner.log": bytes.Repeat([]byte("x"), tt.size)})
+			req := httptest.NewRequest(http.MethodPost, "/v1/upload/debug/"+uuid.NewString()+"/", body)
+			req.Header.Set("Content-Type", ct)
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, req)
+
+			if rec.Code != tt.want {
+				t.Errorf("status = %d, want %d", rec.Code, tt.want)
+			}
+			if got := len(storage.List()); got != tt.bundles {
+				t.Errorf("bundles = %d, want %d", got, tt.bundles)
+			}
+		})
+	}
+}
+
 func TestHandler_ListAndBundleHTML(t *testing.T) {
 	storage, e := newTestHandler(t)
 	storage.Add(&Bundle{
diff --git a/pkg/rest/rest.go b/pkg/rest/rest.go
index b8b9b8e..896f656 100644
--- a/pkg/rest/rest.go
+++ b/pkg/rest/rest.go
@@ -88,8 +88,10 @@ func (h *Handler) CreateReview(c echo.Context) error {
 	return c.String(http.StatusOK, strconv.Itoa(rv.ID))
 }
 
+// notifySlack announces a review. A member review is link-only, hidden from
+// the lists: its fusion (or the promoted single review) is announced instead.
 func (h *Handler) notifySlack(project *reviewer.Project, rv *reviewer.Review) {
-	if h.notifier == nil || !project.HasSlackWebhook() {
+	if h.notifier == nil || !project.HasSlackWebhook() || rv.ReviewRole == reviewer.ReviewRoleMember {
 		return
 	}
 
diff --git a/pkg/rest/rest_test.go b/pkg/rest/rest_test.go
index c16e791..acd8539 100644
--- a/pkg/rest/rest_test.go
+++ b/pkg/rest/rest_test.go
@@ -6,17 +6,20 @@ import (
 	"net/http/httptest"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"reviewsrv/pkg/db"
 	dbtest "reviewsrv/pkg/db/test"
 	"reviewsrv/pkg/reviewer"
+	"reviewsrv/pkg/slack"
 
 	"github.com/labstack/echo/v4"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/vmkteam/embedlog"
 )
 
 // newTestHandler bootstraps the test DB and a Handler wired without a Slack
@@ -230,3 +233,17 @@ func okRunCounters(t *testing.T, reg *prometheus.Registry, project, runner strin
 	}
 	return runs, cost
 }
+
+func TestNotifySlackSkipsMemberReviews(t *testing.T) {
+	var posts atomic.Int32
+	webhook := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { posts.Add(1) }))
+	t.Cleanup(webhook.Close)
+	h := &Handler{notifier: slack.NewNotifier(embedlog.NewDevLogger()), baseURL: "http://localhost"}
+	project := &reviewer.Project{Project: db.Project{Title: "p", SlackChannel: &db.SlackChannel{WebhookURL: webhook.URL}}}
+
+	h.notifySlack(project, &reviewer.Review{Review: db.Review{ID: 1, ReviewRole: reviewer.ReviewRoleMember}})
+	h.notifySlack(project, &reviewer.Review{Review: db.Review{ID: 2, ReviewRole: reviewer.ReviewRoleSingle}})
+
+	require.Eventually(t, func() bool { return posts.Load() == 1 }, 5*time.Second, 10*time.Millisecond)
+	assert.Never(t, func() bool { return posts.Load() > 1 }, 200*time.Millisecond, 10*time.Millisecond, "a member review is not announced")
+}
diff --git a/pkg/reviewctl/server.go b/pkg/reviewctl/server.go
index d081e42..f940d23 100644
--- a/pkg/reviewctl/server.go
+++ b/pkg/reviewctl/server.go
@@ -1,9 +1,13 @@
 package reviewctl
 
 import (
+	"context"
+	"encoding/json"
 	"net/http"
+	"slices"
 
 	"reviewsrv/pkg/db"
+	"reviewsrv/pkg/reviewer"
 
 	"github.com/vmkteam/embedlog"
 	zm "github.com/vmkteam/zenrpc-middleware"
@@ -46,9 +50,10 @@ func New(dbo db.DB, logger embedlog.Logger, isDevel bool) *zenrpc.Server {
 		zm.WithSQLLogger(dbo.DB, isDevel, allowDebugFn(), allowDebugFn()),
 	)
 
+	pf := maskKeys(logger.Print)
 	rpc.Use(
-		zm.WithSLog(logger.Print, zm.DefaultServerName, nil),
-		zm.WithErrorSLog(logger.Print, zm.DefaultServerName, nil),
+		zm.WithSLog(pf, zm.DefaultServerName, nil),
+		zm.WithErrorSLog(pf, zm.DefaultServerName, nil),
 	)
 
 	// services
@@ -58,3 +63,20 @@ func New(dbo db.DB, logger embedlog.Logger, isDevel bool) *zenrpc.Server {
 
 	return rpc
 }
+
+// maskKeys wraps the printer of the RPC log middlewares, which log each call's
+// raw params: every method here takes the project key.
+func maskKeys(pf zm.Print) zm.Print {
+	return func(ctx context.Context, msg string, args ...any) {
+		args = slices.Clone(args)
+		for i := 1; i < len(args); i += 2 {
+			if args[i-1] != "params" {
+				continue
+			}
+			if p, ok := args[i].(json.RawMessage); ok {
+				args[i] = json.RawMessage(reviewer.MaskKeys(string(p)))
+			}
+		}
+		pf(ctx, msg, args...)
+	}
+}
diff --git a/pkg/reviewctl/server_test.go b/pkg/reviewctl/server_test.go
new file mode 100644
index 0000000..06dd32d
--- /dev/null
+++ b/pkg/reviewctl/server_test.go
@@ -0,0 +1,37 @@
+package reviewctl
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log/slog"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	zm "github.com/vmkteam/zenrpc-middleware"
+	"github.com/vmkteam/zenrpc/v2"
+)
+
+func TestMaskKeysHidesProjectKeyInLoggedParams(t *testing.T) {
+	const key = "11111111-2222-3333-4444-555555555555"
+	for _, params := range []string{
+		`{"projectKey":"` + key + `","tokenEnv":true}`,
+		`["` + key + `",true]`, // positional
+	} {
+		var buf bytes.Buffer
+		pf := maskKeys(slog.New(slog.NewJSONHandler(&buf, nil)).InfoContext)
+		var handled json.RawMessage
+		h := zm.WithSLog(pf, zm.DefaultServerName, nil)(func(_ context.Context, _ string, p json.RawMessage) zenrpc.Response {
+			handled = p
+			return zenrpc.Response{}
+		})
+
+		h(t.Context(), "ReviewConfig", json.RawMessage(params))
+		logged := buf.String()
+		require.NotEmpty(t, logged)
+		assert.NotContains(t, logged, key)
+		assert.Contains(t, logged, "11111111…")
+		assert.JSONEq(t, params, string(handled), "the method gets the real key")
+	}
+}
diff --git a/pkg/reviewer/ctl/config.go b/pkg/reviewer/ctl/config.go
index 8f6ac7d..a877b46 100644
--- a/pkg/reviewer/ctl/config.go
+++ b/pkg/reviewer/ctl/config.go
@@ -48,6 +48,9 @@ type Config struct {
 	APIBaseURL  string
 	Effort      string
 	MaxRounds   int // direct runner round budget (--max-rounds / profile); 0 = default
+	// MaxRoundsSet marks MaxRounds as passed (--max-rounds / REVIEW_MAX_ROUNDS):
+	// it then overrides every profile, the panel members' and the judge's too.
+	MaxRoundsSet bool
 
 	// Resolved runner profile (fetched from the server over /v1/reviewctl/rpc/).
 	// Token is the optional API-key fallback used only when the matching env var
diff --git a/pkg/reviewer/ctl/ctl.go b/pkg/reviewer/ctl/ctl.go
index 6208c5d..208b9c3 100644
--- a/pkg/reviewer/ctl/ctl.go
+++ b/pkg/reviewer/ctl/ctl.go
@@ -135,7 +135,7 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 	if len(c.cfg.Multi) > 0 {
 		return c.reviewPanel(ctx, start)
 	}
-	c.log.InfoContext(ctx, "starting review", "projectKey", c.cfg.Key, "runner", c.cfg.Runner, "model", c.cfg.Model)
+	c.log.InfoContext(ctx, "starting review", "projectKey", reviewer.ShortKey(c.cfg.Key), "runner", c.cfg.Runner, "model", c.cfg.Model)
 
 	retried := false
 
@@ -176,14 +176,9 @@ func (c *Controller) Review(ctx context.Context) (retErr error) {
 
 	if isReviewJSONUnfilled(draft) {
 		retried = true
-		d2 := c.runStep2Recovery(ctx, draft, result)
-		if d2 == nil {
-			// Like an empty panel member: an untouched skeleton is no review, so
-			// the run fails (and ships its debug bundle) instead of uploading it.
-			return reviewer.WithRunReason(reviewer.RunReasonNotSubmitted,
-				errors.New("empty review: the runner left review.json unfilled, and the Step 2 retry did not fill it"))
+		if draft, err = c.runStep2Recovery(ctx, draft, result); err != nil {
+			return err
 		}
-		draft = d2
 	}
 
 	mdFiles, err := FindMDFiles(c.cfg.Dir)
diff --git a/pkg/reviewer/ctl/ctl_test.go b/pkg/reviewer/ctl/ctl_test.go
index 583fa9c..da2cc70 100644
--- a/pkg/reviewer/ctl/ctl_test.go
+++ b/pkg/reviewer/ctl/ctl_test.go
@@ -277,6 +277,37 @@ func TestController_Review_FailsOnUnfilledReview(t *testing.T) {
 	assert.Equal(t, "4.175053", dc.field("costUsd"), "both runs are billed")
 }
 
+func TestController_Review_KeepsStep2RetryFailureReason(t *testing.T) {
+	for _, tt := range []struct {
+		name           string
+		err            error
+		status, reason string
+	}{
+		{"cancelled", context.Canceled, reviewer.RunStatusCancelled, reviewer.RunReasonCancelled},
+		{"billing", reviewer.WithRunReason(reviewer.RunReasonBilling, errors.New("credit balance is too low")), reviewer.RunStatusFailed, reviewer.RunReasonBilling},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			srv, dc := newDebugCaptureServer(t, nil)
+			cfg := &Config{Key: "test-key", URL: srv.URL, Model: "opus", Dir: t.TempDir(), Runner: runner.RunnerClaude}
+			// The run leaves review.json untouched; the Step 2 retry fails.
+			var runs int
+			rr := &testClaudeRunner{fixturePath: "testdata/claude_result.json", beforeRun: func() error {
+				runs++
+				if runs == 2 {
+					return tt.err
+				}
+				return nil
+			}}
+
+			err := NewController(cfg, rr, slog.Default()).Review(context.Background())
+			require.ErrorIs(t, err, tt.err)
+			assert.Equal(t, tt.status, dc.field("status"))
+			assert.Equal(t, tt.reason, dc.field("reason"))
+			assert.Equal(t, "2.0875265", dc.field("costUsd"), "the first run stays billed")
+		})
+	}
+}
+
 func TestController_Review_UploadsDebugBundleOnValidationFailure(t *testing.T) {
 	srv, dc := newDebugCaptureServer(t, nil)
 
diff --git a/pkg/reviewer/ctl/panel.go b/pkg/reviewer/ctl/panel.go
index 5eb7db8..afc500f 100644
--- a/pkg/reviewer/ctl/panel.go
+++ b/pkg/reviewer/ctl/panel.go
@@ -63,7 +63,7 @@ func (c *Controller) reviewPanel(ctx context.Context, start time.Time) (err erro
 	if c.cfg.Judge != nil {
 		judge = c.cfg.Judge.String()
 	}
-	c.log.InfoContext(ctx, "starting panel review", "projectKey", c.cfg.Key, "members", members, "judge", judge)
+	c.log.InfoContext(ctx, "starting panel review", "projectKey", reviewer.ShortKey(c.cfg.Key), "members", members, "judge", judge)
 
 	prompt, err := c.prompt.FetchPrompt(ctx, c.cfg.URL, c.cfg.Key)
 	if err != nil {
@@ -196,27 +196,26 @@ func (c *Controller) finishPanel(ctx context.Context, base, commit string, outpu
 }
 
 // fuse runs the judge over the staged member outputs and uploads one fused
-// review that links the members as children. If the judge fails after a retry,
-// it degrades to a single review from the primary member so CI never goes red on
-// a judge flap.
+// review that links the members as children. If the judge can't run or fails
+// after a retry, it degrades to uploadUnfused so CI never goes red on a judge
+// flap.
 func (c *Controller) fuse(ctx context.Context, base, commit string, outputs []*memberOutput) (int, error) {
 	// The judge prompt is a server built-in (served via the reviewctl RPC) so a
 	// future per-project override needs no client change — same as the member prompt.
 	fusionPrompt, err := c.prompt.FetchFusionPrompt(ctx, c.cfg.URL, c.cfg.Key)
 	if err != nil {
-		return 0, fmt.Errorf("fetch fusion prompt: %w", err)
+		return c.judgeNotRun(ctx, outputs, fmt.Errorf("fetch fusion prompt: %w", err))
 	}
 
 	judgeDir := filepath.Join(base, "wt-judge")
 	if err = c.gitWorktreeAdd(ctx, judgeDir, commit); err != nil {
-		return 0, fmt.Errorf("judge worktree add: %w", err)
+		return c.judgeNotRun(ctx, outputs, fmt.Errorf("judge worktree add: %w", err))
 	}
 	defer c.gitWorktreeRemove(ctx, judgeDir)
 
 	fusion, err := c.runJudge(ctx, judgeDir, fusionPrompt, outputs)
 	if err != nil {
-		c.log.ErrorContext(ctx, "judge failed, promoting primary member to single", "err", err)
-		return c.uploadMember(ctx, outputs[0], reviewer.ReviewRoleSingle)
+		return c.uploadUnfused(ctx, outputs, err)
 	}
 
 	// Upload members first to get their ids, then the fusion that links them.
@@ -239,6 +238,45 @@ func (c *Controller) fuse(ctx context.Context, base, commit string, outputs []*m
 	return id, nil
 }
 
+// judgeNotRun reports a judge that could not start as a failed judge run
+// (runJudge settles only the runs it starts), then degrades to uploadUnfused.
+func (c *Controller) judgeNotRun(ctx context.Context, outputs []*memberOutput, err error) (int, error) {
+	jc := c.judgeConfig("") // no worktree: the bundle carries the error only
+	c.settleRun(ctx, &jc, nil, err)
+	return c.uploadUnfused(ctx, outputs, err)
+}
+
+// uploadUnfused uploads the primary member as a single review and the others
+// as member reviews: only an uploaded review reports an ok run, with its cost,
+// to the server's run metrics. A cancelled job uploads nothing more.
+func (c *Controller) uploadUnfused(ctx context.Context, outputs []*memberOutput, cause error) (int, error) {
+	if ctx.Err() != nil {
+		return 0, cause
+	}
+	c.log.ErrorContext(ctx, "no fused review, promoting primary member to single", "err", cause)
+	id, err := c.uploadMember(ctx, outputs[0], reviewer.ReviewRoleSingle)
+	if err != nil {
+		return 0, err
+	}
+	for _, o := range outputs[1:] {
+		// The review is out: a lost member upload costs its metrics, not the run.
+		mid, err := c.uploadMember(ctx, o, reviewer.ReviewRoleMember)
+		if err != nil {
+			c.log.WarnContext(ctx, "upload unfused member", "member", o.label, "err", err)
+			continue
+		}
+		c.log.InfoContext(ctx, "unfused member uploaded", "member", o.label, "reviewId", mid)
+	}
+	return id, nil
+}
+
+// judgeConfig is the judge's run config, working in dir.
+func (c *Controller) judgeConfig(dir string) Config {
+	jc := c.memberConfig(dir, *c.cfg.Judge)
+	jc.Label = "judge"
+	return jc
+}
+
 // memberConfig clones the base config for one panel member (or the judge): its own
 // working dir + runner/model, the panel fields cleared, and — for a server-driven
 // member — its resolved profile's credentials/settings overlaid (nil profile = the
@@ -256,7 +294,9 @@ func (c *Controller) memberConfig(dir string, m MemberSpec) Config {
 		mc.APIProvider = p.APIProvider
 		mc.APIBaseURL = p.APIBaseURL
 		mc.AllowDangerousPermissions = p.Params.AllowDangerousPermissions
-		mc.MaxRounds = p.Params.MaxRounds
+		if !mc.MaxRoundsSet {
+			mc.MaxRounds = p.Params.MaxRounds
+		}
 		mc.RunnerProfileID = p.RunnerProfileID
 		mc.RunnerProfileTitle = p.Title
 	}
@@ -311,8 +351,7 @@ func (c *Controller) produceMember(ctx context.Context, dir, label string, m Mem
 // worktree, then runs the judge with the fusion prompt (one retry) and returns
 // the fused draft + R*.md.
 func (c *Controller) runJudge(ctx context.Context, judgeDir, fusionPrompt string, outputs []*memberOutput) (_ *memberOutput, err error) {
-	jc := c.memberConfig(judgeDir, *c.cfg.Judge)
-	jc.Label = "judge"
+	jc := c.judgeConfig(judgeDir)
 	var rr *spendTracker
 	// The panel survives a failed judge (the primary member is promoted), but
 	// the judge's run and spend must not vanish with its worktree.
diff --git a/pkg/reviewer/ctl/panel_test.go b/pkg/reviewer/ctl/panel_test.go
index 08e9718..dcab59e 100644
--- a/pkg/reviewer/ctl/panel_test.go
+++ b/pkg/reviewer/ctl/panel_test.go
@@ -2,6 +2,7 @@ package ctl
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"log/slog"
 	"net/http"
@@ -9,7 +10,9 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -248,6 +251,19 @@ func TestMemberConfigInheritsTracker(t *testing.T) {
 	assert.True(t, mc.AllowDangerousPermissions)
 }
 
+func TestMemberConfigKeepsPassedMaxRounds(t *testing.T) {
+	member := MemberSpec{Runner: "direct", Model: "m", Profile: &ResolvedProfile{Params: RunnerProfileParams{MaxRounds: 120}}}
+
+	c := NewController(&Config{MaxRounds: 10, MaxRoundsSet: true}, nil, slog.Default())
+	assert.Equal(t, 10, c.memberConfig("/tmp/wt", member).MaxRounds, "--max-rounds overrides the member's profile")
+
+	c = NewController(&Config{MaxRoundsSet: true}, nil, slog.Default())
+	assert.Zero(t, c.memberConfig("/tmp/wt", member).MaxRounds, "an explicit 0 (the default) too")
+
+	c = NewController(&Config{MaxRounds: 10}, nil, slog.Default())
+	assert.Equal(t, 120, c.memberConfig("/tmp/wt", member).MaxRounds, "the primary profile's budget does not")
+}
+
 func TestMemberLabel(t *testing.T) {
 	assert.Equal(t, "1-codex-gpt-5.5", memberLabel(0, MemberSpec{Runner: "codex", Model: "gpt-5.5"}))
 	// duplicates stay distinct by index
@@ -294,6 +310,121 @@ func TestRunJudge_FailureShipsDebugBundle(t *testing.T) {
 	assert.Equal(t, runner.RunnerClaude, dc.field("runner"))
 }
 
+// uploadCapture answers review uploads with sequential ids and records each
+// one's role; failAt fails that upload (1-based) with a 500.
+type uploadCapture struct {
+	mu     sync.Mutex
+	roles  []string
+	failAt int
+}
+
+func (u *uploadCapture) handle(t *testing.T) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if strings.Count(strings.Trim(r.URL.Path, "/"), "/") != 3 { // an R*.md upload
+			return
+		}
+		var d rest.ReviewDraft
+		if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&d)) {
+			return
+		}
+		u.mu.Lock()
+		defer u.mu.Unlock()
+		if len(u.roles)+1 == u.failAt {
+			u.failAt = 0
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		u.roles = append(u.roles, d.Review.ReviewRole)
+		_, _ = w.Write([]byte(strconv.Itoa(len(u.roles))))
+	}
+}
+
+func testOutputs() []*memberOutput {
+	return []*memberOutput{{label: "a", draft: &rest.ReviewDraft{}}, {label: "b", draft: &rest.ReviewDraft{}}}
+}
+
+func TestFuse_JudgeNotStartedUploadsEveryMember(t *testing.T) {
+	uc := &uploadCapture{}
+	srv, dc := newDebugCaptureServer(t, uc.handle(t))
+	// Not a repository: the judge worktree can't be created.
+	cfg := &Config{Key: "k", URL: srv.URL, Dir: t.TempDir(), Judge: &MemberSpec{Runner: runner.RunnerClaude, Model: "opus"}}
+
+	id, err := NewController(cfg, nil, slog.Default()).fuse(t.Context(), t.TempDir(), "HEAD", testOutputs())
+	require.NoError(t, err, "a judge failure never fails the panel")
+	assert.Equal(t, 1, id, "the primary member is the review")
+	assert.Equal(t, []string{reviewer.ReviewRoleSingle, reviewer.ReviewRoleMember}, uc.roles, "every member run is reported")
+	assert.Equal(t, 1, dc.count(), "the judge that never ran is reported too")
+	assert.Equal(t, runner.RunnerClaude, dc.field("runner"))
+	assert.Contains(t, dc.field("errorMsg"), "judge worktree add")
+}
+
+func TestUploadUnfused(t *testing.T) {
+	cause := errors.New("judge failed")
+	for _, tt := range []struct {
+		name    string
+		failAt  int
+		wantErr bool
+		roles   []string
+	}{
+		{"all uploaded", 0, false, []string{reviewer.ReviewRoleSingle, reviewer.ReviewRoleMember}},
+		{"a lost member upload is tolerated", 2, false, []string{reviewer.ReviewRoleSingle}},
+		{"a lost primary upload fails the panel", 1, true, nil},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			uc := &uploadCapture{failAt: tt.failAt}
+			srv := httptest.NewServer(uc.handle(t))
+			t.Cleanup(srv.Close)
+
+			_, err := NewController(&Config{Key: "k", URL: srv.URL}, nil, slog.Default()).uploadUnfused(t.Context(), testOutputs(), cause)
+			assert.Equal(t, tt.wantErr, err != nil, "err = %v", err)
+			assert.Equal(t, tt.roles, uc.roles)
+		})
+	}
+
+	t.Run("a cancelled job uploads nothing", func(t *testing.T) {
+		uc := &uploadCapture{}
+		srv := httptest.NewServer(uc.handle(t))
+		t.Cleanup(srv.Close)
+		ctx, cancel := context.WithCancel(t.Context())
+		cancel()
+
+		_, err := NewController(&Config{Key: "k", URL: srv.URL}, nil, slog.Default()).uploadUnfused(ctx, testOutputs(), cause)
+		require.ErrorIs(t, err, cause)
+		assert.Empty(t, uc.roles)
+	})
+}
+
+func TestReviewPanel_JudgeFailureUploadsEveryMember(t *testing.T) {
+	uc := &uploadCapture{}
+	srv, dc := newDebugCaptureServer(t, uc.handle(t))
+	repo := t.TempDir()
+	runGit(t, repo, "init", "-q")
+	require.NoError(t, os.WriteFile(filepath.Join(repo, "file.txt"), []byte("hi"), 0o600))
+	runGit(t, repo, "add", ".")
+	runGit(t, repo, "-c", "user.email=t@example.com", "-c", "user.name=t", "commit", "-q", "-m", "init")
+	profile := &ResolvedProfile{Params: RunnerProfileParams{MaxRounds: 120}}
+	cfg := &Config{Key: "k", URL: srv.URL, Dir: repo, Commit: "HEAD", Runner: runner.RunnerClaude, MaxRounds: 10, MaxRoundsSet: true,
+		Multi: []MemberSpec{{Runner: runner.RunnerClaude, Model: "a", Profile: profile}, {Runner: runner.RunnerCodex, Model: "b", Profile: profile}},
+		Judge: &MemberSpec{Runner: runner.RunnerClaude, Model: "j", Profile: profile}}
+	var mu sync.Mutex
+	var maxRounds []int
+	c := NewController(cfg, nil, slog.Default(), WithRunnerFactory(func(mc *Config) (runner.ReviewRunner, error) {
+		mu.Lock()
+		maxRounds = append(maxRounds, mc.MaxRounds)
+		mu.Unlock()
+		if mc.Label == "judge" { // leaves the skeleton untouched, on both attempts
+			return failingRunner{name: runner.RunnerClaude}, nil
+		}
+		return &fakeRunner{name: mc.Runner, dir: mc.Dir}, nil
+	}))
+
+	require.NoError(t, c.Review(t.Context()))
+	assert.Equal(t, []string{reviewer.ReviewRoleSingle, reviewer.ReviewRoleMember}, uc.roles, "every member run is reported")
+	assert.Equal(t, 1, dc.count(), "one bundle, the judge's")
+	assert.Equal(t, reviewer.RunReasonNotSubmitted, dc.field("reason"))
+	assert.Equal(t, []int{10, 10, 10}, maxRounds, "--max-rounds overrides every member's and the judge's profile")
+}
+
 func TestReviewPanel_ShipsPanelLevelFailure(t *testing.T) {
 	srv, dc := newDebugCaptureServer(t, nil)
 	// A checkout that doesn't exist: no worktree, so no member ever runs — the
diff --git a/pkg/reviewer/ctl/prompt.go b/pkg/reviewer/ctl/prompt.go
index 89499c0..c2a060b 100644
--- a/pkg/reviewer/ctl/prompt.go
+++ b/pkg/reviewer/ctl/prompt.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/ctl/reviewctlclient"
 )
 
@@ -134,7 +135,7 @@ func (c *PromptClient) FetchConfig(ctx context.Context, serverURL, projectKey st
 	}
 
 	judging := rc.Judge != nil
-	c.log.InfoContext(ctx, "fetched review config", "projectKey", projectKey,
+	c.log.InfoContext(ctx, "fetched review config", "projectKey", reviewer.ShortKey(projectKey),
 		"panelMembers", 1+len(rc.Panel), "judging", judging)
 	return rc, nil
 }
@@ -146,7 +147,7 @@ func (c *PromptClient) FetchFusionPrompt(ctx context.Context, serverURL, project
 	if err != nil {
 		return "", err
 	}
-	c.log.InfoContext(ctx, "fetched fusion prompt", "projectKey", projectKey, "length", len(prompt))
+	c.log.InfoContext(ctx, "fetched fusion prompt", "projectKey", reviewer.ShortKey(projectKey), "length", len(prompt))
 	return prompt, nil
 }
 
@@ -161,7 +162,7 @@ func (c *PromptClient) FetchPrompt(ctx context.Context, serverURL, projectKey st
 	if err != nil {
 		return "", err
 	}
-	c.log.InfoContext(ctx, "fetched prompt", "projectKey", projectKey, "length", len(prompt))
+	c.log.InfoContext(ctx, "fetched prompt", "projectKey", reviewer.ShortKey(projectKey), "length", len(prompt))
 	return prompt, nil
 }
 
diff --git a/pkg/reviewer/ctl/recovery.go b/pkg/reviewer/ctl/recovery.go
index 749cdff..c4b3bc8 100644
--- a/pkg/reviewer/ctl/recovery.go
+++ b/pkg/reviewer/ctl/recovery.go
@@ -2,6 +2,8 @@ package ctl
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"strings"
 
 	"reviewsrv/pkg/rest"
@@ -27,50 +29,50 @@ func isReviewJSONUnfilled(draft *rest.ReviewDraft) bool {
 }
 
 // runStep2Recovery wraps the retry path: logs the skip, invokes retryStep2,
-// records both passes on the recovered draft, and returns it (or nil if the
-// retry didn't help, which fails the run).
-func (c *Controller) runStep2Recovery(ctx context.Context, draft *rest.ReviewDraft, first *runner.ClaudeResult) *rest.ReviewDraft {
+// records both passes on the recovered draft, and returns it. A retry that
+// could not fill review.json fails the run as not submitted — unless the retry
+// run failed for a reason of its own (cancelled, timeout, billing).
+func (c *Controller) runStep2Recovery(ctx context.Context, draft *rest.ReviewDraft, first *runner.ClaudeResult) (*rest.ReviewDraft, error) {
 	c.log.WarnContext(ctx, "review.json appears unfilled — attempting Step 2 retry with session continuation", "files", len(draft.Files), "issues", len(draft.Issues), "sessionId", first.SessionID)
 
-	d2 := c.retryStep2(ctx, first.SessionID)
-	if d2 == nil {
-		return nil
+	d2, err := c.retryStep2(ctx, first.SessionID)
+	if err != nil {
+		return nil, reviewer.WithRunReason(reviewer.RunReasonNotSubmitted, err)
 	}
 	// The tracker holds both passes, so the record covers the retry too.
 	c.applyRunResult(ctx, d2, c.cfg, c.runner)
-
 	if isReviewJSONUnfilled(d2) {
-		c.log.WarnContext(ctx, "Step 2 retry did not fill review.json")
-		return nil
+		return nil, errEmptyReview("the Step 2 retry did not fill it")
 	}
 	c.log.InfoContext(ctx, "Step 2 retry filled review.json", "issues", len(d2.Issues))
-	return d2
+	return d2, nil
 }
 
 // retryStep2 invokes the runner a second time with a focused "fill review.json"
 // prompt, resuming the previous session so the cached original prompt isn't
-// re-billed. Returns the re-read draft; nil signals "retry could not happen or
-// runner failed".
-func (c *Controller) retryStep2(ctx context.Context, lastSessionID string) *rest.ReviewDraft {
-	if lastSessionID == "" {
-		c.log.WarnContext(ctx, "Step 2 retry skipped: no sessionId from previous run")
-		return nil
-	}
-	if c.runner == nil {
-		return nil
+// re-billed. Returns the re-read draft, or why there is none.
+func (c *Controller) retryStep2(ctx context.Context, lastSessionID string) (*rest.ReviewDraft, error) {
+	if lastSessionID == "" || c.runner == nil {
+		return nil, errEmptyReview("there is no session to resume for a Step 2 retry")
 	}
 
 	c.runner.SetSession(lastSessionID)
 
 	if _, err := c.runner.Run(ctx, reviewer.PromptStep2Retry); err != nil {
-		c.log.WarnContext(ctx, "Step 2 retry runner failed", "err", err)
-		return nil
+		return nil, fmt.Errorf("run %s: step 2 retry: %w", c.runner.Name(), err)
 	}
 
 	draft, err := ReadReviewJSON(c.cfg.Dir)
 	if err != nil {
-		c.log.WarnContext(ctx, "Step 2 retry: review.json still unparseable", "err", err)
-		return nil
+		return nil, errEmptyReview("the Step 2 retry left it unparseable: " + err.Error())
 	}
-	return draft
+	return draft, nil
+}
+
+// errEmptyReview fails a run whose review.json stayed an untouched skeleton,
+// like an empty panel member: that is no review, so the run fails (and ships
+// its debug bundle) instead of uploading it.
+func errEmptyReview(why string) error {
+	return reviewer.WithRunReason(reviewer.RunReasonNotSubmitted,
+		errors.New("empty review: the runner left review.json unfilled, and "+why))
 }
diff --git a/pkg/reviewer/ctl/skip_detect_test.go b/pkg/reviewer/ctl/skip_detect_test.go
index dd52ee5..7cded28 100644
--- a/pkg/reviewer/ctl/skip_detect_test.go
+++ b/pkg/reviewer/ctl/skip_detect_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"reviewsrv/pkg/rest"
+	"reviewsrv/pkg/reviewer"
 	"reviewsrv/pkg/reviewer/runner"
 
 	"github.com/stretchr/testify/assert"
@@ -120,36 +121,41 @@ func (r *retryStep2RunnerStub) Run(_ context.Context, _ string) (*runner.ClaudeR
 }
 
 func TestRetryStep2(t *testing.T) {
-	t.Run("empty sessionId returns nil draft and skips runner", func(t *testing.T) {
+	t.Run("empty sessionId fails as not submitted and skips runner", func(t *testing.T) {
 		stub := &retryStep2RunnerStub{}
 		c := &Controller{
 			cfg:    &Config{Dir: t.TempDir()},
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft := c.retryStep2(context.Background(), "")
+		draft, err := c.retryStep2(context.Background(), "")
+		require.ErrorContains(t, err, "no session to resume")
+		_, reason := reviewer.RunOutcome(err)
+		assert.Equal(t, reviewer.RunReasonNotSubmitted, reason)
 		assert.Nil(t, draft)
 		assert.False(t, stub.runCalled, "runner.Run must not be called when sessionId empty")
 		assert.Empty(t, stub.sessionSet, "SetSession must not be called when sessionId empty")
 	})
 
-	t.Run("nil runner returns nil without panic", func(t *testing.T) {
+	t.Run("nil runner fails without panic", func(t *testing.T) {
 		c := &Controller{
 			cfg: &Config{Dir: t.TempDir()},
 			log: slog.Default(),
 		}
-		draft := c.retryStep2(context.Background(), "ses_123")
+		draft, err := c.retryStep2(context.Background(), "ses_123")
+		require.Error(t, err)
 		assert.Nil(t, draft)
 	})
 
-	t.Run("runner error returns nil draft", func(t *testing.T) {
+	t.Run("runner error is returned", func(t *testing.T) {
 		stub := &retryStep2RunnerStub{runErr: errors.New("boom")}
 		c := &Controller{
 			cfg:    &Config{Dir: t.TempDir()},
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft := c.retryStep2(context.Background(), "ses_123")
+		draft, err := c.retryStep2(context.Background(), "ses_123")
+		require.ErrorContains(t, err, "boom")
 		assert.Nil(t, draft)
 		assert.Equal(t, "ses_123", stub.sessionSet, "SetSession must be called before Run")
 	})
@@ -172,7 +178,8 @@ func TestRetryStep2(t *testing.T) {
 			log:    slog.Default(),
 			runner: trackSpend(stub),
 		}
-		draft := c.retryStep2(context.Background(), "ses_abc")
+		draft, err := c.retryStep2(context.Background(), "ses_abc")
+		require.NoError(t, err)
 		require.NotNil(t, draft, "expected non-nil draft after successful retry")
 		assert.Equal(t, "ses_abc", stub.sessionSet)
 		require.Len(t, draft.Files, 1)
diff --git a/pkg/reviewer/ctl/upload.go b/pkg/reviewer/ctl/upload.go
index 854a5f7..a03dc67 100644
--- a/pkg/reviewer/ctl/upload.go
+++ b/pkg/reviewer/ctl/upload.go
@@ -11,6 +11,7 @@ import (
 	"log/slog"
 	"mime/multipart"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -46,22 +47,33 @@ func NewUploadClient(log *slog.Logger) *UploadClient {
 	}
 }
 
+// do sends an upload request, masking the project key in the URL that
+// http.Client quotes in a transport error.
+func (c *UploadClient) do(req *http.Request, projectKey string) (*http.Response, error) {
+	resp, err := c.httpClient.Do(req)
+	var ue *url.Error
+	if errors.As(err, &ue) {
+		ue.URL = reviewer.MaskKey(ue.URL, projectKey)
+	}
+	return resp, err
+}
+
 // UploadReview uploads review.json and returns the reviewId.
 func (c *UploadClient) UploadReview(ctx context.Context, serverURL, projectKey string, draft *rest.ReviewDraft) (int, error) {
-	url := fmt.Sprintf("%s/v1/reviewctl/upload/%s/", strings.TrimRight(serverURL, "/"), projectKey)
+	endpoint := fmt.Sprintf("%s/v1/reviewctl/upload/%s/", strings.TrimRight(serverURL, "/"), projectKey)
 
 	body, err := json.Marshal(draft)
 	if err != nil {
 		return 0, fmt.Errorf("marshal review draft: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
 	if err != nil {
 		return 0, fmt.Errorf("create upload request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := c.httpClient.Do(req)
+	resp, err := c.do(req, projectKey)
 	if err != nil {
 		return 0, fmt.Errorf("upload review: %w", err)
 	}
@@ -88,15 +100,15 @@ func (c *UploadClient) UploadReview(ctx context.Context, serverURL, projectKey s
 
 // UploadFile uploads a single review file (markdown content).
 func (c *UploadClient) UploadFile(ctx context.Context, serverURL, projectKey string, reviewID int, reviewType string, content []byte) error {
-	url := fmt.Sprintf("%s/v1/reviewctl/upload/%s/%d/%s/", strings.TrimRight(serverURL, "/"), projectKey, reviewID, reviewType)
+	endpoint := fmt.Sprintf("%s/v1/reviewctl/upload/%s/%d/%s/", strings.TrimRight(serverURL, "/"), projectKey, reviewID, reviewType)
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(content))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(content))
 	if err != nil {
 		return fmt.Errorf("create file upload request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/octet-stream")
 
-	resp, err := c.httpClient.Do(req)
+	resp, err := c.do(req, projectKey)
 	if err != nil {
 		return fmt.Errorf("upload file %s: %w", reviewType, err)
 	}
@@ -205,14 +217,14 @@ func (c *UploadClient) UploadDebugBundle(ctx context.Context, serverURL, project
 		return "", fmt.Errorf("build multipart: %w", err)
 	}
 
-	url := fmt.Sprintf("%s/v1/upload/debug/%s/", strings.TrimRight(serverURL, "/"), projectKey)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, body)
+	endpoint := fmt.Sprintf("%s/v1/upload/debug/%s/", strings.TrimRight(serverURL, "/"), projectKey)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, body)
 	if err != nil {
 		return "", fmt.Errorf("create debug upload request: %w", err)
 	}
 	req.Header.Set("Content-Type", contentType)
 
-	resp, err := c.httpClient.Do(req)
+	resp, err := c.do(req, projectKey)
 	if err != nil {
 		return "", fmt.Errorf("post debug bundle: %w", err)
 	}
diff --git a/pkg/reviewer/ctl/upload_test.go b/pkg/reviewer/ctl/upload_test.go
index 4b80d92..e7d65e4 100644
--- a/pkg/reviewer/ctl/upload_test.go
+++ b/pkg/reviewer/ctl/upload_test.go
@@ -87,6 +87,26 @@ func TestUploadReview_ServerError(t *testing.T) {
 	}
 }
 
+func TestUploadClient_TransportErrorMasksProjectKey(t *testing.T) {
+	srv := httptest.NewServer(http.NotFoundHandler())
+	srv.Close() // connection refused: http.Client quotes the URL in its error
+
+	const key = "11111111-2222-3333-4444-555555555555"
+	c := NewUploadClient(slog.Default())
+	_, err := c.UploadReview(t.Context(), srv.URL, key, testDraft(t))
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), key)
+	assert.Contains(t, err.Error(), "/v1/reviewctl/upload/11111111…/")
+
+	err = c.UploadFile(t.Context(), srv.URL, key, 42, "architecture", []byte("x"))
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), key)
+
+	_, err = c.UploadDebugBundle(t.Context(), srv.URL, key, DebugMeta{ErrorMsg: "boom"}, nil)
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), key)
+}
+
 func TestReadReviewJSON(t *testing.T) {
 	draft, err := ReadReviewJSON("testdata")
 	require.NoError(t, err)
diff --git a/pkg/reviewer/project.go b/pkg/reviewer/project.go
index 6456cd6..f87c954 100644
--- a/pkg/reviewer/project.go
+++ b/pkg/reviewer/project.go
@@ -3,6 +3,7 @@ package reviewer
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 
 	"reviewsrv/pkg/db"
@@ -22,6 +23,35 @@ const (
 	EnvAPIKey      = "REVIEW_API_KEY" // the direct runner's provider-agnostic key
 )
 
+// ShortKey returns the first 8 chars of a project key, for logs and pages: the
+// full key authorizes the project's config (runner-profile and tracker tokens).
+func ShortKey(key string) string {
+	if len(key) <= 8 {
+		return key
+	}
+	return key[:8]
+}
+
+// MaskKey replaces every occurrence of key in s with its ShortKey, e.g. in a
+// URL or an error message that quotes one.
+func MaskKey(s, key string) string {
+	if key == "" {
+		return s
+	}
+	return strings.ReplaceAll(s, key, maskedKey(key))
+}
+
+// keyRe matches a project key (a UUID) in text that may quote one.
+var keyRe = regexp.MustCompile(`[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}`)
+
+// MaskKeys masks every project key in s, for text where the key is not known
+// up front (logged RPC params, a Sentry event).
+func MaskKeys(s string) string {
+	return keyRe.ReplaceAllStringFunc(s, maskedKey)
+}
+
+func maskedKey(key string) string { return ShortKey(key) + "…" }
+
 type ProjectManager struct {
 	repo       db.ProjectRepo
 	reviewRepo db.ReviewRepo
diff --git a/pkg/reviewer/project_test.go b/pkg/reviewer/project_test.go
index 0b91199..9d775ef 100644
--- a/pkg/reviewer/project_test.go
+++ b/pkg/reviewer/project_test.go
@@ -277,3 +277,12 @@ func TestDBProjectManager_Prompt(t *testing.T) {
 		assert.Empty(t, result)
 	})
 }
+
+func TestMaskKey(t *testing.T) {
+	const key = "11111111-2222-3333-4444-555555555555"
+	assert.Equal(t, "POST /v1/upload/11111111…/ → /v1/upload/11111111…/42/", MaskKey("POST /v1/upload/"+key+"/ → /v1/upload/"+key+"/42/", key))
+	assert.Equal(t, "no key here", MaskKey("no key here", ""), "an empty key masks nothing")
+	assert.JSONEq(t, `{"projectKey":"11111111…","other":"AAAAAAAA…"}`,
+		MaskKeys(`{"projectKey":"`+key+`","other":"AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE"}`), "every key, the case aside")
+	assert.Equal(t, "short", ShortKey("short"))
+}
diff --git a/pkg/reviewer/runner/claude.go b/pkg/reviewer/runner/claude.go
index b1e4be6..512ff62 100644
--- a/pkg/reviewer/runner/claude.go
+++ b/pkg/reviewer/runner/claude.go
@@ -563,6 +563,7 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	cmd.Dir = dir
 	cmd.Stdin = strings.NewReader(prompt)
 	cmd.Env = reviewer.ChildEnv(extraEnv...)
+	prepareCLI(cmd)
 
 	out := &runOutput{}
 	var lw *lineWriter
@@ -577,7 +578,7 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	log.InfoContext(ctx, "running "+binary, "dir", dir, "promptLen", len(prompt), "args", args)
 
 	start := time.Now()
-	out.err = cmd.Run()
+	out.err = finishCLI(ctx, log, cmd, cmd.Run())
 	out.elapsed = time.Since(start)
 	// Killed by the context (runnerTimeout, the caller's deadline or a cancelled
 	// job): keep the cause in the chain so a timeout/cancel is not reported as a
@@ -585,8 +586,9 @@ func runExec(ctx context.Context, log *slog.Logger, binary, dir string, args []s
 	if out.err != nil && ctx.Err() != nil {
 		out.err = fmt.Errorf("%w: %w", ctx.Err(), out.err)
 	}
-	// Stopped by SIGTERM/SIGINT from outside (a cancelled CI job reaches the
-	// runner before, or instead of, reviewctl itself): not a runner failure.
+	// Stopped by SIGTERM/SIGINT from outside — the CLI runs in a process group
+	// of its own, so from whatever signals every process, e.g. a container
+	// stop on a cancelled CI job: not a runner failure.
 	if isInterrupted(out.err) {
 		out.err = reviewer.WithRunReason(reviewer.RunReasonCancelled, out.err)
 	}
diff --git a/pkg/reviewer/runner/claude_failure_test.go b/pkg/reviewer/runner/claude_failure_test.go
index 05ee616..8a1cfa9 100644
--- a/pkg/reviewer/runner/claude_failure_test.go
+++ b/pkg/reviewer/runner/claude_failure_test.go
@@ -7,6 +7,7 @@ import (
 	"os/exec"
 	"strings"
 	"testing"
+	"time"
 
 	"reviewsrv/pkg/reviewer"
 
@@ -107,6 +108,37 @@ func TestRunExecTagsContextCause(t *testing.T) {
 	assert.Equal(t, reviewer.RunStatusCancelled, status)
 }
 
+// setWaitDelay overrides cliWaitDelay for one test.
+func setWaitDelay(t *testing.T, d time.Duration) {
+	t.Helper()
+	old := cliWaitDelay
+	cliWaitDelay = d
+	t.Cleanup(func() { cliWaitDelay = old })
+}
+
+func TestRunExecCancelKillsLeftoverChildren(t *testing.T) {
+	setWaitDelay(t, time.Minute) // only the process-group kill ends the run in time
+	ctx, cancel := context.WithTimeout(t.Context(), 300*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	// The background sleep inherits the CLI's stdout and would hold it open.
+	out := runExec(ctx, slog.New(slog.DiscardHandler), "sh", t.TempDir(), []string{"-c", "sleep 60 & sleep 60"}, "", nil, nil)
+	assert.Less(t, time.Since(start), 10*time.Second)
+	status, _ := reviewer.RunOutcome(out.err)
+	assert.Equal(t, reviewer.RunStatusTimeout, status)
+}
+
+func TestRunExecDoesNotWaitForLeftoverChild(t *testing.T) {
+	setWaitDelay(t, 100*time.Millisecond)
+
+	start := time.Now()
+	out := runExec(t.Context(), slog.New(slog.DiscardHandler), "sh", t.TempDir(), []string{"-c", "sleep 60 & echo done"}, "", nil, nil)
+	require.NoError(t, out.err, "the CLI itself succeeded")
+	assert.Equal(t, "done\n", out.stdout.String())
+	assert.Less(t, time.Since(start), 10*time.Second)
+}
+
 func TestClaudeReason(t *testing.T) {
 	tests := []struct {
 		kind   string
diff --git a/pkg/reviewer/runner/cli_failure_test.go b/pkg/reviewer/runner/cli_failure_test.go
index af68644..2a72126 100644
--- a/pkg/reviewer/runner/cli_failure_test.go
+++ b/pkg/reviewer/runner/cli_failure_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"reviewsrv/pkg/reviewer"
 
@@ -67,3 +68,13 @@ echo 'AI_APICallError: statusCode: 429' >&2; exit 1`,
 		})
 	}
 }
+
+func TestFetchOpenCodeSessionModelIgnoresLeftoverChild(t *testing.T) {
+	setWaitDelay(t, 100*time.Millisecond)
+	// A plugin's background process keeps export's stdout open after it exits.
+	fakeCLI(t, "opencode", `sleep 60 & printf '{"messages":[{"info":{"model":{"providerID":"p","modelID":"m"}}}]}'`)
+
+	start := time.Now()
+	assert.Equal(t, "p/m", fetchOpenCodeSessionModel(t.Context(), slog.New(slog.DiscardHandler), t.TempDir(), "ses_1", nil))
+	assert.Less(t, time.Since(start), 10*time.Second)
+}
diff --git a/pkg/reviewer/runner/opencode.go b/pkg/reviewer/runner/opencode.go
index 95d9192..bc96b31 100644
--- a/pkg/reviewer/runner/opencode.go
+++ b/pkg/reviewer/runner/opencode.go
@@ -211,7 +211,7 @@ func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *Claude
 	if len(cr.ModelUsage) > 0 || cr.SessionID == "" {
 		return
 	}
-	name := fetchOpenCodeSessionModel(ctx, r.Dir, cr.SessionID, isolation)
+	name := fetchOpenCodeSessionModel(ctx, r.Log, r.Dir, cr.SessionID, isolation)
 	if name == "" {
 		r.Log.WarnContext(ctx, "opencode session model not resolved", "sessionId", cr.SessionID)
 		return
@@ -231,7 +231,7 @@ func (r *ExecOpenCodeRunner) resolveSessionModel(ctx context.Context, cr *Claude
 // fetchOpenCodeSessionModel queries `opencode export <sessionID>` to extract
 // the model used in the session. Returns "" on any failure — caller must
 // treat the result as optional (it's a best-effort enrichment).
-func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string, isolation []string) string {
+func fetchOpenCodeSessionModel(ctx context.Context, log *slog.Logger, dir, sessionID string, isolation []string) string {
 	if sessionID == "" {
 		return ""
 	}
@@ -245,8 +245,9 @@ func fetchOpenCodeSessionModel(ctx context.Context, dir, sessionID string, isola
 	// plugins, so run it in the dir Run vetted, under the same isolation.
 	cmd.Dir = dir
 	cmd.Env = reviewer.ChildEnv(isolation...)
+	prepareCLI(cmd)
 	out, err := cmd.Output()
-	if err != nil {
+	if err = finishCLI(ctx, log, cmd, err); err != nil {
 		return ""
 	}
 	// `opencode export` prints "Exporting session: <id>\n" before the JSON body.
diff --git a/pkg/reviewer/runner/procgroup.go b/pkg/reviewer/runner/procgroup.go
new file mode 100644
index 0000000..943987a
--- /dev/null
+++ b/pkg/reviewer/runner/procgroup.go
@@ -0,0 +1,39 @@
+package runner
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+// cliWaitDelay bounds how long a runner CLI is awaited once its context is done
+// (then it is killed) and how long its output pipes are once it exited.
+var cliWaitDelay = 5 * time.Second
+
+// prepareCLI makes a runner CLI command stoppable as a whole: a cancelled
+// context stops its process group — the CLI together with what it spawned (a
+// shell tool, a test run) — and a leftover child that still holds the output
+// pipes is not awaited past cliWaitDelay.
+func prepareCLI(cmd *exec.Cmd) {
+	setProcessGroup(cmd)
+	cmd.WaitDelay = cliWaitDelay
+}
+
+// finishCLI kills whatever the CLI left running in its process group (a
+// background shell, a dev server) and returns the run's error — nil for
+// exec.ErrWaitDelay: the CLI itself succeeded, only a leftover child held its
+// pipes open. A process that left the group (setsid) is out of reach.
+func finishCLI(ctx context.Context, log *slog.Logger, cmd *exec.Cmd, err error) error {
+	name := filepath.Base(cmd.Path)
+	if killProcessGroup(cmd) == nil {
+		log.WarnContext(ctx, "killed processes "+name+" left running")
+	}
+	if errors.Is(err, exec.ErrWaitDelay) {
+		log.WarnContext(ctx, name+" exited, but a process it left running held its output open")
+		return nil
+	}
+	return err
+}
diff --git a/pkg/reviewer/runner/procgroup_other.go b/pkg/reviewer/runner/procgroup_other.go
new file mode 100644
index 0000000..ace37bf
--- /dev/null
+++ b/pkg/reviewer/runner/procgroup_other.go
@@ -0,0 +1,14 @@
+//go:build !unix
+
+package runner
+
+import (
+	"os"
+	"os/exec"
+)
+
+// setProcessGroup is a no-op without Unix process groups: a cancelled context
+// kills the runner CLI alone.
+func setProcessGroup(*exec.Cmd) {}
+
+func killProcessGroup(*exec.Cmd) error { return os.ErrProcessDone }
diff --git a/pkg/reviewer/runner/procgroup_unix.go b/pkg/reviewer/runner/procgroup_unix.go
new file mode 100644
index 0000000..ac36240
--- /dev/null
+++ b/pkg/reviewer/runner/procgroup_unix.go
@@ -0,0 +1,36 @@
+//go:build unix
+
+package runner
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+// setProcessGroup starts cmd in a process group of its own and makes a
+// cancelled context stop the whole group with SIGTERM, so the CLI can still
+// flush its transcript; finishCLI kills whatever outlives it.
+func setProcessGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error { return signalGroup(cmd, syscall.SIGTERM) }
+}
+
+// killProcessGroup kills the process group of a started cmd.
+func killProcessGroup(cmd *exec.Cmd) error {
+	return signalGroup(cmd, syscall.SIGKILL)
+}
+
+// signalGroup signals the process group of a started cmd. A group already gone
+// is os.ErrProcessDone, which exec.Cmd.Cancel takes for "exited on its own".
+func signalGroup(cmd *exec.Cmd, sig syscall.Signal) error {
+	if cmd.Process == nil {
+		return os.ErrProcessDone
+	}
+	err := syscall.Kill(-cmd.Process.Pid, sig)
+	if errors.Is(err, syscall.ESRCH) {
+		return os.ErrProcessDone
+	}
+	return err
+}
diff --git a/pkg/reviewer/runner/procgroup_unix_test.go b/pkg/reviewer/runner/procgroup_unix_test.go
new file mode 100644
index 0000000..43fcbcd
--- /dev/null
+++ b/pkg/reviewer/runner/procgroup_unix_test.go
@@ -0,0 +1,33 @@
+//go:build unix
+
+package runner
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunExecKillsWhatTheCLILeftRunning(t *testing.T) {
+	pidFile := filepath.Join(t.TempDir(), "pid")
+	// The background sleep lets go of the pipes: only the group kill ends it.
+	script := "sleep 60 >/dev/null 2>&1 & echo $! >" + pidFile + "; echo done"
+	out := runExec(t.Context(), slog.New(slog.DiscardHandler), "sh", t.TempDir(), []string{"-c", script}, "", nil, nil)
+	require.NoError(t, out.err)
+
+	data, err := os.ReadFile(pidFile)
+	require.NoError(t, err)
+	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = syscall.Kill(pid, syscall.SIGKILL) })
+	assert.Eventually(t, func() bool { return syscall.Kill(pid, 0) != nil }, 5*time.Second, 20*time.Millisecond,
+		"the leftover process is killed with the run")
+}