Merge pull request 'Post-PR-#11 polish: demo UI, staffer console, face pool, icons, contractor profile (24 commits)' (#12) from demo/post-pr11-polish-2026-04-28 into main

Re-scrum of yesterday's sanitizer fix surfaced 2 more real bugs in the
fix itself (opus, both WARN, neither caught by kimi/qwen):

W1 (service.rs:1949) — `mentions_path_missing` standalone branch was
too aggressive. A registry-internal error like "/root/.cargo/.../x.rs:
no such file or directory" would 404 because it triggers without
dataset context. That's a real 500. Dropped the standalone branch;
require dataset context AND missing-shape phrase. Lance's actual
"Dataset at path X was not found" still satisfies it.

W2 (service.rs:2018) — `out.push(bytes[i] as char)` corrupted
multi-byte UTF-8 by casting raw bytes to char (only sound for ASCII
< 128). A path containing user-supplied non-ASCII names produced
Latin-1 mojibake. Rewrote redact_paths to track byte indices and
emit unmatched runs as &str slices via push_str(&s[range]) — preserves
multi-byte sequences verbatim. Step advance is now per-char, not
per-byte, via small utf8_char_len helper.

Two new regression tests:
- is_not_found_does_not_match_unrelated_path_missing
- redact_preserves_multibyte_utf8 (uses 工作 + café in input)

12/12 sanitize tests PASS. Smoke 10/10 PASS. Loop closure for opus
re-scrum on the 2026-05-02 fix bundle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config/providers.toml

@@ -35,7 +35,9 @@ default_model = "deepseek-v3.2"
 # includes deepseek-v3.2, deepseek-v4-{flash,pro}, gemini-3-flash-
 # preview, glm-{5,5.1}, kimi-k2.6, qwen3-coder-next.
 # 2026-04-28: default upgraded gpt-oss:120b → deepseek-v3.2 (newest
-# DeepSeek revision; kimi-k2:1t still upstream-broken with HTTP 500).
+# DeepSeek revision). NOTE: kimi-k2:1t is upstream-broken (HTTP 500
+# on Ollama Pro probe 2026-04-28) — do not route to it. Use kimi-k2.6
+# instead, which is what staffing_inference points at.
 
 [[provider]]
 name = "openrouter"
@@ -79,8 +81,10 @@ auth_env = "KIMI_API_KEY"
 default_model = "kimi-for-coding"
 # Direct Kimi For Coding provider. `api.kimi.com` is a SEPARATE account
 # system from `api.moonshot.ai` and `api.moonshot.cn` — keys are NOT
-# interchangeable. Used when Ollama Cloud's `kimi-k2:1t` is upstream-
-# broken and OpenRouter's `moonshotai/kimi-k2.6` is rate-limited.
+# interchangeable. Used as a fallback when Ollama Cloud's kimi-k2.6 is
+# unavailable and OpenRouter's `moonshotai/kimi-k2.6` is rate-limited.
+# (Was `kimi-k2:1t` here pre-2026-05-03 — that model is upstream-broken
+# and removed from operator guidance.)
 # Model id: `kimi-for-coding` (kimi-k2.6 underneath).
 # Key file: /etc/lakehouse/kimi.env (loaded via systemd EnvironmentFile).
 # Model-prefix routing: "kimi/<model>" auto-routes here, prefix stripped.

crates/vectord-lance/src/lib.rs

@@ -620,13 +620,23 @@ mod tests {
     use super::*;
 
     fn temp_path(label: &str) -> String {
-        let n = std::time::SystemTime::now()
+        // Per-process atomic counter — guarantees uniqueness regardless
+        // of clock resolution or test scheduling. Combined with pid, the
+        // result is unique within and across processes for any practical
+        // test workload. Nanosecond timestamps were not enough on their
+        // own: opus WARN at lib.rs:622 from the 2026-05-02 scrum noted
+        // that under tokio scheduling, multiple tests in the same cargo
+        // process can hit the same nanos bucket.
+        use std::sync::atomic::{AtomicU64, Ordering};
+        static COUNTER: AtomicU64 = AtomicU64::new(0);
+        let seq = COUNTER.fetch_add(1, Ordering::Relaxed);
+        let pid = std::process::id();
+        let nanos = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .map(|d| d.subsec_nanos())
             .unwrap_or(0);
-        let pid = std::process::id();
         std::env::temp_dir()
-            .join(format!("vlance_test_{label}_{pid}_{n}"))
+            .join(format!("vlance_test_{label}_{pid}_{nanos}_{seq}"))
             .to_string_lossy()
             .to_string()
     }

crates/vectord/src/pathway_memory.rs

@@ -925,7 +925,7 @@ mod tests {
             reject_reason: None,
         }];
         let mut trace = PathwayTrace {
-            pathway_id,
+            pathway_id: pathway_id.clone(),
             task_class: "scrum_review".into(),
             file_path: format!("crates/{id_tag}/src/x.rs"),
             signal_class: Some("CONVERGING".into()),
@@ -954,6 +954,14 @@ mod tests {
             replay_count: replays,
             replays_succeeded: succ,
             retired: false,
+            // Versioning fields added by Mem0 wave (commit 6ac7f61) — defaults
+            // mirror "this trace is the live head with no parent/successor".
+            trace_uid: format!("test-{pathway_id}"),
+            version: 1,
+            parent_trace_uid: None,
+            superseded_at: None,
+            superseded_by_trace_uid: None,
+            retirement_reason: None,
         };
         trace.pathway_vec = build_pathway_vec(&trace);
         trace

crates/vectord/src/service.rs

@@ -1932,21 +1932,283 @@ fn default_subvectors() -> u32 { 48 }    // 768/48 = 16 dims per subvector
 /// search returned 500 + leaked the lakehouse data path AND the
 /// .cargo/registry path with crate versions.
 fn sanitize_lance_err(err: String, index_name: &str) -> (StatusCode, String) {
+    // 404 detection — narrowed across two 2026-05-02→03 scrum waves.
+    // First wave (opus WARN service.rs:1908): the original `lower.contains
+    // ("not found")` was too broad — caught "column not found" /
+    // "field not found in schema" which are real 500s. Second wave (opus
+    // WARN service.rs:1949): the looser `mentions_path_missing` branch I
+    // added would 404 on a registry-file error like "/root/.cargo/.../x.rs:
+    // no such file or directory" because it triggers without dataset
+    // context. Drop the standalone path-missing branch; require dataset
+    // context AND a missing-shape phrase. Lance's actual error format
+    // ("Dataset at path X was not found") satisfies this.
     let lower = err.to_lowercase();
-    let is_not_found = lower.contains("not found") || lower.contains("no such file");
-    let msg = if is_not_found {
-        format!("lance dataset not found: {index_name}")
+    let mentions_dataset = lower.contains("dataset");
+    let lance_dataset_missing = mentions_dataset && (
+        lower.contains("not found") || lower.contains("does not exist")
+    );
+    // Excluded shapes — these contain "not found" but are real 500s.
+    let column_or_field = lower.contains("column not found")
+        || lower.contains("field not found")
+        || lower.contains("schema not found");
+    let is_not_found = lance_dataset_missing && !column_or_field;
+    if is_not_found {
+        return (StatusCode::NOT_FOUND, format!("lance dataset not found: {index_name}"));
+    }
+
+    // Path redaction — replace path-shaped substrings with [REDACTED]
+    // rather than truncating, per opus BLOCK at service.rs:1914 from the
+    // 2026-05-02 scrum. The previous `err.split("/home/").next()` returned
+    // Some("") when the error string STARTED with "/home/", erasing the
+    // entire message and falling back to a generic "lance backend error"
+    // that lost all real error context. Replacing keeps the structural
+    // error (the "what failed") while stripping the location.
+    let cleaned = redact_paths(&err)
+        .trim_end_matches([',', ' ', '\n', '\t'])
+        .to_string();
+    let msg = if cleaned.is_empty() {
+        format!("lance backend error on {index_name}")
     } else {
-        // Generic 500 with the Lance error body trimmed of paths.
-        let cleaned = err
-            .split("/root/.cargo/").next().unwrap_or(&err)
-            .split("/home/").next().unwrap_or(&err)
-            .trim_end_matches([',', ' ', '\n', '\t'])
-            .to_string();
-        if cleaned.is_empty() { format!("lance backend error on {index_name}") } else { cleaned }
+        cleaned
     };
-    let status = if is_not_found { StatusCode::NOT_FOUND } else { StatusCode::INTERNAL_SERVER_ERROR };
-    (status, msg)
+    (StatusCode::INTERNAL_SERVER_ERROR, msg)
+}
+
+/// Replace absolute-path substrings (under known leak-prone roots) with
+/// "[REDACTED]". Walks the input once, identifying path-shaped runs that
+/// start with one of the configured prefixes and continue until a
+/// path-terminating character (whitespace, quote, comma, paren, EOL).
+///
+/// Linear time, no regex dep. Catches multi-occurrence cases that
+/// `String::split(p).next()` lost. The path-redaction surface intentionally
+/// includes /var, /tmp, /etc, /usr, /opt in addition to /home and
+/// /root/.cargo because Lance/Arrow errors surface system paths in
+/// addition to project paths.
+fn redact_paths(s: &str) -> String {
+    // Two prefix sets:
+    // - ABSOLUTE: paths starting with '/' (always safe to redact)
+    // - RELATIVE: same path bodies but without leading '/' (Lance occasionally
+    //   strips the leading slash when echoing dataset paths back, observed
+    //   live 2026-05-02 — "Dataset at path home/profit/lakehouse/data/lance/x
+    //   was not found"). Match these only when preceded by a non-alpha char
+    //   (start of string, space, colon, etc.) so we don't redact innocent
+    //   tokens like "homecoming" or "etcetera".
+    const ABSOLUTE: &[&str] = &[
+        "/root/.cargo", "/home", "/var", "/tmp", "/etc", "/usr", "/opt",
+    ];
+    const RELATIVE: &[&str] = &[
+        "root/.cargo", "home/", "var/", "tmp/", "etc/", "usr/", "opt/",
+    ];
+    fn is_path_term(b: u8) -> bool {
+        matches!(b, b' ' | b'\t' | b'\n' | b'\r' | b'"' | b'\'' | b',' | b')' | b']' | b'}')
+    }
+    fn is_word_boundary_before(bytes: &[u8], i: usize) -> bool {
+        // True if byte at i-1 is non-alphanumeric (so this position starts
+        // a fresh token). True at start-of-input.
+        if i == 0 { return true; }
+        let b = bytes[i - 1];
+        !(b.is_ascii_alphanumeric() || b == b'_' || b == b'.' || b == b'-')
+    }
+    // Walk by byte index but slice the original &str when emitting, never
+    // cast bytes to char (that would corrupt multi-byte UTF-8 — opus WARN
+    // at service.rs:2018 from the 2026-05-03 re-scrum). Path prefixes are
+    // pure ASCII so byte-level matching is sound; what matters is that
+    // we emit non-matched stretches as &str slices, not byte-by-byte.
+    let bytes = s.as_bytes();
+    let mut out = String::with_capacity(s.len());
+    let mut i = 0;
+    let mut copy_start = 0usize;  // start of an in-progress unmatched run
+    while i < bytes.len() {
+        let mut matched_len: Option<usize> = None;
+        // Try absolute prefixes first (always allowed).
+        for p in ABSOLUTE {
+            let pb = p.as_bytes();
+            if i + pb.len() <= bytes.len() && &bytes[i..i + pb.len()] == pb {
+                let after = i + pb.len();
+                if after == bytes.len() || bytes[after] == b'/' || is_path_term(bytes[after]) {
+                    matched_len = Some(pb.len());
+                    break;
+                }
+            }
+        }
+        // Then relative prefixes — only at word boundaries.
+        if matched_len.is_none() && is_word_boundary_before(bytes, i) {
+            for p in RELATIVE {
+                let pb = p.as_bytes();
+                if i + pb.len() <= bytes.len() && &bytes[i..i + pb.len()] == pb {
+                    matched_len = Some(pb.len());
+                    break;
+                }
+            }
+        }
+        if let Some(prefix_len) = matched_len {
+            // Flush any pending unmatched run as a UTF-8-safe slice.
+            if copy_start < i {
+                out.push_str(&s[copy_start..i]);
+            }
+            out.push_str("[REDACTED]");
+            // Skip past the prefix and the path body (until terminator).
+            let mut j = i + prefix_len;
+            while j < bytes.len() && !is_path_term(bytes[j]) {
+                j += 1;
+            }
+            i = j;
+            copy_start = i;
+        } else {
+            // Advance one CHAR (not one byte) so multi-byte UTF-8 sequences
+            // stay intact in the eventual slice. Look up the next char
+            // boundary using the public API.
+            i += utf8_char_len(bytes, i);
+        }
+    }
+    if copy_start < bytes.len() {
+        out.push_str(&s[copy_start..]);
+    }
+    out
+}
+
+/// Length in bytes of the UTF-8 character starting at byte `i`. Bytes are
+/// guaranteed to be a valid UTF-8 sequence start (callers ensure that).
+fn utf8_char_len(bytes: &[u8], i: usize) -> usize {
+    let b = bytes[i];
+    if b < 0x80 { 1 }
+    else if b < 0xC0 { 1 }  // continuation byte — defensive, shouldn't start here
+    else if b < 0xE0 { 2 }
+    else if b < 0xF0 { 3 }
+    else { 4 }
+}
+
+#[cfg(test)]
+mod sanitize_tests {
+    use super::*;
+
+    #[test]
+    fn redact_path_at_offset_zero() {
+        // Regression: opus BLOCK 2026-05-02. Old impl returned Some("")
+        // when err started with "/home/", erasing the whole message.
+        let out = redact_paths("/home/profit/lakehouse/data/lance not a directory");
+        assert_eq!(out, "[REDACTED] not a directory");
+    }
+
+    #[test]
+    fn redact_keeps_pre_and_post_text() {
+        let out = redact_paths("failed to open /home/profit/lakehouse/data/x for read: ENOENT");
+        assert_eq!(out, "failed to open [REDACTED] for read: ENOENT");
+    }
+
+    #[test]
+    fn redact_multiple_paths() {
+        let out = redact_paths("at /root/.cargo/registry/src/index.crates.io-foo/lance-table-4.0.0/src/io/commit.rs:364:26 from /home/profit/lakehouse");
+        assert!(!out.contains("/root/.cargo"));
+        assert!(!out.contains("/home/"));
+        assert!(out.contains("[REDACTED]"));
+    }
+
+    #[test]
+    fn redact_preserves_quote_terminator() {
+        let out = redact_paths("{\"path\":\"/home/profit/x\",\"err\":\"bad\"}");
+        assert_eq!(out, "{\"path\":\"[REDACTED]\",\"err\":\"bad\"}");
+    }
+
+    #[test]
+    fn is_not_found_narrow_dataset_only() {
+        // Regression: opus WARN 2026-05-02. Old impl 404'd on any "not
+        // found" — including legitimate column/field-not-found 500s.
+        let (status, _) = sanitize_lance_err(
+            "column not found: vector".into(), "test_idx",
+        );
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+
+        let (status, _) = sanitize_lance_err(
+            "dataset not found at /home/profit/lakehouse/data/lance/missing".into(), "test_idx",
+        );
+        assert_eq!(status, StatusCode::NOT_FOUND);
+    }
+
+    #[test]
+    fn redact_does_not_match_prefix_substring() {
+        // /etcetera should NOT trigger /etc redaction.
+        let out = redact_paths("etcetera and /etcd");
+        assert_eq!(out, "etcetera and /etcd");
+    }
+
+    #[test]
+    fn redact_relative_paths_lance_emits() {
+        // 2026-05-02: live missing-index probe surfaced Lance error of the
+        // form "Dataset at path home/profit/lakehouse/data/lance/x was not
+        // found" — leading slash stripped. Need to redact the relative form
+        // when preceded by a word boundary.
+        let out = redact_paths("Dataset at path home/profit/lakehouse/data/lance/x was not found");
+        assert!(!out.contains("home/profit"), "should redact: {out}");
+        assert!(out.contains("Dataset at path"));
+        assert!(out.contains("was not found"));
+    }
+
+    #[test]
+    fn redact_does_not_eat_innocent_prefix_words() {
+        // "homecoming" must NOT trigger "home/" redaction. "Etcetera" must
+        // NOT trigger "etc/" redaction. The word-boundary guard handles this.
+        let out = redact_paths("homecoming etcetera vary tmpfile");
+        assert_eq!(out, "homecoming etcetera vary tmpfile");
+    }
+
+    #[test]
+    fn is_not_found_lance_actual_phrasing() {
+        // Lance's actual error format observed live: "Dataset at path X was
+        // not found: Not found: ...". Must 404, not 500.
+        let (status, _) = sanitize_lance_err(
+            "Dataset at path home/profit/lakehouse/data/lance/x was not found".into(),
+            "x",
+        );
+        assert_eq!(status, StatusCode::NOT_FOUND);
+    }
+
+    #[test]
+    fn is_not_found_excludes_column_field_schema() {
+        // Real 500s with the "not found" phrase that aren't dataset-missing.
+        for err in [
+            "column not found: vector",
+            "field not found in schema: doc_id",
+            "schema not found for dataset xyz",
+        ] {
+            let (status, _) = sanitize_lance_err(err.into(), "test_idx");
+            assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR, "{err}");
+        }
+    }
+
+    #[test]
+    fn is_not_found_does_not_match_unrelated_path_missing() {
+        // Regression: opus WARN at service.rs:1949 from the 2026-05-03
+        // re-scrum. A registry-file error from inside a Lance internal
+        // module should NOT be coerced to 404 just because it contains
+        // "no such file or directory" — it's a real 500.
+        let (status, _) = sanitize_lance_err(
+            "/root/.cargo/registry/src/index.crates.io-foo/lance-table-4.0.0/src/io/commit.rs: no such file or directory".into(),
+            "test_idx",
+        );
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        // (And the path is still redacted in the message.)
+        let (_, msg) = sanitize_lance_err(
+            "/root/.cargo/registry/src/lance-foo/x.rs: no such file or directory".into(),
+            "test_idx",
+        );
+        assert!(!msg.contains("/root/.cargo"), "path leak: {msg}");
+    }
+
+    #[test]
+    fn redact_preserves_multibyte_utf8() {
+        // Regression: opus WARN at service.rs:2018 from the 2026-05-03
+        // re-scrum. Old impl did `out.push(bytes[i] as char)` which
+        // corrupted multi-byte UTF-8 (e.g. a path containing user-supplied
+        // names with non-ASCII characters) into Latin-1 mojibake.
+        let input = "Failed to open /home/profit/工作/data — café not found";
+        let out = redact_paths(input);
+        // The path is redacted...
+        assert!(!out.contains("/home/profit"), "path leak: {out}");
+        // ...AND the multi-byte characters elsewhere are preserved verbatim.
+        assert!(out.contains("café"), "lost UTF-8: {out}");
+        assert!(out.contains("not found"), "lost trailing context: {out}");
+    }
 }
 
 /// Build the IVF_PQ index on the Lance dataset.

scripts/lance_smoke.sh

@@ -33,9 +33,18 @@ PROBE "gateway /v1/health responds" \
   bash -c "curl -sf -m 3 $GATEWAY/v1/health -o /dev/null"
 
 # ── 1. Search returns IVF_PQ results on existing dataset ────────
+# Capture curl status separately so a transport-level failure (gateway
+# down, network broken, timeout) shows up as its own probe — instead of
+# being swallowed by `|| echo '{}'` which would surface as the next jq
+# probe failing with a misleading "no method field" message. Per opus
+# INFO at lance_smoke.sh:38 from the 2026-05-02 scrum.
 RESP=$(curl -sS -m 30 -X POST "$PREFIX/search/$DATASET" \
   -H 'Content-Type: application/json' \
-  -d '{"query":"forklift operator","top_k":3}' 2>/dev/null || echo '{}')
+  -d '{"query":"forklift operator","top_k":3}' 2>/dev/null)
+CURL_RC=$?
+PROBE "search/$DATASET curl reachable (exit 0)" \
+  test "$CURL_RC" = "0"
+[ "$CURL_RC" != "0" ] && RESP='{}'
 PROBE "search/$DATASET returns top-3 lance_ivf_pq results" \
   bash -c "echo '$RESP' | jq -e '.method == \"lance_ivf_pq\" and (.results | length) == 3' >/dev/null"
 
@@ -60,9 +69,12 @@ STATUS=$(curl -sS -m 5 -o /tmp/lance_smoke_500.json -w '%{http_code}' \
 BODY=$(cat /tmp/lance_smoke_500.json)
 PROBE "search/<missing> → 404 (was 500 pre-2026-05-02)" \
   test "$STATUS" = "404"
-# The sanitizer fix specifically: no /home/ or /root/.cargo/ in body.
+# Assert "pattern absent" — `! grep -qE` (NOT `grep -qvE` which is unsound:
+# -v -q exits 0 if ANY line lacks the pattern, so a multi-line body containing
+# both a leak line AND any clean line would false-PASS. Caught 2026-05-02 by
+# opus scrum on the lance backend wave.)
 PROBE "search/<missing> body sanitized — no filesystem leak" \
-  bash -c "echo '$BODY' | grep -qvE '/home/|/root/\.cargo/'"
+  bash -c "! echo '$BODY' | grep -qE '/home/|/root/\.cargo/|/var/|/tmp/'"
 
 # ── 5. build_index on missing dataset also sanitized ────────────
 STATUS=$(curl -sS -m 5 -o /tmp/lance_smoke_idx.json -w '%{http_code}' \
@@ -71,7 +83,7 @@ STATUS=$(curl -sS -m 5 -o /tmp/lance_smoke_idx.json -w '%{http_code}' \
   -d '{}')
 BODY=$(cat /tmp/lance_smoke_idx.json)
 PROBE "index/<missing> body sanitized" \
-  bash -c "echo '$BODY' | grep -qvE '/home/|/root/\.cargo/'"
+  bash -c "! echo '$BODY' | grep -qE '/home/|/root/\.cargo/|/var/|/tmp/'"
 
 # ── 6. append validates input shape (rejects empty rows array) ──
 STATUS=$(curl -sS -m 5 -o /dev/null -w '%{http_code}' \

tests/real-world/scrum_master_pipeline.ts

@@ -37,6 +37,13 @@ const MAX_ATTEMPTS = 9;
 // crates/<crate>/src/*.rs.
 const FILE_TREE_SPLIT_THRESHOLD = Number(process.env.LH_SCRUM_TREE_SPLIT_THRESHOLD ?? 6000);
 const FILE_SHARD_SIZE = Number(process.env.LH_SCRUM_SHARD_SIZE ?? 3500);
+
+// Centralized to keep MAP and REDUCE phases in lockstep — diverging the two
+// breaks tree-split consistency (per-shard digests must come from the same
+// model the reducer collapses). Surfaced 2026-05-02 by kimi scrum WARN at
+// scrum_master_pipeline.ts:1143.
+const TREE_SPLIT_MODEL = "gemini-3-flash-preview";
+const TREE_SPLIT_PROVIDER = "ollama_cloud";
 // Same-model retry budget after observer rejection. After this many
 // quality rejects on the current model, advance to the next provider-
 // error fallback. Counts ONLY observer/quality rejects, not provider
@@ -1143,15 +1150,15 @@ Format each as a code-fenced block with the byte offset within the shard:
 EXACT LINE OF SOURCE — DO NOT PARAPHRASE, DO NOT TRUNCATE
 \`\`\`
 Pick the most reviewer-relevant lines: route definitions (e.g. \`@app.route(...)\`), function signatures, security-sensitive calls (auth/SQL/exec/template/secrets), hardcoded credentials/defaults, exception handlers, sensitive imports. The reviewer will REFUSE to act on any claim not backed by a verbatim anchor — so anchors are how you prove findings are real.`;
-    // 2026-04-28: gpt-oss:120b → gemini-3-flash-preview via Ollama
-    // Pro. Tree-split MAP fires once per shard (potentially 5-20×
-    // per file), so latency dominates total scrum time. Gemini 3
-    // flash returns shard digests substantially faster than the old
-    // 120B free model while staying strong enough for byte-anchored
+    // 2026-04-28: gpt-oss:120b → TREE_SPLIT_MODEL via Ollama Pro.
+    // Tree-split MAP fires once per shard (potentially 5-20× per
+    // file), so latency dominates total scrum time. Gemini 3 flash
+    // returns shard digests substantially faster than the old 120B
+    // free model while staying strong enough for byte-anchored
     // extraction.
     const r = await chat({
-      provider: "ollama_cloud",
-      model: "gemini-3-flash-preview",
+      provider: TREE_SPLIT_PROVIDER,
+      model: TREE_SPLIT_MODEL,
       prompt,
       max_tokens: 900,
     });
@@ -1201,14 +1208,14 @@ COPY EVERY anchor block from the piece notes IN ORDER, character-perfect. DO NOT
 
 Output the anchor blocks under their original \`\`\`@offset...\`\`\` fences, each on its own with a blank line between. The reviewer rejects findings that don't quote a string from this anchors block, so completeness here directly determines review quality.`;
 
-  // 2026-04-28: gpt-oss:120b → gemini-3-flash-preview via Ollama
-  // Pro. The reducer runs once per file (vs once per shard for MAP)
-  // but on a much larger context (all shard digests stacked), so
-  // throughput per token still matters. Same model as MAP for
-  // consistency in tree-split outputs.
+  // 2026-04-28: gpt-oss:120b → TREE_SPLIT_MODEL via Ollama Pro. The
+  // reducer runs once per file (vs once per shard for MAP) but on a
+  // much larger context (all shard digests stacked), so throughput
+  // per token still matters. Must match MAP model exactly — diverging
+  // the two breaks tree-split coherence.
   const reduced = await chat({
-    provider: "ollama_cloud",
-    model: "gemini-3-flash-preview",
+    provider: TREE_SPLIT_PROVIDER,
+    model: TREE_SPLIT_MODEL,
     prompt: reducePrompt,
     max_tokens: 2400,
   });