major update

.env.example

@@ -18,6 +18,11 @@ ELIZACLOUD_API_KEY=your-elizacloud-key-here
 # Default model (optional, defaults to gpt-4o):
 # PRR_LLM_MODEL=gpt-4o
 
+# Stronger models for verification / final audit (optional; invalid ids ignored with warning — see shared/config.ts).
+# Order: PRR_FINAL_AUDIT_MODEL → PRR_VERIFIER_MODEL → PRR_LLM_MODEL (README / AGENTS.md).
+# PRR_VERIFIER_MODEL=anthropic/claude-sonnet-4-5-20250929
+# PRR_FINAL_AUDIT_MODEL=anthropic/claude-opus-4-5-20251101
+
 # ElizaCloud: extra 500/502/504 retries inside each complete() (0–15). CI defaults to 5 HTTP attempts when unset; locally 3.
 # PRR_ELIZACLOUD_SERVER_ERROR_RETRIES=6
 
@@ -48,12 +53,18 @@ ELIZACLOUD_API_KEY=your-elizacloud-key-here
 # LLM concurrency (default 1). Raised values speed batches when the gateway allows it.
 # PRR_MAX_CONCURRENT_LLM=3
 
+# Min ms between ElizaCloud request starts per concurrent slot (default from shared/constants/models.ts).
+# PRR_LLM_MIN_DELAY_MS=6000
+
 # Optional: max ms per concurrent pool task (batch analysis / parallel fix groups). Unset or 0 = no cap.
 # PRR_LLM_TASK_TIMEOUT_MS=600000
 
+# llm-api fixer: client wait per HTTP attempt when NOT in full-file rewrite mode. Unset = auto (90s, then 120s/150s/180s by prompt size). Full-file rewrite always uses 180s unless you change code constants.
+# PRR_LLM_API_REQUEST_TIMEOUT_MS=240000
+
 # Skip a fixer model for the rest of the run after this many verification failures with zero verified fixes (default 4). Set to 0 to disable.
 # PRR_SESSION_MODEL_SKIP_FAILURES=4
-# Every N fix iterations, clear session-skipped models so rotation retries them (0 = off). Pill-output #847.
+# After N fix iterations since each model was session-skipped, drop that skip so rotation can retry (0 = off). Pill-output #847.
 # PRR_SESSION_MODEL_SKIP_RESET_AFTER_FIX_ITERATIONS=8
 
 # Warn once after this many consecutive iterations with no new verified fixes (default 10). Set to 0 to disable.
@@ -72,8 +83,10 @@ ELIZACLOUD_API_KEY=your-elizacloud-key-here
 # Catalog model advice (see AGENTS.md): disable 0a6 dismissal and/or quoted-literal auto-heal.
 # PRR_DISABLE_MODEL_CATALOG_SOLVABILITY=1
 # PRR_DISABLE_MODEL_CATALOG_AUTOHEAL=1
+# Override committed JSON snapshot (default: generated/model-provider-catalog.json). Malformed file → empty catalog + warn.
+# PRR_MODEL_CATALOG_PATH=/path/to/model-provider-catalog.json
 
-# Thread replies: set to the GitHub login that posts replies so re-runs skip duplicate posts.
+# Thread replies: optional override for cross-run idempotency (default: token login from GET /user).
 # PRR_BOT_LOGIN=my-bot
 # PRR_REPLY_TO_THREADS=true
 # Also reply on threads dismissed as chronic-failure (default: no — batch token-saving dismissals).
@@ -88,9 +101,28 @@ ELIZACLOUD_API_KEY=your-elizacloud-key-here
 # Exit setup before clone when GitHub says PR is not mergeable / dirty (unless you pass --merge-base).
 # PRR_EXIT_ON_UNMERGEABLE=1
 
-# On PR HEAD change: clear every dismissal (default clears only "already-fixed" dismissals).
+# On PR HEAD change: clear every dismissal category (default clears already-fixed, chronic-failure, stale; keeps e.g. not-an-issue).
 # PRR_CLEAR_ALL_DISMISSED_ON_HEAD=1
 
+# Fixer allowlist: strict first-segment filter (static REPO_TOP_LEVEL + PR changed-file roots).
+# Default (unset): open — any repo-relative path is OK except absolute, node_modules, dist/, .cursor, .prr.
+# WHY default open: unknown roots like agent/ were silently stripped from allowedPaths → no injection, wasted iterations (Cycle 72).
+# WHY set strict: comment bodies that paste dependency-style paths; pair with PR diff so touched roots still whitelist.
+# PRR_STRICT_ALLOWED_PATHS=1
+
+# Max new bot review threads to enqueue per mid–fix-loop batch (0 = unlimited). Default 45.
+# PRR_MID_LOOP_NEW_COMMENT_CAP=45
+
+# Blast radius (changed files + import graph + proximity) — deprioritize / optional dismiss / narrower injection:
+# WHY: Order and llm-api injection focus on PR-related files; fixer allowlist stays full (see README "Blast radius").
+# Graph uses async FS in specifier-resolver; timeout/max-files abort → all issues in-scope (no silent skip).
+# PRR_DISABLE_BLAST_RADIUS=1
+# PRR_BLAST_RADIUS_DEPTH=2
+# PRR_BLAST_RADIUS_DISMISS=1
+# PRR_BLAST_RADIUS_MAX_FILES=5000
+# PRR_BLAST_RADIUS_TIMEOUT_MS=30000
+# PRR_BLAST_RADIUS_MAX_DIR_NEIGHBORS=30
+
 # Dry-merge probes after fetch (git merge-tree; warns before pull if conflicts):
 # PRR_DISABLE_LATENT_MERGE_PROBE=1          # skip HEAD vs origin/<prBranch>
 # PRR_DISABLE_LATENT_MERGE_PROBE_BASE=1     # skip HEAD vs origin/<prBase> (GitHub mergeable/dirty)
@@ -99,9 +131,16 @@ ELIZACLOUD_API_KEY=your-elizacloud-key-here
 # PRR_MATERIALIZE_LATENT_MERGE=1            # merge origin/<prBranch> --no-commit
 # PRR_MATERIALIZE_LATENT_MERGE_BASE=1       # merge origin/<prBase> --no-commit
 
+# Clone / fetch (ms). Large or slow remotes: raise timeouts (README Troubleshooting / AGENTS.md).
+# PRR_CLONE_TIMEOUT_MS=900000
+# PRR_FETCH_TIMEOUT_MS=120000
+
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 # Pill (log audit — optional, e.g. prr --pill)
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 # When tools/prr exists under the pill target directory, drop improvements whose file paths
 # look like the PR clone (src/, packages/, …). Set to 0 to record everything the LLM returns.
 # PILL_TOOL_REPO_SCOPE_FILTER=0
+# Rerun pill on explicit log files (absolute or cwd-relative). CLI --output-log / --prompts-log wins.
+# PILL_OUTPUT_LOG_PATH=/path/to/output.log
+# PILL_PROMPTS_LOG_PATH=/path/to/prompts.log