0.14.0 — round-3 review wave: hardening across 7 modules

0.14.0 — round-3 review wave: hardening across 7 modules

Review-wave hardening (round-3 findings) across gh · fff · repair · shells · jfind · a2a · web, +8 regression suites, tests now 2792 (was 2750).

Highlights

• gh — the /config run_watch budget row passed its working value by value: every save wrote the original value back with a false "Saved" notify (the setting was silently unwritable). Fixed with the todo-module { value } box pattern + a load-bearing NaN guard; round-trip tests drive row edit → save → settings.json.
• fff — in override mode, a guarded() collision on grep/find aborted the whole registration loop (override mode lost resolve_file / fff_multi_grep / related_files too). Registration now degrades per tool with one dim notify naming the skipped tools; normal mode unchanged.
• repair — archive member+range reads (pkg.tgz:src/x.ts:50-80) peel the lines-selector before the member lookup; tar option-injection gate; guard × archive-member target paths; auto-gen guard relative-path correctness.
• shells — since:"last" cursors are now lifetime line counts (a ring-cap shrink could permanently black out output); per-stream cursors; kill refuses pid 0 (kill(-0) = SIGTERM to pi's own process group); name resolution prefers live sessions.
• jfind — file reads honor scanLimitBytes/maxBytes caps with truncation flags; empty single-file scopes surface the eligibility refusal instead of a silent "no hits".
• a2a — A2A_MAX_CONCURRENT env parity; garbage/0 falls back to the default instead of zeroing the admission pool.
• web/read_pdf — lazy pdf.js import via pathToFileURL (spaces in the install path broke the old string form).

Checks: typecheck clean · 2792 tests / 2789 pass / 0 fail · npm pack verified (558 files).