v2.39.0 — the review-convergence rules: a two-round cap, the cosmetic class, and dispatch_count

Ports the three rules the reference plugin shipped in 1.74.0 to Copilot, adapted to this port's own surfaces rather than pasted. Three chained tasks, released once (v2.37.0, v2.38.0 and v2.39.0 are tagged for history).

The two-round review cap (v2.37.0)

Two review rounds is the ceiling, and the second verifies rather than re-reviews. Round two's mission is scoped; its evidence is not — it still receives the full diff. After round two, remaining important and minor findings are recorded rather than fixed; a critical is exempt and blocks at any round number; and a security finding is never recorded at any severity.

A round is re-expressed in surfaces this port actually has: a task-reviewer dispatch whose response yielded a parsable fenced json block. The reference anchors on a merged-result file this port does not carry. No counter file was invented — an agent-written marker only an agent reads is exactly as skippable as the instruction it replaces, and no hook here can observe an agent dispatch — so the count lives in context and an unestablishable round fails closed to round two. The cap is prose, not a pin, and says so.

The cosmetic finding class (v2.38.0)

An optional cosmetic boolean on reviewer issues[] entries. Presentational-only findings are still emitted with honest severity and category, still reported, still recorded — the only thing the flag changes is that a round finding nothing else buys no further round. Never valid on a critical, an important, or a security finding. schema_version 1.6 → 1.7.

The definition carries all three of the reference's gates — the finding's claim is correct, the artifact asserts nothing false, and the subject is purely presentational — plus its default-deny. Gate three is explicitly not present-tense: "nothing behaves differently today" does not satisfy it.

dispatch_count review-cost telemetry (v2.39.0)

An optional count on the reviewer workflow_steps entry — dispatches, not rounds, including a re-dispatch after a crash. The six limits ship with the key, because a figure trusted past its accuracy is worse than no figure: wall-clock is not token cost, the two keys measure different populations so the division is meaningless, a review-skipped task can have real cost and record none, an omitted count must not be imputed, a crash cannot be told from an extra round, and nothing validates the value on the way in.

No seventh workflow_steps name was added, and the optional sub-step dispatches still fold into the reviewer entry.

What this port says that the reference does not

• The round count is recoverable from no artifact at all, in flight or afterwards — this port carries neither reconciling file, so a compliant dispatch_count of 3 must never be read as a cap breach.
• The security rule keys on subject matter, not the category string, so a security-relevant finding filed under code_quality or pitfall is still fixed or escalated.
• Nothing here can measure a dispatch count. hooks.json wires only Bash tool events and the stop gate, so the figure is self-reported by the orchestrator — a record of what it says it did, not a measurement.

Every rule that cannot be mechanically enforced here says so in shipped text, and the guard obligation for the unvalidated key is assigned to its first consumer.

Coverage

Test Groups 23, 24 and 25 (bash) and 20, 21 and 22 (PowerShell), mirrored case-for-case. Group 25 includes a port-wide sweep requiring every competing re-review mandate to defer to the ceiling — the case that caught a real contradiction across nine sites — plus pins that catch a stale schema mirror, a drifted numeral, and a stale gate count. Full suites: bash 653/653, PowerShell 541/541.