@@ -48,17 +48,22 @@ reviews:
           instructions: >-
               Act as an adversarial second-opinion reviewer. Verify PR claims against implementation and
               contracts. Trace changed inputs through normal, boundary, error, cancellation, retry, and
-              default paths and their consumers. Seek plausible counterexamples and regressions from removed
-              safeguards. Identify assumptions in changed code that depend on facts outside the diff. First
-              verify repository conventions, tests, and related implementations. When a potential finding
-              depends on external behavior, use web search and prefer official documentation, specifications,
-              or upstream repositories. Report only concrete, actionable conflicts or failure modes, citing
-              the relevant repository location or external source. Prioritize correctness, security, data loss,
-              lifecycle, and test gaps. Do not report generic best practices, unsupported concerns, speculative
-              style comments, or unrelated refactors. When changed code introduces a local implementation of a
-              cross-cutting concern, check whether it bypasses or duplicates an established repository abstraction
-              or nearby convention. Report only a concrete inconsistency with behavioral or maintenance impact,
-              and allow intentional deviations.
+              default paths and their direct test counterparts. Do not flag defects in files not changed by
+              this PR unless the defect is directly triggered by changed code and cannot be detected in the
+              changed file alone. Seek plausible counterexamples and regressions from removed safeguards.
+              Identify assumptions in changed code that depend on facts outside the diff. First verify
+              repository conventions, tests, and related implementations. When a potential finding depends on
+              external behavior, use web search and prefer official documentation, specifications, or upstream
+              repositories. Report only concrete, actionable conflicts or failure modes, citing the relevant
+              repository location or external source. Prioritize correctness, security, data loss, lifecycle,
+              and test gaps. Do not report generic best practices, unsupported concerns, speculative style
+              comments, or unrelated refactors. When changed code introduces a local implementation of a
+              cross-cutting concern, check whether it bypasses or duplicates an established repository
+              abstraction or nearby convention. Report only a concrete inconsistency with behavioral or
+              maintenance impact, and allow intentional deviations. Treat the linked issue and this PR
+              description as the scope boundary. When a confirmed defect needs work beyond that boundary
+              and this PR does not create the hazard, do not request changes for it. List it once in the
+              walkthrough under follow-up candidates, with one line for the trigger.
 
         - path: "**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}"
           instructions: >-
 
@@ -90,6 +90,8 @@ jobs:
               run: pnpm lint
             - name: Check types
               run: pnpm check-types
+            - name: Validate Code QA workflow
+              run: pnpm test:code-qa-ci
             - name: Model-check task lifecycle protocols
               run: pnpm lifecycle:model-check
             - name: Validate MCP OAuth integration
@@ -125,17 +127,21 @@ jobs:
     unit-test:
         name: platform-unit-test (${{ matrix.name }})
         runs-on: ${{ matrix.os }}
+        concurrency:
+            # Duplicate runs for one commit must not race the OS-specific Turbo cache save.
+            group: unit-test-${{ github.repository }}-${{ github.sha }}-${{ matrix.name }}
+            cancel-in-progress: false
         strategy:
             matrix:
                 include:
                     - os: ubuntu-latest
                       name: ubuntu-latest
                       codecov-flag: ubuntu
-                      upload-coverage: true
+                      collect-coverage: true
                     - os: windows-latest
                       name: windows-latest
                       codecov-flag: windows
-                      upload-coverage: false
+                      collect-coverage: false
         steps:
             - name: Checkout code
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -150,20 +156,56 @@ jobs:
                   restore-keys: |
                       ${{ runner.os }}-turbo-${{ hashFiles('**/pnpm-lock.yaml') }}-
                       ${{ runner.os }}-turbo-
+            # Windows never uploads coverage, so Windows runs the same test
+            # suites through the uninstrumented Turbo tasks. Ubuntu stays the
+            # authoritative coverage lane.
             - name: Run non-extension package coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
-            - name: Run extension unit coverage
-              run: pnpm turbo run test:coverage:unit --filter="zoo-code" --log-order grouped --output-logs new-only
+            - name: Run non-extension package tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test --filter="!@roo-code/core" --filter="!zoo-code" --log-order grouped --output-logs new-only
+            - name: Run extension coverage lanes
+              if: matrix.collect-coverage
+              run: pnpm turbo run test:coverage:api test:coverage:core test:coverage:services test:coverage:misc test:coverage:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
+            - name: Run extension test lanes
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:api test:core test:services test:misc test:tree-sitter --filter="zoo-code" --concurrency=2 --log-order grouped --output-logs new-only
             - name: Verify extension coverage contract
+              if: matrix.collect-coverage
               run: pnpm --dir src run verify:coverage-contract
             - name: Run extension dist smoke test
               run: pnpm turbo run test:dist --filter="zoo-code" --log-order grouped --output-logs new-only
             - name: Run core unit coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Run core unit tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:unit --filter="@roo-code/core" --log-order grouped --output-logs new-only
             - name: Run core integration coverage
+              if: matrix.collect-coverage
               run: pnpm turbo run test:coverage:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
-            - name: Verify extension unit coverage report
-              run: node src/scripts/verify-lcov.mjs src/coverage/unit/lcov.info
+            - name: Run core integration tests
+              if: ${{ !matrix.collect-coverage }}
+              run: pnpm turbo run test:integration --filter="@roo-code/core" --log-order grouped --output-logs new-only
+            - name: Verify extension coverage reports
+              if: matrix.collect-coverage
+              run: |
+                  node src/scripts/verify-lcov.mjs src/coverage/api/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/core/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/services/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/misc/lcov.info
+                  node src/scripts/verify-lcov.mjs src/coverage/tree-sitter/lcov.info
+            - name: Merge extension coverage reports
+              if: matrix.collect-coverage
+              run: |
+                  mkdir -p src/coverage/merged
+                  pnpm --dir src run merge:coverage
+                  node src/scripts/verify-lcov.mjs src/coverage/merged/lcov.info
+            # Validate cache boundaries before publishing any new Turbo entries.
+            - name: Verify coverage cache inputs
+              if: matrix.collect-coverage
+              run: pnpm --dir src run verify:coverage-cache-inputs
             - name: Save Turbo cache
               if: steps.turbo-cache.outputs.cache-hit != 'true'
               uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -175,54 +217,58 @@ jobs:
             # there mostly adds Codecov overhead without changing pass/fail
             # behavior.
             # Coverage is uploaded in separate steps so each LCOV gets the
-            # correct flag set. Codecov double-counts overlapping lines when a
-            # single upload carries multiple flags whose paths overlap, so the
-            # core lanes and webview lane must be uploaded individually with
-            # their own flag.
+            # correct flag set. Extension lanes instrument the same sources, so
+            # union them before upload; a line is covered when any lane executes
+            # it. Core and webview reports retain their independent flags.
             # See https://docs.codecov.com/docs/flags
             - name: Upload non-core coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: >-
-                      src/coverage/unit/lcov.info,
+                      src/coverage/merged/lcov.info,
                       packages/cloud/coverage/lcov.info,
                       packages/telemetry/coverage/lcov.info,
                       apps/cli/coverage/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }}
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload webview JSDOM coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: webview-ui/coverage/lcov.info
                   disable_search: true
                   flags: webview-ui
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core unit coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/unit/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-unit
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload core integration coverage to Codecov
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
               with:
                   files: packages/core/coverage/integration/lcov.info
                   disable_search: true
                   flags: ${{ matrix.codecov-flag }},core-integration
                   token: ${{ secrets.CODECOV_TOKEN }}
             - name: Upload coverage reports to GitHub
-              if: matrix.upload-coverage
+              if: matrix.collect-coverage
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: coverage-reports-${{ matrix.name }}
                   path: |
-                      src/coverage/unit/lcov.info
+                      src/coverage/api/lcov.info
+                      src/coverage/core/lcov.info
+                      src/coverage/services/lcov.info
+                      src/coverage/misc/lcov.info
+                      src/coverage/tree-sitter/lcov.info
+                      src/coverage/merged/lcov.info
                       webview-ui/coverage/lcov.info
                       packages/cloud/coverage/lcov.info
                       packages/telemetry/coverage/lcov.info